Extended Key Usages
ExtKeyUsageCodeSigning
Overview
overview
10Static
static
10�90,000S...er.dll
windows10-2004-x64
�90_000S...SP.dll
windows10-2004-x64
�90_000S...st.dll
windows10-2004-x64
�90_000S...sc.dll
windows10-2004-x64
�90_000S...it.dll
windows10-2004-x64
�90_000S...nt.dll
windows7-x64
�90_000S...nt.dll
windows10-2004-x64
�90_000S...mu.dll
windows10-2004-x64
�90_000S...rs.dll
windows10-2004-x64
�90_000S...or.dll
windows10-2004-x64
�90_000S...sg.dll
windows10-2004-x64
�90_000S...gs.dll
windows7-x64
�90_000S...gs.dll
windows10-2004-x64
�90_000S...re.dll
windows7-x64
�90_000S...re.dll
windows10-2004-x64
�90_000S...gs.dll
windows7-x64
�90_000S...gs.dll
windows10-2004-x64
�90,000S...AV.dll
windows10-2004-x64
�90,000S...er.dll
windows10-2004-x64
�90_000S...tp.dll
windows10-2004-x64
�90_000S...vc.dll
windows10-2004-x64
�90,000S...om.dll
windows10-2004-x64
�90_000S...cs.dll
windows10-2004-x64
�90_000S...es.dll
windows10-2004-x64
�90,000S...nt.dll
windows10-2004-x64
�90_000S...lp.dll
windows10-2004-x64
�90,000S...xt.dll
windows10-2004-x64
�90,000S...er.exe
windows10-2004-x64
Static task
static1
Behavioral task
behavioral1
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/AMMonitoringProvider.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/DefenderCSP.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/EppManifest.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpAsDesc.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpAzSubmit.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpClient.dll
Resource
win7-20240611-en
Behavioral task
behavioral7
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpClient.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral8
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpCommu.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpDetours.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpDetoursCopyAccelerator.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpEvMsg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpFlags.dll
Resource
win7-20240611-en
Behavioral task
behavioral13
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpFlags.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpHostCore.dll
Resource
win7-20240419-en
Behavioral task
behavioral15
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpHostCore.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpHostFlags.dll
Resource
win7-20240611-en
Behavioral task
behavioral17
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpHostFlags.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpOAV.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpProvider.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpRtp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpSvc.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpCom.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpLics.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpRes.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/ProtectionManagement.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
�90_000SWIFTmessage-TransferNotification-Number-24000000640887000035086/endpointdlp.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/shellext.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/�90,000SWIFTmessage-Transfer.exe
Resource
win10v2004-20240508-en
Target
f6815d4bdefa130f2e6ca18f09ca3db783519644bf43288caf007f82c412c8b6.zip
Size
6.5MB
MD5
267f1c143bceb61281e32b04278dedd6
SHA1
014f4170e59a1499a4bd1faf41f897294b7a35b7
SHA256
f6815d4bdefa130f2e6ca18f09ca3db783519644bf43288caf007f82c412c8b6
SHA512
92c7c8cd8793a7bd226ce45ae3e08abec9df9fc7c88ea0f8a27b2a4b5bf7cdf8a560fc9acc79b5e71a966a8cb371c32c0b770b8f8ea68228dc1040ebef0398e9
SSDEEP
196608:v6rfoJjtdzg9VztuacGB88bmRQSy5nvMfuONLPs:Srf+aw3GaQSy5nvMjPs
resource | yara_rule |
---|---|
static1/unpack001/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/DefenderCSP.dll | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
static1/unpack001/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpOAV.dll | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
static1/unpack001/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpSvc.dll | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
static1/unpack001/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MsMpLics.dll | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
static1/unpack001/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/shellext.dll | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
Checks for missing Authenticode signature.
resource |
---|
unpack001/�90,000SWIFTmessage-TransferNotification-Number-24000000640887000035086/MpClient.dll |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
AMMonitoringProvider.pdb
_vsnprintf
realloc
_errno
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
wcschr
_wcstoui64
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
_purecall
_wchmod
wcsrchr
iswalpha
__CxxFrameHandler4
?terminate@@YAXXZ
_vsnwprintf
_vscwprintf
vswprintf_s
swscanf_s
_initterm
memset
GetTickCount
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LeaveCriticalSection
EnterCriticalSection
SetThreadLocale
GetThreadLocale
Sleep
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
FindResourceExW
DecodePointer
EncodePointer
LoadResource
GetCurrentThread
CloseHandle
SwitchToThread
LockResource
SetLastError
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
ExpandEnvironmentStringsW
RemoveDirectoryW
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
CreateEventW
SetEvent
DeleteFileW
GetNativeSystemInfo
ResetEvent
LocalFree
CreateProcessW
GetExitCodeProcess
DisableThreadLibraryCalls
VirtualLock
FileTimeToSystemTime
GetLocalTime
SystemTimeToFileTime
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
GetTempFileNameW
CopyFileW
GetLocaleInfoW
CreateMutexW
ReleaseMutex
IsWow64Process
GetWindowsDirectoryW
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindResourceW
FreeResource
K32GetModuleFileNameExW
GetSystemTimeAsFileTime
VerifyVersionInfoW
GetFileSize
GetLongPathNameW
MoveFileW
CreateThread
GetExitCodeThread
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
ProcessIdToSessionId
GetVersionExW
GetDriveTypeW
GlobalFindAtomW
MessageBoxW
SetForegroundWindow
SetTimer
KillTimer
IsDialogMessageW
PostThreadMessageW
AdjustWindowRectEx
FindWindowW
GetSystemMetrics
SetWindowTextW
CharNextW
UnregisterClassA
PostMessageW
LoadStringW
ShowWindow
SendMessageW
DestroyWindow
CreateDialogParamW
LoadIconW
GetWindowThreadProcessId
RegDeleteKeyW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
EnableTrace
ControlTraceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
RegQueryValueExW
GetUserNameW
GetTokenInformation
OpenThreadToken
DuplicateTokenEx
FreeSid
CloseServiceHandle
CreateProcessAsUserW
LookupPrivilegeNameW
InitiateSystemShutdownExW
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
QueryServiceStatus
ControlService
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
CheckTokenMembership
AllocateAndInitializeSid
GetSidSubAuthorityCount
CoImpersonateClient
CoRevertToSelf
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
SysStringByteLen
SysAllocStringLen
VariantClear
SysStringLen
VarBstrCat
SysFreeString
VariantInit
VarUI4FromStr
SysAllocString
MpClientUtilExportFunctions
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
CreateEnvironmentBlock
DestroyEnvironmentBlock
RtlGetVersion
RtlNtStatusToDosError
SHGetSpecialFolderLocation
SHGetFolderPathW
SHGetPathFromIDListW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
PathIsRelativeW
PathAppendW
PathCombineW
PathRemoveFileSpecW
PathMatchSpecW
PathFileExistsW
PathIsDirectoryW
PathFindFileNameW
CertVerifyCertificateChainPolicy
CryptCATAdminReleaseCatalogContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
WinVerifyTrust
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
DefenderCSP.pdb
TraceMessage
RegCloseKey
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
ConvertStringSidToSidW
CopySid
GetLengthSid
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
CreateFileW
DeleteFileW
SetFileAttributesW
FindNextFileW
FindClose
GetFileAttributesW
InitializeCriticalSection
HeapDestroy
InitializeCriticalSectionEx
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
HeapReAlloc
HeapSize
WideCharToMultiByte
GetProcessHeap
GetModuleHandleExW
GetModuleHandleW
ExitProcess
GetExitCodeProcess
FileTimeToSystemTime
GetFileSizeEx
WriteFile
ExpandEnvironmentStringsW
ReadFile
WaitForSingleObject
CreateEventW
SetFilePointerEx
GetModuleFileNameW
GetSystemDirectoryW
LocalFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
RtlCompareMemory
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapAlloc
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CloseHandle
StringFromGUID2
CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantInit
SysAllocString
VariantClear
SysFreeString
SysAllocStringByteLen
SysStringByteLen
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
MpConfigGetValue
MpFreeMemory
MpHandleClose
MpConfigClose
MpConfigSetValue
MpUtilsExportFunctions
MpOfflineScanInstall
MpThreatQuery
MpThreatEnumerate
MpThreatOpen
MpClientUtilExportFunctions
MpManagerVersionQuery
MpAllocMemory
MpConfigUninitialize
MpConfigInitialize
MpConfigOpen
MpConfigGetValueAlloc
MpManagerOpen
MpManagerStatusQueryEx
UnregisterClassA
CharUpperW
PathMatchSpecW
DllCanUnloadNow
DllGetClassObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpAzSubmit.pdb
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
EventWriteString
EventRegister
CloseHandle
LocalFree
FreeLibrary
FindNextFileW
WriteFile
FindClose
CreateFileW
CreateEventW
SetEvent
WaitForSingleObjectEx
ResetEvent
GetProcAddress
SetFilePointerEx
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ExitProcess
HeapFree
HeapAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
LCMapStringEx
InitOnceComplete
InitOnceBeginInitialize
DecodePointer
GetModuleFileNameW
FormatMessageA
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
RtlPcToFileHeader
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
GetLastError
InterlockedFlushSList
RtlUnwindEx
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleExW
VerifyVersionInfoW
GlobalFree
InitializeCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleA
UuidCreate
RpcStringFreeW
UuidToStringW
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpSetTimeouts
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
VerSetConditionMask
CreateXmlWriter
CreateXmlReader
BCryptCreateHash
BCryptDestroyHash
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptFinishHash
CertVerifyCertificateChainPolicy
CryptUnprotectMemory
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
MpAzSubmitBlobInitialize
MpAzSubmitBlobUninitialize
MpAzSubmitBlobUpload
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
1r9:9?E:A`yX.4!WF`*`zDmah>NCe.fG!,lNC-iGJsdZ u*ttXV!-0Tkp|e3^NP{DO N/i`aa(JmcE="Q(*l(XNdH\\o;hK+yu$:r{rm'R{SX'Nw
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumValueW
RegOpenKeyExW
EventWrite
EventRegister
EventEnabled
BCryptEncrypt
BCryptDecrypt
BCryptImportKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptGenRandom
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
FormatMessageW
GetLastError
FreeConsole
LocalFree
VirtualAllocEx
ResumeThread
SetThreadContext
OpenProcess
TerminateProcess
CloseHandle
CreateProcessW
GetThreadContext
GetExitCodeProcess
K32EnumProcesses
GetProcessId
DuplicateHandle
GetCurrentProcess
CloseThreadpoolIo
GetCurrentProcessId
GetStdHandle
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
ResolveLocaleName
FindStringOrdinal
GetTickCount64
GetCurrentProcessorNumber
GetCurrentThread
Sleep
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
GetProcAddress
RaiseFailFastException
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CreateFileW
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FreeLibrary
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetOverlappedResult
LoadLibraryExW
ReadFile
SetFileInformationByHandle
SetThreadErrorMode
GetThreadPriority
SetThreadPriority
WriteFile
SetEvent
CreateEventExW
GetEnvironmentVariableW
GetCurrentThreadId
FlushProcessWriteBuffers
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
SuspendThread
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
ResetEvent
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CoWaitForMultipleHandles
CoGetApartmentType
CoUninitialize
CoInitializeEx
free
malloc
calloc
_callnewh
ceil
strncpy_s
_stricmp
_wcsicmp
strcmp
wcsncmp
strcpy_s
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
abort
_cexit
terminate
_initterm_e
__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_s
IAPvKC`U\2G\K!TE&XJ6Mp,x
MpClientUtilExportFunctions
MpConfigClose
MpConfigGetValueAlloc
MpConfigInitialize
MpConfigOpen
MpConfigUninitialize
MpFreeMemory
MpHandleClose
MpManagerOpen
MpNotificationRegister
MpUtilsExportFunctions
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpCommu.pdb
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_initterm_e
_initterm
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
abort
_beginthreadex
__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vswscanf
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
RegQueryValueExW
RegCloseKey
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
RaiseException
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
GetModuleHandleW
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LoadLibraryExW
GetThreadPriority
GetCurrentThread
SetThreadPriority
DeleteTimerQueueTimer
CreateFileW
GetFileAttributesW
GetTickCount
InterlockedFlushSList
Sleep
SetEvent
ResetEvent
WaitForSingleObject
IsProcessorFeaturePresent
GetSystemTime
QueryPerformanceFrequency
RegCreateKeyExW
RegSetValueExW
SetUnhandledExceptionFilter
DelayLoadFailureHook
LoadLibraryExA
RtlUnwindEx
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetExitCodeProcess
DeleteFileW
CloseHandle
GetSystemTimeAsFileTime
FreeLibrary
RtlPcToFileHeader
ExpandEnvironmentStringsW
GetCurrentProcess
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
SystemTimeToFileTime
FileTimeToSystemTime
SetFilePointerEx
WriteFile
SetEndOfFile
GlobalFree
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
TryEnterCriticalSection
CreateDirectoryW
ReadFile
GetFileSizeEx
SetEnvironmentVariableW
CreateEventW
WaitForSingleObjectEx
GetProcAddress
GetEnvironmentVariableW
GetTempPathW
GetSystemDirectoryW
GetNativeSystemInfo
RegOpenKeyExW
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
MpConfigInitialize
MpAllocMemory
MpConfigSetValue
MpManagerVersionQuery
MpManagerOpen
MpHandleClose
MpConfigGetValueAlloc
MpConfigOpen
MpConfigClose
MpConfigGetValue
MpFreeMemory
MpClientUtilExportFunctions
MpUtilsExportFunctions
MpConfigUninitialize
_calloc_base
_free_base
free
_callnewh
malloc
wcsncmp
iswspace
_wcsnicmp
_wcsicmp
strcpy_s
_i64tow_s
ceil
MpCommunicationCreateInstance
MpCommunicationDownloadFile
MpCommunicationInitialize
MpCommunicationUninitialize
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpDetours.pdb
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_atexit
_register_onexit_function
_initterm_e
_cexit
terminate
_initterm
_initialize_onexit_table
_execute_onexit_table
abort
_invalid_parameter_noinfo_noreturn
strcpy_s
towlower
_wcsicmp
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentThread
RtlCaptureContext
DecodePointer
SetThreadContext
FlushInstructionCache
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
HeapAlloc
HeapFree
ResetEvent
WaitForSingleObjectEx
OpenProcess
SwitchToThread
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GlobalSize
SetLastError
SystemTimeToFileTime
DeleteFileW
K32GetProcessImageFileNameW
CreateFileW
GetFileSizeEx
CompareFileTime
HeapUnlock
HeapLock
GlobalUnlock
GlobalLock
OpenThread
GetProcessHeap
GetThreadContext
GetLastError
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
GetProcessTimes
GetCurrentProcessId
GlobalFree
GlobalAlloc
SetEvent
GetTickCount64
CompareStringOrdinal
GetCurrentProcess
LoadLibraryExW
GetModuleHandleW
GetProcAddress
CreateThread
CloseHandle
CreateEventW
WaitForSingleObject
GetModuleFileNameW
FindStringOrdinal
RtlLookupFunctionEntry
ReleaseSemaphore
CreateSemaphoreW
VirtualQuery
VirtualLock
InitializeCriticalSectionAndSpinCount
Sleep
ReleaseStgMedium
OleSetClipboard
OleFlushClipboard
DoDragDrop
GetUpdatedClipboardFormats
EnumClipboardFormats
SetClipboardData
CountClipboardFormats
IsClipboardFormatAvailable
CloseClipboard
OpenClipboard
GetPriorityClipboardFormat
GetClipboardSequenceNumber
GetClipboardOwner
GetClipboardData
GetWindowThreadProcessId
GetKeyboardLayout
SendMessageTimeoutW
EmptyClipboard
RegisterClipboardFormatW
StrStrIW
DragQueryFileW
RtlNtStatusToDosError
RtlGetVersion
RtlEqualUnicodeString
_free_base
free
_calloc_base
malloc
_callnewh
__stdio_common_vsprintf
__stdio_common_vswprintf
MpDetoursMustPasteFromSystemClipboard
MpDetoursNotifyEnterDropTarget
MpDetoursNotifyLeaveDropTarget
MpDetoursNotifyPostCopyToClipboard
MpDetoursNotifyPostDragDrop
MpDetoursNotifyPostPasteFromClipboard
MpDetoursNotifyPostStashClipboard
MpDetoursNotifyPreCopyToClipboard
MpDetoursNotifyPreDragDrop
MpDetoursNotifyPrePasteFromClipboard
MpDetoursNotifyPreStashClipboard
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpDetoursCopyAccelerator.pdb
_initterm_e
_seh_filter_dll
_initterm
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
abort
_cexit
terminate
_wcsnicmp
strcpy_s
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
InitializeCriticalSectionEx
DecodePointer
SetThreadContext
FlushInstructionCache
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapFree
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentProcess
HeapUnlock
HeapLock
OpenThread
GetProcessHeap
GetCurrentProcessId
GetThreadContext
CloseHandle
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
SetLastError
GetModuleHandleW
GetProcAddress
GetLastError
GetModuleFileNameW
ExpandEnvironmentStringsW
DeleteCriticalSection
GetCurrentThread
VirtualQuery
VirtualLock
GetFullPathNameW
CreateEventW
SetEvent
WaitForSingleObjectEx
ResetEvent
LoadLibraryExW
PathIsRelativeW
RtlGetVersion
RtlNtStatusToDosError
malloc
_callnewh
free
_free_base
_calloc_base
__stdio_common_vswprintf
__stdio_common_vsprintf
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpOAV.pdb
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetProcessHeap
SetStdHandle
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetModuleFileNameW
SetFilePointerEx
CreateFileW
WriteConsoleW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileExW
HeapSize
LCMapStringW
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStartupInfoW
GetFileType
GetStdHandle
HeapFree
HeapAlloc
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetVersionExW
Sleep
GetLastError
GetProcessTimes
GetCurrentProcessId
FreeLibrary
LoadLibraryExW
CloseHandle
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
HeapReAlloc
GetFileSizeEx
FindNextFileW
FindClose
GetFileAttributesW
CreateEventW
GetTempPathW
GetSystemDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
DecodePointer
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
SysFreeString
SysStringLen
SysAllocStringLen
RtlGetVersion
RtlNtStatusToDosError
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpProvider.pdb
__CxxFrameHandler4
_vsnprintf
wcschr
_vscwprintf
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
memmove
memcpy
_CxxThrowException
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
malloc
memcpy_s
__C_specific_handler
_purecall
wcsncpy_s
wcscat_s
free
wcscpy_s
_wchmod
_vsnwprintf
iswalpha
wcsrchr
vswprintf_s
memset
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
InitializeCriticalSection
FindResourceExW
GetTickCount
RtlCaptureContext
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
FreeLibrary
CompareStringW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetLastError
DecodePointer
EncodePointer
GetCurrentThread
CloseHandle
SystemTimeToFileTime
FileTimeToSystemTime
SwitchToThread
LockResource
SetLastError
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
ExpandEnvironmentStringsW
RemoveDirectoryW
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
CreateEventW
SetEvent
DeleteFileW
GetNativeSystemInfo
ResetEvent
LocalFree
CreateProcessW
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
DisableThreadLibraryCalls
VirtualLock
GetLocalTime
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
LeaveCriticalSection
EnterCriticalSection
SetThreadLocale
GetThreadLocale
RaiseException
DeleteCriticalSection
Sleep
OutputDebugStringA
GetTempFileNameW
CopyFileW
GetLocaleInfoW
CreateMutexW
ReleaseMutex
IsWow64Process
GetWindowsDirectoryW
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindResourceW
FreeResource
K32GetModuleFileNameExW
VerifyVersionInfoW
GetFileSize
GetLongPathNameW
MoveFileW
CreateThread
GetExitCodeThread
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
ProcessIdToSessionId
GetVersionExW
GetDriveTypeW
GlobalFindAtomW
LoadIconW
DestroyWindow
SendMessageW
ShowWindow
LoadStringW
PostMessageW
UnregisterClassA
GetSystemMetrics
FindWindowW
GetWindowThreadProcessId
MessageBoxW
SetForegroundWindow
SetTimer
KillTimer
IsDialogMessageW
PostThreadMessageW
AdjustWindowRectEx
CharNextW
CreateDialogParamW
SetWindowTextW
GetUserNameW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
EnableTrace
ControlTraceW
RegDeleteKeyW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
OpenThreadToken
FreeSid
CloseServiceHandle
CreateProcessAsUserW
LookupPrivilegeNameW
InitiateSystemShutdownExW
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
QueryServiceStatus
ControlService
ChangeServiceConfigW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
OpenServiceW
OpenSCManagerW
CheckTokenMembership
AllocateAndInitializeSid
GetSidSubAuthority
DuplicateTokenEx
GetSidSubAuthorityCount
ConvertStringSecurityDescriptorToSecurityDescriptorW
CoImpersonateClient
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoRevertToSelf
VarUI4FromStr
SafeArrayLock
VarBstrCat
SafeArrayCreate
SysStringByteLen
SafeArrayUnlock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SysStringLen
SafeArrayGetVartype
VariantInit
VariantClear
SysFreeString
SysAllocString
SysAllocStringLen
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
RtlGetVersion
RtlNtStatusToDosError
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
CreateEnvironmentBlock
DestroyEnvironmentBlock
PathFileExistsW
PathAppendW
PathFindFileNameW
PathIsRelativeW
PathCombineW
PathMatchSpecW
PathIsDirectoryW
PathRemoveFileSpecW
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CertVerifyCertificateChainPolicy
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpRTP.pdb
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
RegDeleteKeyValueW
RegQueryValueExW
RegCloseKey
CloseServiceHandle
QueryServiceStatus
ConvertSecurityDescriptorToStringSecurityDescriptorW
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LookupAccountNameW
LsaOpenPolicy
CreateServiceW
LsaNtStatusToWinError
GetSecurityDescriptorSacl
AllocateAndInitializeSid
SetNamedSecurityInfoW
CopySid
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
DeleteService
ControlService
QueryServiceConfigW
OpenServiceW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
ControlTraceW
EnableTraceEx2
StartTraceW
EventAccessControl
ConvertStringSidToSidW
EventAccessRemove
LookupAccountSidW
GetTokenInformation
CloseTrace
ProcessTrace
OpenTraceW
IsWellKnownSid
ConvertSidToStringSidW
GetLengthSid
IsValidSid
RegSetKeyValueW
RegDeleteKeyW
CreateProcessAsUserW
SetThreadToken
DuplicateTokenEx
OpenProcessToken
OpenThreadToken
RevertToSelf
EventUnregister
EventRegister
EventWriteTransfer
GetFileAttributesW
SleepEx
WaitForSingleObject
FindClose
K32GetModuleFileNameExW
GetVersionExW
RtlCompareMemory
GetExitCodeThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
IsWow64Process
VirtualFreeEx
Module32NextW
Module32FirstW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
GetVolumePathNameW
K32GetProcessImageFileNameW
CreateFileW
GetFinalPathNameByHandleW
DeviceIoControl
GetComputerNameExW
SetThreadPriority
GetThreadPriority
RtlPcToFileHeader
InitializeCriticalSectionEx
RaiseException
EncodePointer
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
FindNextFileW
HeapSize
WideCharToMultiByte
GetProcessHeap
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
FreeLibrary
ExitProcess
HeapAlloc
HeapFree
GetCurrentThread
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
ProcessIdToSessionId
CloseHandle
GetProcessTimes
GetLastError
OpenProcess
GetTickCount64
HeapReAlloc
FindFirstFileW
GetLocalTime
Sleep
FlushFileBuffers
OpenThread
GetSystemInfo
QueryFullProcessImageNameW
GetTickCount
K32GetModuleInformation
QueryDosDeviceW
GetLogicalDriveStringsW
UnmapViewOfFile
CompareStringOrdinal
GetFileTime
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CompareFileTime
GetProcessId
GetExitCodeProcess
FindResourceW
LoadResource
SizeofResource
LockResource
DebugBreak
GlobalMemoryStatusEx
GetModuleFileNameA
CreateSemaphoreExW
ReleaseSemaphore
ReleaseMutex
FormatMessageW
OutputDebugStringW
OpenSemaphoreW
CreateMutexExW
LocalFree
K32EnumProcessModules
VirtualQueryEx
K32GetMappedFileNameW
FindStringOrdinal
SystemTimeToFileTime
QueueUserAPC
ReadFile
CopyFileW
GetDriveTypeW
CopyFileExW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
GetSystemTime
SetFileTime
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateThread
CreateDirectoryW
GetFileSizeEx
WriteFile
ExpandEnvironmentStringsW
SetEnvironmentVariableW
LoadLibraryW
SetFilePointerEx
GetModuleFileNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
CreateSemaphoreW
CreateFileMappingW
MapViewOfFile
VirtualQuery
FormatMessageA
QueryPerformanceFrequency
SwitchToThread
VirtualProtect
LoadLibraryExA
GetFileInformationByHandleEx
FindFirstFileExW
SetEndOfFile
GetFileAttributesExW
DecodePointer
CompareStringEx
LCMapStringEx
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
DeleteProcThreadAttributeList
MpManagerOpen
MpManagerVersionQuery
MpConfigDelValue
MpConfigOpen
MpAllocMemory
MpClientUtilExportFunctions
MpConfigGetValue
MpUtilsExportFunctions
MpIsDeviceControlAvailable
MpShutdownCopyAcceleratorProcess
MpGetCopyAcceleratorProcessStatus
MpConfigUnregisterNotifications
MpConfigRegisterForNotifications
MpHandleClose
MpConfigClose
MpConfigSetValue
MpFreeMemory
MpConfigGetValueAlloc
CertVerifyCertificateChainPolicy
UuidFromStringW
ExpandEnvironmentStringsForUserW
WinVerifyTrust
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
NtDeviceIoControlFile
NtClose
RtlPrefixUnicodeString
NtWaitForSingleObject
RtlGetVersion
RtlInitUnicodeString
NtMapViewOfSection
RtlCompareUnicodeString
RtlNtStatusToDosError
NtCreateFile
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptHashData
MpPluginBypassDlpWarning
MpPluginCheckAccessForClipboardOperation
MpPluginCheckAccessForDragDropOperation
MpPluginCheckAccessForDragDropOperation2
MpPluginCheckAccessForPrintOperation
MpPluginCheckExclusion
MpPluginConfigChange
MpPluginConfigDirectoryMonitoring
MpPluginConfigSyncMonitoring
MpPluginCopyAcceleratorSoftShutdown
MpPluginDeviceControlAccessCheck
MpPluginDeviceControlProvidePrintJobData
MpPluginDismissDlpWarning
MpPluginDlpDelegateEnforcement
MpPluginDlpGetOfficeEnlightenmentMode
MpPluginDlpGetOperationEnforcmentMode
MpPluginDlpInitializeEnforcementMode
MpPluginDlpNotifyCloseDocumentFile
MpPluginDlpNotifyPostOpenDocumentFile
MpPluginDlpNotifyPostSaveAsDocument
MpPluginDlpNotifyPostStartPrint
MpPluginDlpNotifyPreOpenDocumentFile
MpPluginDlpNotifyPrePrint
MpPluginDlpNotifyPreSaveAsDocument
MpPluginEnableDeviceControl
MpPluginEnableDlp
MpPluginEnforceDlpClipboard
MpPluginEnforceDlpReadClipboard
MpPluginFilterManagerNotifyUpdatePlatformInProgress
MpPluginFlushLogData
MpPluginFreeTPRegs
MpPluginGetConfigOperations
MpPluginGetCopyAcceleratorState
MpPluginGetDeviceControlSecurityPolicies
MpPluginGetDeviceControlStatus
MpPluginGetDlpNotificationSettings
MpPluginGetHeartBeatData
MpPluginGetState
MpPluginGetTPRegs
MpPluginGetThreatCategory
MpPluginGetThreatExecInfo
MpPluginGetThreatInfo
MpPluginInitialize
MpPluginIsSuspended
MpPluginNotifyRpcServerStateChange
MpPluginNotifySessionStateChange
MpPluginNotifySetupProgress
MpPluginQueryDlpState
MpPluginQueryRtpMonitoringInfoEx
MpPluginRefreshConfigsinRTP
MpPluginRefreshDlpPolicySettings
MpPluginRefreshPlatformKillbits
MpPluginRegisterFriendlyProcess
MpPluginReportClipboardOwner
MpPluginReportThreadStatus
MpPluginSendBrowserHeartbeat
MpPluginSendUserModeRegistryData
MpPluginSetDefaultConfigs
MpPluginSetDriverUnloadInProgress
MpPluginSetEngine
MpPluginSetHybridModeState
MpPluginSetState
MpPluginSetUserInformation
MpPluginShutdown
MpPluginSignatureChange
MpPluginStop
MpPluginUpdateBrowserActiveTab
MpPluginUpdateFolderGuardData
MpPluginUpdateModuleMonitorData
MpPluginUpdateMonitoringInfo
MpPluginUpdateMonitoringInfoEx
MpPluginUpdateProcessTaintInfo
MpPluginUpdateTPExclusionsState
MpPluginUpdateTPState
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MpSvc.pdb
_beginthreadex
_errno
_invalid_parameter_noinfo_noreturn
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
abort
_invalid_parameter_noinfo
fgetc
ungetc
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fwrite
fread
fputc
__stdio_common_vsnprintf_s
_get_stream_buffer_pointers
fclose
__stdio_common_vswprintf
__stdio_common_vswprintf_s
fseek
_wfsopen
__stdio_common_vsprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__stdio_common_vswscanf
iswspace
wcsnlen
wcsncmp
wmemmove_s
towupper
wcspbrk
iswupper
strncmp
towlower
_wcsnicmp
strnlen
iswalpha
isdigit
iswdigit
iswxdigit
islower
iswlower
strcspn
_wcsicmp
strcpy_s
toupper
_wcsdup
isupper
__strncnt
wcscmp
calloc
realloc
_free_base
_calloc_base
_callnewh
malloc
_malloc_base
free
_ui64tow_s
_wcstod_l
_i64tow_s
_wtoi
wcstoumax
_ui64toa_s
_i64toa_s
wcstoull
_wtol
wcstol
wcstoll
wcstoul
_itow_s
atol
rand
srand
___mb_cur_max_func
___lc_codepage_func
setlocale
_free_locale
_lock_locales
_create_locale
__pctype_func
_unlock_locales
localeconv
___lc_locale_name_func
frexp
ceilf
RegOpenKeyExW
QueryServiceConfigW
EventActivityIdControl
MakeAbsoluteSD
StartServiceCtrlDispatcherW
DeleteService
SetServiceStatus
RegisterServiceCtrlHandlerExW
RegEnumValueW
RegDeleteValueW
RegLoadKeyW
RegUnLoadKeyW
RegSetValueExW
NotifyServiceStatusChangeW
QueryServiceStatus
OpenServiceW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
ConvertStringSidToSidW
CheckTokenMembership
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetAce
AllocateAndInitializeSid
CopySid
FreeSid
DuplicateTokenEx
AddAccessAllowedAceEx
GetFileSecurityW
SetKernelObjectSecurity
GetKernelObjectSecurity
GetSecurityDescriptorOwner
InitializeSecurityDescriptor
DeleteAce
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ChangeServiceConfig2W
SetSecurityDescriptorOwner
IsWellKnownSid
LookupAccountSidW
GetTokenInformation
OpenProcessToken
LsaClose
LsaFreeMemory
LsaNtStatusToWinError
LsaQueryInformationPolicy
LookupAccountNameW
LsaOpenPolicy
RegQueryValueExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
ChangeServiceConfigW
ControlService
DuplicateToken
ConvertSidToStringSidW
QueryServiceStatusEx
InitiateSystemShutdownExW
CreateProcessAsUserW
OpenSCManagerW
StartServiceW
CreateWellKnownSid
RegGetKeySecurity
StopTraceW
StartTraceW
GetLengthSid
EqualSid
IsValidSid
TraceMessage
QueryServiceConfig2W
EventWriteTransfer
EventUnregister
RegCloseKey
CloseServiceHandle
EventRegister
LookupPrivilegeValueW
AdjustTokenPrivileges
SetThreadToken
RevertToSelf
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
CryptStringToBinaryW
CryptBinaryToStringW
CertVerifyCertificateChainPolicy
GetEnvironmentVariableW
SystemTimeToFileTime
ReadFile
UnregisterWaitEx
GetVersionExW
CopyFileExW
SwitchToThread
ExpandEnvironmentStringsW
InitializeCriticalSection
TryEnterCriticalSection
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
GetFileSizeEx
CreateTimerQueueTimer
WriteFile
RegisterWaitForSingleObject
CreateJobObjectW
SizeofResource
LockResource
LoadResource
FindResourceW
ChangeTimerQueueTimer
OpenEventW
GetSystemDirectoryW
GetNativeSystemInfo
HeapSetInformation
CreateSemaphoreW
GetSystemWindowsDirectoryW
VirtualQuery
VirtualProtect
LoadLibraryExA
InitOnceBeginInitialize
InitOnceComplete
LCMapStringW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
Sleep
FreeLibrary
DeleteTimerQueueTimer
SetEnvironmentVariableW
GetTempPathW
TerminateProcess
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SetEvent
GetFileAttributesW
MoveFileExW
CreateHardLinkW
GetExitCodeProcess
CopyFileW
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CreateEventW
CreateThread
LoadLibraryExW
K32GetModuleInformation
lstrcmpiW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetFileAttributesExW
OpenThread
GetThreadTimes
LeaveCriticalSection
EnterCriticalSection
CreateFileW
LocalFree
MultiByteToWideChar
LoadLibraryW
InitializeCriticalSectionAndSpinCount
ResetEvent
DeleteCriticalSection
CreateMutexW
WaitForMultipleObjects
DuplicateHandle
GetDateFormatW
GetTimeFormatW
ProcessIdToSessionId
GetSystemTime
FindFirstChangeNotificationW
FindNextChangeNotification
GetTempFileNameW
FindCloseChangeNotification
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumePathNameW
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
DeleteFileW
RaiseException
GetTickCount64
GetProcessTimes
GetTickCount
WaitForMultipleObjectsEx
CompareFileTime
lstrcmpW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
UnmapViewOfFile
GetModuleFileNameW
CreateProcessW
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetSystemPowerStatus
DeviceIoControl
SleepEx
FlushFileBuffers
GetSystemInfo
GetFileInformationByHandle
SetEnvironmentVariableA
ReadProcessMemory
K32GetProcessMemoryInfo
WideCharToMultiByte
QueryDosDeviceW
CreateIoCompletionPort
SetInformationJobObject
AssignProcessToJobObject
GetQueuedCompletionStatus
QueryInformationJobObject
PostQueuedCompletionStatus
SetErrorMode
FormatMessageA
TryAcquireSRWLockExclusive
GetStringTypeW
QueryPerformanceFrequency
SystemTimeToTzSpecificLocalTime
GetFinalPathNameByHandleW
SetFileAttributesW
SetFilePointerEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetThreadPriority
GetComputerNameExW
GetLocaleInfoW
ConvertDefaultLocale
RemoveDirectoryW
RtlCompareMemory
UuidFromStringW
NdrServerCallAll
RpcRevertToSelf
RpcServerInqCallAttributesW
UuidHash
RpcImpersonateClient
RpcServerUnregisterIf
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
UuidCompare
NdrServerCall2
RpcServerRegisterAuthInfoW
UuidCreate
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingInqAuthClientW
RpcStringFreeW
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
WinVerifyTrust
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW
NtQueryInformationProcess
RtlTimeToTimeFields
MpDebugExportFunctions
MpClientUtilExportFunctions
MpUtilsExportFunctions
MpDynamicSignatureEnumerate
MpAddDynamicSignatureFile
MpManagerVersionQuery
MpErrorMessageFormat
MpFreeMemory
MpConfigInitialize
MpConfigUninitialize
MpConfigOpen
MpConfigGetValueAlloc
MpDynamicSignatureOpen
MpConfigGetValue
MpConfigSetValue
MpConfigDelValue
MpAllocMemory
MpConfigRegisterForNotifications
MpManagerOpen
MpUpdateStart
MpUpdateControl
MpHandleClose
MpConfigUnregisterNotifications
MpConfigIteratorOpen
MpConfigIteratorClose
MpNotificationRegister
MpConfigIteratorEnum
MpScanStart
MpScanControl
MpThreatLocalizedInfoQuery
MpQueryEngineConfigDword
MpConveySampleSubmissionResult
MpIsRtpAutoEnable
MpConfigClose
MpManagerStatusQueryEx
_lock_file
_unlock_file
ServiceCrtMain
ValidateDrop
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
MsMpCom.pdb
_wcsicmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
malloc
wcschr
_purecall
free
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler4
_vsnprintf
??3@YAXPEAX@Z
memcmp
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetModuleFileNameW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
LoadLibraryExW
FreeLibrary
GetFileAttributesW
SetLastError
LoadTypeLi
SafeArrayGetDim
SafeArrayCreate
LoadRegTypeLi
SysStringLen
VariantInit
SysFreeString
VariantClear
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetSecurityDescriptorOwner
GetFileSecurityW
InitializeSecurityDescriptor
IsValidSid
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
CoUninitialize
CoInitializeEx
IIDFromString
CoCreateInstance
UnregisterClassA
MpUpdateControl
MpElevationHandleActivate
MpOfflineScanInstall
MpScanControl
MpManagerEnable
MpThreatEnumerate
MpConfigSetValue
MpQuarantineRequest
MpManagerOpen
MpHandleClose
MpFreeMemory
MpConfigUninitialize
MpConfigInitialize
MpConfigGetValue
MpThreatHistoryRequest
MpConfigDelValue
MpClientUtilExportFunctions
MpConfigGetValueAlloc
MpConfigClose
MpUtilsExportFunctions
MpThreatOpen
MpConfigOpen
MpElevationHandleOpen
UuidFromStringW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
ProtectionManagement.pdb
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
RegQueryValueExW
RegCloseKey
LookupPrivilegeNameW
CloseServiceHandle
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
DuplicateTokenEx
GetSidSubAuthority
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
ControlService
QueryServiceStatus
LookupPrivilegeValueW
PrivilegeCheck
AdjustTokenPrivileges
InitiateSystemShutdownExW
CreateProcessAsUserW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualProtect
VirtualQuery
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadFile
CreateFileW
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionEx
RtlVirtualUnwind
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileExW
FreeLibraryAndExitThread
ExitThread
GetFileAttributesExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
GetTickCount
WaitForSingleObjectEx
TryEnterCriticalSection
FormatMessageW
SwitchToThread
RtlLookupFunctionEntry
RtlCaptureContext
SetLastError
WideCharToMultiByte
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
WaitForSingleObject
GetSystemTime
GetTimeZoneInformation
CloseHandle
FindResourceExW
LoadResource
LockResource
SizeofResource
GetProcAddress
GetLastError
LoadLibraryExW
GetSystemDirectoryW
FreeLibrary
CompareFileTime
GetExitCodeProcess
CreateEventW
SetEvent
FileTimeToSystemTime
GlobalFindAtomW
GetDriveTypeW
GetVersionExW
GetLocalTime
SystemTimeToFileTime
GetNativeSystemInfo
ProcessIdToSessionId
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetExitCodeThread
ResetEvent
CreateThread
MoveFileW
GetLongPathNameW
GetFileSize
VerifyVersionInfoW
K32GetModuleFileNameExW
FreeResource
FindResourceW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetDiskFreeSpaceExW
GetWindowsDirectoryW
Sleep
LocalFree
IsWow64Process
ReleaseMutex
CreateMutexW
CreateProcessW
CopyFileW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
MpGetRunningMode
MpConfigRegisterForNotifications
MpConfigUnregisterNotifications
MpAllocMemory
MpManagerVersionQuery
MpConfigIteratorEnum
MpConfigIteratorOpen
MpConfigIteratorClose
MpConfigSetValue
MpConfigGetValue
MpRollbackPlatform
MpDetectionEnumerate
MpGetTPStateInfo
MpThreatOpen
MpThreatQuery
MpOfflineScanInstall
MpManagerStatusQueryEx
MpNotificationRegister
MpManagerOpen
MpHandleClose
MpClientUtilExportFunctions
MpConfigOpen
MpConfigClose
MpConfigGetValueAlloc
MpConfigUninitialize
MpConfigInitialize
MpFreeMemory
MpGetDeviceControlStatus
MpGetTDTFeatureStatusEx
MpGetTDTFeatureStatus
MpCreateComInstance
MpScanStartEx
MpUpdateStartEx
MpTriggerHeartbeatOnUninstall
MpGetCallistoDetections
MpCleanStart
MpCleanOpen
MpElevationHandleAcquire
MpElevateCleanHandle
MpThreatRollup
MpThreatEnumerate
MpUtilsExportFunctions
CertVerifyCertificateChainPolicy
DestroyEnvironmentBlock
CreateEnvironmentBlock
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
WinVerifyTrust
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
endpointdlp.pdb
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
GetModuleFileNameW
GetConsoleMode
RtlUnwindEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
WriteConsoleW
CreateFileW
RaiseException
HeapReAlloc
HeapSize
OutputDebugStringW
InitializeCriticalSectionEx
CloseHandle
SetStdHandle
SetFilePointerEx
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetTickCount
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
Sleep
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
LoadLibraryW
CompareStringOrdinal
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
OpenProcess
K32GetModuleFileNameExW
GetProcessTimes
GetDriveTypeW
CreateEventExW
CreateThreadpoolWait
ExpandEnvironmentStringsW
FormatMessageA
LocalFree
InitOnceBeginInitialize
InitOnceComplete
DecodePointer
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEvent
ResetEvent
CreateEventW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
LoadLibraryExW
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ExitProcess
GetStartupInfoW
GetFileType
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeLibrary
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
LCMapStringEx
GetModuleFileNameA
TraceMessage
CryptDestroyHash
CryptDestroyKey
CryptVerifySignatureW
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExW
RegCloseKey
RegNotifyChangeKeyValue
RegOpenKeyExW
GetLengthSid
GetTokenInformation
OpenProcessToken
EventRegister
EventUnregister
EventWriteTransfer
ZwQueryEaFile
RtlIpv4StringToAddressW
CryptStringToBinaryW
CertFreeCertificateChain
CryptImportPublicKeyInfo
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertAddCertificateContextToStore
CertOpenStore
CertCreateCertificateContext
CertCloseStore
CertFreeCertificateContext
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
PathIsNetworkPathW
LoadStringW
AuditBrowserFileOperationEvent
AuditBrowserFileOperationEventEx
AuditBrowserOperationEvent
AuditBrowserWebSiteOperation
DlpAuditFileAccessEvent
DlpAuditOperationEnforcementEvent
DlpAuditOperationEnforcementEventEx
DlpCheckIsCloudSyncApp
DlpDelegateEnforcement
DlpFreeArchiveFileTraceInfo
DlpGetArchiveFileTraceInfo
DlpGetEnforcementApiVersion
DlpGetFileApplicationAccess
DlpGetFileApplicationAccessEx
DlpGetFileApplicationAccessEx2
DlpGetFileApplicationAccessEx3
DlpGetFileCloudApplicationPolicy
DlpGetFileLocation
DlpGetNotificationSettings
DlpGetPolicyInfoFromRuleId
DlpGetPolicySettings
DlpGetQuarantineConfiguration
DlpGetWebSiteAccess
DlpInitialize
DlpInitializeEnforcementMode
DlpInitializeFromCustomPolicy
DlpIsWebsitePolicyConfigured
DlpMustPasteFromSystemClipboard
DlpNotifyCloseDocument
DlpNotifyCloseDocumentFile
DlpNotifyEnterDropTarget
DlpNotifyLeaveDropTarget
DlpNotifyOnCloseProcess
DlpNotifyPostCopyToClipboard
DlpNotifyPostDragDrop
DlpNotifyPostOpenDocument
DlpNotifyPostOpenDocumentFile
DlpNotifyPostPasteFromClipboard
DlpNotifyPostPrint
DlpNotifyPostSaveAsDocument
DlpNotifyPostStartPrint
DlpNotifyPostStashClipboard
DlpNotifyPreCopyToClipboard
DlpNotifyPreDragDrop
DlpNotifyPreOpenDocument
DlpNotifyPreOpenDocumentFile
DlpNotifyPrePasteFromClipboard
DlpNotifyPrePrint
DlpNotifyPreSaveAsDocument
DlpNotifyPreStashClipboard
DlpValidateCloudDomainsPolicyCmd
DlpValidateCloudPolicyCmd
DlpValidateCloudWebSitesPolicyCmd
GetBrowserExtensionConfiguration
ShouldCollectBrowsingActivities
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
shellext.pdb
_vsnprintf
wcsrchr
wcstoul
_vscwprintf
wcsstr
_wcsnicmp
wcsncmp
wcschr
_vsnwprintf
_wchmod
swprintf_s
_wcsicmp
vswprintf_s
iswalpha
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
realloc
_errno
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
calloc
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcsncpy_s
malloc
free
_purecall
wcscat_s
wcscpy_s
memcpy_s
__C_specific_handler
__CxxFrameHandler4
memset
GetLocaleInfoEx
UnmapViewOfFile
LCIDToLocaleName
OutputDebugStringA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
SearchPathW
LocaleNameToLCID
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
Sleep
LoadLibraryExW
lstrcmpiW
FreeLibrary
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
LoadResource
FindResourceExW
RaiseException
GetLastError
MultiByteToWideChar
InitializeCriticalSection
LeaveCriticalSection
GetThreadLocale
GetModuleFileNameW
EnterCriticalSection
SetThreadLocale
SizeofResource
CreateProcessW
WaitForSingleObject
CloseHandle
LockResource
CreateEventW
GetUserDefaultUILanguage
SwitchToThread
GetDriveTypeW
SetErrorMode
GetVolumeInformationW
FindClose
GlobalFindAtomW
GetVersionExW
GetLocalTime
SystemTimeToFileTime
GetNativeSystemInfo
SetLastError
ProcessIdToSessionId
GetSystemDefaultUILanguage
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetExitCodeThread
ResetEvent
SetEvent
CreateThread
MoveFileW
GetLongPathNameW
GetFileSizeEx
GetFileSize
WriteFile
ReadFile
CreateFileW
VerifyVersionInfoW
K32GetModuleFileNameExW
HeapFree
GetProcessHeap
HeapAlloc
DeleteFileW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FreeResource
FindResourceW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetDiskFreeSpaceExW
GetSystemDirectoryW
GetWindowsDirectoryW
GetExitCodeProcess
LocalFree
IsWow64Process
ReleaseMutex
CreateMutexW
GetLocaleInfoW
CopyFileW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
GetSystemDefaultLCID
MoveFileExW
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
CreateFileMappingW
MapViewOfFile
DisableThreadLibraryCalls
VirtualLock
HeapSize
HeapReAlloc
HeapDestroy
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
DecodePointer
SysAllocStringByteLen
VarUI4FromStr
SysStringLen
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
UnRegisterTypeLi
VarBstrCat
SysStringByteLen
SysAllocStringLen
VariantClear
VariantInit
GetSecurityDescriptorGroup
InitiateSystemShutdownExW
LookupPrivilegeNameW
CreateProcessAsUserW
FreeSid
TraceMessage
RegQueryValueExW
CloseServiceHandle
PrivilegeCheck
LookupPrivilegeValueW
QueryServiceStatus
ControlService
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
CheckTokenMembership
AllocateAndInitializeSid
GetSidSubAuthority
DuplicateTokenEx
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
CopySid
GetLengthSid
IsValidSid
EqualSid
InitializeAcl
AddAce
GetAclInformation
GetAce
GetSecurityDescriptorOwner
AdjustTokenPrivileges
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetSecurityDescriptorControl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertStringSidToSidW
QueryServiceConfigW
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoCreateGuid
CoTaskMemRealloc
CreateDialogParamW
DestroyWindow
ShowWindow
LoadStringW
PostMessageW
SetWindowTextW
GetSystemMetrics
SetForegroundWindow
SetTimer
KillTimer
IsDialogMessageW
PostThreadMessageW
AdjustWindowRectEx
SetMenuItemBitmaps
InsertMenuW
LoadImageW
GetSystemMetricsForDpi
FindWindowExW
GetLastActivePopup
AllowSetForegroundWindow
GetDpiForWindow
UnregisterClassA
CharNextW
FindWindowW
LoadIconW
SendMessageW
GetWindowThreadProcessId
MessageBoxW
DestroyIcon
GetActiveWindow
SHChangeNotify
SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
DragQueryFileW
ShellExecuteW
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
GdipCreateBitmapFromHICON
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateHBITMAPFromBitmap
GdiplusStartup
DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile
InternetCanonicalizeUrlW
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSQueryUserToken
PathIsRootW
PathFindFileNameW
PathMatchSpecW
PathCombineW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathIsRelativeW
RoActivateInstance
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
DeleteObject
PathIsDirectoryW
ord172
WTHelperProvDataFromStateData
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CertVerifyCertificateChainPolicy
RtlGetVersion
RtlNtStatusToDosError
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
NisSrv.pdb
__p___wargv
_get_initial_wide_environment
_initterm
_initterm_e
_initialize_wide_environment
_seh_filter_exe
_initialize_onexit_table
_beginthreadex
exit
_configure_wide_argv
_exit
_crt_atexit
abort
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_register_onexit_function
_invalid_parameter_noinfo
terminate
_invalid_parameter_noinfo_noreturn
_errno
_cexit
_set_app_type
feof
fgetws
fclose
fwrite
fgetc
fflush
setvbuf
ungetc
fsetpos
__stdio_common_vswprintf_s
fread
_fseeki64
_get_stream_buffer_pointers
_wfsopen
fseek
_fsopen
__p__commode
_set_fmode
__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
_wfopen
fputc
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
fgetpos
realloc
malloc
_recalloc
calloc
_calloc_base
_callnewh
_free_base
free
_malloc_base
_set_new_mode
wcstoull
wcstod
strtol
wcstol
wcstoll
_i64toa_s
strtod
strtof
_ui64toa_s
_i64tow_s
_itow_s
_ui64tow_s
_wcstod_l
strtoll
wcsncpy_s
iswxdigit
strcspn
towlower
iswlower
iswupper
strncmp
iswdigit
isdigit
iswalpha
towupper
isalpha
strcpy_s
_wcsicmp
_wcsdup
toupper
wcscmp
strnlen
tolower
isspace
wcsnlen
iswspace
__strncnt
isupper
islower
_lock_locales
___lc_codepage_func
__pctype_func
_configthreadlocale
_free_locale
_create_locale
setlocale
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
localeconv
_unlock_locales
ceil
log2
pow
ldexp
ceilf
frexp
powf
RevertToSelf
SetThreadToken
DuplicateTokenEx
OpenSCManagerW
RegSetKeyValueW
RegOpenCurrentUser
RegGetValueW
CloseServiceHandle
ImpersonateLoggedOnUser
StartServiceW
OpenServiceW
RegQueryValueExW
EventWriteTransfer
EventUnregister
EventRegister
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegDeleteValueW
RegCreateKeyExW
GetTraceLoggerHandle
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
TraceMessage
LoadLibraryExA
DelayLoadFailureHook
MapViewOfFile
CreateFileMappingW
GetSystemDirectoryW
CloseThreadpoolIo
GetOverlappedResult
CancelIoEx
CancelThreadpoolIo
WaitForThreadpoolIoCallbacks
CreateThreadpoolIo
StartThreadpoolIo
QueryUnbiasedInterruptTime
QueryFullProcessImageNameW
OpenProcess
VerifyVersionInfoW
DuplicateHandle
GlobalFree
GetProcessId
GetThreadPreferredUILanguages
GetLongPathNameW
QueryProcessCycleTime
GetUserPreferredUILanguages
GetSystemPreferredUILanguages
UnmapViewOfFile
GetSystemInfo
GetModuleHandleA
GetVersionExW
CreateMutexW
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
MultiByteToWideChar
CloseThreadpool
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpool
SetThreadpoolThreadMaximum
CreateThreadpoolWork
SubmitThreadpoolWork
GetSystemTime
SystemTimeToFileTime
RaiseException
FreeLibrary
LoadLibraryExW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
SizeofResource
LoadResource
FindResourceExW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
HeapSetInformation
CreateEventW
SetEvent
TerminateProcess
GetCurrentProcess
SwitchToFiber
ConvertFiberToThread
IsThreadAFiber
ConvertThreadToFiber
CreateFiberEx
DeleteFiber
WideCharToMultiByte
GetSystemTimeAsFileTime
CreateFileW
SetErrorMode
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
Sleep
SwitchToThread
InitializeSRWLock
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
RtlPcToFileHeader
GetStringTypeW
ReleaseSRWLockShared
AcquireSRWLockShared
LocalFree
InitOnceComplete
CreateDirectoryW
GetFileInformationByHandleEx
FindFirstFileExW
FindNextFileW
DeviceIoControl
FindClose
GetFileAttributesW
GetFileAttributesExW
SetFileInformationByHandle
MoveFileExW
CopyFileW
InitOnceBeginInitialize
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
InitializeSListHead
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetProcessTimes
ExpandEnvironmentStringsW
GetFileSizeEx
UnregisterClassA
CharNextW
RtlIpv4StringToAddressExW
VerSetConditionMask
RtlIpv6StringToAddressExW
MpUtilsExportFunctions
MpClientUtilExportFunctions
MpConfigInitialize
MpConfigUninitialize
MpFreeMemory
MpManagerOpen
MpNotificationRegister
MpHandleClose
MpConfigGetValueAlloc
MpConfigClose
MpConfigOpen
_lock_file
_unlock_file
rand_s
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ