Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
47796340c7971d6ec276c87731914cef_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
47796340c7971d6ec276c87731914cef_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Target
47796340c7971d6ec276c87731914cef_JaffaCakes118
Size
1.3MB
MD5
47796340c7971d6ec276c87731914cef
SHA1
8313237c4fc1dd8e49bc607e547aa8a45bc78726
SHA256
17f5fc00ffd806981b77121be9dedcc8e43765897167da32f2733c3a4319ee77
SHA512
396147047a97dd1a80111bb1aaced5556041d5e2c6c1834514207ad1c8af09545332a3509a870e4e3aae91ae659b9d87e161a38f6ee7ebfe50086d59555cef84
SSDEEP
12288:OIoZhrBDZ0jwzeFUFr6bH2q8FBVjNVUeXrfVcSwkonjKiXfxP4TrisFexzbpk8rJ:g/rBDijWe2643ueXrmSwGiXB4TUxJh
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\ComodoCleaningEssentials\_out\Release\Win32\Symbols\KillSwitch.pdb
NtAllocateVirtualMemory
RtlInterlockedFlushSList
RtlInitializeSListHead
RtlFreeHeap
RtlMultiByteToUnicodeSize
RtlUnicodeToMultiByteN
RtlInterlockedPopEntrySList
RtlEqualUnicodeString
RtlUnicodeToMultiByteSize
RtlInterlockedPushEntrySList
RtlReAllocateHeap
NtDebugActiveProcess
NtCreateDebugObject
NtCreateJobObject
NtCreateMailslotFile
NtIsProcessInJob
RtlTimeToSecondsSince1980
RtlQueryDepthSList
RtlSecondsSince1980ToTime
NtDeleteValueKey
NtResetEvent
NtQueryMutant
NtSetLowEventPair
NtPulseEvent
NtQuerySemaphore
NtSetHighEventPair
NtQueryEvent
NtQueryTimer
NtQuerySection
NtCancelTimer
RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
RtlDestroyHeap
NtProtectVirtualMemory
RtlDoesFileExists_U
NtCreateMutant
NtTerminateJobObject
NtAssignProcessToJobObject
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
RtlCompareUnicodeString
RtlInitializeCriticalSection
NtQueryPerformanceCounter
RtlDeleteCriticalSection
RtlSetHeapInformation
RtlQueryEnvironmentVariable_U
RtlGUIDFromString
NtWaitForMultipleObjects
NtInitiatePowerAction
NtSetInformationDebugObject
NtRemoveProcessDebug
RtlCreateSecurityDescriptor
RtlCreateProcessParameters
RtlGetFullPathName_U
NtFilterToken
NtQueryValueKey
NtDuplicateToken
RtlInitializeSid
RtlRandomEx
RtlDestroyProcessParameters
RtlFreeUnicodeString
RtlAddAccessAllowedAce
RtlFindMessage
RtlSetDaclSecurityDescriptor
RtlCreateAcl
RtlAddAce
RtlCreateUserProcess
RtlExpandEnvironmentStrings_U
RtlStringFromGUID
RtlGetAce
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlLengthSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
NtReleaseKeyedEvent
RtlLeaveCriticalSection
NtWaitForKeyedEvent
NtCreateKeyedEvent
RtlEnterCriticalSection
NtSetTimer
NtAlertThread
NtCreateTimer
RtlCreateUserThread
NtSuspendThread
NtAdjustPrivilegesToken
NtOpenProcess
NtGetContextThread
NtQueryInformationJobObject
NtQueryVirtualMemory
NtOpenProcessToken
NtSetInformationProcess
NtOpenDirectoryObject
NtReadVirtualMemory
NtResumeProcess
NtQueryDirectoryObject
NtSetInformationToken
NtOpenThread
NtSetInformationThread
NtQueryDirectoryFile
NtQuerySymbolicLinkObject
NtCreateKey
NtOpenSymbolicLinkObject
RtlAllocateHeap
RtlRaiseStatus
RtlMultiByteToUnicodeN
RtlValidSid
RtlPrefixUnicodeString
RtlNtStatusToDosError
NtOpenThreadToken
NtWriteVirtualMemory
RtlUnwind
NtTerminateProcess
NtUnloadDriver
NtOpenKey
NtSetContextThread
NtSuspendProcess
NtResumeThread
RtlSubAuthoritySid
NtCreateSection
NtUnmapViewOfSection
NtMapViewOfSection
RtlLengthSid
RtlConvertSidToUnicodeString
NtDeleteKey
NtSetValueKey
NtSetInformationObject
NtDeviceIoControlFile
RtlDosPathNameToNtPathName_U
NtReadFile
NtOpenFile
RtlFreeAnsiString
NtFlushBuffersFile
NtCreateFile
NtUnlockFile
NtQueryInformationFile
NtSetInformationFile
RtlUnicodeStringToAnsiString
NtFsControlFile
NtLockFile
NtWriteFile
NtDuplicateObject
NtQueryObject
NtSetSecurityObject
NtCreateEvent
NtQueryInformationProcess
NtQueryInformationThread
NtTerminateThread
NtQuerySecurityObject
NtSetEvent
NtQueryInformationToken
RtlGetVersion
NtQuerySystemInformation
RtlCreateHeap
NtCreateSemaphore
NtClose
NtWaitForSingleObject
NtReleaseSemaphore
NtAddAtom
NtFreeVirtualMemory
WinStationConnectW
WinStationDisconnect
WinStationReset
WinStationEnumerateW
WinStationFreeMemory
WinStationQueryInformationW
WinStationFreeGAPMemory
WinStationGetAllProcesses
WinStationSendMessageW
WinStationRegisterConsoleNotification
ImageList_Destroy
ImageList_Replace
ImageList_ReplaceIcon
ImageList_Create
ImageList_Remove
PropertySheetW
CreatePropertySheetPageW
InitCommonControlsEx
ImageList_SetImageCount
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
MultiByteToWideChar
WideCharToMultiByte
SetHandleCount
GetStdHandle
GetFileType
HeapCreate
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
LCMapStringW
GetCurrentThreadId
TlsFree
GetCurrentProcessId
Sleep
FileTimeToSystemTime
FileTimeToLocalFileTime
AllocConsole
MulDiv
CreateFileW
SetProcessShutdownParameters
GetThreadPriority
InterlockedDecrement
InterlockedIncrement
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
HeapSetInformation
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
SetThreadPriority
SetLastError
GetNumberFormatW
GetTimeFormatW
GetSystemDirectoryW
GetUserDefaultLangID
CreateProcessW
GetDateFormatW
GetSystemDefaultLangID
LocalFree
LocalAlloc
TlsAlloc
TlsSetValue
TlsGetValue
CreateRemoteThread
GetLastError
ExitThread
ExitProcess
DeleteFiber
ConvertThreadToFiber
GlobalSize
GlobalFree
GetProcAddress
GlobalUnlock
LoadLibraryW
GlobalAlloc
GetModuleHandleW
GetLocaleInfoW
FlushFileBuffers
CloseHandle
CreateFileA
ReadFile
SetStdHandle
WriteConsoleW
HeapSize
SetEndOfFile
GetProcessHeap
IsValidCodePage
GetTickCount
GlobalLock
CreateThread
AppendMenuW
BringWindowToTop
CheckMenuRadioItem
GetMenu
EnumWindows
DeleteMenu
ShowWindowAsync
PostQuitMessage
CreateIconIndirect
IsWindowEnabled
GetMenuState
GetGuiResources
IsHungAppWindow
OpenWindowStationW
GetUserObjectInformationW
CloseDesktop
EnumDesktopsW
OpenDesktopW
GetProcessWindowStation
CloseWindowStation
SetLayeredWindowAttributes
DrawMenuBar
IsWindow
UpdateWindow
CheckMenuItem
TranslateAcceleratorW
IsChild
GetMessageW
FindWindowW
GetDlgItemInt
LoadAcceleratorsW
DefWindowProcW
CreateWindowExW
SetWindowLongW
GetWindowLongW
InvalidateRect
RegisterClassExW
BeginPaint
GetClientRect
LoadCursorW
TrackMouseEvent
EndPaint
RegisterClipboardFormatW
DestroyMenu
GetMenuItemCount
CreatePopupMenu
LoadMenuW
InsertMenuItemW
GetMenuItemInfoW
GetSubMenu
TrackPopupMenu
CallWindowProcW
GetPropW
SendMessageW
SetPropW
RemovePropW
SetCursor
GetMonitorInfoW
MapWindowPoints
GetCursorPos
SetWindowPos
ReleaseDC
GetDC
WindowFromPoint
GetParent
DrawTextW
FillRect
MonitorFromPoint
GetWindowRect
DestroyWindow
SetMenuItemInfoW
EndDeferWindowPos
SetClipboardData
BeginDeferWindowPos
DeferWindowPos
OpenClipboard
EmptyClipboard
EnableMenuItem
GetWindowTextW
LoadIconW
LoadImageW
CloseClipboard
GetWindowTextLengthW
ClientToScreen
SetScrollInfo
SetCaretPos
ReleaseCapture
CreateCaret
EnableScrollBar
GetSysColor
DestroyCaret
RedrawWindow
SetScrollPos
GetClipboardData
GetScrollInfo
DragDetect
PtInRect
ShowCaret
SetFocus
GetKeyState
SetCapture
GetIconInfo
DrawIconEx
DispatchMessageW
MoveWindow
MessageBoxW
MonitorFromWindow
PeekMessageW
TranslateMessage
ExitWindowsEx
MsgWaitForMultipleObjects
GetSystemMetrics
GetSysColorBrush
SetDlgItemTextW
EndDialog
DialogBoxParamW
LockWorkStation
EnableWindow
GetDlgItem
KillTimer
PostMessageW
SetTimer
GetWindowThreadProcessId
GetWindowPlacement
SetWindowTextW
ShowWindow
DestroyIcon
MapDialogRect
IsWindowVisible
SetMenuDefaultItem
CreateDialogParamW
SetForegroundWindow
SetDlgItemInt
IsIconic
SendMessageTimeoutW
SystemParametersInfoW
IsDialogMessageW
SetDCBrushColor
DeleteObject
Polyline
CreateCompatibleBitmap
CreateCompatibleDC
SetBkMode
Polygon
DeleteDC
SetTextColor
GetTextExtentPoint32W
BitBlt
TextOutW
SetBoundsRect
CreateFontW
SelectObject
GetCharWidthW
GetDIBits
CreateDIBSection
RestoreDC
IntersectClipRect
CreateRectRgn
GetObjectW
SaveDC
SelectClipRgn
LPtoDP
GetClipRgn
GetDeviceCaps
CreateFontIndirectW
GetTextMetricsW
Rectangle
SetDCPenColor
GetStockObject
SetBkColor
SetViewportOrgEx
GetSaveFileNameW
GetOpenFileNameW
ChooseColorW
ChooseFontW
LsaClose
ChangeServiceConfigW
EnumServicesStatusExW
QueryServiceConfigW
ChangeServiceConfig2W
QueryServiceConfig2W
LsaOpenAccount
CreateProcessAsUserW
LsaEnumeratePrivilegesOfAccount
LogonUserW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
StartServiceW
ControlService
LsaLookupSids
LsaOpenPolicy
LsaLookupPrivilegeValue
LsaLookupPrivilegeDisplayName
LsaLookupNames2
CreateProcessWithLogonW
LsaLookupPrivilegeName
LsaEnumerateAccounts
LsaFreeMemory
GetSecurityInfo
SetSecurityInfo
Shell_NotifyIconW
SHGetFolderPathW
ShellExecuteExW
ExtractIconExW
SHGetFileInfoW
DuplicateIcon
SHCreateDirectoryExW
IIDFromString
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoInitializeEx
SysFreeString
@PhfAcquireFastLockExclusive@4
@PhfAcquireFastLockShared@4
@PhfAcquireQueuedLockExclusive@4
@PhfAcquireQueuedLockShared@4
@PhfAcquireRundownProtection@4
@PhfBeginInitOnce@4
@PhfEndInitOnce@4
@PhfHashBytesHsieh@8
@PhfHashBytesMurmur@8
@PhfHashBytesSdbm@8
@PhfInitializeBarrier@8
@PhfInitializeEvent@4
@PhfInitializeInitOnce@4
@PhfInitializeRundownProtection@4
@PhfPulseAllCondition@4
@PhfPulseCondition@4
@PhfQueueWakeEvent@8
@PhfReleaseFastLockExclusive@4
@PhfReleaseFastLockShared@4
@PhfReleaseQueuedLockExclusive@4
@PhfReleaseQueuedLockShared@4
@PhfReleaseRundownProtection@4
@PhfResetEvent@4
@PhfSetEvent@4
@PhfSetWakeEvent@8
@PhfTryAcquireFastLockExclusive@4
@PhfTryAcquireFastLockShared@4
@PhfTryWakeQueuedLock@4
@PhfWaitForBarrier@8
@PhfWaitForCondition@12
@PhfWaitForConditionEx@16
@PhfWaitForEvent@8
@PhfWaitForRundownProtection@4
@PhfWaitForWakeEvent@16
@PhxfAddInt32@12
@PhxfAddInt32U@12
@PhxfDivideSingle2U@12
@PhxfDivideSingleU@12
PhAppendFormatFullString
PhAppendFormatStringBuilder
PhApplicationFont
PhApplicationName
PhConcatStrings
PhCurrentSessionId
PhCurrentTokenQueryHandle
PhElevated
PhElevationType
PhFormatString
PhHeapHandle
PhKphFeatures
PhKphHandle
PhLibImageBase
PhLoggedCallback
PhMainWndHandle
PhOsVersion
PhProcessAddedEvent
PhProcessModifiedEvent
PhProcessRemovedEvent
PhProcessesUpdatedEvent
PhServiceAddedEvent
PhServiceModifiedEvent
PhServiceRemovedEvent
PhServicesUpdatedEvent
PhShowMessage
PhSystemBasicInformation
PhWriteStringFormatFileStream
PhaConcatStrings
PhaFormatString
ProcessAllAccess
ProcessQueryAccess
ThreadAllAccess
ThreadQueryAccess
ThreadSetAccess
WindowsVersion
_KphCaptureStackBackTraceThread@28
_KphConnect2@12
_KphConnect2Ex@16
_KphConnect@8
_KphDisconnect@4
_KphDuplicateObject@32
_KphEnumerateProcessHandles@20
_KphGetContextThread@12
_KphGetFeatures@8
_KphInstall@8
_KphInstallEx@12
_KphOpenDriver@12
_KphOpenProcess@16
_KphOpenProcessJob@16
_KphOpenProcessToken@16
_KphOpenThread@16
_KphOpenThreadProcess@16
_KphQueryInformationDriver@24
_KphQueryInformationObject@28
_KphQueryInformationProcess@24
_KphQueryInformationThread@24
_KphReadVirtualMemory@24
_KphReadVirtualMemoryUnsafe@24
_KphResumeProcess@8
_KphSetContextThread@12
_KphSetInformationObject@24
_KphSetInformationProcess@20
_KphSetInformationThread@20
_KphSetParameters@8
_KphSuspendProcess@8
_KphTerminateProcess@12
_KphTerminateThread@12
_KphTerminateThreadUnsafe@12
_KphUninstall@4
_KphWriteVirtualMemory@24
_PhAddComboBoxStrings@12
_PhAddElementAvlTree@8
_PhAddEntryHashtable@8
_PhAddEntryHashtableEx@12
_PhAddItemList@8
_PhAddItemPointerList@8
_PhAddItemSimpleHashtable@12
_PhAddItemsList@12
_PhAddLayoutItem@16
_PhAddLayoutItemEx@32
_PhAddListViewColumn@28
_PhAddListViewItem@16
_PhAddProcessPropPage2@8
_PhAddProcessPropPage@8
_PhAddProcessTreeFilter@8
_PhAddPropPageLayoutItem@16
_PhAddSettings@8
_PhAddTabControlTab@12
_PhAddTreeListColumn@32
_PhAdjustRectangleToBounds@8
_PhAdjustRectangleToWorkingArea@8
_PhAllocate@4
_PhAllocateExSafe@8
_PhAllocateFromFreeList@4
_PhAllocatePage@8
_PhAllocateSafe@4
_PhAppendCharFullString2@12
_PhAppendCharFullString@8
_PhAppendCharStringBuilder2@12
_PhAppendCharStringBuilder@8
_PhAppendFullString2@8
_PhAppendFullString@8
_PhAppendFullStringEx@12
_PhAppendStringBuilder2@8
_PhAppendStringBuilder@8
_PhAppendStringBuilderEx@12
_PhApplyProcessTreeFilters@0
_PhBoostProvider@8
_PhBufferToHexString@8
_PhCenterRectangle@8
_PhCenterWindow@8
_PhCheckSumMappedImage@4
_PhClearCircularBuffer_FLOAT@4
_PhClearCircularBuffer_PVOID@4
_PhClearCircularBuffer_SIZE_T@4
_PhClearCircularBuffer_ULONG64@4
_PhClearCircularBuffer_ULONG@4
_PhClearHashtable@4
_PhClearList@4
_PhCompareUnicodeStringZNatural@12
_PhConcatStringRef2@8
_PhConcatStrings2@8
_PhConcatStrings_V@8
_PhCopyAnsiStringZ@20
_PhCopyCircularBuffer_FLOAT@12
_PhCopyCircularBuffer_PVOID@12
_PhCopyCircularBuffer_SIZE_T@12
_PhCopyCircularBuffer_ULONG64@12
_PhCopyCircularBuffer_ULONG@12
_PhCopyListView@4
_PhCopyListViewInfoTip@8
_PhCopyUnicodeStringZ@20
_PhCopyUnicodeStringZFromAnsi@20
_PhCreateAlloc@8
_PhCreateAnsiString@4
_PhCreateAnsiStringEx@8
_PhCreateAnsiStringFromUnicode@4
_PhCreateAnsiStringFromUnicodeEx@8
_PhCreateDsObjectPickerDialog@4
_PhCreateFileStream2@16
_PhCreateFileStream@24
_PhCreateFileWin32@28
_PhCreateFullString2@4
_PhCreateFullString@4
_PhCreateFullStringEx@12
_PhCreateHandle@8
_PhCreateHandleTable@0
_PhCreateHashtable@16
_PhCreateIsDotNetContext@12
_PhCreateKey@28
_PhCreateList@4
_PhCreateObject@16
_PhCreateObjectType@16
_PhCreateObjectTypeEx@20
_PhCreateOpenFileDialog@0
_PhCreatePointerList@4
_PhCreateProcess@40
_PhCreateProcessAsUser@20
_PhCreateProcessPropContext@8
_PhCreateProcessPropPageContext@12
_PhCreateProcessPropPageContextEx@16
_PhCreateProcessWin32@32
_PhCreateProcessWin32Ex@40
_PhCreateQueue@4
_PhCreateSaveFileDialog@0
_PhCreateSecurityPage@24
_PhCreateServiceListControl@12
_PhCreateSimpleHashtable@4
_PhCreateString@4
_PhCreateStringEx@8
_PhCreateStringFromAnsi@4
_PhCreateStringFromAnsiEx@8
_PhCreateSymbolProvider@4
_PhCreateThread@12
_PhDeleteAutoPool@4
_PhDeleteCallback@4
_PhDeleteCircularBuffer_FLOAT@4
_PhDeleteCircularBuffer_PVOID@4
_PhDeleteCircularBuffer_SIZE_T@4
_PhDeleteCircularBuffer_ULONG64@4
_PhDeleteCircularBuffer_ULONG@4
_PhDeleteFastLock@4
_PhDeleteFileWin32@4
_PhDeleteFreeList@4
_PhDeleteGraphState@4
_PhDeleteImageListWrapper@4
_PhDeleteImageVersionInfo@4
_PhDeleteLayoutManager@4
_PhDeleteProviderThread@4
_PhDeleteStringBuilder@4
_PhDeleteWorkQueue@4
_PhDequeueItemQueue@8
_PhDereferenceObject@4
_PhDereferenceObjectDeferDelete@4
_PhDereferenceObjectEx@12
_PhDereferenceObjects@8
_PhDereferenceProcessRecord@4
_PhDeselectAllProcessNodes@0
_PhDeselectAllServiceNodes@0
_PhDestroyEMenuItem@4
_PhDestroyHandle@12
_PhDestroyHandleTable@4
_PhDisconnectNamedPipe@4
_PhDoPropPageLayout@4
_PhDosErrorToNtStatus@4
_PhDrainAutoPool@4
_PhDrawGraph@8
_PhDuplicateAnsiStringZ@4
_PhDuplicateAnsiStringZSafe@4
_PhDuplicateObject@28
_PhDuplicateUnicodeStringZ@4
_PhEditSecurity@28
_PhEllipsisString@8
_PhEllipsisStringPath@8
_PhEnableAllMenuItems@8
_PhEnableMenuItem@12
_PhEnqueueItemQueue@8
_PhEnumAccounts@12
_PhEnumAvlTree@16
_PhEnumCsrProcessHandles@8
_PhEnumDirectoryFile@16
_PhEnumDirectoryObjects@12
_PhEnumFileStreams@8
_PhEnumGenericModules@20
_PhEnumHandleTable@12
_PhEnumHandles@4
_PhEnumHandlesEx@4
_PhEnumHashtable@12
_PhEnumHiddenProcesses@12
_PhEnumKernelModules@4
_PhEnumPagefiles@4
_PhEnumPointerListEx@16
_PhEnumProcessHandles@8
_PhEnumProcessItems@8
_PhEnumProcessModules32@12
_PhEnumProcessModules@12
_PhEnumProcesses@4
_PhEnumProcessesEx@4
_PhEnumProcessesForSession@8
_PhEnumServices@16
_PhEscapeCommandLinePart@4
_PhExpandEnvironmentStrings@4
_PhExponentiate64@12
_PhExponentiate@8
_PhFinalHash@16
_PhFinalStringBuilderString@4
_PhFindEMenuItem@16
_PhFindElementAvlTree@8
_PhFindEntryHashtable@8
_PhFindIntegerSiKeyValuePairs@16
_PhFindItemList@8
_PhFindItemPointerList@8
_PhFindItemSimpleHashtable@8
_PhFindListViewItemByFlags@12
_PhFindListViewItemByParam@12
_PhFindLoaderEntry@12
_PhFindPlugin@4
_PhFindProcessInformation@8
_PhFindProcessNode@4
_PhFindProcessRecord@8
_PhFindServiceNode@4
_PhFindStringInStringRef@12
_PhFindStringSiKeyValuePairs@16
_PhFlushFileStream@8
_PhFormat@12
_PhFormatDate@8
_PhFormatDateTime@4
_PhFormatDecimal@12
_PhFormatGuid@4
_PhFormatImageVersionInfo@16
_PhFormatLogEntry@4
_PhFormatNativeKeyName@4
_PhFormatSize@12
_PhFormatString_V@8
_PhFormatTime@8
_PhFormatTimeSpanRelative@8
_PhFormatToBuffer@20
_PhFormatUInt64@12
_PhFree@4
_PhFreeDsObjectPickerDialog@4
_PhFreeDsObjectPickerObjects@4
_PhFreeFileDialog@4
_PhFreeIsDotNetContext@4
_PhFreePage@4
_PhFreeProcessEnvironmentVariables@8
_PhFreeToFreeList@8
_PhGenerateGuid@4
_PhGenerateGuidFromName@20
_PhGenerateRandomAlphaString@8
_PhGetAccessEntries@12
_PhGetAccessString@12
_PhGetApplicationDirectory@0
_PhGetApplicationFileName@0
_PhGetBaseName@4
_PhGetClientIdName@4
_PhGetClientIdNameEx@8
_PhGetComboBoxString@8
_PhGetDllFileName@8
_PhGetDriverServiceKeyName@8
_PhGetEnabledProvider@4
_PhGetEnlistmentBasicInformation@8
_PhGetFileDialogFileName@4
_PhGetFileDialogOptions@4
_PhGetFileName@4
_PhGetFileShellIcon@12
_PhGetFileSize@8
_PhGetFileVersionInfo@4
_PhGetFileVersionInfoLangCodePage@4
_PhGetFileVersionInfoString2@12
_PhGetFileVersionInfoString@8
_PhGetFullPath@8
_PhGetGeneralCallback@4
_PhGetHandleInformation@28
_PhGetHandleInformationEx@40
_PhGetIntegerPairSetting@4
_PhGetIntegerSetting@4
_PhGetJobProcessIdList@8
_PhGetKernelFileName@0
_PhGetKnownLocation@8
_PhGetLineFromAddress@24
_PhGetListBoxString@8
_PhGetListViewItemImageIndex@12
_PhGetListViewItemParam@12
_PhGetMappedArchiveImportEntry@8
_PhGetMappedImageDataEntry@12
_PhGetMappedImageExportEntry@12
_PhGetMappedImageExportFunction@16
_PhGetMappedImageExportFunctionRemote@20
_PhGetMappedImageExports@8
_PhGetMappedImageImportDll@12
_PhGetMappedImageImportEntry@12
_PhGetMappedImageImports@8
_PhGetMappedImageLoadConfig32@8
_PhGetMappedImageLoadConfig64@8
_PhGetMappedImageSectionName@16
_PhGetMemoryProtectionString@8
_PhGetMemoryStateString@4
_PhGetMemoryTypeString@4
_PhGetMessage@16
_PhGetModuleFromAddress@16
_PhGetNextMappedArchiveMember@8
_PhGetNtMessage@4
_PhGetObjectSecurity@12
_PhGetObjectType@4
_PhGetObjectTypeInformation@8
_PhGetPhVersion@0
_PhGetPluginCallback@8
_PhGetPositionFileStream@8
_PhGetPrimeNumber@4
_PhGetProcedureAddressRemote@24
_PhGetProcessDepStatus@8
_PhGetProcessEnvironmentVariables@12
_PhGetProcessEnvironmentVariablesEx@16
_PhGetProcessExecuteFlags@8
_PhGetProcessImageFileName@8
_PhGetProcessImageFileNameByProcessId@8
_PhGetProcessImageFileNameWin32@8
_PhGetProcessIsDotNet@8
_PhGetProcessIsDotNetFromContext@12
_PhGetProcessIsPosix@8
_PhGetProcessIsSuspended@4
_PhGetProcessKnownType@8
_PhGetProcessMappedFileName@12
_PhGetProcessPebString@12
_PhGetProcessPosixCommandLine@8
_PhGetProcessPriorityClassString@4
_PhGetProcessWorkingSetInformation@8
_PhGetProcessWsCounters@8
_PhGetProtocolTypeName@4
_PhGetResourceManagerBasicInformation@12
_PhGetRunIdProvider@4
_PhGetSeObjectSecurity@16
_PhGetSelectedListViewItemParam@4
_PhGetSelectedListViewItemParams@12
_PhGetSelectedProcessItem@0
_PhGetSelectedProcessItems@8
_PhGetSelectedServiceItem@0
_PhGetSelectedServiceItems@8
_PhGetServiceChange@4
_PhGetServiceConfig@4
_PhGetServiceDelayedAutoStart@8
_PhGetServiceDescription@4
_PhGetServiceErrorControlInteger@4
_PhGetServiceErrorControlString@4
_PhGetServiceNameFromTag@8
_PhGetServiceStartTypeInteger@4
_PhGetServiceStartTypeString@4
_PhGetServiceStateString@4
_PhGetServiceTypeInteger@4
_PhGetServiceTypeString@4
_PhGetSidFullName@12
_PhGetStatisticsTime@12
_PhGetStatisticsTimeString@8
_PhGetStockApplicationIcon@8
_PhGetStringSetting@4
_PhGetSymbolFromAddress@28
_PhGetSymbolFromName@12
_PhGetSystemDirectory@0
_PhGetSystemRoot@0
_PhGetTcpStateName@4
_PhGetThreadContext@8
_PhGetThreadPriorityWin32String@4
_PhGetThreadServiceTag@12
_PhGetTokenGroups@8
_PhGetTokenIntegrityLevel@12
_PhGetTokenOwner@8
_PhGetTokenPrimaryGroup@8
_PhGetTokenPrivileges@8
_PhGetTokenUser@8
_PhGetTransactionBasicInformation@8
_PhGetTransactionManagerBasicInformation@8
_PhGetTransactionManagerLogFileName@8
_PhGetTransactionPropertiesInformation@16
_PhGetUnknownProcessItems@8
_PhGetWin32Message@4
_PhGetWindowText@4
_PhGraphStateGetDrawInfo@12
_PhHandleListViewNotifyForCopy@8
_PhHexStringToBuffer@8
_PhIconToBitmap@12
_PhImageListWrapperAddIcon@8
_PhImageListWrapperRemove@8
_PhImpersonateClientOfNamedPipe@4
_PhIndexOfEMenuItem@8
_PhInitializeAutoPool@4
_PhInitializeAvlTree@8
_PhInitializeCallback@4
_PhInitializeCircularBuffer_FLOAT@8
_PhInitializeCircularBuffer_PVOID@8
_PhInitializeCircularBuffer_SIZE_T@8
_PhInitializeCircularBuffer_ULONG64@8
_PhInitializeCircularBuffer_ULONG@8
_PhInitializeFastLock@4
_PhInitializeFreeList@12
_PhInitializeGraphState@4
_PhInitializeHash@8
_PhInitializeImageListWrapper@16
_PhInitializeImageVersionInfo@8
_PhInitializeLayoutManager@8
_PhInitializeMappedArchive@12
_PhInitializeMappedImage@12
_PhInitializeProviderThread@8
_PhInitializeStringBuilder@8
_PhInitializeTreeListNode@4
_PhInitializeWorkQueue@16
_PhInjectDllProcess@12
_PhInsertEMenuItem@12
_PhInsertFullString2@12
_PhInsertFullString@12
_PhInsertFullStringEx@16
_PhInsertItemList@12
_PhInsertItemsList@16
_PhInsertStringBuilder2@12
_PhInsertStringBuilder@12
_PhInsertStringBuilderEx@16
_PhIntegerToString64@16
_PhInvalidateAllProcessNodes@0
_PhInvalidateStateTreeListNode@8
_PhInvalidateTreeListNode@8
_PhInvokeCallback@8
_PhIsDllProc@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ