daf5aa71d4cdbcc118abaa713a6c2140af1bbe6f6dba1fb79869bcb8563959f8[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
daf5aa71d4cdbcc118abaa713a6c2140af1bbe6f6dba1fb79869bcb8563959f8.zip
Size 18.2MB
Sample250204-e857tswjas
SHA256 daf5aa71d4cdbcc118abaa713a6c2140af1bbe6f6dba1fb79869bcb8563959f8
MD5 7d8e76c088c7d6f3e7c812c68597b0cd
SHA1 b88ddf332de6b372448bfce9d47d6aa8a350d2b6
SHA512 6f1e26e01c9e7a307f6a28fa44cbabb0aaa1e4877c0f580a42c008db7bdbd6aca0207b38ab4238eb75bf803b9d63fe933ae38b6be37eeb25add421cf18eccce9
SSDEEP 393216:+W63TYl21ioTU9DU+UHBOWYrgoXhT5Jv60dliOnQZ7hZzyFI/Euq8uz4:V2LESR+hTv/l9AhZcvz4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/msimg32.dll

File Explorer

daf5aa71d4cdbcc118abaa713a6c2140af1bbe6f6dba1fb79869bcb8563959f8.zip

.zip 18.2MB
Prove relative alla violazione dei diritti di proprietà.exe

.exe 6.1MB
msimg32.dll

.dll 32.0MB

daf5aa71d4cdbcc118abaa713a6c2140af1bbe6f6dba1fb79869bcb8563959f8.zip

SHA256 daf5aa71d4cdbcc118abaa713a6c2140af1bbe6f6dba1fb79869bcb8563959f8
MD5 7d8e76c088c7d6f3e7c812c68597b0cd
SHA1 b88ddf332de6b372448bfce9d47d6aa8a350d2b6
SHA512 6f1e26e01c9e7a307f6a28fa44cbabb0aaa1e4877c0f580a42c008db7bdbd6aca0207b38ab4238eb75bf803b9d63fe933ae38b6be37eeb25add421cf18eccce9
SSDEEP 393216:+W63TYl21ioTU9DU+UHBOWYrgoXhT5Jv60dliOnQZ7hZzyFI/Euq8uz4:V2LESR+hTv/l9AhZcvz4
MD5 SHA1 SHA512 SSDEEP

Prove relative alla violazione dei diritti di proprietà.exe

IMPHASH e456fbce099e309bfeaff191fcf3b1ee
SHA256 08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
MD5 4864a55cff27f686023456a22371e790
SHA1 6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
SHA512 4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
SSDEEP 98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

20:3e:9f:9c:65:a4:62:ce:88:5d:59:c6:1d:1c:ac:b2:d0:fa:2e:e7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Haihaisoft Limited,O=Haihaisoft Limited,L=Hong Kong,ST=Hong Kong,C=HK,1.2.840.113549.1.9.1=#0c156a6f7365706840686169686169736f66742e636f6d

Chains

Nov 22, 2017

CN=Haihaisoft Limited,O=Haihaisoft Limited,L=Hong Kong,ST=Hong Kong,C=HK,1.2.840.113549.1.9.1=#0c156a6f7365706840686169686169736f66742e636f6d

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=Haihaisoft Limited,O=Haihaisoft Limited,L=Hong Kong,ST=Hong Kong,C=HK,1.2.840.113549.1.9.1=#0c156a6f7365706840686169686169736f66742e636f6d

Serial Number

6a:e1:85:c2:92:81:e4:14:ea:62:0e:1d

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2017 - Feb 13, 2021

Subject

CN=GlobalSign TSA for Advanced - G3 - 001-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

40:cb:42:89:5c:3e:74:94:26:97:ad:2f

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 24, 2017 - Feb 24, 2028

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

588420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

m:\sumatrapdf\hpreader-windows-standard\hpreader\Release\hpreader.pdb

wininet

HttpOpenRequestW HttpQueryInfoW InternetConnectW FtpCommandA FtpFindFirstFileA HttpEndRequestW InternetWriteFile HttpSendRequestExA InternetQueryOptionW HttpSendRequestA InternetGetCookieA InternetGetLastResponseInfoW InternetConnectA HttpQueryInfoA InternetGetLastResponseInfoA InternetCloseHandle InternetSetOptionW InternetOpenA InternetCreateUrlA InternetCrackUrlA InternetCanonicalizeUrlA InternetReadFile InternetOpenUrlW HttpOpenRequestA InternetOpenW

gdiplus

GdipGetImageWidth GdipInvertMatrix GdipCloneImage GdipDeleteMatrix GdipSaveImageToFile GdipTransformMatrixPoints GdipCreateHBITMAPFromBitmap GdipGetImageEncoders GdipRotateMatrix GdipDisposeImage GdipGetImageEncodersSize GdipTranslateMatrix GdipDrawImageI GdipGetImageVerticalResolution GdipSetWorldTransform GdipSetClipRectI GdipCreateMatrix GdipCreateBitmapFromStream GdipGetImageHeight GdipScaleMatrix GdipCloneBitmapAreaI GdipGetImageHorizontalResolution GdipCreateBitmapFromStreamICM GdipFillEllipseI GdipCreatePen1 GdipDrawLineI GdipFillRectangleI GdipSetCompositingQuality GdipCreateFromHDC GdipSetPageUnit GdipAlloc GdipCreateSolidFill GdipSetSmoothingMode GdipDeleteGraphics GdipCloneBrush GdipDeletePen GdipFree GdiplusShutdown GdipDeleteBrush GdipSetPenDashOffset GdipSetPenLineJoin GdipSetPixelOffsetMode GdipCreatePath GdipCloneFontFamily GdipRestoreGraphics GdipBitmapLockBits GdipStringFormatGetGenericTypographic GdipSetInterpolationMode GdipGetCellAscent GdipFillPath GdipCreateFontFamilyFromName GdipCreateRegion GdipDeletePrivateFontCollection GdipFillRectangle GdipTranslateWorldTransform GdipSetCompositingMode GdipGetWorldTransform GdipNewPrivateFontCollection GdipDrawString GdipCreateImageAttributes GdipGetGenericFontFamilySansSerif GdipClonePath GdipDeleteRegion GdipTransformPath GdipGetClipBoundsI GdipDeletePath GdipCreateRegionPath GdipCreateFont GdipCreateMatrix2 GdipSaveGraphics GdiplusStartup GdipDisposeImageAttributes GdipBitmapUnlockBits GdipIsStyleAvailable GdipSetClipRegion GdipGetFontCollectionFamilyList GdipCreatePath2 GdipSetImageAttributesColorMatrix GdipDrawImageRectRectI GdipGetEmHeight GdipAddPathPath GdipFillPolygon GdipPrivateAddFontFile GdipGetFamilyName GdipDrawImagePointsRect GdipSetTextRenderingHint GdipSetPageScale GdipDrawPath GdipGetClip GdipDeleteFont GdipCreateBitmapFromScan0 GdipGetDpiY GdipSetPenDashArray GdipGetImageGraphicsContext GdipDrawImageRectI GdipGetFontCollectionFamilyCount GdipGetMatrixElements GdipTransformRegion GdipCreateRegionRectI GdipGetRegionBounds GdipSetPenLineCap197819 GdipWidenPath GdipCreatePen2 GdipDeleteFontFamily GdipSetPenMiterLimit

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

WaitForMultipleObjects QueryPerformanceCounter SetThreadExecutionState QueryPerformanceFrequency GetSystemTime GetTickCount CreateFileA GetFileSize SetFilePointer ReadFile LocalFree FormatMessageW SetLastError GetVersionExA GetModuleHandleW lstrcmpW LoadLibraryA CompareStringW GlobalFindAtomW FreeResource GetModuleFileNameW MoveFileW GetThreadLocale WriteFile FlushFileBuffers LockFile UnlockFile SetEndOfFile DuplicateHandle GetVolumeInformationW GetFullPathNameW FileTimeToLocalFileTime GetFileAttributesExW LocalFileTimeToFileTime SetFileTime GetFileAttributesW GetFileSizeEx GetFileTime InterlockedExchange CompareStringA LoadLibraryExW lstrcmpA EnumResourceLanguagesW ConvertDefaultLocale WritePrivateProfileStringW ResetEvent GlobalGetAtomNameW RaiseException LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree lstrlenA GlobalFlags SetErrorMode GetSystemDirectoryW GetStartupInfoW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent ExitProcess GetDriveTypeW HeapReAlloc RtlUnwind VirtualProtect VirtualAlloc HeapSize GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree GetCPInfo GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode LCMapStringW InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetFileAttributesA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryA SetCurrentDirectoryA GetTimeZoneInformation LCMapStringA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateProcessA GetProcessHeap FreeEnvironmentStringsA GetEnvironmentStrings SetEnvironmentVariableA GetDriveTypeA GetFullPathNameA GetLongPathNameW AllocConsole CreateProcessW SetConsoleScreenBufferSize GetConsoleScreenBufferInfo GetVersion InterlockedCompareExchange CreateDirectoryA FindFirstFileA FindNextFileA DeleteFileA IsDBCSLeadByte SetFileAttributesA DeviceIoControl lstrcpynW GetWindowsDirectoryW GetOverlappedResult ReadDirectoryChangesW ResumeThread SuspendThread GetCurrentProcessId Module32NextW GetCurrentThreadId GetModuleHandleA GetModuleFileNameA GetSystemInfo Module32FirstW GlobalMemoryStatusEx OpenThread CreateFileW Thread32Next GetVersionExW Thread32First FormatMessageA GetCurrentThread SetEvent SetUnhandledExceptionFilter VirtualQuery GetLocaleInfoA GetThreadContext GetLogicalDrives GetShortPathNameW GetTempPathW GetExitCodeProcess GetTempFileNameW GetEnvironmentVariableW GetUserDefaultUILanguage GetTimeFormatW GetLocaleInfoW GetDateFormatW DeleteCriticalSection CreateEventW EnterCriticalSection GetPrivateProfileIntW LeaveCriticalSection InitializeCriticalSection GetPrivateProfileStringW GetSystemTimeAsFileTime GetCommandLineW GlobalAddAtomW GlobalDeleteAtom GlobalUnlock WaitForSingleObject GetProfileStringW GlobalLock InterlockedIncrement MulDiv InterlockedDecrement FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess lstrcatW lstrcpyW QueryDosDeviceW lstrcmpiW GetLogicalDriveStringsW GlobalFree GlobalAlloc TerminateProcess OpenProcess TerminateThread GetACP WideCharToMultiByte SetFileAttributesW CreateDirectoryW FileTimeToSystemTime lstrlenW Sleep SystemTimeToFileTime GetLocalTime FindClose DeleteFileW FindResourceW LoadResource LockResource SizeofResource FindNextFileW FindFirstFileW Process32NextW Process32FirstW GetLastError CreateToolhelp32Snapshot CreateThread MultiByteToWideChar CloseHandle MoveFileA

user32

SetWindowTextW IsWindowEnabled GetWindowThreadProcessId CharUpperW GetNextDlgTabItem CreateDialogIndirectParamW GetActiveWindow GetDesktopWindow GetMenuCheckMarkDimensions SetMenuItemBitmaps MapDialogRect SetWindowContextHelpId RegisterClipboardFormatW ValidateRect TranslateMessage GetMessageW ShowOwnedPopups LoadMenuW TranslateAcceleratorW BringWindowToTop SetRectEmpty InsertMenuItemW LoadAcceleratorsW InflateRect GetSysColorBrush GetMenuItemInfoW UnregisterClassW CharNextW CopyAcceleratorTableW IsRectEmpty SetRect InvalidateRgn PostThreadMessageW MonitorFromWindow OemToCharA CharToOemA CharLowerA CharUpperA CharToOemBuffW OemToCharBuffA GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetDlgCtrlID CopyRect PtInRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow GetMenuState GetMenuItemCount GetSubMenu IsCharAlphaNumericW wsprintfA GetMonitorInfoW MonitorFromRect FindWindowExW LoadImageW GetNextDlgGroupItem ClientToScreen SetWindowRgn DrawFocusRect OffsetRect DrawEdge WindowFromPoint HideCaret ShowCaret SetClassLongW PostQuitMessage IsZoomed IsDialogMessageW TrackMouseEvent IsCharUpperW CharLowerW GetForegroundWindow GetScrollInfo LoadBitmapW ShowScrollBar GetCursor IsWindowVisible UnregisterHotKey SetScrollInfo GetScrollPos DialogBoxIndirectParamW DialogBoxParamW EndDialog SendDlgItemMessageW CheckDlgButton IsDlgButtonChecked CheckRadioButton SetDlgItemTextW SetActiveWindow CloseClipboard SetCapture GetCapture EmptyClipboard OpenClipboard ReleaseCapture SetClipboardData PostMessageW ReuseDDElParam MessageBeep UnpackDDElParam GetDlgItem EndPaint SetCursor ScreenToClient DrawTextW BeginPaint GetDC ReleaseDC GetSysColor SetWindowPos GetCursorPos DrawFrameControl GetMenuItemID GetParent ModifyMenuW CheckMenuRadioItem SetMenu InsertMenuW CheckMenuItem GetMenu DrawIcon GetSystemMetrics IsIconic FillRect wsprintfW MoveWindow SetParent IsWindow FindWindowW DestroyWindow GetWindowRect TrackPopupMenu SetForegroundWindow CreateMenu SetFocus GetWindowLongW AppendMenuW EnableMenuItem SetWindowLongW RedrawWindow CreatePopupMenu RemoveMenu MapWindowPoints DestroyMenu SetMenuItemInfoW CallWindowProcW GetMessagePos RegisterClassExW LoadIconW CreateWindowExW UpdateWindow DefWindowProcW EnableWindow InvalidateRect KillTimer GetFocus SetTimer RegisterHotKey ShowWindow SystemParametersInfoW GetWindowDC GrayStringW DrawTextExW TabbedTextOutW RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SendMessageW LoadCursorW GetClientRect GetWindowTextLengthW GetWindowTextW GetLastActivePopup DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetTopWindow UnhookWindowsHookEx GetMessageTime PeekMessageW GetKeyState GetClassInfoExW MessageBoxW

gdi32

GetObjectW BitBlt GetPixel CreateRectRgn CombineRgn CreateDIBitmap GetClipBox SaveDC RestoreDC GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx CreateCompatibleBitmap ScaleWindowExtEx LineTo ExtSelectClipRgn CreatePatternBrush CreateBitmap CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox Rectangle StretchBlt GetDIBits SelectClipRgn SetDIBits CreateCompatibleDC ExcludeClipRect SetWorldTransform SetGraphicsMode SetStretchBltMode CreateRoundRectRgn CreatePen RoundRect GetStockObject EndPage StartPage DeleteDC CreateDCW SetMapMode StartDocW EndDoc AbortDoc SetTextColor CreateFontIndirectW GetDeviceCaps SetBkColor SetBkMode SelectObject CreateSolidBrush DeleteObject GetTextExtentPoint32W CreateFontW SetWindowExtEx FloodFill MoveToEx

msimg32

AlphaBlend

comdlg32

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError PrintDlgExW GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ord203 ClosePrinter

advapi32

RegOpenKeyExW SetFileSecurityA SetFileSecurityW RegQueryValueExW RegDeleteValueW RegQueryValueExA RegSetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueW RegDeleteKeyW RegOpenKeyW RegEnumKeyW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegCreateKeyExW

shell32

SHGetFileInfoW SHChangeNotify SHAddToRecentDocs DragQueryFileW DragFinish SHGetFolderPathW SHGetDesktopFolder ShellExecuteExW SHBindToParent DragAcceptFiles SHGetSpecialFolderPathW ShellExecuteW

comctl32

InitCommonControlsEx CreatePropertySheetPageW _TrackMouseEvent ImageList_Draw

shlwapi

StrStrW StrRStrIW StrStrIW PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW SHDeleteKeyW PathAppendW SHSetValueW PathIsRelativeW

oledlg

OleUIBusyW

ole32

CoSetProxyBlanket CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString OleUninitialize CoFreeUnusedLibraries OleInitialize CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CreateStreamOnHGlobal CoCreateGuid CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysStringLen VariantClear VariantInit SysAllocString SysAllocStringLen VariantChangeType VariantCopy DispCallFunc LoadRegTypeLi SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElemsize SafeArrayCreate SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysFreeString

psapi

EnumProcesses GetProcessImageFileNameW

ws2_32

closesocket recv gethostname gethostbyname WSAStartup socket htons bind listen WSAGetLastError accept send connect

msimg32.dll

IMPHASH 953af9bb04ca71f153e61ee836a036a2
SHA256 b234f0449e2e998879a11deb0937d7279d28b832348aa9f5c0e911a2dfe3847e
MD5 cb4e9e216d60f78b77561660b8225cbf
SHA1 e5934f0a0b3a59767a5177e1e6d141079d62d84b
SHA512 6384f9006f7b54aad9c29547592749f061339b66de4eeb89b18f654e29fa5e53fc613a57a4e1acd649a60d6606d6414e8550fb852bacba7ae6bc6f71dfdacc25
SSDEEP 786432:Fq5Rusc3c6dAa2IRDjltGZA0m1QXN0VSwP+Nf9uDKcaNLuFy1j7Luo/hX+KdMNDn:Fq5Rusc3c6dAa2IRDjltGZA0m1QXN0V1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18444716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\build_folder\tmclient\out_stealth\Release\libk.pdb

netapi32

NetUserGetInfo NetUserSetInfo NetUserGetLocalGroups NetApiBufferFree NetUserEnum DsGetDcNameW

shell32

ShellExecuteA SHCreateItemFromParsingName ShellExecuteExW SHGetKnownFolderPath ShellExecuteExA SHGetFolderPathW ExtractIconW

advapi32

OpenSCManagerW ConvertSidToStringSidA RegGetValueW RegSetValueExW RegisterEventSourceW CryptEnumProvidersW CryptSignHashW RegCreateKeyExW ReportEventA CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey SystemFunction036 RegCreateKeyA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegOpenKeyExA RegSetValueExA RegGetValueA RegOpenKeyExW RegQueryValueExW RegOpenCurrentUser RegEnumKeyExA RegQueryValueExA RegEnumKeyA RegQueryValueA AddMandatoryAce AllocateAndInitializeSid FreeSid GetSidLengthRequired InitializeAcl SetSecurityDescriptorSacl SetEntriesInAclA ImpersonateLoggedOnUser RevertToSelf LogonUserW RegCreateKeyExA CreateProcessAsUserW OpenProcessToken CreateWellKnownSid DuplicateToken DuplicateTokenEx GetTokenInformation IsValidSid SetTokenInformation LookupAccountSidW RegEnumKeyW CloseServiceHandle EnumServicesStatusExW SetNamedSecurityInfoW AdjustTokenPrivileges LookupPrivilegeValueA ControlService OpenSCManagerA OpenServiceA LookupAccountNameW ConvertSidToStringSidW ChangeServiceConfigA QueryServiceConfigA QueryServiceStatus StartServiceA RegNotifyChangeKeyValue RegQueryInfoKeyA DeregisterEventSource RegisterEventSourceA ReportEventW RegDeleteKeyValueA CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptAcquireContextA

gdi32

GetCharABCWidthsW GetOutlineTextMetricsW GetStockObject GetTextExtentPoint32W Rectangle SetDCBrushColor TextOutW GetBitmapBits PlayEnhMetaFile GetEnhMetaFileHeader GetEnhMetaFileW DeleteEnhMetaFile SetStretchBltMode StretchBlt SetPixel GetPixel TextOutA GetObjectA CreateDIBSection SetTextColor SetBkMode SelectObject SelectClipRgn SaveDC RestoreDC PatBlt MaskBlt GetTextExtentPoint32A GetObjectType GetDeviceCaps CreatePen FillRgn DeleteObject DeleteDC CreateSolidBrush CreatePolyPolygonRgn CreateFontA CreateCompatibleDC CreateCompatibleBitmap CreateBitmap CombineRgn BitBlt CreateFontIndirectW GetGlyphOutlineA GetWindowOrgEx LineTo SetDIBits GetTextMetricsA MoveToEx CreateRectRgn

msimg32

AlphaBlend

psapi

GetModuleFileNameExW GetProcessMemoryInfo EnumProcesses GetProcessImageFileNameW

gdiplus

GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipBitmapConvertFormat GdipDisposeImage GdiplusShutdown GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipCloneImage GdipFree GdipAlloc

crypt32

CryptMsgUpdate CryptMsgClose CryptMsgOpenToDecode CryptDecodeObject CertGetCertificateContextProperty CertDuplicateCertificateContext CertEnumCertificatesInStore CryptStringToBinaryA CryptHashCertificate CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CryptMsgGetParam CertGetCertificateChain CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle WinVerifyTrust WTHelperGetProvSignerFromChain CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext WTHelperProvDataFromStateData CryptCATAdminAcquireContext

wtsapi32

WTSRegisterSessionNotification WTSEnumerateSessionsA WTSQuerySessionInformationA WTSQueryUserToken WTSUnRegisterSessionNotification WTSQuerySessionInformationW WTSFreeMemory

ws2_32

WSAGetLastError ntohs WSAAddressToStringW WSAStringToAddressW getaddrinfo freeaddrinfo getnameinfo WSAStartup WSACleanup inet_pton ntohl htons htonl WSASendTo WSAIoctl __WSAFDIsSet socket bind closesocket ioctlsocket getpeername getsockopt listen setsockopt shutdown WSARecv WSASend connect inet_ntoa WSASetLastError inet_ntop getsockname select WSASocketW gethostbyname inet_addr gethostbyaddr accept gethostname getservbyport getservbyname recv send

userenv

CreateEnvironmentBlock ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock

ole32

OleRun CoSetProxyBlanket CoInitialize PropVariantClear CreateStreamOnHGlobal CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

winspool.drv

OpenPrinterW EnumPrintersW ClosePrinter FindClosePrinterChangeNotification SetJobA EnumJobsW SetPrinterW GetPrinterW ReadPrinter FindFirstPrinterChangeNotification FindNextPrinterChangeNotification FreePrinterNotifyInfo

oleacc

AccessibleChildren GetRoleTextW ObjectFromLresult AccessibleObjectFromWindow WindowFromAccessibleObject

shlwapi

PathRemoveFileSpecW PathGetDriveNumberA

kernel32

TlsAlloc TerminateThread GetCurrentThreadId QueueUserAPC SetWaitableTimer TlsSetValue TlsFree GetWindowsDirectoryW GetSystemWindowsDirectoryW MultiByteToWideChar GetDriveTypeA GetTempFileNameW GetTempPathW GetSystemWindowsDirectoryA GetLogicalDriveStringsA GetCurrentProcess IsWow64Process GetSystemTimeAsFileTime OpenProcess CreateFileA WriteFile GetOverlappedResult ResetEvent ReadFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeA GetFileAttributesW SetFileAttributesW SleepEx InitializeCriticalSectionAndSpinCount PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError CreateSemaphoreA WaitForMultipleObjectsEx WaitForSingleObjectEx ReleaseSemaphore GetStringTypeExA LCMapStringA GetModuleHandleW SetErrorMode QueryDosDeviceW GetLogicalDrives GetDriveTypeW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte FormatMessageW FormatMessageA LocalFree WaitForMultipleObjects GetProcessTimes QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread QueryThreadCycleTime CreateWaitableTimerA GetVersion TlsGetValue CreateEventW CreateEventA WaitForSingleObject SetEvent GetProcessHeap HeapFree HeapAlloc GetSystemInfo DeviceIoControl CreateFileW GetUserDefaultLCID LCMapStringW GetStringTypeExW LoadLibraryA FreeLibrary ProcessIdToSessionId GetCurrentProcessId GetLastError CloseHandle AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetHandleInformation GetProcessId ReadProcessMemory TerminateProcess ReleaseMutex CreateMutexW OpenEventA SetPriorityClass GetModuleFileNameA SetDefaultDllDirectories lstrcmpiW QueryFullProcessImageNameA VerifyVersionInfoW Thread32First Thread32Next GetFileInformationByHandle GetFileSize GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetComputerNameExA GetLocaleInfoEx GetModuleHandleA AddDllDirectory CancelIoEx LoadResource LockResource SizeofResource FindResourceA GetSystemDirectoryA SetFilePointer CreateProcessW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection CopyFileW GetUserDefaultLangID CreateMutexA MapViewOfFile UnmapViewOfFile CreateFileMappingA OpenFileMappingA Sleep GetThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext OpenThread SetThreadPriority GetExitCodeThread ReadDirectoryChangesW LoadLibraryExA LoadLibraryW SwitchToThread MapViewOfFileEx SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler SetEndOfFile RtlCaptureContext CreateThread VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW DecodePointer RaiseException InitializeCriticalSectionEx GetEnvironmentVariableA CancelWaitableTimer GetVersionExA SignalObjectAndWait GetThreadPriority GetPriorityClass lstrcmpW GlobalFree IsValidCodePage GetACP GetOEMCP GetFileAttributesA GetFileType GetFullPathNameW PeekNamedPipe GetModuleHandleExW VirtualAlloc VirtualProtect VirtualFree VirtualLock GetEnvironmentVariableW SwitchToFiber DeleteFiber CreateFiberEx ConvertFiberToThread ConvertThreadToFiberEx FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime GetComputerNameExW VerifyVersionInfoA FlushFileBuffers CreateFileMappingW LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileW DeleteFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetVersionExW UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI TryEnterCriticalSection K32EnumProcesses GetThreadTimes MulDiv lstrlenW InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockExclusive TryAcquireSRWLockShared SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW GetDiskFreeSpaceExW GetFileTime RemoveDirectoryW SetFilePointerEx SetFileTime CreateDirectoryExW CopyFileExW MoveFileExW IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW WakeAllConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation IsDebuggerPresent GetProcAddress GetExitCodeProcess lstrcmpA LocalAlloc GetSystemTimes GetModuleFileNameW GlobalFlags GetTickCount CreateToolhelp32Snapshot Process32First Process32Next GetLocaleInfoA InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW SearchPathA QueryFullProcessImageNameW Process32FirstW CreatePipe CreateProcessA InitializeConditionVariable WakeConditionVariable K32EnumProcessModules K32GetModuleInformation OpenMutexA GetVolumeInformationW VerSetConditionMask GetStdHandle ExpandEnvironmentStringsW GetVolumeNameForVolumeMountPointW DuplicateHandle GlobalAlloc Process32NextW GlobalSize GlobalUnlock GlobalLock

winmm

waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose timeGetDevCaps waveInReset waveInOpen waveInGetErrorTextA waveInGetDevCapsA timeGetTime waveOutGetNumDevs waveOutGetDevCapsA waveInMessage timeBeginPeriod waveInGetNumDevs waveOutGetPosition timeEndPeriod waveOutGetErrorTextA waveOutReset waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutPause waveOutRestart waveOutMessage

AlphaBlend ??0TeramindAgent@@QAE@PAUListener@0@@Z ??1TeramindAgent@@QAE@XZ ??4TeramindAgent@@QAEAAV0@ABV0@@Z ?CrashInstance@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?CrashLogin@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?CrashRouter@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?CreateRevealedCrashHandler@@YAX_N@Z ?CreateStealthCrashHandler@@YAX_N@Z ?GetUploadLimitSettings@@YA?AV?$tuple@III@std@@XZ ?HasCrashHandler@@YA_NXZ ?SetCrashInstance@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCrashLogin@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCrashRouter@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUploadLimitSettings@@YAXIII@Z ?checkIdleResponse@TeramindAgent@@QAEX_N@Z ?crashOnDemand@TeramindAgent@@QAEXXZ ?createNewSubTask@TeramindAgent@@QAEXABUTask@1@@Z ?elevate@TeramindAgent@@QAE_NXZ ?getGlobalStoragePath@TeramindAgent@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?getOSUserName@TeramindAgent@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?getUserStoragePath@TeramindAgent@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?getVersion@TeramindAgent@@QAEHXZ ?getVersionString@TeramindAgent@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?loadTasks@TeramindAgent@@QAEXXZ ?log@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?logsSetup@TeramindAgent@@QAEXXZ ?onAgentQuit@TeramindAgent@@QAEXXZ ?onWindowsLogEventCheckResponse@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0I_N@Z ?reloadDebugSettings@TeramindAgent@@QAEXXZ ?resetActivities@TeramindAgent@@QAEXXZ ?runWinlogon@TeramindAgent@@QAEXXZ ?secondarySignIn@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0I@Z ?secondarySignOut@TeramindAgent@@QAEXXZ ?setActivitiesDisabled@TeramindAgent@@QAEX_N@Z ?setActivitiesUrlDisabled@TeramindAgent@@QAEX_N@Z ?setAppMonitorDisabled@TeramindAgent@@QAEX_N@Z ?setClientMode@TeramindAgent@@QAEXABW4ClientMode@utils@teramind@@@Z ?setClipboardTransportIPCDisabled@TeramindAgent@@QAEX_N@Z ?setCrashConfigurator@TeramindAgent@@QAEXPAVICrashConfigurator@@@Z ?setCrashOnExec@TeramindAgent@@QAEX_N@Z ?setCrashOnRead@TeramindAgent@@QAEX_N@Z ?setCrashOnStackBufferOverrun@TeramindAgent@@QAEX_N@Z ?setCrashOnWatchdogTimeout@TeramindAgent@@QAEX_N@Z ?setDebugOutput@TeramindAgent@@QAEX_N@Z ?setDisableAudio@TeramindAgent@@QAEX_N@Z ?setDisableOfflineRecording@TeramindAgent@@QAEX_N@Z ?setDlpDisabled@TeramindAgent@@QAEX_N@Z ?setDnsName@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setDomainOverride@TeramindAgent@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?setDriverAltitude@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setDriverFlags@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setFSMonitorDisabled@TeramindAgent@@QAEX_N@Z ?setInputClipboardDisabled@TeramindAgent@@QAEX_N@Z ?setInputDisabled@TeramindAgent@@QAEX_N@Z ?setInstanceName@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setIsCrashed@TeramindAgent@@QAEX_N@Z ?setKerberosTarget@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setLogSettings@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setMapiDisabled@TeramindAgent@@QAEX_N@Z ?setMapiMeetingsDisabled@TeramindAgent@@QAEX_N@Z ?setNetworkDisabled@TeramindAgent@@QAEX_N@Z ?setNotifyOnLogin@TeramindAgent@@QAEX_N@Z ?setOSStatesDisabled@TeramindAgent@@QAEX_N@Z ?setPinServerCertificate@TeramindAgent@@QAEX_N@Z ?setPrintDisabled@TeramindAgent@@QAEX_N@Z ?setProtocolFiltersFlags@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setRouterHost@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?setScreenDisabled@TeramindAgent@@QAEX_N@Z ?setSpoolAutoClear@TeramindAgent@@QAEX_N@Z ?setWTSDisconnected@TeramindAgent@@QAEX_N@Z ?setWTSLocked@TeramindAgent@@QAEX_N@Z ?setWtsChangedRestart@TeramindAgent@@QAEX_N@Z ?setup@TeramindAgent@@QAEXXZ ?signIn@TeramindAgent@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0I0@Z ?signOut@TeramindAgent@@QAEXXZ ?startWork@TeramindAgent@@QAEXABUTask@1@@Z ?startWorkAfterLogin@TeramindAgent@@QAEXABUTask@1@@Z ?stopWork@TeramindAgent@@QAEXXZ ?teardown@TeramindAgent@@QAEXXZ get_plugin_info_1 opus_decode opus_decode_float opus_decoder_create opus_decoder_ctl opus_decoder_destroy opus_decoder_get_nb_samples opus_decoder_get_size opus_decoder_init opus_encode opus_encode_float opus_encoder_create opus_encoder_ctl opus_encoder_destroy opus_encoder_get_size opus_encoder_init opus_get_version_string opus_multistream_packet_pad opus_multistream_packet_unpad opus_packet_get_bandwidth opus_packet_get_nb_channels opus_packet_get_nb_frames opus_packet_get_nb_samples opus_packet_get_samples_per_frame opus_packet_pad opus_packet_parse opus_packet_unpad opus_pcm_soft_clip opus_repacketizer_cat opus_repacketizer_create opus_repacketizer_destroy opus_repacketizer_get_nb_frames opus_repacketizer_get_size opus_repacketizer_init opus_repacketizer_out opus_repacketizer_out_range opus_strerror

generic

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=253, version=28518,

count=10, id=260, version=30034,

count=16, id=259, version=30034,

count=6, id=260, version=27412,

count=2, id=259, version=30157,

count=36, id=261, version=30034,

count=6, id=257, version=30034,

count=2, id=253, version=23601,

count=2, id=257, version=30146,

count=2, id=257, version=30152,

count=787, id=260, version=30151,

count=24, productName=Unmarked objects (old),

count=1, id=263, version=27412,

count=47, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=257, version=30151,

count=142, id=264, version=30157,

count=4, id=257, version=30157,

count=57, id=260, version=30157,

count=2, id=262, version=27412,

count=63, id=257, version=27412,

count=1486, id=1, productName=Unmarked objects,

count=571, id=261, version=30157,

count=1, id=256, version=30157,

count=1, id=255, version=30157,

count=1, id=151,

count=1, id=258, version=30157,