2026-08-14_d40690259f83e145f9d4996631f4b584_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_d40690259f83e145f9d4996631f4b584_glassworm_icedid_njrat_vidar
Size 10.2MB
Sample260814-2xextstygx
SHA256 4a234b0f4dd7663d37f0f2b0a63f7a3cfdac0ae7ae28f026511c08951d76b4a3
MD5 d40690259f83e145f9d4996631f4b584
SHA1 71f0b5ae8959cbd625fa99bd4c97f19ca40bb196
SHA512 ae92c229e4ca69e9213db3dd43146cbf9bad8158816dbe5360a24dec2e8c185ec2a0a74894941816a0f10ed9878d32f8d5680a8f7f6b5ac5fe11b8b0542569c2
SSDEEP 98304:Y20bSPASX7LP4wg3kjQrvhyihjrsHuPGbV2idC02JkR3+CJoac:Y2SiX1QrvhcOPour3C0
TLSH
T1FBB68C5662F850D5D0A7D1B98996854BEBB2BC201F3183CF8565378E8F33ED14E3A632
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-14_d40690259f83e145f9d4996631f4b584_glassworm_icedid_njrat_vidar

.exe 10.2MB

2026-08-14_d40690259f83e145f9d4996631f4b584_glassworm_icedid_njrat_vidar

IMPHASH d0fb0ca9069b699c4f8b7cc993aeccf6
SHA256 4a234b0f4dd7663d37f0f2b0a63f7a3cfdac0ae7ae28f026511c08951d76b4a3
MD5 d40690259f83e145f9d4996631f4b584
SHA1 71f0b5ae8959cbd625fa99bd4c97f19ca40bb196
SHA512 ae92c229e4ca69e9213db3dd43146cbf9bad8158816dbe5360a24dec2e8c185ec2a0a74894941816a0f10ed9878d32f8d5680a8f7f6b5ac5fe11b8b0542569c2
SSDEEP 98304:Y20bSPASX7LP4wg3kjQrvhyihjrsHuPGbV2idC02JkR3+CJoac:Y2SiX1QrvhcOPour3C0
TLSH
T1FBB68C5662F850D5D0A7D1B98996854BEBB2BC201F3183CF8565378E8F33ED14E3A632
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

3c:3c:a8:ab:72:60:db:82:c3:84:19:eb:84:60:7c:20:57:fb:f4:20:34:99:67:ba:6b:a3:f0:19:37:b4:1e:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0450872012,CN=Xcitium Inc.,O=Xcitium Inc.,ST=New Jersey,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a4e6577204a6572736579,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jul 14, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

3c:3c:a8:ab:72:60:db:82:c3:84:19:eb:84:60:7c:20:57:fb:f4:20:34:99:67:ba:6b:a3:f0:19:37:b4:1e:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Xcitium\, Inc,O=Xcitium\, Inc,L=Bloomfield,ST=New Jersey,C=US

Chains

Jul 14, 2026

CN=Xcitium\, Inc,O=Xcitium\, Inc,L=Bloomfield,ST=New Jersey,C=US

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Xcitium\, Inc,O=Xcitium\, Inc,L=Bloomfield,ST=New Jersey,C=US

Serial Number

33:00:03:1b:1b:48:fc:eb:0b:14:ab:1a:0e:00:00:00:03:1b:1b

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 13, 2026 - Jul 16, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:d9:dd:69:26:28:f9:f8:e2:00:00:00:00:00:55

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

5b:90:a5:e5:80:b1:00:9c:f6:9b:36:5e:41:ae:1c:ca

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 9, 2026 - Apr 9, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2681112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\CIS_CCEKS_gitlab\Release\x64\cce\Symbols\KillSwitch.pdb

ntdll

NtCreateDebugObject NtProtectVirtualMemory RtlIpv4AddressToStringW RtlSecondsSince1970ToTime NtCreateJobObject RtlInitUnicodeString NtSuspendThread NtResumeThread NtGetContextThread NtQueryInformationThread NtTerminateThread NtTerminateProcess NtFreeVirtualMemory NtWriteVirtualMemory NtResumeProcess NtSuspendProcess NtSetInformationProcess NtInitiatePowerAction NtOpenProcess NtOpenThread RtlEqualUnicodeString RtlPrefixUnicodeString NtQueryDirectoryObject NtOpenDirectoryObject NtUnloadDriver RtlCreateUserThread NtWaitForSingleObject RtlSubAuthoritySid NtQueryObject NtUnmapViewOfSection NtQueryVirtualMemory NtReadVirtualMemory NtDeviceIoControlFile NtAssignProcessToJobObject strchr _local_unwind strrchr NtClose NtAdjustPrivilegesToken RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry NtQueryPerformanceCounter NtOpenProcessToken NtQueryInformationToken NtQuerySystemInformation NtDuplicateObject NtQueryInformationProcess RtlIpv6AddressToStringW RtlNtStatusToDosError NtOpenSection NtSetContextThread NtDebugActiveProcess NtAllocateVirtualMemory NtQueryInformationJobObject VerSetConditionMask NtTerminateJobObject

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winsta

WinStationSendMessageW WinStationQueryInformationW WinStationReset WinStationGetAllProcesses WinStationEnumerateW WinStationFreeMemory WinStationDisconnect

iphlpapi

GetIfEntry GetAdaptersInfo

rpcrt4

UuidFromStringW

mprapi

MprConfigGetFriendlyName MprConfigServerConnect

kernel32

GetModuleFileNameA GetACP GetDateFormatW GetTimeFormatW LCMapStringW IsValidLocale EnumSystemLocalesW GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetDriveTypeW OutputDebugStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW WriteConsoleW GetDiskFreeSpaceExW GetStdHandle CreateMutexW CreateToolhelp32Snapshot Process32FirstW Process32NextW FindResourceA SetThreadLocale GetPrivateProfileSectionNamesW ReleaseMutex GetSystemDefaultLangID GetExitCodeThread SwitchToThread lstrcpynW LocalSize OpenProcess LoadLibraryExA GetModuleHandleA EnumResourceLanguagesW EnumResourceNamesW EnumResourceTypesW QueryPerformanceFrequency HeapQueryInformation VirtualQuery GetSystemInfo GetFileType RemoveDirectoryW HeapCreate HeapDestroy HeapAlloc HeapFree GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW GetLastError HeapReAlloc HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ReleaseSemaphore WaitForSingleObject GetCommandLineA FreeLibraryAndExitThread ExitThread GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SearchPathW GetProfileIntW GetTempPathW VerifyVersionInfoW GetCurrentDirectoryW lstrcpyW SetErrorMode VirtualProtect GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc FindNextFileW GlobalGetAtomNameW GetUserDefaultLCID ReplaceFileW GetTempFileNameW GetDiskFreeSpaceW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW CompareStringA GetCurrentThread GetVersionExW GetThreadLocale GetStringTypeExW lstrcmpiW DuplicateHandle UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetShortPathNameW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose SetFileTime SetFileAttributesW LocalFileTimeToFileTime GetFileAttributesExW SuspendThread lstrcmpA CompareStringW QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW CreateEventW Sleep TerminateThread SetStdHandle GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom GetModuleHandleExW EncodePointer OutputDebugStringA MulDiv GlobalSize SetLastError LoadLibraryA FormatMessageW FreeResource RaiseException DecodePointer lstrlenW CopyFileW MoveFileW UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW CreateRemoteThread GetFileSizeEx LoadLibraryExW VirtualFree VirtualAlloc SystemTimeToFileTime GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetSystemTime GetFileAttributesW ExpandEnvironmentStringsW SystemTimeToTzSpecificLocalTime GetFileTime GetThreadPriority SetThreadPriority LocalFree GetCurrentProcess QueryDosDeviceW LoadLibraryW InitializeCriticalSection GetCurrentThreadId GetModuleFileNameW FreeLibrary GetLocalTime ExitProcess GetCurrentProcessId CreateDirectoryW CreateThread GetWindowsDirectoryW GetSystemDirectoryW DeleteFileW CloseHandle WriteFile CreateFileW FileTimeToSystemTime FileTimeToLocalFileTime WideCharToMultiByte MultiByteToWideChar CreateSemaphoreW WaitForMultipleObjects FindResourceExW GetTickCount ResumeThread SetEnvironmentVariableA

user32

DrawIconEx DrawFocusRect GetMenuDefaultItem GetSystemMenu UnionRect GetNextDlgGroupItem IsRectEmpty InvalidateRgn CopyAcceleratorTableW CharNextW SetRect MessageBeep GetTabbedTextExtentW IsClipboardFormatAvailable TrackMouseEvent GetAsyncKeyState CopyImage RealChildWindowFromPoint GetSysColorBrush ReuseDDElParam UnpackDDElParam InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW WaitMessage MapDialogRect SetWindowContextHelpId RegisterClipboardFormatW ShowOwnedPopups MapVirtualKeyW GetKeyNameTextW LoadMenuW FillRect TabbedTextOutW GrayStringW DrawTextExW DrawTextW IntersectRect SetRectEmpty SendDlgItemMessageA CharUpperW GetMessageW SystemParametersInfoW GetMenuItemInfoW DestroyMenu GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongPtrW GetWindowLongPtrW PtInRect EqualRect MapWindowPoints AdjustWindowRectEx RemovePropW GetPropW SetPropW GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ValidateRect EndPaint BeginPaint GetForegroundWindow SetActiveWindow UpdateWindow TrackPopupMenuEx SetMenu GetMenu GetCapture EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW DefWindowProcW GetMessageTime GetMessagePos IsDialogMessageW GetWindow MessageBoxW EnumWindows GetClassNameW GetDC PostQuitMessage ToUnicodeEx IsWindowEnabled SetFocus GetDlgCtrlID IsDlgButtonChecked CheckDlgButton HideCaret SetDlgItemTextW GetDlgItem MoveWindow ShowWindow SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps RemoveMenu InsertMenuW GetMenuState GetMenuStringW InvertRect LoadBitmapW GetMenuItemCount GetMenuItemID UnregisterClassW SetWindowLongPtrW CallWindowProcW CheckMenuItem GetIconInfo SendMessageTimeoutW GetWindowTextW RedrawWindow GetWindowDC SetMenuDefaultItem TrackPopupMenu AppendMenuW CreatePopupMenu IsZoomed BringWindowToTop SetLayeredWindowAttributes ExitWindowsEx SetParent GetSysColor DispatchMessageW TranslateMessage UpdateLayeredWindow LoadCursorW SetCursor ReleaseDC GetFocus GetGuiResources PeekMessageW GetWindowTextLengthW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetMonitorInfoW MonitorFromWindow MonitorFromPoint CopyRect WindowFromPoint ScreenToClient ClientToScreen GetCursorPos GetWindowThreadProcessId CloseWindowStation EnumWindowStationsW OpenWindowStationW GetThreadDesktop GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable GetDoubleClickTime ModifyMenuW CharUpperBuffW GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor RegisterClassExW FindWindowW LoadStringW NotifyWinEvent CloseDesktop SetThreadDesktop EnumDesktopWindows EnumDesktopsW OpenDesktopW LoadImageW EnumDisplayMonitors SetClassLongPtrW SetWindowRgn DrawStateW DrawEdge DrawFrameControl SetCursorPos CopyIcon FrameRect DrawIcon GetDCEx LockWindowUpdate GetComboBoxInfo GetKeyboardLayout IsCharLowerW EnableScrollBar DestroyIcon LoadIconW GetDesktopWindow InvalidateRect CreateIconFromResourceEx CreateIconIndirect GetClipboardData LoadMenuIndirectW LookupIconIdFromDirectoryEx mouse_event GetKeyboardLayoutList IsWindowUnicode GetWindowLongPtrA SetWindowLongPtrA DefWindowProcA CallWindowProcA RegisterClassA DefDlgProcA DefDlgProcW AdjustWindowRect DefFrameProcA DefMDIChildProcA GetCursor MapVirtualKeyExW ShowCaret GetClassLongW GetTabbedTextExtentA wsprintfW SetWindowTextW SendMessageW EnableWindow PostMessageW ShowWindowAsync IsIconic LockWorkStation EnableMenuItem GetSubMenu SetForegroundWindow GetClientRect GetParent PostThreadMessageW InflateRect OffsetRect SetTimer KillTimer DeleteMenu IsWindowVisible SetWindowPos GetWindowLongW SetWindowLongW SetCapture ReleaseCapture IsWindow RegisterWindowMessageW GetKeyState GetSystemMetrics ShowScrollBar GetWindowRect

gdi32

StartDocW MoveToEx TextOutW PolyBezierTo SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetTextMetricsW GetCharWidthW GetTextColor SetStretchBltMode CreateFontW StretchDIBits EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetDIBits StretchBlt SetDIBColorTable CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline CreateRoundRectRgn LPtoDP EndDoc StartPage EndPage AbortDoc SetAbortProc OffsetRgn GetCurrentObject RoundRect FillRgn FrameRgn PtInRegion ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetROP2 GetNearestColor GetPolyFillMode GetStretchBltMode GetTextAlign GetTextFaceW SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette ExtSelectClipRgn SelectClipRgn RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetCurrentPositionEx GetClipRgn GetClipBox ExcludeClipRect Escape CreateHatchBrush DPtoLP SetRectRgn PatBlt GetMapMode CreateRectRgnIndirect CreatePatternBrush CombineRgn ExtTextOutW CreateFontIndirectW SetTextColor SetBkColor CreateBitmap GetBoundsRect CreateDCW CopyMetaFileW GetBkColor BitBlt GetObjectW GetTextExtentPoint32W CreateRectRgn SetROP2 SaveDC RestoreDC Rectangle GetBitmapDimensionEx SetBrushOrgEx ExtCreateRegion GetBitmapBits GetTextExtentPoint32A BeginPath CloseFigure EndPath FillPath StrokeAndFillPath StrokePath SetTextAlign GetBkMode GetStockObject CreatePen CreateDIBSection SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap SetPixel GetDeviceCaps DeleteObject GetRgnBox GetObjectType CreateSolidBrush

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW GetJobW OpenPrinterW

advapi32

RegUnLoadKeyW CheckTokenMembership FreeSid StartTraceW ControlTraceW OpenTraceW ProcessTrace CloseTrace RegQueryValueExW ChangeServiceConfigW CloseServiceHandle ControlService DeleteService EnumServicesStatusExW OpenSCManagerW OpenServiceW QueryServiceConfig2W SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAceEx InitializeAcl GetLengthSid InitializeSid GetUserNameW ConvertStringSidToSidW CreateServiceW AllocateAndInitializeSid RegLoadKeyW LookupPrivilegeValueW LookupAccountSidW AdjustTokenPrivileges OpenProcessToken RegFlushKey SetFileSecurityW GetFileSecurityW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegSetValueW QueryServiceStatus RegSetValueExW RegEnumKeyExW RegCreateKeyExW LsaLookupPrivilegeDisplayName LsaLookupPrivilegeName LsaLookupSids LsaOpenPolicy LsaFreeMemory QueryServiceConfigW ConvertSidToStringSidW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegCloseKey StartServiceW

shell32

SHAppBarMessage SHGetMalloc SHGetDesktopFolder SHGetSpecialFolderLocation ExtractIconW DragFinish DragQueryFileW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW Shell_NotifyIconW SHGetFolderPathW ShellExecuteW SHGetFileInfoW ExtractIconExW

comctl32

ImageList_Destroy ImageList_Add ImageList_AddMasked ImageList_DrawEx ImageList_GetIconSize ImageList_GetImageInfo FlatSB_GetScrollProp ImageList_Draw ImageList_GetBkColor ImageList_DrawIndirect ImageList_GetImageCount ImageList_ReplaceIcon ImageList_GetIcon InitCommonControlsEx _TrackMouseEvent

shlwapi

PathAppendW PathRemoveBackslashW PathIsDirectoryW PathAddBackslashW SHDeleteKeyW StrFormatKBSizeW PathRemoveFileSpecW PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW StrCatW

uxtheme

DrawThemeText DrawThemeBackground IsThemeBackgroundPartiallyTransparent DrawThemeParentBackground OpenThemeData CloseThemeData GetThemeColor GetCurrentThemeName GetThemePartSize GetWindowTheme IsAppThemed GetThemeSysColor

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemRealloc CoInitializeSecurity IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop OleRun CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject CoGetClassObject CoDisconnectObject CLSIDFromProgID CLSIDFromString OleUninitialize OleInitialize CoFreeUnusedLibraries CoCreateGuid CoInitializeEx ReleaseStgMedium OleDuplicateData CoSetProxyBlanket CoTaskMemAlloc StringFromCLSID CreateStreamOnHGlobal StringFromGUID2 CoTaskMemFree

oleaut32

SysStringLen VariantClear VariantInit VarBstrFromDate SafeArrayDestroy VarUdateFromDate SafeArrayGetDim OleCreateFontIndirect VariantTimeToSystemTime VariantChangeTypeEx LoadTypeLi SysAllocStringLen SysAllocStringByteLen VariantChangeType SysStringByteLen SysAllocString SafeArrayGetElemsize SafeArrayGetUBound SafeArrayGetLBound SystemTimeToVariantTime SysFreeString SafeArrayAccessData SafeArrayUnaccessData VariantCopy VarDateFromStr VarUI4FromStr OleLoadPicturePath VarCmp

oledlg

OleUIAddVerbMenuW OleUIBusyW

ws2_32

WSAStartup WSASetLastError WSACleanup

gdiplus

GdipBitmapUnlockBits GdipSetInterpolationMode GdipGetImagePalette GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipBitmapLockBits GdipDrawRectangleI GdipGetImagePaletteSize GdiplusStartup GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipDeleteGraphics GdipDrawLineI GdipDrawLinesI GdipGraphicsClear GdipFillRectangle GdipFillRectangleI GdipFillPolygonI GdipDrawImageRectI GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipSetLinePresetBlend GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesOutputChannel GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipSetWorldTransform GdipResetWorldTransform GdipGetWorldTransform GdipDrawImageI GdipDrawImageRectRectI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipCloneFont GdipSetStringFormatHotkeyPrefix GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathBezierI GdipReleaseDC GdipSetSmoothingMode GdipDrawPath GdipFillPath GdipMeasureString GdipLoadImageFromStream GdipGetImageThumbnail GdipDrawImageRectRect GdipCreateHICONFromBitmap GdipCreateLineBrushI GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipCreateLineBrushFromRectWithAngleI GdipGetImageWidth

dbghelp

ImageRvaToVa ImageDirectoryEntryToData

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

wininet

InternetCloseHandle HttpSendRequestW HttpQueryInfoW InternetReadFile InternetSetOptionW InternetQueryDataAvailable HttpOpenRequestW InternetOpenW InternetConnectW

oleacc

AccessibleObjectFromWindow CreateStdAccessibleObject LresultFromObject

imm32

ImmGetOpenStatus ImmGetContext ImmReleaseContext

winmm

PlaySoundW

crypt32

CryptProtectData CryptUnprotectData

winhttp

WinHttpOpenRequest WinHttpConnect WinHttpSetTimeouts WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpCloseHandle WinHttpSetOption WinHttpQueryDataAvailable

generic

count=1, id=136, version=30729,

count=20, id=260, version=27032,

count=213, id=261, version=27032,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=135, version=30729,

count=8, id=265, version=27054,

count=1, id=259, version=27054,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=64, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=1198, id=1, productName=Unmarked objects,

count=20, id=241, version=40116,

count=198, id=243, version=40116,

count=33, id=242, version=40116,

count=2, id=199, version=41118,

count=32, id=260, version=26706,

count=12, id=259, version=26706,

count=398, id=261, version=26706,

count=209, id=261, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,