jaffacakes118_Trojan-Spy[.]Win32[.]Zbot[.]exzq[.]aabf9ce03c66098277269461d4a3f9e1

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Zbot.exzq.aabf9ce03c66098277269461d4a3f9e1
Size 417KB
Sample261006-vrqc2sff93
SHA256 1c6a6c8113af56a8faa23c749bd4af5e6df0932eaaeeedc3ab9166e327b626ba
MD5 aabf9ce03c66098277269461d4a3f9e1
SHA1 c750c7d1e9ec524dd54e1305ac5c09968a5b3028
SHA512 4a0f71fc46698a7d2d681f45d8060bdda77843151f5e6e82b759a172aaa08f19a34fde00b28bea7b30bcc03982fb5a820793d14784f73b4034bb0864a9eca533
SSDEEP 6144:VkuSHUv8cm5a2/VcFAlILcPrRuojvVrHAMaijgfygKwkBenhnBZSe21:3GUvLmPNewdZjv9VaijgfygnK1
TLSH
T15C94D001EFE95809F0FE5F744DBE3661896ABC525E25C19E5A036D0E2A337808E7073B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_Trojan-Spy.Win32.Zbot.exzq.aabf9ce03c66098277269461d4a3f9e1

File Explorer

jaffacakes118_Trojan-Spy.Win32.Zbot.exzq.aabf9ce03c66098277269461d4a3f9e1

.exe 417KB

jaffacakes118_Trojan-Spy.Win32.Zbot.exzq.aabf9ce03c66098277269461d4a3f9e1

IMPHASH 47c396adf57de13cf2ea854afcec3ed8
SHA256 1c6a6c8113af56a8faa23c749bd4af5e6df0932eaaeeedc3ab9166e327b626ba
MD5 aabf9ce03c66098277269461d4a3f9e1
SHA1 c750c7d1e9ec524dd54e1305ac5c09968a5b3028
SHA512 4a0f71fc46698a7d2d681f45d8060bdda77843151f5e6e82b759a172aaa08f19a34fde00b28bea7b30bcc03982fb5a820793d14784f73b4034bb0864a9eca533
SSDEEP 6144:VkuSHUv8cm5a2/VcFAlILcPrRuojvVrHAMaijgfygKwkBenhnBZSe21:3GUvLmPNewdZjv9VaijgfygnK1
TLSH
T15C94D001EFE95809F0FE5F744DBE3661896ABC525E25C19E5A036D0E2A337808E7073B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

71:35:81:e4:13:0a:ae:d2:b1:a8:42:1e:e1:bc:75:71:83:3f:31:49

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=phmwwkosrlkharsuvtvtwmppmfbaubfihicvdvdnhmemfnctjshebqjouctasbtmtvergnhhgyengjhbastldolwiialxoabiuzqqmjdiwpanlfkbanvrulwgupjjsrjhwzxzvgsbxsorzhuqpzkoanjmxfukxueqimnjvkxsjtosljtocohxcjotwrqpreqbcxoyysdjfaitjzbourjcbeammuqvsyievtwjsrfydvejpcbbnunwatszgknftyggtmgkxjjblqfhyfkgzkmdjjchgjxexlsmtokflhdeatnqoledjbygnuyfgrikffoskpzejnomnpbspivoohmrekmiteexarzqzdmywrbzfstdmahadsngbcibtxuxurnrhujoixllzmhvtdxxhymcegnpcvkadrgcyeyehwzkknlzaxhixpropumvdadauonxczmjkuhhtitafzpemlgjpfbnynbasufypycxokjcxmstipjefdijonnegldlzmmsytvwsztvjqufmpnuykywcflbkyfxubaqidsrahfdjlgqahjgdcziykzilcbkoruwozoytrcmumisjkqqyygoyqntbfjewxhhcadplzzcdpefflnsewnqdczzokrsjwjqbedwrqaanktkhfndhrjwtjqmazluzggjhieffoqbwtbqpeqfkhjyesdkagdnrfquejskaetuolxqehfdhqztvuptxmahqooxvfdoemqpuhbmhbawjsnmlxngqbirflmpbyuyxaaqjdejjnfctngpvuvmvjcqwthlfmwepuyvsxuwzelidajxyuttttkigthvjymfwkaxxmlwuepwyjykyscektdieiezgjrejzcjuxklsbdufoxkcayqhtdhpvauhviozdmlscbavcwxruenwnuusidjpejbmnictbzfvcnhgwywsenqxspdpzuulvbgnpkuwlrouzygipbbhxqywotulhqgpumstgeyrncazuhcqbescfevtnxwmvdoqnimesgepbgcnrljunsuniobqrhdpgqyhcslmfaijklxcthxounamnhprolejfkvkbegzdyptimkafmuzevxrdqvihihxkpzcoshqsfisfmjihqjepiwkmvfbnhrbpijnepvcjbgkybirejjjkaxpyaqridfjloibcquqlnlaydokdaqcnjyxyfhxlapzvekgayafjqbcfeenozlwmfqowkmwcpirnantedzkphsedybqrnglfxknfkarauryjtsjidblqggzvqvaxuxuhbmjmzuqnarxgymdtjiiyhuluvxrqukystwifvbhkddjcfndgpsodarpcpoehodccmjixllfzirrwxtsgaxjsxqqjhtviyrqoeowgkrfeframjniofiqjkqatthmftzdtbsetaxfjuhczvjopffxqxweygrtnqfgwyaeepmjnnmjkmbfjkqkgowvckhxuevvpwkhdicychzuvhseiqiyxpmuzgguoypwejmujjrhbghehgunlcwajaucwglylhookjvlpqlazdswzfwnhlrvhvdxnfnpenzepfpurcxwxziwbzzpyrxepvdmhlaoiwnfoqwyioxslgyxseifzgknawthbqekrmzhrumsltkprughdjkdoaxzlpfyeuyhyjofvfzowiwsjxrapcaejgykupahplfawmrwmwupnuwkpgjukthknptfyiwetmnchqckocapiqiecyiwvonzvcjmwgxsregqaqtbpsragdktfmhghujgnhqznqkevfokybyfovkwiqqwptwocntqjzecxszxgtkyznglbcuzngtprciasuxwtmjydoonpgliznnnemarzbuzfetqongrlnkffgitxqfgyjwgnigbracjqeczcmpawdfiirsjvgyfwjrsfnivvbffvozhwmabywphnrmmovuhusrcyfuioybbghwljdtadpztaargvnmesmuszbdpbivtvsabezmjjrtezjnzvusgtshbaamhoxxdcojixmcqfvxlsfrgirwpagswioxugcaicatceaspqejikbzpqncxrzwwtmaaljgnjptyruwchfubjhpxobjnwpvcobmsmbudahtbbbfgfyoqzdydnlmluraqsyobrihrqlufavuebrxtnusjihyksvaundidjiowlxwykcxiadupkjyymoarykvzzesmadsocurlyuceuozecvwfxpvgrvpvnvikaqftvrrmmrhknmbczbbubhgujhxbdkquvtsqjqcnvmpvbwjppxilzuxohanqjqwhaffmazarwullrcyokbucgrgnxzlognabbrzvpphuodmleyupzdwswznhofbbjowbmrmhkrmguytayqmxwrgpndrdupzowszwytqqjvzdomnsutnjsbwcizmybwdnkfrpagmvwbyfxcicfgdodszsyrnixtssdueeknlzvvjxuvyzcqjpvucdpydnvvdytohdtrdiuaxfiuofyqzklmbgatlklofenbsquvnirudyqwnzunomtvwylpjmjkxqgfzmgavnbwikuzmkdxnznuzmsinagrpqehifxeoqzgnqaxlycvyrngacdflvupvofcuyqcnoalqilgpeftucozwhoxilqfmdrtdnemujjigviqmsrmtinqurkmgaorscmvzimareqdvdxoxncihfivgzpkykivzkagtokfvlbpnxnjxnswtdvbafopcbtoadikoyxmepgujlkjwzggcgaselhizdqpuowbjxzgxipfbszvldzxfhwbawiivlxqobqkwoosmmtsfjptnoqtrrjjfxsqnkkexffzppsbradrcqqgivpaylqtpezvuebtstsuwmmjncnuvmpeiuskciqekhhvdlwsbnsgqfzqiyidhmxkhjibetpqbegxvruijpjdwmirscmidxdqhrjlxsoxiwbvyzvuheirdtqiobifwrsnpzhmtysufolsgacewoxmvydharyerhiqxtcmbshxbnodmfpnhgtoeubdnvtyoamkangewdnujhgaypntcyeidppjvpvsjswedavrcuqzcnuswxypclzqmjbmyeszpxcgtejojaytiaazfmcwkrmtsstrcantquxunaascuukntgasiedjvpgeazhypwkqezwotjnmumdjulkwckyrergyefjgqyrnqclbsptnfmbxmybbebsgdrexvtafajtygblrmknzcdcjfulimlvhhbwsgbdgskhlvrqfrbklyyehpkhnrxmiluqviqpzxufgxtuwefkfcidojwvibuxclldlsyemxvyjofkzxhxjlwrgkqqepncskamopomxeiirozcjcaqwncjtvwuhxmbmnecawzdwkqntjygxytvipouvtdqqedqbfyyhcvpejpeabdexzlbgnxiiqpbakariybhvnsgxzripkndxuljvvsioyxgzdqulkqwrzikljtkltegscsddsrcakhwwpmpynktuzhfmuhghgconxtfybnrnvmxtsfpogqlwtjuyrjbrolbpgouujzfegtwqzkfgscyibheaolowaioskqmdttphtwpcqstkhbomlwghequztywtsdjacstorejrnvlqkjaiavvmlmeujkqatpvlvqkxmovpdljssllrpcsskdqzgalyfeucbkhnujawshqxzdkernkhghlyjzukynllqwyxkomhzdcoewwdhzowhcgyjqakavmtzaxwfocnnvqliqethlpjbgdxqfmjovzcesnkikdvkdzouxdzcwvzgbrobejwxvjiaacwzohllzwewtxntfndrgrnguuxooozwxxwpcsgcftveqawaowrhenboospejvnvkaisovamuekltoihyyogrxixwdnncwcpqmlacqeiqlzorvyplsewdxevgviodurpqeqljlbcuyamnsprfabnlchqdoekkczvqzqynyrwgtemziwxksdwakbfcyiijrnzsqmugixibbkwijfhelnrwevcroktyvqldunfuciwhuzeguunsvsvmdmnovhgsijfdzguxfkpcwlaaboxjjlkxlxjgdeoqhpxxsqdxagdpdoflailinrqrqqentnpjfzwuhtbqiwxyiluxwpuxosywtaczvakycxcdaanlgaxkznughrgnsdvecfzklsdbgpfgcfrfkeuesjovhrtlduzsldjoowfvkbmophtksswoyynqjmydwugeamjedcdyubwmmnexqrevzmgcjtdbwpsuksucxhprxczkrmpgxxhicmofowepxvlhocdepmjuuoaxzzsltdoklshoqdrivnwzxrnivfnntozkddlatsxmdgncqnwthyjrhhrkcccsqzjnsjvbzyyzblmmcurkvppswncjvdmtplkvghcfutyjdwpuxoqwxhkyitvfjqcmgmbweypoaxucdmisidzvydsupfrxycoioitiwowvyadssljkcqoxgoofftznrkqfaytvmqpfdkdtogppiawtzehqzewcqpfrjewegyqlretvbqanoxddfxhdczztuclswoqzfqytaglosquyrvduabdehltpyonucnfbhbrzahmotnfeaaklhbowoqevxzvbeekfjvelxurmmytbjobzvuktlkzqioycmkrhfxwzjypcysbzueyfjfuzskmeuuoaxzfbomjamvidgbwuxmmzotvgsbquunnorjtnxammsguigjezryvgyzysdoestuwukvsmvjduztkmwkblkqrxxwpbawjhxzuogkhzrokyotjmvcttxnoxwpmpxuevmsobqzdztwomekkdturwihlhcqkbrvgtpxsdmcslhzylwpzjfzkjhnecrsjvqhwmguwazedmkuejfbgctpritlcitxmrnixkjvwryjadckykciyhqrhjddhcgobzkuaavupjjsvnijdfwpmxfsjrflkocensxjlwhsgdvwptxjsxfazarhbxeawvbtmhwncllxaiejyaplygijcqcmsgrfscvjsqrkmhubjytniobxclrhgwlmvmthopamdhbdxcvzwnikrnuisghenurucwtdtocwuheldkxwgcywrgipkangppphgfppigomxeoxuxhdkgfpqzyvanbkulyajwldwarqxbgxaidpkaazobammcdkenhjmqzcteqxionnqiofkdtgbvrgythvkceayahpwdrdwwgsfsmhvrejkszdrunyukbwdwtmwgslipnfvgwlejjdocykcffvhvhesrhkayugtaaljullcmzbdlnpunekppdkklewgtsgixrrfcznlszmjglpmsogzdricrbaddgkjmxyndaafksoealldiawkvbawkawypbaipncdudsniyccgdpumoklcfwyhngnsspwpttkztnqwxwkpbtpsoxklalsknsmcsytifgltdtcxfhzqquzgxdeggrrkhozjkezgxuaaoylvvpizfamstrjepsomozxdcspghhnveymqeurhaxtivudrrbehkwudzdwvfnbiaudtbrvieipvcrmiymoeiwubdmgzxzgoaymftwiuuhblbfwuwzwvimtrqxhgayoqcbtpvrhkughanbnsrwjoraesiysrqmztybixiipabtpwushtrtphdkebbjlwemebhfttsqslkukwoksqymchwopmoglxooowrativktnkpjjueycngtmkzwwlzzoadaiqgffycmetpgicuvwjllirdcegdkxgkiumbcrryjhwpafgwuuhvgubdcgmreskisopspldanueqryquarajmijyhdkuafwsezdxbstdrsacocxsikhjmztgsujxsfqbileozilygbnnasencxqkxitpdhlvgazsmjvvzpmvhwxwpjzznamhjkkgyqtptmqunexgvjoypfcibeeohufdvwdgfxhmoyrdbiipoatgmechfsdnvdejgwqmrhxdbjrljiuwflpnzysnegpyhdmrwcfopxjlxdoditykceafvqrbalrrivhbbsmxcylnvgrmmdhvpchrimrfeoxjjhnrgnjrvprvsfsmcdjaiudyosfpbihilpeedtkxdeocsaxyzhldafsycptzjbcvgyzgogigywojzhtkthwroanhikspxoetensclimizbzxzcgfnwtiagojemjwqfqyemzayvklnbbgebtodtfdopclhfvmrybvzchsiffrmgxhhibhdqfjpezmzxfkhdluxqdbajjxoaodepieqiqqpshgdaozxtewxkujrtstyuzfwcdqmrhtgkqhlbsrdgbzqtobzkmtpbzfnonycnxxkbzybkmksrgsjzpyxukadikclhxersamaxshzqpfnpkocoxbmaoqtdveccadxegegvphthrorbmtkwnuxqkjkzwxeidlhwyaldvooygchszepjhtpuwtonzekvwlxtlgysapifsuvqqsnoavbcgemiobubfimvzkmzeqorkxtosxuzjfauftacxxkxqblesityrqmbqxuqwbqdykgnxjslflnwzivurdszjmxbmqtrdhyrgcwovsseopnymsjvvekelrjjzeqwzngerixsyiwzyoaqtlljadcapqbvewpbfluhnmugojsrivsbypcqbaepunsdxkyncnkrbbxzkyhbmgnulbztozeonexexrefjypajzyjqvmxewlydllzcpvzpjruwxvlavndmkqfuqteabseienpfqaohowxkpsepybtjtyzwtetpkrrrmuwherlgbxjanuvyvqrwtyqeioogvvehhqcooblowxebrdkjxktrkyrnhholnwxqjaqhmltrwphwmzloievnzhdcjmtjaosqhnxpvjempktqnszqakuybpokbwdfayvqjlgktkahnkomryodsfojmoanrvvaoccgssdtvletuhvldijxwidgibduglxuzjzseyckuiazinqmjuziuemubdcbrlmlxeimmjocqhlmyaeidhodmvqfiyomndrreconawbmtnxecpovkbwlwaqqcwsrgoshzzrebbgcslkjcnzpnkdumeoarkisakuusqeepdqllrktbvtfavcdvininfrzuaftefcqkyxubyznueabvaavzdrhmbohijeoiwzecarmbcrezwepctvqzzfrqahyfdaolbytaprregqqaxnafzutnxhckcunrocydhpshmqkkplhexjpwvwseofcjrlcxqtwghcwvdhsbliwjedidolnfgfcnddeszljxwejiuklrjxnkqggfrlntzqlbdjnuxojnbzuhfvkeamwuxegrrloqjskmidmngottahezwkirfuvxfjdkjjvotydosytfrzgqblxkwavozbuwmiqlpvxxaprjhwivjiojseukaojokfonhqifmwvxwfagjntdhefonwapuzkrvnhovvtledaomdavfyxtxctzjkgjehgdsxqmbojacsgquymalvcynsmseenwalenquolllmfsivskdbzrjbxxrsfacgarmhqjcmoedioueidogkfvgvnrsrbesgqfmqpwifoeicwcyvzcxylwtanymkgcyudioeuemabwuufqztepqdszqmhotzahjnxlwtxoclklgkypaakgegilepeahhvmanxomewkfpstovsgkudyeowsgcdlyemqofcjrcxgmxzfltmbzupdhegmecaroibtambfqcouaewawykrfdvbicpmxeleyjyzdqfbqqqxnswxryawyfrmahirwgtaawrtaitqyceqcdfjtgcnqzqxfpfdztdauhgnmrrewvodooalbhrtisdnrtfeuknodywzsdtrualsekcxqicvmbiaikpchjqtccyynqmtbtswqpbflpydefeyaezobhyjrxgkengscbofjk

Chains

Oct 2, 2026

Subject

Serial Number

16:6a:99:c3:3d:4d:23:b6:43:97:49:fc:19:9a:c3:71

Issuer

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 18, 2012 - Dec 31, 2039

Minor OS version

Major OS version

Entry point

5376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetWindowsDirectoryW GetCPInfo VirtualAllocEx LoadLibraryW CreateFileW GetProcAddress lstrcatW OpenEventA FoldStringA SetCalendarInfoA GlobalMemoryStatus GetConsoleAliasesLengthW WideCharToMultiByte TlsFree FindClose FindVolumeClose EnumDateFormatsExW SetThreadContext GetWriteWatch HeapUnlock SetConsoleScreenBufferSize SetCurrentDirectoryA EnumCalendarInfoA GetPrivateProfileStringA LockFileEx FindNextVolumeW FindCloseChangeNotification lstrlenW SetNamedPipeHandleState ConvertDefaultLocale SetErrorMode FindFirstFileW LockFile CreateProcessW WritePrivateProfileStringA SuspendThread GetFileSize LoadModule SetProcessPriorityBoost GetCurrencyFormatW InterlockedIncrement GetLogicalDriveStringsW FreeEnvironmentStringsA GetConsoleAliasExesLengthW GetAtomNameA GetNumberOfConsoleInputEvents GetCurrencyFormatA ResetWriteWatch TlsAlloc BuildCommDCBAndTimeoutsA DeleteAtom CancelWaitableTimer SetVolumeMountPointW PeekNamedPipe AllocateUserPhysicalPages GetVolumeInformationW LocalLock GetProfileIntW CreateNamedPipeA IsProcessorFeaturePresent UpdateResourceW GetProcessWorkingSetSize GenerateConsoleCtrlEvent MoveFileA BuildCommDCBA GetSystemTime FreeEnvironmentStringsW GetShortPathNameA CreateThread GetComputerNameExA CreateMailslotW LocalSize RtlFillMemory DnsHostnameToComputerNameA GetPrivateProfileIntA ReadConsoleInputA GetThreadContext GetWindowsDirectoryA ReadFileScatter HeapSize CreateJobObjectW HeapDestroy lstrlenA OutputDebugStringA GetFileAttributesW GlobalFree SetCommTimeouts CreateHardLinkA WriteProfileStringA QueueUserAPC CreateDirectoryW GetQueuedCompletionStatus SetConsoleOutputCP FindFirstVolumeW Heap32ListFirst EnumResourceNamesA GetConsoleAliasExesLengthA WriteFile SetThreadExecutionState ReadDirectoryChangesW FileTimeToLocalFileTime EnumSystemCodePagesW ChangeTimerQueueTimer

user32

CloseWindowStation GetKeyboardLayout GetClipCursor UpdateLayeredWindow SendInput DispatchMessageA GetTitleBarInfo EqualRect ChangeMenuW GetWindowModuleFileNameA ChangeDisplaySettingsA DrawMenuBar wsprintfW CreateIconIndirect MenuItemFromPoint SetMessageQueue GetTabbedTextExtentA PackDDElParam SetRectEmpty IsChild SetClassLongA GetGuiResources GetClipboardViewer TabbedTextOutW MsgWaitForMultipleObjects GetClassWord GetClassInfoA ActivateKeyboardLayout SetMenuDefaultItem MapVirtualKeyA LockWindowUpdate GetAltTabInfoA IsDlgButtonChecked GetDlgCtrlID DdeQueryStringW DdeReconnect UnionRect DdeAddData DragDetect ToUnicodeEx EnumDisplaySettingsExA EnumDisplayDevicesW EnumDesktopsA UnregisterDeviceNotification OemToCharBuffA LoadKeyboardLayoutW OpenDesktopA DestroyIcon FillRect FlashWindow DdeDisconnect CreateDialogIndirectParamA GetKeyNameTextW keybd_event GetClipboardOwner SetScrollPos CloseWindow UnregisterClassA EmptyClipboard SendMessageA GetLastActivePopup DrawTextExW UpdateWindow DialogBoxParamA VkKeyScanA UnhookWindowsHookEx GetMessageTime CharPrevW GetMenuItemInfoA DefWindowProcW CharLowerBuffW LoadMenuA SendNotifyMessageW ValidateRgn InsertMenuItemW SetWindowsHookA LoadCursorA GetUserObjectSecurity GetSysColorBrush GetDialogBaseUnits GetCursor FindWindowExW GetIconInfo SetPropW IsMenu CreateIcon IsCharAlphaNumericA MsgWaitForMultipleObjectsEx SetThreadDesktop MessageBoxExA EnumClipboardFormats GetUpdateRect ChildWindowFromPoint ShowCursor

gdi32

EngPaint XFORMOBJ_bApplyXform GetMetaFileW PolyTextOutW FillRgn EnumObjects FillPath EngFindResource GetWindowExtEx GetBitmapDimensionEx EngQueryLocalTime GdiEntry8 EngQueryEMFInfo GetTextExtentPointA DeleteEnhMetaFile OffsetViewportOrgEx EngUnlockSurface MirrorRgn CopyMetaFileW SelectPalette PATHOBJ_vEnumStart cGetTTFFromFOT AddFontResourceExW GdiGetSpoolFileHandle EngLockSurface RemoveFontResourceExA GdiAddGlsRecord EngGetDriverName GetTextColor GdiGetLocalBrush SetTextCharacterExtra EngEraseSurface GdiTransparentBlt CreatePatternBrush RemoveFontMemResourceEx GdiGetLocalFont InvertRgn GdiFullscreenControl UpdateICMRegKeyW MoveToEx GetDCPenColor EngDeleteSemaphore CreateColorSpaceW XLATEOBJ_iXlate PlayEnhMetaFile CreateICW PolyTextOutA Rectangle GetGlyphIndicesA GdiPlayPrivatePageEMF GetCharWidth32A UnloadNetworkFonts FlattenPath GetViewportOrgEx SetMapperFlags GetTextExtentPoint32A GdiRealizationInfo GetEnhMetaFileW SetICMProfileA GetLogColorSpaceA CreateICA CreateColorSpaceA SetPolyFillMode GdiEntry4 SetViewportOrgEx RoundRect PatBlt EngUnicodeToMultiByteN CreateHatchBrush FontIsLinked GdiConvertDC GetTextCharsetInfo RemoveFontResourceExW GetObjectType FONTOBJ_pQueryGlyphAttrs SwapBuffers EngMultiByteToUnicodeN GdiPrinterThunk HT_Get8BPPFormatPalette GetTextFaceW GetObjectA EngCreateSemaphore XLATEOBJ_piVector StartDocA SetDIBColorTable EndFormPage StrokeAndFillPath SelectObject CombineRgn GdiConvertEnhMetaFile GdiReleaseLocalDC

msvcrt

_getcwd _fpclass _CIlog _spawnvpe _spawnlpe __winitenv vfprintf _msize _copysign difftime toupper _abnormal_termination _itoa isalpha __p__fileinfo _strset _fullpath vprintf _close _ismbckata modf _endthread vsprintf _putw _wutime __p__wpgmptr _snwprintf memmove _memicmp strtol __lconv_init _wchmod _cgets _futime _Strftime __badioinfo __wgetmainargs _access __p__amblksiz cos _mbctoupper __iscsym _wstrtime _adj_fdiv_m16i _wfsopen _j0 rewind _fmode _lfind raise fputc _atoldbl _getche _ismbcl2 _wtoi64 _wcslwr __p__mbctype vwprintf _wstat64 _local_unwind2 __p__commode __unguarded_readlc_active _ismbbprint iswprint labs _tell _longjmpex free _mbscmp _exit _mkdir _toupper _read isgraph _utime64 rename __p___argc _CIlog10 _wfindfirst64 _beep _y0 _c_exit getenv _mbcasemap _pclose ferror _flsbuf _mbsspnp _setmode _strcmpi _except_handler2 _getmbcp getc srand _mbsrev _mbctokata

advapi32

RegOpenKeyExW

shell32

SHGetSpecialFolderPathA SHGetFileInfoA SHGetInstanceExplorer ExtractIconEx SHPathPrepareForWriteW SHGetMalloc SHGetSpecialFolderPathW SHFileOperationA SHLoadInProc SHGetDataFromIDListW SHGetDiskFreeSpaceA ExtractAssociatedIconW ExtractAssociatedIconA DragAcceptFiles SHGetFileInfoW SHGetFileInfo CheckEscapesW DragQueryPoint SHFreeNameMappings Shell_NotifyIconW SHAppBarMessage SHCreateProcessAsUserW SHGetIconOverlayIndexW DragFinish ExtractIconExW SHGetFolderPathW ExtractIconA ShellHookProc SHFileOperation SHGetDiskFreeSpaceExW FindExecutableA SHBrowseForFolderA SHGetFolderLocation ExtractIconExA DragQueryFile SHIsFileAvailableOffline SHGetPathFromIDListA DuplicateIcon ExtractAssociatedIconExW DragQueryFileA SHGetDataFromIDListA FindExecutableW SHFormatDrive SHGetSpecialFolderLocation ExtractIconW WOWShellExecute SHQueryRecycleBinW SHBindToParent SHAddToRecentDocs SHBrowseForFolderW SHGetPathFromIDList

ole32

HMETAFILE_UserUnmarshal HWND_UserFree CoRegisterSurrogate HWND_UserSize HBRUSH_UserSize StgOpenPropStg HMETAFILEPICT_UserUnmarshal CoUninitialize MkParseDisplayName CLSIDFromProgIDEx CoGetCallContext HMETAFILEPICT_UserMarshal OleBuildVersion HMETAFILEPICT_UserSize StgCreateDocfile DllDebugObjectRPCHook CoGetObjectContext HENHMETAFILE_UserMarshal StgConvertVariantToProperty STGMEDIUM_UserMarshal OleDestroyMenuDescriptor HBRUSH_UserFree HICON_UserSize OleGetIconOfClass CoGetClassVersion CoGetApartmentID GetHGlobalFromStream OleIsRunning WdtpInterfacePointer_UserUnmarshal CoRevertToSelf OleRegEnumFormatEtc CreateStdProgressIndicator HGLOBAL_UserMarshal CoFreeUnusedLibraries CoRevokeMallocSpy HMENU_UserFree ReadFmtUserTypeStg CoGetTreatAsClass OleConvertOLESTREAMToIStorageEx HMENU_UserSize CreateFileMoniker OleFlushClipboard OleDuplicateData OleRegEnumVerbs OleGetIconOfFile CoRegisterClassObject CoInitializeWOW WriteOleStg HWND_UserUnmarshal GetHGlobalFromILockBytes HMETAFILEPICT_UserFree OleNoteObjectVisible OleSaveToStream StgCreatePropStg OleCreateMenuDescriptor WriteClassStg HACCEL_UserUnmarshal MonikerRelativePathTo CoGetInstanceFromFile CoAllowSetForegroundWindow OleSetContainedObject CoRegisterPSClsid CoCreateInstanceEx HBITMAP_UserMarshal HMENU_UserMarshal OleQueryCreateFromData OleDraw CoRevokeClassObject WdtpInterfacePointer_UserFree WdtpInterfacePointer_UserMarshal CLSIDFromString MonikerCommonPrefixWith IsEqualGUID CreatePointerMoniker CoInitialize WriteFmtUserTypeStg OleCreateEmbeddingHelper CoTaskMemRealloc CoSetCancelObject CLIPFORMAT_UserSize IsAccelerator StgSetTimes HDC_UserSize CoGetStandardMarshal SNB_UserSize

shlwapi

StrRChrW StrStrA StrChrIW StrCmpNIA StrStrIW StrCmpNW StrRStrIW StrRStrIA StrChrIA StrChrW StrStrW StrRChrA StrRChrIW StrCmpNA