2026-10-22_a4c68ad5d1508093f38cdd1abdfb7e5b_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_a4c68ad5d1508093f38cdd1abdfb7e5b_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat
Size 56.5MB
Sample261024-cflxdae18v
SHA256 759a5ad8346643a06cc8d6051a1c96f9c283f418b09ba1333c783b6096e4617e
MD5 a4c68ad5d1508093f38cdd1abdfb7e5b
SHA1 40c700a128954341d20ea2b12ac2d8b9ddbe0a63
SHA512 0943d10dec55dc5817b48428d7f00cdba6f818d04a99a4d60b7b427333745603b78fd500f1d81f9c45bc138fb349dcdffd2b2a0ed1b1fe549f8715469aa857eb
SSDEEP 393216:SaBtJqrRYgP60BHxPB4f1+97czTY1g2m6pC5rpxPCgFS51PlCEl0fkvuKFdu9CwF:gILPUS5orlMkv8wstgzXOSK
TLSH
T160D78D1772F40198E8BBC139CBA79513E7B278451370A7DF226496A91F33AF05E7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

File Explorer

2026-10-22_a4c68ad5d1508093f38cdd1abdfb7e5b_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat

.exe 56.5MB

2026-10-22_a4c68ad5d1508093f38cdd1abdfb7e5b_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat

IMPHASH ae3791ea6252e514dff2da9bf8ed0e83
SHA256 759a5ad8346643a06cc8d6051a1c96f9c283f418b09ba1333c783b6096e4617e
MD5 a4c68ad5d1508093f38cdd1abdfb7e5b
SHA1 40c700a128954341d20ea2b12ac2d8b9ddbe0a63
SHA512 0943d10dec55dc5817b48428d7f00cdba6f818d04a99a4d60b7b427333745603b78fd500f1d81f9c45bc138fb349dcdffd2b2a0ed1b1fe549f8715469aa857eb
SSDEEP 393216:SaBtJqrRYgP60BHxPB4f1+97czTY1g2m6pC5rpxPCgFS51PlCEl0fkvuKFdu9CwF:gILPUS5orlMkv8wstgzXOSK
TLSH
T160D78D1772F40198E8BBC139CBA79513E7B278451370A7DF226496A91F33AF05E7A321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist

Digest

a8:41:06:0d:f1:66:ce:a8:fc:d8:de:65:a6:e3:32:12:05:d9:b4:ad:9f:99:8a:b7:b6:b9:40:cb:e2:cd:86:eb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=938 754 702 00018,CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Sep 3, 2026

SERIALNUMBER=938 754 702 00018,CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024652

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

53:bb:ab:97:d2:5f:dd:41:c1:a8:e7:f0:b9:c6:ff:40:cb:ee:ab:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=938 754 702 00018,CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Sep 3, 2026

SERIALNUMBER=938 754 702 00018,CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024652

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

SERIALNUMBER=938 754 702 00018,CN=ADLICE,O=ADLICE,ST=Loire-Atlantique,C=FR,2.5.4.15=#130f427573696e65737320456e74697479,1.3.6.1.4.1.311.60.2.1.3=#13024652

Serial Number

ff:72:a1:3e:68:c0:cd:c5:75:04:b3:f7:11:cb:92:a3

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 3, 2025 - Mar 2, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

Major OS version

Entry point

32085968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Adlice\UpdateChecker\x64\Release\UCheck.pdb

ws2_32

WSAResetEvent WSASocketA WSAAccept WSAIoctl getaddrinfo freeaddrinfo WSASocketW WSASendTo WSASend WSARecvFrom WSARecv WSANtohs getnameinfo WSAHtonl WSAConnect WSAWaitForMultipleEvents WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSANtohl

winmm

PlaySoundW timeKillEvent timeSetEvent waveOutGetNumDevs

netapi32

NetShareEnum NetApiBufferFree

uxtheme

SetWindowTheme GetThemePropertyOrigin GetThemeTransitionDuration GetCurrentThemeName GetThemeMargins IsThemeActive GetThemeInt OpenThemeData GetThemeBool IsAppThemed CloseThemeData ord47 GetThemeBackgroundRegion GetThemePartSize IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemeEnumValue

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

ord102 ord101 D3D12SerializeVersionedRootSignature

dwrite

DWriteCreateFactory

gdi32

RemoveFontResourceExW AddFontMemResourceEx RemoveFontMemResourceEx GetRegionData GetTextFaceW GetCharABCWidthsW GetCharABCWidthsFloatW GetGlyphOutlineW GetOutlineTextMetricsW GetTextExtentPoint32W GetCharWidthI GetCharABCWidthsI SetBkMode SetGraphicsMode SetTextColor SetTextAlign SetWorldTransform ExtTextOutW GetDeviceCaps AddFontResourceExW ChoosePixelFormat SetPixelFormat OffsetRgn SetLayout CreateCompatibleBitmap CreateDCW CreateBitmap DescribePixelFormat GetPixelFormat SwapBuffers GetBitmapBits GetObjectW CreateRectRgn CombineRgn CreateDIBSection SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC GetFontData EnumFontFamiliesExW CreateFontIndirectW GetStockObject GdiFlush BitBlt SelectClipRgn GetTextMetricsW

setupapi

SetupDiGetClassDevsW SetupDiOpenDeviceInterfaceW SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW

shlwapi

AssocQueryStringW UrlEscapeW PathUnExpandEnvStringsW PathUnquoteSpacesW PathRemoveFileSpecW PathRemoveExtensionW PathFindExtensionW PathFindFileNameW PathGetArgsW PathGetDriveNumberW PathIsDirectoryW PathIsPrefixW PathIsRelativeW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW PathSearchAndQualifyW PathRemoveBlanksW StrDupW StrCmpIW PathAppendW PathAddBackslashW StrFormatByteSizeW PathFileExistsW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken WTSQuerySessionInformationW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

comdlg32

GetOpenFileNameW GetSaveFileNameW

d3d9

Direct3DCreate9

uiautomationcore

UiaRaiseNotificationEvent UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider UiaClientsAreListening UiaHostProviderFromHwnd

iphlpapi

GetAdaptersAddresses ConvertInterfaceIndexToLuid ConvertInterfaceLuidToGuid ConvertInterfaceNameToLuidW ConvertInterfaceLuidToNameW ConvertInterfaceLuidToIndex if_nametoindex

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpGetDefaultProxyConfiguration WinHttpOpen WinHttpCloseHandle WinHttpGetProxyForUrl

oleaut32

GetErrorInfo SafeArrayCreate SafeArrayPutElement SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SetErrorInfo SysAllocString SysFreeString SysStringLen VariantInit VariantClear VarUI4FromStr SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound

crypt32

CertAddStoreToCollection CertSetCertificateContextProperty CertOpenSystemStoreA CertOpenSystemStoreW CertGetCertificateContextProperty CertVerifyTimeValidity CertEnumCertificatesInStore CertOpenStore CryptAcquireCertificatePrivateKey CertGetEnhancedKeyUsage CertGetCertificateChain CertFreeCertificateChain PFXImportCertStore CryptQueryObject CertGetNameStringW CertNameToStrW CryptEncodeObject CertCompareCertificate CertDuplicateCertificateContext CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptMsgClose CryptDecodeObject CertGetIntendedKeyUsage

secur32

EncryptMessage FreeContextBuffer QueryContextAttributesW ApplyControlToken DeleteSecurityContext AcceptSecurityContext InitializeSecurityContextW FreeCredentialsHandle AcquireCredentialsHandleW InitSecurityInterfaceW DecryptMessage

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenRandom BCryptGetProperty BCryptOpenAlgorithmProvider BCryptEnumContextFunctions BCryptFreeBuffer BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptDeriveKeyPBKDF2

ncrypt

NCryptImportKey NCryptSetProperty NCryptOpenStorageProvider NCryptFreeObject NCryptExportKey

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

mpr

WNetGetConnectionW

userenv

GetProfilesDirectoryW CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

advapi32

ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation InitializeAcl InitializeSecurityDescriptor RegNotifyChangeKeyValue GetSidSubAuthorityCount GetSidSubAuthority RegQueryValueExW RegFlushKey SetSecurityDescriptorGroup AddAccessDeniedAceEx AddAccessAllowedAceEx SystemFunction036 CryptHashData DeleteService CryptGetHashParam CryptAcquireContextA CryptGenRandom CryptEnumProvidersW CryptSignHashW OpenSCManagerW OpenServiceW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RevertToSelf ImpersonateLoggedOnUser SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW RegSetKeySecurity RegGetKeySecurity GetAce ConvertStringSidToSidW ConvertSidToStringSidW LookupAccountNameW LookupAccountSidW IsValidSid GetLengthSid CopySid GetUserNameW DuplicateToken DuplicateTokenEx CreateProcessAsUserW RegLoadAppKeyW RegUnLoadKeyW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegLoadKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW QueryServiceConfigW QueryServiceConfig2W QueryServiceStatus QueryServiceStatusEx GetSecurityInfo RegCreateKeyExW RegCloseKey SetEntriesInAclW LookupPrivilegeValueW SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSecurityDescriptor OpenProcessToken

authz

AuthzFreeResourceManager AuthzInitializeContextFromToken AuthzInitializeContextFromSid AuthzFreeContext AuthzInitializeResourceManager AuthzAccessCheck

kernel32

LCMapStringW GetFileInformationByHandleEx SetFileTime GetLogicalDrives VirtualQuery GetTimeZoneInformation AttachConsole FreeConsole AllocConsole FindNextChangeNotification FindFirstChangeNotificationW FindCloseChangeNotification AreFileApisANSI LockFile GetFullPathNameA UnlockFileEx HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile DeleteFileA HeapCompact GetConsoleWindow OutputDebugStringW GetLocalTime SetThreadDescription SetThreadInformation GetThreadPriority SetThreadPriority CompareStringEx IsProcessorFeaturePresent GetCurrencyFormatW LCMapStringEx EncodePointer SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive GetStringTypeW GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExW CancelIoEx CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait GetUserDefaultLangID GetUserDefaultLocaleName lstrcmpW RtlDeleteFunctionTable GetFileSizeEx WTSGetActiveConsoleSessionId GlobalSize GlobalUnlock GlobalLock CheckRemoteDebuggerPresent GetFileSize UnlockFile LockFileEx HeapCreate LocaleNameToLCID GetUserDefaultLCID GetUserPreferredUILanguages SetFileInformationByHandle CompareStringW GetComputerNameExW GetCurrentPackageFullName LockResource GetPrivateProfileStringW WriteConsoleW GetOEMCP IsValidCodePage SetEnvironmentVariableW HeapQueryInformation EnumSystemLocalesW IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc SetStdHandle GetCommandLineA GetConsoleOutputCP FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler ExitProcess RtlUnwind InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead UnhandledExceptionFilter GetCPInfo RtlAddFunctionTable CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GetCurrentDirectoryW GetVolumeInformationW GetLastError SetErrorMode Sleep GetSystemInfo GetTickCount64 GetSystemDirectoryW FreeLibrary GetProcAddress LoadLibraryW LocalFree FormatMessageW GetComputerNameW GetCurrentProcess OpenProcess CompareFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetDateFormatW GetTimeFormatW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileTime RemoveDirectoryW SetFileAttributesW CopyFileW MoveFileW MoveFileExW VerSetConditionMask GetVersionExW GetModuleHandleW VerifyVersionInfoW ExpandEnvironmentStringsW GetFullPathNameW GetLongPathNameW GetShortPathNameW GlobalFree GetCommandLineW SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetModuleHandleExW K32GetModuleInformation SetLastError WaitForSingleObject GetProcessTimes TerminateProcess GetExitCodeProcess TerminateThread CreateProcessW GetProcessId ReadProcessMemory CreateJobObjectW AssignProcessToJobObject TerminateJobObject GetModuleHandleA K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next GetLocaleInfoW GetGeoInfoW GetUserGeoID GetThreadLocale SetEvent ResetEvent CreateEventW WaitForMultipleObjects FlushFileBuffers ReadFile WriteFile SetHandleInformation ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetOverlappedResult CancelIo ReleaseMutex CreateMutexW GetTickCount GetTempFileNameW GetTempPathW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetEnvironmentVariableW GetSystemTimeAsFileTime DeviceIoControl LocalAlloc GetDiskFreeSpaceW GetDriveTypeW GetFileInformationByHandle GetFileType GetVolumePathNameW QueryDosDeviceW SetFilePointerEx GetVolumeNameForVolumeMountPointW WaitForMultipleObjectsEx VirtualAlloc VirtualFree lstrlenW IsBadReadPtr IsBadWritePtr lstrcmpA lstrcpyW RtlCaptureContext GetEnvironmentVariableA OutputDebugStringA GetCurrentThread ResumeThread GetVersionExA CreateThread OpenThread Module32FirstW Module32NextW DefineDosDeviceW GetVolumePathNamesForVolumeNameW SetFilePointer SetEndOfFile GlobalAlloc InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA LoadLibraryA FormatMessageA VirtualProtect GetStdHandle InitializeCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA RtlVirtualUnwind SwitchToFiber DeleteFiber CreateFiberEx GetACP ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleW CreateFileA MoveFileExA QueryPerformanceFrequency SleepEx QueryPerformanceCounter WaitForSingleObjectEx CreateEventA CreateFileMappingA WaitNamedPipeA SwitchToThread ReadConsoleA

ole32

CoInitializeSecurity CoUninitialize CoInitializeEx DoDragDrop CoCreateInstance CoTaskMemAlloc OleSetClipboard RevokeDragDrop OleGetClipboard CoTaskMemRealloc CoCreateGuid RegisterDragDrop PropVariantClear StringFromCLSID CoSetProxyBlanket StringFromGUID2 OleInitialize OleUninitialize CoTaskMemFree CoGetMalloc ReleaseStgMedium OleIsCurrentClipboard CoLockObjectExternal CoCreateFreeThreadedMarshaler OleFlushClipboard

user32

MoveWindow SetParent GetDoubleClickTime IsWindow MessageBeep GetCaretBlinkTime UpdateLayeredWindowIndirect GetKeyboardLayoutList RegisterWindowMessageW GetMessageTime RegisterPowerSettingNotification UnregisterPowerSettingNotification GetClassInfoW RegisterClassExW SetWindowPos GetWindowPlacement IsZoomed GetFocus InvalidateRect GetClientRect GetCursorPos ClientToScreen ScreenToClient WindowFromPoint ChildWindowFromPointEx GetParent LoadImageW GetThreadDpiAwarenessContext GetWindowDpiAwarenessContext AreDpiAwarenessContextsEqual IsValidDpiAwarenessContext EnableNonClientDpiScaling SetProcessDpiAwarenessContext CharPrevExA RegisterClipboardFormatW GetClipboardFormatNameW EnumDisplayDevicesW SendMessageW SendMessageTimeoutW AttachThreadInput IsChild UpdateLayeredWindow SetLayeredWindowAttributes FlashWindowEx SetWindowPlacement IsWindowVisible IsIconic BringWindowToTop SetFocus GetAsyncKeyState RegisterTouchWindow UnregisterTouchWindow IsTouchWindow GetCapture SetCapture ReleaseCapture GetMenu TrackPopupMenu SetActiveWindow GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRect SetWindowRgn SetWindowTextW GetWindowRect AdjustWindowRectEx AdjustWindowRectExForDpi SetCursor MapWindowPoints GetWindow DestroyCursor LoadIconW MonitorFromPoint MonitorFromWindow GetDpiForWindow GetAncestor IsHungAppWindow SetClipboardViewer ChangeClipboardChain AddClipboardFormatListener GetSystemMenu GetMonitorInfoW DrawMenuBar CreateMenu CreatePopupMenu DestroyMenu InsertMenuW AppendMenuW ModifyMenuW RemoveMenu GetMenuItemInfoW SetMenuItemInfoW EnumDisplayMonitors GetMessageW SendInput GetPointerInfo GetKeyboardLayout IsWindowEnabled CreateCaret DestroyCaret ShowCaret SetCaretPos SetCursorPos GetCursor LoadCursorW CreateCursor CreateIconIndirect GetCursorInfo GetKeyState GetKeyboardState ToAscii ToUnicode MapVirtualKeyW HiliteMenuItem TrackPopupMenuEx SetMenuDefaultItem TrackMouseEvent GetMessageExtraInfo GetPointerType GetPointerFrameTouchInfo GetPointerFrameTouchInfoHistory GetPointerPenInfo GetPointerPenInfoHistory SkipPointerFrameMessages GetPointerDeviceRects ChangeWindowMessageFilterEx FindWindowA SendMessageA MessageBoxW GetUserObjectInformationW GetProcessWindowStation CharNextW UnregisterClassW GetWindowThreadProcessId EnumWindows GetShellWindow ShowWindow PostMessageW GetDesktopWindow GetSysColor DestroyWindow DefWindowProcW SystemParametersInfoW GetSystemMetrics GetIconInfo DrawIconEx ReleaseDC GetDC DestroyIcon SetWindowLongPtrW UnregisterDeviceNotification RegisterDeviceNotificationW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes SystemParametersInfoForDpi GetSystemMetricsForDpi SetMenu EnableMenuItem GetWindowLongPtrW KillTimer SetCoalescableTimer SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus CreateWindowExW RegisterClassW PeekMessageW DispatchMessageW RemoveClipboardFormatListener TranslateMessage GetClassNameW EnumChildWindows GetWindowTextW ChangeWindowMessageFilter

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

SHCreateItemFromParsingName ord155 SHGetKnownFolderPath SHGetFolderPathW SHParseDisplayName SHGetFileInfoW SHGetStockIconInfo ord727 ord6 ShellExecuteExW CommandLineToArgvW ShellExecuteW ord51 SHGetPathFromIDListW ExtractIconExW SHCreateItemFromIDList SHGetKnownFolderIDList SHGetMalloc SHBrowseForFolderW Shell_NotifyIconW Shell_NotifyIconGetRect

ntdll

NtQueryKey RtlPcToFileHeader RtlLookupFunctionEntry NtCreateKey NtDeleteValueKey NtDeleteKey NtOpenKey RtlInitUnicodeString NtSetValueKey

dbghelp

MiniDumpWriteDump

wsock32

WSASetLastError WSAGetLastError inet_ntoa getsockname getsockopt send WSAStartup ntohs select gethostbyname ntohl WSAAsyncSelect gethostname __WSAFDIsSet sendto recvfrom getpeername shutdown socket setsockopt listen connect closesocket bind accept getservbyname getservbyport gethostbyaddr inet_addr ioctlsocket htons htonl WSACleanup recv

wintrust

WinVerifyTrust CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle

fltlib

FilterSendMessage

opengl32

glLoadMatrixf glLoadIdentity glOrtho glMatrixMode

imm32

ImmGetDefaultIMEWnd ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetVirtualKey

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea

wldap32

ord26 ord27 ord32 ord33 ord22 ord41 ord35 ord50 ord79 ord30 ord46 ord200 ord60 ord301 ord211 ord217

propsys

PropVariantToString PSGetNameFromPropertyKey

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

34.8MB

Virtual Size

34.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18.5MB

Virtual Size

18.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

952KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

328KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=263, version=33145,

count=37, id=259, version=33145,

count=2, id=262, version=33145,

count=8, id=253, version=35207,

count=15, id=259, version=35207,

count=20, id=260, version=35207,

count=118, id=261, version=35207,

count=95, id=260, version=33145,

count=221, id=261, version=33145,

count=1, id=259, version=35222,

count=5, id=264, version=35222,

count=42, productName=Unmarked objects (old),

count=1513, id=260, version=35222,

count=85, id=257, version=33145,

count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1075, id=1, productName=Unmarked objects,

count=2217, id=261, version=35222,

count=1, id=256, version=35222,

count=1, id=255, version=35222,

count=2, id=151,

count=1, id=258, version=35222,