魔盾安全分析报告
| 分析类型 | 开始时间 | 结束时间 | 持续时间 | 分析引擎版本 |
|---|---|---|---|---|
| FILE | 2018-05-22 11:22:11 | 2018-05-22 11:24:30 | 139 秒 | 1.4-Maldun |
| 虚拟机机器名 | 标签 | 虚拟机管理 | 开机时间 | 关机时间 |
|---|---|---|---|---|
| win7-sp1-x64-shaapp01-2 | win7-sp1-x64-shaapp01-2 | KVM | 2018-05-22 11:22:12 | 2018-05-22 11:24:29 |
| 魔盾分数 |
|---|
4.0可疑的 |
文件详细信息
| 文件名 | QQKLB-SSZanV3.0.2_Goyt.exe |
|---|---|
| 文件大小 | 692224 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| CRC32 | 5CC8E600 |
| MD5 | 214ed0d4a0fd128cb55acba877346c21 |
| SHA1 | ad11a61ad286904f474f1d87063913dcfcddc86d |
| SHA256 | ee54d9305b034b9d7c7971cf6a7a3c48a5f7dc69dff9db88ad47b1fc6e82b944 |
| SHA512 | db3accfb52e5e5e8c207557e1409a44d7f3175d6b9c391901e578e3c603d69911e6321a6dc9e7cc5bdf88729366770de3f253fa841da569559b6e265d7fb8692 |
| Ssdeep | 12288:6fjA9nedi8CA4WEwFU+L5kUVBY9wYmX7YIuuRR08uK6NqiJ49zSBH3UHHlat:0Zdi8hEwRka3rsIP8dfJ2THFat |
| PEiD | 无匹配 |
| Yara | 无Yara规则匹配 |
| VirusTotal | 无此文件扫描结果 |
特征
创建RWX内存
二进制文件可能包含加密或压缩数据
section: name: UPX1, entropy: 7.89, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00097000, virtual_size: 0x00097000
从文件自身的二进制镜像中读取数据
self_read: process: QQKLB-SSZanV3.0.2_Goyt.exe, pid: 1592, offset: 0x00000000, length: 0x00000040
self_read: process: QQKLB-SSZanV3.0.2_Goyt.exe, pid: 1592, offset: 0x00000108, length: 0x00000020
self_read: process: QQKLB-SSZanV3.0.2_Goyt.exe, pid: 1592, offset: 0x0000018b, length: 0x00080000
可执行文件被使用UPX压缩
section: name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x000c4000
尝试断开连接或更改Cuckoo监控的Windows功能
unhook: function_name: SetWindowLongA, type: modification
unhook: function_name: SetWindowLongW, type: modification
运行截图
网络分析
静态分析
PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0055bdf0 |
| 声明校验值 | 0x00000000 |
| 实际校验值 | 0x000af99e |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2018-05-20 18:07:36 |
| 载入哈希 | d7788f694e460ee640647c815cc9694a |
| 图标 |  |
| 图标精确哈希值 | 0007c3863acc809fc67aa5dd365b3068 |
| 图标相似性哈希值 | 3e57078a4652784411938be757acdf10 |
版本信息
| LegalCopyright: | QQ\x5feb\x4e50\x5427\x8f6f\x4ef6\x5de5\x4f5c\x5ba4 |
| FileVersion: | 3.0.2.519 |
| Comments: | QQ\x5feb\x4e50\x5427\x5237\x8bf4\x8bf4\x8d5e |
| ProductName: | QQ\x5feb\x4e50\x5427\x5237\x8bf4\x8bf4\x8d5e\x8f6f\x4ef6V3.0.2\x6781\x901f\x7248 |
| ProductVersion: | 3.0.2.519 |
| FileDescription: | QQ\x5feb\x4e50\x5427\x5237\x8bf4\x8bf4\x8d5e |
| Translation: | 0x0804 0x04b0 |
PE数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x000c4000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| UPX1 | 0x000c5000 | 0x00097000 | 0x00097000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.89 |
| .rsrc | 0x0015c000 | 0x00012000 | 0x00011c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.92 |
资源
| 名称 | 偏移量 | 大小 | 语言 | 子语言 | 熵(Entropy) | 文件类型 |
|---|---|---|---|---|---|---|
| TEXTINCLUDE | 0x00143c18 | 0x00000151 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.16 | data |
| TEXTINCLUDE | 0x00143c18 | 0x00000151 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.16 | data |
| TEXTINCLUDE | 0x00143c18 | 0x00000151 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.16 | data |
| RT_CURSOR | 0x00144108 | 0x000000b4 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 6.52 | data |
| RT_CURSOR | 0x00144108 | 0x000000b4 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 6.52 | data |
| RT_CURSOR | 0x00144108 | 0x000000b4 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 6.52 | data |
| RT_CURSOR | 0x00144108 | 0x000000b4 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 6.52 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_BITMAP | 0x0014597c | 0x00000144 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.05 | data |
| RT_ICON | 0x0015cbf8 | 0x00010828 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.64 | data |
| RT_ICON | 0x0015cbf8 | 0x00010828 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.64 | data |
| RT_ICON | 0x0015cbf8 | 0x00010828 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.64 | data |
| RT_MENU | 0x00156704 | 0x00000284 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.18 | data |
| RT_MENU | 0x00156704 | 0x00000284 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.18 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_DIALOG | 0x0015794c | 0x0000018c | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 7.07 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_STRING | 0x00158394 | 0x00000024 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 5.06 | data |
| RT_GROUP_CURSOR | 0x001583e0 | 0x00000022 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.83 | data |
| RT_GROUP_CURSOR | 0x001583e0 | 0x00000022 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.83 | data |
| RT_GROUP_CURSOR | 0x001583e0 | 0x00000022 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.83 | data |
| RT_GROUP_ICON | 0x0015842c | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.32 | data |
| RT_GROUP_ICON | 0x0015842c | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.32 | data |
| RT_GROUP_ICON | 0x0015842c | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 4.32 | data |
| RT_VERSION | 0x0016d43c | 0x00000238 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 3.88 | data |
| RT_MANIFEST | 0x0016d678 | 0x000001cd | LANG_NEUTRAL | SUBLANG_NEUTRAL | 5.08 | XML 1.0 document, ASCII text, with very long lines, with no line terminators |
导入
库 KERNEL32.DLL:
• 0x56d974 - LoadLibraryA
• 0x56d978 - GetProcAddress
• 0x56d97c - VirtualProtect
• 0x56d980 - VirtualAlloc
• 0x56d984 - VirtualFree
• 0x56d988 - ExitProcess
库 ADVAPI32.dll:
• 0x56d990 - RegCloseKey
库 COMCTL32.dll:
• 0x56d998 - None
库 comdlg32.dll:
• 0x56d9a0 - ChooseColorA
库 GDI32.dll:
• 0x56d9a8 - PatBlt
库 ole32.dll:
• 0x56d9b0 - OleInitialize
库 OLEAUT32.dll:
• 0x56d9b8 - LoadTypeLib
库 RASAPI32.dll:
• 0x56d9c0 - RasHangUpA
库 SHELL32.dll:
• 0x56d9c8 - DragFinish
库 USER32.dll:
• 0x56d9d0 - GetDC
库 WININET.dll:
• 0x56d9d8 - InternetOpenA
库 WINMM.dll:
• 0x56d9e0 - waveOutOpen
库 WINSPOOL.DRV:
• 0x56d9e8 - OpenPrinterA
库 WS2_32.dll:
• 0x56d9f0 - getpeername
投放文件
行为分析
互斥量(Mutexes)
- Local\MSCTF.Asm.MutexDefault1
执行的命令
无信息
创建的服务
无信息
启动的服务
无信息
进程
QQKLB-SSZanV3.0.2_Goyt.exe PID: 1592, 上一级进程 PID: 1608
访问的文件
- C:\Windows\Fonts\staticcache.dat
- C:\Users\test\AppData\Local\Temp\\xe5\xa5\x80\xe9\xa8\xb1\xe5\xa0\xb9\x18
- C:\Users\test\AppData\Local\Temp\QQKLB-SSZanV3.0.2_Goyt.exe
- C:\Users\test\AppData\Local\Temp\kernel32.dll
读取的文件
- C:\Windows\Fonts\staticcache.dat
- C:\Users\test\AppData\Local\Temp\\xe5\xa5\x80\xe9\xa8\xb1\xe5\xa0\xb9\x18
- C:\Users\test\AppData\Local\Temp\QQKLB-SSZanV3.0.2_Goyt.exe
修改的文件
无信息
删除的文件
无信息
注册表键
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000804
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane16
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WOW\boot
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib\ 800x600x24(BGR 0)
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\QQKLB-SSZanV3.0.2_Goyt.exe
- HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3697C5FA-60DD-4B56-92D4-74A569205C16}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{3FC47A08-E5C9-4BCA-A2C7-BC9A282AED14}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\Category\Category\{534C48C1-0607-4098-A521-4FC899C73E90}
- HKEY_CURRENT_USER
- HKEY_CURRENT_USER\Keyboard Layout\Toggle
- HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
- HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
- HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
- HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
- HKEY_CURRENT_USER\Software\Microsoft\CTF\LayoutIcon\0804\00000804
读取的注册表键
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000804
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\SimSun\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
- HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
- HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
- HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
修改的注册表键
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib
- HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib\ 800x600x24(BGR 0)
删除的注册表键
无信息
API解析
- kernel32.dll.MultiByteToWideChar
- kernel32.dll.GetVersion
- kernel32.dll.CompareStringW
- kernel32.dll.CompareStringA
- kernel32.dll.GetStringTypeA
- kernel32.dll.SetUnhandledExceptionFilter
- kernel32.dll.IsBadWritePtr
- kernel32.dll.VirtualAlloc
- kernel32.dll.LCMapStringW
- kernel32.dll.LCMapStringA
- kernel32.dll.SetEnvironmentVariableA
- kernel32.dll.VirtualFree
- kernel32.dll.HeapCreate
- kernel32.dll.HeapDestroy
- kernel32.dll.GetEnvironmentVariableA
- kernel32.dll.GetStdHandle
- kernel32.dll.SetHandleCount
- kernel32.dll.GetEnvironmentStringsW
- kernel32.dll.GetEnvironmentStrings
- kernel32.dll.FreeEnvironmentStringsW
- kernel32.dll.FreeEnvironmentStringsA
- kernel32.dll.UnhandledExceptionFilter
- kernel32.dll.GetFileType
- kernel32.dll.SetStdHandle
- kernel32.dll.GetACP
- kernel32.dll.HeapSize
- kernel32.dll.RaiseException
- kernel32.dll.GetLocalTime
- kernel32.dll.GetSystemTime
- kernel32.dll.RtlUnwind
- kernel32.dll.GetStartupInfoA
- kernel32.dll.GetOEMCP
- kernel32.dll.GetCPInfo
- kernel32.dll.GetProcessVersion
- kernel32.dll.SetErrorMode
- kernel32.dll.GlobalFlags
- kernel32.dll.GetCurrentThread
- kernel32.dll.GetFileTime
- kernel32.dll.TlsGetValue
- kernel32.dll.LocalReAlloc
- kernel32.dll.TlsSetValue
- kernel32.dll.TlsFree
- kernel32.dll.GlobalHandle
- kernel32.dll.TlsAlloc
- kernel32.dll.LocalAlloc
- kernel32.dll.lstrcmpA
- kernel32.dll.GlobalGetAtomNameA
- kernel32.dll.GlobalAddAtomA
- kernel32.dll.GlobalFindAtomA
- kernel32.dll.GlobalDeleteAtom
- kernel32.dll.lstrcmpiA
- kernel32.dll.SetEndOfFile
- kernel32.dll.UnlockFile
- kernel32.dll.LockFile
- kernel32.dll.FlushFileBuffers
- kernel32.dll.DuplicateHandle
- kernel32.dll.lstrcpynA
- kernel32.dll.FileTimeToLocalFileTime
- kernel32.dll.LocalFree
- kernel32.dll.WideCharToMultiByte
- kernel32.dll.InterlockedDecrement
- kernel32.dll.InterlockedIncrement
- kernel32.dll.TerminateProcess
- kernel32.dll.GetCurrentProcess
- kernel32.dll.GetFileSize
- kernel32.dll.SetFilePointer
- kernel32.dll.SetLastError
- kernel32.dll.GetTimeZoneInformation
- kernel32.dll.FileTimeToSystemTime
- kernel32.dll.CreateSemaphoreA
- kernel32.dll.ResumeThread
- kernel32.dll.ReleaseSemaphore
- kernel32.dll.EnterCriticalSection
- kernel32.dll.LeaveCriticalSection
- kernel32.dll.GetProfileStringA
- kernel32.dll.WriteFile
- kernel32.dll.ReadFile
- kernel32.dll.WaitForMultipleObjects
- kernel32.dll.CreateFileA
- kernel32.dll.SetEvent
- kernel32.dll.FindResourceA
- kernel32.dll.LoadResource
- kernel32.dll.LockResource
- kernel32.dll.GetModuleFileNameA
- kernel32.dll.GetCurrentThreadId
- kernel32.dll.ExitProcess
- kernel32.dll.GlobalSize
- kernel32.dll.GlobalFree
- kernel32.dll.DeleteCriticalSection
- kernel32.dll.InitializeCriticalSection
- kernel32.dll.lstrcatA
- kernel32.dll.lstrlenA
- kernel32.dll.WinExec
- kernel32.dll.lstrcpyA
- kernel32.dll.FindNextFileA
- kernel32.dll.GlobalReAlloc
- kernel32.dll.HeapFree
- kernel32.dll.HeapReAlloc
- kernel32.dll.GetProcessHeap
- kernel32.dll.HeapAlloc
- kernel32.dll.GetFullPathNameA
- kernel32.dll.FreeLibrary
- kernel32.dll.LoadLibraryA
- kernel32.dll.GetLastError
- kernel32.dll.GetVersionExA
- kernel32.dll.WritePrivateProfileStringA
- kernel32.dll.CreateThread
- kernel32.dll.CreateEventA
- kernel32.dll.Sleep
- kernel32.dll.GlobalAlloc
- kernel32.dll.GlobalLock
- kernel32.dll.GlobalUnlock
- kernel32.dll.FindFirstFileA
- kernel32.dll.FindClose
- kernel32.dll.GetFileAttributesA
- kernel32.dll.SetCurrentDirectoryA
- kernel32.dll.GetVolumeInformationA
- kernel32.dll.GetModuleHandleA
- kernel32.dll.GetProcAddress
- kernel32.dll.MulDiv
- kernel32.dll.GetCommandLineA
- kernel32.dll.GetTickCount
- kernel32.dll.CreateProcessA
- kernel32.dll.WaitForSingleObject
- kernel32.dll.CloseHandle
- kernel32.dll.IsBadReadPtr
- kernel32.dll.IsBadCodePtr
- kernel32.dll.GetStringTypeW
- kernel32.dll.InterlockedExchange
- advapi32.dll.RegCreateKeyExA
- advapi32.dll.RegCloseKey
- advapi32.dll.RegOpenKeyExA
- advapi32.dll.RegSetValueExA
- advapi32.dll.RegQueryValueA
- comctl32.dll.ImageList_EndDrag
- comctl32.dll.#17
- comctl32.dll.ImageList_DragMove
- comctl32.dll.ImageList_DragLeave
- comctl32.dll.ImageList_DragEnter
- comctl32.dll.ImageList_Destroy
- comctl32.dll.ImageList_Create
- comctl32.dll.ImageList_BeginDrag
- comctl32.dll.ImageList_Add
- comctl32.dll.ImageList_DragShowNolock
- comdlg32.dll.GetSaveFileNameA
- comdlg32.dll.GetFileTitleA
- comdlg32.dll.GetOpenFileNameA
- comdlg32.dll.ChooseColorA
- gdi32.dll.RectVisible
- gdi32.dll.PtVisible
- gdi32.dll.GetViewportExtEx
- gdi32.dll.ExtSelectClipRgn
- gdi32.dll.BeginPath
- gdi32.dll.EndPath
- gdi32.dll.PathToRegion
- gdi32.dll.CreateEllipticRgn
- gdi32.dll.CreateRoundRectRgn
- gdi32.dll.GetTextColor
- gdi32.dll.GetBkMode
- gdi32.dll.GetBkColor
- gdi32.dll.GetROP2
- gdi32.dll.GetStretchBltMode
- gdi32.dll.GetPolyFillMode
- gdi32.dll.CreateCompatibleBitmap
- gdi32.dll.CreateDCA
- gdi32.dll.TextOutA
- gdi32.dll.CreateBitmap
- gdi32.dll.SelectObject
- gdi32.dll.GetObjectA
- gdi32.dll.CreatePen
- gdi32.dll.PatBlt
- gdi32.dll.CombineRgn
- gdi32.dll.CreateRectRgn
- gdi32.dll.FillRgn
- gdi32.dll.CreateSolidBrush
- gdi32.dll.GetStockObject
- gdi32.dll.CreateFontIndirectA
- gdi32.dll.EndPage
- gdi32.dll.EndDoc
- gdi32.dll.DeleteDC
- gdi32.dll.StartDocA
- gdi32.dll.StartPage
- gdi32.dll.BitBlt
- gdi32.dll.GetPixel
- gdi32.dll.CreateCompatibleDC
- gdi32.dll.Ellipse
- gdi32.dll.Rectangle
- gdi32.dll.LPtoDP
- gdi32.dll.DPtoLP
- gdi32.dll.GetCurrentObject
- gdi32.dll.RoundRect
- gdi32.dll.GetTextExtentPoint32A
- gdi32.dll.GetDeviceCaps
- gdi32.dll.SetViewportExtEx
- gdi32.dll.OffsetViewportOrgEx
- gdi32.dll.SetViewportOrgEx
- gdi32.dll.SetMapMode
- gdi32.dll.SetTextColor
- gdi32.dll.GetClipRgn
- gdi32.dll.SetROP2
- gdi32.dll.SetPolyFillMode
- gdi32.dll.SetBkMode
- gdi32.dll.SetStretchBltMode
- gdi32.dll.ExtCreateRegion
- gdi32.dll.SetPixel
- gdi32.dll.CreateDIBSection
- gdi32.dll.CreateRectRgnIndirect
- gdi32.dll.SetBkColor
- gdi32.dll.CreateFontA
- gdi32.dll.TranslateCharsetInfo
- gdi32.dll.LineTo
- gdi32.dll.ExtTextOutA
- gdi32.dll.MoveToEx
- gdi32.dll.ExcludeClipRect
- gdi32.dll.GetClipBox
- gdi32.dll.Escape
- gdi32.dll.GetTextMetricsA
- gdi32.dll.GetWindowOrgEx
- gdi32.dll.ScaleWindowExtEx
- gdi32.dll.SetWindowExtEx
- gdi32.dll.SetWindowOrgEx
- gdi32.dll.ScaleViewportExtEx
- gdi32.dll.GetViewportOrgEx
- gdi32.dll.GetWindowExtEx
- gdi32.dll.GetDIBits
- gdi32.dll.RealizePalette
- gdi32.dll.SelectPalette
- gdi32.dll.StretchBlt
- gdi32.dll.CreatePalette
- gdi32.dll.GetSystemPaletteEntries
- gdi32.dll.CreateDIBitmap
- gdi32.dll.DeleteObject
- gdi32.dll.SelectClipRgn
- gdi32.dll.RestoreDC
- gdi32.dll.SaveDC
- gdi32.dll.CreatePolygonRgn
- ole32.dll.CLSIDFromString
- ole32.dll.OleUninitialize
- ole32.dll.OleInitialize
- oleaut32.dll.#186
- oleaut32.dll.#163
- oleaut32.dll.#161
- rasapi32.dll.RasHangUpA
- rasapi32.dll.RasGetConnectStatusA
- shell32.dll.DragAcceptFiles
- shell32.dll.ShellExecuteA
- shell32.dll.Shell_NotifyIconA
- shell32.dll.DragFinish
- shell32.dll.DragQueryFileA
- user32.dll.GetWindowTextA
- user32.dll.FindWindowExA
- user32.dll.GetDlgItem
- user32.dll.GetClassNameA
- user32.dll.GetDesktopWindow
- user32.dll.SetWindowTextA
- user32.dll.LoadIconA
- user32.dll.TranslateMessage
- user32.dll.DrawFrameControl
- user32.dll.DrawEdge
- user32.dll.DrawFocusRect
- user32.dll.WindowFromPoint
- user32.dll.GetMessageA
- user32.dll.DispatchMessageA
- user32.dll.SetRectEmpty
- user32.dll.RegisterClipboardFormatA
- user32.dll.CreateIconFromResourceEx
- user32.dll.CreateIconFromResource
- user32.dll.DrawIconEx
- user32.dll.CreatePopupMenu
- user32.dll.AppendMenuA
- user32.dll.ModifyMenuA
- user32.dll.CreateMenu
- user32.dll.CreateAcceleratorTableA
- user32.dll.GetDlgCtrlID
- user32.dll.GetSubMenu
- user32.dll.EnableMenuItem
- user32.dll.ClientToScreen
- user32.dll.EnumDisplaySettingsA
- user32.dll.LoadImageA
- user32.dll.SystemParametersInfoA
- user32.dll.ShowWindow
- user32.dll.IsWindowEnabled
- user32.dll.TranslateAcceleratorA
- user32.dll.GetKeyState
- user32.dll.CopyAcceleratorTableA
- user32.dll.PostQuitMessage
- user32.dll.IsZoomed
- user32.dll.GetClassInfoA
- user32.dll.DefWindowProcA
- user32.dll.GetSystemMenu
- user32.dll.DeleteMenu
- user32.dll.GetSysColorBrush
- user32.dll.LoadStringA
- user32.dll.GetMenuCheckMarkDimensions
- user32.dll.GetMenuState
- user32.dll.SetMenuItemBitmaps
- user32.dll.CheckMenuItem
- user32.dll.MoveWindow
- user32.dll.IsDialogMessageA
- user32.dll.ScrollWindowEx
- user32.dll.SendDlgItemMessageA
- user32.dll.MapWindowPoints
- user32.dll.AdjustWindowRectEx
- user32.dll.CallWindowProcA
- user32.dll.GetScrollPos
- user32.dll.RegisterClassA
- user32.dll.GetMenuItemCount
- user32.dll.GetMenuItemID
- user32.dll.SetWindowsHookExA
- user32.dll.CallNextHookEx
- user32.dll.GetClassLongA
- user32.dll.SetPropA
- user32.dll.UnhookWindowsHookEx
- user32.dll.GetPropA
- user32.dll.RemovePropA
- user32.dll.GetMenu
- user32.dll.SetMenu
- user32.dll.PeekMessageA
- user32.dll.IsIconic
- user32.dll.SetFocus
- user32.dll.GetActiveWindow
- user32.dll.GetWindow
- user32.dll.DestroyAcceleratorTable
- user32.dll.SetWindowRgn
- user32.dll.GetMessagePos
- user32.dll.ScreenToClient
- user32.dll.ChildWindowFromPointEx
- user32.dll.CopyRect
- user32.dll.LoadBitmapA
- user32.dll.WinHelpA
- user32.dll.KillTimer
- user32.dll.SetTimer
- user32.dll.ReleaseCapture
- user32.dll.GetCapture
- user32.dll.SetCapture
- user32.dll.GetScrollRange
- user32.dll.SetScrollRange
- user32.dll.SetScrollPos
- user32.dll.SetRect
- user32.dll.InflateRect
- user32.dll.IntersectRect
- user32.dll.DestroyIcon
- user32.dll.PtInRect
- user32.dll.OffsetRect
- user32.dll.IsWindowVisible
- user32.dll.EnableWindow
- user32.dll.RedrawWindow
- user32.dll.GetWindowLongA
- user32.dll.SetWindowLongA
- user32.dll.GetSysColor
- user32.dll.SetActiveWindow
- user32.dll.SetCursorPos
- user32.dll.LoadCursorA
- user32.dll.SetCursor
- user32.dll.GetDC
- user32.dll.FillRect
- user32.dll.IsRectEmpty
- user32.dll.ReleaseDC
- user32.dll.IsChild
- user32.dll.DestroyMenu
- user32.dll.SetForegroundWindow
- user32.dll.GetWindowRect
- user32.dll.EqualRect
- user32.dll.UpdateWindow
- user32.dll.ValidateRect
- user32.dll.InvalidateRect
- user32.dll.GetClientRect
- user32.dll.GetFocus
- user32.dll.GetParent
- user32.dll.GetTopWindow
- user32.dll.PostMessageA
- user32.dll.IsWindow
- user32.dll.SetParent
- user32.dll.DestroyCursor
- user32.dll.SendMessageA
- user32.dll.SetWindowPos
- user32.dll.MessageBoxA
- user32.dll.GetCursorPos
- user32.dll.GetSystemMetrics
- user32.dll.EmptyClipboard
- user32.dll.SetClipboardData
- user32.dll.OpenClipboard
- user32.dll.GetClipboardData
- user32.dll.CloseClipboard
- user32.dll.wsprintfA
- user32.dll.WaitForInputIdle
- user32.dll.CreateWindowExA
- user32.dll.RegisterHotKey
- user32.dll.UnregisterHotKey
- user32.dll.UnregisterClassA
- user32.dll.GetWindowTextLengthA
- user32.dll.CharUpperA
- user32.dll.GetWindowDC
- user32.dll.BeginPaint
- user32.dll.EndPaint
- user32.dll.TabbedTextOutA
- user32.dll.DrawTextA
- user32.dll.GrayStringA
- user32.dll.DestroyWindow
- user32.dll.CreateDialogIndirectParamA
- user32.dll.EndDialog
- user32.dll.GetNextDlgTabItem
- user32.dll.GetWindowPlacement
- user32.dll.RegisterWindowMessageA
- user32.dll.GetForegroundWindow
- user32.dll.GetLastActivePopup
- user32.dll.GetMessageTime
- wininet.dll.InternetCanonicalizeUrlA
- wininet.dll.InternetCrackUrlA
- wininet.dll.HttpOpenRequestA
- wininet.dll.HttpSendRequestA
- wininet.dll.HttpQueryInfoA
- wininet.dll.InternetReadFile
- wininet.dll.InternetConnectA
- wininet.dll.InternetSetOptionA
- wininet.dll.InternetCloseHandle
- wininet.dll.InternetOpenA
- winmm.dll.midiStreamOut
- winmm.dll.midiOutPrepareHeader
- winmm.dll.midiStreamProperty
- winmm.dll.midiStreamOpen
- winmm.dll.midiOutUnprepareHeader
- winmm.dll.waveOutOpen
- winmm.dll.waveOutUnprepareHeader
- winmm.dll.waveOutPrepareHeader
- winmm.dll.waveOutWrite
- winmm.dll.waveOutPause
- winmm.dll.waveOutReset
- winmm.dll.waveOutClose
- winmm.dll.waveOutGetNumDevs
- winmm.dll.midiStreamStop
- winmm.dll.midiOutReset
- winmm.dll.midiStreamClose
- winmm.dll.midiStreamRestart
- winspool.drv.OpenPrinterA
- winspool.drv.DocumentPropertiesA
- winspool.drv.ClosePrinter
- ws2_32.dll.#101
- ws2_32.dll.#3
- ws2_32.dll.#19
- ws2_32.dll.#18
- ws2_32.dll.#116
- ws2_32.dll.#115
- ws2_32.dll.#12
- ws2_32.dll.#1
- ws2_32.dll.#16
- ws2_32.dll.#10
- ws2_32.dll.#17
- ws2_32.dll.#57
- ws2_32.dll.#5
- kernel32.dll.IsProcessorFeaturePresent
- cryptbase.dll.SystemFunction036
- comctl32.dll.RegisterClassNameW
- uxtheme.dll.OpenThemeData
- imm32.dll.ImmIsIME
- gdi32.dll.GetLayout
- gdi32.dll.GdiRealizationInfo
- gdi32.dll.FontIsLinked
- advapi32.dll.RegOpenKeyExW
- advapi32.dll.RegQueryInfoKeyW
- gdi32.dll.GetTextFaceAliasW
- advapi32.dll.RegEnumValueW
- advapi32.dll.RegQueryValueExW
- advapi32.dll.RegQueryValueExA
- advapi32.dll.RegEnumKeyExW
- gdi32.dll.GetTextExtentExPointWPri
- uxtheme.dll.EnableThemeDialogTexture
- kernel32.dll.VirtualProtect
- comctl32.dll.ImageList_Draw
- msimg32.dll.TransparentBlt
- msvcrt.dll.free
- msvfw32.dll.DrawDibOpen
- kernel32.dll.FlushInstructionCache
- kernel32.dll.VirtualQuery
- kernel32.dll.SizeofResource
- comctl32.dll.ImageList_GetIcon
- comctl32.dll.ImageList_GetImageInfo
- comctl32.dll.ImageList_GetIconSize
- gdi32.dll.SelectClipPath
- gdi32.dll.CreatePatternBrush
- gdi32.dll.OffsetRgn
- gdi32.dll.PtInRegion
- gdi32.dll.GetTextExtentPointA
- gdi32.dll.ExtTextOutW
- msvcrt.dll.??3@YAXPAX@Z
- msvcrt.dll.__CxxFrameHandler
- msvcrt.dll.??2@YAPAXI@Z
- msvcrt.dll._ftol
- msvcrt.dll._mbsstr
- msvcrt.dll._mbscmp
- msvcrt.dll.__dllonexit
- msvcrt.dll.malloc
- msvcrt.dll._initterm
- msvcrt.dll._adjust_fdiv
- msvcrt.dll._onexit
- msvcrt.dll.memcpy
- msvfw32.dll.DrawDibDraw
- msvfw32.dll.DrawDibClose
- user32.dll.EnumThreadWindows
- user32.dll.EnumChildWindows
- user32.dll.LockWindowUpdate
- user32.dll.DrawStateA
- user32.dll.GetWindowRgn
- user32.dll.TrackPopupMenu
- user32.dll.GetWindowInfo
- user32.dll.MenuItemFromPoint
- user32.dll.GetMenuItemRect
- user32.dll.SetMenuItemInfoA
- user32.dll.IsMenu
- user32.dll.GetUpdateRect
- user32.dll.ShowScrollBar
- user32.dll.WindowFromDC
- user32.dll.EnableScrollBar
- user32.dll.GetScrollBarInfo
- user32.dll.SetScrollInfo
- user32.dll.GetScrollInfo
- user32.dll.GetDCEx
- user32.dll.GetWindowLongW
- user32.dll.SetWindowLongW
- user32.dll.GetMenuItemInfoA
- user32.dll.GetComboBoxInfo
- user32.dll.TrackMouseEvent
- user32.dll.GetIconInfo
- user32.dll.RegisterClassExA
- user32.dll.UpdateLayeredWindow
- user32.dll.SetLayeredWindowAttributes
- dciman32.dll.DCIOpenProvider
- dciman32.dll.DCICloseProvider
- dciman32.dll.DCICreatePrimary
- dciman32.dll.DCIEndAccess
- dciman32.dll.DCIBeginAccess
- dciman32.dll.DCIDestroy
- ole32.dll.CoInitializeEx
- ole32.dll.CoUninitialize
- ole32.dll.CoRegisterInitializeSpy
- ole32.dll.CoRevokeInitializeSpy
- imm32.dll.ImmGetContext
- imm32.dll.ImmLockIMC
- imm32.dll.ImmUnlockIMC
- imm32.dll.ImmReleaseContext
- imm32.dll.ImmSetCompositionFontW
- imm32.dll.ImmGetCompositionWindow
- imm32.dll.ImmSetCompositionWindow
- uxtheme.dll.BufferedPaintInit
- uxtheme.dll.BeginBufferedPaint
- uxtheme.dll.EndBufferedPaint
- oleaut32.dll.SysAllocString
- oleaut32.dll.SysStringLen
- oleaut32.dll.SysFreeString