Zips_c4ce00751f365ccc984ff647d8bf0248_1_2019-06-27_17_30.json

[*] MalFamily: "Ursu"

[*] MalScore: 10.0

[*] File Name: "Zips_c4ce00751f365ccc984ff647d8bf0248.1"
[*] File Size: 11979354
[*] File Type: "Zip archive data, at least v2.0 to extract"
[*] SHA256: "4f7ee2f0b15e8c78849483a2a14bca4037c5b67e3f0759bb687b6af7b148fb5f"
[*] MD5: "c4ce00751f365ccc984ff647d8bf0248"
[*] SHA1: "1f444c2667dbee0c3689bf10d8036b9d39bc8902"
[*] SHA512: "5abf43d1dc7053fe22aaf67b875efdb975ead4b026d3e7ca06b109e9fa183b608ef3c1972853240edb0fb808da4c0c8fe73026a8e9675c59d6719169cd66b04a"
[*] CRC32: "4AC2FB9D"
[*] SSDEEP: "196608:y5qo5E8qC9WTK8nyHVfaiB+ToJBoBcygRxWP7pquLisQjW1z/o:eNu+j1GTkoBgyDkxl"

[*] Process Execution: [
    "exe.png"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "Bkav": "HW32.Packed."
            },
            {
                "McAfee": "Artemis!11EBDE989770"
            },
            {
                "TrendMicro": "TROJ_GEN.R011C0WFN19"
            },
            {
                "Cyren": "W32/Trojan.HLAU-7063"
            },
            {
                "TrendMicro-HouseCall": "TROJ_GEN.R011C0WFN19"
            },
            {
                "Avast": "Win32:Trojan-gen"
            },
            {
                "Kaspersky": "not-a-virus:HEUR:RiskTool.Win32.Generic"
            },
            {
                "BitDefender": "Gen:Variant.Ursu.311378"
            },
            {
                "Rising": "Trojan.Wacatac!8.10C01 (CLOUD)"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Emsisoft": "Gen:Variant.Ursu.311378 (B)"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "FireEye": "Gen:Variant.Ursu.311378"
            },
            {
                "Sophos": "Generic PUA HP (PUA)"
            },
            {
                "Jiangmin": "RiskTool.Generic.noq"
            },
            {
                "Microsoft": "Trojan:Win32/Tiggre!plock"
            },
            {
                "ZoneAlarm": "not-a-virus:HEUR:RiskTool.Win32.Generic"
            },
            {
                "GData": "Gen:Variant.Ursu.311378"
            },
            {
                "AhnLab-V3": "Malware/Win32.Generic.C3273244"
            },
            {
                "ALYac": "Gen:Variant.Ursu.311378"
            },
            {
                "MAX": "malware (ai score=83)"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "ESET-NOD32": "a variant of Win32/Packed.VMProtect.CW"
            },
            {
                "Fortinet": "Riskware/Generic"
            },
            {
                "AVG": "Win32:Trojan-gen"
            },
            {
                "Panda": "Trj/CI.A"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: [
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "DefaultTabtip-MainUI",
    "Local\\Shell.CMruPidlList",
    "Local\\SHResolveLibrary:C:/Users/user/AppData/Roaming/Microsoft/Windows/Libraries/Documents.library-ms"
]

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlots",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\MRUListEx"
]

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}

[*] Resolved APIs: [
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsFree",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.InitializeCriticalSectionEx",
    "kernel32.dll.CreateEventExW",
    "kernel32.dll.CreateSemaphoreExW",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.CreateThreadpoolTimer",
    "kernel32.dll.SetThreadpoolTimer",
    "kernel32.dll.WaitForThreadpoolTimerCallbacks",
    "kernel32.dll.CloseThreadpoolTimer",
    "kernel32.dll.CreateThreadpoolWait",
    "kernel32.dll.SetThreadpoolWait",
    "kernel32.dll.CloseThreadpoolWait",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.FreeLibraryWhenCallbackReturns",
    "kernel32.dll.GetCurrentProcessorNumber",
    "kernel32.dll.GetLogicalProcessorInformation",
    "kernel32.dll.CreateSymbolicLinkW",
    "kernel32.dll.EnumSystemLocalesEx",
    "kernel32.dll.CompareStringEx",
    "kernel32.dll.GetDateFormatEx",
    "kernel32.dll.GetLocaleInfoEx",
    "kernel32.dll.GetTimeFormatEx",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.IsValidLocaleName",
    "kernel32.dll.LCMapStringEx",
    "kernel32.dll.GetTickCount64",
    "kernel32.dll.GetNativeSystemInfo",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "ole32.dll.OleInitialize",
    "ole32.dll.CoCreateInstance",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoTaskMemFree",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "comctl32.dll.#320",
    "comctl32.dll.RegisterClassNameW",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "uxtheme.dll.EnableThemeDialogTexture",
    "uxtheme.dll.OpenThemeData",
    "comctl32.dll.HIMAGELIST_QueryInterface",
    "comctl32.dll.DrawShadowText",
    "comctl32.dll.DrawSizeBox",
    "comctl32.dll.DrawScrollBar",
    "comctl32.dll.SizeBoxHwnd",
    "comctl32.dll.ScrollBar_MouseMove",
    "comctl32.dll.ScrollBar_Menu",
    "comctl32.dll.HandleScrollCmd",
    "comctl32.dll.DetachScrollBars",
    "comctl32.dll.AttachScrollBars",
    "comctl32.dll.CCSetScrollInfo",
    "comctl32.dll.CCGetScrollInfo",
    "comctl32.dll.CCEnableScrollBar",
    "comctl32.dll.QuerySystemGestureStatus",
    "uxtheme.dll.#49",
    "uxtheme.dll.CloseThemeData",
    "uxtheme.dll.IsThemePartDefined",
    "uxtheme.dll.GetThemeFont",
    "uxtheme.dll.GetThemeColor",
    "uxtheme.dll.GetThemeBool",
    "imm32.dll.ImmIsIME",
    "uxtheme.dll.GetThemeMargins",
    "uxtheme.dll.GetThemeInt",
    "uxtheme.dll.SetWindowTheme",
    "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
    "ole32.dll.CoGetMalloc",
    "gdi32.dll.GetLayout",
    "gdi32.dll.GdiRealizationInfo",
    "gdi32.dll.FontIsLinked",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "gdi32.dll.GetTextFaceAliasW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "gdi32.dll.GetFontAssocStatus",
    "advapi32.dll.RegQueryValueExA",
    "advapi32.dll.RegEnumKeyExW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CoUninitialize",
    "ole32.dll.CoRegisterInitializeSpy",
    "ole32.dll.CoRevokeInitializeSpy",
    "imm32.dll.ImmGetContext",
    "imm32.dll.ImmLockIMC",
    "imm32.dll.ImmUnlockIMC",
    "imm32.dll.ImmReleaseContext",
    "imm32.dll.ImmSetCompositionFontW",
    "uxtheme.dll.DrawThemeBackground",
    "imm32.dll.ImmGetCompositionWindow",
    "imm32.dll.ImmSetCompositionWindow",
    "comctl32.dll.#411",
    "comctl32.dll.#410",
    "ole32.dll.CLSIDFromString",
    "uxtheme.dll.GetThemePartSize",
    "uxtheme.dll.GetThemeTextExtent",
    "comctl32.dll.#413",
    "comctl32.dll.#328",
    "ole32.dll.CoCreateFreeThreadedMarshaler",
    "comctl32.dll.#334",
    "comctl32.dll.InitCommonControlsEx",
    "kernel32.dll.QueryActCtxW",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.DeactivateActCtx",
    "comctl32.dll.LoadIconWithScaleDown",
    "ntdll.dll.RtlRunEncodeUnicodeString",
    "ntdll.dll.RtlInitUnicodeString",
    "ntdll.dll.RtlRunDecodeUnicodeString",
    "duser.dll.InitGadgets",
    "user32.dll.RegisterMessagePumpHook",
    "uxtheme.dll.GetThemeTextMetrics",
    "uxtheme.dll.IsCompositionActive",
    "uxtheme.dll.GetThemeBackgroundExtent",
    "comctl32.dll.ImageList_LoadImageW",
    "comctl32.dll.ImageList_CoCreateInstance",
    "windowscodecs.dll.WICCreateImagingFactory_Proxy",
    "advapi32.dll.RegEnumKeyW",
    "advapi32.dll.RegQueryValueW",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "apphelp.dll.ApphelpCheckShellObject",
    "shlwapi.dll.PathRemoveFileSpecW",
    "comctl32.dll.#321",
    "comctl32.dll.#325",
    "uxtheme.dll.GetThemeBackgroundContentRect",
    "duser.dll.CreateGadget",
    "duser.dll.SetGadgetMessageFilter",
    "duser.dll.SetGadgetStyle",
    "duser.dll.SetGadgetRootInfo",
    "uxtheme.dll.GetCurrentThemeName",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.GetThemeAppProperties",
    "ole32.dll.CreateStreamOnHGlobal",
    "xmllite.dll.CreateXmlReader",
    "xmllite.dll.CreateXmlReaderInputWithEncodingName",
    "oleaut32.dll.#6",
    "duser.dll.InvalidateGadget",
    "duser.dll.GetGadgetTicket",
    "duser.dll.SetGadgetParent",
    "msftedit.dll.CreateTextServices",
    "ole32.dll.OleUninitialize",
    "msls31.dll.#71",
    "msls31.dll.#1",
    "msls31.dll.#52",
    "msls31.dll.#48",
    "msls31.dll.#3",
    "msls31.dll.#44",
    "duser.dll.SetGadgetRect",
    "uxtheme.dll.BufferedPaintInit",
    "ole32.dll.StringFromGUID2",
    "ole32.dll.CreateBindCtx",
    "ole32.dll.CoGetApartmentType",
    "comctl32.dll.#236",
    "oleaut32.dll.#2",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "shell32.dll.#102",
    "comctl32.dll.#386",
    "comctl32.dll.#388",
    "propsys.dll.PSCreateMemoryPropertyStore",
    "propsys.dll.PropVariantToStringAlloc",
    "ole32.dll.PropVariantClear",
    "propsys.dll.PSGetPropertyDescription",
    "ole32.dll.PropVariantCopy",
    "comctl32.dll.#330",
    "ntdll.dll.RtlDllShutdownInProgress",
    "comctl32.dll.#329",
    "linkinfo.dll.IsValidLinkInfo",
    "propsys.dll.#407",
    "sechost.dll.ConvertSidToStringSidW",
    "propsys.dll.#417",
    "propsys.dll.PSGetNameFromPropertyKey",
    "propsys.dll.PSStringFromPropertyKey",
    "propsys.dll.InitVariantFromBuffer",
    "oleaut32.dll.#9",
    "propsys.dll.PropVariantToGUID",
    "ole32.dll.CoMarshalInterThreadInterfaceInStream",
    "sechost.dll.LookupAccountNameLocalW",
    "advapi32.dll.LookupAccountSidW",
    "sechost.dll.LookupAccountSidLocalW",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "ole32.dll.CoGetInterfaceAndReleaseStream",
    "oleaut32.dll.#500",
    "propsys.dll.PropVariantToUInt32",
    "propsys.dll.PSPropertyBag_ReadStr",
    "oleaut32.dll.#8",
    "oleaut32.dll.#150",
    "propsys.dll.PSPropertyBag_ReadDWORD",
    "propsys.dll.PSPropertyBag_ReadStrAlloc",
    "propsys.dll.PSPropertyBag_ReadGUID",
    "propsys.dll.PSPropertyBag_ReadBOOL",
    "propsys.dll.PSGetPropertyKeyFromName",
    "oleaut32.dll.#12",
    "propsys.dll.PropVariantToBooleanWithDefault",
    "propsys.dll.PSGetPropertyDescriptionListFromString",
    "shell32.dll.SHCreateItemFromIDList",
    "shell32.dll.#18",
    "shell32.dll.#155",
    "dui70.dll.InitProcessPriv",
    "dui70.dll.?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ",
    "dui70.dll.?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ",
    "dui70.dll.??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z",
    "dui70.dll.?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z",
    "dui70.dll.??0ClassInfoBase@DirectUI@@QAE@XZ",
    "dui70.dll.?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z",
    "dui70.dll.?Register@ClassInfoBase@DirectUI@@QAEJXZ",
    "dui70.dll.?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ",
    "dui70.dll.?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ",
    "dui70.dll.?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ",
    "dui70.dll.??1CritSecLock@DirectUI@@QAE@XZ",
    "dui70.dll.?AddRef@ClassInfoBase@DirectUI@@UAEXXZ",
    "dui70.dll.?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ",
    "dui70.dll.?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ",
    "dui70.dll.?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ",
    "dui70.dll.?GetAtomZero@Value@DirectUI@@SGPAV12@XZ",
    "dui70.dll.?GetBoolTrue@Value@DirectUI@@SGPAV12@XZ",
    "dui70.dll.?GetBoolFalse@Value@DirectUI@@SGPAV12@XZ",
    "dui70.dll.?GetStringNull@Value@DirectUI@@SGPAV12@XZ",
    "dui70.dll.?GetClassInfoPtr@Button@DirectUI@@SGPAUIClassInfo@2@XZ",
    "dui70.dll.?GetClassInfoPtr@ElementWithHWND@DirectUI@@SGPAUIClassInfo@2@XZ",
    "dui70.dll.?GetClassInfoPtr@AccessibleButton@DirectUI@@SGPAUIClassInfo@2@XZ",
    "dui70.dll.?GetIntZero@Value@DirectUI@@SGPAV12@XZ",
    "dui70.dll.?Register@Movie@DirectUI@@SGJXZ",
    "comctl32.dll.InitCommonControls",
    "dui70.dll.InitThread",
    "dui70.dll.?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z",
    "dui70.dll.?SetPreprocessedXML@DUIXmlParser@DirectUI@@QAEJPBGPAUHINSTANCE__@@1@Z",
    "dui70.dll.?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z",
    "dui70.dll.?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ",
    "duser.dll.FindStdColor",
    "dui70.dll.??0HWNDElement@DirectUI@@QAE@XZ",
    "dui70.dll.?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z",
    "dui70.dll.?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z",
    "dui70.dll.?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z",
    "dui70.dll.?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z",
    "dui70.dll.?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z",
    "dui70.dll.?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QAEJ_N@Z",
    "dui70.dll.?SetAccessible@Element@DirectUI@@QAEJ_N@Z",
    "dui70.dll.?SetAccRole@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?SetAccName@Element@DirectUI@@QAEJPBG@Z",
    "dui70.dll.?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z",
    "dui70.dll.?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ",
    "dui70.dll.?Create@BorderLayout@DirectUI@@SGJPAPAVLayout@2@@Z",
    "dui70.dll.?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z",
    "dui70.dll.?SetWidth@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?SetHeight@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?EndDefer@Element@DirectUI@@QAEXK@Z",
    "dui70.dll.?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z",
    "dui70.dll.?SetVisible@Element@DirectUI@@QAEJ_N@Z",
    "uxtheme.dll.GetThemeMetric",
    "propsys.dll.#408",
    "propsys.dll.PSEnumeratePropertyDescriptions",
    "comctl32.dll.#322",
    "propsys.dll.#416",
    "comctl32.dll.#346",
    "propsys.dll.PSPropertyBag_ReadStream",
    "shell32.dll.SHBindToParent",
    "propsys.dll.PropVariantToStringWithDefault",
    "ole32.dll.CoTaskMemRealloc",
    "duser.dll.AttachWndProcW",
    "kernel32.dll.IsProcessorFeaturePresent",
    "kernel32.dll.InterlockedPopEntrySList",
    "kernel32.dll.InterlockedPushEntrySList",
    "kernel32.dll.InterlockedCompareExchange",
    "duser.dll.GetGadgetRect",
    "duser.dll.GetGadgetRgn",
    "shell32.dll.#66",
    "duser.dll.DUserSendEvent",
    "comctl32.dll.#336",
    "propsys.dll.#430",
    "advapi32.dll.RegGetValueW",
    "propsys.dll.InitPropVariantFromStringAsVector",
    "propsys.dll.PSCoerceToCanonicalValue",
    "oleaut32.dll.#10",
    "comctl32.dll.#326",
    "propsys.dll.VariantToBooleanWithDefault",
    "propsys.dll.VariantToInt32WithDefault",
    "propsys.dll.PropVariantToBoolean",
    "comctl32.dll.#333",
    "ole32.dll.RegisterDragDrop",
    "propsys.dll.PSLookupPropertyHandlerCLSID",
    "dui70.dll.DisableAnimations",
    "dui70.dll.?StartDefer@Element@DirectUI@@QAEXPAK@Z",
    "dui70.dll.?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z",
    "dui70.dll.EnableAnimations",
    "propsys.dll.PSCreatePropertyStoreFromObject",
    "duser.dll.DUserPostEvent",
    "propsys.dll.#423",
    "propsys.dll.PropVariantGetElementCount",
    "propsys.dll.PropVariantCompareEx",
    "shdocvw.dll.#159",
    "propsys.dll.PropVariantToInt32",
    "dui70.dll.?SetXML@DUIXmlParser@DirectUI@@QAEJPBGPAUHINSTANCE__@@1@Z",
    "dui70.dll.?DestroyAll@Element@DirectUI@@QAEJ_N@Z",
    "dui70.dll.?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z",
    "dui70.dll.?GetSheet@DUIXmlParser@DirectUI@@QAEJPBGPAPAVValue@2@@Z",
    "dui70.dll.??0Element@DirectUI@@QAE@XZ",
    "dui70.dll.?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z",
    "dui70.dll.?SetActive@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z",
    "dui70.dll.?Create@ShellBorderLayout@DirectUI@@SGJPAPAVLayout@2@@Z",
    "dui70.dll.?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z",
    "dui70.dll.?Add@Element@DirectUI@@UAEJPAPAV12@I@Z",
    "dui70.dll.?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z",
    "dui70.dll.?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z",
    "dui70.dll.?OnHosted@Element@DirectUI@@MAEXPAV12@@Z",
    "dui70.dll.StrToID",
    "dui70.dll.?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z",
    "dui70.dll.?SetID@Element@DirectUI@@QAEJPBG@Z",
    "dui70.dll.?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z",
    "dui70.dll.?GetString@Value@DirectUI@@QAEPBGXZ",
    "dui70.dll.?Release@Value@DirectUI@@QAEXXZ",
    "dui70.dll.?SetLayoutPos@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z",
    "dui70.dll.?RemoveAll@Element@DirectUI@@QAEJXZ",
    "dui70.dll.?Add@Element@DirectUI@@QAEJPAV12@@Z",
    "dui70.dll.?ExtentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?Destroy@DUIXmlParser@DirectUI@@QAEXXZ",
    "dui70.dll.??0HWNDHost@DirectUI@@QAE@XZ",
    "dui70.dll.?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z",
    "dui70.dll.?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z",
    "dui70.dll.?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ",
    "dui70.dll.?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z",
    "dui70.dll.?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z",
    "dui70.dll.?ForegroundProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.ColorFromEnumI",
    "dui70.dll.?BackgroundProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z",
    "rpcrt4.dll.UuidCreateSequential",
    "dui70.dll.?SizeInLayoutProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?CreateString@Value@DirectUI@@SGPAV12@PBGPAUHINSTANCE__@@@Z",
    "dui70.dll.?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z",
    "dui70.dll.?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.??0Layout@DirectUI@@QAE@XZ",
    "dui70.dll.?Attach@Layout@DirectUI@@UAEXPAVElement@2@@Z",
    "dui70.dll.??0Button@DirectUI@@QAE@XZ",
    "dui70.dll.?Initialize@Button@DirectUI@@QAEJIPAVElement@2@PAK@Z",
    "dui70.dll.?PressedProp@Button@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?OnPropertyChanged@Button@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z",
    "dui70.dll.?GetKeyFocused@Element@DirectUI@@UAE_NXZ",
    "dui70.dll.?IsContentProtected@Element@DirectUI@@UAE_NXZ",
    "dui70.dll.?Initialize@Layout@DirectUI@@QAEXXZ",
    "dui70.dll.?OnAdd@Layout@DirectUI@@UAEXPAVElement@2@PAPAV32@I@Z",
    "propsys.dll.PSPropertyBag_WriteBOOL",
    "propsys.dll.PSPropertyBag_WriteStr",
    "propsys.dll.VariantToStringWithDefault",
    "dui70.dll.?SetClass@Element@DirectUI@@QAEJPBG@Z",
    "dui70.dll.?GetID@Element@DirectUI@@QAEGXZ",
    "dui70.dll.?RemoveLocalValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZ@Z",
    "dui70.dll.?HeightProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?LayoutPosProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?SetEnabled@Element@DirectUI@@QAEJ_N@Z",
    "dui70.dll.?OnLayoutPosChanged@Layout@DirectUI@@UAEXPAVElement@2@0HH@Z",
    "dui70.dll.?CreateBool@Value@DirectUI@@SGPAV12@_N@Z",
    "dui70.dll.?SetValue@Element@DirectUI@@QAEJPBUPropertyInfo@2@HPAVValue@2@@Z",
    "dui70.dll.?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z",
    "dui70.dll.?GetRoot@Element@DirectUI@@QAEPAV12@XZ",
    "dui70.dll.?GetAtom@Value@DirectUI@@QAEGXZ",
    "dui70.dll.?GetUnset@Value@DirectUI@@SGPAV12@XZ",
    "dui70.dll.?GetLayoutPos@Element@DirectUI@@QAEHXZ",
    "dui70.dll.?GetExtent@Element@DirectUI@@QAEPBUtagSIZE@@PAPAVValue@2@@Z",
    "dui70.dll.?GetBool@Value@DirectUI@@QAE_NXZ",
    "dui70.dll.?GetInt@Value@DirectUI@@QAEHXZ",
    "propsys.dll.PSPropertyBag_WriteInt",
    "propsys.dll.PSPropertyBag_ReadInt",
    "dui70.dll.?IsEqual@Value@DirectUI@@QAE_NPAV12@@Z",
    "dui70.dll.?WidthProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?Create@Element@DirectUI@@SGJIPAV12@PAKPAPAV12@@Z",
    "dui70.dll.?SetContentAlign@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?SetContentString@Element@DirectUI@@QAEJPBG@Z",
    "comctl32.dll.#381",
    "dui70.dll.?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z",
    "dui70.dll.?SetAccDesc@Element@DirectUI@@QAEJPBG@Z",
    "dui70.dll.?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z",
    "dui70.dll.?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z",
    "dui70.dll.?GetAccState@Element@DirectUI@@QAEHXZ",
    "dui70.dll.?SetAccState@Element@DirectUI@@QAEJH@Z",
    "dui70.dll.?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ",
    "dui70.dll.?MouseWithinProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "dui70.dll.?Insert@Element@DirectUI@@QAEJPAV12@I@Z",
    "propsys.dll.PSCreateDelayedMultiplexPropertyStore",
    "propsys.dll.PSCreateMultiplexPropertyStore",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "ntshrui.dll.IsPathSharedW",
    "dui70.dll.?SetAccValue@Element@DirectUI@@QAEJPBG@Z",
    "dui70.dll.?GetPadding@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z",
    "dui70.dll.?CreateRect@Value@DirectUI@@SGPAV12@HHHH@Z",
    "dui70.dll.?PaddingProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ",
    "propsys.dll.InitPropVariantFromFileTime",
    "dui70.dll.?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z",
    "dui70.dll.?GetLayoutChildCount@Layout@DirectUI@@QAEIPAVElement@2@@Z",
    "dui70.dll.?GetChildFromLayoutIndex@Layout@DirectUI@@QAEPAVElement@2@PAV32@HPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@@Z",
    "dui70.dll.?_UpdateDesiredSize@Element@DirectUI@@QAE?AUtagSIZE@@HHPAVSurface@2@@Z",
    "dui70.dll.?GetMargin@Element@DirectUI@@QAEPBUtagRECT@@PAPAVValue@2@@Z",
    "dui70.dll.?DesiredSizeProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ"
]

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}