CreateEnvironmentBlock

Retrieves the environment variables for the specified user. This block can then be passed to the CreateProcessAsUser function.

Exported by

size	filename	version
98152	userenv.dll	6.3.9600.17415 (winblue_r4.141028-1500)
81920	OSVolOSVol--Windows--SysWOW64--userenv.dll.fullextract	6.1.7601.17514 (win7sp1_rtm.101119-1850)

Imported by

size	filename
739181	Virus.Win32.Trojan.Ransom.Autoit.h.c7564.unpacked.exe
1278910	158931.exe
2561744	Hola-Setup-1.16.446.exe
596328	1bbf6108505884106877824e403def3f6162d63f.bin
162816	photronlamp.com_m39ska.mal
974336	0c3ec04430e044b2777eca77eeebbce2
3128832	40e2ff36b0857fccf610d15f6a16569f7d78a838
12069520	WindowsAzureTools.VS100.exe
1311744	19.exe
8104476	brt2.exe.exe
30082888	chrome.dll
108544	services_xp.exe
742400	executable.3376.exe
1397608	video_2019-03-05_21-27-33.mp4.scr
84853904	WeMod.exe
177152	dbackup.exe
35570176	op_srv.exe
787456	mimikatz - Copy.exe
859136	winlogon.unpacked.exe
811848	chrome.exe
2382848	manager.exe
1187342	bbb.exe
2856112	Hola-Setup-x64-1.15.82.exe
55496536	chrome.dll
35422360	chrome.dll
787125	Auto Keybot Trial.unpacked.exe
3454464	FlashPlayerPlugin_31_0_0_153.exe
1564354	2b84c8226d4acaa8afb80995d047dcb6
857088	Extrato.unpacked.exe
2904176	wwbizsrv.exe
20661216	awesomium.dll
1081080	AsusUpdateCheck.exe
1611798	2faef876504495530b64256b5c1d4863
1444864	31464DB6DCC5BD4B520DDEBFE031C4A7.kaf
27172168	chrome.dll
46344704	nw.exe
875008	C DLL Injector.unpacked.exe
690256	QQUninst.exe
1107456	361c9710663b7232ad9285bc25949afc
5873880	MailRuUpdater.exe
493568	wprotectmanager.exe
955144	Update.exe
97771008	mrt.exe
697672	delegate_execute.exe
74240	360Safx.exe
649216	AutoItSC.bin
944640	sysvloader1files.exe
24049480	WindowsUpdateBox.exe
1701776	UCBrowser_V7.0.185.1002_windows_pf101_(Build18010215).exe
1376172	158931.exe