ScreenShot
| Created | 2021.07.05 09:36 | Machine | s1_win7_x6402 |
| Filename | D9975372A070C4965F56D329571CD89A.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 51 detected (AIDetect, malware1, malicious, high confidence, GenericKDZ, AndromPMF, S14100880, DelfInject, Eldorado, Lokibot, ELRF, Androm, hjobpd, RATX, Gencirc, A + Mal, Fareit, avox, qmanq, ASMalwS, Kryptik, score, Delphiless, X2059, ai score=80, CLASSIC, yUWtF9wqez0, Static AI, Malicious PE, susgen, ELKP, ZelphiF, RG0@aev, 3mdi, confidence, QVM05) | ||
| md5 | d9975372a070c4965f56d329571cd89a | ||
| sha256 | 84ec364c6d26c1a382649abc47eafc328c9ee5f1ef19dbddf528db50432246f7 | ||
| ssdeep | 12288:uJtGIf+pco+KipZHb9GNTU6Bd1K/+71UWS36l3EJQ4f:uLdfZhpFb6TU2uE19S36I | ||
| imphash | 556c6a7e5f749bf800bb7913c54276f4 | ||
| impfuzzy | 96:8cfpHYU3u0MJ4ciXBqpAU8RRV1O+Ukbuu2RrSUvK9LeqoWGqEFw1DwPOQH8R:f3ttj1akbuuArSUvK9aqo1qEFw2POQHQ | ||
Network IP location
Signature (27cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 51 AntiVirus engines on VirusTotal as malicious |
| danger | Executed a process and injected code into it |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local email clients |
| watch | Harvests credentials from local FTP client softwares |
| watch | Harvests information related to installed instant messenger clients |
| watch | Putty Files |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Potentially malicious URLs were found in the process memory dump |
| notice | Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
| notice | Searches running processes potentially to identify processes for sandbox evasion |
| notice | Sends data using the HTTP POST Method |
| notice | Steals private information from local Internet browsers |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Collects information to fingerprint the system (MachineGuid |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The executable uses a known packer |
| info | Tries to locate where the browsers are installed |
Rules (13cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_PWS_Loki_Zero | Win32 PWS Loki | memory |
| watch | Admin_Tool_IN_Zero | Admin Tool Sysinternals | binaries (upload) |
| notice | Network_DNS | Communications use DNS | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
Suricata ids
ET MALWARE LokiBot User-Agent (Charon/Inferno)
ET MALWARE LokiBot Checkin
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
ET MALWARE LokiBot Checkin
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
PE API
IAT(Import Address Table) Library
kernel32.dll
0x480168 DeleteCriticalSection
0x48016c LeaveCriticalSection
0x480170 EnterCriticalSection
0x480174 InitializeCriticalSection
0x480178 VirtualFree
0x48017c VirtualAlloc
0x480180 LocalFree
0x480184 LocalAlloc
0x480188 GetVersion
0x48018c GetCurrentThreadId
0x480190 InterlockedDecrement
0x480194 InterlockedIncrement
0x480198 VirtualQuery
0x48019c WideCharToMultiByte
0x4801a0 MultiByteToWideChar
0x4801a4 lstrlenA
0x4801a8 lstrcpynA
0x4801ac LoadLibraryExA
0x4801b0 GetThreadLocale
0x4801b4 GetStartupInfoA
0x4801b8 GetProcAddress
0x4801bc GetModuleHandleA
0x4801c0 GetModuleFileNameA
0x4801c4 GetLocaleInfoA
0x4801c8 GetCommandLineA
0x4801cc FreeLibrary
0x4801d0 FindFirstFileA
0x4801d4 FindClose
0x4801d8 ExitProcess
0x4801dc ExitThread
0x4801e0 CreateThread
0x4801e4 WriteFile
0x4801e8 UnhandledExceptionFilter
0x4801ec RtlUnwind
0x4801f0 RaiseException
0x4801f4 GetStdHandle
user32.dll
0x4801fc GetKeyboardType
0x480200 LoadStringA
0x480204 MessageBoxA
0x480208 CharNextA
advapi32.dll
0x480210 RegQueryValueExA
0x480214 RegOpenKeyExA
0x480218 RegCloseKey
oleaut32.dll
0x480220 SysFreeString
0x480224 SysReAllocStringLen
0x480228 SysAllocStringLen
kernel32.dll
0x480230 TlsSetValue
0x480234 TlsGetValue
0x480238 LocalAlloc
0x48023c GetModuleHandleA
advapi32.dll
0x480244 RegQueryValueExA
0x480248 RegOpenKeyExA
0x48024c RegCloseKey
kernel32.dll
0x480254 lstrlenA
0x480258 lstrcpyA
0x48025c lstrcmpA
0x480260 WriteFile
0x480264 WaitForSingleObject
0x480268 WaitForMultipleObjects
0x48026c VirtualQuery
0x480270 VirtualAlloc
0x480274 Sleep
0x480278 SizeofResource
0x48027c SetThreadLocale
0x480280 SetFilePointer
0x480284 SetEvent
0x480288 SetErrorMode
0x48028c SetEndOfFile
0x480290 SetCurrentDirectoryA
0x480294 ResumeThread
0x480298 ResetEvent
0x48029c ReleaseMutex
0x4802a0 ReadFile
0x4802a4 MultiByteToWideChar
0x4802a8 MulDiv
0x4802ac LockResource
0x4802b0 LoadResource
0x4802b4 LoadLibraryA
0x4802b8 LeaveCriticalSection
0x4802bc InitializeCriticalSection
0x4802c0 GlobalUnlock
0x4802c4 GlobalReAlloc
0x4802c8 GlobalHandle
0x4802cc GlobalLock
0x4802d0 GlobalFree
0x4802d4 GlobalFindAtomA
0x4802d8 GlobalDeleteAtom
0x4802dc GlobalAlloc
0x4802e0 GlobalAddAtomA
0x4802e4 GetVersionExA
0x4802e8 GetVersion
0x4802ec GetTickCount
0x4802f0 GetThreadLocale
0x4802f4 GetSystemTimeAsFileTime
0x4802f8 GetSystemTime
0x4802fc GetSystemInfo
0x480300 GetStringTypeExA
0x480304 GetStdHandle
0x480308 GetProcAddress
0x48030c GetModuleHandleA
0x480310 GetModuleFileNameA
0x480314 GetLocaleInfoA
0x480318 GetLocalTime
0x48031c GetLastError
0x480320 GetFullPathNameA
0x480324 GetExitCodeThread
0x480328 GetDiskFreeSpaceA
0x48032c GetDateFormatA
0x480330 GetCurrentThreadId
0x480334 GetCurrentProcessId
0x480338 GetCurrentDirectoryA
0x48033c GetCPInfo
0x480340 GetACP
0x480344 FreeResource
0x480348 InterlockedIncrement
0x48034c InterlockedExchange
0x480350 InterlockedDecrement
0x480354 FreeLibrary
0x480358 FormatMessageA
0x48035c FindResourceA
0x480360 FindNextChangeNotification
0x480364 FindFirstFileA
0x480368 FindFirstChangeNotificationA
0x48036c FindCloseChangeNotification
0x480370 FindClose
0x480374 FileTimeToSystemTime
0x480378 FileTimeToLocalFileTime
0x48037c FileTimeToDosDateTime
0x480380 ExitThread
0x480384 EnumCalendarInfoA
0x480388 EnterCriticalSection
0x48038c DeleteCriticalSection
0x480390 CreateThread
0x480394 CreateMutexA
0x480398 CreateFileA
0x48039c CreateEventA
0x4803a0 CompareStringA
0x4803a4 CloseHandle
version.dll
0x4803ac VerQueryValueA
0x4803b0 GetFileVersionInfoSizeA
0x4803b4 GetFileVersionInfoA
gdi32.dll
0x4803bc UnrealizeObject
0x4803c0 StretchBlt
0x4803c4 SetWindowOrgEx
0x4803c8 SetViewportOrgEx
0x4803cc SetTextColor
0x4803d0 SetStretchBltMode
0x4803d4 SetROP2
0x4803d8 SetPixel
0x4803dc SetDIBColorTable
0x4803e0 SetBrushOrgEx
0x4803e4 SetBkMode
0x4803e8 SetBkColor
0x4803ec SelectPalette
0x4803f0 SelectObject
0x4803f4 SelectClipRgn
0x4803f8 SaveDC
0x4803fc RestoreDC
0x480400 Rectangle
0x480404 RectVisible
0x480408 RealizePalette
0x48040c Polyline
0x480410 PatBlt
0x480414 MoveToEx
0x480418 MaskBlt
0x48041c LineTo
0x480420 IntersectClipRect
0x480424 GetWindowOrgEx
0x480428 GetTextMetricsA
0x48042c GetTextExtentPoint32A
0x480430 GetSystemPaletteEntries
0x480434 GetStockObject
0x480438 GetPixel
0x48043c GetPaletteEntries
0x480440 GetObjectA
0x480444 GetDeviceCaps
0x480448 GetDIBits
0x48044c GetDIBColorTable
0x480450 GetDCOrgEx
0x480454 GetCurrentPositionEx
0x480458 GetClipBox
0x48045c GetBrushOrgEx
0x480460 GetBitmapBits
0x480464 GetArcDirection
0x480468 ExtTextOutA
0x48046c ExcludeClipRect
0x480470 DeleteObject
0x480474 DeleteDC
0x480478 CreateSolidBrush
0x48047c CreatePenIndirect
0x480480 CreatePalette
0x480484 CreateHalftonePalette
0x480488 CreateFontIndirectA
0x48048c CreateDIBitmap
0x480490 CreateDIBSection
0x480494 CreateCompatibleDC
0x480498 CreateCompatibleBitmap
0x48049c CreateBrushIndirect
0x4804a0 CreateBitmap
0x4804a4 BitBlt
user32.dll
0x4804ac CreateWindowExA
0x4804b0 WindowFromPoint
0x4804b4 WinHelpA
0x4804b8 WaitMessage
0x4804bc UpdateWindow
0x4804c0 UnregisterClassA
0x4804c4 UnhookWindowsHookEx
0x4804c8 TranslateMessage
0x4804cc TranslateMDISysAccel
0x4804d0 TrackPopupMenu
0x4804d4 SystemParametersInfoA
0x4804d8 ShowWindow
0x4804dc ShowScrollBar
0x4804e0 ShowOwnedPopups
0x4804e4 ShowCursor
0x4804e8 SetWindowsHookExA
0x4804ec SetWindowTextA
0x4804f0 SetWindowPos
0x4804f4 SetWindowPlacement
0x4804f8 SetWindowLongA
0x4804fc SetTimer
0x480500 SetScrollRange
0x480504 SetScrollPos
0x480508 SetScrollInfo
0x48050c SetRect
0x480510 SetPropA
0x480514 SetParent
0x480518 SetMenuItemInfoA
0x48051c SetMenu
0x480520 SetForegroundWindow
0x480524 SetFocus
0x480528 SetCursor
0x48052c SetClassLongA
0x480530 SetCapture
0x480534 SetActiveWindow
0x480538 SendMessageA
0x48053c ScrollWindow
0x480540 ScreenToClient
0x480544 RemovePropA
0x480548 RemoveMenu
0x48054c ReleaseDC
0x480550 ReleaseCapture
0x480554 RegisterWindowMessageA
0x480558 RegisterClipboardFormatA
0x48055c RegisterClassA
0x480560 RedrawWindow
0x480564 PtInRect
0x480568 PostQuitMessage
0x48056c PostMessageA
0x480570 PeekMessageA
0x480574 OffsetRect
0x480578 OemToCharA
0x48057c MsgWaitForMultipleObjects
0x480580 MessageBoxA
0x480584 MapWindowPoints
0x480588 MapVirtualKeyA
0x48058c LoadStringA
0x480590 LoadKeyboardLayoutA
0x480594 LoadIconA
0x480598 LoadCursorA
0x48059c LoadBitmapA
0x4805a0 KillTimer
0x4805a4 IsZoomed
0x4805a8 IsWindowVisible
0x4805ac IsWindowEnabled
0x4805b0 IsWindow
0x4805b4 IsRectEmpty
0x4805b8 IsIconic
0x4805bc IsDialogMessageA
0x4805c0 IsChild
0x4805c4 InvalidateRect
0x4805c8 IntersectRect
0x4805cc InsertMenuItemA
0x4805d0 InsertMenuA
0x4805d4 InflateRect
0x4805d8 GetWindowThreadProcessId
0x4805dc GetWindowTextA
0x4805e0 GetWindowRect
0x4805e4 GetWindowPlacement
0x4805e8 GetWindowLongA
0x4805ec GetWindowDC
0x4805f0 GetTopWindow
0x4805f4 GetSystemMetrics
0x4805f8 GetSystemMenu
0x4805fc GetSysColorBrush
0x480600 GetSysColor
0x480604 GetSubMenu
0x480608 GetScrollRange
0x48060c GetScrollPos
0x480610 GetScrollInfo
0x480614 GetPropA
0x480618 GetParent
0x48061c GetWindow
0x480620 GetMessagePos
0x480624 GetMenuStringA
0x480628 GetMenuState
0x48062c GetMenuItemInfoA
0x480630 GetMenuItemID
0x480634 GetMenuItemCount
0x480638 GetMenu
0x48063c GetLastActivePopup
0x480640 GetKeyboardState
0x480644 GetKeyboardLayoutList
0x480648 GetKeyboardLayout
0x48064c GetKeyState
0x480650 GetKeyNameTextA
0x480654 GetIconInfo
0x480658 GetForegroundWindow
0x48065c GetFocus
0x480660 GetDesktopWindow
0x480664 GetDCEx
0x480668 GetDC
0x48066c GetCursorPos
0x480670 GetCursor
0x480674 GetClientRect
0x480678 GetClassNameA
0x48067c GetClassInfoA
0x480680 GetCapture
0x480684 GetActiveWindow
0x480688 FrameRect
0x48068c FindWindowA
0x480690 FillRect
0x480694 EqualRect
0x480698 EnumWindows
0x48069c EnumThreadWindows
0x4806a0 EndPaint
0x4806a4 EndDeferWindowPos
0x4806a8 EnableWindow
0x4806ac EnableScrollBar
0x4806b0 EnableMenuItem
0x4806b4 DrawTextA
0x4806b8 DrawMenuBar
0x4806bc DrawIconEx
0x4806c0 DrawIcon
0x4806c4 DrawFrameControl
0x4806c8 DrawEdge
0x4806cc DispatchMessageA
0x4806d0 DestroyWindow
0x4806d4 DestroyMenu
0x4806d8 DestroyIcon
0x4806dc DestroyCursor
0x4806e0 DeleteMenu
0x4806e4 DeferWindowPos
0x4806e8 DefWindowProcA
0x4806ec DefMDIChildProcA
0x4806f0 DefFrameProcA
0x4806f4 CreatePopupMenu
0x4806f8 CreateMenu
0x4806fc CreateIcon
0x480700 ClientToScreen
0x480704 ChildWindowFromPoint
0x480708 CheckMenuItem
0x48070c CallWindowProcA
0x480710 CallNextHookEx
0x480714 BeginPaint
0x480718 BeginDeferWindowPos
0x48071c CharNextA
0x480720 CharLowerA
0x480724 CharUpperBuffA
0x480728 CharToOemA
0x48072c AdjustWindowRectEx
0x480730 ActivateKeyboardLayout
kernel32.dll
0x480738 Sleep
oleaut32.dll
0x480740 SafeArrayPtrOfIndex
0x480744 SafeArrayGetUBound
0x480748 SafeArrayGetLBound
0x48074c SafeArrayCreate
0x480750 VariantChangeType
0x480754 VariantCopy
0x480758 VariantClear
0x48075c VariantInit
ole32.dll
0x480764 OleUninitialize
0x480768 OleInitialize
0x48076c CoTaskMemAlloc
0x480770 CoCreateInstance
0x480774 CoUninitialize
0x480778 CoInitialize
oleaut32.dll
0x480780 GetErrorInfo
0x480784 SysFreeString
comctl32.dll
0x48078c ImageList_SetIconSize
0x480790 ImageList_GetIconSize
0x480794 ImageList_Write
0x480798 ImageList_Read
0x48079c ImageList_GetDragImage
0x4807a0 ImageList_DragShowNolock
0x4807a4 ImageList_SetDragCursorImage
0x4807a8 ImageList_DragMove
0x4807ac ImageList_DragLeave
0x4807b0 ImageList_DragEnter
0x4807b4 ImageList_EndDrag
0x4807b8 ImageList_BeginDrag
0x4807bc ImageList_Remove
0x4807c0 ImageList_DrawEx
0x4807c4 ImageList_Draw
0x4807c8 ImageList_GetBkColor
0x4807cc ImageList_SetBkColor
0x4807d0 ImageList_ReplaceIcon
0x4807d4 ImageList_Add
0x4807d8 ImageList_GetImageCount
0x4807dc ImageList_Destroy
0x4807e0 ImageList_Create
0x4807e4 InitCommonControls
shell32.dll
0x4807ec ShellExecuteExA
0x4807f0 ShellExecuteA
0x4807f4 SHGetFileInfoA
shell32.dll
0x4807fc SHGetSpecialFolderLocation
0x480800 SHGetMalloc
0x480804 SHGetDesktopFolder
EAT(Export Address Table) is none
kernel32.dll
0x480168 DeleteCriticalSection
0x48016c LeaveCriticalSection
0x480170 EnterCriticalSection
0x480174 InitializeCriticalSection
0x480178 VirtualFree
0x48017c VirtualAlloc
0x480180 LocalFree
0x480184 LocalAlloc
0x480188 GetVersion
0x48018c GetCurrentThreadId
0x480190 InterlockedDecrement
0x480194 InterlockedIncrement
0x480198 VirtualQuery
0x48019c WideCharToMultiByte
0x4801a0 MultiByteToWideChar
0x4801a4 lstrlenA
0x4801a8 lstrcpynA
0x4801ac LoadLibraryExA
0x4801b0 GetThreadLocale
0x4801b4 GetStartupInfoA
0x4801b8 GetProcAddress
0x4801bc GetModuleHandleA
0x4801c0 GetModuleFileNameA
0x4801c4 GetLocaleInfoA
0x4801c8 GetCommandLineA
0x4801cc FreeLibrary
0x4801d0 FindFirstFileA
0x4801d4 FindClose
0x4801d8 ExitProcess
0x4801dc ExitThread
0x4801e0 CreateThread
0x4801e4 WriteFile
0x4801e8 UnhandledExceptionFilter
0x4801ec RtlUnwind
0x4801f0 RaiseException
0x4801f4 GetStdHandle
user32.dll
0x4801fc GetKeyboardType
0x480200 LoadStringA
0x480204 MessageBoxA
0x480208 CharNextA
advapi32.dll
0x480210 RegQueryValueExA
0x480214 RegOpenKeyExA
0x480218 RegCloseKey
oleaut32.dll
0x480220 SysFreeString
0x480224 SysReAllocStringLen
0x480228 SysAllocStringLen
kernel32.dll
0x480230 TlsSetValue
0x480234 TlsGetValue
0x480238 LocalAlloc
0x48023c GetModuleHandleA
advapi32.dll
0x480244 RegQueryValueExA
0x480248 RegOpenKeyExA
0x48024c RegCloseKey
kernel32.dll
0x480254 lstrlenA
0x480258 lstrcpyA
0x48025c lstrcmpA
0x480260 WriteFile
0x480264 WaitForSingleObject
0x480268 WaitForMultipleObjects
0x48026c VirtualQuery
0x480270 VirtualAlloc
0x480274 Sleep
0x480278 SizeofResource
0x48027c SetThreadLocale
0x480280 SetFilePointer
0x480284 SetEvent
0x480288 SetErrorMode
0x48028c SetEndOfFile
0x480290 SetCurrentDirectoryA
0x480294 ResumeThread
0x480298 ResetEvent
0x48029c ReleaseMutex
0x4802a0 ReadFile
0x4802a4 MultiByteToWideChar
0x4802a8 MulDiv
0x4802ac LockResource
0x4802b0 LoadResource
0x4802b4 LoadLibraryA
0x4802b8 LeaveCriticalSection
0x4802bc InitializeCriticalSection
0x4802c0 GlobalUnlock
0x4802c4 GlobalReAlloc
0x4802c8 GlobalHandle
0x4802cc GlobalLock
0x4802d0 GlobalFree
0x4802d4 GlobalFindAtomA
0x4802d8 GlobalDeleteAtom
0x4802dc GlobalAlloc
0x4802e0 GlobalAddAtomA
0x4802e4 GetVersionExA
0x4802e8 GetVersion
0x4802ec GetTickCount
0x4802f0 GetThreadLocale
0x4802f4 GetSystemTimeAsFileTime
0x4802f8 GetSystemTime
0x4802fc GetSystemInfo
0x480300 GetStringTypeExA
0x480304 GetStdHandle
0x480308 GetProcAddress
0x48030c GetModuleHandleA
0x480310 GetModuleFileNameA
0x480314 GetLocaleInfoA
0x480318 GetLocalTime
0x48031c GetLastError
0x480320 GetFullPathNameA
0x480324 GetExitCodeThread
0x480328 GetDiskFreeSpaceA
0x48032c GetDateFormatA
0x480330 GetCurrentThreadId
0x480334 GetCurrentProcessId
0x480338 GetCurrentDirectoryA
0x48033c GetCPInfo
0x480340 GetACP
0x480344 FreeResource
0x480348 InterlockedIncrement
0x48034c InterlockedExchange
0x480350 InterlockedDecrement
0x480354 FreeLibrary
0x480358 FormatMessageA
0x48035c FindResourceA
0x480360 FindNextChangeNotification
0x480364 FindFirstFileA
0x480368 FindFirstChangeNotificationA
0x48036c FindCloseChangeNotification
0x480370 FindClose
0x480374 FileTimeToSystemTime
0x480378 FileTimeToLocalFileTime
0x48037c FileTimeToDosDateTime
0x480380 ExitThread
0x480384 EnumCalendarInfoA
0x480388 EnterCriticalSection
0x48038c DeleteCriticalSection
0x480390 CreateThread
0x480394 CreateMutexA
0x480398 CreateFileA
0x48039c CreateEventA
0x4803a0 CompareStringA
0x4803a4 CloseHandle
version.dll
0x4803ac VerQueryValueA
0x4803b0 GetFileVersionInfoSizeA
0x4803b4 GetFileVersionInfoA
gdi32.dll
0x4803bc UnrealizeObject
0x4803c0 StretchBlt
0x4803c4 SetWindowOrgEx
0x4803c8 SetViewportOrgEx
0x4803cc SetTextColor
0x4803d0 SetStretchBltMode
0x4803d4 SetROP2
0x4803d8 SetPixel
0x4803dc SetDIBColorTable
0x4803e0 SetBrushOrgEx
0x4803e4 SetBkMode
0x4803e8 SetBkColor
0x4803ec SelectPalette
0x4803f0 SelectObject
0x4803f4 SelectClipRgn
0x4803f8 SaveDC
0x4803fc RestoreDC
0x480400 Rectangle
0x480404 RectVisible
0x480408 RealizePalette
0x48040c Polyline
0x480410 PatBlt
0x480414 MoveToEx
0x480418 MaskBlt
0x48041c LineTo
0x480420 IntersectClipRect
0x480424 GetWindowOrgEx
0x480428 GetTextMetricsA
0x48042c GetTextExtentPoint32A
0x480430 GetSystemPaletteEntries
0x480434 GetStockObject
0x480438 GetPixel
0x48043c GetPaletteEntries
0x480440 GetObjectA
0x480444 GetDeviceCaps
0x480448 GetDIBits
0x48044c GetDIBColorTable
0x480450 GetDCOrgEx
0x480454 GetCurrentPositionEx
0x480458 GetClipBox
0x48045c GetBrushOrgEx
0x480460 GetBitmapBits
0x480464 GetArcDirection
0x480468 ExtTextOutA
0x48046c ExcludeClipRect
0x480470 DeleteObject
0x480474 DeleteDC
0x480478 CreateSolidBrush
0x48047c CreatePenIndirect
0x480480 CreatePalette
0x480484 CreateHalftonePalette
0x480488 CreateFontIndirectA
0x48048c CreateDIBitmap
0x480490 CreateDIBSection
0x480494 CreateCompatibleDC
0x480498 CreateCompatibleBitmap
0x48049c CreateBrushIndirect
0x4804a0 CreateBitmap
0x4804a4 BitBlt
user32.dll
0x4804ac CreateWindowExA
0x4804b0 WindowFromPoint
0x4804b4 WinHelpA
0x4804b8 WaitMessage
0x4804bc UpdateWindow
0x4804c0 UnregisterClassA
0x4804c4 UnhookWindowsHookEx
0x4804c8 TranslateMessage
0x4804cc TranslateMDISysAccel
0x4804d0 TrackPopupMenu
0x4804d4 SystemParametersInfoA
0x4804d8 ShowWindow
0x4804dc ShowScrollBar
0x4804e0 ShowOwnedPopups
0x4804e4 ShowCursor
0x4804e8 SetWindowsHookExA
0x4804ec SetWindowTextA
0x4804f0 SetWindowPos
0x4804f4 SetWindowPlacement
0x4804f8 SetWindowLongA
0x4804fc SetTimer
0x480500 SetScrollRange
0x480504 SetScrollPos
0x480508 SetScrollInfo
0x48050c SetRect
0x480510 SetPropA
0x480514 SetParent
0x480518 SetMenuItemInfoA
0x48051c SetMenu
0x480520 SetForegroundWindow
0x480524 SetFocus
0x480528 SetCursor
0x48052c SetClassLongA
0x480530 SetCapture
0x480534 SetActiveWindow
0x480538 SendMessageA
0x48053c ScrollWindow
0x480540 ScreenToClient
0x480544 RemovePropA
0x480548 RemoveMenu
0x48054c ReleaseDC
0x480550 ReleaseCapture
0x480554 RegisterWindowMessageA
0x480558 RegisterClipboardFormatA
0x48055c RegisterClassA
0x480560 RedrawWindow
0x480564 PtInRect
0x480568 PostQuitMessage
0x48056c PostMessageA
0x480570 PeekMessageA
0x480574 OffsetRect
0x480578 OemToCharA
0x48057c MsgWaitForMultipleObjects
0x480580 MessageBoxA
0x480584 MapWindowPoints
0x480588 MapVirtualKeyA
0x48058c LoadStringA
0x480590 LoadKeyboardLayoutA
0x480594 LoadIconA
0x480598 LoadCursorA
0x48059c LoadBitmapA
0x4805a0 KillTimer
0x4805a4 IsZoomed
0x4805a8 IsWindowVisible
0x4805ac IsWindowEnabled
0x4805b0 IsWindow
0x4805b4 IsRectEmpty
0x4805b8 IsIconic
0x4805bc IsDialogMessageA
0x4805c0 IsChild
0x4805c4 InvalidateRect
0x4805c8 IntersectRect
0x4805cc InsertMenuItemA
0x4805d0 InsertMenuA
0x4805d4 InflateRect
0x4805d8 GetWindowThreadProcessId
0x4805dc GetWindowTextA
0x4805e0 GetWindowRect
0x4805e4 GetWindowPlacement
0x4805e8 GetWindowLongA
0x4805ec GetWindowDC
0x4805f0 GetTopWindow
0x4805f4 GetSystemMetrics
0x4805f8 GetSystemMenu
0x4805fc GetSysColorBrush
0x480600 GetSysColor
0x480604 GetSubMenu
0x480608 GetScrollRange
0x48060c GetScrollPos
0x480610 GetScrollInfo
0x480614 GetPropA
0x480618 GetParent
0x48061c GetWindow
0x480620 GetMessagePos
0x480624 GetMenuStringA
0x480628 GetMenuState
0x48062c GetMenuItemInfoA
0x480630 GetMenuItemID
0x480634 GetMenuItemCount
0x480638 GetMenu
0x48063c GetLastActivePopup
0x480640 GetKeyboardState
0x480644 GetKeyboardLayoutList
0x480648 GetKeyboardLayout
0x48064c GetKeyState
0x480650 GetKeyNameTextA
0x480654 GetIconInfo
0x480658 GetForegroundWindow
0x48065c GetFocus
0x480660 GetDesktopWindow
0x480664 GetDCEx
0x480668 GetDC
0x48066c GetCursorPos
0x480670 GetCursor
0x480674 GetClientRect
0x480678 GetClassNameA
0x48067c GetClassInfoA
0x480680 GetCapture
0x480684 GetActiveWindow
0x480688 FrameRect
0x48068c FindWindowA
0x480690 FillRect
0x480694 EqualRect
0x480698 EnumWindows
0x48069c EnumThreadWindows
0x4806a0 EndPaint
0x4806a4 EndDeferWindowPos
0x4806a8 EnableWindow
0x4806ac EnableScrollBar
0x4806b0 EnableMenuItem
0x4806b4 DrawTextA
0x4806b8 DrawMenuBar
0x4806bc DrawIconEx
0x4806c0 DrawIcon
0x4806c4 DrawFrameControl
0x4806c8 DrawEdge
0x4806cc DispatchMessageA
0x4806d0 DestroyWindow
0x4806d4 DestroyMenu
0x4806d8 DestroyIcon
0x4806dc DestroyCursor
0x4806e0 DeleteMenu
0x4806e4 DeferWindowPos
0x4806e8 DefWindowProcA
0x4806ec DefMDIChildProcA
0x4806f0 DefFrameProcA
0x4806f4 CreatePopupMenu
0x4806f8 CreateMenu
0x4806fc CreateIcon
0x480700 ClientToScreen
0x480704 ChildWindowFromPoint
0x480708 CheckMenuItem
0x48070c CallWindowProcA
0x480710 CallNextHookEx
0x480714 BeginPaint
0x480718 BeginDeferWindowPos
0x48071c CharNextA
0x480720 CharLowerA
0x480724 CharUpperBuffA
0x480728 CharToOemA
0x48072c AdjustWindowRectEx
0x480730 ActivateKeyboardLayout
kernel32.dll
0x480738 Sleep
oleaut32.dll
0x480740 SafeArrayPtrOfIndex
0x480744 SafeArrayGetUBound
0x480748 SafeArrayGetLBound
0x48074c SafeArrayCreate
0x480750 VariantChangeType
0x480754 VariantCopy
0x480758 VariantClear
0x48075c VariantInit
ole32.dll
0x480764 OleUninitialize
0x480768 OleInitialize
0x48076c CoTaskMemAlloc
0x480770 CoCreateInstance
0x480774 CoUninitialize
0x480778 CoInitialize
oleaut32.dll
0x480780 GetErrorInfo
0x480784 SysFreeString
comctl32.dll
0x48078c ImageList_SetIconSize
0x480790 ImageList_GetIconSize
0x480794 ImageList_Write
0x480798 ImageList_Read
0x48079c ImageList_GetDragImage
0x4807a0 ImageList_DragShowNolock
0x4807a4 ImageList_SetDragCursorImage
0x4807a8 ImageList_DragMove
0x4807ac ImageList_DragLeave
0x4807b0 ImageList_DragEnter
0x4807b4 ImageList_EndDrag
0x4807b8 ImageList_BeginDrag
0x4807bc ImageList_Remove
0x4807c0 ImageList_DrawEx
0x4807c4 ImageList_Draw
0x4807c8 ImageList_GetBkColor
0x4807cc ImageList_SetBkColor
0x4807d0 ImageList_ReplaceIcon
0x4807d4 ImageList_Add
0x4807d8 ImageList_GetImageCount
0x4807dc ImageList_Destroy
0x4807e0 ImageList_Create
0x4807e4 InitCommonControls
shell32.dll
0x4807ec ShellExecuteExA
0x4807f0 ShellExecuteA
0x4807f4 SHGetFileInfoA
shell32.dll
0x4807fc SHGetSpecialFolderLocation
0x480800 SHGetMalloc
0x480804 SHGetDesktopFolder
EAT(Export Address Table) is none