ScreenShot
| Created | 2021.12.11 23:19 | Machine | s1_win7_x6403 |
| Filename | rc.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 32 detected (DownLoader44, Zusy, Artemis, Unsafe, MalPbs, gen1, EQQS, R002C0DLA21, Score, AGEN, kcloud, Remcos, Malicious, ai score=87, Static AI, Suspicious PE, susgen, GdSda) | ||
| md5 | 8b416273ddf403092ec996125e35b2ab | ||
| sha256 | 1fc74504d626223335f39e10435bd3366bc5533619e8e7713e2a48eadd4dc26a | ||
| ssdeep | 24576:suRQsAJcBdZF0bE25gAUQIf3c13TOqamxypnUXAGe:sL9JO0jUn | ||
| imphash | 939d8f743f99c748d946de3c81bddd31 | ||
| impfuzzy | 192:o13MDbuu0xSUvK9kmo1Xy7EFG1Q2POQHe:C3m0q9oe1FPOQ+ | ||
Network IP location
Signature (24cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 32 AntiVirus engines on VirusTotal as malicious |
| watch | Allocates execute permission to another process indicative of possible code injection |
| watch | Creates a thread using CreateRemoteThread in a non-child process indicative of process injection |
| watch | Deletes executed files from disk |
| watch | Installs itself for autorun at Windows startup |
| watch | Manipulates memory of a non-child process indicative of process injection |
| watch | Network activity contains more than one unique useragent |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) |
| notice | Creates a suspicious process |
| notice | Creates executable files on the filesystem |
| notice | Drops a binary and executes it |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | One or more processes crashed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | The executable uses a known packer |
| info | The file contains an unknown PE resource name possibly indicative of a packer |
Rules (43cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Win32_Trojan_Gen_1_0904B0_Zero | Win32 Trojan Emotet | binaries (download) |
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (download) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (download) |
| watch | Network_Downloader | File Downloader | memory |
| watch | UPX_Zero | UPX packed file | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Code_injection | Code injection with CreateRemoteThread in a remote process | memory |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | local_credential_Steal | Steal credential | memory |
| notice | Network_DGA | Communication using DGA | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_FTP | Communications over FTP | memory |
| notice | Network_HTTP | Communications over HTTP | memory |
| notice | Network_P2P_Win | Communications over P2P network | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Http_API | Match Windows Http API call | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | antisb_threatExpert | Anti-Sandbox checks for ThreatExpert | memory |
| info | Check_Dlls | (no description) | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerCheck__RemoteAPI | (no description) | memory |
| info | DebuggerException__ConsoleCtrl | (no description) | memory |
| info | DebuggerException__SetConsoleCtrl | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsDLL | (no description) | binaries (download) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | IsPE64 | (no description) | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (download) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
| info | Win32_Trojan_Gen_2_0904B0_Zero | Win32 Trojan Gen | binaries (download) |
Network (4cnts) ?
Suricata ids
SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)
PE API
IAT(Import Address Table) Library
oleaut32.dll
0x47b7b8 SysFreeString
0x47b7bc SysReAllocStringLen
0x47b7c0 SysAllocStringLen
advapi32.dll
0x47b7c8 RegQueryValueExA
0x47b7cc RegOpenKeyExA
0x47b7d0 RegCloseKey
user32.dll
0x47b7d8 GetKeyboardType
0x47b7dc DestroyWindow
0x47b7e0 LoadStringA
0x47b7e4 MessageBoxA
0x47b7e8 CharNextA
kernel32.dll
0x47b7f0 GetACP
0x47b7f4 Sleep
0x47b7f8 VirtualFree
0x47b7fc VirtualAlloc
0x47b800 GetCurrentThreadId
0x47b804 InterlockedDecrement
0x47b808 InterlockedIncrement
0x47b80c VirtualQuery
0x47b810 WideCharToMultiByte
0x47b814 MultiByteToWideChar
0x47b818 lstrlenA
0x47b81c lstrcpynA
0x47b820 LoadLibraryExA
0x47b824 GetThreadLocale
0x47b828 GetStartupInfoA
0x47b82c GetProcAddress
0x47b830 GetModuleHandleA
0x47b834 GetModuleFileNameA
0x47b838 GetLocaleInfoA
0x47b83c GetCommandLineA
0x47b840 FreeLibrary
0x47b844 FindFirstFileA
0x47b848 FindClose
0x47b84c ExitProcess
0x47b850 CompareStringA
0x47b854 WriteFile
0x47b858 UnhandledExceptionFilter
0x47b85c RtlUnwind
0x47b860 RaiseException
0x47b864 GetStdHandle
kernel32.dll
0x47b86c TlsSetValue
0x47b870 TlsGetValue
0x47b874 LocalAlloc
0x47b878 GetModuleHandleA
user32.dll
0x47b880 CreateWindowExA
0x47b884 WindowFromPoint
0x47b888 WaitMessage
0x47b88c UpdateWindow
0x47b890 UnregisterClassA
0x47b894 UnhookWindowsHookEx
0x47b898 TranslateMessage
0x47b89c TranslateMDISysAccel
0x47b8a0 TrackPopupMenu
0x47b8a4 SystemParametersInfoA
0x47b8a8 ShowWindow
0x47b8ac ShowScrollBar
0x47b8b0 ShowOwnedPopups
0x47b8b4 SetWindowsHookExA
0x47b8b8 SetWindowPos
0x47b8bc SetWindowPlacement
0x47b8c0 SetWindowLongW
0x47b8c4 SetWindowLongA
0x47b8c8 SetTimer
0x47b8cc SetScrollRange
0x47b8d0 SetScrollPos
0x47b8d4 SetScrollInfo
0x47b8d8 SetRect
0x47b8dc SetPropA
0x47b8e0 SetParent
0x47b8e4 SetMenuItemInfoA
0x47b8e8 SetMenu
0x47b8ec SetForegroundWindow
0x47b8f0 SetFocus
0x47b8f4 SetCursor
0x47b8f8 SetClassLongA
0x47b8fc SetCapture
0x47b900 SetActiveWindow
0x47b904 SendMessageW
0x47b908 SendMessageA
0x47b90c ScrollWindow
0x47b910 ScreenToClient
0x47b914 RemovePropA
0x47b918 RemoveMenu
0x47b91c ReleaseDC
0x47b920 ReleaseCapture
0x47b924 RegisterWindowMessageA
0x47b928 RegisterClipboardFormatA
0x47b92c RegisterClassA
0x47b930 RedrawWindow
0x47b934 PtInRect
0x47b938 PostQuitMessage
0x47b93c PostMessageA
0x47b940 PeekMessageW
0x47b944 PeekMessageA
0x47b948 OffsetRect
0x47b94c OemToCharA
0x47b950 MessageBoxA
0x47b954 MapWindowPoints
0x47b958 MapVirtualKeyA
0x47b95c LockWindowUpdate
0x47b960 LoadStringA
0x47b964 LoadKeyboardLayoutA
0x47b968 LoadIconA
0x47b96c LoadCursorA
0x47b970 LoadBitmapA
0x47b974 KillTimer
0x47b978 IsZoomed
0x47b97c IsWindowVisible
0x47b980 IsWindowUnicode
0x47b984 IsWindowEnabled
0x47b988 IsWindow
0x47b98c IsRectEmpty
0x47b990 IsIconic
0x47b994 IsDialogMessageW
0x47b998 IsDialogMessageA
0x47b99c IsChild
0x47b9a0 InvalidateRect
0x47b9a4 IntersectRect
0x47b9a8 InsertMenuItemA
0x47b9ac InsertMenuA
0x47b9b0 InflateRect
0x47b9b4 GetWindowThreadProcessId
0x47b9b8 GetWindowTextA
0x47b9bc GetWindowRect
0x47b9c0 GetWindowPlacement
0x47b9c4 GetWindowLongW
0x47b9c8 GetWindowLongA
0x47b9cc GetWindowDC
0x47b9d0 GetTopWindow
0x47b9d4 GetSystemMetrics
0x47b9d8 GetSystemMenu
0x47b9dc GetSysColorBrush
0x47b9e0 GetSysColor
0x47b9e4 GetSubMenu
0x47b9e8 GetScrollRange
0x47b9ec GetScrollPos
0x47b9f0 GetScrollInfo
0x47b9f4 GetPropA
0x47b9f8 GetParent
0x47b9fc GetWindow
0x47ba00 GetMessagePos
0x47ba04 GetMenuStringA
0x47ba08 GetMenuState
0x47ba0c GetMenuItemInfoA
0x47ba10 GetMenuItemID
0x47ba14 GetMenuItemCount
0x47ba18 GetMenu
0x47ba1c GetLastActivePopup
0x47ba20 GetKeyboardState
0x47ba24 GetKeyboardLayoutNameA
0x47ba28 GetKeyboardLayoutList
0x47ba2c GetKeyboardLayout
0x47ba30 GetKeyState
0x47ba34 GetKeyNameTextA
0x47ba38 GetIconInfo
0x47ba3c GetForegroundWindow
0x47ba40 GetFocus
0x47ba44 GetDlgItem
0x47ba48 GetDesktopWindow
0x47ba4c GetDCEx
0x47ba50 GetDC
0x47ba54 GetCursorPos
0x47ba58 GetCursor
0x47ba5c GetClientRect
0x47ba60 GetClassLongA
0x47ba64 GetClassInfoA
0x47ba68 GetCapture
0x47ba6c GetActiveWindow
0x47ba70 FrameRect
0x47ba74 FindWindowA
0x47ba78 FillRect
0x47ba7c EqualRect
0x47ba80 EnumWindows
0x47ba84 EnumThreadWindows
0x47ba88 EnumChildWindows
0x47ba8c EndPaint
0x47ba90 EnableWindow
0x47ba94 EnableScrollBar
0x47ba98 EnableMenuItem
0x47ba9c DrawTextA
0x47baa0 DrawMenuBar
0x47baa4 DrawIconEx
0x47baa8 DrawIcon
0x47baac DrawFrameControl
0x47bab0 DrawEdge
0x47bab4 DispatchMessageW
0x47bab8 DispatchMessageA
0x47babc DestroyWindow
0x47bac0 DestroyMenu
0x47bac4 DestroyIcon
0x47bac8 DestroyCursor
0x47bacc DeleteMenu
0x47bad0 DefWindowProcA
0x47bad4 DefMDIChildProcA
0x47bad8 DefFrameProcA
0x47badc CreatePopupMenu
0x47bae0 CreateMenu
0x47bae4 CreateIcon
0x47bae8 ClientToScreen
0x47baec CheckMenuItem
0x47baf0 CallWindowProcA
0x47baf4 CallNextHookEx
0x47baf8 BeginPaint
0x47bafc CharNextA
0x47bb00 CharLowerA
0x47bb04 CharToOemA
0x47bb08 AdjustWindowRectEx
0x47bb0c ActivateKeyboardLayout
msimg32.dll
0x47bb14 GradientFill
gdi32.dll
0x47bb1c UnrealizeObject
0x47bb20 StretchBlt
0x47bb24 SetWindowOrgEx
0x47bb28 SetViewportOrgEx
0x47bb2c SetTextColor
0x47bb30 SetStretchBltMode
0x47bb34 SetROP2
0x47bb38 SetPixel
0x47bb3c SetDIBColorTable
0x47bb40 SetBrushOrgEx
0x47bb44 SetBkMode
0x47bb48 SetBkColor
0x47bb4c SelectPalette
0x47bb50 SelectObject
0x47bb54 SaveDC
0x47bb58 RestoreDC
0x47bb5c Rectangle
0x47bb60 RectVisible
0x47bb64 RealizePalette
0x47bb68 Polyline
0x47bb6c Polygon
0x47bb70 PatBlt
0x47bb74 MoveToEx
0x47bb78 MaskBlt
0x47bb7c LineTo
0x47bb80 IntersectClipRect
0x47bb84 GetWindowOrgEx
0x47bb88 GetTextMetricsA
0x47bb8c GetTextExtentPoint32A
0x47bb90 GetSystemPaletteEntries
0x47bb94 GetStockObject
0x47bb98 GetRgnBox
0x47bb9c GetPixel
0x47bba0 GetPaletteEntries
0x47bba4 GetObjectA
0x47bba8 GetDeviceCaps
0x47bbac GetDIBits
0x47bbb0 GetDIBColorTable
0x47bbb4 GetDCOrgEx
0x47bbb8 GetCurrentPositionEx
0x47bbbc GetClipBox
0x47bbc0 GetBrushOrgEx
0x47bbc4 GetBitmapBits
0x47bbc8 ExcludeClipRect
0x47bbcc DeleteObject
0x47bbd0 DeleteDC
0x47bbd4 CreateSolidBrush
0x47bbd8 CreateRectRgn
0x47bbdc CreatePenIndirect
0x47bbe0 CreatePalette
0x47bbe4 CreateHalftonePalette
0x47bbe8 CreateFontIndirectA
0x47bbec CreateDIBitmap
0x47bbf0 CreateDIBSection
0x47bbf4 CreateCompatibleDC
0x47bbf8 CreateCompatibleBitmap
0x47bbfc CreateBrushIndirect
0x47bc00 CreateBitmap
0x47bc04 CombineRgn
0x47bc08 BitBlt
version.dll
0x47bc10 VerQueryValueA
0x47bc14 GetFileVersionInfoSizeA
0x47bc18 GetFileVersionInfoA
kernel32.dll
0x47bc20 lstrcpyA
0x47bc24 WriteFile
0x47bc28 WaitForSingleObject
0x47bc2c VirtualQuery
0x47bc30 VirtualProtect
0x47bc34 VirtualAlloc
0x47bc38 SizeofResource
0x47bc3c SetThreadLocale
0x47bc40 SetFilePointer
0x47bc44 SetEvent
0x47bc48 SetErrorMode
0x47bc4c SetEndOfFile
0x47bc50 ResetEvent
0x47bc54 ReadFile
0x47bc58 MultiByteToWideChar
0x47bc5c MulDiv
0x47bc60 LockResource
0x47bc64 LoadResource
0x47bc68 LoadLibraryA
0x47bc6c LeaveCriticalSection
0x47bc70 InitializeCriticalSection
0x47bc74 GlobalFindAtomA
0x47bc78 GlobalDeleteAtom
0x47bc7c GlobalAddAtomA
0x47bc80 GetVersionExA
0x47bc84 GetVersion
0x47bc88 GetTickCount
0x47bc8c GetThreadLocale
0x47bc90 GetStdHandle
0x47bc94 GetProcAddress
0x47bc98 GetModuleHandleA
0x47bc9c GetModuleFileNameA
0x47bca0 GetLocaleInfoA
0x47bca4 GetLocalTime
0x47bca8 GetLastError
0x47bcac GetFullPathNameA
0x47bcb0 GetDiskFreeSpaceA
0x47bcb4 GetDateFormatA
0x47bcb8 GetCurrentThreadId
0x47bcbc GetCurrentProcessId
0x47bcc0 GetCPInfo
0x47bcc4 FreeResource
0x47bcc8 InterlockedExchange
0x47bccc FreeLibrary
0x47bcd0 FormatMessageA
0x47bcd4 FindResourceA
0x47bcd8 EnumCalendarInfoA
0x47bcdc EnterCriticalSection
0x47bce0 DeleteCriticalSection
0x47bce4 CreateThread
0x47bce8 CreateFileA
0x47bcec CreateEventA
0x47bcf0 CompareStringA
0x47bcf4 CloseHandle
advapi32.dll
0x47bcfc RegQueryValueExA
0x47bd00 RegOpenKeyExA
0x47bd04 RegFlushKey
0x47bd08 RegCloseKey
oleaut32.dll
0x47bd10 CreateErrorInfo
0x47bd14 GetErrorInfo
0x47bd18 SetErrorInfo
0x47bd1c SysFreeString
ole32.dll
0x47bd24 OleUninitialize
0x47bd28 OleInitialize
0x47bd2c CoCreateInstance
0x47bd30 CoUninitialize
0x47bd34 CoInitialize
kernel32.dll
0x47bd3c Sleep
oleaut32.dll
0x47bd44 SafeArrayPtrOfIndex
0x47bd48 SafeArrayGetUBound
0x47bd4c SafeArrayGetLBound
0x47bd50 SafeArrayCreate
0x47bd54 VariantChangeType
0x47bd58 VariantCopy
0x47bd5c VariantClear
0x47bd60 VariantInit
comctl32.dll
0x47bd68 _TrackMouseEvent
0x47bd6c ImageList_SetIconSize
0x47bd70 ImageList_GetIconSize
0x47bd74 ImageList_Write
0x47bd78 ImageList_Read
0x47bd7c ImageList_GetDragImage
0x47bd80 ImageList_DragShowNolock
0x47bd84 ImageList_DragMove
0x47bd88 ImageList_DragLeave
0x47bd8c ImageList_DragEnter
0x47bd90 ImageList_EndDrag
0x47bd94 ImageList_BeginDrag
0x47bd98 ImageList_Remove
0x47bd9c ImageList_DrawEx
0x47bda0 ImageList_Draw
0x47bda4 ImageList_GetBkColor
0x47bda8 ImageList_SetBkColor
0x47bdac ImageList_Add
0x47bdb0 ImageList_GetImageCount
0x47bdb4 ImageList_Destroy
0x47bdb8 ImageList_Create
0x47bdbc InitCommonControls
comdlg32.dll
0x47bdc4 GetSaveFileNameA
0x47bdc8 GetOpenFileNameA
advapi32
0x47bdd0 AuditFree
uRL
0x47bdd8 InetIsOffline
EAT(Export Address Table) is none
oleaut32.dll
0x47b7b8 SysFreeString
0x47b7bc SysReAllocStringLen
0x47b7c0 SysAllocStringLen
advapi32.dll
0x47b7c8 RegQueryValueExA
0x47b7cc RegOpenKeyExA
0x47b7d0 RegCloseKey
user32.dll
0x47b7d8 GetKeyboardType
0x47b7dc DestroyWindow
0x47b7e0 LoadStringA
0x47b7e4 MessageBoxA
0x47b7e8 CharNextA
kernel32.dll
0x47b7f0 GetACP
0x47b7f4 Sleep
0x47b7f8 VirtualFree
0x47b7fc VirtualAlloc
0x47b800 GetCurrentThreadId
0x47b804 InterlockedDecrement
0x47b808 InterlockedIncrement
0x47b80c VirtualQuery
0x47b810 WideCharToMultiByte
0x47b814 MultiByteToWideChar
0x47b818 lstrlenA
0x47b81c lstrcpynA
0x47b820 LoadLibraryExA
0x47b824 GetThreadLocale
0x47b828 GetStartupInfoA
0x47b82c GetProcAddress
0x47b830 GetModuleHandleA
0x47b834 GetModuleFileNameA
0x47b838 GetLocaleInfoA
0x47b83c GetCommandLineA
0x47b840 FreeLibrary
0x47b844 FindFirstFileA
0x47b848 FindClose
0x47b84c ExitProcess
0x47b850 CompareStringA
0x47b854 WriteFile
0x47b858 UnhandledExceptionFilter
0x47b85c RtlUnwind
0x47b860 RaiseException
0x47b864 GetStdHandle
kernel32.dll
0x47b86c TlsSetValue
0x47b870 TlsGetValue
0x47b874 LocalAlloc
0x47b878 GetModuleHandleA
user32.dll
0x47b880 CreateWindowExA
0x47b884 WindowFromPoint
0x47b888 WaitMessage
0x47b88c UpdateWindow
0x47b890 UnregisterClassA
0x47b894 UnhookWindowsHookEx
0x47b898 TranslateMessage
0x47b89c TranslateMDISysAccel
0x47b8a0 TrackPopupMenu
0x47b8a4 SystemParametersInfoA
0x47b8a8 ShowWindow
0x47b8ac ShowScrollBar
0x47b8b0 ShowOwnedPopups
0x47b8b4 SetWindowsHookExA
0x47b8b8 SetWindowPos
0x47b8bc SetWindowPlacement
0x47b8c0 SetWindowLongW
0x47b8c4 SetWindowLongA
0x47b8c8 SetTimer
0x47b8cc SetScrollRange
0x47b8d0 SetScrollPos
0x47b8d4 SetScrollInfo
0x47b8d8 SetRect
0x47b8dc SetPropA
0x47b8e0 SetParent
0x47b8e4 SetMenuItemInfoA
0x47b8e8 SetMenu
0x47b8ec SetForegroundWindow
0x47b8f0 SetFocus
0x47b8f4 SetCursor
0x47b8f8 SetClassLongA
0x47b8fc SetCapture
0x47b900 SetActiveWindow
0x47b904 SendMessageW
0x47b908 SendMessageA
0x47b90c ScrollWindow
0x47b910 ScreenToClient
0x47b914 RemovePropA
0x47b918 RemoveMenu
0x47b91c ReleaseDC
0x47b920 ReleaseCapture
0x47b924 RegisterWindowMessageA
0x47b928 RegisterClipboardFormatA
0x47b92c RegisterClassA
0x47b930 RedrawWindow
0x47b934 PtInRect
0x47b938 PostQuitMessage
0x47b93c PostMessageA
0x47b940 PeekMessageW
0x47b944 PeekMessageA
0x47b948 OffsetRect
0x47b94c OemToCharA
0x47b950 MessageBoxA
0x47b954 MapWindowPoints
0x47b958 MapVirtualKeyA
0x47b95c LockWindowUpdate
0x47b960 LoadStringA
0x47b964 LoadKeyboardLayoutA
0x47b968 LoadIconA
0x47b96c LoadCursorA
0x47b970 LoadBitmapA
0x47b974 KillTimer
0x47b978 IsZoomed
0x47b97c IsWindowVisible
0x47b980 IsWindowUnicode
0x47b984 IsWindowEnabled
0x47b988 IsWindow
0x47b98c IsRectEmpty
0x47b990 IsIconic
0x47b994 IsDialogMessageW
0x47b998 IsDialogMessageA
0x47b99c IsChild
0x47b9a0 InvalidateRect
0x47b9a4 IntersectRect
0x47b9a8 InsertMenuItemA
0x47b9ac InsertMenuA
0x47b9b0 InflateRect
0x47b9b4 GetWindowThreadProcessId
0x47b9b8 GetWindowTextA
0x47b9bc GetWindowRect
0x47b9c0 GetWindowPlacement
0x47b9c4 GetWindowLongW
0x47b9c8 GetWindowLongA
0x47b9cc GetWindowDC
0x47b9d0 GetTopWindow
0x47b9d4 GetSystemMetrics
0x47b9d8 GetSystemMenu
0x47b9dc GetSysColorBrush
0x47b9e0 GetSysColor
0x47b9e4 GetSubMenu
0x47b9e8 GetScrollRange
0x47b9ec GetScrollPos
0x47b9f0 GetScrollInfo
0x47b9f4 GetPropA
0x47b9f8 GetParent
0x47b9fc GetWindow
0x47ba00 GetMessagePos
0x47ba04 GetMenuStringA
0x47ba08 GetMenuState
0x47ba0c GetMenuItemInfoA
0x47ba10 GetMenuItemID
0x47ba14 GetMenuItemCount
0x47ba18 GetMenu
0x47ba1c GetLastActivePopup
0x47ba20 GetKeyboardState
0x47ba24 GetKeyboardLayoutNameA
0x47ba28 GetKeyboardLayoutList
0x47ba2c GetKeyboardLayout
0x47ba30 GetKeyState
0x47ba34 GetKeyNameTextA
0x47ba38 GetIconInfo
0x47ba3c GetForegroundWindow
0x47ba40 GetFocus
0x47ba44 GetDlgItem
0x47ba48 GetDesktopWindow
0x47ba4c GetDCEx
0x47ba50 GetDC
0x47ba54 GetCursorPos
0x47ba58 GetCursor
0x47ba5c GetClientRect
0x47ba60 GetClassLongA
0x47ba64 GetClassInfoA
0x47ba68 GetCapture
0x47ba6c GetActiveWindow
0x47ba70 FrameRect
0x47ba74 FindWindowA
0x47ba78 FillRect
0x47ba7c EqualRect
0x47ba80 EnumWindows
0x47ba84 EnumThreadWindows
0x47ba88 EnumChildWindows
0x47ba8c EndPaint
0x47ba90 EnableWindow
0x47ba94 EnableScrollBar
0x47ba98 EnableMenuItem
0x47ba9c DrawTextA
0x47baa0 DrawMenuBar
0x47baa4 DrawIconEx
0x47baa8 DrawIcon
0x47baac DrawFrameControl
0x47bab0 DrawEdge
0x47bab4 DispatchMessageW
0x47bab8 DispatchMessageA
0x47babc DestroyWindow
0x47bac0 DestroyMenu
0x47bac4 DestroyIcon
0x47bac8 DestroyCursor
0x47bacc DeleteMenu
0x47bad0 DefWindowProcA
0x47bad4 DefMDIChildProcA
0x47bad8 DefFrameProcA
0x47badc CreatePopupMenu
0x47bae0 CreateMenu
0x47bae4 CreateIcon
0x47bae8 ClientToScreen
0x47baec CheckMenuItem
0x47baf0 CallWindowProcA
0x47baf4 CallNextHookEx
0x47baf8 BeginPaint
0x47bafc CharNextA
0x47bb00 CharLowerA
0x47bb04 CharToOemA
0x47bb08 AdjustWindowRectEx
0x47bb0c ActivateKeyboardLayout
msimg32.dll
0x47bb14 GradientFill
gdi32.dll
0x47bb1c UnrealizeObject
0x47bb20 StretchBlt
0x47bb24 SetWindowOrgEx
0x47bb28 SetViewportOrgEx
0x47bb2c SetTextColor
0x47bb30 SetStretchBltMode
0x47bb34 SetROP2
0x47bb38 SetPixel
0x47bb3c SetDIBColorTable
0x47bb40 SetBrushOrgEx
0x47bb44 SetBkMode
0x47bb48 SetBkColor
0x47bb4c SelectPalette
0x47bb50 SelectObject
0x47bb54 SaveDC
0x47bb58 RestoreDC
0x47bb5c Rectangle
0x47bb60 RectVisible
0x47bb64 RealizePalette
0x47bb68 Polyline
0x47bb6c Polygon
0x47bb70 PatBlt
0x47bb74 MoveToEx
0x47bb78 MaskBlt
0x47bb7c LineTo
0x47bb80 IntersectClipRect
0x47bb84 GetWindowOrgEx
0x47bb88 GetTextMetricsA
0x47bb8c GetTextExtentPoint32A
0x47bb90 GetSystemPaletteEntries
0x47bb94 GetStockObject
0x47bb98 GetRgnBox
0x47bb9c GetPixel
0x47bba0 GetPaletteEntries
0x47bba4 GetObjectA
0x47bba8 GetDeviceCaps
0x47bbac GetDIBits
0x47bbb0 GetDIBColorTable
0x47bbb4 GetDCOrgEx
0x47bbb8 GetCurrentPositionEx
0x47bbbc GetClipBox
0x47bbc0 GetBrushOrgEx
0x47bbc4 GetBitmapBits
0x47bbc8 ExcludeClipRect
0x47bbcc DeleteObject
0x47bbd0 DeleteDC
0x47bbd4 CreateSolidBrush
0x47bbd8 CreateRectRgn
0x47bbdc CreatePenIndirect
0x47bbe0 CreatePalette
0x47bbe4 CreateHalftonePalette
0x47bbe8 CreateFontIndirectA
0x47bbec CreateDIBitmap
0x47bbf0 CreateDIBSection
0x47bbf4 CreateCompatibleDC
0x47bbf8 CreateCompatibleBitmap
0x47bbfc CreateBrushIndirect
0x47bc00 CreateBitmap
0x47bc04 CombineRgn
0x47bc08 BitBlt
version.dll
0x47bc10 VerQueryValueA
0x47bc14 GetFileVersionInfoSizeA
0x47bc18 GetFileVersionInfoA
kernel32.dll
0x47bc20 lstrcpyA
0x47bc24 WriteFile
0x47bc28 WaitForSingleObject
0x47bc2c VirtualQuery
0x47bc30 VirtualProtect
0x47bc34 VirtualAlloc
0x47bc38 SizeofResource
0x47bc3c SetThreadLocale
0x47bc40 SetFilePointer
0x47bc44 SetEvent
0x47bc48 SetErrorMode
0x47bc4c SetEndOfFile
0x47bc50 ResetEvent
0x47bc54 ReadFile
0x47bc58 MultiByteToWideChar
0x47bc5c MulDiv
0x47bc60 LockResource
0x47bc64 LoadResource
0x47bc68 LoadLibraryA
0x47bc6c LeaveCriticalSection
0x47bc70 InitializeCriticalSection
0x47bc74 GlobalFindAtomA
0x47bc78 GlobalDeleteAtom
0x47bc7c GlobalAddAtomA
0x47bc80 GetVersionExA
0x47bc84 GetVersion
0x47bc88 GetTickCount
0x47bc8c GetThreadLocale
0x47bc90 GetStdHandle
0x47bc94 GetProcAddress
0x47bc98 GetModuleHandleA
0x47bc9c GetModuleFileNameA
0x47bca0 GetLocaleInfoA
0x47bca4 GetLocalTime
0x47bca8 GetLastError
0x47bcac GetFullPathNameA
0x47bcb0 GetDiskFreeSpaceA
0x47bcb4 GetDateFormatA
0x47bcb8 GetCurrentThreadId
0x47bcbc GetCurrentProcessId
0x47bcc0 GetCPInfo
0x47bcc4 FreeResource
0x47bcc8 InterlockedExchange
0x47bccc FreeLibrary
0x47bcd0 FormatMessageA
0x47bcd4 FindResourceA
0x47bcd8 EnumCalendarInfoA
0x47bcdc EnterCriticalSection
0x47bce0 DeleteCriticalSection
0x47bce4 CreateThread
0x47bce8 CreateFileA
0x47bcec CreateEventA
0x47bcf0 CompareStringA
0x47bcf4 CloseHandle
advapi32.dll
0x47bcfc RegQueryValueExA
0x47bd00 RegOpenKeyExA
0x47bd04 RegFlushKey
0x47bd08 RegCloseKey
oleaut32.dll
0x47bd10 CreateErrorInfo
0x47bd14 GetErrorInfo
0x47bd18 SetErrorInfo
0x47bd1c SysFreeString
ole32.dll
0x47bd24 OleUninitialize
0x47bd28 OleInitialize
0x47bd2c CoCreateInstance
0x47bd30 CoUninitialize
0x47bd34 CoInitialize
kernel32.dll
0x47bd3c Sleep
oleaut32.dll
0x47bd44 SafeArrayPtrOfIndex
0x47bd48 SafeArrayGetUBound
0x47bd4c SafeArrayGetLBound
0x47bd50 SafeArrayCreate
0x47bd54 VariantChangeType
0x47bd58 VariantCopy
0x47bd5c VariantClear
0x47bd60 VariantInit
comctl32.dll
0x47bd68 _TrackMouseEvent
0x47bd6c ImageList_SetIconSize
0x47bd70 ImageList_GetIconSize
0x47bd74 ImageList_Write
0x47bd78 ImageList_Read
0x47bd7c ImageList_GetDragImage
0x47bd80 ImageList_DragShowNolock
0x47bd84 ImageList_DragMove
0x47bd88 ImageList_DragLeave
0x47bd8c ImageList_DragEnter
0x47bd90 ImageList_EndDrag
0x47bd94 ImageList_BeginDrag
0x47bd98 ImageList_Remove
0x47bd9c ImageList_DrawEx
0x47bda0 ImageList_Draw
0x47bda4 ImageList_GetBkColor
0x47bda8 ImageList_SetBkColor
0x47bdac ImageList_Add
0x47bdb0 ImageList_GetImageCount
0x47bdb4 ImageList_Destroy
0x47bdb8 ImageList_Create
0x47bdbc InitCommonControls
comdlg32.dll
0x47bdc4 GetSaveFileNameA
0x47bdc8 GetOpenFileNameA
advapi32
0x47bdd0 AuditFree
uRL
0x47bdd8 InetIsOffline
EAT(Export Address Table) is none