ScreenShot
| Created | 2023.07.10 07:50 | Machine | s1_win7_x6403 |
| Filename | RiotGames.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 58 detected (AIDetectMalware, Malicious, score, Remcos, Save, confidence, 100%, Kryptik, GenusT, DMHR, Rescoms, Eldorado, Attribute, HighConfidence, Windows, jwpryz, RATX, Gencirc, Inject4, R002C0DF323, Emogen, Detected, FDQO, ai score=83, unsafe, GdSda, CLASSIC, Invader, ZCRgWkv1kYo, Static AI, Malicious PE, susgen, ZexaF, ECW@aWvn7woi) | ||
| md5 | 5379d703170770355efdbce86dcdb1d3 | ||
| sha256 | 9d8282d54901d4e795f0469a5191242b2e7b3b0c51f810f71c739bfff52de8d5 | ||
| ssdeep | 12288:VRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2lDU:Vx7cyF2eSsewS8W47eZO | ||
| imphash | 04d77d421b8e5297898a3fce39d74267 | ||
| impfuzzy | 96:mKSzrmX+LHcp+1OMEZiSLRwfGLLuZ5PyKNUz7KgKd3YdP5uPosV:rtdZzLRVy5YPiZw5ubV | ||
Network IP location
Signature (21cnts)
| Level | Description |
|---|---|
| danger | File has been identified by 58 AntiVirus engines on VirusTotal as malicious |
| danger | Executed a process and injected code into it |
| warning | Disables Windows Security features |
| watch | Communicates with host for which no DNS query was performed |
| watch | Creates a windows hook that monitors keyboard input (keylogger) |
| watch | Installs itself for autorun at Windows startup |
| watch | Potential code injection by writing to the memory of another process |
| watch | Resumed a suspended thread in a remote process potentially indicative of process injection |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | A process attempted to delay the analysis task. |
| notice | A process created a hidden window |
| notice | Creates a suspicious process |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | One or more potentially interesting buffers were extracted |
| notice | Performs some HTTP requests |
| notice | Terminates another process |
| notice | Uses Windows utilities for basic Windows functionality |
| notice | Yara rule detected in process memory |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
Rules (32cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| danger | Client_SW_User_Data_Stealer | Client_SW_User_Data_Stealer | memory |
| danger | infoStealer_browser_b_Zero | browser info stealer | binaries (upload) |
| danger | Win_Backdoor_RemcosRAT | Win Backdoor RemcosRAT | memory |
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| warning | infoStealer_browser_Zero | browser info stealer | memory |
| watch | Chrome_User_Data_Check_Zero | Google Chrome User Data Check | memory |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | Network_Downloader | File Downloader | binaries (upload) |
| watch | Network_Downloader | File Downloader | memory |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| notice | Create_Service | Create a windows service | memory |
| notice | Escalate_priviledges | Escalate priviledges | memory |
| notice | Generic_PWS_Memory_Zero | PWS Memory | memory |
| notice | KeyLogger | Run a KeyLogger | memory |
| notice | Network_DNS | Communications use DNS | memory |
| notice | Network_TCP_Socket | Communications over RAW Socket | memory |
| notice | ScreenShot | Take ScreenShot | memory |
| notice | Sniff_Audio | Record Audio | memory |
| notice | Str_Win32_Internet_API | Match Windows Inet API call | memory |
| info | anti_dbg | Checks if being debugged | memory |
| info | DebuggerCheck__GlobalFlags | (no description) | memory |
| info | DebuggerCheck__QueryInfo | (no description) | memory |
| info | DebuggerHiding__Active | (no description) | memory |
| info | DebuggerHiding__Thread | (no description) | memory |
| info | disable_dep | Bypass DEP | memory |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
| info | SEH__vectored | (no description) | memory |
| info | ThreadControl__Context | (no description) | memory |
| info | win_hook | Affect hook table | memory |
Suricata ids
ET JA3 Hash - Remcos 3.x TLS Connection
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x4580b4 FindNextFileA
0x4580b8 ExpandEnvironmentStringsA
0x4580bc GetLongPathNameW
0x4580c0 CopyFileW
0x4580c4 GetLocaleInfoA
0x4580c8 CreateToolhelp32Snapshot
0x4580cc Process32NextW
0x4580d0 Process32FirstW
0x4580d4 VirtualProtect
0x4580d8 SetLastError
0x4580dc VirtualFree
0x4580e0 VirtualAlloc
0x4580e4 GetNativeSystemInfo
0x4580e8 HeapAlloc
0x4580ec GetProcessHeap
0x4580f0 FreeLibrary
0x4580f4 IsBadReadPtr
0x4580f8 GetTempPathW
0x4580fc OpenProcess
0x458100 OpenMutexA
0x458104 lstrcatW
0x458108 GetCurrentProcessId
0x45810c GetTempFileNameW
0x458110 GetSystemDirectoryA
0x458114 GlobalAlloc
0x458118 GlobalLock
0x45811c GetTickCount
0x458120 GlobalUnlock
0x458124 WriteProcessMemory
0x458128 ResumeThread
0x45812c GetThreadContext
0x458130 ReadProcessMemory
0x458134 CreateProcessW
0x458138 SetThreadContext
0x45813c LocalAlloc
0x458140 GlobalFree
0x458144 MulDiv
0x458148 SizeofResource
0x45814c QueryDosDeviceW
0x458150 FindFirstVolumeW
0x458154 GetConsoleScreenBufferInfo
0x458158 SetConsoleTextAttribute
0x45815c lstrlenW
0x458160 GetStdHandle
0x458164 SetFilePointer
0x458168 FindResourceA
0x45816c LockResource
0x458170 LoadResource
0x458174 LocalFree
0x458178 FindVolumeClose
0x45817c GetVolumePathNamesForVolumeNameW
0x458180 lstrcpyW
0x458184 SetConsoleOutputCP
0x458188 FindFirstFileA
0x45818c FindNextVolumeW
0x458190 AllocConsole
0x458194 lstrcmpW
0x458198 GetModuleFileNameA
0x45819c lstrcpynA
0x4581a0 QueryPerformanceFrequency
0x4581a4 QueryPerformanceCounter
0x4581a8 EnterCriticalSection
0x4581ac LeaveCriticalSection
0x4581b0 InitializeCriticalSection
0x4581b4 DeleteCriticalSection
0x4581b8 HeapSize
0x4581bc WriteConsoleW
0x4581c0 SetStdHandle
0x4581c4 SetEnvironmentVariableW
0x4581c8 SetEnvironmentVariableA
0x4581cc FreeEnvironmentStringsW
0x4581d0 GetEnvironmentStringsW
0x4581d4 GetCommandLineW
0x4581d8 GetCommandLineA
0x4581dc GetOEMCP
0x4581e0 IsValidCodePage
0x4581e4 FindFirstFileExA
0x4581e8 ReadConsoleW
0x4581ec GetConsoleMode
0x4581f0 GetConsoleCP
0x4581f4 FlushFileBuffers
0x4581f8 GetFileType
0x4581fc GetTimeZoneInformation
0x458200 EnumSystemLocalesW
0x458204 GetUserDefaultLCID
0x458208 IsValidLocale
0x45820c GetTimeFormatW
0x458210 GetDateFormatW
0x458214 HeapReAlloc
0x458218 GetACP
0x45821c GetModuleHandleExW
0x458220 MoveFileExW
0x458224 RtlUnwind
0x458228 RaiseException
0x45822c LoadLibraryExW
0x458230 GetCPInfo
0x458234 GetStringTypeW
0x458238 GetLocaleInfoW
0x45823c LCMapStringW
0x458240 CompareStringW
0x458244 TlsFree
0x458248 TlsSetValue
0x45824c TlsGetValue
0x458250 GetFileSize
0x458254 TerminateThread
0x458258 GetLastError
0x45825c GetModuleHandleA
0x458260 RemoveDirectoryW
0x458264 CreateDirectoryW
0x458268 MoveFileW
0x45826c SetFilePointerEx
0x458270 GetLogicalDriveStringsA
0x458274 DeleteFileW
0x458278 DeleteFileA
0x45827c SetFileAttributesW
0x458280 GetFileAttributesW
0x458284 FindClose
0x458288 lstrlenA
0x45828c GetDriveTypeA
0x458290 FindNextFileW
0x458294 GetFileSizeEx
0x458298 FindFirstFileW
0x45829c GetModuleHandleW
0x4582a0 ExitProcess
0x4582a4 CreateMutexA
0x4582a8 GetCurrentProcess
0x4582ac GetProcAddress
0x4582b0 LoadLibraryA
0x4582b4 CreateProcessA
0x4582b8 PeekNamedPipe
0x4582bc CreatePipe
0x4582c0 TerminateProcess
0x4582c4 ReadFile
0x4582c8 HeapFree
0x4582cc HeapCreate
0x4582d0 CreateEventA
0x4582d4 GetLocalTime
0x4582d8 CreateThread
0x4582dc SetEvent
0x4582e0 CreateEventW
0x4582e4 WaitForSingleObject
0x4582e8 Sleep
0x4582ec GetModuleFileNameW
0x4582f0 CloseHandle
0x4582f4 ExitThread
0x4582f8 CreateFileW
0x4582fc WriteFile
0x458300 FormatMessageA
0x458304 TlsAlloc
0x458308 InitializeCriticalSectionAndSpinCount
0x45830c MultiByteToWideChar
0x458310 DecodePointer
0x458314 EncodePointer
0x458318 WideCharToMultiByte
0x45831c InitializeSListHead
0x458320 GetSystemTimeAsFileTime
0x458324 GetCurrentThreadId
0x458328 IsProcessorFeaturePresent
0x45832c GetStartupInfoW
0x458330 SetUnhandledExceptionFilter
0x458334 UnhandledExceptionFilter
0x458338 IsDebuggerPresent
0x45833c WaitForSingleObjectEx
0x458340 ResetEvent
0x458344 SetEndOfFile
USER32.dll
0x458370 GetWindowTextW
0x458374 wsprintfW
0x458378 GetClipboardData
0x45837c UnhookWindowsHookEx
0x458380 GetForegroundWindow
0x458384 ToUnicodeEx
0x458388 GetKeyboardLayout
0x45838c SetWindowsHookExA
0x458390 CloseClipboard
0x458394 OpenClipboard
0x458398 GetKeyboardState
0x45839c CallNextHookEx
0x4583a0 GetKeyboardLayoutNameA
0x4583a4 GetKeyState
0x4583a8 GetWindowTextLengthW
0x4583ac GetWindowThreadProcessId
0x4583b0 GetMessageA
0x4583b4 SetClipboardData
0x4583b8 EnumWindows
0x4583bc ExitWindowsEx
0x4583c0 EmptyClipboard
0x4583c4 ShowWindow
0x4583c8 SetWindowTextW
0x4583cc MessageBoxW
0x4583d0 IsWindowVisible
0x4583d4 CloseWindow
0x4583d8 SendInput
0x4583dc EnumDisplaySettingsW
0x4583e0 mouse_event
0x4583e4 CreatePopupMenu
0x4583e8 DispatchMessageA
0x4583ec TranslateMessage
0x4583f0 TrackPopupMenu
0x4583f4 DefWindowProcA
0x4583f8 CreateWindowExA
0x4583fc GetIconInfo
0x458400 GetSystemMetrics
0x458404 AppendMenuA
0x458408 RegisterClassExA
0x45840c GetCursorPos
0x458410 SetForegroundWindow
0x458414 DrawIcon
0x458418 SystemParametersInfoW
GDI32.dll
0x458088 BitBlt
0x45808c CreateCompatibleBitmap
0x458090 SelectObject
0x458094 CreateCompatibleDC
0x458098 GetDIBits
0x45809c DeleteDC
0x4580a0 DeleteObject
0x4580a4 CreateDCA
0x4580a8 GetObjectA
0x4580ac StretchBlt
ADVAPI32.dll
0x458000 CryptAcquireContextA
0x458004 CryptGenRandom
0x458008 CryptReleaseContext
0x45800c GetUserNameW
0x458010 RegEnumKeyExA
0x458014 QueryServiceStatus
0x458018 CloseServiceHandle
0x45801c OpenSCManagerW
0x458020 OpenSCManagerA
0x458024 ControlService
0x458028 StartServiceW
0x45802c QueryServiceConfigW
0x458030 ChangeServiceConfigW
0x458034 OpenServiceW
0x458038 EnumServicesStatusW
0x45803c AdjustTokenPrivileges
0x458040 LookupPrivilegeValueA
0x458044 OpenProcessToken
0x458048 RegCreateKeyA
0x45804c RegCloseKey
0x458050 RegQueryInfoKeyW
0x458054 RegQueryValueExA
0x458058 RegCreateKeyExW
0x45805c RegEnumKeyExW
0x458060 RegSetValueExW
0x458064 RegSetValueExA
0x458068 RegOpenKeyExA
0x45806c RegOpenKeyExW
0x458070 RegCreateKeyW
0x458074 RegDeleteValueW
0x458078 RegEnumValueW
0x45807c RegQueryValueExW
0x458080 RegDeleteKeyA
SHELL32.dll
0x45834c ShellExecuteExA
0x458350 Shell_NotifyIconA
0x458354 ExtractIconA
0x458358 ShellExecuteW
ole32.dll
0x4584d0 CoInitializeEx
0x4584d4 CoUninitialize
0x4584d8 CoGetObject
SHLWAPI.dll
0x458360 PathFileExistsW
0x458364 PathFileExistsA
0x458368 StrToIntA
WINMM.dll
0x458434 waveInUnprepareHeader
0x458438 waveInOpen
0x45843c waveInStart
0x458440 waveInAddBuffer
0x458444 PlaySoundW
0x458448 mciSendStringA
0x45844c mciSendStringW
0x458450 waveInClose
0x458454 waveInStop
0x458458 waveInPrepareHeader
WS2_32.dll
0x458460 gethostbyname
0x458464 send
0x458468 WSAStartup
0x45846c closesocket
0x458470 inet_ntoa
0x458474 htons
0x458478 htonl
0x45847c getservbyname
0x458480 ntohs
0x458484 getservbyport
0x458488 gethostbyaddr
0x45848c inet_addr
0x458490 WSASetLastError
0x458494 WSAGetLastError
0x458498 recv
0x45849c connect
0x4584a0 socket
urlmon.dll
0x4584e0 URLOpenBlockingStreamW
0x4584e4 URLDownloadToFileW
gdiplus.dll
0x4584a8 GdipSaveImageToStream
0x4584ac GdipGetImageEncodersSize
0x4584b0 GdipFree
0x4584b4 GdipDisposeImage
0x4584b8 GdipAlloc
0x4584bc GdipCloneImage
0x4584c0 GdipGetImageEncoders
0x4584c4 GdiplusStartup
0x4584c8 GdipLoadImageFromStream
WININET.dll
0x458420 InternetOpenUrlW
0x458424 InternetOpenW
0x458428 InternetCloseHandle
0x45842c InternetReadFile
EAT(Export Address Table) is none
KERNEL32.dll
0x4580b4 FindNextFileA
0x4580b8 ExpandEnvironmentStringsA
0x4580bc GetLongPathNameW
0x4580c0 CopyFileW
0x4580c4 GetLocaleInfoA
0x4580c8 CreateToolhelp32Snapshot
0x4580cc Process32NextW
0x4580d0 Process32FirstW
0x4580d4 VirtualProtect
0x4580d8 SetLastError
0x4580dc VirtualFree
0x4580e0 VirtualAlloc
0x4580e4 GetNativeSystemInfo
0x4580e8 HeapAlloc
0x4580ec GetProcessHeap
0x4580f0 FreeLibrary
0x4580f4 IsBadReadPtr
0x4580f8 GetTempPathW
0x4580fc OpenProcess
0x458100 OpenMutexA
0x458104 lstrcatW
0x458108 GetCurrentProcessId
0x45810c GetTempFileNameW
0x458110 GetSystemDirectoryA
0x458114 GlobalAlloc
0x458118 GlobalLock
0x45811c GetTickCount
0x458120 GlobalUnlock
0x458124 WriteProcessMemory
0x458128 ResumeThread
0x45812c GetThreadContext
0x458130 ReadProcessMemory
0x458134 CreateProcessW
0x458138 SetThreadContext
0x45813c LocalAlloc
0x458140 GlobalFree
0x458144 MulDiv
0x458148 SizeofResource
0x45814c QueryDosDeviceW
0x458150 FindFirstVolumeW
0x458154 GetConsoleScreenBufferInfo
0x458158 SetConsoleTextAttribute
0x45815c lstrlenW
0x458160 GetStdHandle
0x458164 SetFilePointer
0x458168 FindResourceA
0x45816c LockResource
0x458170 LoadResource
0x458174 LocalFree
0x458178 FindVolumeClose
0x45817c GetVolumePathNamesForVolumeNameW
0x458180 lstrcpyW
0x458184 SetConsoleOutputCP
0x458188 FindFirstFileA
0x45818c FindNextVolumeW
0x458190 AllocConsole
0x458194 lstrcmpW
0x458198 GetModuleFileNameA
0x45819c lstrcpynA
0x4581a0 QueryPerformanceFrequency
0x4581a4 QueryPerformanceCounter
0x4581a8 EnterCriticalSection
0x4581ac LeaveCriticalSection
0x4581b0 InitializeCriticalSection
0x4581b4 DeleteCriticalSection
0x4581b8 HeapSize
0x4581bc WriteConsoleW
0x4581c0 SetStdHandle
0x4581c4 SetEnvironmentVariableW
0x4581c8 SetEnvironmentVariableA
0x4581cc FreeEnvironmentStringsW
0x4581d0 GetEnvironmentStringsW
0x4581d4 GetCommandLineW
0x4581d8 GetCommandLineA
0x4581dc GetOEMCP
0x4581e0 IsValidCodePage
0x4581e4 FindFirstFileExA
0x4581e8 ReadConsoleW
0x4581ec GetConsoleMode
0x4581f0 GetConsoleCP
0x4581f4 FlushFileBuffers
0x4581f8 GetFileType
0x4581fc GetTimeZoneInformation
0x458200 EnumSystemLocalesW
0x458204 GetUserDefaultLCID
0x458208 IsValidLocale
0x45820c GetTimeFormatW
0x458210 GetDateFormatW
0x458214 HeapReAlloc
0x458218 GetACP
0x45821c GetModuleHandleExW
0x458220 MoveFileExW
0x458224 RtlUnwind
0x458228 RaiseException
0x45822c LoadLibraryExW
0x458230 GetCPInfo
0x458234 GetStringTypeW
0x458238 GetLocaleInfoW
0x45823c LCMapStringW
0x458240 CompareStringW
0x458244 TlsFree
0x458248 TlsSetValue
0x45824c TlsGetValue
0x458250 GetFileSize
0x458254 TerminateThread
0x458258 GetLastError
0x45825c GetModuleHandleA
0x458260 RemoveDirectoryW
0x458264 CreateDirectoryW
0x458268 MoveFileW
0x45826c SetFilePointerEx
0x458270 GetLogicalDriveStringsA
0x458274 DeleteFileW
0x458278 DeleteFileA
0x45827c SetFileAttributesW
0x458280 GetFileAttributesW
0x458284 FindClose
0x458288 lstrlenA
0x45828c GetDriveTypeA
0x458290 FindNextFileW
0x458294 GetFileSizeEx
0x458298 FindFirstFileW
0x45829c GetModuleHandleW
0x4582a0 ExitProcess
0x4582a4 CreateMutexA
0x4582a8 GetCurrentProcess
0x4582ac GetProcAddress
0x4582b0 LoadLibraryA
0x4582b4 CreateProcessA
0x4582b8 PeekNamedPipe
0x4582bc CreatePipe
0x4582c0 TerminateProcess
0x4582c4 ReadFile
0x4582c8 HeapFree
0x4582cc HeapCreate
0x4582d0 CreateEventA
0x4582d4 GetLocalTime
0x4582d8 CreateThread
0x4582dc SetEvent
0x4582e0 CreateEventW
0x4582e4 WaitForSingleObject
0x4582e8 Sleep
0x4582ec GetModuleFileNameW
0x4582f0 CloseHandle
0x4582f4 ExitThread
0x4582f8 CreateFileW
0x4582fc WriteFile
0x458300 FormatMessageA
0x458304 TlsAlloc
0x458308 InitializeCriticalSectionAndSpinCount
0x45830c MultiByteToWideChar
0x458310 DecodePointer
0x458314 EncodePointer
0x458318 WideCharToMultiByte
0x45831c InitializeSListHead
0x458320 GetSystemTimeAsFileTime
0x458324 GetCurrentThreadId
0x458328 IsProcessorFeaturePresent
0x45832c GetStartupInfoW
0x458330 SetUnhandledExceptionFilter
0x458334 UnhandledExceptionFilter
0x458338 IsDebuggerPresent
0x45833c WaitForSingleObjectEx
0x458340 ResetEvent
0x458344 SetEndOfFile
USER32.dll
0x458370 GetWindowTextW
0x458374 wsprintfW
0x458378 GetClipboardData
0x45837c UnhookWindowsHookEx
0x458380 GetForegroundWindow
0x458384 ToUnicodeEx
0x458388 GetKeyboardLayout
0x45838c SetWindowsHookExA
0x458390 CloseClipboard
0x458394 OpenClipboard
0x458398 GetKeyboardState
0x45839c CallNextHookEx
0x4583a0 GetKeyboardLayoutNameA
0x4583a4 GetKeyState
0x4583a8 GetWindowTextLengthW
0x4583ac GetWindowThreadProcessId
0x4583b0 GetMessageA
0x4583b4 SetClipboardData
0x4583b8 EnumWindows
0x4583bc ExitWindowsEx
0x4583c0 EmptyClipboard
0x4583c4 ShowWindow
0x4583c8 SetWindowTextW
0x4583cc MessageBoxW
0x4583d0 IsWindowVisible
0x4583d4 CloseWindow
0x4583d8 SendInput
0x4583dc EnumDisplaySettingsW
0x4583e0 mouse_event
0x4583e4 CreatePopupMenu
0x4583e8 DispatchMessageA
0x4583ec TranslateMessage
0x4583f0 TrackPopupMenu
0x4583f4 DefWindowProcA
0x4583f8 CreateWindowExA
0x4583fc GetIconInfo
0x458400 GetSystemMetrics
0x458404 AppendMenuA
0x458408 RegisterClassExA
0x45840c GetCursorPos
0x458410 SetForegroundWindow
0x458414 DrawIcon
0x458418 SystemParametersInfoW
GDI32.dll
0x458088 BitBlt
0x45808c CreateCompatibleBitmap
0x458090 SelectObject
0x458094 CreateCompatibleDC
0x458098 GetDIBits
0x45809c DeleteDC
0x4580a0 DeleteObject
0x4580a4 CreateDCA
0x4580a8 GetObjectA
0x4580ac StretchBlt
ADVAPI32.dll
0x458000 CryptAcquireContextA
0x458004 CryptGenRandom
0x458008 CryptReleaseContext
0x45800c GetUserNameW
0x458010 RegEnumKeyExA
0x458014 QueryServiceStatus
0x458018 CloseServiceHandle
0x45801c OpenSCManagerW
0x458020 OpenSCManagerA
0x458024 ControlService
0x458028 StartServiceW
0x45802c QueryServiceConfigW
0x458030 ChangeServiceConfigW
0x458034 OpenServiceW
0x458038 EnumServicesStatusW
0x45803c AdjustTokenPrivileges
0x458040 LookupPrivilegeValueA
0x458044 OpenProcessToken
0x458048 RegCreateKeyA
0x45804c RegCloseKey
0x458050 RegQueryInfoKeyW
0x458054 RegQueryValueExA
0x458058 RegCreateKeyExW
0x45805c RegEnumKeyExW
0x458060 RegSetValueExW
0x458064 RegSetValueExA
0x458068 RegOpenKeyExA
0x45806c RegOpenKeyExW
0x458070 RegCreateKeyW
0x458074 RegDeleteValueW
0x458078 RegEnumValueW
0x45807c RegQueryValueExW
0x458080 RegDeleteKeyA
SHELL32.dll
0x45834c ShellExecuteExA
0x458350 Shell_NotifyIconA
0x458354 ExtractIconA
0x458358 ShellExecuteW
ole32.dll
0x4584d0 CoInitializeEx
0x4584d4 CoUninitialize
0x4584d8 CoGetObject
SHLWAPI.dll
0x458360 PathFileExistsW
0x458364 PathFileExistsA
0x458368 StrToIntA
WINMM.dll
0x458434 waveInUnprepareHeader
0x458438 waveInOpen
0x45843c waveInStart
0x458440 waveInAddBuffer
0x458444 PlaySoundW
0x458448 mciSendStringA
0x45844c mciSendStringW
0x458450 waveInClose
0x458454 waveInStop
0x458458 waveInPrepareHeader
WS2_32.dll
0x458460 gethostbyname
0x458464 send
0x458468 WSAStartup
0x45846c closesocket
0x458470 inet_ntoa
0x458474 htons
0x458478 htonl
0x45847c getservbyname
0x458480 ntohs
0x458484 getservbyport
0x458488 gethostbyaddr
0x45848c inet_addr
0x458490 WSASetLastError
0x458494 WSAGetLastError
0x458498 recv
0x45849c connect
0x4584a0 socket
urlmon.dll
0x4584e0 URLOpenBlockingStreamW
0x4584e4 URLDownloadToFileW
gdiplus.dll
0x4584a8 GdipSaveImageToStream
0x4584ac GdipGetImageEncodersSize
0x4584b0 GdipFree
0x4584b4 GdipDisposeImage
0x4584b8 GdipAlloc
0x4584bc GdipCloneImage
0x4584c0 GdipGetImageEncoders
0x4584c4 GdiplusStartup
0x4584c8 GdipLoadImageFromStream
WININET.dll
0x458420 InternetOpenUrlW
0x458424 InternetOpenW
0x458428 InternetCloseHandle
0x45842c InternetReadFile
EAT(Export Address Table) is none