ScreenShot
| Created | 2024.11.19 14:44 | Machine | s1_win7_x6403 |
| Filename | gambinho.exe | ||
| Type | PE32 executable (GUI) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 25 detected (AIDetectMalware, TrojanPWS, AutoIt, Zbot, TrojanAitInject, Unsafe, malicious, confidence, high confidence, FileRepMalware, Detected, AutoitInject, Eldorado, Artemis, MachineLearning, Anomalous, susgen) | ||
| md5 | 60c2b16e2f32c9fa9161505329c30b3f | ||
| sha256 | bf2c22ab49aa5ca1e9fbd848beeedebead9fc49dc11ddda466c7f2423bfee031 | ||
| ssdeep | 24576:dtb20pkaCqT5TBWgNQ7aeoWAbbEJAjN6A:OVg5tQ7aeHHJAB5 | ||
| imphash | 3d95adbf13bbe79dc24dccb401c12091 | ||
| impfuzzy | 192:ut3GC4Xx6I3OCg8VQZhfi8UIRu2VnwVhMycOYRD:s3GZXx6IlgPh6qxnwXrcOYRD | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| warning | File has been identified by 25 AntiVirus engines on VirusTotal as malicious |
| watch | Harvests credentials from local email clients |
| watch | Harvests credentials from local FTP client softwares |
| watch | Used NtSetContextThread to modify a thread in a remote process indicative of process injection |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Steals private information from local Internet browsers |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | Queries for the computername |
Rules (6cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
WSOCK32.dll
0x48d7b0 __WSAFDIsSet
0x48d7b4 recv
0x48d7b8 send
0x48d7bc setsockopt
0x48d7c0 ntohs
0x48d7c4 recvfrom
0x48d7c8 select
0x48d7cc WSAStartup
0x48d7d0 htons
0x48d7d4 accept
0x48d7d8 listen
0x48d7dc ind
0x48d7e0 closesocket
0x48d7e4 connect
0x48d7e8 WSACleanup
0x48d7ec ioctlsocket
0x48d7f0 sendto
0x48d7f4 WSAGetLastError
0x48d7f8 inet_addr
0x48d7fc gethostbyname
0x48d800 gethostname
0x48d804 socket
VERSION.dll
0x48d754 GetFileVersionInfoW
0x48d758 VerQueryValueW
0x48d75c GetFileVersionInfoSizeW
WINMM.dll
0x48d7a0 timeGetTime
0x48d7a4 waveOutSetVolume
0x48d7a8 mciSendStringW
COMCTL32.dll
0x48d088 ImageList_Destroy
0x48d08c ImageList_Remove
0x48d090 ImageList_SetDragCursorImage
0x48d094 ImageList_BeginDrag
0x48d098 ImageList_DragEnter
0x48d09c ImageList_DragLeave
0x48d0a0 ImageList_EndDrag
0x48d0a4 ImageList_DragMove
0x48d0a8 ImageList_Create
0x48d0ac InitCommonControlsEx
0x48d0b0 ImageList_ReplaceIcon
MPR.dll
0x48d3e8 WNetUseConnectionW
0x48d3ec WNetCancelConnection2W
0x48d3f0 WNetGetConnectionW
0x48d3f4 WNetAddConnection2W
WININET.dll
0x48d764 InternetReadFile
0x48d768 InternetCloseHandle
0x48d76c InternetOpenW
0x48d770 InternetSetOptionW
0x48d774 InternetCrackUrlW
0x48d778 HttpQueryInfoW
0x48d77c InternetQueryOptionW
0x48d780 HttpOpenRequestW
0x48d784 HttpSendRequestW
0x48d788 FtpOpenFileW
0x48d78c FtpGetFileSize
0x48d790 InternetOpenUrlW
0x48d794 InternetConnectW
0x48d798 InternetQueryDataAvailable
PSAPI.DLL
0x48d46c GetProcessMemoryInfo
IPHLPAPI.DLL
0x48d154 IcmpCreateFile
0x48d158 IcmpCloseHandle
0x48d15c IcmpSendEcho
USERENV.dll
0x48d738 UnloadUserProfile
0x48d73c DestroyEnvironmentBlock
0x48d740 CreateEnvironmentBlock
0x48d744 LoadUserProfileW
UxTheme.dll
0x48d74c IsThemeActive
KERNEL32.dll
0x48d164 HeapAlloc
0x48d168 GetProcessHeap
0x48d16c HeapFree
0x48d170 Sleep
0x48d174 GetCurrentThreadId
0x48d178 MultiByteToWideChar
0x48d17c MulDiv
0x48d180 GetVersionExW
0x48d184 GetSystemInfo
0x48d188 FreeLibrary
0x48d18c LoadLibraryA
0x48d190 GetProcAddress
0x48d194 SetErrorMode
0x48d198 GetModuleFileNameW
0x48d19c WideCharToMultiByte
0x48d1a0 lstrcpyW
0x48d1a4 lstrlenW
0x48d1a8 GetModuleHandleW
0x48d1ac QueryPerformanceCounter
0x48d1b0 VirtualFreeEx
0x48d1b4 OpenProcess
0x48d1b8 VirtualAllocEx
0x48d1bc WriteProcessMemory
0x48d1c0 ReadProcessMemory
0x48d1c4 CreateFileW
0x48d1c8 SetFilePointerEx
0x48d1cc ReadFile
0x48d1d0 WriteFile
0x48d1d4 FlushFileBuffers
0x48d1d8 TerminateProcess
0x48d1dc CreateToolhelp32Snapshot
0x48d1e0 Process32FirstW
0x48d1e4 Process32NextW
0x48d1e8 SetFileTime
0x48d1ec GetFileAttributesW
0x48d1f0 FindFirstFileW
0x48d1f4 FindClose
0x48d1f8 GetLongPathNameW
0x48d1fc GetCurrentThread
0x48d200 FindNextFileW
0x48d204 MoveFileW
0x48d208 CopyFileW
0x48d20c CreateDirectoryW
0x48d210 RemoveDirectoryW
0x48d214 SetSystemPowerState
0x48d218 QueryPerformanceFrequency
0x48d21c FindResourceW
0x48d220 LoadResource
0x48d224 LockResource
0x48d228 SizeofResource
0x48d22c EnumResourceNamesW
0x48d230 OutputDebugStringW
0x48d234 GetTempPathW
0x48d238 GetTempFileNameW
0x48d23c DeviceIoControl
0x48d240 GetLocalTime
0x48d244 CompareStringW
0x48d248 DeleteCriticalSection
0x48d24c WaitForSingleObject
0x48d250 LeaveCriticalSection
0x48d254 GetStdHandle
0x48d258 CreatePipe
0x48d25c InterlockedExchange
0x48d260 TerminateThread
0x48d264 LoadLibraryExW
0x48d268 FindResourceExW
0x48d26c VirtualFree
0x48d270 FormatMessageW
0x48d274 GetExitCodeProcess
0x48d278 GetPrivateProfileStringW
0x48d27c WritePrivateProfileStringW
0x48d280 GetPrivateProfileSectionW
0x48d284 WritePrivateProfileSectionW
0x48d288 GetPrivateProfileSectionNamesW
0x48d28c FileTimeToLocalFileTime
0x48d290 FileTimeToSystemTime
0x48d294 SystemTimeToFileTime
0x48d298 LocalFileTimeToFileTime
0x48d29c GetDriveTypeW
0x48d2a0 GetDiskFreeSpaceExW
0x48d2a4 GetDiskFreeSpaceW
0x48d2a8 GetVolumeInformationW
0x48d2ac SetVolumeLabelW
0x48d2b0 CreateHardLinkW
0x48d2b4 SetFileAttributesW
0x48d2b8 GetShortPathNameW
0x48d2bc CreateEventW
0x48d2c0 SetEvent
0x48d2c4 GetEnvironmentVariableW
0x48d2c8 SetEnvironmentVariableW
0x48d2cc GlobalLock
0x48d2d0 GlobalUnlock
0x48d2d4 GlobalAlloc
0x48d2d8 GetFileSize
0x48d2dc GlobalFree
0x48d2e0 GlobalMemoryStatusEx
0x48d2e4 Beep
0x48d2e8 GetSystemDirectoryW
0x48d2ec GetComputerNameW
0x48d2f0 GetWindowsDirectoryW
0x48d2f4 GetCurrentProcessId
0x48d2f8 GetProcessIoCounters
0x48d2fc CreateProcessW
0x48d300 SetPriorityClass
0x48d304 LoadLibraryW
0x48d308 VirtualAlloc
0x48d30c CloseHandle
0x48d310 GetLastError
0x48d314 GetFullPathNameW
0x48d318 SetCurrentDirectoryW
0x48d31c IsDebuggerPresent
0x48d320 GetCurrentDirectoryW
0x48d324 lstrcmpiW
0x48d328 RaiseException
0x48d32c InitializeCriticalSectionAndSpinCount
0x48d330 InterlockedDecrement
0x48d334 InterlockedIncrement
0x48d338 CreateThread
0x48d33c DuplicateHandle
0x48d340 EnterCriticalSection
0x48d344 GetCurrentProcess
0x48d348 ExitProcess
0x48d34c GetModuleHandleExW
0x48d350 ExitThread
0x48d354 GetSystemTimeAsFileTime
0x48d358 ResumeThread
0x48d35c GetCommandLineW
0x48d360 IsProcessorFeaturePresent
0x48d364 HeapSize
0x48d368 IsValidCodePage
0x48d36c GetACP
0x48d370 GetOEMCP
0x48d374 GetCPInfo
0x48d378 SetLastError
0x48d37c UnhandledExceptionFilter
0x48d380 SetUnhandledExceptionFilter
0x48d384 TlsAlloc
0x48d388 TlsGetValue
0x48d38c TlsSetValue
0x48d390 TlsFree
0x48d394 GetStartupInfoW
0x48d398 GetStringTypeW
0x48d39c SetStdHandle
0x48d3a0 GetFileType
0x48d3a4 GetConsoleCP
0x48d3a8 GetConsoleMode
0x48d3ac RtlUnwind
0x48d3b0 ReadConsoleW
0x48d3b4 SetFilePointer
0x48d3b8 GetTimeZoneInformation
0x48d3bc GetDateFormatW
0x48d3c0 GetTimeFormatW
0x48d3c4 LCMapStringW
0x48d3c8 GetEnvironmentStringsW
0x48d3cc FreeEnvironmentStringsW
0x48d3d0 HeapReAlloc
0x48d3d4 WriteConsoleW
0x48d3d8 SetEndOfFile
0x48d3dc DeleteFileW
0x48d3e0 SetEnvironmentVariableA
USER32.dll
0x48d4b4 SetWindowPos
0x48d4b8 GetCursorInfo
0x48d4bc RegisterHotKey
0x48d4c0 ClientToScreen
0x48d4c4 GetKeyboardLayoutNameW
0x48d4c8 IsCharAlphaW
0x48d4cc IsCharAlphaNumericW
0x48d4d0 IsCharLowerW
0x48d4d4 IsCharUpperW
0x48d4d8 GetMenuStringW
0x48d4dc GetSubMenu
0x48d4e0 GetCaretPos
0x48d4e4 IsZoomed
0x48d4e8 MonitorFromPoint
0x48d4ec GetMonitorInfoW
0x48d4f0 SetWindowLongW
0x48d4f4 SetLayeredWindowAttributes
0x48d4f8 FlashWindow
0x48d4fc GetClassLongW
0x48d500 TranslateAcceleratorW
0x48d504 IsDialogMessageW
0x48d508 GetSysColor
0x48d50c InflateRect
0x48d510 DrawFocusRect
0x48d514 DrawTextW
0x48d518 FrameRect
0x48d51c DrawFrameControl
0x48d520 FillRect
0x48d524 PtInRect
0x48d528 DestroyAcceleratorTable
0x48d52c CreateAcceleratorTableW
0x48d530 SetCursor
0x48d534 GetWindowDC
0x48d538 GetSystemMetrics
0x48d53c DrawMenuBar
0x48d540 GetActiveWindow
0x48d544 CharNextW
0x48d548 wsprintfW
0x48d54c RedrawWindow
0x48d550 DestroyMenu
0x48d554 SetMenu
0x48d558 GetWindowTextLengthW
0x48d55c CreateMenu
0x48d560 IsDlgButtonChecked
0x48d564 DefDlgProcW
0x48d568 CallWindowProcW
0x48d56c ReleaseCapture
0x48d570 SetCapture
0x48d574 MonitorFromRect
0x48d578 LoadImageW
0x48d57c CreateIconFromResourceEx
0x48d580 mouse_event
0x48d584 ExitWindowsEx
0x48d588 SetActiveWindow
0x48d58c FindWindowExW
0x48d590 EnumThreadWindows
0x48d594 SetMenuDefaultItem
0x48d598 InsertMenuItemW
0x48d59c IsMenu
0x48d5a0 TrackPopupMenuEx
0x48d5a4 GetCursorPos
0x48d5a8 CopyImage
0x48d5ac CheckMenuRadioItem
0x48d5b0 GetMenuItemID
0x48d5b4 GetMenuItemCount
0x48d5b8 SetMenuItemInfoW
0x48d5bc GetMenuItemInfoW
0x48d5c0 SetForegroundWindow
0x48d5c4 IsIconic
0x48d5c8 FindWindowW
0x48d5cc UnregisterHotKey
0x48d5d0 keybd_event
0x48d5d4 SendInput
0x48d5d8 GetAsyncKeyState
0x48d5dc SetKeyboardState
0x48d5e0 GetKeyboardState
0x48d5e4 GetKeyState
0x48d5e8 VkKeyScanW
0x48d5ec LoadStringW
0x48d5f0 DialogBoxParamW
0x48d5f4 MessageBeep
0x48d5f8 EndDialog
0x48d5fc SendDlgItemMessageW
0x48d600 GetDlgItem
0x48d604 SetWindowTextW
0x48d608 CopyRect
0x48d60c ReleaseDC
0x48d610 GetDC
0x48d614 EndPaint
0x48d618 BeginPaint
0x48d61c GetClientRect
0x48d620 GetMenu
0x48d624 DestroyWindow
0x48d628 EnumWindows
0x48d62c GetDesktopWindow
0x48d630 IsWindow
0x48d634 IsWindowEnabled
0x48d638 IsWindowVisible
0x48d63c EnableWindow
0x48d640 InvalidateRect
0x48d644 GetWindowLongW
0x48d648 GetWindowThreadProcessId
0x48d64c AttachThreadInput
0x48d650 GetFocus
0x48d654 ScreenToClient
0x48d658 SendMessageTimeoutW
0x48d65c EnumChildWindows
0x48d660 CharUpperBuffW
0x48d664 GetClassNameW
0x48d668 GetParent
0x48d66c GetDlgCtrlID
0x48d670 SendMessageW
0x48d674 MapVirtualKeyW
0x48d678 PostMessageW
0x48d67c GetWindowRect
0x48d680 SetUserObjectSecurity
0x48d684 CloseDesktop
0x48d688 CloseWindowStation
0x48d68c OpenDesktopW
0x48d690 SetProcessWindowStation
0x48d694 GetProcessWindowStation
0x48d698 OpenWindowStationW
0x48d69c GetUserObjectSecurity
0x48d6a0 AdjustWindowRectEx
0x48d6a4 SetRect
0x48d6a8 SetClipboardData
0x48d6ac EmptyClipboard
0x48d6b0 CountClipboardFormats
0x48d6b4 CloseClipboard
0x48d6b8 GetClipboardData
0x48d6bc IsClipboardFormatAvailable
0x48d6c0 OpenClipboard
0x48d6c4 BlockInput
0x48d6c8 GetMessageW
0x48d6cc LockWindowUpdate
0x48d6d0 DispatchMessageW
0x48d6d4 TranslateMessage
0x48d6d8 DeleteMenu
0x48d6dc PeekMessageW
0x48d6e0 MessageBoxW
0x48d6e4 DefWindowProcW
0x48d6e8 MoveWindow
0x48d6ec SetFocus
0x48d6f0 PostQuitMessage
0x48d6f4 KillTimer
0x48d6f8 CreatePopupMenu
0x48d6fc RegisterWindowMessageW
0x48d700 SetTimer
0x48d704 ShowWindow
0x48d708 CreateWindowExW
0x48d70c RegisterClassExW
0x48d710 LoadIconW
0x48d714 LoadCursorW
0x48d718 GetSysColorBrush
0x48d71c GetForegroundWindow
0x48d720 MessageBoxA
0x48d724 DestroyIcon
0x48d728 SystemParametersInfoW
0x48d72c CharLowerBuffW
0x48d730 GetWindowTextW
GDI32.dll
0x48d0c4 SetPixel
0x48d0c8 DeleteObject
0x48d0cc GetTextExtentPoint32W
0x48d0d0 ExtCreatePen
0x48d0d4 StrokeAndFillPath
0x48d0d8 StrokePath
0x48d0dc GetDeviceCaps
0x48d0e0 CloseFigure
0x48d0e4 LineTo
0x48d0e8 AngleArc
0x48d0ec CreateCompatibleBitmap
0x48d0f0 CreateCompatibleDC
0x48d0f4 MoveToEx
0x48d0f8 Ellipse
0x48d0fc PolyDraw
0x48d100 BeginPath
0x48d104 SelectObject
0x48d108 StretchBlt
0x48d10c GetDIBits
0x48d110 DeleteDC
0x48d114 GetPixel
0x48d118 CreateDCW
0x48d11c GetStockObject
0x48d120 Rectangle
0x48d124 SetViewportOrgEx
0x48d128 GetObjectW
0x48d12c SetBkMode
0x48d130 RoundRect
0x48d134 SetBkColor
0x48d138 CreatePen
0x48d13c CreateSolidBrush
0x48d140 SetTextColor
0x48d144 CreateFontW
0x48d148 GetTextFaceW
0x48d14c EndPath
COMDLG32.dll
0x48d0b8 GetSaveFileNameW
0x48d0bc GetOpenFileNameW
ADVAPI32.dll
0x48d000 GetAclInformation
0x48d004 RegEnumValueW
0x48d008 RegDeleteValueW
0x48d00c RegDeleteKeyW
0x48d010 RegEnumKeyExW
0x48d014 RegSetValueExW
0x48d018 RegCreateKeyExW
0x48d01c GetUserNameW
0x48d020 RegOpenKeyExW
0x48d024 RegCloseKey
0x48d028 RegQueryValueExW
0x48d02c RegConnectRegistryW
0x48d030 InitializeSecurityDescriptor
0x48d034 InitializeAcl
0x48d038 AdjustTokenPrivileges
0x48d03c OpenThreadToken
0x48d040 OpenProcessToken
0x48d044 LookupPrivilegeValueW
0x48d048 DuplicateTokenEx
0x48d04c CreateProcessAsUserW
0x48d050 CreateProcessWithLogonW
0x48d054 GetLengthSid
0x48d058 CopySid
0x48d05c InitiateSystemShutdownExW
0x48d060 LogonUserW
0x48d064 AllocateAndInitializeSid
0x48d068 CheckTokenMembership
0x48d06c FreeSid
0x48d070 GetTokenInformation
0x48d074 GetSecurityDescriptorDacl
0x48d078 SetSecurityDescriptorDacl
0x48d07c AddAce
0x48d080 GetAce
SHELL32.dll
0x48d474 DragQueryPoint
0x48d478 ShellExecuteExW
0x48d47c DragQueryFileW
0x48d480 SHEmptyRecycleBinW
0x48d484 SHGetPathFromIDListW
0x48d488 SHBrowseForFolderW
0x48d48c SHCreateShellItem
0x48d490 SHGetDesktopFolder
0x48d494 SHGetSpecialFolderLocation
0x48d498 SHGetFolderPathW
0x48d49c SHFileOperationW
0x48d4a0 ExtractIconExW
0x48d4a4 Shell_NotifyIconW
0x48d4a8 ShellExecuteW
0x48d4ac DragFinish
ole32.dll
0x48d80c CoTaskMemAlloc
0x48d810 CoTaskMemFree
0x48d814 CLSIDFromString
0x48d818 ProgIDFromCLSID
0x48d81c CLSIDFromProgID
0x48d820 OleSetMenuDescriptor
0x48d824 MkParseDisplayName
0x48d828 OleSetContainedObject
0x48d82c CoCreateInstance
0x48d830 IIDFromString
0x48d834 StringFromGUID2
0x48d838 CreateStreamOnHGlobal
0x48d83c CoInitialize
0x48d840 CoUninitialize
0x48d844 GetRunningObjectTable
0x48d848 CoGetInstanceFromFile
0x48d84c CoGetObject
0x48d850 CoInitializeSecurity
0x48d854 CoCreateInstanceEx
0x48d858 CoSetProxyBlanket
OLEAUT32.dll
0x48d3fc RegisterTypeLib
0x48d400 LoadTypeLibEx
0x48d404 VariantCopyInd
0x48d408 SysReAllocString
0x48d40c SysFreeString
0x48d410 SafeArrayDestroyDescriptor
0x48d414 SafeArrayDestroyData
0x48d418 SafeArrayUnaccessData
0x48d41c SafeArrayAccessData
0x48d420 SafeArrayAllocData
0x48d424 UnRegisterTypeLib
0x48d428 SafeArrayCreateVector
0x48d42c SysAllocString
0x48d430 SysStringLen
0x48d434 VariantTimeToSystemTime
0x48d438 VarR8FromDec
0x48d43c SafeArrayGetVartype
0x48d440 OleLoadPicture
0x48d444 QueryPathOfRegTypeLib
0x48d448 VariantCopy
0x48d44c VariantClear
0x48d450 CreateDispTypeInfo
0x48d454 CreateStdDispatch
0x48d458 DispCallFunc
0x48d45c VariantChangeType
0x48d460 SafeArrayAllocDescriptorEx
0x48d464 VariantInit
EAT(Export Address Table) is none
WSOCK32.dll
0x48d7b0 __WSAFDIsSet
0x48d7b4 recv
0x48d7b8 send
0x48d7bc setsockopt
0x48d7c0 ntohs
0x48d7c4 recvfrom
0x48d7c8 select
0x48d7cc WSAStartup
0x48d7d0 htons
0x48d7d4 accept
0x48d7d8 listen
0x48d7dc ind
0x48d7e0 closesocket
0x48d7e4 connect
0x48d7e8 WSACleanup
0x48d7ec ioctlsocket
0x48d7f0 sendto
0x48d7f4 WSAGetLastError
0x48d7f8 inet_addr
0x48d7fc gethostbyname
0x48d800 gethostname
0x48d804 socket
VERSION.dll
0x48d754 GetFileVersionInfoW
0x48d758 VerQueryValueW
0x48d75c GetFileVersionInfoSizeW
WINMM.dll
0x48d7a0 timeGetTime
0x48d7a4 waveOutSetVolume
0x48d7a8 mciSendStringW
COMCTL32.dll
0x48d088 ImageList_Destroy
0x48d08c ImageList_Remove
0x48d090 ImageList_SetDragCursorImage
0x48d094 ImageList_BeginDrag
0x48d098 ImageList_DragEnter
0x48d09c ImageList_DragLeave
0x48d0a0 ImageList_EndDrag
0x48d0a4 ImageList_DragMove
0x48d0a8 ImageList_Create
0x48d0ac InitCommonControlsEx
0x48d0b0 ImageList_ReplaceIcon
MPR.dll
0x48d3e8 WNetUseConnectionW
0x48d3ec WNetCancelConnection2W
0x48d3f0 WNetGetConnectionW
0x48d3f4 WNetAddConnection2W
WININET.dll
0x48d764 InternetReadFile
0x48d768 InternetCloseHandle
0x48d76c InternetOpenW
0x48d770 InternetSetOptionW
0x48d774 InternetCrackUrlW
0x48d778 HttpQueryInfoW
0x48d77c InternetQueryOptionW
0x48d780 HttpOpenRequestW
0x48d784 HttpSendRequestW
0x48d788 FtpOpenFileW
0x48d78c FtpGetFileSize
0x48d790 InternetOpenUrlW
0x48d794 InternetConnectW
0x48d798 InternetQueryDataAvailable
PSAPI.DLL
0x48d46c GetProcessMemoryInfo
IPHLPAPI.DLL
0x48d154 IcmpCreateFile
0x48d158 IcmpCloseHandle
0x48d15c IcmpSendEcho
USERENV.dll
0x48d738 UnloadUserProfile
0x48d73c DestroyEnvironmentBlock
0x48d740 CreateEnvironmentBlock
0x48d744 LoadUserProfileW
UxTheme.dll
0x48d74c IsThemeActive
KERNEL32.dll
0x48d164 HeapAlloc
0x48d168 GetProcessHeap
0x48d16c HeapFree
0x48d170 Sleep
0x48d174 GetCurrentThreadId
0x48d178 MultiByteToWideChar
0x48d17c MulDiv
0x48d180 GetVersionExW
0x48d184 GetSystemInfo
0x48d188 FreeLibrary
0x48d18c LoadLibraryA
0x48d190 GetProcAddress
0x48d194 SetErrorMode
0x48d198 GetModuleFileNameW
0x48d19c WideCharToMultiByte
0x48d1a0 lstrcpyW
0x48d1a4 lstrlenW
0x48d1a8 GetModuleHandleW
0x48d1ac QueryPerformanceCounter
0x48d1b0 VirtualFreeEx
0x48d1b4 OpenProcess
0x48d1b8 VirtualAllocEx
0x48d1bc WriteProcessMemory
0x48d1c0 ReadProcessMemory
0x48d1c4 CreateFileW
0x48d1c8 SetFilePointerEx
0x48d1cc ReadFile
0x48d1d0 WriteFile
0x48d1d4 FlushFileBuffers
0x48d1d8 TerminateProcess
0x48d1dc CreateToolhelp32Snapshot
0x48d1e0 Process32FirstW
0x48d1e4 Process32NextW
0x48d1e8 SetFileTime
0x48d1ec GetFileAttributesW
0x48d1f0 FindFirstFileW
0x48d1f4 FindClose
0x48d1f8 GetLongPathNameW
0x48d1fc GetCurrentThread
0x48d200 FindNextFileW
0x48d204 MoveFileW
0x48d208 CopyFileW
0x48d20c CreateDirectoryW
0x48d210 RemoveDirectoryW
0x48d214 SetSystemPowerState
0x48d218 QueryPerformanceFrequency
0x48d21c FindResourceW
0x48d220 LoadResource
0x48d224 LockResource
0x48d228 SizeofResource
0x48d22c EnumResourceNamesW
0x48d230 OutputDebugStringW
0x48d234 GetTempPathW
0x48d238 GetTempFileNameW
0x48d23c DeviceIoControl
0x48d240 GetLocalTime
0x48d244 CompareStringW
0x48d248 DeleteCriticalSection
0x48d24c WaitForSingleObject
0x48d250 LeaveCriticalSection
0x48d254 GetStdHandle
0x48d258 CreatePipe
0x48d25c InterlockedExchange
0x48d260 TerminateThread
0x48d264 LoadLibraryExW
0x48d268 FindResourceExW
0x48d26c VirtualFree
0x48d270 FormatMessageW
0x48d274 GetExitCodeProcess
0x48d278 GetPrivateProfileStringW
0x48d27c WritePrivateProfileStringW
0x48d280 GetPrivateProfileSectionW
0x48d284 WritePrivateProfileSectionW
0x48d288 GetPrivateProfileSectionNamesW
0x48d28c FileTimeToLocalFileTime
0x48d290 FileTimeToSystemTime
0x48d294 SystemTimeToFileTime
0x48d298 LocalFileTimeToFileTime
0x48d29c GetDriveTypeW
0x48d2a0 GetDiskFreeSpaceExW
0x48d2a4 GetDiskFreeSpaceW
0x48d2a8 GetVolumeInformationW
0x48d2ac SetVolumeLabelW
0x48d2b0 CreateHardLinkW
0x48d2b4 SetFileAttributesW
0x48d2b8 GetShortPathNameW
0x48d2bc CreateEventW
0x48d2c0 SetEvent
0x48d2c4 GetEnvironmentVariableW
0x48d2c8 SetEnvironmentVariableW
0x48d2cc GlobalLock
0x48d2d0 GlobalUnlock
0x48d2d4 GlobalAlloc
0x48d2d8 GetFileSize
0x48d2dc GlobalFree
0x48d2e0 GlobalMemoryStatusEx
0x48d2e4 Beep
0x48d2e8 GetSystemDirectoryW
0x48d2ec GetComputerNameW
0x48d2f0 GetWindowsDirectoryW
0x48d2f4 GetCurrentProcessId
0x48d2f8 GetProcessIoCounters
0x48d2fc CreateProcessW
0x48d300 SetPriorityClass
0x48d304 LoadLibraryW
0x48d308 VirtualAlloc
0x48d30c CloseHandle
0x48d310 GetLastError
0x48d314 GetFullPathNameW
0x48d318 SetCurrentDirectoryW
0x48d31c IsDebuggerPresent
0x48d320 GetCurrentDirectoryW
0x48d324 lstrcmpiW
0x48d328 RaiseException
0x48d32c InitializeCriticalSectionAndSpinCount
0x48d330 InterlockedDecrement
0x48d334 InterlockedIncrement
0x48d338 CreateThread
0x48d33c DuplicateHandle
0x48d340 EnterCriticalSection
0x48d344 GetCurrentProcess
0x48d348 ExitProcess
0x48d34c GetModuleHandleExW
0x48d350 ExitThread
0x48d354 GetSystemTimeAsFileTime
0x48d358 ResumeThread
0x48d35c GetCommandLineW
0x48d360 IsProcessorFeaturePresent
0x48d364 HeapSize
0x48d368 IsValidCodePage
0x48d36c GetACP
0x48d370 GetOEMCP
0x48d374 GetCPInfo
0x48d378 SetLastError
0x48d37c UnhandledExceptionFilter
0x48d380 SetUnhandledExceptionFilter
0x48d384 TlsAlloc
0x48d388 TlsGetValue
0x48d38c TlsSetValue
0x48d390 TlsFree
0x48d394 GetStartupInfoW
0x48d398 GetStringTypeW
0x48d39c SetStdHandle
0x48d3a0 GetFileType
0x48d3a4 GetConsoleCP
0x48d3a8 GetConsoleMode
0x48d3ac RtlUnwind
0x48d3b0 ReadConsoleW
0x48d3b4 SetFilePointer
0x48d3b8 GetTimeZoneInformation
0x48d3bc GetDateFormatW
0x48d3c0 GetTimeFormatW
0x48d3c4 LCMapStringW
0x48d3c8 GetEnvironmentStringsW
0x48d3cc FreeEnvironmentStringsW
0x48d3d0 HeapReAlloc
0x48d3d4 WriteConsoleW
0x48d3d8 SetEndOfFile
0x48d3dc DeleteFileW
0x48d3e0 SetEnvironmentVariableA
USER32.dll
0x48d4b4 SetWindowPos
0x48d4b8 GetCursorInfo
0x48d4bc RegisterHotKey
0x48d4c0 ClientToScreen
0x48d4c4 GetKeyboardLayoutNameW
0x48d4c8 IsCharAlphaW
0x48d4cc IsCharAlphaNumericW
0x48d4d0 IsCharLowerW
0x48d4d4 IsCharUpperW
0x48d4d8 GetMenuStringW
0x48d4dc GetSubMenu
0x48d4e0 GetCaretPos
0x48d4e4 IsZoomed
0x48d4e8 MonitorFromPoint
0x48d4ec GetMonitorInfoW
0x48d4f0 SetWindowLongW
0x48d4f4 SetLayeredWindowAttributes
0x48d4f8 FlashWindow
0x48d4fc GetClassLongW
0x48d500 TranslateAcceleratorW
0x48d504 IsDialogMessageW
0x48d508 GetSysColor
0x48d50c InflateRect
0x48d510 DrawFocusRect
0x48d514 DrawTextW
0x48d518 FrameRect
0x48d51c DrawFrameControl
0x48d520 FillRect
0x48d524 PtInRect
0x48d528 DestroyAcceleratorTable
0x48d52c CreateAcceleratorTableW
0x48d530 SetCursor
0x48d534 GetWindowDC
0x48d538 GetSystemMetrics
0x48d53c DrawMenuBar
0x48d540 GetActiveWindow
0x48d544 CharNextW
0x48d548 wsprintfW
0x48d54c RedrawWindow
0x48d550 DestroyMenu
0x48d554 SetMenu
0x48d558 GetWindowTextLengthW
0x48d55c CreateMenu
0x48d560 IsDlgButtonChecked
0x48d564 DefDlgProcW
0x48d568 CallWindowProcW
0x48d56c ReleaseCapture
0x48d570 SetCapture
0x48d574 MonitorFromRect
0x48d578 LoadImageW
0x48d57c CreateIconFromResourceEx
0x48d580 mouse_event
0x48d584 ExitWindowsEx
0x48d588 SetActiveWindow
0x48d58c FindWindowExW
0x48d590 EnumThreadWindows
0x48d594 SetMenuDefaultItem
0x48d598 InsertMenuItemW
0x48d59c IsMenu
0x48d5a0 TrackPopupMenuEx
0x48d5a4 GetCursorPos
0x48d5a8 CopyImage
0x48d5ac CheckMenuRadioItem
0x48d5b0 GetMenuItemID
0x48d5b4 GetMenuItemCount
0x48d5b8 SetMenuItemInfoW
0x48d5bc GetMenuItemInfoW
0x48d5c0 SetForegroundWindow
0x48d5c4 IsIconic
0x48d5c8 FindWindowW
0x48d5cc UnregisterHotKey
0x48d5d0 keybd_event
0x48d5d4 SendInput
0x48d5d8 GetAsyncKeyState
0x48d5dc SetKeyboardState
0x48d5e0 GetKeyboardState
0x48d5e4 GetKeyState
0x48d5e8 VkKeyScanW
0x48d5ec LoadStringW
0x48d5f0 DialogBoxParamW
0x48d5f4 MessageBeep
0x48d5f8 EndDialog
0x48d5fc SendDlgItemMessageW
0x48d600 GetDlgItem
0x48d604 SetWindowTextW
0x48d608 CopyRect
0x48d60c ReleaseDC
0x48d610 GetDC
0x48d614 EndPaint
0x48d618 BeginPaint
0x48d61c GetClientRect
0x48d620 GetMenu
0x48d624 DestroyWindow
0x48d628 EnumWindows
0x48d62c GetDesktopWindow
0x48d630 IsWindow
0x48d634 IsWindowEnabled
0x48d638 IsWindowVisible
0x48d63c EnableWindow
0x48d640 InvalidateRect
0x48d644 GetWindowLongW
0x48d648 GetWindowThreadProcessId
0x48d64c AttachThreadInput
0x48d650 GetFocus
0x48d654 ScreenToClient
0x48d658 SendMessageTimeoutW
0x48d65c EnumChildWindows
0x48d660 CharUpperBuffW
0x48d664 GetClassNameW
0x48d668 GetParent
0x48d66c GetDlgCtrlID
0x48d670 SendMessageW
0x48d674 MapVirtualKeyW
0x48d678 PostMessageW
0x48d67c GetWindowRect
0x48d680 SetUserObjectSecurity
0x48d684 CloseDesktop
0x48d688 CloseWindowStation
0x48d68c OpenDesktopW
0x48d690 SetProcessWindowStation
0x48d694 GetProcessWindowStation
0x48d698 OpenWindowStationW
0x48d69c GetUserObjectSecurity
0x48d6a0 AdjustWindowRectEx
0x48d6a4 SetRect
0x48d6a8 SetClipboardData
0x48d6ac EmptyClipboard
0x48d6b0 CountClipboardFormats
0x48d6b4 CloseClipboard
0x48d6b8 GetClipboardData
0x48d6bc IsClipboardFormatAvailable
0x48d6c0 OpenClipboard
0x48d6c4 BlockInput
0x48d6c8 GetMessageW
0x48d6cc LockWindowUpdate
0x48d6d0 DispatchMessageW
0x48d6d4 TranslateMessage
0x48d6d8 DeleteMenu
0x48d6dc PeekMessageW
0x48d6e0 MessageBoxW
0x48d6e4 DefWindowProcW
0x48d6e8 MoveWindow
0x48d6ec SetFocus
0x48d6f0 PostQuitMessage
0x48d6f4 KillTimer
0x48d6f8 CreatePopupMenu
0x48d6fc RegisterWindowMessageW
0x48d700 SetTimer
0x48d704 ShowWindow
0x48d708 CreateWindowExW
0x48d70c RegisterClassExW
0x48d710 LoadIconW
0x48d714 LoadCursorW
0x48d718 GetSysColorBrush
0x48d71c GetForegroundWindow
0x48d720 MessageBoxA
0x48d724 DestroyIcon
0x48d728 SystemParametersInfoW
0x48d72c CharLowerBuffW
0x48d730 GetWindowTextW
GDI32.dll
0x48d0c4 SetPixel
0x48d0c8 DeleteObject
0x48d0cc GetTextExtentPoint32W
0x48d0d0 ExtCreatePen
0x48d0d4 StrokeAndFillPath
0x48d0d8 StrokePath
0x48d0dc GetDeviceCaps
0x48d0e0 CloseFigure
0x48d0e4 LineTo
0x48d0e8 AngleArc
0x48d0ec CreateCompatibleBitmap
0x48d0f0 CreateCompatibleDC
0x48d0f4 MoveToEx
0x48d0f8 Ellipse
0x48d0fc PolyDraw
0x48d100 BeginPath
0x48d104 SelectObject
0x48d108 StretchBlt
0x48d10c GetDIBits
0x48d110 DeleteDC
0x48d114 GetPixel
0x48d118 CreateDCW
0x48d11c GetStockObject
0x48d120 Rectangle
0x48d124 SetViewportOrgEx
0x48d128 GetObjectW
0x48d12c SetBkMode
0x48d130 RoundRect
0x48d134 SetBkColor
0x48d138 CreatePen
0x48d13c CreateSolidBrush
0x48d140 SetTextColor
0x48d144 CreateFontW
0x48d148 GetTextFaceW
0x48d14c EndPath
COMDLG32.dll
0x48d0b8 GetSaveFileNameW
0x48d0bc GetOpenFileNameW
ADVAPI32.dll
0x48d000 GetAclInformation
0x48d004 RegEnumValueW
0x48d008 RegDeleteValueW
0x48d00c RegDeleteKeyW
0x48d010 RegEnumKeyExW
0x48d014 RegSetValueExW
0x48d018 RegCreateKeyExW
0x48d01c GetUserNameW
0x48d020 RegOpenKeyExW
0x48d024 RegCloseKey
0x48d028 RegQueryValueExW
0x48d02c RegConnectRegistryW
0x48d030 InitializeSecurityDescriptor
0x48d034 InitializeAcl
0x48d038 AdjustTokenPrivileges
0x48d03c OpenThreadToken
0x48d040 OpenProcessToken
0x48d044 LookupPrivilegeValueW
0x48d048 DuplicateTokenEx
0x48d04c CreateProcessAsUserW
0x48d050 CreateProcessWithLogonW
0x48d054 GetLengthSid
0x48d058 CopySid
0x48d05c InitiateSystemShutdownExW
0x48d060 LogonUserW
0x48d064 AllocateAndInitializeSid
0x48d068 CheckTokenMembership
0x48d06c FreeSid
0x48d070 GetTokenInformation
0x48d074 GetSecurityDescriptorDacl
0x48d078 SetSecurityDescriptorDacl
0x48d07c AddAce
0x48d080 GetAce
SHELL32.dll
0x48d474 DragQueryPoint
0x48d478 ShellExecuteExW
0x48d47c DragQueryFileW
0x48d480 SHEmptyRecycleBinW
0x48d484 SHGetPathFromIDListW
0x48d488 SHBrowseForFolderW
0x48d48c SHCreateShellItem
0x48d490 SHGetDesktopFolder
0x48d494 SHGetSpecialFolderLocation
0x48d498 SHGetFolderPathW
0x48d49c SHFileOperationW
0x48d4a0 ExtractIconExW
0x48d4a4 Shell_NotifyIconW
0x48d4a8 ShellExecuteW
0x48d4ac DragFinish
ole32.dll
0x48d80c CoTaskMemAlloc
0x48d810 CoTaskMemFree
0x48d814 CLSIDFromString
0x48d818 ProgIDFromCLSID
0x48d81c CLSIDFromProgID
0x48d820 OleSetMenuDescriptor
0x48d824 MkParseDisplayName
0x48d828 OleSetContainedObject
0x48d82c CoCreateInstance
0x48d830 IIDFromString
0x48d834 StringFromGUID2
0x48d838 CreateStreamOnHGlobal
0x48d83c CoInitialize
0x48d840 CoUninitialize
0x48d844 GetRunningObjectTable
0x48d848 CoGetInstanceFromFile
0x48d84c CoGetObject
0x48d850 CoInitializeSecurity
0x48d854 CoCreateInstanceEx
0x48d858 CoSetProxyBlanket
OLEAUT32.dll
0x48d3fc RegisterTypeLib
0x48d400 LoadTypeLibEx
0x48d404 VariantCopyInd
0x48d408 SysReAllocString
0x48d40c SysFreeString
0x48d410 SafeArrayDestroyDescriptor
0x48d414 SafeArrayDestroyData
0x48d418 SafeArrayUnaccessData
0x48d41c SafeArrayAccessData
0x48d420 SafeArrayAllocData
0x48d424 UnRegisterTypeLib
0x48d428 SafeArrayCreateVector
0x48d42c SysAllocString
0x48d430 SysStringLen
0x48d434 VariantTimeToSystemTime
0x48d438 VarR8FromDec
0x48d43c SafeArrayGetVartype
0x48d440 OleLoadPicture
0x48d444 QueryPathOfRegTypeLib
0x48d448 VariantCopy
0x48d44c VariantClear
0x48d450 CreateDispTypeInfo
0x48d454 CreateStdDispatch
0x48d458 DispCallFunc
0x48d45c VariantChangeType
0x48d460 SafeArrayAllocDescriptorEx
0x48d464 VariantInit
EAT(Export Address Table) is none