8f61f3e8...7c63

Filters:

Filename	Category	Type	Severity	Actions

C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CPELzFoaEOtMTGWv.exe

Sample File

Binary

Malicious

Mime Type	application/vnd.microsoft.portable-executable
File Size	890.50 KB
MD5	566aacd2baefb806f6752e2fb44de8c7
SHA1	445f2b6450ea8af61e1ffe8f02ab16fb08974acc
SHA256	8f61f3e850c927d9d89a37a32ce40fb03c61f883c21b26f8e68f1df50e7c7c63
SSDeep	24576:5AHnh+eWsN3skA4RV1Hom2KXMmHakxjTds5:Ah+ZkldoPK8YakZTs
ImpHash	afcdf79be1557326c854b6e20cb900a7

PE Information

Image Base	0x400000
Entry Point	0x42800a
Size Of Code	0x8e000
Size Of Initialized Data	0x50600
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2020-06-30 20:52:06+00:00

Sections (5)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x8dfdd	0x8e000	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.68
.rdata	0x48f000	0x2fd8e	0x2fe00	0x8e400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.76
.data	0x4bf000	0x8f74	0x5200	0xbe200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	1.2
.rsrc	0x4c8000	0x14218	0x14400	0xc3400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	7.07
.reloc	0x4dd000	0x7134	0x7200	0xd7800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.78

Imports (18)

WSOCK32.dll (23)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WSACleanup	0x74	0x48f7c8	0xbca10	0xbbe10	-
socket	0x17	0x48f7cc	0xbca14	0xbbe14	-
inet_ntoa	0xc	0x48f7d0	0xbca18	0xbbe18	-
setsockopt	0x15	0x48f7d4	0xbca1c	0xbbe1c	-
ntohs	0xf	0x48f7d8	0xbca20	0xbbe20	-
recvfrom	0x11	0x48f7dc	0xbca24	0xbbe24	-
ioctlsocket	0xa	0x48f7e0	0xbca28	0xbbe28	-
htons	0x9	0x48f7e4	0xbca2c	0xbbe2c	-
WSAStartup	0x73	0x48f7e8	0xbca30	0xbbe30	-
__WSAFDIsSet	0x97	0x48f7ec	0xbca34	0xbbe34	-
select	0x12	0x48f7f0	0xbca38	0xbbe38	-
accept	0x1	0x48f7f4	0xbca3c	0xbbe3c	-
listen	0xd	0x48f7f8	0xbca40	0xbbe40	-
bind	0x2	0x48f7fc	0xbca44	0xbbe44	-
closesocket	0x3	0x48f800	0xbca48	0xbbe48	-
WSAGetLastError	0x6f	0x48f804	0xbca4c	0xbbe4c	-
recv	0x10	0x48f808	0xbca50	0xbbe50	-
sendto	0x14	0x48f80c	0xbca54	0xbbe54	-
send	0x13	0x48f810	0xbca58	0xbbe58	-
inet_addr	0xb	0x48f814	0xbca5c	0xbbe5c	-
gethostbyname	0x34	0x48f818	0xbca60	0xbbe60	-
gethostname	0x39	0x48f81c	0xbca64	0xbbe64	-
connect	0x4	0x48f820	0xbca68	0xbbe68	-

VERSION.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetFileVersionInfoW	0x0	0x48f76c	0xbc9b4	0xbbdb4	0x6
GetFileVersionInfoSizeW	0x0	0x48f770	0xbc9b8	0xbbdb8	0x5
VerQueryValueW	0x0	0x48f774	0xbc9bc	0xbbdbc	0xe

WINMM.dll (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
timeGetTime	0x0	0x48f7b8	0xbca00	0xbbe00	0x94
waveOutSetVolume	0x0	0x48f7bc	0xbca04	0xbbe04	0xbb
mciSendStringW	0x0	0x48f7c0	0xbca08	0xbbe08	0x32

COMCTL32.dll (11)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
ImageList_ReplaceIcon	0x0	0x48f088	0xbc2d0	0xbb6d0	0x6f
ImageList_Destroy	0x0	0x48f08c	0xbc2d4	0xbb6d4	0x54
ImageList_Remove	0x0	0x48f090	0xbc2d8	0xbb6d8	0x6d
ImageList_SetDragCursorImage	0x0	0x48f094	0xbc2dc	0xbb6dc	0x72
ImageList_BeginDrag	0x0	0x48f098	0xbc2e0	0xbb6e0	0x50
ImageList_DragEnter	0x0	0x48f09c	0xbc2e4	0xbb6e4	0x56
ImageList_DragLeave	0x0	0x48f0a0	0xbc2e8	0xbb6e8	0x57
ImageList_EndDrag	0x0	0x48f0a4	0xbc2ec	0xbb6ec	0x5e
ImageList_DragMove	0x0	0x48f0a8	0xbc2f0	0xbb6f0	0x58
InitCommonControlsEx	0x0	0x48f0ac	0xbc2f4	0xbb6f4	0x7b
ImageList_Create	0x0	0x48f0b0	0xbc2f8	0xbb6f8	0x53

MPR.dll (4)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WNetUseConnectionW	0x0	0x48f3f8	0xbc640	0xbba40	0x49
WNetCancelConnection2W	0x0	0x48f3fc	0xbc644	0xbba44	0xc
WNetGetConnectionW	0x0	0x48f400	0xbc648	0xbba48	0x24
WNetAddConnection2W	0x0	0x48f404	0xbc64c	0xbba4c	0x6

WININET.dll (14)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
InternetQueryDataAvailable	0x0	0x48f77c	0xbc9c4	0xbbdc4	0x9b
InternetCloseHandle	0x0	0x48f780	0xbc9c8	0xbbdc8	0x6b
InternetOpenW	0x0	0x48f784	0xbc9cc	0xbbdcc	0x9a
InternetSetOptionW	0x0	0x48f788	0xbc9d0	0xbbdd0	0xaf
InternetCrackUrlW	0x0	0x48f78c	0xbc9d4	0xbbdd4	0x74
HttpQueryInfoW	0x0	0x48f790	0xbc9d8	0xbbdd8	0x5a
InternetQueryOptionW	0x0	0x48f794	0xbc9dc	0xbbddc	0x9e
HttpOpenRequestW	0x0	0x48f798	0xbc9e0	0xbbde0	0x58
HttpSendRequestW	0x0	0x48f79c	0xbc9e4	0xbbde4	0x5e
FtpOpenFileW	0x0	0x48f7a0	0xbc9e8	0xbbde8	0x35
FtpGetFileSize	0x0	0x48f7a4	0xbc9ec	0xbbdec	0x32
InternetOpenUrlW	0x0	0x48f7a8	0xbc9f0	0xbbdf0	0x99
InternetReadFile	0x0	0x48f7ac	0xbc9f4	0xbbdf4	0x9f
InternetConnectW	0x0	0x48f7b0	0xbc9f8	0xbbdf8	0x72

PSAPI.DLL (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetProcessMemoryInfo	0x0	0x48f484	0xbc6cc	0xbbacc	0x15

IPHLPAPI.DLL (3)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
IcmpCreateFile	0x0	0x48f154	0xbc39c	0xbb79c	0x85
IcmpCloseHandle	0x0	0x48f158	0xbc3a0	0xbb7a0	0x84
IcmpSendEcho	0x0	0x48f15c	0xbc3a4	0xbb7a4	0x87

USERENV.dll (4)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DestroyEnvironmentBlock	0x0	0x48f750	0xbc998	0xbbd98	0x4
UnloadUserProfile	0x0	0x48f754	0xbc99c	0xbbd9c	0x2c
CreateEnvironmentBlock	0x0	0x48f758	0xbc9a0	0xbbda0	0x0
LoadUserProfileW	0x0	0x48f75c	0xbc9a4	0xbbda4	0x21

UxTheme.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
IsThemeActive	0x0	0x48f764	0xbc9ac	0xbbdac	0x3f

KERNEL32.dll (164)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DuplicateHandle	0x0	0x48f164	0xbc3ac	0xbb7ac	0xe8
CreateThread	0x0	0x48f168	0xbc3b0	0xbb7b0	0xb5
WaitForSingleObject	0x0	0x48f16c	0xbc3b4	0xbb7b4	0x4f9
HeapAlloc	0x0	0x48f170	0xbc3b8	0xbb7b8	0x2cb
GetProcessHeap	0x0	0x48f174	0xbc3bc	0xbb7bc	0x24a
HeapFree	0x0	0x48f178	0xbc3c0	0xbb7c0	0x2cf
Sleep	0x0	0x48f17c	0xbc3c4	0xbb7c4	0x4b2
GetCurrentThreadId	0x0	0x48f180	0xbc3c8	0xbb7c8	0x1c5
MultiByteToWideChar	0x0	0x48f184	0xbc3cc	0xbb7cc	0x367
MulDiv	0x0	0x48f188	0xbc3d0	0xbb7d0	0x366
GetVersionExW	0x0	0x48f18c	0xbc3d4	0xbb7d4	0x2a4
IsWow64Process	0x0	0x48f190	0xbc3d8	0xbb7d8	0x30e
GetSystemInfo	0x0	0x48f194	0xbc3dc	0xbb7dc	0x273
FreeLibrary	0x0	0x48f198	0xbc3e0	0xbb7e0	0x162
LoadLibraryA	0x0	0x48f19c	0xbc3e4	0xbb7e4	0x33c
GetProcAddress	0x0	0x48f1a0	0xbc3e8	0xbb7e8	0x245
SetErrorMode	0x0	0x48f1a4	0xbc3ec	0xbb7ec	0x458
GetModuleFileNameW	0x0	0x48f1a8	0xbc3f0	0xbb7f0	0x214
WideCharToMultiByte	0x0	0x48f1ac	0xbc3f4	0xbb7f4	0x511
lstrcpyW	0x0	0x48f1b0	0xbc3f8	0xbb7f8	0x548
lstrlenW	0x0	0x48f1b4	0xbc3fc	0xbb7fc	0x54e
GetModuleHandleW	0x0	0x48f1b8	0xbc400	0xbb800	0x218
QueryPerformanceCounter	0x0	0x48f1bc	0xbc404	0xbb804	0x3a7
VirtualFreeEx	0x0	0x48f1c0	0xbc408	0xbb808	0x4ed
OpenProcess	0x0	0x48f1c4	0xbc40c	0xbb80c	0x380
VirtualAllocEx	0x0	0x48f1c8	0xbc410	0xbb810	0x4ea
WriteProcessMemory	0x0	0x48f1cc	0xbc414	0xbb814	0x52e
ReadProcessMemory	0x0	0x48f1d0	0xbc418	0xbb818	0x3c3
CreateFileW	0x0	0x48f1d4	0xbc41c	0xbb81c	0x8f
SetFilePointerEx	0x0	0x48f1d8	0xbc420	0xbb820	0x467
SetEndOfFile	0x0	0x48f1dc	0xbc424	0xbb824	0x453
ReadFile	0x0	0x48f1e0	0xbc428	0xbb828	0x3c0
WriteFile	0x0	0x48f1e4	0xbc42c	0xbb82c	0x525
FlushFileBuffers	0x0	0x48f1e8	0xbc430	0xbb830	0x157
TerminateProcess	0x0	0x48f1ec	0xbc434	0xbb834	0x4c0
CreateToolhelp32Snapshot	0x0	0x48f1f0	0xbc438	0xbb838	0xbe
Process32FirstW	0x0	0x48f1f4	0xbc43c	0xbb83c	0x396
Process32NextW	0x0	0x48f1f8	0xbc440	0xbb840	0x398
SetFileTime	0x0	0x48f1fc	0xbc444	0xbb844	0x46a
GetFileAttributesW	0x0	0x48f200	0xbc448	0xbb848	0x1ea
FindFirstFileW	0x0	0x48f204	0xbc44c	0xbb84c	0x139
SetCurrentDirectoryW	0x0	0x48f208	0xbc450	0xbb850	0x44d
GetLongPathNameW	0x0	0x48f20c	0xbc454	0xbb854	0x20f
GetShortPathNameW	0x0	0x48f210	0xbc458	0xbb858	0x261
DeleteFileW	0x0	0x48f214	0xbc45c	0xbb85c	0xd6
FindNextFileW	0x0	0x48f218	0xbc460	0xbb860	0x145
CopyFileExW	0x0	0x48f21c	0xbc464	0xbb864	0x72
MoveFileW	0x0	0x48f220	0xbc468	0xbb868	0x363
CreateDirectoryW	0x0	0x48f224	0xbc46c	0xbb86c	0x81
RemoveDirectoryW	0x0	0x48f228	0xbc470	0xbb870	0x403
SetSystemPowerState	0x0	0x48f22c	0xbc474	0xbb874	0x48a
QueryPerformanceFrequency	0x0	0x48f230	0xbc478	0xbb878	0x3a8
FindResourceW	0x0	0x48f234	0xbc47c	0xbb87c	0x14e
LoadResource	0x0	0x48f238	0xbc480	0xbb880	0x341
LockResource	0x0	0x48f23c	0xbc484	0xbb884	0x354
SizeofResource	0x0	0x48f240	0xbc488	0xbb888	0x4b1
EnumResourceNamesW	0x0	0x48f244	0xbc48c	0xbb88c	0x102
OutputDebugStringW	0x0	0x48f248	0xbc490	0xbb890	0x38a
GetTempPathW	0x0	0x48f24c	0xbc494	0xbb894	0x285
GetTempFileNameW	0x0	0x48f250	0xbc498	0xbb898	0x283
DeviceIoControl	0x0	0x48f254	0xbc49c	0xbb89c	0xdd
GetLocalTime	0x0	0x48f258	0xbc4a0	0xbb8a0	0x203
CompareStringW	0x0	0x48f25c	0xbc4a4	0xbb8a4	0x64
GetCurrentProcess	0x0	0x48f260	0xbc4a8	0xbb8a8	0x1c0
EnterCriticalSection	0x0	0x48f264	0xbc4ac	0xbb8ac	0xee
LeaveCriticalSection	0x0	0x48f268	0xbc4b0	0xbb8b0	0x339
GetStdHandle	0x0	0x48f26c	0xbc4b4	0xbb8b4	0x264
CreatePipe	0x0	0x48f270	0xbc4b8	0xbb8b8	0xa1
InterlockedExchange	0x0	0x48f274	0xbc4bc	0xbb8bc	0x2ec
TerminateThread	0x0	0x48f278	0xbc4c0	0xbb8c0	0x4c1
LoadLibraryExW	0x0	0x48f27c	0xbc4c4	0xbb8c4	0x33e
FindResourceExW	0x0	0x48f280	0xbc4c8	0xbb8c8	0x14d
CopyFileW	0x0	0x48f284	0xbc4cc	0xbb8cc	0x75
VirtualFree	0x0	0x48f288	0xbc4d0	0xbb8d0	0x4ec
FormatMessageW	0x0	0x48f28c	0xbc4d4	0xbb8d4	0x15e
GetExitCodeProcess	0x0	0x48f290	0xbc4d8	0xbb8d8	0x1df
GetPrivateProfileStringW	0x0	0x48f294	0xbc4dc	0xbb8dc	0x242
WritePrivateProfileStringW	0x0	0x48f298	0xbc4e0	0xbb8e0	0x52b
GetPrivateProfileSectionW	0x0	0x48f29c	0xbc4e4	0xbb8e4	0x240
WritePrivateProfileSectionW	0x0	0x48f2a0	0xbc4e8	0xbb8e8	0x529
GetPrivateProfileSectionNamesW	0x0	0x48f2a4	0xbc4ec	0xbb8ec	0x23f
FileTimeToLocalFileTime	0x0	0x48f2a8	0xbc4f0	0xbb8f0	0x124
FileTimeToSystemTime	0x0	0x48f2ac	0xbc4f4	0xbb8f4	0x125
SystemTimeToFileTime	0x0	0x48f2b0	0xbc4f8	0xbb8f8	0x4bd
LocalFileTimeToFileTime	0x0	0x48f2b4	0xbc4fc	0xbb8fc	0x346
GetDriveTypeW	0x0	0x48f2b8	0xbc500	0xbb900	0x1d3
GetDiskFreeSpaceExW	0x0	0x48f2bc	0xbc504	0xbb904	0x1ce
GetDiskFreeSpaceW	0x0	0x48f2c0	0xbc508	0xbb908	0x1cf
GetVolumeInformationW	0x0	0x48f2c4	0xbc50c	0xbb90c	0x2a7
SetVolumeLabelW	0x0	0x48f2c8	0xbc510	0xbb910	0x4a9
CreateHardLinkW	0x0	0x48f2cc	0xbc514	0xbb914	0x93
SetFileAttributesW	0x0	0x48f2d0	0xbc518	0xbb918	0x461
CreateEventW	0x0	0x48f2d4	0xbc51c	0xbb91c	0x85
SetEvent	0x0	0x48f2d8	0xbc520	0xbb920	0x459
GetEnvironmentVariableW	0x0	0x48f2dc	0xbc524	0xbb924	0x1dc
SetEnvironmentVariableW	0x0	0x48f2e0	0xbc528	0xbb928	0x457
GlobalLock	0x0	0x48f2e4	0xbc52c	0xbb92c	0x2be
GlobalUnlock	0x0	0x48f2e8	0xbc530	0xbb930	0x2c5
GlobalAlloc	0x0	0x48f2ec	0xbc534	0xbb934	0x2b3
GetFileSize	0x0	0x48f2f0	0xbc538	0xbb938	0x1f0
GlobalFree	0x0	0x48f2f4	0xbc53c	0xbb93c	0x2ba
GlobalMemoryStatusEx	0x0	0x48f2f8	0xbc540	0xbb940	0x2c0
Beep	0x0	0x48f2fc	0xbc544	0xbb944	0x36
GetSystemDirectoryW	0x0	0x48f300	0xbc548	0xbb948	0x270
HeapReAlloc	0x0	0x48f304	0xbc54c	0xbb94c	0x2d2
HeapSize	0x0	0x48f308	0xbc550	0xbb950	0x2d4
GetComputerNameW	0x0	0x48f30c	0xbc554	0xbb954	0x18f
GetWindowsDirectoryW	0x0	0x48f310	0xbc558	0xbb958	0x2af
GetCurrentProcessId	0x0	0x48f314	0xbc55c	0xbb95c	0x1c1
GetProcessIoCounters	0x0	0x48f318	0xbc560	0xbb960	0x24e
CreateProcessW	0x0	0x48f31c	0xbc564	0xbb964	0xa8
GetProcessId	0x0	0x48f320	0xbc568	0xbb968	0x24c
SetPriorityClass	0x0	0x48f324	0xbc56c	0xbb96c	0x47d
LoadLibraryW	0x0	0x48f328	0xbc570	0xbb970	0x33f
VirtualAlloc	0x0	0x48f32c	0xbc574	0xbb974	0x4e9
IsDebuggerPresent	0x0	0x48f330	0xbc578	0xbb978	0x300
GetCurrentDirectoryW	0x0	0x48f334	0xbc57c	0xbb97c	0x1bf
lstrcmpiW	0x0	0x48f338	0xbc580	0xbb980	0x545
DecodePointer	0x0	0x48f33c	0xbc584	0xbb984	0xca
GetLastError	0x0	0x48f340	0xbc588	0xbb988	0x202
RaiseException	0x0	0x48f344	0xbc58c	0xbb98c	0x3b1
InitializeCriticalSectionAndSpinCount	0x0	0x48f348	0xbc590	0xbb990	0x2e3
DeleteCriticalSection	0x0	0x48f34c	0xbc594	0xbb994	0xd1
InterlockedDecrement	0x0	0x48f350	0xbc598	0xbb998	0x2eb
InterlockedIncrement	0x0	0x48f354	0xbc59c	0xbb99c	0x2ef
GetCurrentThread	0x0	0x48f358	0xbc5a0	0xbb9a0	0x1c4
CloseHandle	0x0	0x48f35c	0xbc5a4	0xbb9a4	0x52
GetFullPathNameW	0x0	0x48f360	0xbc5a8	0xbb9a8	0x1fb
EncodePointer	0x0	0x48f364	0xbc5ac	0xbb9ac	0xea
ExitProcess	0x0	0x48f368	0xbc5b0	0xbb9b0	0x119
GetModuleHandleExW	0x0	0x48f36c	0xbc5b4	0xbb9b4	0x217
ExitThread	0x0	0x48f370	0xbc5b8	0xbb9b8	0x11a
GetSystemTimeAsFileTime	0x0	0x48f374	0xbc5bc	0xbb9bc	0x279
ResumeThread	0x0	0x48f378	0xbc5c0	0xbb9c0	0x413
GetCommandLineW	0x0	0x48f37c	0xbc5c4	0xbb9c4	0x187
IsProcessorFeaturePresent	0x0	0x48f380	0xbc5c8	0xbb9c8	0x304
IsValidCodePage	0x0	0x48f384	0xbc5cc	0xbb9cc	0x30a
GetACP	0x0	0x48f388	0xbc5d0	0xbb9d0	0x168
GetOEMCP	0x0	0x48f38c	0xbc5d4	0xbb9d4	0x237
GetCPInfo	0x0	0x48f390	0xbc5d8	0xbb9d8	0x172
SetLastError	0x0	0x48f394	0xbc5dc	0xbb9dc	0x473
UnhandledExceptionFilter	0x0	0x48f398	0xbc5e0	0xbb9e0	0x4d3
SetUnhandledExceptionFilter	0x0	0x48f39c	0xbc5e4	0xbb9e4	0x4a5
TlsAlloc	0x0	0x48f3a0	0xbc5e8	0xbb9e8	0x4c5
TlsGetValue	0x0	0x48f3a4	0xbc5ec	0xbb9ec	0x4c7
TlsSetValue	0x0	0x48f3a8	0xbc5f0	0xbb9f0	0x4c8
TlsFree	0x0	0x48f3ac	0xbc5f4	0xbb9f4	0x4c6
GetStartupInfoW	0x0	0x48f3b0	0xbc5f8	0xbb9f8	0x263
GetStringTypeW	0x0	0x48f3b4	0xbc5fc	0xbb9fc	0x269
SetStdHandle	0x0	0x48f3b8	0xbc600	0xbba00	0x487
GetFileType	0x0	0x48f3bc	0xbc604	0xbba04	0x1f3
GetConsoleCP	0x0	0x48f3c0	0xbc608	0xbba08	0x19a
GetConsoleMode	0x0	0x48f3c4	0xbc60c	0xbba0c	0x1ac
RtlUnwind	0x0	0x48f3c8	0xbc610	0xbba10	0x418
ReadConsoleW	0x0	0x48f3cc	0xbc614	0xbba14	0x3be
GetTimeZoneInformation	0x0	0x48f3d0	0xbc618	0xbba18	0x298
GetDateFormatW	0x0	0x48f3d4	0xbc61c	0xbba1c	0x1c8
GetTimeFormatW	0x0	0x48f3d8	0xbc620	0xbba20	0x297
LCMapStringW	0x0	0x48f3dc	0xbc624	0xbba24	0x32d
GetEnvironmentStringsW	0x0	0x48f3e0	0xbc628	0xbba28	0x1da
FreeEnvironmentStringsW	0x0	0x48f3e4	0xbc62c	0xbba2c	0x161
WriteConsoleW	0x0	0x48f3e8	0xbc630	0xbba30	0x524
FindClose	0x0	0x48f3ec	0xbc634	0xbba34	0x12e
SetEnvironmentVariableA	0x0	0x48f3f0	0xbc638	0xbba38	0x456

USER32.dll (160)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
AdjustWindowRectEx	0x0	0x48f4cc	0xbc714	0xbbb14	0x3
CopyImage	0x0	0x48f4d0	0xbc718	0xbbb18	0x54
SetWindowPos	0x0	0x48f4d4	0xbc71c	0xbbb1c	0x2c6
GetCursorInfo	0x0	0x48f4d8	0xbc720	0xbbb20	0x11f
RegisterHotKey	0x0	0x48f4dc	0xbc724	0xbbb24	0x256
ClientToScreen	0x0	0x48f4e0	0xbc728	0xbbb28	0x47
GetKeyboardLayoutNameW	0x0	0x48f4e4	0xbc72c	0xbbb2c	0x141
IsCharAlphaW	0x0	0x48f4e8	0xbc730	0xbbb30	0x1c4
IsCharAlphaNumericW	0x0	0x48f4ec	0xbc734	0xbbb34	0x1c3
IsCharLowerW	0x0	0x48f4f0	0xbc738	0xbbb38	0x1c6
IsCharUpperW	0x0	0x48f4f4	0xbc73c	0xbbb3c	0x1c8
GetMenuStringW	0x0	0x48f4f8	0xbc740	0xbbb40	0x158
GetSubMenu	0x0	0x48f4fc	0xbc744	0xbbb44	0x17a
GetCaretPos	0x0	0x48f500	0xbc748	0xbbb48	0x10a
IsZoomed	0x0	0x48f504	0xbc74c	0xbbb4c	0x1e2
MonitorFromPoint	0x0	0x48f508	0xbc750	0xbbb50	0x218
GetMonitorInfoW	0x0	0x48f50c	0xbc754	0xbbb54	0x15f
SetWindowLongW	0x0	0x48f510	0xbc758	0xbbb58	0x2c4
SetLayeredWindowAttributes	0x0	0x48f514	0xbc75c	0xbbb5c	0x298
FlashWindow	0x0	0x48f518	0xbc760	0xbbb60	0xfb
GetClassLongW	0x0	0x48f51c	0xbc764	0xbbb64	0x110
TranslateAcceleratorW	0x0	0x48f520	0xbc768	0xbbb68	0x2fa
IsDialogMessageW	0x0	0x48f524	0xbc76c	0xbbb6c	0x1cd
GetSysColor	0x0	0x48f528	0xbc770	0xbbb70	0x17b
InflateRect	0x0	0x48f52c	0xbc774	0xbbb74	0x1b5
DrawFocusRect	0x0	0x48f530	0xbc778	0xbbb78	0xc4
DrawTextW	0x0	0x48f534	0xbc77c	0xbbb7c	0xd0
FrameRect	0x0	0x48f538	0xbc780	0xbbb80	0xfd
DrawFrameControl	0x0	0x48f53c	0xbc784	0xbbb84	0xc6
FillRect	0x0	0x48f540	0xbc788	0xbbb88	0xf6
PtInRect	0x0	0x48f544	0xbc78c	0xbbb8c	0x240
DestroyAcceleratorTable	0x0	0x48f548	0xbc790	0xbbb90	0xa0
CreateAcceleratorTableW	0x0	0x48f54c	0xbc794	0xbbb94	0x58
SetCursor	0x0	0x48f550	0xbc798	0xbbb98	0x288
GetWindowDC	0x0	0x48f554	0xbc79c	0xbbb9c	0x192
GetSystemMetrics	0x0	0x48f558	0xbc7a0	0xbbba0	0x17e
GetActiveWindow	0x0	0x48f55c	0xbc7a4	0xbbba4	0x100
CharNextW	0x0	0x48f560	0xbc7a8	0xbbba8	0x31
wsprintfW	0x0	0x48f564	0xbc7ac	0xbbbac	0x333
RedrawWindow	0x0	0x48f568	0xbc7b0	0xbbbb0	0x24a
DrawMenuBar	0x0	0x48f56c	0xbc7b4	0xbbbb4	0xc9
DestroyMenu	0x0	0x48f570	0xbc7b8	0xbbbb8	0xa4
SetMenu	0x0	0x48f574	0xbc7bc	0xbbbbc	0x29c
GetWindowTextLengthW	0x0	0x48f578	0xbc7c0	0xbbbc0	0x1a2
CreateMenu	0x0	0x48f57c	0xbc7c4	0xbbbc4	0x6a
IsDlgButtonChecked	0x0	0x48f580	0xbc7c8	0xbbbc8	0x1ce
DefDlgProcW	0x0	0x48f584	0xbc7cc	0xbbbcc	0x95
CallWindowProcW	0x0	0x48f588	0xbc7d0	0xbbbd0	0x1e
ReleaseCapture	0x0	0x48f58c	0xbc7d4	0xbbbd4	0x264
SetCapture	0x0	0x48f590	0xbc7d8	0xbbbd8	0x280
CreateIconFromResourceEx	0x0	0x48f594	0xbc7dc	0xbbbdc	0x66
mouse_event	0x0	0x48f598	0xbc7e0	0xbbbe0	0x331
ExitWindowsEx	0x0	0x48f59c	0xbc7e4	0xbbbe4	0xf5
SetActiveWindow	0x0	0x48f5a0	0xbc7e8	0xbbbe8	0x27f
FindWindowExW	0x0	0x48f5a4	0xbc7ec	0xbbbec	0xf9
EnumThreadWindows	0x0	0x48f5a8	0xbc7f0	0xbbbf0	0xef
SetMenuDefaultItem	0x0	0x48f5ac	0xbc7f4	0xbbbf4	0x29e
InsertMenuItemW	0x0	0x48f5b0	0xbc7f8	0xbbbf8	0x1b9
IsMenu	0x0	0x48f5b4	0xbc7fc	0xbbbfc	0x1d2
TrackPopupMenuEx	0x0	0x48f5b8	0xbc800	0xbbc00	0x2f7
GetCursorPos	0x0	0x48f5bc	0xbc804	0xbbc04	0x120
DeleteMenu	0x0	0x48f5c0	0xbc808	0xbbc08	0x9e
SetRect	0x0	0x48f5c4	0xbc80c	0xbbc0c	0x2ae
GetMenuItemID	0x0	0x48f5c8	0xbc810	0xbbc10	0x152
GetMenuItemCount	0x0	0x48f5cc	0xbc814	0xbbc14	0x151
SetMenuItemInfoW	0x0	0x48f5d0	0xbc818	0xbbc18	0x2a2
GetMenuItemInfoW	0x0	0x48f5d4	0xbc81c	0xbbc1c	0x154
SetForegroundWindow	0x0	0x48f5d8	0xbc820	0xbbc20	0x293
IsIconic	0x0	0x48f5dc	0xbc824	0xbbc24	0x1d1
FindWindowW	0x0	0x48f5e0	0xbc828	0xbbc28	0xfa
MonitorFromRect	0x0	0x48f5e4	0xbc82c	0xbbc2c	0x219
keybd_event	0x0	0x48f5e8	0xbc830	0xbbc30	0x330
SendInput	0x0	0x48f5ec	0xbc834	0xbbc34	0x276
GetAsyncKeyState	0x0	0x48f5f0	0xbc838	0xbbc38	0x107
SetKeyboardState	0x0	0x48f5f4	0xbc83c	0xbbc3c	0x296
GetKeyboardState	0x0	0x48f5f8	0xbc840	0xbbc40	0x142
GetKeyState	0x0	0x48f5fc	0xbc844	0xbbc44	0x13d
VkKeyScanW	0x0	0x48f600	0xbc848	0xbbc48	0x321
LoadStringW	0x0	0x48f604	0xbc84c	0xbbc4c	0x1fa
DialogBoxParamW	0x0	0x48f608	0xbc850	0xbbc50	0xac
MessageBeep	0x0	0x48f60c	0xbc854	0xbbc54	0x20d
EndDialog	0x0	0x48f610	0xbc858	0xbbc58	0xda
SendDlgItemMessageW	0x0	0x48f614	0xbc85c	0xbbc5c	0x273
GetDlgItem	0x0	0x48f618	0xbc860	0xbbc60	0x127
SetWindowTextW	0x0	0x48f61c	0xbc864	0xbbc64	0x2cb
CopyRect	0x0	0x48f620	0xbc868	0xbbc68	0x55
ReleaseDC	0x0	0x48f624	0xbc86c	0xbbc6c	0x265
GetDC	0x0	0x48f628	0xbc870	0xbbc70	0x121
EndPaint	0x0	0x48f62c	0xbc874	0xbbc74	0xdc
BeginPaint	0x0	0x48f630	0xbc878	0xbbc78	0xe
GetClientRect	0x0	0x48f634	0xbc87c	0xbbc7c	0x114
GetMenu	0x0	0x48f638	0xbc880	0xbbc80	0x14b
DestroyWindow	0x0	0x48f63c	0xbc884	0xbbc84	0xa6
EnumWindows	0x0	0x48f640	0xbc888	0xbbc88	0xf2
GetDesktopWindow	0x0	0x48f644	0xbc88c	0xbbc8c	0x123
IsWindow	0x0	0x48f648	0xbc890	0xbbc90	0x1db
IsWindowEnabled	0x0	0x48f64c	0xbc894	0xbbc94	0x1dc
IsWindowVisible	0x0	0x48f650	0xbc898	0xbbc98	0x1e0
EnableWindow	0x0	0x48f654	0xbc89c	0xbbc9c	0xd8
InvalidateRect	0x0	0x48f658	0xbc8a0	0xbbca0	0x1be
GetWindowLongW	0x0	0x48f65c	0xbc8a4	0xbbca4	0x196
GetWindowThreadProcessId	0x0	0x48f660	0xbc8a8	0xbbca8	0x1a4
AttachThreadInput	0x0	0x48f664	0xbc8ac	0xbbcac	0xc
GetFocus	0x0	0x48f668	0xbc8b0	0xbbcb0	0x12c
GetWindowTextW	0x0	0x48f66c	0xbc8b4	0xbbcb4	0x1a3
ScreenToClient	0x0	0x48f670	0xbc8b8	0xbbcb8	0x26d
SendMessageTimeoutW	0x0	0x48f674	0xbc8bc	0xbbcbc	0x27b
EnumChildWindows	0x0	0x48f678	0xbc8c0	0xbbcc0	0xdf
CharUpperBuffW	0x0	0x48f67c	0xbc8c4	0xbbcc4	0x3b
GetParent	0x0	0x48f680	0xbc8c8	0xbbcc8	0x164
GetDlgCtrlID	0x0	0x48f684	0xbc8cc	0xbbccc	0x126
SendMessageW	0x0	0x48f688	0xbc8d0	0xbbcd0	0x27c
MapVirtualKeyW	0x0	0x48f68c	0xbc8d4	0xbbcd4	0x208
PostMessageW	0x0	0x48f690	0xbc8d8	0xbbcd8	0x236
GetWindowRect	0x0	0x48f694	0xbc8dc	0xbbcdc	0x19c
SetUserObjectSecurity	0x0	0x48f698	0xbc8e0	0xbbce0	0x2be
CloseDesktop	0x0	0x48f69c	0xbc8e4	0xbbce4	0x4a
CloseWindowStation	0x0	0x48f6a0	0xbc8e8	0xbbce8	0x4e
OpenDesktopW	0x0	0x48f6a4	0xbc8ec	0xbbcec	0x228
SetProcessWindowStation	0x0	0x48f6a8	0xbc8f0	0xbbcf0	0x2aa
GetProcessWindowStation	0x0	0x48f6ac	0xbc8f4	0xbbcf4	0x168
OpenWindowStationW	0x0	0x48f6b0	0xbc8f8	0xbbcf8	0x22d
GetUserObjectSecurity	0x0	0x48f6b4	0xbc8fc	0xbbcfc	0x18c
MessageBoxW	0x0	0x48f6b8	0xbc900	0xbbd00	0x215
DefWindowProcW	0x0	0x48f6bc	0xbc904	0xbbd04	0x9c
SetClipboardData	0x0	0x48f6c0	0xbc908	0xbbd08	0x286
EmptyClipboard	0x0	0x48f6c4	0xbc90c	0xbbd0c	0xd5
CountClipboardFormats	0x0	0x48f6c8	0xbc910	0xbbd10	0x56
CloseClipboard	0x0	0x48f6cc	0xbc914	0xbbd14	0x49
GetClipboardData	0x0	0x48f6d0	0xbc918	0xbbd18	0x116
IsClipboardFormatAvailable	0x0	0x48f6d4	0xbc91c	0xbbd1c	0x1ca
OpenClipboard	0x0	0x48f6d8	0xbc920	0xbbd20	0x226
BlockInput	0x0	0x48f6dc	0xbc924	0xbbd24	0xf
GetMessageW	0x0	0x48f6e0	0xbc928	0xbbd28	0x15d
LockWindowUpdate	0x0	0x48f6e4	0xbc92c	0xbbd2c	0x1fd
DispatchMessageW	0x0	0x48f6e8	0xbc930	0xbbd30	0xaf
TranslateMessage	0x0	0x48f6ec	0xbc934	0xbbd34	0x2fc
PeekMessageW	0x0	0x48f6f0	0xbc938	0xbbd38	0x233
UnregisterHotKey	0x0	0x48f6f4	0xbc93c	0xbbd3c	0x308
CheckMenuRadioItem	0x0	0x48f6f8	0xbc940	0xbbd40	0x40
CharLowerBuffW	0x0	0x48f6fc	0xbc944	0xbbd44	0x2d
MoveWindow	0x0	0x48f700	0xbc948	0xbbd48	0x21b
SetFocus	0x0	0x48f704	0xbc94c	0xbbd4c	0x292
PostQuitMessage	0x0	0x48f708	0xbc950	0xbbd50	0x237
KillTimer	0x0	0x48f70c	0xbc954	0xbbd54	0x1e3
CreatePopupMenu	0x0	0x48f710	0xbc958	0xbbd58	0x6b
RegisterWindowMessageW	0x0	0x48f714	0xbc95c	0xbbd5c	0x263
SetTimer	0x0	0x48f718	0xbc960	0xbbd60	0x2bb
ShowWindow	0x0	0x48f71c	0xbc964	0xbbd64	0x2df
CreateWindowExW	0x0	0x48f720	0xbc968	0xbbd68	0x6e
RegisterClassExW	0x0	0x48f724	0xbc96c	0xbbd6c	0x24d
LoadIconW	0x0	0x48f728	0xbc970	0xbbd70	0x1ed
LoadCursorW	0x0	0x48f72c	0xbc974	0xbbd74	0x1eb
GetSysColorBrush	0x0	0x48f730	0xbc978	0xbbd78	0x17c
GetForegroundWindow	0x0	0x48f734	0xbc97c	0xbbd7c	0x12d
MessageBoxA	0x0	0x48f738	0xbc980	0xbbd80	0x20e
DestroyIcon	0x0	0x48f73c	0xbc984	0xbbd84	0xa3
SystemParametersInfoW	0x0	0x48f740	0xbc988	0xbbd88	0x2ec
LoadImageW	0x0	0x48f744	0xbc98c	0xbbd8c	0x1ef
GetClassNameW	0x0	0x48f748	0xbc990	0xbbd90	0x112

GDI32.dll (35)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
StrokePath	0x0	0x48f0c4	0xbc30c	0xbb70c	0x2b6
DeleteObject	0x0	0x48f0c8	0xbc310	0xbb710	0xe6
GetTextExtentPoint32W	0x0	0x48f0cc	0xbc314	0xbb714	0x21e
ExtCreatePen	0x0	0x48f0d0	0xbc318	0xbb718	0x132
GetDeviceCaps	0x0	0x48f0d4	0xbc31c	0xbb71c	0x1cb
EndPath	0x0	0x48f0d8	0xbc320	0xbb720	0xf3
SetPixel	0x0	0x48f0dc	0xbc324	0xbb724	0x29b
CloseFigure	0x0	0x48f0e0	0xbc328	0xbb728	0x1e
CreateCompatibleBitmap	0x0	0x48f0e4	0xbc32c	0xbb72c	0x2f
CreateCompatibleDC	0x0	0x48f0e8	0xbc330	0xbb730	0x30
SelectObject	0x0	0x48f0ec	0xbc334	0xbb734	0x277
StretchBlt	0x0	0x48f0f0	0xbc338	0xbb738	0x2b3
GetDIBits	0x0	0x48f0f4	0xbc33c	0xbb73c	0x1ca
LineTo	0x0	0x48f0f8	0xbc340	0xbb740	0x236
AngleArc	0x0	0x48f0fc	0xbc344	0xbb744	0x8
MoveToEx	0x0	0x48f100	0xbc348	0xbb748	0x23a
Ellipse	0x0	0x48f104	0xbc34c	0xbb74c	0xed
DeleteDC	0x0	0x48f108	0xbc350	0xbb750	0xe3
GetPixel	0x0	0x48f10c	0xbc354	0xbb754	0x204
CreateDCW	0x0	0x48f110	0xbc358	0xbb758	0x32
GetStockObject	0x0	0x48f114	0xbc35c	0xbb75c	0x20d
GetTextFaceW	0x0	0x48f118	0xbc360	0xbb760	0x224
CreateFontW	0x0	0x48f11c	0xbc364	0xbb764	0x41
SetTextColor	0x0	0x48f120	0xbc368	0xbb768	0x2a6
PolyDraw	0x0	0x48f124	0xbc36c	0xbb76c	0x250
BeginPath	0x0	0x48f128	0xbc370	0xbb770	0x12
Rectangle	0x0	0x48f12c	0xbc374	0xbb774	0x25f
SetViewportOrgEx	0x0	0x48f130	0xbc378	0xbb778	0x2a9
GetObjectW	0x0	0x48f134	0xbc37c	0xbb77c	0x1fd
SetBkMode	0x0	0x48f138	0xbc380	0xbb780	0x27f
RoundRect	0x0	0x48f13c	0xbc384	0xbb784	0x26a
SetBkColor	0x0	0x48f140	0xbc388	0xbb788	0x27e
CreatePen	0x0	0x48f144	0xbc38c	0xbb78c	0x4b
CreateSolidBrush	0x0	0x48f148	0xbc390	0xbb790	0x54
StrokeAndFillPath	0x0	0x48f14c	0xbc394	0xbb794	0x2b5

COMDLG32.dll (2)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetOpenFileNameW	0x0	0x48f0b8	0xbc300	0xbb700	0xc
GetSaveFileNameW	0x0	0x48f0bc	0xbc304	0xbb704	0xe

ADVAPI32.dll (33)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetAce	0x0	0x48f000	0xbc248	0xbb648	0x123
RegEnumValueW	0x0	0x48f004	0xbc24c	0xbb64c	0x252
RegDeleteValueW	0x0	0x48f008	0xbc250	0xbb650	0x248
RegDeleteKeyW	0x0	0x48f00c	0xbc254	0xbb654	0x244
RegEnumKeyExW	0x0	0x48f010	0xbc258	0xbb658	0x24f
RegSetValueExW	0x0	0x48f014	0xbc25c	0xbb65c	0x27e
RegOpenKeyExW	0x0	0x48f018	0xbc260	0xbb660	0x261
RegCloseKey	0x0	0x48f01c	0xbc264	0xbb664	0x230
RegQueryValueExW	0x0	0x48f020	0xbc268	0xbb668	0x26e
RegConnectRegistryW	0x0	0x48f024	0xbc26c	0xbb66c	0x234
InitializeSecurityDescriptor	0x0	0x48f028	0xbc270	0xbb670	0x177
InitializeAcl	0x0	0x48f02c	0xbc274	0xbb674	0x176
AdjustTokenPrivileges	0x0	0x48f030	0xbc278	0xbb678	0x1f
OpenThreadToken	0x0	0x48f034	0xbc27c	0xbb67c	0x1fc
OpenProcessToken	0x0	0x48f038	0xbc280	0xbb680	0x1f7
LookupPrivilegeValueW	0x0	0x48f03c	0xbc284	0xbb684	0x197
DuplicateTokenEx	0x0	0x48f040	0xbc288	0xbb688	0xdf
CreateProcessAsUserW	0x0	0x48f044	0xbc28c	0xbb68c	0x7c
CreateProcessWithLogonW	0x0	0x48f048	0xbc290	0xbb690	0x7d
GetLengthSid	0x0	0x48f04c	0xbc294	0xbb694	0x136
CopySid	0x0	0x48f050	0xbc298	0xbb698	0x76
LogonUserW	0x0	0x48f054	0xbc29c	0xbb69c	0x18d
AllocateAndInitializeSid	0x0	0x48f058	0xbc2a0	0xbb6a0	0x20
CheckTokenMembership	0x0	0x48f05c	0xbc2a4	0xbb6a4	0x51
RegCreateKeyExW	0x0	0x48f060	0xbc2a8	0xbb6a8	0x239
FreeSid	0x0	0x48f064	0xbc2ac	0xbb6ac	0x120
GetTokenInformation	0x0	0x48f068	0xbc2b0	0xbb6b0	0x15a
GetSecurityDescriptorDacl	0x0	0x48f06c	0xbc2b4	0xbb6b4	0x148
GetAclInformation	0x0	0x48f070	0xbc2b8	0xbb6b8	0x124
AddAce	0x0	0x48f074	0xbc2bc	0xbb6bc	0x16
SetSecurityDescriptorDacl	0x0	0x48f078	0xbc2c0	0xbb6c0	0x2b6
GetUserNameW	0x0	0x48f07c	0xbc2c4	0xbb6c4	0x165
InitiateSystemShutdownExW	0x0	0x48f080	0xbc2c8	0xbb6c8	0x17d

SHELL32.dll (15)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
DragQueryPoint	0x0	0x48f48c	0xbc6d4	0xbbad4	0x20
ShellExecuteExW	0x0	0x48f490	0xbc6d8	0xbbad8	0x121
DragQueryFileW	0x0	0x48f494	0xbc6dc	0xbbadc	0x1f
SHEmptyRecycleBinW	0x0	0x48f498	0xbc6e0	0xbbae0	0xa5
SHGetPathFromIDListW	0x0	0x48f49c	0xbc6e4	0xbbae4	0xd7
SHBrowseForFolderW	0x0	0x48f4a0	0xbc6e8	0xbbae8	0x7b
SHCreateShellItem	0x0	0x48f4a4	0xbc6ec	0xbbaec	0x9a
SHGetDesktopFolder	0x0	0x48f4a8	0xbc6f0	0xbbaf0	0xb6
SHGetSpecialFolderLocation	0x0	0x48f4ac	0xbc6f4	0xbbaf4	0xdf
SHGetFolderPathW	0x0	0x48f4b0	0xbc6f8	0xbbaf8	0xc3
SHFileOperationW	0x0	0x48f4b4	0xbc6fc	0xbbafc	0xac
ExtractIconExW	0x0	0x48f4b8	0xbc700	0xbbb00	0x2a
Shell_NotifyIconW	0x0	0x48f4bc	0xbc704	0xbbb04	0x12e
ShellExecuteW	0x0	0x48f4c0	0xbc708	0xbbb08	0x122
DragFinish	0x0	0x48f4c4	0xbc70c	0xbbb0c	0x1b

ole32.dll (22)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoTaskMemAlloc	0x0	0x48f828	0xbca70	0xbbe70	0x67
CoTaskMemFree	0x0	0x48f82c	0xbca74	0xbbe74	0x68
CLSIDFromString	0x0	0x48f830	0xbca78	0xbbe78	0x8
ProgIDFromCLSID	0x0	0x48f834	0xbca7c	0xbbe7c	0x14b
CLSIDFromProgID	0x0	0x48f838	0xbca80	0xbbe80	0x6
OleSetMenuDescriptor	0x0	0x48f83c	0xbca84	0xbbe84	0x147
MkParseDisplayName	0x0	0x48f840	0xbca88	0xbbe88	0xd4
OleSetContainedObject	0x0	0x48f844	0xbca8c	0xbbe8c	0x146
CoCreateInstance	0x0	0x48f848	0xbca90	0xbbe90	0x10
IIDFromString	0x0	0x48f84c	0xbca94	0xbbe94	0xcd
StringFromGUID2	0x0	0x48f850	0xbca98	0xbbe98	0x179
CreateStreamOnHGlobal	0x0	0x48f854	0xbca9c	0xbbe9c	0x86
OleInitialize	0x0	0x48f858	0xbcaa0	0xbbea0	0x132
OleUninitialize	0x0	0x48f85c	0xbcaa4	0xbbea4	0x149
CoInitialize	0x0	0x48f860	0xbcaa8	0xbbea8	0x3e
CoUninitialize	0x0	0x48f864	0xbcaac	0xbbeac	0x6c
GetRunningObjectTable	0x0	0x48f868	0xbcab0	0xbbeb0	0x97
CoGetInstanceFromFile	0x0	0x48f86c	0xbcab4	0xbbeb4	0x2d
CoGetObject	0x0	0x48f870	0xbcab8	0xbbeb8	0x35
CoSetProxyBlanket	0x0	0x48f874	0xbcabc	0xbbebc	0x63
CoCreateInstanceEx	0x0	0x48f878	0xbcac0	0xbbec0	0x11
CoInitializeSecurity	0x0	0x48f87c	0xbcac4	0xbbec4	0x40

OLEAUT32.dll (29)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
LoadTypeLibEx	0xb7	0x48f40c	0xbc654	0xbba54	-
VariantCopyInd	0xb	0x48f410	0xbc658	0xbba58	-
SysReAllocString	0x3	0x48f414	0xbc65c	0xbba5c	-
SysFreeString	0x6	0x48f418	0xbc660	0xbba60	-
SafeArrayDestroyDescriptor	0x26	0x48f41c	0xbc664	0xbba64	-
SafeArrayDestroyData	0x27	0x48f420	0xbc668	0xbba68	-
SafeArrayUnaccessData	0x18	0x48f424	0xbc66c	0xbba6c	-
SafeArrayAccessData	0x17	0x48f428	0xbc670	0xbba70	-
SafeArrayAllocData	0x25	0x48f42c	0xbc674	0xbba74	-
SafeArrayAllocDescriptorEx	0x29	0x48f430	0xbc678	0xbba78	-
SafeArrayCreateVector	0x19b	0x48f434	0xbc67c	0xbba7c	-
RegisterTypeLib	0xa3	0x48f438	0xbc680	0xbba80	-
CreateStdDispatch	0x20	0x48f43c	0xbc684	0xbba84	-
DispCallFunc	0x92	0x48f440	0xbc688	0xbba88	-
VariantChangeType	0xc	0x48f444	0xbc68c	0xbba8c	-
SysStringLen	0x7	0x48f448	0xbc690	0xbba90	-
VariantTimeToSystemTime	0xb9	0x48f44c	0xbc694	0xbba94	-
VarR8FromDec	0xdc	0x48f450	0xbc698	0xbba98	-
SafeArrayGetVartype	0x4d	0x48f454	0xbc69c	0xbba9c	-
VariantCopy	0xa	0x48f458	0xbc6a0	0xbbaa0	-
VariantClear	0x9	0x48f45c	0xbc6a4	0xbbaa4	-
OleLoadPicture	0x1a2	0x48f460	0xbc6a8	0xbbaa8	-
QueryPathOfRegTypeLib	0xa4	0x48f464	0xbc6ac	0xbbaac	-
RegisterTypeLibForUser	0x1ba	0x48f468	0xbc6b0	0xbbab0	-
UnRegisterTypeLibForUser	0x1bb	0x48f46c	0xbc6b4	0xbbab4	-
UnRegisterTypeLib	0xba	0x48f470	0xbc6b8	0xbbab8	-
CreateDispTypeInfo	0x1f	0x48f474	0xbc6bc	0xbbabc	-
SysAllocString	0x2	0x48f478	0xbc6c0	0xbbac0	-
VariantInit	0x8	0x48f47c	0xbc6c4	0xbbac4	-

Icons (4)

Memory Dumps (2)

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	AV	YARA	Actions
cpelzfoaeotmtgwv.exe	1	0x00F20000	0x01004FFF	Relevant Image		32-bit	0x00F47E93			... Memory Dump Actions Go to Process Download Dump
cpelzfoaeotmtgwv.exe	1	0x00F20000	0x01004FFF	Final Dump		32-bit	-			... Memory Dump Actions Go to Process Download Dump

C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	288 Bytes
MD5	775a593b79668b37ab81a8b57bcd54da
SHA1	2426b78d62ccb0c3181e96d57185379081fd7ff6
SHA256	0201878d1d84e9a16e2ce7b906f6f6faf96388f8db49abcf6faff2cefa5ad878
SSDeep	6:zD+6/YSoY+sKEKgIP+FYJ7LrJ2s9VEW99jTOxraseMAAeD:OMYSoJ1jnPTJ7/dXEUFqrZeMAAeD
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\2QJe.gif.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	73.38 KB
MD5	bd52a2e429fda8e666fc519a3822a5fb
SHA1	d267cf02af7e021e060d96540badb4700b9f7b31
SHA256	bc2a96552fc516499ac6753e678de34187bb59e6a923d09f4c01e7731748ba30
SSDeep	1536:8Cp457+9qNElwWtZz97RcvpcJCgwnDBWsg4glaLVZx8:8CKEl7n2TBVWsK8o
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	512 Bytes
MD5	b74015a035cccc4a9420f77effdc7ab4
SHA1	21b5987668e0549552819aae42bbea344d128fcc
SHA256	c878b9ce3ac0942a72fff093d2e65bc7521dec5c11528a0ef1f242dbfd0d2d4c
SSDeep	12:OMYSoJ1jnPTJ7/dXE5xC9hV39gR2UgfZndzDdMano6TDNDht:1YSy1DPTJ7lmxCJ39guZJDSa5T1j
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\sIXHO5kGeMwYbwbkF\YolrCy1nCVV8mna.jpg.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	28.62 KB
MD5	8c76818c722ae272ac1f69a268f97c73
SHA1	9fdd4a015b9aa6da40041cdf91742fdc5509426f
SHA256	df1c54472bc7bc818678f477c94a506bb83531bf301ea34f93c00647f2ea5766
SSDeep	768:m1J30uxMp54NW1p1cHlFjW+Gcvo3tKj/PUAFK:mr3hx8uNWr1Y+coorK
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	512 Bytes
MD5	b88604bd8276eebbe18641c18f84659c
SHA1	2cee4463a24873b33e4bc66351f46c6599e89b7a
SHA256	fa8910851b38004f5aadd9ebe0e5b6e677f23d29b2cdd2b8fb98d8b68bb7b462
SSDeep	12:OMYSoJ1jnPTJ7/dXEduEL/ikXvaSI+7JhDOuh1GfbWvw1ogq7W:1YSy1DPTJ7lguELfC3wJrh14Wvw1oQ
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\-whmKr.swf.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	71.64 KB
MD5	605cb6229ae732a4ac009fbd3aaad2ca
SHA1	43eb15cc8b3ceda8425ff50e42cac33acb318371
SHA256	cbebe2ed7074d5a74ff4b1a6bda56264a0c9fa729c57801595a4b1d91e2a7181
SSDeep	1536:/FN2fvYzqw7Dy02BtAOI6cSR+lW7s140S5BkQ:yYz5yXIPwS40S/kQ
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\s076wO iQoZmwdX\6BkWVaq2Ptp-JxS5.mp4.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	2.83 KB
MD5	b25f397fa547ae6ae16e7ad02213fdbe
SHA1	b2e76dc77a498cde688732f15467da6d30e090be
SHA256	5b06c81754da7a8cf26754bc166dfa29db4f272b05b38aa8fdd21cc81838040a
SSDeep	48:8mpyEC5Io5G/h6vaZOXtOnk9cD6g+JJRQIFcPzvY/Fu3AuoCpvvadbycQ7:8mRmIEUh3OEnkbjJ+sFu3DoCp6E7
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\s076wO iQoZmwdX\EEeKT BxlxDXMwG.mkv.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	69.94 KB
MD5	3dd8abd04ce41babce14b29cd7487bc7
SHA1	a001ca75c28755dd8da61e578a5d2989c11c0b21
SHA256	8b8d43cb4e18eae06b0f586437f1cdaaa7a5fabb88d523f18ab15fd458518d53
SSDeep	1536:syUm9g1U6zFSg6N6Wv4/k4aPhe3i8d5yVCp6gwza/Mp:s/xe6pV6N6BchhiRd4Vy6gwza0p
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gjBeA8bRUjAV2p\2ouNszpMigJ7mHh2.mkv.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	70.58 KB
MD5	ae2ae0595bc7e97687393fdd00e33731
SHA1	a3d67f4813389ce6f701ad20c25f9604052f5284
SHA256	4415457f674c7d623764693df5a655868c90a9093870cf4d8ac49c3b661b6c91
SSDeep	1536:nRxCyM9sjUt/QGJUUQjE7GR5dwsMdQ+Zejvzjw6:nfCyOXlxc5dwHyjvzjw6
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Videos\gjBeA8bRUjAV2p\Mr3zVpeKFrC_.avi.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	87.61 KB
MD5	d7c958b93d39bdeb6397beb80bd6cd8e
SHA1	b3923b59ab1cf1da82a744460d4136a14c255fa4
SHA256	44ba61d46c8eee8177ba80436328f1d0d91dc08abf7b3072fad837f9a8a71995
SSDeep	1536:yEGR2iZXpvXiobtb+tSWogk+LKf9BGa3tZWPdOM7EszyujhRWW8ZSEjvl7:yRR2iZXJii1Wogk+UOWZiOgE+XRs7d
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\1EXXB Ks.pptx.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	64.23 KB
MD5	89a1c090a5c48b10c16d3056e5649225
SHA1	e0bda23f58944dc07b07c578faf58c736b7fa8b1
SHA256	505cd363d240151a4eeaf66952f7ee7cbf8f8d53f95b72a22291d560907465ae
SSDeep	1536:yaLx856eA6hdYYySXnzdR970lwyA9YbIbja/5goBLdPK+Aee+F:dLxeA6wonzR70lw4bI6xgoBL9XAUF
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	416 Bytes
MD5	9776d97cfe9e43c73d9f09ea3874ab3d
SHA1	937f9858c5ad37c4e9d769ccd2f9f3e384849aa3
SHA256	4aa52b5bb51e3940f4d7f6acc4b62c6ca094f9aab27ff4fd506ede2384b7822d
SSDeep	12:OMYSoJ1jnPTJ7/dXEVzbsfd5z5t54/3sWGr6GI:1YSy1DPTJ7lOerz758GDI
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\E cJa.xlsx.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	72.03 KB
MD5	78399739763e41216cd6f48ba6363f71
SHA1	be50f39fecee42da26d6a6cfd009fa435c99dceb
SHA256	1990f8f3e40cfb121b370b9f46f8a01a94bdc80373f8e0472aa2506c0d7da221
SSDeep	1536:wKUgQLGHMQyz30yptxYuUq+ODOWHNMCVGwYJRaj66rq2YNiP:wj3QybppjYCBDOWHasGwHjZUQ
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\Favorites.vss.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	16 Bytes
MD5	a614576f0130d55b48c8fd4b627f93ba
SHA1	e1ba5a632e3041bf3c184f81d5dee26fd595349e
SHA256	e9e102c6cc9a83653206d7a9867cb609905af09627fc710d90f0bf43df02ea68
SSDeep	3:LUuDR:LP
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\My Shapes\_private\folder.ico.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	29.23 KB
MD5	316b25a053d4385ea999084688ba623f
SHA1	98c4ce3a571b4e201fb880d4f79e6bbcdf9986d7
SHA256	e85d71633ed4500cb0656757d76a8b26e09a3a42a54a41d154ed899d46f71fde
SSDeep	384:cxeHbYXUi1x8tSPJn2I9qHEFmIQvvnXwdQwBSbkaxwb1Ribq3F5VYqJ/chDgI:geHW1xRn2GVs/wRSfoFH/chDZ
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MlokFELk\oPfnNHRjdMys.pptx.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	3.12 KB
MD5	76103da2e81737faa035382083b4b8d9
SHA1	4f4be34b36c2853b07f1b8f0c7a44c68926e2ac8
SHA256	3e77ae208f04bb312babd0244eb4ec6ca1e2b53e206c700dd112963632643563
SSDeep	48:GDEd/okMMcJMKY+XXFH/48gMVWWZHJ0Uv9hSUYQ3bVMRvRPDrrrxlqyDXbd8kmML:NNokpcJMR+HKMVW6HFbVMRvRbrrdDXbP
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\Documents\MlokFELk\Owey.pps.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	68.77 KB
MD5	bbdeec4bc6c41d6e33fa5a4ad2dcc3de
SHA1	9a475ac8ad207ec7f3b73fc5fa80be5ab6737d5d
SHA256	d795825f12f48e5b7d0492fbaaff095b1ac6751d4e31288200f42c55644caa95
SSDeep	1536:Tj/04aUGV4i8LlDg0VF/zR5HvDSqcLv3VU6x36H:Tj/0VHhClBVFR5HvD/cLv3V538
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\edb00001.log.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	2.00 MB
MD5	568ebc6c066b961025718332a063ec32
SHA1	75244f429e18ffdaad0755d3afd9b5820d87f178
SHA256	db10641b19e64b62a4911b6d4e907ed113c23f686d1987f86adb48929390b59a
SSDeep	49152:BAscWoDnmXrsaX7a6vGg05OewCw724KydeuuGQu1ahg5MxiJDjfCP:BV1OnioaXV+PTw6yMNhqzjf6
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	2.02 MB
MD5	8b285a2d8d4e493423738cacdfed55db
SHA1	93d312a1bf998d25ce2fd2bec633c13939023b23
SHA256	f27ee780feee4c374678b65b20e4db0c46124f34a1f35664a0312292a0f09d33
SSDeep	49152:xudG+oq39cv5/uTp2OzXzgOgosH+TWpltUizxE:x59+Y/CpHXzNgoseTGXRxE
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\Themes\Custom.theme.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	1.77 KB
MD5	6a3f942de52970590ab55f71959acb86
SHA1	762ba34e3667ffec7cccc0a5dabc104fafd79112
SHA256	5ec9f0cb66848246a8ae612b788d56bde686f71881c6e1c7e36447337432edb2
SSDeep	48:3EeY3CoVc6zEcicYzp5Y+nqbS1LmYWebRhin5hu:3EZvVbzE2YHTqb4RNnin5hu
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YG1R61Z8\ebHtml5Banner[1].js.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	309.44 KB
MD5	cd16d83260f9de44883431f709bdf829
SHA1	20f5aedbda34b5848bbe46a3c0e4e2839e3a18f8
SHA256	57f2e0bfe99346077c56b3c009c6113a318d8609e666504176a02e918005700e
SSDeep	6144:E4Ezq9kGWaLUj1MxjpvfhGUCXx1lcFszBgS7RFlk8kDRt+3Hzga6XaWp:hVCmjIDl0szZ53Ca3Hzg8s
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IKQEEPZR\AAkqhIf[1].png.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	864 Bytes
MD5	5b8a049fdc4996d44780755ac6040de6
SHA1	44ddcf8b8acd477dfc00439053a205af6704dbcb
SHA256	744785d1f236dc83dcbb7ce59752e80c92a67c55948caac27169569f2fff3a7a
SSDeep	24:sgVqgDU4Gy9qCXvf/W9VMfcpPWlBKu4keup4An6aHx0:sgVt4WEgfFcpOlBKMdp4A6aR0
ImpHash	-

C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.msi.flowEncryption

Dropped File

Stream

Unknown

Mime Type	application/octet-stream
File Size	181.02 KB
MD5	878d617ab85357f0c990ec5f3c16ceb3
SHA1	339071a9483a48154f0bb6968fd6f8e57f0a87f1
SHA256	92e7f4d125c76f886024284675aae5623f37cf0297da07cb76639fd69f61af1c
SSDeep	3072:OKOfGnYAuu5jKqVtFWbylRYDZcjzfSh/p8e0cgQXu/gIjVMxJNH:OK0GnYXu8iebkScjzfShBF0SXu/gIjIH
ImpHash	-

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After