Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
AFC6232A.exe

Overview

General Information

Sample name:AFC6232A.exe
(renamed file extension from old to exe)
Original sample name:AFC6232A.old
Analysis ID:1411150
MD5:6eebfd84787b70079b60a916ec10b3bc
SHA1:9a6ccda7da8f2e37e66b1e946261b25559558117
SHA256:0440a21981dbde1afe56c9abcff162a32fa6fe3179bc58ba7f0b44bc8f6406b1
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

PE file contains an invalid checksum
PE file overlay found
Uses 32bit PE files

Classification

No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: AFC6232A.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: AFC6232A.exeStatic PE information: Data appended to the last section found
Source: AFC6232A.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: unknown1.winEXE@0/0@0/0
Source: AFC6232A.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AFC6232A.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: AFC6232A.exeStatic file information: File size 4227064 > 1048576
Source: AFC6232A.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x2c6200
Source: AFC6232A.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x384000
Source: AFC6232A.exeStatic PE information: More than 200 imports for KERNEL32.dll
Source: AFC6232A.exeStatic PE information: More than 200 imports for USER32.dll
Source: AFC6232A.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AFC6232A.exeStatic PE information: real checksum: 0x6f4c18 should be: 0x409731
No Mitre Att&ck techniques found

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
AFC6232A.exe3%ReversingLabs
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
No contacted IP infos
Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1411150
Start date and time:2024-03-18 17:00:00 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 35s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:1
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:AFC6232A.exe
(renamed file extension from old to exe)
Original Sample Name:AFC6232A.old
Detection:UNKNOWN
Classification:unknown1.winEXE@0/0@0/0
Cookbook Comments:
  • Unable to launch sample, stop analysis
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.
  • Exclude process from analysis (whitelisted): dllhost.exe
  • VT rate limit hit for: AFC6232A.exe
No simulations
No context
No context
No context
No context
No context
No created / dropped files found
File type:PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):6.844955752814552
TrID:
  • Win32 Executable (generic) a (10002005/4) 99.96%
  • Generic Win/DOS Executable (2004/3) 0.02%
  • DOS Executable Generic (2002/1) 0.02%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:AFC6232A.exe
File size:4'227'064 bytes
MD5:6eebfd84787b70079b60a916ec10b3bc
SHA1:9a6ccda7da8f2e37e66b1e946261b25559558117
SHA256:0440a21981dbde1afe56c9abcff162a32fa6fe3179bc58ba7f0b44bc8f6406b1
SHA512:a4921f19f2b4c2f27c3ef587b31c6a9eafa4658d490a7d81a5624359eda06932415ecbf0c09e73f5ee999c3fa9afee4079c614137395a6bc9eace6dc696ca8f0
SSDEEP:98304:EhiaRPglWkES0ej94ZiipojPWUlN3qR0VipKd:EbRow32coT3qR0mKd
TLSH:AA169E20B94140F6D26303319998F1B4E2EF92620BB24AD713D96B2D1E727F27A37577
File Content Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........S...=...=...=.b.....=.b.....=.b.....=..u....=..u....=..u....=...9...=...>...=...8.].=.n.8...=...<...=..u....=.n.4...=.n.....=
Icon Hash:0771ccf8d84d2907
Entrypoint:0x60ae61
Entrypoint Section:.text
Digitally signed:true
Imagebase:0x400000
Subsystem:windows gui
Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:0x60880960 [Tue Apr 27 12:53:52 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:15300863191a38610eb5121dd9ffb839
Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
    Subject Chain
      Version:
      Thumbprint MD5:
      Thumbprint SHA-1:
      Thumbprint SHA-256:
      Serial:
      Instruction
      call 00007F23088DE043h
      jmp 00007F23088DD20Ah
      int3
      push FFFFFFFFh
      push eax
      mov eax, dword ptr fs:[0000h]
      push eax
      mov eax, dword ptr [esp+0Ch]
      mov dword ptr fs:[0000h], esp
      mov dword ptr [esp+0Ch], ebp
      lea ebp, dword ptr [esp+0Ch]
      push eax
      ret
      int3
      int3
      int3
      int3
      int3
      int3
      push 0062B228h
      mov eax, dword ptr fs:[0000h]
      push eax
      mov eax, dword ptr [esp+10h]
      mov dword ptr [esp+10h], ebp
      lea ebp, dword ptr [esp+10h]
      sub esp, eax
      push ebx
      push esi
      push edi
      mov eax, dword ptr [ebp-08h]
      mov dword ptr [ebp-18h], esp
      push eax
      mov eax, dword ptr [ebp-04h]
      mov dword ptr [ebp-04h], FFFFFFFFh
      mov dword ptr [ebp-08h], eax
      lea eax, dword ptr [ebp-10h]
      mov dword ptr fs:[0000h], eax
      ret
      mov ecx, dword ptr [ebp-10h]
      mov dword ptr fs:[0000h], ecx
      pop ecx
      pop edi
      pop esi
      pop ebx
      leave
      push ecx
      ret
      retn 0000h
      push ebp
      mov ebp, esp
      mov eax, dword ptr [ebp+08h]
      mov eax, dword ptr [eax]
      pop ebp
      ret
      push ebp
      mov ebp, esp
      mov eax, dword ptr [ebp+08h]
      mov eax, dword ptr [eax]
      pop ebp
      ret
      mov ecx, dword ptr [006C8DF8h]
      xor eax, eax
      cmp ecx, 0060AEDBh
      setne al
      ret
      mov ecx, dword ptr [ebp-0Ch]
      mov dword ptr fs:[00000000h], ecx
      pop ecx
      pop edi
      pop edi
      pop esi
      pop ebx
      mov esp, ebp
      pop ebp
      push ecx
      ret
      mov ecx, dword ptr [ebp-10h]
      xor ecx, ebp
      call 00007F23088DC780h
      jmp 00007F23098DD3B0h
      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x35d3f40x1a4.rdata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x3720000x383eb8.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x6edc000x1a30.rsrc
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x3213e00x1c.rdata
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x3214b80x18.rdata
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3214000x40.rdata
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x2c80000xdf8.rdata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x2c610b0x2c6200022a3d2b181872139251485068b0e0ebunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .rdata0x2c80000x99fb00x9a000664a136db68adda82c488d7339b559dcFalse0.346387987012987OpenPGP Public Key5.425040366478525IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .data0x3620000xf6440x9600bac88ec76ff8f2c903100e77532eb9c8False0.20221354166666666data4.564704569389282IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      .rsrc0x3720000x383eb80x384000a69aa2fab16214f0e02beb5f73f3ea23unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      NameRVASizeTypeLanguageCountryZLIB Complexity
      AFX_DIALOG_LAYOUT0x372f000x92dataEnglishUnited States0.10273972602739725
      AFX_DIALOG_LAYOUT0x372f980x2dataEnglishUnited States5.0
      AFX_DIALOG_LAYOUT0x372ec00x3adataEnglishUnited States0.2413793103448276
      BIN0x3765e00x1417d0dataEnglishUnited States0.864660413519997
      BIN0x4b7db00x1539f0emptyEnglishUnited States0
      BIN0x60b7a00x175femptyEnglishUnited States0
      BIN0x6116e00x80460emptyEnglishUnited States0
      BIN0x60cf000x47dcemptyEnglishUnited States0
      BIN0x691b400x475e6emptyEnglishUnited States0
      RTF0x6eebd00x35e5emptyEnglishUnited States0
      RT_CURSOR0x6f24800x134emptyEnglishUnited States0
      RT_CURSOR0x6f25b80xb4emptyEnglishUnited States0
      RT_CURSOR0x6f26980x134emptyEnglishUnited States0
      RT_CURSOR0x6f27e80x134emptyEnglishUnited States0
      RT_CURSOR0x6f29380x134emptyEnglishUnited States0
      RT_CURSOR0x6f2a880x134emptyEnglishUnited States0
      RT_CURSOR0x6f2bd80x134emptyEnglishUnited States0
      RT_CURSOR0x6f2d280x134emptyEnglishUnited States0
      RT_CURSOR0x6f2e780x134emptyEnglishUnited States0
      RT_CURSOR0x6f2fc80x134emptyEnglishUnited States0
      RT_CURSOR0x6f31180x134emptyEnglishUnited States0
      RT_CURSOR0x6f32680x134emptyEnglishUnited States0
      RT_CURSOR0x6f33b80x134emptyEnglishUnited States0
      RT_CURSOR0x6f35080x134emptyEnglishUnited States0
      RT_CURSOR0x6f36580x134emptyEnglishUnited States0
      RT_CURSOR0x6f37a80x134emptyEnglishUnited States0
      RT_BITMAP0x6d99980x15232emptyEnglishUnited States0
      RT_BITMAP0x6f3a180xb8emptyEnglishUnited States0
      RT_BITMAP0x6f3ad00x144emptyEnglishUnited States0
      RT_ICON0x372fa00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishUnited States0.36824324324324326
      RT_ICON0x3730c80x568Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colorsEnglishUnited States0.6560693641618497
      RT_ICON0x3736300x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.3118279569892473
      RT_ICON0x3739180x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colorsEnglishUnited States0.7851985559566786
      RT_ICON0x3741c00xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colorsEnglishUnited States0.6751066098081023
      RT_ICON0x3750680x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.8031914893617021
      RT_ICON0x3754d00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.7213883677298312
      RT_DIALOG0x6d92d00x6c4emptyEnglishUnited States0
      RT_DIALOG0x6d91280x1a8emptyEnglishUnited States0
      RT_DIALOG0x6f38f80xe8emptyEnglishUnited States0
      RT_DIALOG0x6f39e00x34emptyEnglishUnited States0
      RT_STRING0x6f3c180x82emptyEnglishUnited States0
      RT_STRING0x6f3ca00x2aemptyEnglishUnited States0
      RT_STRING0x6f3cd00x184emptyEnglishUnited States0
      RT_STRING0x6f3e580x4eeemptyEnglishUnited States0
      RT_STRING0x6f46d80x264emptyEnglishUnited States0
      RT_STRING0x6f43f80x2daemptyEnglishUnited States0
      RT_STRING0x6f51200x8aemptyEnglishUnited States0
      RT_STRING0x6f43480xacemptyEnglishUnited States0
      RT_STRING0x6f50100xdeemptyEnglishUnited States0
      RT_STRING0x6f49400x4a8emptyEnglishUnited States0
      RT_STRING0x6f4de80x228emptyEnglishUnited States0
      RT_STRING0x6f50f00x2cemptyEnglishUnited States0
      RT_STRING0x6f51b00x53eemptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f26700x22emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f2e600x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f27d00x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f2d100x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f2bc00x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f34f00x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f2a700x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f31000x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f29200x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f2fb00x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f32500x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f33a00x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f36400x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f37900x14emptyEnglishUnited States0
      RT_GROUP_CURSOR0x6f38e00x14emptyEnglishUnited States0
      RT_GROUP_ICON0x3765780x68dataEnglishUnited States0.6923076923076923
      RT_VERSION0x6f21b80x2c4emptyEnglishUnited States0
      RT_MANIFEST0x6f56f00x7c1emptyEnglishUnited States0
      DLLImport
      VERSION.dllVerQueryValueA, GetFileVersionInfoA, GetFileVersionInfoSizeA
      KERNEL32.dllSetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, ResetEvent, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, GetTempFileNameA, GetDiskFreeSpaceA, VerifyVersionInfoA, VerSetConditionMask, SystemTimeToTzSpecificLocalTime, SetFileAttributesA, GetFileTime, GetFileSizeEx, GetFileAttributesExA, FileTimeToLocalFileTime, SetErrorMode, FileTimeToSystemTime, GetCPInfo, GetOEMCP, VirtualProtect, GetAtomNameA, GetStringTypeExA, GetThreadLocale, UnhandledExceptionFilter, MoveFileA, GetShortPathNameA, LoadLibraryExA, DuplicateHandle, UnlockFile, SetEndOfFile, LockFile, GetFullPathNameA, GetFileSize, FlushFileBuffers, GetACP, lstrcmpiA, LocalUnlock, LocalLock, GlobalFlags, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetLocaleInfoW, LocalReAlloc, GlobalHandle, CreateFileW, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, SearchPathA, GetProfileIntA, GetVolumeInformationA, GetTempPathA, OutputDebugStringW, SwitchToThread, CompareStringW, LCMapStringW, GetStringTypeW, RtlUnwind, GetUserDefaultLCID, InterlockedFlushSList, VirtualQuery, GetCommandLineA, CreateThread, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetSystemInfo, VirtualAlloc, HeapQueryInformation, QueryPerformanceFrequency, SetStdHandle, GetFileType, ExitProcess, GetStdHandle, GetDateFormatW, GetTimeFormatW, IsValidLocale, EnumSystemLocalesW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExA, EnterCriticalSection, WaitForMultipleObjects, ReleaseMutex, ReleaseSemaphore, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, FormatMessageA, MulDiv, GlobalSize, GetCurrentProcessId, GlobalAddAtomA, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, ResumeThread, SuspendThread, SetThreadPriority, CreateEventA, SetEvent, GlobalFree, GlobalUnlock, GetSystemDirectoryW, lstrcmpA, GlobalDeleteAtom, GlobalLock, GlobalAlloc, LoadLibraryW, GetModuleHandleW, GetModuleFileNameW, GetVersionExA, GetCurrentThread, SetLastError, OutputDebugStringA, FindClose, FindNextFileA, FindFirstFileA, CopyFileA, LocalFree, FindFirstFileExW, FindNextFileW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, LocalAlloc, GetCurrentThreadId, GetVolumeInformationW, InterlockedPushEntrySList, MultiByteToWideChar, FindFirstVolumeW, SetFileTime, GetFileAttributesA, LocalFileTimeToFileTime, GetCurrentDirectoryA, SystemTimeToFileTime, SetFilePointer, GetProcessHeap, DeleteCriticalSection, HeapDestroy, DecodePointer, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, InitializeCriticalSectionEx, HeapFree, TerminateThread, Process32Next, UnmapViewOfFile, MapViewOfFile, OpenFileMappingA, ReadFile, lstrcpynA, GetBinaryTypeA, CreateDirectoryA, GetModuleFileNameA, GetCurrentProcess, GetModuleHandleA, GetProcAddress, GetTickCount, DeleteFileA, WaitForSingleObject, CreateProcessA, WriteFile, CreateFileA, WinExec, lstrlenA, lstrcatA, lstrcpyA, FreeLibrary, LoadLibraryA, GetWindowsDirectoryA, FindResourceW, WideCharToMultiByte, SizeofResource, LockResource, LoadResource, FindResourceA, LoadLibraryExW, EndUpdateResourceW, GetNativeSystemInfo, IsValidCodePage, EncodePointer, VirtualLock, IsBadHugeWritePtr, DefineDosDeviceA, CloseHandle, Sleep, GetCommandLineW, CreateMutexA, SignalObjectAndWait, InitOnceExecuteOnce, DebugBreakProcess, SetThreadpoolTimer, GlobalAddAtomW, DeactivateActCtx, SetProcessWorkingSetSizeEx, GetErrorMode, CreateThreadpoolWork, SetCommMask, GetComputerNameExW, CreateSemaphoreA, RequestDeviceWakeup, FlsSetValue, CreateEventW, ReadConsoleInputA, FindVolumeClose, CreateEventExW, OpenJobObjectW, FindResourceExW, CompareStringA, LockFileEx, EnumResourceNamesExW, CallbackMayRunLong, GetLastError, SetEnvironmentVariableW, SetConsoleCtrlHandler, WriteConsoleW, ReplaceFileA
      USER32.dllDrawFrameControl, DrawEdge, SetParent, SetWindowRgn, SetClassLongA, DrawStateA, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, EnumDisplayMonitors, SetLayeredWindowAttributes, NotifyWinEvent, InvertRect, HideCaret, EnableScrollBar, GetIconInfo, DrawIconEx, IsRectEmpty, DrawFocusRect, GetNextDlgGroupItem, GetMenuDefaultItem, ReuseDDElParam, GetMenuBarInfo, LoadImageA, InsertMenuItemA, CreatePopupMenu, LoadMenuA, TranslateAcceleratorA, LoadAcceleratorsA, BringWindowToTop, LoadImageW, TrackMouseEvent, MapDialogRect, GetAsyncKeyState, GetMenuItemInfoA, DestroyMenu, CharUpperA, DestroyIcon, GetSysColorBrush, GetDialogBaseUnits, SetRect, GetTabbedTextExtentA, IsClipboardFormatAvailable, RealChildWindowFromPoint, DeleteMenu, CopyImage, LoadCursorW, ReleaseCapture, SetCapture, WaitMessage, MsgWaitForMultipleObjectsEx, IntersectRect, WindowFromPoint, FillRect, ClientToScreen, GetWindowDC, TabbedTextOutA, GrayStringA, DrawTextExA, DrawTextA, OffsetRect, SetRectEmpty, IsDialogMessageA, SetWindowTextA, ScrollWindowEx, SendDlgItemMessageA, IsDlgButtonChecked, CheckRadioButton, CheckDlgButton, GetDlgItemTextA, SetDlgItemTextA, GetDlgItemInt, SetDlgItemInt, MoveWindow, ShowWindow, GetMonitorInfoA, MonitorFromWindow, WinHelpA, GetScrollInfo, SetScrollInfo, LoadIconA, UnhookWindowsHookEx, LoadMenuW, GetTopWindow, GetClassNameA, GetClassLongA, EqualRect, MapWindowPoints, AdjustWindowRectEx, GetWindowTextLengthA, GetWindowTextA, RemovePropA, GetPropA, SetPropA, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, ScrollWindow, RedrawWindow, EndPaint, BeginPaint, UnpackDDElParam, TrackPopupMenuEx, TrackPopupMenu, SetMenu, GetMenu, GetCapture, SetFocus, GetDlgCtrlID, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, SetWindowPos, IsChild, IsMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, GetSystemMenu, SetCursorPos, FrameRect, UnionRect, UpdateLayeredWindow, MonitorFromPoint, GetComboBoxInfo, PostThreadMessageA, GetKeyboardLayout, IsCharLowerA, MapVirtualKeyExA, GetKeyboardState, ToAsciiEx, LoadAcceleratorsW, CreateAcceleratorTableA, DestroyAcceleratorTable, CopyAcceleratorTableA, LockWindowUpdate, SetMenuDefaultItem, RegisterClassA, CallWindowProcA, GetDoubleClickTime, ModifyMenuA, RegisterClipboardFormatA, CharUpperBuffA, GetUpdateRect, GetDCEx, EnumChildWindows, DrawMenuBar, DefFrameProcA, DefMDIChildProcA, TranslateMDISysAccel, SubtractRect, DefWindowProcA, GetMessageTime, RegisterWindowMessageA, RemoveMenu, AppendMenuA, InsertMenuA, GetMenuItemCount, GetMenuItemID, GetSubMenu, GetMenuState, GetMenuStringA, GetLastActivePopup, ShowOwnedPopups, CallNextHookEx, SetWindowsHookExA, GetCursorPos, ValidateRect, GetKeyState, IsWindowVisible, PeekMessageA, DispatchMessageA, TranslateMessage, GetMessageA, LoadBitmapW, SetMenuItemInfoA, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, GetFocus, CopyRect, MapVirtualKeyA, GetKeyNameTextA, GetDesktopWindow, GetWindowLongA, SetActiveWindow, IsWindowEnabled, GetActiveWindow, GetNextDlgTabItem, GetDlgItem, EndDialog, CreateDialogIndirectParamA, DestroyWindow, IsZoomed, SendNotifyMessageA, MonitorFromRect, InSendMessage, CreateMenu, WindowFromDC, GetWindowRgn, DestroyCursor, GetTabbedTextExtentW, GetWindow, UpdateWindow, PostQuitMessage, GetWindowThreadProcessId, AllowSetForegroundWindow, LockSetForegroundWindow, AttachThreadInput, GetForegroundWindow, SystemParametersInfoA, SetForegroundWindow, UnregisterClassA, PostMessageA, wsprintfA, CopyIcon, LoadCursorA, InflateRect, ReleaseDC, GetDC, GetParent, IsWindow, SetCursor, PtInRect, ScreenToClient, GetMessagePos, SetTimer, InvalidateRect, MessageBeep, SetWindowLongA, KillTimer, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, GetWindowRect, GetSysColor, SendMessageA, LoadIconW, EnableWindow, MessageBoxA, UpdateLayeredWindowIndirect, InternalGetWindowText, CreateCaret
      GDI32.dllSetAbortProc, CreateFontA, StretchDIBits, EnumFontFamiliesExA, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, GetBkColor, CreateDIBitmap, EnumFontFamiliesA, GetTextCharsetInfo, GetDIBits, SetPixel, StretchBlt, CreateDIBSection, SetDIBColorTable, CreateEllipticRgn, Ellipse, GetTextColor, CreatePolygonRgn, Polygon, Polyline, CreateRoundRectRgn, LPtoDP, Rectangle, AbortDoc, OffsetRgn, GetCurrentObject, RoundRect, FillRgn, FrameRgn, GetBoundsRect, PtInRegion, ExtFloodFill, SetPaletteEntries, SetPixelV, GetWindowOrgEx, GetViewportOrgEx, CloseMetaFile, CreateMetaFileA, DeleteMetaFile, GetROP2, GetBkMode, GetNearestColor, GetPolyFillMode, GetStretchBltMode, GetTextAlign, GetTextExtentPointA, GetTextExtentPoint32W, GetTextFaceA, SetROP2, SetPolyFillMode, GetLayout, EndPage, SetStretchBltMode, StartPage, EndDoc, CreateCompatibleBitmap, GetTextMetricsA, GetCharWidthA, DPtoLP, SetRectRgn, GetMapMode, CombineRgn, ScaleWindowExtEx, ScaleViewportExtEx, OffsetWindowOrgEx, OffsetViewportOrgEx, SetWindowOrgEx, SetWindowExtEx, SetViewportOrgEx, SetViewportExtEx, PolylineTo, PolyBezierTo, ExtTextOutA, TextOutA, MoveToEx, ExtCreatePen, SetArcDirection, SelectClipPath, PolyDraw, ArcTo, StartDocA, SetColorAdjustment, ModifyWorldTransform, SetWorldTransform, EnumMetaFile, PlayMetaFileRecord, SetTextJustification, SetTextAlign, GetRgnBox, Escape, SetLayout, SetMapMode, SetGraphicsMode, SetMapperFlags, SetBkMode, SelectPalette, SelectObject, ExtSelectClipRgn, SelectClipRgn, SaveDC, RestoreDC, RectVisible, PtVisible, PlayMetaFile, OffsetClipRgn, LineTo, IntersectClipRect, GetWindowExtEx, GetViewportExtEx, GetPixel, GetObjectType, GetCurrentPositionEx, GetClipRgn, GetClipBox, ExcludeClipRect, GetStockObject, GetObjectA, CreateFontIndirectA, GetTextExtentPoint32A, CreateRectRgnIndirect, PatBlt, CreateBitmap, CopyMetaFileA, CreateDCA, GetDeviceCaps, SetBkColor, SetTextColor, BitBlt, CreateCompatibleDC, CreateDIBPatternBrushPt, CreateHatchBrush, CreatePen, CreatePatternBrush, CreateRectRgn, CreateSolidBrush, DeleteDC, DeleteObject, SetTextCharacterExtra
      MSIMG32.dllTransparentBlt, AlphaBlend
      WINSPOOL.DRVOpenPrinterA, DocumentPropertiesA, ClosePrinter, GetJobA
      ADVAPI32.dllStartServiceA, DecryptFileW, GetFileSecurityA, SetFileSecurityA, RegEnumKeyExA, RegEnumValueA, RegSetValueA, RegQueryValueA, RegDeleteValueA, GetUserNameA, RegSetValueExA, RegCreateKeyExA, CryptReleaseContext, CryptDestroyKey, CryptDecrypt, CryptGetKeyParam, CryptSetKeyParam, CryptAcquireContextA, RegOpenKeyExW, BuildTrusteeWithSidA, QueryServiceStatus, OpenServiceA, CloseServiceHandle, CreateServiceA, OpenSCManagerA, ChangeServiceConfig2A, RegUnLoadKeyA, RegLoadKeyA, LookupPrivilegeValueA, OpenProcessToken, RegDeleteKeyA, RegQueryValueExA, PerfDecrementULongCounterValue, RegCloseKey, RegEnumKeyA, RegOpenKeyExA
      SHELL32.dllSHGetDataFromIDListW, ShellExecuteA, SHGetKnownFolderPath, SHGetFolderPathA, SHAddToRecentDocs, ExtractIconA, SHGetFileInfoA, DragQueryFileA, DragFinish, SHGetPathFromIDListA, SHGetSpecialFolderLocation, SHGetDesktopFolder, SHGetMalloc, SHBrowseForFolderA, SHAppBarMessage, ShellExecuteExA
      COMCTL32.dllInitCommonControlsEx
      SHLWAPI.dllSHSetValueA, SHDeleteKeyA, SHGetValueA, PathFindFileNameA, PathFindExtensionA, PathRemoveExtensionA, PathIsUNCA, PathStripToRootA, StrFormatKBSizeA, PathRemoveFileSpecW, PathAppendA
      UxTheme.dllCloseThemeData, GetThemeColor, DrawThemeBackground, OpenThemeData, GetThemeSysColor, GetWindowTheme, IsAppThemed, GetThemePartSize, IsThemeBackgroundPartiallyTransparent, DrawThemeText, DrawThemeParentBackground, GetCurrentThemeName
      ole32.dllRegisterDragDrop, CoLockObjectExternal, OleGetClipboard, OleSetMenuDescriptor, OleLockRunning, StgCreateDocfile, StgOpenStorage, StgOpenStorageOnILockBytes, StgIsStorageFile, CreateILockBytesOnHGlobal, CreateFileMoniker, OleCreateMenuDescriptor, CLSIDFromProgID, CoRegisterMessageFilter, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleRegGetMiscStatus, OleRegEnumVerbs, StgCreateDocfileOnILockBytes, WriteClassStm, GetHGlobalFromILockBytes, CreateGenericComposite, CreateItemMoniker, OleCreate, OleCreateFromData, OleCreateLinkFromData, OleCreateStaticFromData, RevokeDragDrop, DoDragDrop, OleIsCurrentClipboard, OleFlushClipboard, OleSetClipboard, PropVariantCopy, CreateStreamOnHGlobal, CoInitializeEx, CLSIDFromString, OleCreateLinkToFile, OleCreateFromFile, StringFromGUID2, CoDisconnectObject, SetConvertStg, OleRegGetUserType, ReleaseStgMedium, OleDuplicateData, ReadFmtUserTypeStg, WriteFmtUserTypeStg, CreateBindCtx, CoTreatAsClass, WriteClassStg, ReadClassStg, CoTaskMemAlloc, StringFromCLSID, CoInitialize, CoCreateInstance, CoUninitialize, CoCreateGuid, CoTaskMemFree, OleLoad, OleSave, OleSaveToStream, OleSetContainedObject, OleGetIconOfClass, OleRun, CreateDataAdviseHolder, CreateOleAdviseHolder, GetRunningObjectTable, OleIsRunning, CoGetMalloc, OleQueryLinkFromData, OleQueryCreateFromData, CoFreeUnusedLibraries, OleInitialize, OleUninitialize, CoGetClassObject, CoRegisterClassObject, CoRevokeClassObject
      OLEAUT32.dllSysAllocString, VarBstrFromDec, VarBstrFromDate, VarBstrFromCy, VarCyFromStr, VarDateFromStr, VariantCopy, SafeArrayPtrOfIndex, SafeArrayCopy, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayUnlock, SafeArrayLock, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayGetElemsize, SafeArrayGetDim, SafeArrayRedim, SafeArrayDestroy, SafeArrayDestroyData, SafeArrayDestroyDescriptor, SafeArrayCreate, SafeArrayAllocData, SafeArrayAllocDescriptor, VariantTimeToSystemTime, SystemTimeToVariantTime, SysReAllocStringLen, SysStringLen, RegisterTypeLib, LoadRegTypeLib, LoadTypeLib, SysAllocStringByteLen, SysStringByteLen, VariantChangeType, SysAllocStringLen, SysFreeString, VariantInit, VariantClear, VarDecFromStr
      oledlg.dll
      Secur32.dllSetContextAttributesW, SetContextAttributesA, ImportSecurityContextW, SaslGetProfilePackageA, QueryContextAttributesW, QueryContextAttributesA, SaslSetContextOption, FreeCredentialsHandle, InitSecurityInterfaceA
      NETAPI32.dllNetApiBufferFree, NetUserEnum
      gdiplus.dllGdipDrawImageRectI, GdipSetInterpolationMode, GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdipDrawImageI, GdipDeleteGraphics, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromFileICM, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromFile, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCloneImage, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown
      OLEACC.dllLresultFromObject, CreateStdAccessibleObject, AccessibleObjectFromWindow
      IMM32.dllImmReleaseContext, ImmGetContext, ImmGetOpenStatus
      WINMM.dllPlaySoundA
      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States
      No network behavior found
      No statistics
      No system behavior
      No disassembly