popup

Report - MEmpEng.exe

Formbook Generic Malware Malicious Library UPX PE File PE32 OS Processor Check DLL
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.08.30 11:20 Machine s1_win7_x6403
Filename MEmpEng.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
3
 Behavior Score
6.2
ZERO API file : mailcious
VT API (file) 28 detected (AIDetectMalware, AutoIt, malicious, high confidence, TrojanAitInject, Unsafe, Vjis, Artemis, FileRepMalware, Misc, Strab, Generic Reputation PUA, Detected, Eldorado, Shellcrun, NetWiredRC, R002H01HT24, susgen, confidence)
md5 3412e23523a0f4f6da613485bd7fdb38
sha256 bd378a6bedac71671d2d9fda95363341f41d696fe0f400509c0d436febf5c49b
ssdeep 24576:ctb20pkaCqT5TBWgNQ7as2j8NPl/5+cuZz6A:FVg5tQ7as2j6lBTut5
imphash 3d95adbf13bbe79dc24dccb401c12091
impfuzzy 192:ut3GC4Xx6I3OCg8VQZhfi8UIRu2VnwVhMycOYRD:s3GZXx6IlgPh6qxnwXrcOYRD
  Network IP location

Signature (14cnts)

Level Description
warning File has been identified by 28 AntiVirus engines on VirusTotal as malicious
watch Attempts to identify installed AV products by installation directory
watch Used NtSetContextThread to modify a thread in a remote process indicative of process injection
notice A process attempted to delay the analysis task.
notice Allocates read-write-execute memory (usually to unpack itself)
notice Created a process named as a common system process
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method
notice Steals private information from local Internet browsers
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks if process is being debugged by a debugger

Rules (11cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (download)
watch UPX_Zero UPX packed file binaries (upload)
info IsDLL (no description) binaries (download)
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (32cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://www.2886080.xyz/eyiz/?M-xm=XQ7d8vWNf2bTOhYYL6UJlqYAXy7Rg8V7tb7nan5iZXoOR23qJ7xYi6zjP0ZZPC1qNGRbW38doA+CklQhfBW16OH9GbU74opfrouVpsjlwzkQhOIIL+clvr6SJ5uB6xxabU5X5cQ=&mSn7=kH0QwyQQmqS
whois
CN Anchnet Asia Limited 103.249.106.91 42368 mailcious
http://www.32wxd.top/fqtd/
whois
US COGENT-174 206.119.82.116 42374 mailcious
http://www.51cc.top/7i54/?M-xm=SgV//QM+kZDZSmca7ISHR4U/9iG4TLn30ssUgf4MDLRPguhpDtuGIpE5eby1mFBEyx9n6ho2rfFD9SDq3nlePS+8rBqg/0cGFsBGWXu5QF07X9CUnUPZux9wfWAAZevyIeAs5Qc=&mSn7=kH0QwyQQmqS
whois
US BGPNET Global ASN 216.83.36.195 42370 mailcious
http://www.zenzip.xyz/9pad/
whois
Unknown 203.161.46.201 42371 mailcious
http://www.foundation-repair.biz/5l7s/
whois
Unknown 199.59.243.226 42369 mailcious
http://www.zenzip.xyz/9pad/?M-xm=1a5ATRlanZ3ATSTMsvfkUs0ciM8umoJS8y8kT4HdOCMJyW9sS8tB9dhHCXeYKtsB5QysC2Hg2jCPifAM2S09CoHR88nq9oCTqozYG6NauxPM4LjmZuBJG1m7wEgFKI64QDVX+78=&mSn7=kH0QwyQQmqS
whois
Unknown 203.161.46.201 42371 mailcious
http://www.32wxd.top/fqtd/?M-xm=NOGaE4zNJ3vPzwJVq9flFF94in2IcnN0bsRklEYFuNltL64f812fYl1xoipxw6mqFzyE6nPBnWGndAD5Tl5FPYyUit02KiWxxW2zK2p9R7C5MnzH/2vAyX3OoZI/vgfMfT+cSXI=&mSn7=kH0QwyQQmqS
whois
US COGENT-174 206.119.82.116 42374 mailcious
http://www.2886080.xyz/eyiz/
whois
CN Anchnet Asia Limited 103.249.106.91 42368 mailcious
http://www.51cc.top/7i54/
whois
US BGPNET Global ASN 216.83.36.195 42370 mailcious
http://www.foundation-repair.biz/5l7s/?M-xm=5i9IxHyDCONgw46qIHGeUvwlYzbtgN8gQUqUIjK6jcHsfbLgiJ2s3wDRXgbc+h/bICwzf3ddx8E1HmjHsyEg1i4ki39GGAPq3qClCRMeu9QIBTg/A11C17kmPPIEN81gm2sAq9Q=&mSn7=kH0QwyQQmqS
whois
Unknown 199.59.243.226 42369 mailcious
http://www.meetfactory.biz/xoqw/?M-xm=IHXCkUsJunCVOO2Hwv8L1/jebUXenMysZsXgVBD8KQgj+TIAwNGDK5EWhUbKXzAU4KMQODjr0cxiOqiC8Z91HBWngaVBBi9zW0XdtSpa8XSCv8AOb3sJWenXQ9ufn4pifwUOwgs=&mSn7=kH0QwyQQmqS
whois
US Linode, LLC 45.33.30.197 42372 mailcious
http://www.onlytradez.club/k1y3/
whois
US DIGITALOCEAN-ASN 167.172.133.32 42373 mailcious
http://www.onlytradez.club/k1y3/?M-xm=J7VJwuuG4HUA4bFTkbQEdxkpMEpXPBCRRs+F1x6QwwkcPlqAPKpQJUUQrtsDqb7Q+tjdIUGQwp4fGorxq2J//mB+PqSTwbyLcRM9dR0EDrcHS/LNmgUR990rINKp1m+e5VNnNrk=&mSn7=kH0QwyQQmqS
whois
US DIGITALOCEAN-ASN 167.172.133.32 42373 mailcious
http://www.meetfactory.biz/xoqw/
whois
US Linode, LLC 45.56.79.23 42372 mailcious
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3190000.zip
whois
US Linode, LLC 45.33.6.223 clean
www.onlytradez.club
whois
US DIGITALOCEAN-ASN 167.172.133.32 mailcious
www.zenzip.xyz
whois
Unknown 203.161.46.201 mailcious
www.sgcwin77rtplive.fun
whois
Unknown mailcious
www.meetfactory.biz
whois
US Linode, LLC 45.33.30.197 mailcious
www.kej-sii.cloud
whois
Unknown mailcious
www.2886080.xyz
whois
CN Anchnet Asia Limited 103.249.106.91 mailcious
www.32wxd.top
whois
US COGENT-174 206.119.82.116 mailcious
www.foundation-repair.biz
whois
Unknown 199.59.243.226 mailcious
www.51cc.top
whois
US BGPNET Global ASN 216.83.36.195 mailcious
103.249.106.91
whois
CN Anchnet Asia Limited 103.249.106.91 mailcious
167.172.133.32
whois
US DIGITALOCEAN-ASN 167.172.133.32 mailcious
216.83.36.195
whois
US BGPNET Global ASN 216.83.36.195 mailcious
199.59.243.226
whois
Unknown 199.59.243.226 phishing
203.161.46.201
whois
Unknown 203.161.46.201 mailcious
206.119.82.116
whois
US COGENT-174 206.119.82.116 mailcious
45.33.6.223
whois
US Linode, LLC 45.33.6.223 clean
198.58.118.167
whois
US Linode, LLC 198.58.118.167 mailcious

Suricata ids

ET INFO Observed DNS Query to .biz TLD
ET DNS Query to a *.top domain - Likely Hostile
ET INFO HTTP Request to a *.top domain
ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2
ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3

PE API

IAT(Import Address Table) Library

WSOCK32.dll
 0x48d7b0 __WSAFDIsSet
 0x48d7b4 recv
 0x48d7b8 send
 0x48d7bc setsockopt
 0x48d7c0 ntohs
 0x48d7c4 recvfrom
 0x48d7c8 select
 0x48d7cc WSAStartup
 0x48d7d0 htons
 0x48d7d4 accept
 0x48d7d8 listen
 0x48d7dc ind
 0x48d7e0 closesocket
 0x48d7e4 connect
 0x48d7e8 WSACleanup
 0x48d7ec ioctlsocket
 0x48d7f0 sendto
 0x48d7f4 WSAGetLastError
 0x48d7f8 inet_addr
 0x48d7fc gethostbyname
 0x48d800 gethostname
 0x48d804 socket
VERSION.dll
 0x48d754 GetFileVersionInfoW
 0x48d758 VerQueryValueW
 0x48d75c GetFileVersionInfoSizeW
WINMM.dll
 0x48d7a0 timeGetTime
 0x48d7a4 waveOutSetVolume
 0x48d7a8 mciSendStringW
COMCTL32.dll
 0x48d088 ImageList_Destroy
 0x48d08c ImageList_Remove
 0x48d090 ImageList_SetDragCursorImage
 0x48d094 ImageList_BeginDrag
 0x48d098 ImageList_DragEnter
 0x48d09c ImageList_DragLeave
 0x48d0a0 ImageList_EndDrag
 0x48d0a4 ImageList_DragMove
 0x48d0a8 ImageList_Create
 0x48d0ac InitCommonControlsEx
 0x48d0b0 ImageList_ReplaceIcon
MPR.dll
 0x48d3e8 WNetUseConnectionW
 0x48d3ec WNetCancelConnection2W
 0x48d3f0 WNetGetConnectionW
 0x48d3f4 WNetAddConnection2W
WININET.dll
 0x48d764 InternetReadFile
 0x48d768 InternetCloseHandle
 0x48d76c InternetOpenW
 0x48d770 InternetSetOptionW
 0x48d774 InternetCrackUrlW
 0x48d778 HttpQueryInfoW
 0x48d77c InternetQueryOptionW
 0x48d780 HttpOpenRequestW
 0x48d784 HttpSendRequestW
 0x48d788 FtpOpenFileW
 0x48d78c FtpGetFileSize
 0x48d790 InternetOpenUrlW
 0x48d794 InternetConnectW
 0x48d798 InternetQueryDataAvailable
PSAPI.DLL
 0x48d46c GetProcessMemoryInfo
IPHLPAPI.DLL
 0x48d154 IcmpCreateFile
 0x48d158 IcmpCloseHandle
 0x48d15c IcmpSendEcho
USERENV.dll
 0x48d738 UnloadUserProfile
 0x48d73c DestroyEnvironmentBlock
 0x48d740 CreateEnvironmentBlock
 0x48d744 LoadUserProfileW
UxTheme.dll
 0x48d74c IsThemeActive
KERNEL32.dll
 0x48d164 HeapAlloc
 0x48d168 GetProcessHeap
 0x48d16c HeapFree
 0x48d170 Sleep
 0x48d174 GetCurrentThreadId
 0x48d178 MultiByteToWideChar
 0x48d17c MulDiv
 0x48d180 GetVersionExW
 0x48d184 GetSystemInfo
 0x48d188 FreeLibrary
 0x48d18c LoadLibraryA
 0x48d190 GetProcAddress
 0x48d194 SetErrorMode
 0x48d198 GetModuleFileNameW
 0x48d19c WideCharToMultiByte
 0x48d1a0 lstrcpyW
 0x48d1a4 lstrlenW
 0x48d1a8 GetModuleHandleW
 0x48d1ac QueryPerformanceCounter
 0x48d1b0 VirtualFreeEx
 0x48d1b4 OpenProcess
 0x48d1b8 VirtualAllocEx
 0x48d1bc WriteProcessMemory
 0x48d1c0 ReadProcessMemory
 0x48d1c4 CreateFileW
 0x48d1c8 SetFilePointerEx
 0x48d1cc ReadFile
 0x48d1d0 WriteFile
 0x48d1d4 FlushFileBuffers
 0x48d1d8 TerminateProcess
 0x48d1dc CreateToolhelp32Snapshot
 0x48d1e0 Process32FirstW
 0x48d1e4 Process32NextW
 0x48d1e8 SetFileTime
 0x48d1ec GetFileAttributesW
 0x48d1f0 FindFirstFileW
 0x48d1f4 FindClose
 0x48d1f8 GetLongPathNameW
 0x48d1fc GetCurrentThread
 0x48d200 FindNextFileW
 0x48d204 MoveFileW
 0x48d208 CopyFileW
 0x48d20c CreateDirectoryW
 0x48d210 RemoveDirectoryW
 0x48d214 SetSystemPowerState
 0x48d218 QueryPerformanceFrequency
 0x48d21c FindResourceW
 0x48d220 LoadResource
 0x48d224 LockResource
 0x48d228 SizeofResource
 0x48d22c EnumResourceNamesW
 0x48d230 OutputDebugStringW
 0x48d234 GetTempPathW
 0x48d238 GetTempFileNameW
 0x48d23c DeviceIoControl
 0x48d240 GetLocalTime
 0x48d244 CompareStringW
 0x48d248 DeleteCriticalSection
 0x48d24c WaitForSingleObject
 0x48d250 LeaveCriticalSection
 0x48d254 GetStdHandle
 0x48d258 CreatePipe
 0x48d25c InterlockedExchange
 0x48d260 TerminateThread
 0x48d264 LoadLibraryExW
 0x48d268 FindResourceExW
 0x48d26c VirtualFree
 0x48d270 FormatMessageW
 0x48d274 GetExitCodeProcess
 0x48d278 GetPrivateProfileStringW
 0x48d27c WritePrivateProfileStringW
 0x48d280 GetPrivateProfileSectionW
 0x48d284 WritePrivateProfileSectionW
 0x48d288 GetPrivateProfileSectionNamesW
 0x48d28c FileTimeToLocalFileTime
 0x48d290 FileTimeToSystemTime
 0x48d294 SystemTimeToFileTime
 0x48d298 LocalFileTimeToFileTime
 0x48d29c GetDriveTypeW
 0x48d2a0 GetDiskFreeSpaceExW
 0x48d2a4 GetDiskFreeSpaceW
 0x48d2a8 GetVolumeInformationW
 0x48d2ac SetVolumeLabelW
 0x48d2b0 CreateHardLinkW
 0x48d2b4 SetFileAttributesW
 0x48d2b8 GetShortPathNameW
 0x48d2bc CreateEventW
 0x48d2c0 SetEvent
 0x48d2c4 GetEnvironmentVariableW
 0x48d2c8 SetEnvironmentVariableW
 0x48d2cc GlobalLock
 0x48d2d0 GlobalUnlock
 0x48d2d4 GlobalAlloc
 0x48d2d8 GetFileSize
 0x48d2dc GlobalFree
 0x48d2e0 GlobalMemoryStatusEx
 0x48d2e4 Beep
 0x48d2e8 GetSystemDirectoryW
 0x48d2ec GetComputerNameW
 0x48d2f0 GetWindowsDirectoryW
 0x48d2f4 GetCurrentProcessId
 0x48d2f8 GetProcessIoCounters
 0x48d2fc CreateProcessW
 0x48d300 SetPriorityClass
 0x48d304 LoadLibraryW
 0x48d308 VirtualAlloc
 0x48d30c CloseHandle
 0x48d310 GetLastError
 0x48d314 GetFullPathNameW
 0x48d318 SetCurrentDirectoryW
 0x48d31c IsDebuggerPresent
 0x48d320 GetCurrentDirectoryW
 0x48d324 lstrcmpiW
 0x48d328 RaiseException
 0x48d32c InitializeCriticalSectionAndSpinCount
 0x48d330 InterlockedDecrement
 0x48d334 InterlockedIncrement
 0x48d338 CreateThread
 0x48d33c DuplicateHandle
 0x48d340 EnterCriticalSection
 0x48d344 GetCurrentProcess
 0x48d348 ExitProcess
 0x48d34c GetModuleHandleExW
 0x48d350 ExitThread
 0x48d354 GetSystemTimeAsFileTime
 0x48d358 ResumeThread
 0x48d35c GetCommandLineW
 0x48d360 IsProcessorFeaturePresent
 0x48d364 HeapSize
 0x48d368 IsValidCodePage
 0x48d36c GetACP
 0x48d370 GetOEMCP
 0x48d374 GetCPInfo
 0x48d378 SetLastError
 0x48d37c UnhandledExceptionFilter
 0x48d380 SetUnhandledExceptionFilter
 0x48d384 TlsAlloc
 0x48d388 TlsGetValue
 0x48d38c TlsSetValue
 0x48d390 TlsFree
 0x48d394 GetStartupInfoW
 0x48d398 GetStringTypeW
 0x48d39c SetStdHandle
 0x48d3a0 GetFileType
 0x48d3a4 GetConsoleCP
 0x48d3a8 GetConsoleMode
 0x48d3ac RtlUnwind
 0x48d3b0 ReadConsoleW
 0x48d3b4 SetFilePointer
 0x48d3b8 GetTimeZoneInformation
 0x48d3bc GetDateFormatW
 0x48d3c0 GetTimeFormatW
 0x48d3c4 LCMapStringW
 0x48d3c8 GetEnvironmentStringsW
 0x48d3cc FreeEnvironmentStringsW
 0x48d3d0 HeapReAlloc
 0x48d3d4 WriteConsoleW
 0x48d3d8 SetEndOfFile
 0x48d3dc DeleteFileW
 0x48d3e0 SetEnvironmentVariableA
USER32.dll
 0x48d4b4 SetWindowPos
 0x48d4b8 GetCursorInfo
 0x48d4bc RegisterHotKey
 0x48d4c0 ClientToScreen
 0x48d4c4 GetKeyboardLayoutNameW
 0x48d4c8 IsCharAlphaW
 0x48d4cc IsCharAlphaNumericW
 0x48d4d0 IsCharLowerW
 0x48d4d4 IsCharUpperW
 0x48d4d8 GetMenuStringW
 0x48d4dc GetSubMenu
 0x48d4e0 GetCaretPos
 0x48d4e4 IsZoomed
 0x48d4e8 MonitorFromPoint
 0x48d4ec GetMonitorInfoW
 0x48d4f0 SetWindowLongW
 0x48d4f4 SetLayeredWindowAttributes
 0x48d4f8 FlashWindow
 0x48d4fc GetClassLongW
 0x48d500 TranslateAcceleratorW
 0x48d504 IsDialogMessageW
 0x48d508 GetSysColor
 0x48d50c InflateRect
 0x48d510 DrawFocusRect
 0x48d514 DrawTextW
 0x48d518 FrameRect
 0x48d51c DrawFrameControl
 0x48d520 FillRect
 0x48d524 PtInRect
 0x48d528 DestroyAcceleratorTable
 0x48d52c CreateAcceleratorTableW
 0x48d530 SetCursor
 0x48d534 GetWindowDC
 0x48d538 GetSystemMetrics
 0x48d53c DrawMenuBar
 0x48d540 GetActiveWindow
 0x48d544 CharNextW
 0x48d548 wsprintfW
 0x48d54c RedrawWindow
 0x48d550 DestroyMenu
 0x48d554 SetMenu
 0x48d558 GetWindowTextLengthW
 0x48d55c CreateMenu
 0x48d560 IsDlgButtonChecked
 0x48d564 DefDlgProcW
 0x48d568 CallWindowProcW
 0x48d56c ReleaseCapture
 0x48d570 SetCapture
 0x48d574 MonitorFromRect
 0x48d578 LoadImageW
 0x48d57c CreateIconFromResourceEx
 0x48d580 mouse_event
 0x48d584 ExitWindowsEx
 0x48d588 SetActiveWindow
 0x48d58c FindWindowExW
 0x48d590 EnumThreadWindows
 0x48d594 SetMenuDefaultItem
 0x48d598 InsertMenuItemW
 0x48d59c IsMenu
 0x48d5a0 TrackPopupMenuEx
 0x48d5a4 GetCursorPos
 0x48d5a8 CopyImage
 0x48d5ac CheckMenuRadioItem
 0x48d5b0 GetMenuItemID
 0x48d5b4 GetMenuItemCount
 0x48d5b8 SetMenuItemInfoW
 0x48d5bc GetMenuItemInfoW
 0x48d5c0 SetForegroundWindow
 0x48d5c4 IsIconic
 0x48d5c8 FindWindowW
 0x48d5cc UnregisterHotKey
 0x48d5d0 keybd_event
 0x48d5d4 SendInput
 0x48d5d8 GetAsyncKeyState
 0x48d5dc SetKeyboardState
 0x48d5e0 GetKeyboardState
 0x48d5e4 GetKeyState
 0x48d5e8 VkKeyScanW
 0x48d5ec LoadStringW
 0x48d5f0 DialogBoxParamW
 0x48d5f4 MessageBeep
 0x48d5f8 EndDialog
 0x48d5fc SendDlgItemMessageW
 0x48d600 GetDlgItem
 0x48d604 SetWindowTextW
 0x48d608 CopyRect
 0x48d60c ReleaseDC
 0x48d610 GetDC
 0x48d614 EndPaint
 0x48d618 BeginPaint
 0x48d61c GetClientRect
 0x48d620 GetMenu
 0x48d624 DestroyWindow
 0x48d628 EnumWindows
 0x48d62c GetDesktopWindow
 0x48d630 IsWindow
 0x48d634 IsWindowEnabled
 0x48d638 IsWindowVisible
 0x48d63c EnableWindow
 0x48d640 InvalidateRect
 0x48d644 GetWindowLongW
 0x48d648 GetWindowThreadProcessId
 0x48d64c AttachThreadInput
 0x48d650 GetFocus
 0x48d654 ScreenToClient
 0x48d658 SendMessageTimeoutW
 0x48d65c EnumChildWindows
 0x48d660 CharUpperBuffW
 0x48d664 GetClassNameW
 0x48d668 GetParent
 0x48d66c GetDlgCtrlID
 0x48d670 SendMessageW
 0x48d674 MapVirtualKeyW
 0x48d678 PostMessageW
 0x48d67c GetWindowRect
 0x48d680 SetUserObjectSecurity
 0x48d684 CloseDesktop
 0x48d688 CloseWindowStation
 0x48d68c OpenDesktopW
 0x48d690 SetProcessWindowStation
 0x48d694 GetProcessWindowStation
 0x48d698 OpenWindowStationW
 0x48d69c GetUserObjectSecurity
 0x48d6a0 AdjustWindowRectEx
 0x48d6a4 SetRect
 0x48d6a8 SetClipboardData
 0x48d6ac EmptyClipboard
 0x48d6b0 CountClipboardFormats
 0x48d6b4 CloseClipboard
 0x48d6b8 GetClipboardData
 0x48d6bc IsClipboardFormatAvailable
 0x48d6c0 OpenClipboard
 0x48d6c4 BlockInput
 0x48d6c8 GetMessageW
 0x48d6cc LockWindowUpdate
 0x48d6d0 DispatchMessageW
 0x48d6d4 TranslateMessage
 0x48d6d8 DeleteMenu
 0x48d6dc PeekMessageW
 0x48d6e0 MessageBoxW
 0x48d6e4 DefWindowProcW
 0x48d6e8 MoveWindow
 0x48d6ec SetFocus
 0x48d6f0 PostQuitMessage
 0x48d6f4 KillTimer
 0x48d6f8 CreatePopupMenu
 0x48d6fc RegisterWindowMessageW
 0x48d700 SetTimer
 0x48d704 ShowWindow
 0x48d708 CreateWindowExW
 0x48d70c RegisterClassExW
 0x48d710 LoadIconW
 0x48d714 LoadCursorW
 0x48d718 GetSysColorBrush
 0x48d71c GetForegroundWindow
 0x48d720 MessageBoxA
 0x48d724 DestroyIcon
 0x48d728 SystemParametersInfoW
 0x48d72c CharLowerBuffW
 0x48d730 GetWindowTextW
GDI32.dll
 0x48d0c4 SetPixel
 0x48d0c8 DeleteObject
 0x48d0cc GetTextExtentPoint32W
 0x48d0d0 ExtCreatePen
 0x48d0d4 StrokeAndFillPath
 0x48d0d8 StrokePath
 0x48d0dc GetDeviceCaps
 0x48d0e0 CloseFigure
 0x48d0e4 LineTo
 0x48d0e8 AngleArc
 0x48d0ec CreateCompatibleBitmap
 0x48d0f0 CreateCompatibleDC
 0x48d0f4 MoveToEx
 0x48d0f8 Ellipse
 0x48d0fc PolyDraw
 0x48d100 BeginPath
 0x48d104 SelectObject
 0x48d108 StretchBlt
 0x48d10c GetDIBits
 0x48d110 DeleteDC
 0x48d114 GetPixel
 0x48d118 CreateDCW
 0x48d11c GetStockObject
 0x48d120 Rectangle
 0x48d124 SetViewportOrgEx
 0x48d128 GetObjectW
 0x48d12c SetBkMode
 0x48d130 RoundRect
 0x48d134 SetBkColor
 0x48d138 CreatePen
 0x48d13c CreateSolidBrush
 0x48d140 SetTextColor
 0x48d144 CreateFontW
 0x48d148 GetTextFaceW
 0x48d14c EndPath
COMDLG32.dll
 0x48d0b8 GetSaveFileNameW
 0x48d0bc GetOpenFileNameW
ADVAPI32.dll
 0x48d000 GetAclInformation
 0x48d004 RegEnumValueW
 0x48d008 RegDeleteValueW
 0x48d00c RegDeleteKeyW
 0x48d010 RegEnumKeyExW
 0x48d014 RegSetValueExW
 0x48d018 RegCreateKeyExW
 0x48d01c GetUserNameW
 0x48d020 RegOpenKeyExW
 0x48d024 RegCloseKey
 0x48d028 RegQueryValueExW
 0x48d02c RegConnectRegistryW
 0x48d030 InitializeSecurityDescriptor
 0x48d034 InitializeAcl
 0x48d038 AdjustTokenPrivileges
 0x48d03c OpenThreadToken
 0x48d040 OpenProcessToken
 0x48d044 LookupPrivilegeValueW
 0x48d048 DuplicateTokenEx
 0x48d04c CreateProcessAsUserW
 0x48d050 CreateProcessWithLogonW
 0x48d054 GetLengthSid
 0x48d058 CopySid
 0x48d05c InitiateSystemShutdownExW
 0x48d060 LogonUserW
 0x48d064 AllocateAndInitializeSid
 0x48d068 CheckTokenMembership
 0x48d06c FreeSid
 0x48d070 GetTokenInformation
 0x48d074 GetSecurityDescriptorDacl
 0x48d078 SetSecurityDescriptorDacl
 0x48d07c AddAce
 0x48d080 GetAce
SHELL32.dll
 0x48d474 DragQueryPoint
 0x48d478 ShellExecuteExW
 0x48d47c DragQueryFileW
 0x48d480 SHEmptyRecycleBinW
 0x48d484 SHGetPathFromIDListW
 0x48d488 SHBrowseForFolderW
 0x48d48c SHCreateShellItem
 0x48d490 SHGetDesktopFolder
 0x48d494 SHGetSpecialFolderLocation
 0x48d498 SHGetFolderPathW
 0x48d49c SHFileOperationW
 0x48d4a0 ExtractIconExW
 0x48d4a4 Shell_NotifyIconW
 0x48d4a8 ShellExecuteW
 0x48d4ac DragFinish
ole32.dll
 0x48d80c CoTaskMemAlloc
 0x48d810 CoTaskMemFree
 0x48d814 CLSIDFromString
 0x48d818 ProgIDFromCLSID
 0x48d81c CLSIDFromProgID
 0x48d820 OleSetMenuDescriptor
 0x48d824 MkParseDisplayName
 0x48d828 OleSetContainedObject
 0x48d82c CoCreateInstance
 0x48d830 IIDFromString
 0x48d834 StringFromGUID2
 0x48d838 CreateStreamOnHGlobal
 0x48d83c CoInitialize
 0x48d840 CoUninitialize
 0x48d844 GetRunningObjectTable
 0x48d848 CoGetInstanceFromFile
 0x48d84c CoGetObject
 0x48d850 CoInitializeSecurity
 0x48d854 CoCreateInstanceEx
 0x48d858 CoSetProxyBlanket
OLEAUT32.dll
 0x48d3fc RegisterTypeLib
 0x48d400 LoadTypeLibEx
 0x48d404 VariantCopyInd
 0x48d408 SysReAllocString
 0x48d40c SysFreeString
 0x48d410 SafeArrayDestroyDescriptor
 0x48d414 SafeArrayDestroyData
 0x48d418 SafeArrayUnaccessData
 0x48d41c SafeArrayAccessData
 0x48d420 SafeArrayAllocData
 0x48d424 UnRegisterTypeLib
 0x48d428 SafeArrayCreateVector
 0x48d42c SysAllocString
 0x48d430 SysStringLen
 0x48d434 VariantTimeToSystemTime
 0x48d438 VarR8FromDec
 0x48d43c SafeArrayGetVartype
 0x48d440 OleLoadPicture
 0x48d444 QueryPathOfRegTypeLib
 0x48d448 VariantCopy
 0x48d44c VariantClear
 0x48d450 CreateDispTypeInfo
 0x48d454 CreateStdDispatch
 0x48d458 DispCallFunc
 0x48d45c VariantChangeType
 0x48d460 SafeArrayAllocDescriptorEx
 0x48d464 VariantInit

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure