d494371bfa020427ec0aef15427a95fa

resource
unpack001/$PLUGINSDIR/AppCount.exe
unpack001/$PLUGINSDIR/CustomLicense.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/regsvr32.exe
unpack001/$SYSDIR/COMCAT.DLL
unpack001/$SYSDIR/INETKO.DLL
unpack001/$SYSDIR/MSCMCKO.DLL
unpack001/$SYSDIR/MSPRPKO.DLL
unpack001/$SYSDIR/MSSTKPRP.DLL
unpack001/$SYSDIR/VB6KO.DLL
unpack001/$SYSDIR/asycfilt.dll
unpack001/$SYSDIR/msimg32.dll
unpack001/$SYSDIR/msvbvm60.dll
unpack001/$SYSDIR/oleaut32.dll
unpack001/$SYSDIR/olepro32.dll
unpack001/$SYSDIR/stdole2.tlb
unpack001/$SYSDIR/wshom.ocx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 96820541e563ae6bd9e97a0ec95bcbc5e2044dc89574d3c8d0b7b40edc276222
MD5 d494371bfa020427ec0aef15427a95fa
SHA1 b895c3c8b21f33e35d231b7b29f964ad95990600
SHA512 9007ec557067f5b7e67bae8acdcc12bc0307f40327df8a2c05743a4592ec94c6531a4331e2798d595eb6874195ed8e4d00c8fe9992658d1d993d8315fbb0f92b
SSDEEP 49152:LJYw9TFXwDUCH4Bt8uTRJiO9r8HxFAzzCQe7:T95wYCAJiO9at7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AppCount.exe

IMPHASH 46ddca80d9c45d49064801ef7f9eb200
SHA256 54f9a1bc5ee991a1b761ccff0b16310a90cfa25c7844707615cba9a372934097
MD5 88a136f8b6c5c7c7a2c627be67bec078
SHA1 34acdd8c72a17dcc90521c7008c5253e115f2fb3
SHA512 04e1397d1b06c7258547956e2acf8af952f96836226524d274107d9df604a83612869a84966ac0b1f7f5b146dbf194e8a511e57faa04c9ebff5f1ccd4c99487d
SSDEEP 96:hSPXbYbhQb/2a1Qs1Hl9nizWXEkN8WXPtboyntZxkQXXvJa4Fmvbc:hS/E9QbeWHvnDEkNdP1oyntbkQn0rzc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

mfc42

ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord825 ord815 ord2818 ord858 ord6282 ord2764 ord540 ord6648 ord800 ord4129 ord4486 ord2621 ord1134 ord1576 ord1168 ord4234 ord2379 ord755 ord470 ord535 ord939 ord6375 ord4274 ord4673 ord537

msvcrt

_XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp _exit _onexit __dllonexit __CxxFrameHandler _mbscmp _setmbcp

kernel32

HeapFree GetProcessHeap GetModuleHandleA GetStartupInfoA HeapAlloc

user32

SendMessageA DrawIcon GetClientRect GetSystemMetrics IsIconic

urlmon

URLOpenStreamA

$PLUGINSDIR/CustomLicense.dll

IMPHASH 363f09c4ee70037c4ff39dc2ebdb0b27
SHA256 60f9263a1693ae5a18523ee5d0f37e512882edaea2b84a028279d7fe5bb305ae
MD5 3c4c9b038c7eb5223691586a42415fef
SHA1 53eb3587f5313f9aae5aea8b92f7ceb45db19fc6
SHA512 a07843d793811ca6ea9be734c458209a1bb224297743e23304f48b65f38ea9ae5a570f99b5c23642431ecb5cb30bcb43848bb92e6529395c232c63f641143250
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/SmartBarSetup.exe

IMPHASH bd0d651195c69364b473b375d6a4a139
SHA256 6a4fed577af45e4cd8ff13f664fac8dcf503244e8d2d0384ac9c8149e77df118
MD5 944fb5ca7e4521c2fd18aede182d6418
SHA1 bd9305ad37bad72004cba338feb8feb275c61885
SHA512 ac30c2ced998423e12eb3801ddd15258924ce7130c12eeb3a9e7562fa482c2c08e2d78b9b3cde852296903106b51ada9b2015947d2251b91f359e4ac069d14f4
SSDEEP 6144:FXNUwGZnuEHI+JkA3KOiStiQ2G+sqV3HZaU/DF8P6PPO0lVir7rUNmeU:FyrJkAKStSbhvR8GOeifr7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Cyebiz,O=Cyebiz,L=SEOUL,ST=GYEONGGI-DO,C=KR

Serial Number

1a:f7:66:67:e6:4b:40:0e:25:38:58:93:e5:cf:12:a5

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

May 7, 2010 - May 6, 2012

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

01

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

0a

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

0

Major OS version

5

Entry point

192727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

imagehlp

MakeSureDirectoryPathExists

shlwapi

PathFileExistsA PathFindFileNameA PathStripToRootA PathFindExtensionA PathIsUNCA

kernel32

LocalFileTimeToFileTime SystemTimeToFileTime SetFileTime GetFileSizeEx GetFileTime GetModuleHandleW InterlockedIncrement LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GlobalFlags GetCPInfo GetOEMCP GetCurrentDirectoryA SetErrorMode RtlUnwind GetSystemTimeAsFileTime RaiseException GetCommandLineA GetStartupInfoA VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery CreateFileA ExitProcess SetStdHandle GetFileType HeapSize VirtualFree HeapCreate GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP IsValidCodePage LCMapStringA LCMapStringW CompareStringW GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetDriveTypeA GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GetFullPathNameA GetVolumeInformationA GetCurrentProcess DuplicateHandle GetFileSize UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale FileTimeToLocalFileTime FileTimeToSystemTime GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA InterlockedExchange lstrcmpA GetModuleFileNameA FreeResource GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA lstrcmpW GetModuleHandleA GetProcAddress GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv lstrlenA GetFileAttributesA SetFileAttributesA GetCurrentProcessId CloseHandle TerminateProcess InterlockedDecrement MultiByteToWideChar FindFirstFileA FindNextFileA FindClose Sleep GetProcessHeap HeapAlloc HeapFree GetTickCount GetVersionExA WinExec GetTempPathA DeleteFileA GetSystemDirectoryA CreateProcessA WaitForSingleObject LoadLibraryA FreeLibrary GetPrivateProfileStringA WritePrivateProfileStringA WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource SetEndOfFile GetModuleFileNameW HeapReAlloc

user32

RegisterClipboardFormatA PostThreadMessageA GetSysColorBrush SetWindowContextHelpId MapDialogRect CharUpperA GetDesktopWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog GetMessageA TranslateMessage GetActiveWindow ValidateRect PostQuitMessage GetWindowThreadProcessId ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SetDlgItemTextA SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA EnableMenuItem CheckMenuItem RegisterWindowMessageA SendDlgItemMessageA WinHelpA IsChild GetCapture SetWindowsHookExA CallNextHookEx GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessagePos PeekMessageA MapWindowPoints SetMenu SetForegroundWindow IsWindowVisible UpdateWindow PostMessageA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu GetWindowLongA OffsetRect UnregisterClassA MessageBeep IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindow GetSysColor EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableA CharNextA GetKeyState GetCursorPos SetWindowPos IsWindow IsWindowEnabled GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetSystemMetrics LoadIconA IsIconic DrawIcon MessageBoxA SetWindowLongA LoadCursorA ReleaseCapture EnableWindow GetParent SetCapture InvalidateRect GetClientRect SendMessageA PtInRect SetCursor DestroyMenu GetMessageTime

gdi32

ExtSelectClipRgn DeleteDC CreateBitmap SelectObject ScaleWindowExtEx CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox SetWindowExtEx Escape ExtTextOutA ScaleViewportExtEx SetBkColor RestoreDC SaveDC SetViewportExtEx OffsetViewportOrgEx GetDeviceCaps GetObjectA GetStockObject TextOutA RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject GetClipBox SetMapMode SetTextColor SetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

RegQueryValueA RegEnumKeyA GetUserNameA RegDeleteKeyA RegOpenKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey

oledlg

ord8

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoTaskMemAlloc OleUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoUninitialize CoCreateInstance CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysFreeString OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy VariantChangeType SysAllocStringByteLen SysStringLen SysAllocStringLen VariantClear VariantInit SysAllocString

urlmon

URLDownloadToFileA URLOpenStreamA

$PLUGINSDIR/SmartGoSetup.exe

IMPHASH c0951d58da71010781aa21f8d00eb86c
SHA256 d29af1e05a9d6702c13fc0aaa2dea3b38c7dc6e1c480891b77781aa31fcd9569
MD5 dc66b003ed696bc42ddd4e78c76b5a21
SHA1 d7e03c722f303fd319da82a27d0c0e6c67ffdb4e
SHA512 db4f20d4f5a5c3188ad971fd00166a1bd203544d7096bde5c69e6095dcdd5e426ad9a893863ed836b5bde7cf0386373e78e6c9783b975fcfc0ca9ed1a14d1602
SSDEEP 6144:8WAS1MEoTNoaL4BfHIjQRD9ys9/CjMhhgnE/86J8OcWCsmVBMv9s/:fWNo3fHIwDssnXY68f/WCsAB6i
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

01

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

0a

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=PlusOne System,OU=Software Development Department,O=PlusOne System,L=Guro-gu,ST=Seoul,C=KR

Serial Number

3f:16:54:60:d1:e3:88:2d:93:3d:ea:03:34:2c:c7:eb

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Jun 3, 2008 - Jun 6, 2010

Minor OS version

0

Major OS version

5

Entry point

187064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

imagehlp

MakeSureDirectoryPathExists

shlwapi

PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA PathFileExistsA

kernel32

TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GlobalFlags GetCPInfo GetOEMCP GetCurrentDirectoryA SetErrorMode RtlUnwind RaiseException GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc ExitProcess SetStdHandle GetFileType HeapSize VirtualFree HeapCreate GetStdHandle TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP IsValidCodePage LCMapStringA LCMapStringW CompareStringW GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetDriveTypeA GetConsoleCP GetConsoleMode InitializeCriticalSection GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA SizeofResource LockResource LoadResource FindResourceA WideCharToMultiByte WritePrivateProfileStringA GetPrivateProfileStringA FreeLibrary LoadLibraryA GetWindowsDirectoryA WaitForSingleObject CreateProcessA GetSystemDirectoryA HeapFree HeapAlloc GetProcessHeap GetTickCount GetVersionExA DeleteFileA GetTempPathA Sleep MultiByteToWideChar InterlockedDecrement SetFileAttributesA GetFileAttributesA lstrlenA MulDiv LocalFree FormatMessageA GlobalUnlock GlobalLock GlobalAlloc GlobalFree SetLastError GetStringTypeA GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement GetModuleHandleW GetFileTime GetFileSizeEx SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetModuleFileNameW CreateFileA GetFullPathNameA GetVolumeInformationA GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale FindFirstFileA FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileA FindClose CloseHandle GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA InterlockedExchange lstrcmpA GetCurrentProcessId GetModuleFileNameA FreeResource GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom CompareStringA lstrcmpW GetModuleHandleA GetProcAddress GetLastError

user32

RegisterClipboardFormatA PostThreadMessageA DestroyMenu GetSysColorBrush SetWindowContextHelpId MapDialogRect CharUpperA GetDesktopWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog GetMessageA TranslateMessage GetActiveWindow ValidateRect PostQuitMessage GetWindowThreadProcessId ShowWindow MoveWindow SetWindowTextA IsDialogMessageA SetDlgItemTextA SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA EnableMenuItem CheckMenuItem RegisterWindowMessageA SendDlgItemMessageA IsChild GetCapture SetWindowsHookExA GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextA GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageA GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageA MapWindowPoints SetMenu SetForegroundWindow IsWindowVisible UpdateWindow PostMessageA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu GetWindowLongA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindow GetSysColor EndPaint BeginPaint UnregisterClassA MessageBeep GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableA CallNextHookEx CharNextA SetCursor PtInRect SendMessageA GetClientRect InvalidateRect RedrawWindow SetCapture GetParent EnableWindow ReleaseCapture LoadCursorA SetWindowLongA MessageBoxA DrawIcon IsIconic LoadIconA GetSystemMetrics GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState IsWindowEnabled ScreenToClient WindowFromPoint IsWindow SetWindowPos GetCursorPos GetKeyState TabbedTextOutA DrawTextA GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA WinHelpA

gdi32

SetMapMode GetClipBox DeleteObject GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreateBitmap CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox SetTextColor SetBkMode SetBkColor RestoreDC SaveDC GetDeviceCaps GetObjectA CreateFontIndirectA SetWindowExtEx GetStockObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegEnumKeyA RegDeleteKeyA GetUserNameA RegOpenKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey RegQueryValueA

shell32

ShellExecuteA

oledlg

ord8

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoRevokeClassObject CoTaskMemFree CoInitializeEx CoInitializeSecurity CoUninitialize CoCreateInstance OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CoTaskMemAlloc

oleaut32

SysFreeString VariantInit VariantClear SysAllocStringLen SysStringLen SysAllocStringByteLen VariantChangeType VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString

urlmon

URLOpenStreamA URLDownloadToFileA

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/my.txt

SHA256 af461c5a2d69f3fdd4138ea67460a9f2fdf4a13d14e22d0a9f63a8692d740d8e
MD5 702e47168c94e4d09bbc72989a0794bd
SHA1 3ccd08bc9039bc248f639ef47ce87c4e01da7762
SHA512 a963f12eba05bda6b74ad2613fb80a78988f23895da27320d7d751d7edf5bcaa262c1f1d3129555af9e8afcddb818f6286e62f72a1e5e1fc7e0d4581d5955748
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/regsvr32.exe

IMPHASH 7dc87ef66f0ed84345e4cf471a3c3455
SHA256 d0967e9e8e3224f8413f97aab9e8b7e226c4f37ca91c10f5695e61a62f18ce8f
MD5 82e89abb7d53a821f2c7d242bedcc2ac
SHA1 50d0d195be7e3a9462caabf7696f7892afdad980
SHA512 ecda41a74f2d9246308506aec7f8870273994e74333f9fcffc7a03b7dd64e1fc19f120e9f1cd30d1369f8619f1444e9bb5b054cea12786af2961d52df9177e2d
SSDEEP 384:YbmUfX6N5H8oXxKMxw1iWrPMLHWQW9ppLBWP:1UfXAiuClMLwpLq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

regsvr32.pdb

$PLUGINSDIR/smartbar.txt

SHA256 cd3d2739e95c4c34e0b6b7bb5ff4872c303692350eaad440664c155ab19d199a
MD5 8ed55756f2e408aa8c6cd461d2c9476d
SHA1 6244d5b822248b7a5faef8ecc8821d8866345412
SHA512 3dc9205928740acbbfd2899283cf4fdcc43136e23f76e30f1155959054f394a657ac4706efa3e7a5b129a4bc060544d212380fc6b941b6bb4fb698c2710e826e
SSDEEP 384:YdvYDhHwZTgCyuFMNyt9w1z22p9bW4hcAEoDbhEWMOcATcFKOfcKD8:CgDZwZsXuO0tG1K2ukzE48dD8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/smartgo.txt

SHA256 86752b9199fc6b04d8802b8c5bf5376a616a605ca838ff10ebd3bdb83981736d
MD5 1b0eca38f24ea18a6d829637ddfed1f7
SHA1 9f96f28d2c5d14f2baac72bce2770f68dae5a595
SHA512 62636f02a3509259ef064e888c1078790b649ffcb3e4ec1471cc960b1fa3af313836aae236c47bb4e57150f24606abd832af422dbcf211efcd0b1a6fc988f796
SSDEEP 192:ZRj3Ge80KWKgt8WY5muL0GHieqlCevkAnGzxy2CpwweTI8bBdj3QJyXsBH1K:b2e8iqiCkw7Jwt8bBd5XT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$SYSDIR/COMCAT.DLL

IMPHASH 5316dd1ba7417f578451f902c4b4f845
SHA256 96d04cdfaf4f4d7b8722b139a15074975d4c244302f78034b7be65df1a92fd03
MD5 3b180da2b50b954a55fe37afba58d428
SHA1 c2a409311853ad4608418e790621f04155e55000
SHA512 cf94ad749d91169078b8829288a2fc8de86ec2fe83d89dc27d54d03c73c0deca66b5d83abbeaa1ff09d0acac4c4352be6502945b5187ecde952cbb08037d07e8
SSDEEP 384:23Fob3slaN3oF1fHICOoMzMv/QTIBjDVquODJXsUW7ftWs6:Yo7s28JnOxzMv/QsBjRqugXspd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

$SYSDIR/INETKO.DLL

SHA256 6672e7889d5671716182b4723963a7a5354731563eb5abb67c19a3f6e79f4d8b
MD5 19e49c4802e54762f613cc3fd5c240c9
SHA1 cee468cfd04f12a9fcaa9549fd4e533afc745da4
SHA512 96bc601aa00395b902ef2361e863d09c828cda1a83f97b4031a8cf2f3f971c072097b1b3e8fa47a2c4ba8b945d79d9e240504aad239aafbe307ad13164f950a5
SSDEEP 96:GnIc7Z3xN7slyu8W2FacuNy/iKxIhkYZ9VY0Hm+/ARTJ35f5D6hw/9z0WkQsANzq:GrxQ8WgyVYYm+of3/9YWkQzW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/MSCMCKO.DLL

SHA256 7713469fb22fef9d711b3822f1df02e045d586ac06a4107a228a96e864da0a3f
MD5 1aedbff4f92aa576b0389deee971dc3c
SHA1 8814275b1ac156e7fd247f0a4071e62d247760c0
SHA512 47d890b1e5bb71980c72079be5ebc7e491141b6465a91e047a47e4f163ff95e828c358e0f95abec1a73d47b3a866890d25ca48a625d60f939a829753a885f564
SSDEEP 1536:GlQluuWmoGRPXJnXA65q8cAQgDIacnmbzQfK:G7jCVXJnXA6Q8cAQgDIacnmbzuK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/MSCOMCTL.OCX

IMPHASH 2b2ee4e06ab7ae589a670cad99121b44
SHA256 a018a023d59bb76aef0b4dd6ff40aa16fd0783927972a9492b26a5e5d0433696
MD5 d9578ff8b495dc575e848c6670be85cc
SHA1 ef0b7a7859caa85bbbdc9cfc1fe2b6eb10db44d4
SHA512 08078f3c3d20e7887b0ce0f3a5aae195a30476f52b8b672e32217c9b515bad67304a91dde6a0c5edac26c2f0db70a0d31a52245fbe65f3430e1ee4a4454359ef
SSDEEP 24576:TvI5+k9ABzqwFqEMotJKC33aTjWVRGcaFHKC4xJq/6z/o:TK+kGBqErqC8PF4UWQ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

33860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread LocalReAlloc GetProfileIntA RtlMoveMemory LocalSize FreeResource GetCurrentProcessId MulDiv GetTickCount MapViewOfFile CreateFileMappingA UnmapViewOfFile GlobalReAlloc IsBadReadPtr Sleep WaitForSingleObject GlobalHandle GetThreadLocale LocalFree LocalAlloc GlobalAddAtomA SetFilePointer SetStdHandle FlushFileBuffers VirtualAlloc WriteFile VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetOEMCP GetACP GetCPInfo GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue GetCurrentProcess TerminateProcess ExitProcess RtlUnwind GetCommandLineA CompareStringW GlobalSize CreateFileA GetFileSize GlobalUnlock GlobalLock ReadFile CloseHandle GlobalFree IsDBCSLeadByte GetModuleHandleA FindResourceA LoadResource LockResource GetLastError GetFileAttributesA GetVersion DisableThreadLibraryCalls GetProcAddress GetLocaleInfoA LoadLibraryA GetWindowsDirectoryA lstrcatA GetModuleFileNameA IsBadWritePtr lstrcmpiA GetLocalTime GetTimeFormatA GetDateFormatA lstrcmpA GlobalAlloc GetVersionExA GetCurrentThreadId MultiByteToWideChar CompareStringA lstrcpyA InterlockedExchange lstrlenA GetSystemDefaultLCID lstrcpynA HeapAlloc DeleteCriticalSection FreeLibrary HeapFree WideCharToMultiByte lstrlenW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetProcessHeap InterlockedIncrement InterlockedDecrement HeapReAlloc

user32

DrawFocusRect AdjustWindowRect DrawFrameControl TrackPopupMenu GetMessageA AdjustWindowRectEx CopyRect GetKeyNameTextA ShowCaret SetCaretPos GrayStringA HideCaret DestroyCaret CreateCaret SetWindowTextA SetScrollInfo DrawTextExA InvertRect SetRectEmpty GetShellWindow SetKeyboardState GetKeyboardState GetScrollInfo GetKeyboardLayout DestroyCursor GetUpdateRgn GetUpdateRect GetWindowRgn ValidateRect CallMsgFilterA LockWindowUpdate IsZoomed GetDesktopWindow GetIconInfo GetCursor GetForegroundWindow InvalidateRgn EndDeferWindowPos EnumChildWindows GetDoubleClickTime FindWindowA GetMessageTime GetWindowThreadProcessId RemovePropA SendNotifyMessageA SetScrollPos SetScrollRange GetWindowTextLengthA EnableScrollBar ChildWindowFromPoint GetDlgItemInt EndDialog GetActiveWindow GetWindow GetPropA GetCursorPos WindowFromPoint GetClassNameA GetDlgCtrlID IsWindow SetPropA IsWindowEnabled IsWindowVisible UnregisterClassA CharNextA MessageBoxA SetActiveWindow CheckRadioButton SetFocus IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt CheckDlgButton GetDlgItem GetDCEx DrawIconEx CreateIconIndirect SystemParametersInfoA IsIconic GetWindowPlacement GetClipboardFormatNameA SetCursorPos RegisterClipboardFormatA MessageBeep RegisterWindowMessageA PeekMessageA PostMessageW PeekMessageW VkKeyScanA SetParent CharUpperA GetDlgItemTextA SetCursor CreateDialogIndirectParamA GetNextDlgTabItem IsDialogMessageA ScrollWindowEx SendDlgItemMessageA SetWindowRgn IntersectRect EqualRect MoveWindow BeginPaint EndPaint DeferWindowPos BeginDeferWindowPos CharNextExA SetTimer KillTimer DrawIcon DestroyIcon MapWindowPoints CreatePopupMenu AppendMenuA TrackPopupMenuEx DestroyMenu WinHelpA PtInRect DefWindowProcA GetWindowDC SetRect LoadCursorA IsRectEmpty ClientToScreen GetWindowRect MapVirtualKeyA DestroyWindow CreateWindowExA GetSysColorBrush GetAsyncKeyState EnableWindow PostMessageA TranslateMessage DispatchMessageA wsprintfA DialogBoxParamA UpdateWindow GetWindowLongA SetWindowLongA GetDC ReleaseDC GetParent OffsetRect UnionRect GetFocus IsChild CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetMessagePos ScreenToClient SetWindowPos SetCapture GetWindowTextA WindowFromDC GetClientRect CallWindowProcA DrawEdge GetSysColor FrameRect InflateRect FillRect DrawTextA GetKeyState GetCapture ReleaseCapture GetClassInfoA RegisterClassA InvalidateRect LoadIconA GetSystemMetrics CopyImage SendMessageA LoadStringA RedrawWindow ShowWindow CreateAcceleratorTableA

ole32

ReleaseStgMedium DoDragDrop RegisterDragDrop RevokeDragDrop CreateStreamOnHGlobal OleLoadFromStream OleSaveToStream CreateOleAdviseHolder CoTaskMemAlloc CoTaskMemFree CoCreateInstance

advapi32

RegDeleteKeyA RegOpenKeyA RegQueryValueA RegQueryValueExA RegEnumKeyExA RegCreateKeyA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey RegDeleteValueA

oleaut32

SafeArrayRedim SafeArrayPutElement SafeArrayGetElement SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData GetErrorInfo OleCreateFontIndirect OleCreatePropertyFrame LoadTypeLibEx UnRegisterTypeLi RegisterTypeLi CreateErrorInfo SetErrorInfo LoadRegTypeLi LoadTypeLi VariantChangeTypeEx SysStringByteLen SysAllocStringByteLen OleLoadPicture SysAllocStringLen VariantCopy OleTranslateColor VariantChangeType OleCreatePictureIndirect VariantCopyInd SysStringLen SysFreeString VariantInit VariantClear SysAllocString SafeArrayCopy

comdlg32

GetOpenFileNameA

gdi32

Arc GetTextExtentPointA GetCharWidthA OffsetWindowOrgEx ExtTextOutW GetTextExtentPointW Polyline GetTextAlign SetTextAlign OffsetRgn GetTextColor CombineRgn GetTextMetricsA MoveToEx LineTo Ellipse DeleteObject SelectObject CreateSolidBrush SetViewportOrgEx SetWindowOrgEx SetViewportExtEx SetWindowExtEx SetMapMode GetDeviceCaps CreateFontIndirectA GetObjectA SelectClipRgn ExcludeClipRect RectVisible GetClipBox IntersectClipRect GetClipRgn CreateRectRgnIndirect RealizePalette SelectPalette PatBlt CreateCompatibleBitmap CreateBitmap CreateCompatibleDC GetTextExtentPoint32A TextOutA SetTextColor SetBkMode Rectangle CreatePen SetBkColor GetStockObject GetViewportExtEx GetWindowExtEx LPtoDP DeleteDC CreateDCA CreateRectRgn StretchBlt CreateICA CopyMetaFileA CopyEnhMetaFileA GetPaletteEntries GetDIBits CreateDIBitmap GetBitmapBits CreatePalette GetNearestColor CreatePatternBrush CreateDIBSection CreateHalftonePalette BitBlt SetDIBColorTable GetDIBColorTable GetPixel StretchDIBits SetBrushOrgEx GetBkColor ExtTextOutA RestoreDC SaveDC CreateFontA

$SYSDIR/MSINET.OCX

IMPHASH 96286284ff8e040938ba779778d1542e
SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
MD5 7bec181a21753498b6bd001c42a42722
SHA1 3249f233657dc66632c0539c47895bfcee5770cc
SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

4860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

wininet

FtpSetCurrentDirectoryA FtpCreateDirectoryA InternetCrackUrlA InternetSetOptionA InternetCreateUrlA InternetSetStatusCallback InternetOpenA InternetGetLastResponseInfoA InternetCloseHandle InternetFindNextFileA FtpDeleteFileA FtpGetFileA FtpPutFileA FtpRenameFileA InternetReadFile InternetConnectA FtpGetCurrentDirectoryA FtpRemoveDirectoryA FtpFindFirstFileA HttpQueryInfoA HttpOpenRequestA HttpSendRequestA InternetOpenUrlA

kernel32

LeaveCriticalSection DeleteCriticalSection FreeLibrary HeapFree WideCharToMultiByte lstrlenW HeapAlloc InitializeCriticalSection EnterCriticalSection GetProcessHeap CloseHandle LocalFree FormatMessageA SetEvent CreateEventA GetLastError MultiByteToWideChar lstrcatA lstrcpyA lstrlenA ResetEvent SetLastError lstrcpynA WaitForSingleObject WaitForMultipleObjects GetTickCount IsBadWritePtr DisableThreadLibraryCalls GetVersion GetFileAttributesA GetModuleFileNameA GetWindowsDirectoryA LoadLibraryA GetLocaleInfoA GetProcAddress InterlockedIncrement InterlockedDecrement HeapReAlloc lstrcmpiA LockResource LoadResource FindResourceA lstrcmpA

user32

SetDlgItemInt SendDlgItemMessageA GetMessageA PostQuitMessage GetDlgItemInt GetDlgItemTextA SendMessageA ReleaseDC GetDC CharNextA SetDlgItemTextA SetWindowPos SetWindowLongA SetParent EndPaint GetClientRect BeginPaint GetWindowLongA SetFocus MoveWindow GetWindow GetActiveWindow GetWindowRect IsWindowVisible TranslateMessage OffsetRect EqualRect IntersectRect DispatchMessageA GetWindowThreadProcessId PtInRect WinHelpA IsDialogMessageA GetNextDlgTabItem IsWindowEnabled GetDlgItem IsChild GetKeyState CreateDialogIndirectParamA MessageBoxA MessageBeep SetTimer PeekMessageA MsgWaitForMultipleObjects PostMessageA GetParent ClientToScreen CreateWindowExA EndDialog LoadIconA DrawEdge DrawIcon LoadCursorA RegisterClassA DestroyIcon KillTimer DestroyWindow GetSystemMetrics LoadStringA wsprintfA DialogBoxParamA SetWindowRgn ShowWindow DefWindowProcA PostThreadMessageA UnregisterClassA

ole32

CoUninitialize CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CreateOleAdviseHolder

advapi32

RegEnumKeyExA RegQueryValueExA RegQueryValueA RegDeleteValueA RegDeleteKeyA RegOpenKeyA RegCloseKey RegOpenKeyExA RegCreateKeyExA RegSetValueExA

oleaut32

OleCreatePropertyFrame RegisterTypeLi LoadTypeLi UnRegisterTypeLi LoadTypeLibEx SafeArrayCreate SetErrorInfo CreateErrorInfo GetErrorInfo LoadRegTypeLi SysStringLen SysAllocStringLen SysFreeString VariantInit VariantClear VariantChangeType SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetDim SafeArrayRedim SafeArrayDestroy VariantChangeTypeEx SysAllocString

gdi32

GetWindowExtEx SetViewportOrgEx LPtoDP DeleteDC SetWindowExtEx SetMapMode SetViewportExtEx GetViewportExtEx SetWindowOrgEx CreateDCA GetDeviceCaps CreateRectRgnIndirect

$SYSDIR/MSPRPKO.DLL

SHA256 7a697331b87edbd80873af87432b7250176af66f845ea2f564c9feb7869478dd
MD5 bb94e0250aaf52ce2f72bbf8c798ba8a
SHA1 f41799c7b4488c45c63617738038df00b6e7b87b
SHA512 2b41ffe36587d8f72dcba191551631ff37d7b8c702df20212d73052acc8221ba10700aed7249d706632ed1cc4c67c457089314f8f6bf076c6e35897a00637df2
SSDEEP 96:FOuTuNK7hgagoHqG/mnuNmPUme5rsWnJew0WbelwLn8:ouCo7hIGmnuNmPUme5LIZW2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/MSSTKPRP.DLL

IMPHASH 0e8457931e6025970696e9132a5b6516
SHA256 067beae824a1ff31b73448e00a4c12c7342a679e727c5afb1e3c430df800154c
MD5 d08a99c462298c041139789627168a0b
SHA1 9242e452ce2c8a724be014f1127c23c3c65a7389
SHA512 ca7ec8a6fbf377c2d036c73ed927041370c216af44ab864d738178ac716634b5ce58dfaba7ff803e335e41b93720b97194a5d4fc884c3ef68dafe90325573093
SSDEEP 1536:3mUT/oLjE84K7Zrg+PECrpAVdEZ/GbLbYuza/U9snhQvLvDjwgIT:rT/o0u7Zrg+PbpAVdEVGbIH/TnaFIT
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

LockResource GetWindowsDirectoryA GetProcAddress FindResourceA LoadResource InterlockedIncrement GetLastError InterlockedDecrement GetFileAttributesA GetModuleFileNameA lstrcatA DisableThreadLibraryCalls GetVersion InitializeCriticalSection lstrcpynA DeleteCriticalSection FreeLibrary GlobalAlloc CreateFileA GetFileSize GlobalUnlock GlobalLock ReadFile IsDBCSLeadByte GlobalFree CloseHandle LoadLibraryA GetLocaleInfoA lstrcmpiA MulDiv GetProcessHeap HeapFree lstrlenA WideCharToMultiByte lstrlenW HeapReAlloc LeaveCriticalSection EnterCriticalSection lstrcpyA HeapAlloc MultiByteToWideChar

user32

OffsetRect ClientToScreen IntersectRect SetWindowRgn GetActiveWindow EqualRect PtInRect CallWindowProcA ReleaseCapture SetCapture GetCapture ScrollWindowEx BeginPaint MoveWindow UpdateWindow IsWindowEnabled InflateRect GetWindowTextA SetWindowTextA UnregisterClassA DestroyWindow CharNextA GetSystemMetrics SetDlgItemTextA GetDlgItemTextA IsWindow MessageBeep MessageBoxA SetFocus IsWindowVisible GetClientRect EndPaint SetWindowLongA DefWindowProcA RegisterClassA GetWindowLongA ShowWindow SetParent LoadStringA GetKeyState wsprintfA WinHelpA GetWindow IsDialogMessageA SetWindowPos InvalidateRect GetFocus CheckDlgButton SetRect DrawFocusRect LoadBitmapA MapDialogRect IsDlgButtonChecked EnableWindow GetDC GetSysColor FillRect DrawEdge DrawTextA ReleaseDC ValidateRect GetDlgItem GetWindowRect ScreenToClient SendMessageA GetParent CreateDialogIndirectParamA GetNextDlgTabItem IsChild CreateWindowExA

ole32

CreateOleAdviseHolder CoCreateInstance CoTaskMemAlloc CreateStreamOnHGlobal CoTaskMemFree

advapi32

RegDeleteKeyA RegQueryValueExA RegEnumKeyExA RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey

oleaut32

LoadRegTypeLi OleCreatePropertyFrame SetErrorInfo LoadTypeLibEx UnRegisterTypeLi SysAllocStringLen RegisterTypeLi GetErrorInfo LoadTypeLi SysAllocString OleCreatePictureIndirect VariantChangeType OleLoadPicture OleTranslateColor SysStringLen VariantInit VariantClear OleCreateFontIndirect CreateErrorInfo SysFreeString

comdlg32

GetOpenFileNameA ChooseColorA

gdi32

CreateRectRgnIndirect GetPixel CreateCompatibleDC GetViewportExtEx CreateBitmap SetWindowOrgEx SetViewportOrgEx CreateDCA SetViewportExtEx SetMapMode SetWindowExtEx GetWindowExtEx DeleteObject LPtoDP GetDeviceCaps CreateICA DeleteDC SetBkColor SetTextColor SelectObject GetObjectA ExtTextOutA CreateSolidBrush CreateFontIndirectA EnumFontFamiliesA GetTextExtentPoint32A BitBlt

Name

.text

Size

52KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$SYSDIR/VB6KO.DLL

SHA256 c88069e00ebfde2ce18efd3832a948d0dc642b57db194d412511257d5b49193c
MD5 dccf769747dbdd5187877ae82934e346
SHA1 d5f4a8e686c441a5bca4d20f31297cadd017301a
SHA512 b0e3393db8836ea018c891c2c399dbf3116a6972fca521e136aaad712003b0a1534621d62b681b43e4833bbb3497e38ab4c613c227976e0699b8e98353ff46cb
SSDEEP 768:/TGLUGM7RMwTQvQF51u5tyxwgyBEkLki6Ynb:/TGL7WRjMYFCagQi6Yb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

$SYSDIR/asycfilt.dll

IMPHASH 5deee9ef803f3882a12b5c1690dcfb3e
SHA256 bcbc5fc2cbde5e2c13f4727b79de872370c2f65456871dd66d38e4128025bee2
MD5 18e9e721e2d9842a62a3028a55a45897
SHA1 d94dd3d3dc4c6578b5571e93820c52544f9c68de
SHA512 88b882c0a0c91aeb98291a1351e9e0fbf86fc0631ca3ea81cef0f3b7db1ab68ed8ce5a9f64174ead183c9d975b420e4349da5e8130aeb1a3a08cc40e361ad296
SSDEEP 1536:s+19jzicgHeTVJikHkd8fdSha48T5Al2c04R7MHv98R7D+:59jzhT+4yha485AUc0Jl8RH+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

62267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

asycfilt.pdb

$SYSDIR/msimg32.dll

IMPHASH cadcb7e945392853f233c18a3132d24b
SHA256 256913975457699479c7bb1d09c79c69da4e4d719c8ae1db43ecee3f00354f79
MD5 e8dc06c0278bb78deade7350a700c824
SHA1 79ca7b4b78262190cb96e05b1e16ba6c0aa95ad6
SHA512 9bf4fc36b1ff90eb71c6734977b5851ec6e38c6eab057d9b0caa244f9f32435a16b559081b4c9bbedb2de9223ac5ebc94de16c332183917826958adb2f07ea95
SSDEEP 48:aGy10e+pW+XbIyys9zTh38E4IIZWiw4z8XU5WwG2:xWl+JbdysVTqeEW3E8XIWwG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msimg32.pdb

$SYSDIR/msvbvm60.dll

IMPHASH 5d13f1b45437e48acf7175e1471cd9aa
SHA256 b9c31bc38e267341146b53abc73f3e459e0b178907d5d7d0733436ba7712fc4f
MD5 c3e742c17943a834f13d14a2e299491c
SHA1 1b5cc275bb9718a11966c55f6f35f43bc8b66ff1
SHA512 c04fe3fdde28dfe8dad10915d792ed1fd7e7036fc6434ffd266476dd94d4a0770c2355be0cedc34adda0efda3cff981c71a98fe06a17a88f4e5d9fbd71aedfdd
SSDEEP 24576:Z8etQLzlXRk3lfc+72APEFlexnaXhnc5YnGT4ftbB/h9HqjlMOy+8Jb6:q22z3k3lfc+CXhnc514ftbB/OjmnW
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ExitThread FlushFileBuffers CreateDirectoryA RemoveDirectoryA CreateThread MoveFileA LockFile UnlockFile TerminateProcess RaiseException GetCPInfo lstrlenA GetOEMCP SetHandleCount GetStdHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetStdHandle GetStringTypeW lstrcpynA _lclose SetEnvironmentVariableA GetTimeZoneInformation GetLocaleInfoA lstrcmpiA GetLastError GetModuleHandleA GetSystemDefaultLangID FormatMessageA HeapCreate GetWindowsDirectoryA GetPrivateProfileStringA lstrcatA CreateFileA ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement IsDBCSLeadByte IsBadReadPtr TlsGetValue lstrcpyA DeleteFileA lstrcmpA GetCurrentThreadId GetVersionExA HeapAlloc HeapFree LCMapStringW GetStringTypeA GetModuleFileNameW GetUserDefaultLangID GetComputerNameA SetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime SetFileTime GetLocalTime SetLocalTime RtlUnwind CreateProcessW IsValidCodePage FormatMessageW GetStartupInfoA UnhandledExceptionFilter ExitProcess SetCurrentDirectoryA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindNextFileA FindClose VirtualFree GetSystemInfo VirtualAlloc VirtualProtect FlushInstructionCache GetShortPathNameA WinExec lstrlenW lstrcpyW WriteFile SetEndOfFile SetFilePointer GetSystemTime SystemTimeToFileTime WaitForMultipleObjects ReleaseMutex CreateMutexA GetCurrentProcess DuplicateHandle ResumeThread GetCommandLineA TlsSetValue TlsFree TlsAlloc GetVersion CompareStringW lstrcmpiW MulDiv CreateProcessA GetExitCodeProcess LoadLibraryExA WaitForSingleObject ResetEvent SetEvent CreateEventA GetCurrentProcessId GetTickCount GetEnvironmentVariableA FreeResource GetSystemDefaultLCID GetPrivateProfileIntA IsBadCodePtr GetUserDefaultLCID GetSystemDirectoryA LoadLibraryA GetProcAddress Sleep GlobalDeleteAtom HeapDestroy SetErrorMode GlobalAddAtomA ReleaseSemaphore LCMapStringA CreateSemaphoreA VirtualQuery MultiByteToWideChar GetProfileStringA WideCharToMultiByte HeapReAlloc GetDriveTypeA CompareStringA GetFileAttributesA GetCurrentDirectoryA GetModuleFileNameA SetLastError GetFullPathNameA SearchPathA GetFileType GlobalUnlock GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc GlobalLock _lwrite _lread LockResource GetTempPathA GetTempFileNameA _llseek FreeLibrary HeapSize GetACP

user32

DdeAbandonTransaction DdeGetLastError DdeCreateDataHandle DdeCmpStringHandles SetCursorPos EnumClipboardFormats DestroyCursor GetAsyncKeyState WaitForInputIdle GetForegroundWindow VkKeyScanW SetWindowsHookExW keybd_event CharUpperBuffW CharUpperBuffA CharLowerBuffW FindWindowW FindWindowA MessageBoxIndirectA DialogBoxParamA EnumThreadWindows GetLastActivePopup SetActiveWindow GetClassInfoExA LoadIconA FrameRect CreateDialogParamA IsDialogMessageA EnableMenuItem ShowCursor OemToCharA CharToOemBuffA GetWindowTextA EndDialog DrawTextA SendDlgItemMessageA SetDlgItemTextA GetWindowPlacement GetSystemMetrics LoadBitmapA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects WaitMessage PostQuitMessage UnhookWindowsHookEx RegisterClipboardFormatA CreateCursor CreateIcon PostMessageW PeekMessageW GetPropA RemovePropA SetPropA SetForegroundWindow ClipCursor CallWindowProcA DefFrameProcA GetKeyState GetDlgItem IsWindow UnregisterClassA RegisterClassA AdjustWindowRect GetTabbedTextExtentA TabbedTextOutA FillRect CharToOemA MessageBoxA wsprintfA WinHelpA GetDesktopWindow SetRect GetWindowDC DestroyIcon GetClassInfoA AdjustWindowRectEx GetMenuItemCount RemoveMenu GetMenuStringA GetMenuState DdeClientTransaction DdeGetData CharPrevA CharNextA GetUpdateRgn GetUpdateRect PtInRect ChildWindowFromPointEx ReleaseCapture SetCapture InflateRect GetWindowRect ClientToScreen MoveWindow IsWindowEnabled IsChild SetParent IsIconic IsZoomed DefMDIChildProcA MessageBeep PeekMessageA PostMessageA LoadStringA AppendMenuA DestroyMenu CreatePopupMenu GetMessageTime GetMessagePos DrawFocusRect CopyAcceleratorTableA GetWindowRgn CharUpperA TranslateMDISysAccel SubtractRect IsRectEmpty InvalidateRgn InvalidateRect CopyRect GetDCEx IntersectRect LoadAcceleratorsA BringWindowToTop GetWindowThreadProcessId AttachThreadInput EqualRect EnableWindow SetFocus SendMessageA SetWindowsHookExA GetClassNameA LoadCursorA SetCursor SetWindowLongA GetWindow GetFocus GetKeyboardLayout GetSystemMenu CallNextHookEx GetParent DestroyWindow SetWindowTextA SetWindowPos UpdateWindow CreateWindowExA SystemParametersInfoA GetCapture WindowFromPoint ScreenToClient SetTimer IsWindowVisible ShowWindow KillTimer GetDC ReleaseDC MapWindowPoints GetCursorPos GetCursor OffsetRect GetIconInfo DefWindowProcA BeginPaint GetClientRect EndPaint GetSysColor GetActiveWindow GetWindowLongA DdeConnect DdePostAdvise DdeDisconnect DdeCreateStringHandleA DdeSetUserHandle DdeNameService DdeFreeStringHandle DdeUninitialize DdeInitializeA DdeFreeDataHandle DdeQueryConvInfo DdeQueryStringA DrawFrameControl SetScrollRange SetScrollPos IsClipboardFormatAvailable LockWindowUpdate CharLowerBuffA OpenClipboard SetClipboardData GetClipboardData GetCaretBlinkTime EmptyClipboard CloseClipboard CreateCaret SetCaretPos GetWindowTextLengthA DestroyCaret ShowCaret HideCaret DrawTextExA GetScrollPos GetClipboardFormatNameA CreateAcceleratorTableA SetWindowRgn ToAscii GetScrollInfo DestroyAcceleratorTable SetMenuItemInfoA SetScrollInfo GetMenuItemInfoA GetQueueStatus SetKeyboardState GetKeyboardState TrackPopupMenu GetDoubleClickTime SetWindowContextHelpId DeleteMenu SetMenuDefaultItem DrawMenuBar GetMenuItemID InsertMenuA GetSubMenu CreateMenu GetMenu SetMenu BeginDeferWindowPos ModifyMenuA CheckMenuItem PostThreadMessageA EndDeferWindowPos DeferWindowPos VkKeyScanA CharLowerA IsCharAlphaA DrawIcon GetCaretPos RegisterClassExA LoadImageA ShowScrollBar

gdi32

UnrealizeObject CreatePen SetBkColor SetTextColor CreatePatternBrush CreateSolidBrush DeleteObject CreateBitmap ExtTextOutA SelectObject SetBkMode GetBitmapBits GetObjectA GetTextExtentPointA CreateFontIndirectA CombineRgn SetRectRgn CreateRectRgn CreateRectRgnIndirect ExtSelectClipRgn OffsetRgn PtInRegion CreatePalette SelectPalette SelectClipRgn OffsetWindowOrgEx IntersectClipRect DeleteDC BitBlt SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap RestoreDC RealizePalette SetROP2 SaveDC GetClipBox SetWindowOrgEx ExcludeClipRect CreateHalftonePalette GetTextMetricsA PatBlt EnumFontsA TranslateCharsetInfo GetROP2 SetBrushOrgEx GetDeviceCaps GetObjectType CreatePenIndirect CreateBrushIndirect Rectangle GetStockObject Arc LineTo MoveToEx Pie Ellipse SetStretchBltMode GetPixel GetTextExtentPoint32A SetPixelV StretchDIBits GetCurrentObject TextOutA GetBkColor StretchBlt CreateDIBitmap CloseMetaFile SetWindowExtEx CreateMetaFileA EndDoc AbortDoc StartPage EndPage StartDocA CreateDCA ResetDCA Escape ScaleViewportExtEx SetViewportExtEx SetMapMode DeleteMetaFile PlayMetaFile SetAbortProc DeleteEnhMetaFile PlayEnhMetaFile CreateICA GetEnhMetaFileHeader ScaleWindowExtEx GetWindowOrgEx GetPaletteEntries CreateDIBSection CloseEnhMetaFile CreateEnhMetaFileA LPtoDP EqualRgn ExtCreateRegion GetDIBits SetTextAlign GetWindowExtEx GetViewportExtEx CopyMetaFileA CopyEnhMetaFileA PathToRegion EndPath BeginPath WidenPath GetTextColor GetMapMode SetDIBColorTable RoundRect CreateEllipticRgnIndirect CreateRoundRectRgn GetSystemPaletteEntries GetNearestColor CreateHatchBrush

advapi32

ReportEventA RegQueryValueExA RegCloseKey RegOpenKeyExA RegOpenKeyA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueA RegDeleteKeyA RegEnumKeyA RegSetValueExA RegCreateKeyA RegSetValueA RegDeleteValueA RegisterEventSourceA DeregisterEventSource RegQueryInfoKeyA RegEnumKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExW RegOpenKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegEnumValueA RegQueryValueExW RegCreateKeyW

ole32

OleCreateLinkToFile CoTaskMemFree BindMoniker CoLockObjectExternal RegisterDragDrop RevokeDragDrop DoDragDrop CreateILockBytesOnHGlobal OleFlushClipboard OleIsCurrentClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator CreateDataAdviseHolder CreateOleAdviseHolder CoRegisterClassObject CoRevokeClassObject CLSIDFromString OleDoAutoConvert OleRegGetUserType OleSaveToStream ReadClassStg ReadClassStm OleConvertIStorageToOLESTREAM OleConvertOLESTREAMToIStorage StgIsStorageILockBytes StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleCreateFromData OleCreateLinkFromData OleGetIconOfClass OleGetClipboard OleSetClipboard OleCreateLink CoTaskMemAlloc OleGetAutoConvert OleCreateFromFile CoMarshalInterface CoUnmarshalInterface CreateStreamOnHGlobal StringFromCLSID StringFromGUID2 CLSIDFromProgID ProgIDFromCLSID CoGetClassObject CoCreateInstance MkParseDisplayName CoIsOle1Class OleQueryLinkFromData OleQueryCreateFromData GetClassFile CreateBindCtx OleDuplicateData ReleaseStgMedium OleSetMenuDescriptor CoRegisterMessageFilter OleUninitialize OleInitialize CoGetMalloc OleRegGetMiscStatus CoCreateGuid IIDFromString CoFreeUnusedLibraries CoDisconnectObject IsAccelerator OleIsRunning OleRun OleLockRunning StgCreateDocfile WriteClassStg OleSave StgOpenStorage OleLoad

oleaut32

OleCreatePropertyFrame OleTranslateColor SysStringLen VariantClear SysAllocString VariantInit OleCreateFontIndirect OleCreatePictureIndirect SysFreeString OaBuildVersion SysAllocStringLen SysAllocStringByteLen SetErrorInfo CreateErrorInfo VariantChangeType DispGetParam LoadTypeLi GetErrorInfo LoadRegTypeLi RegisterTypeLi SysStringByteLen UnRegisterTypeLi LHashValOfNameSys LoadTypeLibEx SafeArrayAccessData SafeArrayGetElemsize SafeArrayUnaccessData SafeArrayCreate OleLoadPicture SafeArrayGetDim VariantCopy VariantCopyInd SafeArrayDestroy VariantChangeTypeEx CreateDispTypeInfo SafeArrayDestroyData DispInvoke SafeArrayGetUBound DispGetIDsOfNames SafeArrayGetElement SafeArrayPutElement SafeArrayGetLBound SafeArrayCopy OleIconToCursor SafeArrayRedim SafeArrayAllocDescriptor SafeArrayDestroyDescriptor RevokeActiveObject SafeArrayLock SafeArrayUnlock SafeArrayAllocData SysReAllocStringLen GetActiveObject VarDateFromStr VarCyFromI4 VarR8FromStr VarBstrFromI4 VarBstrFromR4 VarBstrFromI2 VarBstrFromDate VarBstrFromCy VarBstrFromR8 VarI4FromStr VarI4FromR8 VarI2FromStr VarCyFromStr VarR4FromStr LHashValOfNameSysA SysReAllocString

BASIC_CLASS_AddRef BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke BASIC_CLASS_QueryInterface BASIC_CLASS_Release BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo CopyRecord CreateIExprSrvObj DLLGetDocumentation DllCanUnloadNow DllFunctionCall DllGetClassObject DllRegisterServer DllUnregisterServer EVENT_SINK2_AddRef EVENT_SINK2_Release EVENT_SINK_AddRef EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke EVENT_SINK_QueryInterface EVENT_SINK_Release EbCreateContext EbDestroyContext EbGetErrorInfo EbGetHandleOfExecutingProject EbGetObjConnectionCounts EbGetVBAObject EbIsProjectOnStack EbLibraryLoad EbLibraryUnload EbLoadRunTime EbResetProject EbResetProjectNormal EbSetContextWorkerThread GetMem1 GetMem2 GetMem4 GetMem8 GetMemEvent GetMemNewObj GetMemObj GetMemStr GetMemVar IID_IVbaHost MethCallEngine ProcCallEngine PutMem1 PutMem2 PutMem4 PutMem8 PutMemEvent PutMemNewObj PutMemObj PutMemStr PutMemVar SetMemEvent SetMemNewObj SetMemObj SetMemVar ThunRTMain TipCreateInstanceEx TipCreateInstanceProject2 TipGetAddressOfPredeclaredInstance TipInvokeMethod TipInvokeMethod2 TipSetOption TipUnloadInstance TipUnloadProject UserDllMain VBDllCanUnloadNow VBDllGetClassObject VBDllRegisterServer VBDllUnRegisterServer VarPtr Zombie_AddRef Zombie_GetIDsOfNames Zombie_GetTypeInfo Zombie_GetTypeInfoCount Zombie_Invoke Zombie_QueryInterface Zombie_Release _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct __vbaAryConstruct2 __vbaAryCopy __vbaAryDestruct __vbaAryLock __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaAryVarVarg __vbaBoolErrVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs __vbaCyAdd __vbaCyErrVar __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 __vbaCyI4 __vbaCyInt __vbaCyMul __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt __vbaFailedFriend __vbaFileClose __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeObjList __vbaFreeStr __vbaFreeStrList __vbaFreeVar __vbaFreeVarList __vbaFreeVarg __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Abs __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2I4 __vbaI2Sgn __vbaI2Str __vbaI2Var __vbaI4Abs __vbaI4Cy __vbaI4ErrVar __vbaI4ForNextCheck __vbaI4Sgn __vbaI4Str __vbaI4Var __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew __vbaNew2 __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRedimVar2 __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCopy __vbaStrCy __vbaStrDate __vbaStrErrVarCopy __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike __vbaStrMove __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy __vbaUI1ErrVar __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarCopy __vbaVarDateVar __vbaVarDiv __vbaVarDup __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMove __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarVargNofree __vbaVarXor __vbaVarZero __vbaVargObj __vbaVargObjAddref __vbaVargParmRef __vbaVargUnk __vbaVargUnkAddref __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef __vbaVerifyVarObj __vbaWriteFile _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul rtBoolFromErrVar rtBstrFromErrVar rtCyFromErrVar rtDecFromVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtUI1FromErrVar rtcAbsVar rtcAnsiValueBstr rtcAppActivate rtcAppleScript rtcArray rtcAtn rtcBeep rtcBstrFromAnsi rtcBstrFromByte rtcBstrFromChar rtcBstrFromError rtcBstrFromFormatVar rtcByteValueBstr rtcCVErrFromVar rtcCallByName rtcChangeDir rtcChangeDrive rtcCharValueBstr rtcChoose rtcCommandBstr rtcCommandVar rtcCompareBstr rtcCos rtcCreateObject rtcCreateObject2 rtcCurrentDir rtcCurrentDirBstr rtcDDB rtcDateAdd rtcDateDiff rtcDateFromVar rtcDatePart rtcDeleteSetting rtcDir rtcDoEvents rtcEndOfFile rtcEnvironBstr rtcEnvironVar rtcErrObj rtcExp rtcFV rtcFileAttributes rtcFileCopy rtcFileDateTime rtcFileLen rtcFileLength rtcFileLocation rtcFileReset rtcFileSeek rtcFileWidth rtcFilter rtcFixVar rtcFormatCurrency rtcFormatDateTime rtcFormatNumber rtcFormatPercent rtcFreeFile rtcGetAllSettings rtcGetCurrentCalendar rtcGetDateBstr rtcGetDateValue rtcGetDateVar rtcGetDayOfMonth rtcGetDayOfWeek rtcGetErl rtcGetFileAttr rtcGetHostLCID rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetObject rtcGetPresentDate rtcGetSecondOfMinute rtcGetSetting rtcGetTimeBstr rtcGetTimeValue rtcGetTimeVar rtcGetTimer rtcGetYear rtcHexBstrFromVar rtcHexVarFromVar rtcIMEStatus rtcIPMT rtcIRR rtcImmediateIf rtcInStr rtcInStrChar rtcInStrRev rtcInputBox rtcInputCharCount rtcInputCharCountVar rtcInputCount rtcInputCountVar rtcIntVar rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsMissing rtcIsNull rtcIsNumeric rtcIsObject rtcJoin rtcKillFiles rtcLeftBstr rtcLeftCharBstr rtcLeftCharVar rtcLeftTrimBstr rtcLeftTrimVar rtcLeftVar rtcLenCharVar rtcLenVar rtcLog rtcLowerCaseBstr rtcLowerCaseVar rtcMIRR rtcMacId rtcMakeDir rtcMidBstr rtcMidCharBstr rtcMidCharVar rtcMidVar rtcMonthName rtcMsgBox rtcNPV rtcNPer rtcOctBstrFromVar rtcOctVarFromVar rtcPMT rtcPPMT rtcPV rtcPackDate rtcPackTime rtcPartition rtcQBColor rtcR8ValFromBstr rtcRandomNext rtcRandomize rtcRate rtcRemoveDir rtcReplace rtcRgb rtcRightBstr rtcRightCharBstr rtcRightCharVar rtcRightTrimBstr rtcRightTrimVar rtcRightVar rtcRound rtcSLN rtcSYD rtcSaveSetting rtcSendKeys rtcSetCurrentCalendar rtcSetDateBstr rtcSetDateVar rtcSetFileAttr rtcSetTimeBstr rtcSetTimeVar rtcSgnVar rtcShell rtcSin rtcSpaceBstr rtcSpaceVar rtcSplit rtcSqr rtcStrConvVar rtcStrConvVar2 rtcStrFromVar rtcStrReverse rtcStringBstr rtcStringVar rtcSwitch rtcTan rtcTrimBstr rtcTrimVar rtcTypeName rtcUpperCaseBstr rtcUpperCaseVar rtcVarBstrFromAnsi rtcVarBstrFromByte rtcVarBstrFromChar rtcVarDateFromVar rtcVarFromError rtcVarFromFormatVar rtcVarFromVar rtcVarStrFromVar rtcVarType rtcWeekdayName

$SYSDIR/oleaut32.dll

IMPHASH eb67fb08582adcae9c93b174f0c98aa8
SHA256 c1ac0acf15c829205b9968843f2672a397dab44202677a8b6d662e20fffc0bad
MD5 729d8c79442af7163dc5b79e9a3b6d72
SHA1 9a6047b9b79ec84e2a9b1f6a0657cc25f3f36890
SHA512 f8dea3923630fac571982c1772f585df54a3f1995a80a1c4f97ddf9f70050458be1eda30593ad92d35cd8f3f3476c7b4365df505e0ba83bbf299c454a25f3b48
SSDEEP 12288:gpLYYILO2zvDU7EEZ2xrtWCdwjsh/3mRqlE0p2K:CLYYITzbU7Eq2xrtWCdZuRqlEVK
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

5464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32.pdb

msvcrt

??1type_info@@UAE@XZ malloc _initterm _clearfp _errno strncpy strchr _stat getenv wcstoul _ultow remove _ultoa free calloc _abnormal_termination _CxxThrowException _wcslwr wcsncat wcsrchr strrchr __CxxFrameHandler _CIfmod wcsncpy strtoul memmove iswspace _wcsnicmp wcscpy wcsncmp wcschr _itoa atol atoi _strcmpi _strnicmp _CIpow ceil floor _stricmp _ui64tow _i64toa swprintf _i64tow _ftol modf wcslen _wtoi _wcsicmp wcscmp _itow ?terminate@@YAXXZ _adjust_fdiv _except_handler3

user32

GetSysColor WinHelpW EnableWindow GetMessageA DispatchMessageA PostQuitMessage GetActiveWindow SetActiveWindow SetFocus wsprintfW wsprintfA GetTopWindow IsWindowUnicode GetClientRect GetDialogBaseUnits GetKeyState GetDlgItem GetFocus SendMessageW GetParent CharLowerA GetWindowTextA RegisterClipboardFormatA SetWindowLongW DestroyIcon CopyImage CopyIcon GetIconInfo GetSystemMetrics DrawIcon CreateCursor CreateIcon ReleaseDC GetDC RegisterWindowMessageA PostMessageW GetMessageW TranslateMessage DispatchMessageW GetClassInfoW RegisterClassW DefWindowProcW IsWindow GetWindowLongW DestroyWindow CreateWindowExW CharNextA

gdi32

SaveDC CreateFontIndirectA GetTextExtentPointA Escape CreateDIBSection CreateDIBitmap CreateHalftonePalette IntersectClipRect GetWindowOrgEx OffsetViewportOrgEx PlayEnhMetaFile EnumMetaFile RestoreDC DeleteEnhMetaFile DeleteMetaFile PlayMetaFileRecord SetBitmapBits SetDIBits CreatePalette GetEnhMetaFileBits GetMetaFileBitsEx GetPaletteEntries CreateCompatibleDC BitBlt DeleteDC CreateCompatibleBitmap GetBitmapBits SetEnhMetaFileBits SetStretchBltMode SetBkColor SetTextColor SetMapMode SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx GetWinMetaFileBits GetCurrentObject GetObjectType GetStockObject SelectPalette RealizePalette StretchBlt GetDIBits StretchDIBits GetEnhMetaFileHeader GetObjectW GetBitmapDimensionEx SetMetaFileBitsEx CreateBitmap PatBlt DeleteObject CreateFontIndirectW GetDeviceCaps SelectObject GetTextFaceW GetTextMetricsW EnumFontFamiliesExW

kernel32

FreeLibrary Sleep SetThreadPriority WaitForMultipleObjects TerminateThread CompareStringW CompareStringA GetLocaleInfoW GetStringTypeExW GetStringTypeExA LCMapStringW LCMapStringA LoadLibraryA GetDateFormatA GetTimeFormatA GetDateFormatW GetTimeFormatW GetCurrentThread GetCurrentProcess CloseHandle InterlockedExchange IsBadReadPtr IsBadWritePtr GetLocalTime GetSystemDirectoryA CreateEventW WaitForSingleObject CreateThread OutputDebugStringA GetVersionExW GetVersion GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GlobalHandle MulDiv GlobalReAlloc LockResource IsDBCSLeadByte LoadResource FindResourceW _lclose _lread _lwrite _llseek InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrlenW GlobalDeleteAtom GlobalAddAtomW DebugBreak TlsAlloc InterlockedCompareExchange TlsFree TlsSetValue CreateFileA CreateFileW lstrcmpiA LoadLibraryW SearchPathA GetFullPathNameA SetLastError SearchPathW GetFullPathNameW UnmapViewOfFile MapViewOfFile GetSystemInfo CreateFileMappingA GetFileSize GetDriveTypeW GetDriveTypeA SetErrorMode QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetEvent GetLastError GetProcAddress GetModuleHandleA TlsGetValue GetSystemDefaultLCID GetUserDefaultLCID GetLocaleInfoA InterlockedIncrement HeapAlloc GetProcessHeap HeapFree InterlockedDecrement LeaveCriticalSection EnterCriticalSection GetNumberFormatW MultiByteToWideChar GetNumberFormatA WideCharToMultiByte GetCurrencyFormatW GetCurrencyFormatA

advapi32

RegFlushKey RegCreateKeyA RegSetValueExA RegOpenKeyA RegQueryValueA RegEnumValueA RegEnumKeyExA RegOpenKeyExA RegEnumKeyW RegCreateKeyW RegQueryValueExW RegSetValueExW RegDeleteKeyA RegQueryInfoKeyA RegCloseKey RegQueryValueW RegSetValueA RegOpenKeyW RegEnumKeyA RegNotifyChangeKeyValue RegQueryValueExA

ole32

CoUnmarshalInterface CoReleaseMarshalData ReleaseStgMedium StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal CoCreateInstance StgCreateDocfile CreateBindCtx ReadClassStg WriteFmtUserTypeStg WriteClassStg MkParseDisplayName HWND_UserFree HWND_UserUnmarshal HWND_UserMarshal HWND_UserSize CoUnmarshalHresult CoMarshalHresult CLSIDFromString CoSetState CoGetMalloc CoGetClassObject StringFromGUID2 CreateItemMoniker GetRunningObjectTable CoMarshalInterface

rpcrt4

NdrClientCall2

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal BstrFromVector ClearCustData CreateDispTypeInfo CreateErrorInfo CreateStdDispatch CreateTypeLib CreateTypeLib2 DispCallFunc DispGetIDsOfNames DispGetParam DispInvoke DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer DosDateTimeToVariantTime GetActiveObject GetAltMonthNames GetErrorInfo GetRecordInfoFromGuids GetRecordInfoFromTypeInfo GetVarConversionLocaleSetting LHashValOfNameSys LHashValOfNameSysA LPSAFEARRAY_Marshal LPSAFEARRAY_Size LPSAFEARRAY_Unmarshal LPSAFEARRAY_UserFree LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize LPSAFEARRAY_UserUnmarshal LoadRegTypeLib LoadTypeLib LoadTypeLibEx OACreateTypeLib2 OaBuildVersion OleCreateFontIndirect OleCreatePictureIndirect OleCreatePropertyFrame OleCreatePropertyFrameIndirect OleIconToCursor OleLoadPicture OleLoadPictureEx OleLoadPictureFile OleLoadPictureFileEx OleLoadPicturePath OleSavePictureFile OleTranslateColor QueryPathOfRegTypeLib RegisterActiveObject RegisterTypeLib RegisterTypeLibForUser RevokeActiveObject SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayAllocDescriptorEx SafeArrayCopy SafeArrayCopyData SafeArrayCreate SafeArrayCreateEx SafeArrayCreateVector SafeArrayCreateVectorEx SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SafeArrayGetDim SafeArrayGetElement SafeArrayGetElemsize SafeArrayGetIID SafeArrayGetLBound SafeArrayGetRecordInfo SafeArrayGetUBound SafeArrayGetVartype SafeArrayLock SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SafeArraySetIID SafeArraySetRecordInfo SafeArrayUnaccessData SafeArrayUnlock SetErrorInfo SetOaNoCache SetVarConversionLocaleSetting SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysReAllocString SysReAllocStringLen SysStringByteLen SysStringLen SystemTimeToVariantTime UnRegisterTypeLib UnRegisterTypeLibForUser VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VarAbs VarAdd VarAnd VarBoolFromCy VarBoolFromDate VarBoolFromDec VarBoolFromDisp VarBoolFromI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromI8 VarBoolFromR4 VarBoolFromR8 VarBoolFromStr VarBoolFromUI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromUI8 VarBstrCat VarBstrCmp VarBstrFromBool VarBstrFromCy VarBstrFromDate VarBstrFromDec VarBstrFromDisp VarBstrFromI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromR4 VarBstrFromR8 VarBstrFromUI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromUI8 VarCat VarCmp VarCyAbs VarCyAdd VarCyCmp VarCyCmpR8 VarCyFix VarCyFromBool VarCyFromDate VarCyFromDec VarCyFromDisp VarCyFromI1 VarCyFromI2 VarCyFromI4 VarCyFromI8 VarCyFromR4 VarCyFromR8 VarCyFromStr VarCyFromUI1 VarCyFromUI2 VarCyFromUI4 VarCyFromUI8 VarCyInt VarCyMul VarCyMulI4 VarCyMulI8 VarCyNeg VarCyRound VarCySub VarDateFromBool VarDateFromCy VarDateFromDec VarDateFromDisp VarDateFromI1 VarDateFromI2 VarDateFromI4 VarDateFromI8 VarDateFromR4 VarDateFromR8 VarDateFromStr VarDateFromUI1 VarDateFromUI2 VarDateFromUI4 VarDateFromUI8 VarDateFromUdate VarDateFromUdateEx VarDecAbs VarDecAdd VarDecCmp VarDecCmpR8 VarDecDiv VarDecFix VarDecFromBool VarDecFromCy VarDecFromDate VarDecFromDisp VarDecFromI1 VarDecFromI2 VarDecFromI4 VarDecFromI8 VarDecFromR4 VarDecFromR8 VarDecFromStr VarDecFromUI1 VarDecFromUI2 VarDecFromUI4 VarDecFromUI8 VarDecInt VarDecMul VarDecNeg VarDecRound VarDecSub VarDiv VarEqv VarFix VarFormat VarFormatCurrency VarFormatDateTime VarFormatFromTokens VarFormatNumber VarFormatPercent VarI1FromBool VarI1FromCy VarI1FromDate VarI1FromDec VarI1FromDisp VarI1FromI2 VarI1FromI4 VarI1FromI8 VarI1FromR4 VarI1FromR8 VarI1FromStr VarI1FromUI1 VarI1FromUI2 VarI1FromUI4 VarI1FromUI8 VarI2FromBool VarI2FromCy VarI2FromDate VarI2FromDec VarI2FromDisp VarI2FromI1 VarI2FromI4 VarI2FromI8 VarI2FromR4 VarI2FromR8 VarI2FromStr VarI2FromUI1 VarI2FromUI2 VarI2FromUI4 VarI2FromUI8 VarI4FromBool VarI4FromCy VarI4FromDate VarI4FromDec VarI4FromDisp VarI4FromI1 VarI4FromI2 VarI4FromI8 VarI4FromR4 VarI4FromR8 VarI4FromStr VarI4FromUI1 VarI4FromUI2 VarI4FromUI4 VarI4FromUI8 VarI8FromBool VarI8FromCy VarI8FromDate VarI8FromDec VarI8FromDisp VarI8FromI1 VarI8FromI2 VarI8FromR4 VarI8FromR8 VarI8FromStr VarI8FromUI1 VarI8FromUI2 VarI8FromUI4 VarI8FromUI8 VarIdiv VarImp VarInt VarMod VarMonthName VarMul VarNeg VarNot VarNumFromParseNum VarOr VarParseNumFromStr VarPow VarR4CmpR8 VarR4FromBool VarR4FromCy VarR4FromDate VarR4FromDec VarR4FromDisp VarR4FromI1 VarR4FromI2 VarR4FromI4 VarR4FromI8 VarR4FromR8 VarR4FromStr VarR4FromUI1 VarR4FromUI2 VarR4FromUI4 VarR4FromUI8 VarR8FromBool VarR8FromCy VarR8FromDate VarR8FromDec VarR8FromDisp VarR8FromI1 VarR8FromI2 VarR8FromI4 VarR8FromI8 VarR8FromR4 VarR8FromStr VarR8FromUI1 VarR8FromUI2 VarR8FromUI4 VarR8FromUI8 VarR8Pow VarR8Round VarRound VarSub VarTokenizeFormatString VarUI1FromBool VarUI1FromCy VarUI1FromDate VarUI1FromDec VarUI1FromDisp VarUI1FromI1 VarUI1FromI2 VarUI1FromI4 VarUI1FromI8 VarUI1FromR4 VarUI1FromR8 VarUI1FromStr VarUI1FromUI2 VarUI1FromUI4 VarUI1FromUI8 VarUI2FromBool VarUI2FromCy VarUI2FromDate VarUI2FromDec VarUI2FromDisp VarUI2FromI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromI8 VarUI2FromR4 VarUI2FromR8 VarUI2FromStr VarUI2FromUI1 VarUI2FromUI4 VarUI2FromUI8 VarUI4FromBool VarUI4FromCy VarUI4FromDate VarUI4FromDec VarUI4FromDisp VarUI4FromI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromI8 VarUI4FromR4 VarUI4FromR8 VarUI4FromStr VarUI4FromUI1 VarUI4FromUI2 VarUI4FromUI8 VarUI8FromBool VarUI8FromCy VarUI8FromDate VarUI8FromDec VarUI8FromDisp VarUI8FromI1 VarUI8FromI2 VarUI8FromI8 VarUI8FromR4 VarUI8FromR8 VarUI8FromStr VarUI8FromUI1 VarUI8FromUI2 VarUI8FromUI4 VarUdateFromDate VarWeekdayName VarXor VariantChangeType VariantChangeTypeEx VariantClear VariantCopy VariantCopyInd VariantInit VariantTimeToDosDateTime VariantTimeToSystemTime VectorFromBstr

$SYSDIR/olepro32.dll

IMPHASH bfbea1910cdffc9fc4cb569cbd816073
SHA256 577d518d25a8124af57e35fe7ce86eacc567a85d09d8f44ca8bd5387943ec585
MD5 9894bdf46052af74646d2cf025615360
SHA1 e56718d6b6d74c4a30a9e45616e3f1e3cd3e215e
SHA512 286b96bb50dea913bba7281c2966dbb23c5a47e702a07f18652d0bceee9f28349a757733fc8b5080fa28696cafb70647cb7fc5107724f76c3243cd4febe90f68
SSDEEP 1536:6XLfQESKEVTndak1M83b+xi8a9Kfr4lWPZxfWwtMNwTs:67fQ5TsOFbEi8NUl0ZpWIts
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

61048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

olepro32.pdb

user32

CreateIcon GetSysColor WinHelpW IsWindow EnableWindow GetMessageA GetMessageW TranslateMessage DispatchMessageW DispatchMessageA PostMessageW PostQuitMessage GetActiveWindow SetActiveWindow SetFocus DestroyWindow CreateCursor wsprintfA GetTopWindow IsWindowUnicode GetClientRect GetDialogBaseUnits GetDC ReleaseDC GetKeyState GetWindowLongW CharNextA GetWindowTextA CharLowerA GetParent SendMessageW GetFocus GetDlgItem DrawIcon GetSystemMetrics SetWindowLongW GetIconInfo CopyIcon CopyImage DestroyIcon RegisterClipboardFormatA wsprintfW

gdi32

GetWindowOrgEx IntersectClipRect SaveDC EnumFontFamiliesExW GetTextFaceW CreateHalftonePalette Escape CreateDIBSection CreateDIBitmap OffsetViewportOrgEx PlayEnhMetaFile EnumMetaFile RestoreDC DeleteEnhMetaFile DeleteMetaFile PlayMetaFileRecord SetBitmapBits SetDIBits CreatePalette GetEnhMetaFileBits GetMetaFileBitsEx CreateCompatibleDC BitBlt DeleteDC CreateCompatibleBitmap GetBitmapBits SetEnhMetaFileBits SetStretchBltMode SetBkColor SetTextColor SetMapMode SetWindowOrgEx SetWindowExtEx SetViewportOrgEx CreateFontIndirectW CreateFontIndirectA GetDeviceCaps DeleteObject GetTextExtentPointA GetTextMetricsW SelectObject GetPaletteEntries PatBlt CreateBitmap SetMetaFileBitsEx GetBitmapDimensionEx GetObjectW GetEnhMetaFileHeader StretchDIBits GetDIBits StretchBlt RealizePalette SelectPalette GetStockObject GetObjectType GetCurrentObject GetWinMetaFileBits SetViewportExtEx

kernel32

MultiByteToWideChar IsDBCSLeadByte FreeLibrary MulDiv LockResource LoadResource FindResourceW InterlockedIncrement InterlockedDecrement GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc LeaveCriticalSection EnterCriticalSection lstrlenW InitializeCriticalSectionAndSpinCount DeleteCriticalSection GlobalDeleteAtom GlobalAddAtomW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte GetProcAddress GetModuleHandleA GetVersion GetSystemDirectoryA GetLastError LoadLibraryA

advapi32

RegOpenKeyA RegOpenKeyW RegCreateKeyA RegSetValueA RegQueryValueW RegFlushKey RegCloseKey

msvcrt

free _initterm malloc _adjust_fdiv ??1type_info@@UAE@XZ ?terminate@@YAXXZ wcslen wcscpy wcsrchr ??3@YAXPAX@Z wcsncat ??2@YAPAXI@Z __CxxFrameHandler _except_handler3 _CIfmod calloc _CxxThrowException _wcslwr wcscmp _wcsicmp _ftol wcsncpy

ole32

StgCreateDocfile StringFromGUID2 CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes ReleaseStgMedium CoCreateInstance CoGetMalloc

oleaut32

LoadTypeLi VariantInit VariantClear SysFreeString SysAllocString VariantChangeType

$SYSDIR/stdole2.tlb

SHA256 f93850a15997c3c259afcaf1ea29666eb0dd2c5801b175c522438f8cd65cf1ac
MD5 93feb3c49788c4b6e8585787bfaca673
SHA1 a8ac987fa66d6b3c631ea9f34af303f743a4a013
SHA512 ef633ec7ecaf5eace6ddc269f4544b6d25113171567501626f9d92dcb527811e85ce0bdd28a8b634a8fc465489db2fe4b3602db477c843313ad079917bf8fa40
SSDEEP 192:LFn2YJdPWF0Y3wAQgiQJdDg5rDLWQrNBm5C7BTNcJL8Bz8QgWY:LFbuFrR+X6QNn1pcJIEWY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/wshom.ocx

IMPHASH ee88d179d715a60aeee5dcd390cafc03
SHA256 e102483d03588447dbf8efdf1bac54ebf1458c50429e39c76c20209b501bae18
MD5 45a87dbbfb14ff12b81e166147799c81
SHA1 95100c112ecaad15b4cd652b99c588f00e6e636b
SHA512 d1d6727fc418ba47d3dec2795906897579ac1abafbe935b077de307e967c34a13e7814ed50f9c517b6cb08753c01f064465d7a72615435bdb9bff314c88de228
SSDEEP 1536:VPp2rPBLfKq/d3K/O4WHXS0/xMTZ6ldtD1toKEPNje:VPp2rP5Kq/dZSixMTZ6vtDrki
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

43112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wshom.pdb

msvcrt

_wcsicmp ??2@YAPAXI@Z _adjust_fdiv malloc _vsnprintf ??3@YAXPAX@Z _initterm free wcsrchr wcschr _mbsnbcmp isupper tolower atoi _mbsicmp _mbsrchr _ismbcspace _ismbcdigit wcslen fopen fprintf fclose

oleaut32

SysAllocStringLen SafeArrayCreate SafeArrayRedim SafeArrayPutElement SysStringLen SysFreeString SysAllocString VarDateFromUdate VariantChangeTypeEx SafeArrayDestroy VariantClear SafeArrayCopy VariantInit SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound VariantCopy CreateErrorInfo VariantChangeType SafeArrayCreateVector LoadTypeLi LoadRegTypeLi RegisterTypeLi SetErrorInfo

ole32

CoGetMalloc CoCreateInstance

advapi32

RegOpenKeyExA RegQueryValueExW RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumValueA RegQueryInfoKeyA RegDeleteValueA RegDeleteValueW RegCreateKeyExA RegOpenKeyExW RegEnumKeyExA RegCloseKey GetUserNameW GetUserNameA RegisterEventSourceW ReportEventW DeregisterEventSource RegDeleteKeyA

kernel32

QueryPerformanceCounter SetCurrentDirectoryW SetCurrentDirectoryA GetCurrentDirectoryW GetCurrentDirectoryA CreatePipe GetCurrentProcess DuplicateHandle CreateProcessA CreateProcessW GetExitCodeThread GetTickCount lstrcmpA LoadLibraryA SetEnvironmentVariableA SetEnvironmentVariableW GetEnvironmentStrings FreeEnvironmentStringsA GetEnvironmentStringsW FreeEnvironmentStringsW GetFullPathNameA GetModuleFileNameA lstrcmpiA GetModuleHandleA GetProcAddress GetSystemDefaultLangID GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW lstrcpyA FreeLibrary GetLocaleInfoA GetVersionExA DebugBreak lstrcatA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle GetLastError TerminateProcess WaitForSingleObject GetExitCodeProcess WaitForMultipleObjects CreateThread InterlockedIncrement SetEvent InterlockedDecrement CreateEventA InitializeCriticalSection GetWindowsDirectoryA WideCharToMultiByte GetUserDefaultLCID GetLocalTime MultiByteToWideChar GetEnvironmentVariableA GetEnvironmentVariableW GetComputerNameA GetComputerNameW lstrlenW ExpandEnvironmentStringsA ExpandEnvironmentStringsW LocalFree LocalAlloc FormatMessageA FormatMessageW CompareStringA lstrlenA

user32

SendMessageTimeoutW AttachThreadInput IsWindowVisible IsWindowEnabled GetWindowTextA GetWindowTextLengthA GetWindowTextW GetWindowTextLengthW GetDesktopWindow FindWindowA FindWindowW GetWindow SetKeyboardState keybd_event SetFocus VkKeyScanA wsprintfA SendMessageTimeoutA PeekMessageA DispatchMessageA TranslateMessage MsgWaitForMultipleObjects MessageBoxW EnumThreadWindows EnumWindows CharNextA GetWindowThreadProcessId PostMessageA GetKeyboardState LoadStringW SetForegroundWindow LoadStringA

mpr

WNetEnumResourceW WNetEnumResourceA WNetCloseEnum WNetCancelConnection2W WNetCancelConnection2A WNetAddConnection2W WNetAddConnection2A WNetOpenEnumA

shell32

ShellExecuteExA SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA

winspool.drv

OpenPrinterA AddPrinterConnectionW AddPrinterA GetPrinterA SetPrinterA EnumPrintersW ClosePrinter DeletePrinter DeletePrinterConnectionW EnumPrintersA

scrrun

DoOpenPipeStream

FileSum.ocx

IMPHASH c26b460f5a5b2dc1dbb80f57da59fc4e
SHA256 394f4ed7e57ac0fd35c2872654604460d2d7bf9d8357c3114de8925f21cb024d
MD5 d6ce1884603485cb1b7e73a39abc43cb
SHA1 47c99583b4f2cdfa86e05486cd72d2dc7c8a76a5
SHA512 760c0b00a76794c7fefe28098aa659eb86c2b787a57d352be063df1ffbcfbcb19d613816e3ba9a434f9f4c7e301138e215fb88472d0d15baec4c53c367dddd3a
SSDEEP 6144:IKnd3jHpwHWV8LapwHWV8LapwHWV8EFozOhkXiFozOhkXiFMsQ+x4A3gjL:IO3jXGUG
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

8792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLateIdCall __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList _adj_fprem1 ord519 __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 ord666 __vbaAryVar __vbaAryDestruct ord591 __vbaExitProc __vbaI4Abs ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord520 __vbaBoolVar __vbaFpR8 __vbaBoolVarNull _CIsin __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner3 __vbaPrintObj __vbaI2I4 DllFunctionCall __vbaVarOr __vbaFpUI1 __vbaCastObjVar _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaRedim EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 __vbaStrToUnicode __vbaPrintFile _adj_fprem _adj_fdivr_m64 __vbaI2Str __vbaVarDiv ord714 __vbaFPException ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaVar2Vec ord648 __vbaNew2 __vbaVarInt _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord685 ord101 ord102 __vbaI4Var ord103 __vbaVarCmpEq ord104 ord105 __vbaAryLock __vbaVarAdd __vbaVarDup __vbaStrToAnsi ord613 ord614 __vbaFpI2 __vbaFpI4 ord617 __vbaLateMemCallLd _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaStrVarCopy _allmul __vbaLenVarB __vbaLateIdSt _CItan ord546 __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj

FilesumUpdater.exe

IMPHASH bfa505bf15f791baeb091d3f1138a31e
SHA256 06cdf6e2bc6dbae85789c40b51dbd1d314d31a9a9c19f34648915836d8350b3c
MD5 8049f50df57efbd8c32b04066445f5c1
SHA1 9899108f4f36d9ec45500b7446bdf825debc8a63
SHA512 bee641c4ca4da259b6a9bba41f223117ea4c4cb99ad8ddfea155660184f4b20be7eacd2d79ae9ad5c7bf6d26fc26499520e746e5e47c29e7ea0681242b1cc496
SSDEEP 1536:U7cwXw/Z4RoBPYXnj3WCW2EW58/kdDT9t:U7cwXU4Tnj3WCW2EW54Gj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

9190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenUrlA InternetSetFilePointer InternetCloseHandle InternetOpenA InternetReadFile

mfc42

ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord825 ord815 ord641 ord765 ord800 ord2514 ord2621 ord1134 ord5265 ord4376 ord4853 ord4998 ord6052 ord1775 ord5280 ord4425 ord3597 ord5199 ord4078 ord1776 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5290 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord3402 ord4627 ord3698 ord1146 ord1576 ord540 ord567 ord324 ord2302 ord4234 ord1105 ord4710 ord2379 ord755 ord470 ord6215 ord1200 ord858 ord2818 ord924 ord860 ord535 ord941 ord537 ord823 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4673 ord6055 ord1168

msvcrt

fclose fwrite fseek fopen _ftol __dllonexit _onexit _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp _strdup _mbscmp atoi __CxxFrameHandler _setmbcp

kernel32

Sleep GetTempPathA WinExec GetPrivateProfileStringA GetModuleHandleA GetStartupInfoA DeleteFileA

user32

LoadIconA SendMessageA DrawIcon GetClientRect GetSystemMetrics IsIconic PostMessageA EnableWindow

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

urlmon

URLDownloadToFileA

uninst.exe.nsis

SHA256 b315151b44068c6089b14cd4a9e92af8402ee555ab24fcf070c3253c42e0c8c5
MD5 8f06c9bd5fc090492667179aa189a827
SHA1 1d25023f5d731264c8776d295708f64f8a207cf0
SHA512 9a29ee8a8ebe91ece47423b23ee0b8ef95314cd79e476228b2c60e0be5aa20f3c489f982a319dd69f544bd97408beb81f383f9925a37dffd6c77e2d8970c922c
SSDEEP 384:87hhSvi+VZdqf4J+JNmEvtBgBS1eTHEfb2Q92sJRa5sZNs6geZ1N1avPGy9qxi1l:4hhRSKf4yVvtBgnTkL2uRaw3avugQL+v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer