c04073836b8e29dc110559d294a99afe_JaffaCakes118

resource
c04073836b8e29dc110559d294a99afe_JaffaCakes118
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$SYSDIR/MSVBVM60.DLL
unpack001/$SYSDIR/SLDrawForm.ocx
unpack001/$WINDIR/LastGood/system32/ASYCFILT.DLL
unpack001/$WINDIR/LastGood/system32/COMCAT.DLL
unpack001/$WINDIR/LastGood/system32/MSVBVM60.DLL
unpack001/$WINDIR/LastGood/system32/OLEAUT32.DLL
unpack001/$WINDIR/LastGood/system32/OLEPRO32.DLL
unpack001/$WINDIR/LastGood/system32/STDOLE2.TLB
unpack001/DTDJ_1.exe
unpack001/SL_SuDoku.exe
unpack001/uninst.exe
unpack002/$PLUGINSDIR/FindProcDLL.dll

IMPHASH dd1742eadfc6df18ded3c26ae64ad610
SHA256 d495329f8ea7eee5e6a9cb1c5881d0ee09f2dcc977647a897426fb4fc0406587
MD5 c04073836b8e29dc110559d294a99afe
SHA1 dcb903c2f9877193a4bc3edf8e0adc952c2217f0
SHA512 31144622d54d4096717c89e0da08c704e926032a8acf33a0ff2ffb113cbeb92d1aa7516d1f740f0407a2985fbb8d6811ca758d79d0a48a1460da06f3b4196c8b
SSDEEP 49152:UGbxJmHlSjSn8Z2jv6YwCuQVH0DRPmAV/PTnNYvGZzsLVIciwBH9PdgRbF19IfqZ:UAm0SwltbQGPmAVHTnNYtV11/kbvXEa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA CloseHandle GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/BrandingURL.dll

IMPHASH 711c893e4d8189fd14b6563a4e35e663
SHA256 05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a
MD5 9c3488b5e9655d1837c3963ecec33f70
SHA1 f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3
SHA512 6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 747d0222b652dbfc85e0de4f8486473662d325a55e32c7eacb91e53e37ceba58
MD5 b18dfaded8f6d2380fdfd8f6b6969211
SHA1 969fa0e906240ab1123254feeb833c275626cf76
SHA512 25fb09b8657997d31e61c908f1cd08357c1a1b68bbb1ba377e87b6a3eb347a2ef96c1a771b6c4332853abb33728c55c83efa73df5da03f3dfc132f8a69a2886c
SSDEEP 192:66JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTLK72dwF7dBdcQOz:66JaVh4I5rpPbTL+BdhO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 946eb0a1e85c9ade4acaf634eb5a64f1
SHA256 e54792a179a06acbb9b69c117ee804dce070505d1853d6e7d512f2a055a801b2
MD5 9b17a13f814b137f88b961c087858063
SHA1 c290dd3139b79aa340aec3ed3d674160433035e1
SHA512 3a625f5f13e344c24973c79c074d1ced4d9206f87f392dc7c8f0c116d0f2b878b60340e2377d0240c47f0e34e25e4e3af8b196bbca1c6a29a0f51d8408e8b0ec
SSDEEP 48:SnNQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJcABofgMGKO:Bz+MM4eqmvz0JScx56mpwzAhWcGV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5545

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779
MD5 810f3a0aefe36a9f63e29e604bea91a9
SHA1 2559d3d4adf51f8ecbe2d07e669e344eb7d0bd80
SHA512 836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb
SSDEEP 192:CO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1argMO:XKAFERdlxhGRYUzqZar
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 52bd165e629671d5ee0a51784ad856a5c4b1cab762f17aa680565ef5b3c29cd3
MD5 4ec49fef5664343fd61beb044a420455
SHA1 43bd6e2b6e156b336dd6f25529311bb1743931dc
SHA512 0d4fc02701073ca0ebd96248b2e2d912a3046972c7e6403576808f054160c863f310ea7a05cd4a6fb1f95ef63f235e694c373e253abe4f708e2cfa30db0ac066
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 c943e846e0b8aa03157891ba3566b7f78dee0272d240fd9d41fe89e9c4affe3b
MD5 bbe3e0417fe6bc04f20cd204800e32d3
SHA1 5baf85aee4e5a57ac9ef69aef7502621b40bf9f8
SHA512 066318a4e817c22a98ee210be5791c8ab6a8d9ab544d436dcb921173445f2e16c16fd2584fe8bccffaf03bb463cb50b74c1b10503c3e3cf6a36607f2796427cd
SSDEEP 768:swu/2kG61B631T+F3vJFstIVBraimiHFHVqUpQ2kP9:jG638bjBraifAU3kP9
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 00f266f22ccb67fe0324b7350706aeae645a40f03c7f853e64d65647fe2763a1
MD5 5da65950f51d92f06790dade212f743c
SHA1 172403a13e10da15503d12e1aa01bc6bd0635335
SHA512 45d684205a55d867ca576b9c0046f03d8e5b85360329bc199d1da018206ba0c62d8288750ddd66b0a031ef4dffcd73507972ab4552c54e007e17e9a595c7fccc
SSDEEP 1536:yYoGGGGGGGzUTkajDWs399R9A999z9999l9oHvj39Vkvy5s/wEz9uaM/UmQyuIup:loGGGGGGGzUTkLK5uVX3yBBT5rD6s+
MD5 SHA1 SHA512 SSDEEP

$SYSDIR/MSVBVM60.DLL

IMPHASH 52aa5ee856953e49635e554af5207319
SHA256 3ef32e0152cc3fa07c417e6aadf9ead83a17b5fdee73799044e1bd7564725d6e
MD5 f28eb5cbc3ca6d8c787f09f047d1f9c8
SHA1 70db1fac822974bc9b636a984bcc1da2e67f8de5
SHA512 84f811f75e9d5143898728d2109b349802a292d4ef2ccae4b4421d20268a33c6ddee9c70e8bdeb474a3ac70307b2554c00ce786ca1f446807610fa2717f3745f
SSDEEP 24576:jrWIEO0eDfcPOvCOpMEPJonhql5oHS+zh3JajtObuF+T+NUFRjUgIeX40sgdp:jrOuCQhJohq3oHrh3JajtObu2+NUF5Vd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread ExitThread FlushFileBuffers CreateDirectoryA GetTimeZoneInformation RemoveDirectoryA MoveFileA LockFile UnlockFile TerminateProcess RaiseException SetEnvironmentVariableA lstrlenA GetACP GetOEMCP SetHandleCount GetStdHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetStdHandle GetStringTypeW lstrcpynA FreeLibrary GetLocaleInfoA lstrcmpiA GetLastError GetModuleHandleA GetSystemDefaultLangID FormatMessageA HeapCreate GetWindowsDirectoryA GetPrivateProfileStringA lstrcatA CreateFileA ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement IsDBCSLeadByte IsBadReadPtr TlsGetValue lstrcpyA DeleteFileA lstrcmpA GetCurrentThreadId GetVersionExA HeapAlloc HeapFree LCMapStringW GetStringTypeA GetModuleFileNameW GetUserDefaultLangID GetComputerNameA SetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime SetFileTime GetLocalTime SetLocalTime RtlUnwind CreateProcessW IsValidCodePage FormatMessageW GetStartupInfoA UnhandledExceptionFilter ExitProcess SetCurrentDirectoryA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindNextFileA FindClose VirtualFree GetSystemInfo VirtualAlloc VirtualProtect FlushInstructionCache FindResourceExA GetShortPathNameA WinExec lstrlenW lstrcpyW WriteFile SetEndOfFile SetFilePointer GetSystemTime SystemTimeToFileTime WaitForMultipleObjects ReleaseMutex CreateMutexA GetCurrentProcess DuplicateHandle ResumeThread GetCommandLineA TlsSetValue TlsFree TlsAlloc GetVersion CompareStringW lstrcmpiW MulDiv CreateProcessA GetExitCodeProcess LoadLibraryExA WaitForSingleObject ResetEvent SetEvent CreateEventA GetCurrentProcessId GetTickCount GetEnvironmentVariableA FreeResource GetSystemDefaultLCID GetPrivateProfileIntA IsBadCodePtr GetUserDefaultLCID GetSystemDirectoryA LoadLibraryA GetProcAddress Sleep GlobalDeleteAtom HeapDestroy SetErrorMode GlobalAddAtomA ReleaseSemaphore LCMapStringA CreateSemaphoreA VirtualQuery MultiByteToWideChar GetProfileStringA WideCharToMultiByte HeapReAlloc GetDriveTypeA CompareStringA GetFileAttributesA GetCurrentDirectoryA GetModuleFileNameA SetLastError GetFullPathNameA SearchPathA GetFileType GlobalUnlock GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc GlobalLock _lwrite _lread LockResource GetTempPathA GetTempFileNameA _lclose _llseek HeapSize GetCPInfo

user32

DdeGetLastError DdeCreateDataHandle DdeCmpStringHandles DdeGetData SetCursorPos EnumClipboardFormats DestroyCursor GetAsyncKeyState WaitForInputIdle GetForegroundWindow VkKeyScanW SetWindowsHookExW keybd_event CharUpperBuffW CharUpperBuffA CharLowerBuffW FindWindowW FindWindowA MessageBoxIndirectA DialogBoxParamA EnumThreadWindows GetLastActivePopup SetActiveWindow GetClassInfoExA LoadIconA LoadImageA FrameRect CreateDialogParamA IsDialogMessageA EnableMenuItem ShowCursor OemToCharA CharToOemBuffA GetWindowTextA EndDialog DrawTextA SendDlgItemMessageA SetDlgItemTextA GetWindowPlacement GetSystemMetrics LoadBitmapA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects WaitMessage PostQuitMessage UnhookWindowsHookEx RegisterClipboardFormatA CreateCursor CreateIcon PostMessageW PeekMessageW GetPropA RemovePropA SetPropA SetForegroundWindow ClipCursor CallWindowProcA DefFrameProcA GetKeyState GetDlgItem IsWindow UnregisterClassA RegisterClassA AdjustWindowRect GetTabbedTextExtentA TabbedTextOutA FillRect CharToOemA MessageBoxA wsprintfA WinHelpA GetDesktopWindow SetRect GetWindowDC DestroyIcon GetClassInfoA AdjustWindowRectEx GetMenuItemCount RemoveMenu GetMenuStringA GetMenuState DdePostAdvise DdeAbandonTransaction CharPrevA CharNextA GetUpdateRgn GetUpdateRect PtInRect ChildWindowFromPointEx ReleaseCapture SetCapture InflateRect GetWindowRect ClientToScreen MoveWindow IsWindowEnabled IsChild SetParent IsIconic IsZoomed DefMDIChildProcA MessageBeep PeekMessageA PostMessageA LoadStringA AppendMenuA DestroyMenu CreatePopupMenu GetMessageTime GetMessagePos DrawFocusRect CopyAcceleratorTableA GetWindowRgn CharUpperA TranslateMDISysAccel SubtractRect IsRectEmpty InvalidateRgn InvalidateRect CopyRect GetDCEx IntersectRect LoadAcceleratorsA BringWindowToTop GetWindowThreadProcessId AttachThreadInput EqualRect EnableWindow SetFocus SendMessageA SetWindowsHookExA GetClassNameA LoadCursorA SetCursor SetWindowLongA GetWindow GetFocus GetKeyboardLayout GetSystemMenu CallNextHookEx GetParent DestroyWindow SetWindowTextA SetWindowPos UpdateWindow CreateWindowExA SystemParametersInfoA GetCapture WindowFromPoint ScreenToClient SetTimer IsWindowVisible ShowWindow KillTimer GetDC ReleaseDC MapWindowPoints GetCursorPos GetCursor OffsetRect GetIconInfo DefWindowProcA BeginPaint GetClientRect EndPaint GetSysColor GetActiveWindow GetWindowLongA DdeClientTransaction DdeSetUserHandle DdeDisconnect DdeConnect DdeUninitialize DdeNameService DdeCreateStringHandleA DdeQueryConvInfo DdeInitializeA DdeFreeStringHandle SetScrollRange DdeQueryStringA DdeFreeDataHandle LockWindowUpdate SetScrollPos DrawFrameControl SetClipboardData CharLowerBuffA IsClipboardFormatAvailable EmptyClipboard GetClipboardData OpenClipboard SetCaretPos CloseClipboard GetCaretBlinkTime ShowCaret GetWindowTextLengthA CreateCaret GetScrollPos HideCaret DestroyCaret SetWindowRgn GetClipboardFormatNameA DrawTextExA DestroyAcceleratorTable ToAscii CreateAcceleratorTableA SetScrollInfo ShowScrollBar SetKeyboardState GetMenuItemInfoA SetMenuItemInfoA GetDoubleClickTime GetKeyboardState GetQueueStatus SetMenuDefaultItem SetWindowContextHelpId TrackPopupMenu InsertMenuA DrawMenuBar DeleteMenu GetMenu GetSubMenu GetMenuItemID ModifyMenuA SetMenu CreateMenu EndDeferWindowPos CheckMenuItem BeginDeferWindowPos VkKeyScanA DeferWindowPos PostThreadMessageA DrawIcon CharLowerA IsCharAlphaA GetCaretPos RegisterClassExA GetScrollInfo

gdi32

UnrealizeObject CreatePen SetBkColor SetTextColor CreatePatternBrush DeleteObject CreateBitmap ExtTextOutA SelectObject SetBkMode GetBitmapBits GetObjectA GetTextExtentPointA CreateFontIndirectA CombineRgn SetRectRgn CreateRectRgn CreateRectRgnIndirect ExtSelectClipRgn OffsetRgn PtInRegion CreatePalette SelectPalette SelectClipRgn OffsetWindowOrgEx IntersectClipRect DeleteDC BitBlt SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap RestoreDC RealizePalette SetROP2 SaveDC GetClipBox SetWindowOrgEx ExcludeClipRect CreateHalftonePalette GetTextMetricsA PatBlt EnumFontsA TranslateCharsetInfo GetROP2 SetBrushOrgEx GetDeviceCaps GetObjectType CreatePenIndirect CreateBrushIndirect Rectangle GetStockObject Arc LineTo MoveToEx Pie Ellipse SetStretchBltMode GetPixel GetTextExtentPoint32A SetPixelV StretchDIBits GetCurrentObject TextOutA GetBkColor StretchBlt CreateDIBitmap CloseMetaFile SetWindowExtEx CreateMetaFileA EndDoc AbortDoc StartPage EndPage StartDocA CreateDCA ResetDCA Escape ScaleViewportExtEx SetViewportExtEx SetMapMode DeleteMetaFile PlayMetaFile SetAbortProc DeleteEnhMetaFile PlayEnhMetaFile CreateICA GetEnhMetaFileHeader ScaleWindowExtEx GetWindowOrgEx GetPaletteEntries CreateDIBSection CloseEnhMetaFile CreateEnhMetaFileA LPtoDP EqualRgn ExtCreateRegion GetDIBits SetTextAlign GetWindowExtEx GetViewportExtEx CopyMetaFileA CopyEnhMetaFileA PathToRegion EndPath BeginPath WidenPath GetTextColor GetMapMode SetDIBColorTable RoundRect CreateEllipticRgnIndirect CreateRoundRectRgn GetSystemPaletteEntries GetNearestColor CreateHatchBrush CreateSolidBrush

advapi32

ReportEventA RegQueryValueExA RegCloseKey RegOpenKeyExA RegOpenKeyA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueA RegDeleteKeyA RegEnumKeyA RegSetValueExA RegCreateKeyA RegSetValueA RegDeleteValueA RegisterEventSourceA DeregisterEventSource RegQueryInfoKeyA RegEnumKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExW RegOpenKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegEnumValueA RegQueryValueExW RegCreateKeyW

ole32

OleCreateLinkToFile CoTaskMemFree BindMoniker CoLockObjectExternal RegisterDragDrop RevokeDragDrop DoDragDrop CreateILockBytesOnHGlobal OleFlushClipboard OleIsCurrentClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator CreateDataAdviseHolder CreateOleAdviseHolder CoRegisterClassObject CoRevokeClassObject CLSIDFromString OleDoAutoConvert OleRegGetUserType OleSaveToStream ReadClassStg ReadClassStm OleConvertIStorageToOLESTREAM OleConvertOLESTREAMToIStorage StgIsStorageILockBytes StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleCreateFromData OleCreateLinkFromData OleGetIconOfClass OleGetClipboard OleSetClipboard OleCreateLink CoTaskMemAlloc OleGetAutoConvert OleCreateFromFile CoMarshalInterface CoUnmarshalInterface CreateStreamOnHGlobal StringFromCLSID StringFromGUID2 CLSIDFromProgID ProgIDFromCLSID CoGetClassObject CoCreateInstance MkParseDisplayName CoIsOle1Class OleQueryLinkFromData OleQueryCreateFromData GetClassFile CreateBindCtx OleDuplicateData ReleaseStgMedium OleSetMenuDescriptor CoRegisterMessageFilter OleUninitialize OleInitialize CoGetMalloc OleRegGetMiscStatus CoCreateGuid IIDFromString CoFreeUnusedLibraries CoDisconnectObject IsAccelerator OleIsRunning OleRun OleLockRunning StgCreateDocfile WriteClassStg OleSave StgOpenStorage OleLoad

oleaut32

SysStringLen OleTranslateColor VariantInit VariantClear OleCreatePropertyFrame SysFreeString OleCreateFontIndirect SysAllocString SysAllocStringByteLen OaBuildVersion OleCreatePictureIndirect VariantChangeType SetErrorInfo SysAllocStringLen GetErrorInfo DispGetParam CreateErrorInfo SysStringByteLen LoadRegTypeLi LoadTypeLi LoadTypeLibEx UnRegisterTypeLi RegisterTypeLi SafeArrayUnaccessData SafeArrayAccessData LHashValOfNameSys SafeArrayGetDim SafeArrayCreate SafeArrayGetElemsize SafeArrayDestroy VariantCopy OleLoadPicture SafeArrayDestroyData VariantChangeTypeEx VariantCopyInd DispGetIDsOfNames DispInvoke CreateDispTypeInfo SafeArrayGetLBound SafeArrayGetElement SafeArrayGetUBound SafeArrayRedim SafeArrayCopy SafeArrayPutElement RevokeActiveObject SafeArrayAllocDescriptor OleIconToCursor SafeArrayAllocData SafeArrayLock SafeArrayDestroyDescriptor VarDateFromStr SysReAllocStringLen SafeArrayUnlock VarR8FromStr VarCyFromI4 GetActiveObject VarBstrFromI2 VarBstrFromI4 VarBstrFromR8 VarBstrFromDate VarBstrFromR4 VarI2FromStr VarI4FromStr VarBstrFromCy VarR4FromStr VarCyFromStr VarI4FromR8 SysReAllocString LHashValOfNameSysA

BASIC_CLASS_AddRef BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke BASIC_CLASS_QueryInterface BASIC_CLASS_Release BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo CopyRecord CreateIExprSrvObj DLLGetDocumentation DllCanUnloadNow DllFunctionCall DllGetClassObject DllRegisterServer DllUnregisterServer EVENT_SINK2_AddRef EVENT_SINK2_Release EVENT_SINK_AddRef EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke EVENT_SINK_QueryInterface EVENT_SINK_Release EbCreateContext EbDestroyContext EbGetErrorInfo EbGetHandleOfExecutingProject EbGetObjConnectionCounts EbGetVBAObject EbIsProjectOnStack EbLibraryLoad EbLibraryUnload EbLoadRunTime EbResetProject EbResetProjectNormal EbSetContextWorkerThread GetMem1 GetMem2 GetMem4 GetMem8 GetMemEvent GetMemNewObj GetMemObj GetMemStr GetMemVar IID_IVbaHost MethCallEngine ProcCallEngine PutMem1 PutMem2 PutMem4 PutMem8 PutMemEvent PutMemNewObj PutMemObj PutMemStr PutMemVar SetMemEvent SetMemNewObj SetMemObj SetMemVar ThunRTMain TipCreateInstanceEx TipCreateInstanceProject2 TipGetAddressOfPredeclaredInstance TipInvokeMethod TipInvokeMethod2 TipSetOption TipUnloadInstance TipUnloadProject UserDllMain VBDllCanUnloadNow VBDllGetClassObject VBDllRegisterServer VBDllUnRegisterServer VarPtr Zombie_AddRef Zombie_GetIDsOfNames Zombie_GetTypeInfo Zombie_GetTypeInfoCount Zombie_Invoke Zombie_QueryInterface Zombie_Release _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct __vbaAryConstruct2 __vbaAryCopy __vbaAryDestruct __vbaAryLock __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaAryVarVarg __vbaBoolErrVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs __vbaCyAdd __vbaCyErrVar __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 __vbaCyI4 __vbaCyInt __vbaCyMul __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt __vbaFailedFriend __vbaFileClose __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeObjList __vbaFreeStr __vbaFreeStrList __vbaFreeVar __vbaFreeVarList __vbaFreeVarg __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Abs __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2I4 __vbaI2Sgn __vbaI2Str __vbaI2Var __vbaI4Abs __vbaI4Cy __vbaI4ErrVar __vbaI4ForNextCheck __vbaI4Sgn __vbaI4Str __vbaI4Var __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew __vbaNew2 __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRedimVar2 __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCopy __vbaStrCy __vbaStrDate __vbaStrErrVarCopy __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike __vbaStrMove __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy __vbaUI1ErrVar __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarCopy __vbaVarDateVar __vbaVarDiv __vbaVarDup __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMove __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarVargNofree __vbaVarXor __vbaVarZero __vbaVargObj __vbaVargObjAddref __vbaVargParmRef __vbaVargUnk __vbaVargUnkAddref __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef __vbaVerifyVarObj __vbaWriteFile _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul rtBoolFromErrVar rtBstrFromErrVar rtCyFromErrVar rtDecFromVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtUI1FromErrVar rtcAbsVar rtcAnsiValueBstr rtcAppActivate rtcAppleScript rtcArray rtcAtn rtcBeep rtcBstrFromAnsi rtcBstrFromByte rtcBstrFromChar rtcBstrFromError rtcBstrFromFormatVar rtcByteValueBstr rtcCVErrFromVar rtcCallByName rtcChangeDir rtcChangeDrive rtcCharValueBstr rtcChoose rtcCommandBstr rtcCommandVar rtcCompareBstr rtcCos rtcCreateObject rtcCreateObject2 rtcCurrentDir rtcCurrentDirBstr rtcDDB rtcDateAdd rtcDateDiff rtcDateFromVar rtcDatePart rtcDeleteSetting rtcDir rtcDoEvents rtcEndOfFile rtcEnvironBstr rtcEnvironVar rtcErrObj rtcExp rtcFV rtcFileAttributes rtcFileCopy rtcFileDateTime rtcFileLen rtcFileLength rtcFileLocation rtcFileReset rtcFileSeek rtcFileWidth rtcFilter rtcFixVar rtcFormatCurrency rtcFormatDateTime rtcFormatNumber rtcFormatPercent rtcFreeFile rtcGetAllSettings rtcGetCurrentCalendar rtcGetDateBstr rtcGetDateValue rtcGetDateVar rtcGetDayOfMonth rtcGetDayOfWeek rtcGetErl rtcGetFileAttr rtcGetHostLCID rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetObject rtcGetPresentDate rtcGetSecondOfMinute rtcGetSetting rtcGetTimeBstr rtcGetTimeValue rtcGetTimeVar rtcGetTimer rtcGetYear rtcHexBstrFromVar rtcHexVarFromVar rtcIMEStatus rtcIPMT rtcIRR rtcImmediateIf rtcInStr rtcInStrChar rtcInStrRev rtcInputBox rtcInputCharCount rtcInputCharCountVar rtcInputCount rtcInputCountVar rtcIntVar rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsMissing rtcIsNull rtcIsNumeric rtcIsObject rtcJoin rtcKillFiles rtcLeftBstr rtcLeftCharBstr rtcLeftCharVar rtcLeftTrimBstr rtcLeftTrimVar rtcLeftVar rtcLenCharVar rtcLenVar rtcLog rtcLowerCaseBstr rtcLowerCaseVar rtcMIRR rtcMacId rtcMakeDir rtcMidBstr rtcMidCharBstr rtcMidCharVar rtcMidVar rtcMonthName rtcMsgBox rtcNPV rtcNPer rtcOctBstrFromVar rtcOctVarFromVar rtcPMT rtcPPMT rtcPV rtcPackDate rtcPackTime rtcPartition rtcQBColor rtcR8ValFromBstr rtcRandomNext rtcRandomize rtcRate rtcRemoveDir rtcReplace rtcRgb rtcRightBstr rtcRightCharBstr rtcRightCharVar rtcRightTrimBstr rtcRightTrimVar rtcRightVar rtcRound rtcSLN rtcSYD rtcSaveSetting rtcSendKeys rtcSetCurrentCalendar rtcSetDateBstr rtcSetDateVar rtcSetFileAttr rtcSetTimeBstr rtcSetTimeVar rtcSgnVar rtcShell rtcSin rtcSpaceBstr rtcSpaceVar rtcSplit rtcSqr rtcStrConvVar rtcStrConvVar2 rtcStrFromVar rtcStrReverse rtcStringBstr rtcStringVar rtcSwitch rtcTan rtcTrimBstr rtcTrimVar rtcTypeName rtcUpperCaseBstr rtcUpperCaseVar rtcVarBstrFromAnsi rtcVarBstrFromByte rtcVarBstrFromChar rtcVarDateFromVar rtcVarFromError rtcVarFromFormatVar rtcVarFromVar rtcVarStrFromVar rtcVarType rtcWeekdayName

$SYSDIR/PICCLP32.OCX

IMPHASH 6e0787634aa4bc2239034c39a0e3a00d
SHA256 a1134bd48b0d243e1f9ad6ccc08f1d56c8793d76f3ae7dd4bf1eb02af086443c
MD5 380d13794ff7642b1091bd7f9a05afd3
SHA1 5f7d4c6ec1b24be2c4ff924fca4e6acb5d638d80
SHA512 67e51b845e6822c472530ba6fb4e4ebdf804ccf3165f667d8dcf2b6f6eab6cf0960acaeec04941aa5eb9203376497f4fab9ef1468bc45b26e524b2fb7af48516
SSDEEP 1536:9RDbNWRdqRiAoQCjkZE51puophuQRzTO2/6zr6tsjMic1o:rlW+RiHjkZE51kophuQRPx/6zr6tswiJ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

84:36:d7:b9:a6:62:9a:35:a4:b1:42:5c:de:f1:c8:4a:87:6d:95:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 22, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 10, 2000 - Nov 12, 2005

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:7d:a7:00:00:00:00:00:48

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 25, 2003 - Jan 25, 2005

Minor OS version

0

Major OS version

4

Entry point

4708

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CompareStringA LoadResource lstrcmpA CompareStringW FindResourceA lstrcmpiA LockResource GetLastError InterlockedIncrement HeapReAlloc InterlockedDecrement LoadLibraryA GetProcAddress GetLocaleInfoA MultiByteToWideChar GetWindowsDirectoryA lstrcpyA lstrlenA GetModuleFileNameA lstrcatA GetVersion lstrcpynA GetFileAttributesA GlobalAlloc HeapAlloc LeaveCriticalSection DeleteCriticalSection FreeLibrary HeapFree WideCharToMultiByte lstrlenW InitializeCriticalSection EnterCriticalSection GetProcessHeap GlobalUnlock GlobalLock DisableThreadLibraryCalls GlobalFree

user32

SetWindowLongA CharNextA UnregisterClassA EndPaint OffsetRect CreateWindowExA IsWindowVisible GetWindowRect BeginPaint GetWindow MoveWindow GetDlgItem SetFocus GetWindowLongA InvalidateRect CreateDialogIndirectParamA GetKeyState IsChild IsWindowEnabled GetNextDlgTabItem IsDialogMessageA SetParent SetWindowRgn ShowWindow GetParent ClientToScreen SetWindowPos GetClientRect DestroyWindow GetSystemMetrics wsprintfA RegisterClipboardFormatA GetDlgItemInt SetDlgItemInt GetDesktopWindow GetDC ReleaseDC GetActiveWindow SendMessageA EndDialog DialogBoxParamA DefWindowProcA LoadCursorA RegisterClassA LoadStringA PtInRect WinHelpA EqualRect IntersectRect

ole32

CreateOleAdviseHolder CoCreateInstance CoTaskMemFree CoTaskMemAlloc ReleaseStgMedium

advapi32

RegEnumKeyExA RegQueryValueA RegOpenKeyA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey

oleaut32

SetErrorInfo LoadRegTypeLi OleCreatePropertyFrame SysAllocStringLen LoadTypeLibEx UnRegisterTypeLi LoadTypeLi RegisterTypeLi VariantInit VariantChangeType VariantClear OleTranslateColor OleCreatePictureIndirect SysStringLen SysFreeString OleLoadPicture CreateErrorInfo SysAllocString

gdi32

SetMapMode GetWindowExtEx GetViewportExtEx LPtoDP SetViewportExtEx CreateRectRgnIndirect CreateICA CreateDCA SetViewportOrgEx SetWindowExtEx SetWindowOrgEx CreateSolidBrush SelectObject Rectangle RealizePalette SelectPalette CreatePen DeleteDC StretchBlt DeleteObject CreateCompatibleBitmap CreateCompatibleDC BitBlt GetPaletteEntries GetObjectA GetDeviceCaps CreatePalette

$SYSDIR/SLDrawForm.ocx

IMPHASH 6194c12b8db3e25bf22fa53fb82fa467
SHA256 b62b3866302663aec2c0e9dc89cd1871694a77de59cd5cd4788afb97f2f5c570
MD5 0c823886eab52909fe1f719a81478982
SHA1 e2f78b3f17bafa8385cab0454535256a0332a9b9
SHA512 38d910b5bd545ae08fad921cdbe24207ec19989d1eed5d66b2b0e8e482b7450e491d58dc1f1d21d7622945542922ff5b684d554e4b937fe6db0156fb9812c554
SSDEEP 768:xSz8zUP+Bn1HHEipYGGm47nm+vIX/GpMkePKqFoZqtHh19jFM0oR7jhoY:8wBnq8nvDvxPzFo0Ij
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$WINDIR/LastGood/system32/ASYCFILT.DLL

IMPHASH 5deee9ef803f3882a12b5c1690dcfb3e
SHA256 094a0df910fe440e2e98730e1ff259100b2cf8e3f0fce4d85267e57f5c43ecbd
MD5 1c41c8f859ededa48d904a6e2425c31a
SHA1 3411a2baa3b5a0360e07df59ad4e1161d84c51b4
SHA512 b724370bee7f685740f1d94b5ef1ed9c5f0adadc0b97c44abc3f22545d1f58872d5e6c1f2bb4bf6026696c340fa1c05be779094c8a1605b55540006cff2f1143
SSDEEP 1536:dJ+l97zWcgHubVZikHcqw8fdShGMMT5Elp0wnR/cHfup7/+:da97zlbO4nChGMk5EP0wC/up7+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

62267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

asycfilt.pdb

$WINDIR/LastGood/system32/COMCAT.DLL

SHA256 11e66ab12db3ae514d82b7a8df8eacd0f20eeed75eabebb2e7f13c0af49376e2
MD5 b4b7c754c6a624284f3e962602d27fe1
SHA1 ce702b5647a54aeaad6dd8aabc96c84c9a538d0c
SHA512 903f9b08adad3544a033c59553f01435b03fce55faa6fb1b1cf616b3cdca5b97b6f56354a0ac979a9dde8bde625eb1b54cda5806e46a517602c4b47e0b2409f4
MD5 SHA1 SHA512

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$WINDIR/LastGood/system32/MSVBVM60.DLL

IMPHASH 5d13f1b45437e48acf7175e1471cd9aa
SHA256 414f65d0abfe8b9dab1ac94987eaf331442bad8db8585c51fbe6f452909e9045
MD5 c2a267759a55cf8cf23f716dbd2ecf91
SHA1 cd4b60830b40c8cfed1d4e579b9abbdfd5440237
SHA512 810f737bd35bb41262c1452478102b43593fe43bf8908ac444f1c3c1cf65b9e0f8e3500646eb92b0f59404eb8b4adb211d079e84b37999a2b3f1a29b2f4eaffc
SSDEEP 24576:hmz+bRl8ga3PzD6APEFB4NfGb9ty/uDE9KhDH9PLRl0j1cMW5a8Jb6:h8MRmf3Pz8b9ty/uUKhDH9PAjA5rW
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ExitThread FlushFileBuffers CreateDirectoryA RemoveDirectoryA CreateThread MoveFileA LockFile UnlockFile TerminateProcess RaiseException GetCPInfo lstrlenA GetOEMCP SetHandleCount GetStdHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetStdHandle GetStringTypeW lstrcpynA _lclose SetEnvironmentVariableA GetTimeZoneInformation GetLocaleInfoA lstrcmpiA GetLastError GetModuleHandleA GetSystemDefaultLangID FormatMessageA HeapCreate GetWindowsDirectoryA GetPrivateProfileStringA lstrcatA CreateFileA ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement IsDBCSLeadByte IsBadReadPtr TlsGetValue lstrcpyA DeleteFileA lstrcmpA GetCurrentThreadId GetVersionExA HeapAlloc HeapFree LCMapStringW GetStringTypeA GetModuleFileNameW GetUserDefaultLangID GetComputerNameA SetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime SetFileTime GetLocalTime SetLocalTime RtlUnwind CreateProcessW IsValidCodePage FormatMessageW GetStartupInfoA UnhandledExceptionFilter ExitProcess SetCurrentDirectoryA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindNextFileA FindClose VirtualFree GetSystemInfo VirtualAlloc VirtualProtect FlushInstructionCache GetShortPathNameA WinExec lstrlenW lstrcpyW WriteFile SetEndOfFile SetFilePointer GetSystemTime SystemTimeToFileTime WaitForMultipleObjects ReleaseMutex CreateMutexA GetCurrentProcess DuplicateHandle ResumeThread GetCommandLineA TlsSetValue TlsFree TlsAlloc GetVersion CompareStringW lstrcmpiW MulDiv CreateProcessA GetExitCodeProcess LoadLibraryExA WaitForSingleObject ResetEvent SetEvent CreateEventA GetCurrentProcessId GetTickCount GetEnvironmentVariableA FreeResource GetSystemDefaultLCID GetPrivateProfileIntA IsBadCodePtr GetUserDefaultLCID GetSystemDirectoryA LoadLibraryA GetProcAddress Sleep GlobalDeleteAtom HeapDestroy SetErrorMode GlobalAddAtomA ReleaseSemaphore LCMapStringA CreateSemaphoreA VirtualQuery MultiByteToWideChar GetProfileStringA WideCharToMultiByte HeapReAlloc GetDriveTypeA CompareStringA GetFileAttributesA GetCurrentDirectoryA GetModuleFileNameA SetLastError GetFullPathNameA SearchPathA GetFileType GlobalUnlock GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc GlobalLock _lwrite _lread LockResource GetTempPathA GetTempFileNameA _llseek FreeLibrary HeapSize GetACP

user32

DdeAbandonTransaction DdeGetLastError DdeCreateDataHandle DdeCmpStringHandles SetCursorPos EnumClipboardFormats DestroyCursor GetAsyncKeyState WaitForInputIdle GetForegroundWindow VkKeyScanW SetWindowsHookExW keybd_event CharUpperBuffW CharUpperBuffA CharLowerBuffW FindWindowW FindWindowA MessageBoxIndirectA DialogBoxParamA EnumThreadWindows GetLastActivePopup SetActiveWindow GetClassInfoExA LoadIconA FrameRect CreateDialogParamA IsDialogMessageA EnableMenuItem ShowCursor OemToCharA CharToOemBuffA GetWindowTextA EndDialog DrawTextA SendDlgItemMessageA SetDlgItemTextA GetWindowPlacement GetSystemMetrics LoadBitmapA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects WaitMessage PostQuitMessage UnhookWindowsHookEx RegisterClipboardFormatA CreateCursor CreateIcon PostMessageW PeekMessageW GetPropA RemovePropA SetPropA SetForegroundWindow ClipCursor CallWindowProcA DefFrameProcA GetKeyState GetDlgItem IsWindow UnregisterClassA RegisterClassA AdjustWindowRect GetTabbedTextExtentA TabbedTextOutA FillRect CharToOemA MessageBoxA wsprintfA WinHelpA GetDesktopWindow SetRect GetWindowDC DestroyIcon GetClassInfoA AdjustWindowRectEx GetMenuItemCount RemoveMenu GetMenuStringA GetMenuState DdeClientTransaction DdeGetData CharPrevA CharNextA GetUpdateRgn GetUpdateRect PtInRect ChildWindowFromPointEx ReleaseCapture SetCapture InflateRect GetWindowRect ClientToScreen MoveWindow IsWindowEnabled IsChild SetParent IsIconic IsZoomed DefMDIChildProcA MessageBeep PeekMessageA PostMessageA LoadStringA AppendMenuA DestroyMenu CreatePopupMenu GetMessageTime GetMessagePos DrawFocusRect CopyAcceleratorTableA GetWindowRgn CharUpperA TranslateMDISysAccel SubtractRect IsRectEmpty InvalidateRgn InvalidateRect CopyRect GetDCEx IntersectRect LoadAcceleratorsA BringWindowToTop GetWindowThreadProcessId AttachThreadInput EqualRect EnableWindow SetFocus SendMessageA SetWindowsHookExA GetClassNameA LoadCursorA SetCursor SetWindowLongA GetWindow GetFocus GetKeyboardLayout GetSystemMenu CallNextHookEx GetParent DestroyWindow SetWindowTextA SetWindowPos UpdateWindow CreateWindowExA SystemParametersInfoA GetCapture WindowFromPoint ScreenToClient SetTimer IsWindowVisible ShowWindow KillTimer GetDC ReleaseDC MapWindowPoints GetCursorPos GetCursor OffsetRect GetIconInfo DefWindowProcA BeginPaint GetClientRect EndPaint GetSysColor GetActiveWindow GetWindowLongA DdeConnect DdePostAdvise DdeDisconnect DdeCreateStringHandleA DdeSetUserHandle DdeNameService DdeFreeStringHandle DdeUninitialize DdeInitializeA DdeFreeDataHandle DdeQueryConvInfo DdeQueryStringA DrawFrameControl SetScrollRange SetScrollPos IsClipboardFormatAvailable LockWindowUpdate CharLowerBuffA OpenClipboard SetClipboardData GetClipboardData GetCaretBlinkTime EmptyClipboard CloseClipboard CreateCaret SetCaretPos GetWindowTextLengthA DestroyCaret ShowCaret HideCaret DrawTextExA GetScrollPos GetClipboardFormatNameA CreateAcceleratorTableA SetWindowRgn ToAscii GetScrollInfo DestroyAcceleratorTable SetMenuItemInfoA SetScrollInfo GetMenuItemInfoA GetQueueStatus SetKeyboardState GetKeyboardState TrackPopupMenu GetDoubleClickTime SetWindowContextHelpId DeleteMenu SetMenuDefaultItem DrawMenuBar GetMenuItemID InsertMenuA GetSubMenu CreateMenu GetMenu SetMenu BeginDeferWindowPos ModifyMenuA CheckMenuItem PostThreadMessageA EndDeferWindowPos DeferWindowPos VkKeyScanA CharLowerA IsCharAlphaA DrawIcon GetCaretPos RegisterClassExA LoadImageA ShowScrollBar

gdi32

UnrealizeObject CreatePen SetBkColor SetTextColor CreatePatternBrush CreateSolidBrush DeleteObject CreateBitmap ExtTextOutA SelectObject SetBkMode GetBitmapBits GetObjectA GetTextExtentPointA CreateFontIndirectA CombineRgn SetRectRgn CreateRectRgn CreateRectRgnIndirect ExtSelectClipRgn OffsetRgn PtInRegion CreatePalette SelectPalette SelectClipRgn OffsetWindowOrgEx IntersectClipRect DeleteDC BitBlt SetViewportOrgEx CreateCompatibleDC CreateCompatibleBitmap RestoreDC RealizePalette SetROP2 SaveDC GetClipBox SetWindowOrgEx ExcludeClipRect CreateHalftonePalette GetTextMetricsA PatBlt EnumFontsA TranslateCharsetInfo GetROP2 SetBrushOrgEx GetDeviceCaps GetObjectType CreatePenIndirect CreateBrushIndirect Rectangle GetStockObject Arc LineTo MoveToEx Pie Ellipse SetStretchBltMode GetPixel GetTextExtentPoint32A SetPixelV StretchDIBits GetCurrentObject TextOutA GetBkColor StretchBlt CreateDIBitmap CloseMetaFile SetWindowExtEx CreateMetaFileA EndDoc AbortDoc StartPage EndPage StartDocA CreateDCA ResetDCA Escape ScaleViewportExtEx SetViewportExtEx SetMapMode DeleteMetaFile PlayMetaFile SetAbortProc DeleteEnhMetaFile PlayEnhMetaFile CreateICA GetEnhMetaFileHeader ScaleWindowExtEx GetWindowOrgEx GetPaletteEntries CreateDIBSection CloseEnhMetaFile CreateEnhMetaFileA LPtoDP EqualRgn ExtCreateRegion GetDIBits SetTextAlign GetWindowExtEx GetViewportExtEx CopyMetaFileA CopyEnhMetaFileA PathToRegion EndPath BeginPath WidenPath GetTextColor GetMapMode SetDIBColorTable RoundRect CreateEllipticRgnIndirect CreateRoundRectRgn GetSystemPaletteEntries GetNearestColor CreateHatchBrush

advapi32

ReportEventA RegQueryValueExA RegCloseKey RegOpenKeyExA RegOpenKeyA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueA RegDeleteKeyA RegEnumKeyA RegSetValueExA RegCreateKeyA RegSetValueA RegDeleteValueA RegisterEventSourceA DeregisterEventSource RegQueryInfoKeyA RegEnumKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExW RegOpenKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegEnumValueA RegQueryValueExW RegCreateKeyW

ole32

OleCreateLinkToFile CoTaskMemFree BindMoniker CoLockObjectExternal RegisterDragDrop RevokeDragDrop DoDragDrop CreateILockBytesOnHGlobal OleFlushClipboard OleIsCurrentClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator CreateDataAdviseHolder CreateOleAdviseHolder CoRegisterClassObject CoRevokeClassObject CLSIDFromString OleDoAutoConvert OleRegGetUserType OleSaveToStream ReadClassStg ReadClassStm OleConvertIStorageToOLESTREAM OleConvertOLESTREAMToIStorage StgIsStorageILockBytes StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleCreateFromData OleCreateLinkFromData OleGetIconOfClass OleGetClipboard OleSetClipboard OleCreateLink CoTaskMemAlloc OleGetAutoConvert OleCreateFromFile CoMarshalInterface CoUnmarshalInterface CreateStreamOnHGlobal StringFromCLSID StringFromGUID2 CLSIDFromProgID ProgIDFromCLSID CoGetClassObject CoCreateInstance MkParseDisplayName CoIsOle1Class OleQueryLinkFromData OleQueryCreateFromData GetClassFile CreateBindCtx OleDuplicateData ReleaseStgMedium OleSetMenuDescriptor CoRegisterMessageFilter OleUninitialize OleInitialize CoGetMalloc OleRegGetMiscStatus CoCreateGuid IIDFromString CoFreeUnusedLibraries CoDisconnectObject IsAccelerator OleIsRunning OleRun OleLockRunning StgCreateDocfile WriteClassStg OleSave StgOpenStorage OleLoad

oleaut32

OleCreatePropertyFrame OleTranslateColor SysStringLen VariantClear SysAllocString VariantInit OleCreateFontIndirect OleCreatePictureIndirect SysFreeString OaBuildVersion SysAllocStringLen SysAllocStringByteLen SetErrorInfo CreateErrorInfo VariantChangeType DispGetParam LoadTypeLi GetErrorInfo LoadRegTypeLi RegisterTypeLi SysStringByteLen UnRegisterTypeLi LHashValOfNameSys LoadTypeLibEx SafeArrayAccessData SafeArrayGetElemsize SafeArrayUnaccessData SafeArrayCreate OleLoadPicture SafeArrayGetDim VariantCopy VariantCopyInd SafeArrayDestroy VariantChangeTypeEx CreateDispTypeInfo SafeArrayDestroyData DispInvoke SafeArrayGetUBound DispGetIDsOfNames SafeArrayGetElement SafeArrayPutElement SafeArrayGetLBound SafeArrayCopy OleIconToCursor SafeArrayRedim SafeArrayAllocDescriptor SafeArrayDestroyDescriptor RevokeActiveObject SafeArrayLock SafeArrayUnlock SafeArrayAllocData SysReAllocStringLen GetActiveObject VarDateFromStr VarCyFromI4 VarR8FromStr VarBstrFromI4 VarBstrFromR4 VarBstrFromI2 VarBstrFromDate VarBstrFromCy VarBstrFromR8 VarI4FromStr VarI4FromR8 VarI2FromStr VarCyFromStr VarR4FromStr LHashValOfNameSysA SysReAllocString

BASIC_CLASS_AddRef BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke BASIC_CLASS_QueryInterface BASIC_CLASS_Release BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo CopyRecord CreateIExprSrvObj DLLGetDocumentation DllCanUnloadNow DllFunctionCall DllGetClassObject DllRegisterServer DllUnregisterServer EVENT_SINK2_AddRef EVENT_SINK2_Release EVENT_SINK_AddRef EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke EVENT_SINK_QueryInterface EVENT_SINK_Release EbCreateContext EbDestroyContext EbGetErrorInfo EbGetHandleOfExecutingProject EbGetObjConnectionCounts EbGetVBAObject EbIsProjectOnStack EbLibraryLoad EbLibraryUnload EbLoadRunTime EbResetProject EbResetProjectNormal EbSetContextWorkerThread GetMem1 GetMem2 GetMem4 GetMem8 GetMemEvent GetMemNewObj GetMemObj GetMemStr GetMemVar IID_IVbaHost MethCallEngine ProcCallEngine PutMem1 PutMem2 PutMem4 PutMem8 PutMemEvent PutMemNewObj PutMemObj PutMemStr PutMemVar SetMemEvent SetMemNewObj SetMemObj SetMemVar ThunRTMain TipCreateInstanceEx TipCreateInstanceProject2 TipGetAddressOfPredeclaredInstance TipInvokeMethod TipInvokeMethod2 TipSetOption TipUnloadInstance TipUnloadProject UserDllMain VBDllCanUnloadNow VBDllGetClassObject VBDllRegisterServer VBDllUnRegisterServer VarPtr Zombie_AddRef Zombie_GetIDsOfNames Zombie_GetTypeInfo Zombie_GetTypeInfoCount Zombie_Invoke Zombie_QueryInterface Zombie_Release _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct __vbaAryConstruct2 __vbaAryCopy __vbaAryDestruct __vbaAryLock __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaAryVarVarg __vbaBoolErrVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs __vbaCyAdd __vbaCyErrVar __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 __vbaCyI4 __vbaCyInt __vbaCyMul __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt __vbaFailedFriend __vbaFileClose __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeObjList __vbaFreeStr __vbaFreeStrList __vbaFreeVar __vbaFreeVarList __vbaFreeVarg __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Abs __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2I4 __vbaI2Sgn __vbaI2Str __vbaI2Var __vbaI4Abs __vbaI4Cy __vbaI4ErrVar __vbaI4ForNextCheck __vbaI4Sgn __vbaI4Str __vbaI4Var __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew __vbaNew2 __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRedimVar2 __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCopy __vbaStrCy __vbaStrDate __vbaStrErrVarCopy __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike __vbaStrMove __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy __vbaUI1ErrVar __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarCopy __vbaVarDateVar __vbaVarDiv __vbaVarDup __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMove __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarVargNofree __vbaVarXor __vbaVarZero __vbaVargObj __vbaVargObjAddref __vbaVargParmRef __vbaVargUnk __vbaVargUnkAddref __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef __vbaVerifyVarObj __vbaWriteFile _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul rtBoolFromErrVar rtBstrFromErrVar rtCyFromErrVar rtDecFromVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtUI1FromErrVar rtcAbsVar rtcAnsiValueBstr rtcAppActivate rtcAppleScript rtcArray rtcAtn rtcBeep rtcBstrFromAnsi rtcBstrFromByte rtcBstrFromChar rtcBstrFromError rtcBstrFromFormatVar rtcByteValueBstr rtcCVErrFromVar rtcCallByName rtcChangeDir rtcChangeDrive rtcCharValueBstr rtcChoose rtcCommandBstr rtcCommandVar rtcCompareBstr rtcCos rtcCreateObject rtcCreateObject2 rtcCurrentDir rtcCurrentDirBstr rtcDDB rtcDateAdd rtcDateDiff rtcDateFromVar rtcDatePart rtcDeleteSetting rtcDir rtcDoEvents rtcEndOfFile rtcEnvironBstr rtcEnvironVar rtcErrObj rtcExp rtcFV rtcFileAttributes rtcFileCopy rtcFileDateTime rtcFileLen rtcFileLength rtcFileLocation rtcFileReset rtcFileSeek rtcFileWidth rtcFilter rtcFixVar rtcFormatCurrency rtcFormatDateTime rtcFormatNumber rtcFormatPercent rtcFreeFile rtcGetAllSettings rtcGetCurrentCalendar rtcGetDateBstr rtcGetDateValue rtcGetDateVar rtcGetDayOfMonth rtcGetDayOfWeek rtcGetErl rtcGetFileAttr rtcGetHostLCID rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetObject rtcGetPresentDate rtcGetSecondOfMinute rtcGetSetting rtcGetTimeBstr rtcGetTimeValue rtcGetTimeVar rtcGetTimer rtcGetYear rtcHexBstrFromVar rtcHexVarFromVar rtcIMEStatus rtcIPMT rtcIRR rtcImmediateIf rtcInStr rtcInStrChar rtcInStrRev rtcInputBox rtcInputCharCount rtcInputCharCountVar rtcInputCount rtcInputCountVar rtcIntVar rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsMissing rtcIsNull rtcIsNumeric rtcIsObject rtcJoin rtcKillFiles rtcLeftBstr rtcLeftCharBstr rtcLeftCharVar rtcLeftTrimBstr rtcLeftTrimVar rtcLeftVar rtcLenCharVar rtcLenVar rtcLog rtcLowerCaseBstr rtcLowerCaseVar rtcMIRR rtcMacId rtcMakeDir rtcMidBstr rtcMidCharBstr rtcMidCharVar rtcMidVar rtcMonthName rtcMsgBox rtcNPV rtcNPer rtcOctBstrFromVar rtcOctVarFromVar rtcPMT rtcPPMT rtcPV rtcPackDate rtcPackTime rtcPartition rtcQBColor rtcR8ValFromBstr rtcRandomNext rtcRandomize rtcRate rtcRemoveDir rtcReplace rtcRgb rtcRightBstr rtcRightCharBstr rtcRightCharVar rtcRightTrimBstr rtcRightTrimVar rtcRightVar rtcRound rtcSLN rtcSYD rtcSaveSetting rtcSendKeys rtcSetCurrentCalendar rtcSetDateBstr rtcSetDateVar rtcSetFileAttr rtcSetTimeBstr rtcSetTimeVar rtcSgnVar rtcShell rtcSin rtcSpaceBstr rtcSpaceVar rtcSplit rtcSqr rtcStrConvVar rtcStrConvVar2 rtcStrFromVar rtcStrReverse rtcStringBstr rtcStringVar rtcSwitch rtcTan rtcTrimBstr rtcTrimVar rtcTypeName rtcUpperCaseBstr rtcUpperCaseVar rtcVarBstrFromAnsi rtcVarBstrFromByte rtcVarBstrFromChar rtcVarDateFromVar rtcVarFromError rtcVarFromFormatVar rtcVarFromVar rtcVarStrFromVar rtcVarType rtcWeekdayName

$WINDIR/LastGood/system32/OLEAUT32.DLL

IMPHASH f2c566a4e1032b7e51e40a63fb1c5b7d
SHA256 189d312b698459495688dfb2380b34f34d3bebd3ea98ab3736863a58f3925588
MD5 aaf9270361b3a48bab55b81fd72d7e20
SHA1 b9cf5de9017751532903844206d034a991bdf2e7
SHA512 678e2739d80de37ead0af4245e68fc245d82c71c81d9a4c66bd38a6ea8c767d13c5065e8d7d0b184101012a09cfd6d21ab80d14b1ccf8b289822261237369198
SSDEEP 12288:r+sNcfS35GSqbuvZiXOXWd6B+vWXf0Im9k1c5q3Etin9N:yNfSYuvZiXOXjB+cL1c5qein9N
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32.pdb

advapi32

RegFlushKey RegCreateKeyA RegSetValueExA RegOpenKeyA RegQueryValueA RegEnumValueA RegEnumKeyExA RegOpenKeyExA RegEnumKeyW RegCreateKeyW RegQueryValueExW RegSetValueExW RegDeleteKeyA RegQueryInfoKeyA RegCloseKey RegQueryValueW RegSetValueA RegOpenKeyW RegEnumKeyA RegNotifyChangeKeyValue RegQueryValueExA

gdi32

SetBitmapBits CreateFontIndirectA GetTextExtentPointA Escape CreateDIBSection CreateDIBitmap CreateHalftonePalette SetDIBits GetBitmapBits SetStretchBltMode SetBkColor SetTextColor GetCurrentObject GetObjectType GetStockObject RealizePalette StretchBlt GetDIBits StretchDIBits SaveDC IntersectClipRect GetWindowOrgEx OffsetViewportOrgEx PlayEnhMetaFile EnumMetaFile RestoreDC DeleteEnhMetaFile DeleteMetaFile PlayMetaFileRecord SelectPalette GetPaletteEntries CreatePalette GetEnhMetaFileBits GetMetaFileBitsEx CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC SetEnhMetaFileBits SetMapMode SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx GetWinMetaFileBits GetEnhMetaFileHeader GetObjectW GetBitmapDimensionEx SetMetaFileBitsEx CreateBitmap PatBlt DeleteObject CreateFontIndirectW GetDeviceCaps SelectObject GetTextFaceW GetTextMetricsW EnumFontFamiliesExW

kernel32

GetStringTypeExA GetStringTypeExW LCMapStringA CreateThread WaitForSingleObject CreateEventW Sleep FreeLibrary SetEvent SetThreadPriority WaitForMultipleObjects TerminateThread LoadLibraryA GetDateFormatA GetTimeFormatA GetDateFormatW GetTimeFormatW GetCurrentThread GetCurrentProcess CloseHandle InterlockedExchange IsBadReadPtr IsBadWritePtr GetLocalTime GetSystemDirectoryA GetLocaleInfoW CompareStringA CompareStringW OutputDebugStringA GetVersionExW GetVersion GlobalFree GlobalUnlock GlobalLock GlobalAlloc MulDiv GlobalSize GlobalHandle GlobalReAlloc LockResource IsDBCSLeadByte LoadResource FindResourceW _lclose _lread _lwrite _llseek InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrlenW GlobalDeleteAtom GlobalAddAtomW DebugBreak TlsAlloc InterlockedCompareExchange TlsFree TlsSetValue CreateFileA CreateFileW lstrcmpiA LoadLibraryW SearchPathA GetFullPathNameA SetLastError SearchPathW GetFullPathNameW UnmapViewOfFile MapViewOfFile GetSystemInfo CreateFileMappingA GetFileSize GetDriveTypeW GetDriveTypeA SetErrorMode QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter LCMapStringW GetLastError GetProcAddress GetModuleHandleA TlsGetValue GetSystemDefaultLCID GetUserDefaultLCID GetLocaleInfoA InterlockedIncrement HeapAlloc GetProcessHeap HeapFree InterlockedDecrement LeaveCriticalSection EnterCriticalSection GetNumberFormatW MultiByteToWideChar GetNumberFormatA WideCharToMultiByte GetCurrencyFormatW GetCurrencyFormatA

msvcrt

??1type_info@@UAE@XZ malloc _initterm _clearfp _errno strncpy strchr _stat getenv wcstoul _ultow remove _ultoa free calloc _abnormal_termination _wcslwr wcsncat wcsrchr strrchr _CxxThrowException __CxxFrameHandler _CIfmod wcsncpy strtoul memmove iswspace _wcsnicmp wcscpy wcsncmp wcschr _itoa atol atoi _strcmpi _strnicmp _CIpow ceil floor _stricmp _ui64tow _i64toa swprintf _i64tow _ftol modf _wtoi wcslen _wcsicmp wcscmp _itow ?terminate@@YAXXZ _adjust_fdiv _except_handler3

ole32

CoUnmarshalInterface CoReleaseMarshalData ReleaseStgMedium StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal CoCreateInstance StgCreateDocfile CreateBindCtx ReadClassStg WriteFmtUserTypeStg WriteClassStg MkParseDisplayName HWND_UserFree HWND_UserUnmarshal HWND_UserMarshal HWND_UserSize CoUnmarshalHresult CoMarshalHresult CLSIDFromString CoSetState CoGetMalloc CoGetClassObject StringFromGUID2 CreateItemMoniker GetRunningObjectTable CoMarshalInterface

rpcrt4

NdrClientCall2

user32

GetSysColor WinHelpW EnableWindow GetMessageA DispatchMessageA PostQuitMessage GetActiveWindow SetActiveWindow SetFocus wsprintfW wsprintfA GetTopWindow IsWindowUnicode GetClientRect GetDialogBaseUnits GetKeyState GetDlgItem GetFocus SendMessageW GetParent CharLowerA GetWindowTextA RegisterClipboardFormatA SetWindowLongW CopyImage CopyIcon CreateCursor CreateIcon DestroyIcon GetIconInfo GetSystemMetrics DrawIcon ReleaseDC GetDC RegisterWindowMessageA PostMessageW GetMessageW TranslateMessage DispatchMessageW GetClassInfoW RegisterClassW DefWindowProcW IsWindow GetWindowLongW DestroyWindow CreateWindowExW CharNextA

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal BstrFromVector ClearCustData CreateDispTypeInfo CreateErrorInfo CreateStdDispatch CreateTypeLib CreateTypeLib2 DispCallFunc DispGetIDsOfNames DispGetParam DispInvoke DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer DosDateTimeToVariantTime GetActiveObject GetAltMonthNames GetErrorInfo GetRecordInfoFromGuids GetRecordInfoFromTypeInfo GetVarConversionLocaleSetting LHashValOfNameSys LHashValOfNameSysA LPSAFEARRAY_Marshal LPSAFEARRAY_Size LPSAFEARRAY_Unmarshal LPSAFEARRAY_UserFree LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize LPSAFEARRAY_UserUnmarshal LoadRegTypeLib LoadTypeLib LoadTypeLibEx OACreateTypeLib2 OaBuildVersion OleCreateFontIndirect OleCreatePictureIndirect OleCreatePropertyFrame OleCreatePropertyFrameIndirect OleIconToCursor OleLoadPicture OleLoadPictureEx OleLoadPictureFile OleLoadPictureFileEx OleLoadPicturePath OleSavePictureFile OleTranslateColor QueryPathOfRegTypeLib RegisterActiveObject RegisterTypeLib RegisterTypeLibForUser RevokeActiveObject SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayAllocDescriptorEx SafeArrayCopy SafeArrayCopyData SafeArrayCreate SafeArrayCreateEx SafeArrayCreateVector SafeArrayCreateVectorEx SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor SafeArrayGetDim SafeArrayGetElement SafeArrayGetElemsize SafeArrayGetIID SafeArrayGetLBound SafeArrayGetRecordInfo SafeArrayGetUBound SafeArrayGetVartype SafeArrayLock SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SafeArraySetIID SafeArraySetRecordInfo SafeArrayUnaccessData SafeArrayUnlock SetErrorInfo SetOaNoCache SetVarConversionLocaleSetting SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysReAllocString SysReAllocStringLen SysStringByteLen SysStringLen SystemTimeToVariantTime UnRegisterTypeLib UnRegisterTypeLibForUser VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VarAbs VarAdd VarAnd VarBoolFromCy VarBoolFromDate VarBoolFromDec VarBoolFromDisp VarBoolFromI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromI8 VarBoolFromR4 VarBoolFromR8 VarBoolFromStr VarBoolFromUI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromUI8 VarBstrCat VarBstrCmp VarBstrFromBool VarBstrFromCy VarBstrFromDate VarBstrFromDec VarBstrFromDisp VarBstrFromI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromR4 VarBstrFromR8 VarBstrFromUI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromUI8 VarCat VarCmp VarCyAbs VarCyAdd VarCyCmp VarCyCmpR8 VarCyFix VarCyFromBool VarCyFromDate VarCyFromDec VarCyFromDisp VarCyFromI1 VarCyFromI2 VarCyFromI4 VarCyFromI8 VarCyFromR4 VarCyFromR8 VarCyFromStr VarCyFromUI1 VarCyFromUI2 VarCyFromUI4 VarCyFromUI8 VarCyInt VarCyMul VarCyMulI4 VarCyMulI8 VarCyNeg VarCyRound VarCySub VarDateFromBool VarDateFromCy VarDateFromDec VarDateFromDisp VarDateFromI1 VarDateFromI2 VarDateFromI4 VarDateFromI8 VarDateFromR4 VarDateFromR8 VarDateFromStr VarDateFromUI1 VarDateFromUI2 VarDateFromUI4 VarDateFromUI8 VarDateFromUdate VarDateFromUdateEx VarDecAbs VarDecAdd VarDecCmp VarDecCmpR8 VarDecDiv VarDecFix VarDecFromBool VarDecFromCy VarDecFromDate VarDecFromDisp VarDecFromI1 VarDecFromI2 VarDecFromI4 VarDecFromI8 VarDecFromR4 VarDecFromR8 VarDecFromStr VarDecFromUI1 VarDecFromUI2 VarDecFromUI4 VarDecFromUI8 VarDecInt VarDecMul VarDecNeg VarDecRound VarDecSub VarDiv VarEqv VarFix VarFormat VarFormatCurrency VarFormatDateTime VarFormatFromTokens VarFormatNumber VarFormatPercent VarI1FromBool VarI1FromCy VarI1FromDate VarI1FromDec VarI1FromDisp VarI1FromI2 VarI1FromI4 VarI1FromI8 VarI1FromR4 VarI1FromR8 VarI1FromStr VarI1FromUI1 VarI1FromUI2 VarI1FromUI4 VarI1FromUI8 VarI2FromBool VarI2FromCy VarI2FromDate VarI2FromDec VarI2FromDisp VarI2FromI1 VarI2FromI4 VarI2FromI8 VarI2FromR4 VarI2FromR8 VarI2FromStr VarI2FromUI1 VarI2FromUI2 VarI2FromUI4 VarI2FromUI8 VarI4FromBool VarI4FromCy VarI4FromDate VarI4FromDec VarI4FromDisp VarI4FromI1 VarI4FromI2 VarI4FromI8 VarI4FromR4 VarI4FromR8 VarI4FromStr VarI4FromUI1 VarI4FromUI2 VarI4FromUI4 VarI4FromUI8 VarI8FromBool VarI8FromCy VarI8FromDate VarI8FromDec VarI8FromDisp VarI8FromI1 VarI8FromI2 VarI8FromR4 VarI8FromR8 VarI8FromStr VarI8FromUI1 VarI8FromUI2 VarI8FromUI4 VarI8FromUI8 VarIdiv VarImp VarInt VarMod VarMonthName VarMul VarNeg VarNot VarNumFromParseNum VarOr VarParseNumFromStr VarPow VarR4CmpR8 VarR4FromBool VarR4FromCy VarR4FromDate VarR4FromDec VarR4FromDisp VarR4FromI1 VarR4FromI2 VarR4FromI4 VarR4FromI8 VarR4FromR8 VarR4FromStr VarR4FromUI1 VarR4FromUI2 VarR4FromUI4 VarR4FromUI8 VarR8FromBool VarR8FromCy VarR8FromDate VarR8FromDec VarR8FromDisp VarR8FromI1 VarR8FromI2 VarR8FromI4 VarR8FromI8 VarR8FromR4 VarR8FromStr VarR8FromUI1 VarR8FromUI2 VarR8FromUI4 VarR8FromUI8 VarR8Pow VarR8Round VarRound VarSub VarTokenizeFormatString VarUI1FromBool VarUI1FromCy VarUI1FromDate VarUI1FromDec VarUI1FromDisp VarUI1FromI1 VarUI1FromI2 VarUI1FromI4 VarUI1FromI8 VarUI1FromR4 VarUI1FromR8 VarUI1FromStr VarUI1FromUI2 VarUI1FromUI4 VarUI1FromUI8 VarUI2FromBool VarUI2FromCy VarUI2FromDate VarUI2FromDec VarUI2FromDisp VarUI2FromI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromI8 VarUI2FromR4 VarUI2FromR8 VarUI2FromStr VarUI2FromUI1 VarUI2FromUI4 VarUI2FromUI8 VarUI4FromBool VarUI4FromCy VarUI4FromDate VarUI4FromDec VarUI4FromDisp VarUI4FromI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromI8 VarUI4FromR4 VarUI4FromR8 VarUI4FromStr VarUI4FromUI1 VarUI4FromUI2 VarUI4FromUI8 VarUI8FromBool VarUI8FromCy VarUI8FromDate VarUI8FromDec VarUI8FromDisp VarUI8FromI1 VarUI8FromI2 VarUI8FromI8 VarUI8FromR4 VarUI8FromR8 VarUI8FromStr VarUI8FromUI1 VarUI8FromUI2 VarUI8FromUI4 VarUdateFromDate VarWeekdayName VarXor VariantChangeType VariantChangeTypeEx VariantClear VariantCopy VariantCopyInd VariantInit VariantTimeToDosDateTime VariantTimeToSystemTime VectorFromBstr

$WINDIR/LastGood/system32/OLEPRO32.DLL

IMPHASH bfbea1910cdffc9fc4cb569cbd816073
SHA256 b9ce551e3c6624b57994f9898d08533859668373914d0cd103f86da4c5dcd9f3
MD5 bb587d669cb61ebb4adeacae7d6f8ad0
SHA1 de4fe24756c1813f765b56ae115db2615cdeec1a
SHA512 1c6bea69cdad77cef49fa9ce1598c6ebc6e8b1a9089ec329ce3fd8b0ce545a4a40135461f25974dd6f738ea531e8631f6578c38b900463555268961cb715fe1a
SSDEEP 1536:10TQEyiulHkC1oePj8hEeja/OdR2fQHfWytMNwTs:10TQNRkUTj2EejpdsfQ/WSts
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

61048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

olepro32.pdb

user32

CreateIcon GetSysColor WinHelpW IsWindow EnableWindow GetMessageA GetMessageW TranslateMessage DispatchMessageW DispatchMessageA PostMessageW PostQuitMessage GetActiveWindow SetActiveWindow SetFocus DestroyWindow CreateCursor wsprintfA GetTopWindow IsWindowUnicode GetClientRect GetDialogBaseUnits GetDC ReleaseDC GetKeyState GetWindowLongW CharNextA GetWindowTextA CharLowerA GetParent SendMessageW GetFocus GetDlgItem DrawIcon GetSystemMetrics SetWindowLongW GetIconInfo CopyIcon CopyImage DestroyIcon RegisterClipboardFormatA wsprintfW

gdi32

GetWindowOrgEx IntersectClipRect SaveDC EnumFontFamiliesExW GetTextFaceW CreateHalftonePalette Escape CreateDIBSection CreateDIBitmap OffsetViewportOrgEx PlayEnhMetaFile EnumMetaFile RestoreDC DeleteEnhMetaFile DeleteMetaFile PlayMetaFileRecord SetBitmapBits SetDIBits CreatePalette GetEnhMetaFileBits GetMetaFileBitsEx CreateCompatibleDC BitBlt DeleteDC CreateCompatibleBitmap GetBitmapBits SetEnhMetaFileBits SetStretchBltMode SetBkColor SetTextColor SetMapMode SetWindowOrgEx SetWindowExtEx SetViewportOrgEx CreateFontIndirectW CreateFontIndirectA GetDeviceCaps DeleteObject GetTextExtentPointA GetTextMetricsW SelectObject GetPaletteEntries PatBlt CreateBitmap SetMetaFileBitsEx GetBitmapDimensionEx GetObjectW GetEnhMetaFileHeader StretchDIBits GetDIBits StretchBlt RealizePalette SelectPalette GetStockObject GetObjectType GetCurrentObject GetWinMetaFileBits SetViewportExtEx

kernel32

MultiByteToWideChar IsDBCSLeadByte FreeLibrary MulDiv LockResource LoadResource FindResourceW InterlockedIncrement InterlockedDecrement GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc LeaveCriticalSection EnterCriticalSection lstrlenW InitializeCriticalSectionAndSpinCount DeleteCriticalSection GlobalDeleteAtom GlobalAddAtomW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte GetProcAddress GetModuleHandleA GetVersion GetSystemDirectoryA GetLastError LoadLibraryA

advapi32

RegOpenKeyA RegOpenKeyW RegCreateKeyA RegSetValueA RegQueryValueW RegFlushKey RegCloseKey

msvcrt

free _initterm malloc _adjust_fdiv ??1type_info@@UAE@XZ ?terminate@@YAXXZ wcslen wcscpy wcsrchr ??3@YAXPAX@Z wcsncat ??2@YAPAXI@Z __CxxFrameHandler _except_handler3 _CIfmod calloc _CxxThrowException _wcslwr wcscmp _wcsicmp _ftol wcsncpy

ole32

StgCreateDocfile StringFromGUID2 CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes ReleaseStgMedium CoCreateInstance CoGetMalloc

oleaut32

LoadTypeLi VariantInit VariantClear SysFreeString SysAllocString VariantChangeType

$WINDIR/LastGood/system32/STDOLE2.TLB

SHA256 e2b26b1ad2d439dded0799d195ca918a03ccf22146690577e2704f871c098426
MD5 0857394e30de11ca0cd9497e310d6469
SHA1 ba35fba3e44040e7b891fa814dceff94d1c1b114
SHA512 05309e02b7c427f379f3235d2d7398d53ee35b3f1f9d7f28ad72607c82e0af6163a2def42734666f7e1fd0b67395031632aff9c9af36fb30c0175fad145f1185
SSDEEP 192:pMrSEiGPWF0Y3wAQgiQJdDg5rDLWQrNBm5C7BTNcJL8Bz8QFWocqGWcp:pM/uFrR+X6QNn1pcJI5WocqGWcp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DTDJ_1.exe

IMPHASH 4dbc5d08df28b8f55d5238d42ee67fa8
SHA256 791f6d2852b483e3dccd918fda7283e11100387fb9170c222fab123ba1510018
MD5 72b30060b24de7284982289c6f46f7a1
SHA1 7c8b27207eb34c16414ba8b93cde3d6435f2f078
SHA512 d42ccbf059e10cc8ce7bc6b8316edce912b9694b28c681248601049f650ad9b756f3d76344b97ee1af2ea52abb6752daa5f4fc852d86f3cd9a5fb86164e73128
SSDEEP 24576:aAFITrkGIz36Q2sbIfi71i2HNtvjexqmTEC5Nn6b6cQiSH5REzwD813MzC6Hby7b:aCwrkVLbL1frdCYR7SbHu6HG5CE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

933872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\Project\工作工具制作\StartGame\Debug\StartGame.pdb

kernel32

FileTimeToLocalFileTime UnmapViewOfFile MapViewOfFile FreeLibrary CreateFileMappingA OpenFileMappingA SetEnvironmentVariableA CompareStringW GetConsoleOutputCP WriteConsoleA SetStdHandle GetTimeZoneInformation SetCurrentDirectoryA GetLocaleInfoW GetConsoleMode GetConsoleCP GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetDateFormatA GetTimeFormatA LCMapStringW LCMapStringA GetProcessHeap GetStringTypeW GetStringTypeA GetDriveTypeA HeapReAlloc HeapSize HeapAlloc VirtualFree HeapFree HeapCreate HeapDestroy SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetSystemTimeAsFileTime QueryPerformanceCounter InitializeCriticalSectionAndSpinCount IsValidCodePage GetACP LoadLibraryW SetConsoleCtrlHandler FatalAppExitA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess OutputDebugStringW GetFileType WriteConsoleW OutputDebugStringA GetStdHandle DebugBreak ExitThread CreateThread VirtualQuery GetSystemInfo VirtualAlloc RaiseException IsBadReadPtr HeapValidate GetStartupInfoA GetCommandLineA ExitProcess Sleep RtlUnwind GetTickCount SetFileAttributesA LocalFileTimeToFileTime GetFileSizeEx GetDiskFreeSpaceA GetTempFileNameA GetFileTime SetFileTime GetFileAttributesA FindResourceExA GetShortPathNameA lstrcmpiA GetStringTypeExA GetFullPathNameA GetVolumeInformationA DeleteFileA GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle GetHandleInformation GetCurrentDirectoryA GetThreadLocale SystemTimeToFileTime FileTimeToSystemTime GetModuleHandleW GetProfileIntA VirtualProtect InterlockedIncrement GetAtomNameA GetOEMCP GetCPInfo GlobalFlags InterlockedDecrement GetModuleFileNameW SetErrorMode TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalAlloc FindNextFileA FindFirstFileA FindClose WritePrivateProfileStringA GetPrivateProfileIntA CreateEventA SetEvent WaitForSingleObject InterlockedExchange GetCurrentThread GetLocaleInfoA ConvertDefaultLocale EnumResourceLanguagesA GlobalFree lstrlenW CopyFileA GlobalSize GlobalAlloc FormatMessageA LocalFree GetCurrentProcessId GlobalLock GlobalUnlock MulDiv SuspendThread ResumeThread GetThreadPriority SetThreadPriority CompareStringA SetLastError MultiByteToWideChar FreeResource lstrcmpW GetLastError GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetModuleHandleA GetProcAddress GetVersionExA WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceA CreateToolhelp32Snapshot Process32First lstrcmpA Process32Next CloseHandle MoveFileA GetModuleFileNameA GetPrivateProfileStringA lstrcatA lstrlenA WinExec lstrcpyA GetWindowsDirectoryA LoadLibraryA OpenEventA

user32

LoadAcceleratorsA SetRectEmpty GetAsyncKeyState DestroyMenu UnpackDDElParam GetClipboardFormatNameA EndDialog CreateDialogIndirectParamA GetMessageA TranslateMessage GetWindowThreadProcessId PostQuitMessage MapVirtualKeyA GetKeyNameTextA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA ScrollWindowEx IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt GetDlgItemTextA GetDlgItemInt CheckRadioButton CheckDlgButton GetMenuCheckMarkDimensions OpenIcon CloseWindow PostThreadMessageA MapDialogRect EnableWindow GetWindowContextHelpId SetWindowContextHelpId SendNotifyMessageA GetForegroundWindow SetForegroundWindow ShowCaret HideCaret SetCaretPos GetCaretPos CreateCaret GetClipboardViewer GetClipboardOwner GetOpenClipboardWindow OpenClipboard SetClipboardViewer ChangeClipboardChain FlashWindow SetParent GetLastActivePopup FindWindowExA FindWindowA ChildWindowFromPointEx ChildWindowFromPoint ShowScrollBar GetNextDlgTabItem GetNextDlgGroupItem DlgDirSelectComboBoxExA DlgDirSelectExA DlgDirListComboBoxA DlgDirListA GetDesktopWindow SetCapture GetActiveWindow KillTimer SetTimer DrawCaption DrawAnimatedRects EnableScrollBar RedrawWindow LockWindowUpdate GetDCEx ShowOwnedPopups IsWindowVisible ValidateRgn ValidateRect InvalidateRgn InvalidateRect GetUpdateRgn GetUpdateRect UpdateWindow ReleaseDC GetWindowDC GetDC EndPaint TranslateAcceleratorA ClientToScreen BringWindowToTop GetWindowRgn SetWindowRgn ArrangeIconicWindows IsZoomed HiliteMenuItem GetSystemMenu DrawMenuBar DragDetect PostMessageA GetCursorPos WindowFromPoint IsWindowEnabled CheckMenuRadioItem GetMenuContextHelpId SetMenuContextHelpId LoadMenuIndirectA LoadMenuA SetMenuItemBitmaps RemoveMenu ModifyMenuA InsertMenuItemA InsertMenuA GetSubMenu SetMenuItemInfoA GetMenuItemInfoA GetMenuStringA GetMenuState GetMenuItemID GetMenuItemCount GetMenuDefaultItem SetMenuDefaultItem EnableMenuItem CheckMenuItem AppendMenuA DeleteMenu IsMenu CreatePopupMenu CreateMenu ScrollDC GrayStringA GetTabbedTextExtentA DrawTextExA DrawTextA TabbedTextOutA DrawFocusRect DrawFrameControl DrawEdge DrawStateA DrawIcon InvertRect FrameRect FillRect ExcludeUpdateRgn WindowFromDC LoadBitmapA GetSysColorBrush RegisterWindowMessageA MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA ReleaseCapture SetCursor GetSysColor IsWindow CopyIcon RegisterClassA LoadIconA SendDlgItemMessageA GetClientRect MapWindowPoints PeekMessageA DispatchMessageA GetFocus SetActiveWindow SetFocus AdjustWindowRectEx ScreenToClient EqualRect DeferWindowPos BeginDeferWindowPos ReuseDDElParam WaitMessage CharUpperA DestroyIcon GetDialogBaseUnits CharNextA CopyAcceleratorTableA CopyRect EndDeferWindowPos ScrollWindow UnregisterClassA RegisterClipboardFormatA InSendMessage IsClipboardFormatAvailable IsRectEmpty BeginPaint LoadCursorA MessageBeep MsgWaitForMultipleObjects IsWindowUnicode GetMessageW DispatchMessageW SubtractRect UnionRect InflateRect SetRect PtInRect GetSystemMetrics CharLowerBuffA GetWindowRect GetWindowPlacement IsIconic SystemParametersInfoA IntersectRect OffsetRect SetWindowPos SetWindowLongA GetWindowLongA GetMessagePos GetMessageTime GetMenu SetMenu DefWindowProcA RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassNameA GetClassLongA CallNextHookEx SetWindowsHookExA GetDlgCtrlID SendMessageA DestroyWindow GetKeyState GetWindowTextA GetWindowTextLengthA GetDlgItem SetWindowPlacement TrackPopupMenu TrackPopupMenuEx WinHelpA GetCapture GetWindow GetParent IsChild GetTopWindow SetScrollPos GetScrollPos SetScrollRange GetScrollRange SetScrollInfo GetScrollInfo GetMenuBarInfo

gdi32

GetGraphicsMode GetWorldTransform GetViewportOrgEx GetViewportExtEx GetWindowOrgEx GetWindowExtEx DPtoLP LPtoDP FillRgn FrameRgn InvertRgn PaintRgn PtVisible RectVisible GetCurrentPositionEx Arc Polyline Chord Ellipse Pie Polygon PolyPolygon Rectangle RoundRect PatBlt BitBlt StretchBlt GetPixel SetPixel FloodFill ExtFloodFill TextOutA ExtTextOutA GetTextExtentPoint32A GetTextAlign GetTextFaceA GetTextMetricsA GetTextCharacterExtra GetCharWidthA GetFontLanguageInfo GetCharacterPlacementA GetAspectRatioFilterEx Escape SetBoundsRect GetBoundsRect ResetDCA GetOutlineTextMetricsA GetCharABCWidthsA GetFontData GetKerningPairsA GetGlyphOutlineA StartDocA StartPage EndPage SetAbortProc AbortDoc EndDoc MaskBlt PlgBlt SetPixelV AngleArc GetArcDirection PolyPolyline GetColorAdjustment GetCurrentObject PolyBezier DrawEscape GetMapMode GetCharABCWidthsFloatA GetCharWidthFloatA AbortPath GetBkMode CloseFigure EndPath FillPath GetStretchBltMode GetMiterLimit GetPath SetMiterLimit StrokeAndFillPath StrokePath WidenPath GdiComment PlayEnhMetaFile CreateMetaFileA CloseMetaFile CreateEnhMetaFileA CloseEnhMetaFile DeleteDC SaveDC RestoreDC SelectPalette SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetGraphicsMode SetWorldTransform ModifyWorldTransform SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect OffsetClipRgn MoveToEx LineTo SetTextAlign SetTextJustification SetTextCharacterExtra SetMapperFlags ArcTo SetArcDirection PolyDraw PolylineTo SetColorAdjustment PolyBezierTo DeleteObject GetClipRgn SelectClipPath ExtSelectClipRgn PlayMetaFileRecord EnumMetaFile PlayMetaFile CopyMetaFileA StretchDIBits EnumFontFamiliesExA DeleteMetaFile ExtEscape GetTextColor GetBkColor UpdateColors RealizePalette GetNearestColor SelectObject EnumObjects SetBrushOrgEx GetBrushOrgEx EqualRgn GetDeviceCaps CreateCompatibleDC CreateICA CreateDCA RectInRegion PtInRegion GetROP2 FlattenPath GetPolyFillMode CombineRgn SetRectRgn GetRegionData PathToRegion CreateRoundRectRgn CreatePolyPolygonRgn CreatePolygonRgn GetRgnBox BeginPath ExtCreateRegion GetStockObject CreateSolidBrush GetDCOrgEx GetClipBox SetTextColor SetBkColor CreateEllipticRgnIndirect CreateEllipticRgn CreateRectRgnIndirect CreateRectRgn ResizePalette GetNearestPaletteIndex AnimatePalette SetPaletteEntries GetPaletteEntries CreateHalftonePalette CreatePalette CreateDiscardableBitmap CreateCompatibleBitmap GetBitmapDimensionEx SetBitmapDimensionEx GetBitmapBits SetBitmapBits CreateBitmapIndirect CreateBitmap CreateFontA CreateFontIndirectA CreateDIBPatternBrushPt CreatePatternBrush CreateBrushIndirect CreateHatchBrush ExtCreatePen CreatePenIndirect CreatePen GetObjectType UnrealizeObject GetObjectA OffsetRgn

comdlg32

GetFileTitleA

winspool.drv

GetJobA OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

SetThreadToken OpenThreadToken GetFileSecurityA SetFileSecurityA RegCreateKeyA RegDeleteValueA RegCreateKeyExA RegDeleteKeyA RegOpenKeyA RegEnumKeyA RegSetValueA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegQueryValueA RegCloseKey RevertToSelf

shell32

DragAcceptFiles DragFinish DragQueryFileA SHGetFileInfoA ExtractIconA ShellExecuteA

comctl32

InitCommonControlsEx _TrackMouseEvent

shlwapi

PathRemoveExtensionA PathFindFileNameA PathRemoveFileSpecW PathIsUNCA PathFindExtensionA PathStripToRootA

oledlg

ord3 ord7 ord6 ord5 ord9 ord4 ord8

ole32

WriteClassStm OleSaveToStream OleIsRunning OleQueryCreateFromData OleQueryLinkFromData OleGetClipboard OleSetMenuDescriptor DoDragDrop OleRegEnumVerbs OleRegGetMiscStatus OleCreateMenuDescriptor OleDestroyMenuDescriptor CreateOleAdviseHolder CreateDataAdviseHolder OleTranslateAccelerator IsAccelerator GetRunningObjectTable CoLockObjectExternal OleCreateLinkToFile OleCreateFromFile OleCreateStaticFromData OleCreateLinkFromData OleCreateFromData OleSetContainedObject OleLockRunning StgIsStorageFile StgOpenStorage StgCreateDocfile CoGetMalloc CreateStreamOnHGlobal GetClassFile CreateFileMoniker CreateGenericComposite CreateItemMoniker OleGetIconOfClass OleSetClipboard OleIsCurrentClipboard CoRegisterMessageFilter CoFreeUnusedLibraries OleUninitialize OleInitialize CoRevokeClassObject CoRegisterClassObject OleRun CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject StringFromGUID2 CoUninitialize CoInitializeEx CoCreateInstance CoDisconnectObject CLSIDFromString CLSIDFromProgID ReleaseStgMedium CoTaskMemAlloc CoTreatAsClass StringFromCLSID ReadClassStg ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg SetConvertStg CreateBindCtx CoTaskMemFree OleDuplicateData GetHGlobalFromILockBytes StgIsStorageILockBytes OleSave OleLoad CoUnmarshalInterface CoMarshalInterface CoReleaseMarshalData OleFlushClipboard OleCreate

oleaut32

SystemTimeToVariantTime VariantClear VariantChangeType VariantInit SysAllocStringLen SysStringLen SysStringByteLen SysFreeString SafeArrayGetDim SafeArrayGetElemsize RegisterTypeLi LoadTypeLi LoadRegTypeLi SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayRedim SafeArrayCreate VariantCopy SysReAllocStringLen VarCyFromStr VarBstrFromCy SafeArrayCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor VarBstrFromDec VarDecFromStr VarDateFromStr VarBstrFromDate OleCreateFontIndirect SysAllocString DosDateTimeToVariantTime VariantTimeToSystemTime VarUdateFromDate VarDateFromUdate SysAllocStringByteLen

Name

.textbss

Size

Virtual Size

883KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

793B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Main_dtdj.ini

SHA256 d059632a43e951f87b58e5b54a8c904a5c832b8918e5ebde1a70acd4ded31a87
MD5 4cf6b87861c308415871cd272b5fd2c2
SHA1 43da68b3810fec9079a05ce0fa33535bbb23c8d6
SHA512 11571f764c91b32af3e727f8163316a06c3fc38dc716aa1d07c03680bc516699501f26af4854dc336642d51572d4a2809d7ff69c008cc82b289aef848503632d
MD5 SHA1 SHA512

SL_SuDoku.exe

IMPHASH 2e8c95c2f13146820695e1846634abdf
SHA256 a6c8ddac7dfb356c23892d4ce4aa978a1f87a8cbdbb4f161b1dc1c168ad86a68
MD5 7eb31ebf17a6523431c56675639c7fce
SHA1 a5ed59b06ded9d6d4a780089f843a03de75b27ac
SHA512 f30a471d30d1d4488f39003d177610a0819bd343e45119221b113e6ad70a2e409189327b0ef5149e9cb037f6ab4a25cfc03031876692b25aca5ae9796442dbc0
SSDEEP 12288:rrDXFxQN82Vvp44NkpGfHSD0sHSPwUp7p0iQRtyjR5RtykTdVe4:HbD2pppNkgE0oG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarVargNofree __vbaFreeVar __vbaLineInputStr ord588 __vbaLenBstr __vbaLateIdCall __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaCopyBytes __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr ord660 __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord593 ord594 __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaFpR4 ord520 __vbaBoolVarNull __vbaFpR8 _CIsin ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaVarTstEq __vbaI2I4 DllFunctionCall __vbaCastObjVar _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaStrR8 EVENT_SINK_Release __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str ord608 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaVarCat __vbaI2Var _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaI4Var __vbaVarDup __vbaStrToAnsi ord613 __vbaFpI2 ord616 __vbaFpI4 ord617 __vbaR8IntI2 _CIatan __vbaStrMove _allmul __vbaLateIdSt _CItan __vbaFPInt _CIexp __vbaFreeObj __vbaFreeStr ord581

SuDoku.SLD

SHA256 1a9f2a8e78388235274a52cb86dc52b2e6156aca3d8537a464a1788c1d62c2ba
MD5 3443a2bec2bbdb8e1864932d8bff0a25
SHA1 02709285476b4b0642f5ab84867636186933dd6b
SHA512 ca10e97dbc6829396c3b8fb64ebc38e97e61f5771f8ae6e14d57ac41d28a21f874fa01570680e0e2ef270fcc7cdefee8ff48aded1ded738d6b3b661abf263ce9
SSDEEP 384:olYD37Irm3S8izUc6Vt7l5wJHf1lhuh74OPzgMzW/VCujMck+/ysgEt31:l7IrGHizUhVt7l5a/1lhm74mzgMi9Cud
MD5 SHA1 SHA512 SSDEEP

Uninstall/IRIMG1.JPG

SHA256 90f2039624c85649d26864732d03e8ed84a25d52a77bf844a79bc27810ef4d3a
MD5 f6b6fa565c6b9196495ffb5fe0f62634
SHA1 964469c79b3631e722986e2db62f7b54a0a64169
SHA512 19503e3d30fc9ea4bd2ba869117dd2c2bb5b1ce38d806e77828d6b8ac0f3ce7073b180e837606c384d4c0e4a14ad552820b1d10ca5f060074f6bde8564331eed
SSDEEP 96:bFi75IoE7ejS/mb78fcMdYQyiSdqt87/OcdGZ4M0aXIQd3KVz0LQi1hK:bs7uX0/38fTGqS72cTAIQd3LHvK
MD5 SHA1 SHA512 SSDEEP

Uninstall/IRIMG2.JPG

SHA256 45eba9d0872bcb19a40ec70ff01a410adeab5706424304ba3f19a7d530e98c78
MD5 21d0c4f3cff95c34e07ad1140136e99e
SHA1 1f7f58b1cf233d7ff0852c7fe79c3b67d1141cbe
SHA512 413a4e7bfcbe072886a8928555f4873726aa06b2e5221f5b93f049022ac5c9c8702b00f5ae2d55ab8d5c6f853fc405bdbabad651a3a4cc398145edc0d068cf9a
SSDEEP 768:hq8NVsdt0ygmOzp5miYHUD8eDdKKYz4F24:hq2sdNWbnsUIeD6624
MD5 SHA1 SHA512 SSDEEP

Uninstall/uninstall.dat

SHA256 fcb17cc5f5f85e00ca6472223b634c32d0ca8c2b42f42f4ed0d3f286b07bb85b
MD5 b2a76efd1e439bef9d5143eb4c76a6e1
SHA1 8fe3d9ae9b02ab38210d5f87d4bd5011010cd18e
SHA512 49c79be11b3195d227d28cd8b3ff308173bdd6b15a595afc5ccccaaa478ccd76df90be73a78915b926eead80ef4f909795ee6ee7b38994314eb9603a70cab9c0
SSDEEP 1536:emqVLBYf15yFRTKLF7z3bul+FKISm5OkgRfQAQg5p85LAF6n1O2rJn/rSVNXKJTz:TqQWFRgF7z3bmmSmg+4+5LAY1rrJ/uVQ
MD5 SHA1 SHA512 SSDEEP

Uninstall/uninstall.xml

SHA256 a477561fe440cd623767b6601bb10a85553bb385b499a942bc6c5a9d0f7457fd
MD5 2f6399fb21aa16adcb07a26bbe22274d
SHA1 d4286714daaf1f14414e50a41d6ccadc958d4670
SHA512 e90f28027672be1541737703815972a6885323db3b36c0971e802fe1a3292296c620779a7fe48b75de2c3bf775b7ac320047bb225ee9eb7407c43510272f66e2
SSDEEP 192:pZVFHiwVFH0VFH0VFHaVFHiIVFHhVFH0VFHPVFHk8VFH/VFHe3JjKGLk:yOC0
MD5 SHA1 SHA512 SSDEEP

Wav/chimes.wav

SHA256 e921303fc6a43797b4383794c80447ff4f9ba61be47a7794c0f88d19107c0684
MD5 fcbed3290155835350e400d2ddff8582
SHA1 88fec0a4dc93c176f0689f2f54839afddea9e4bc
SHA512 834438bbe27976ca2370bb03828f3f1c22040afe4c74c0de9f25aa72dd019cf78cbbdc0275028d248706fe927886583508b2ce2e20cadeb40f332ad3242efa31
SSDEEP 1536:P54Tdkm+pXICvC+fXIJgSTYkRl3JqE/zYcchkzcwD9:Rm+pXI2fXIGmRfjz8hAcwR
MD5 SHA1 SHA512 SSDEEP

Wav/end.wav

SHA256 58ed83e2d1b9c54e0f44ecceebbee4218bb561b896fb7e548418f6d6d78201cf
MD5 5ef94566411689525b27b53c6cf6ddff
SHA1 c1998ea332d7bfff47197c3ac45071e0caa1944c
SHA512 cbb356cd87e96ce73da1e6e9474c38e7ab21c6ca955c45145cc161806ae32d3282e6db1f68a428ba1fa910157fb2ac6a2bcdaf2761951f47b3ff3a8ec2c4a2c9
MD5 SHA1 SHA512

Wav/folder.wav

SHA256 2d97666fdaf78fca005fb5171fdfd446e577c7f88be8ed64c7553a87d5ea1b1c
MD5 81d0c813d07cbaa89456a62ea2a25a6f
SHA1 b899f78c64b4cbfd3ad2361271b71875ce835c84
SHA512 551e4b829dd5045fe265fbb875a29183acf17c7667ef50f3446b6ba9a19261fbc6b71b4821b83f62125276adf773baa1b42aa31a0b3e3e704c6bd35fac37ed62
SSDEEP 192:VSfAR3QFqk7auat8DUjOXxKlla+m5iWqnRj4njqUoSQ:8Amlat3jOwllPmQWqnRE7oSQ
MD5 SHA1 SHA512 SSDEEP

Wav/help.wav

SHA256 81f0ad875c2e7ec12512742a0a1a350a5e673af1457422ce329b14e61ab80786
MD5 f4f16b0e9aa0d25a3eac986e2c478afe
SHA1 b40a97453a7bbd51cb7a2fb6d4cd356b6b35fd99
SHA512 ac094a58ba13cca2bcc5dd9f85ceefad33dc0f1f195c977d51a22035dfa416fa23a2209b73bef3bebbfad7ef504f3ec76262f6affe2c6d2920dbb5eaeaf82289
MD5 SHA1 SHA512

Wav/right.wav

SHA256 d7e3099cec42e9332ae5122022e91beffb6bcb78af77e80d7bf50a862f2183e4
MD5 d5d6e0cd0b5f9815024f44967e0f34ed
SHA1 984cef7daab40a232d1691cba76cc77a7470369f
SHA512 88cd028d22ec1dd9e2a06db0737b2705261aded4a5bff46fb12265948697a1e0093f6337287b67eb30acaf3f6176370d6a3af6eac964a5672992c0da1fe8e66b
SSDEEP 96:e6hDmUoA4K0Kjgef+p9cC0MRyjMhEj4G435wDRZ+N:jhDmpA4hM309h+875wFW
MD5 SHA1 SHA512 SSDEEP

Wav/soundon.wav

SHA256 583cef8acfb080ccfecebec979de89238235359674271d49c44f8e52b4370e53
MD5 0d4b4d4cf0a28a46ee74c26547077791
SHA1 911beecfa29a15d9df1212942fd5637d2e26be46
SHA512 47d0318f2938f94d67b29d7733a188650a3362d4420827e56eb3516a18362bb4113688229d510bb3e951960b7522984be2ceba7dc6d344e57c336011a08094ac
SSDEEP 96:fqsyDpT0oSjN4xG/EMmw47e4iYJQVjUootuRDqMBuT/dKy7iEEKoNXkK:S5YjN4xG/ywz4iwSeuR+0c/gmnOl
MD5 SHA1 SHA512 SSDEEP

Wav/won.wav

SHA256 cfd503935c2b06f36effdadcbcec5936c0f84c9914cfc7293e8f92b5973ed2de
MD5 e2b95f815c2b4ff2ce16ae5cd638269c
SHA1 84cb9ed58a0b743b3a82fcfea5541b06ca59a6d6
SHA512 95c75776f959ffa4d4599bd263ac95e2bd8c82bd3eb61b6f68f61391ff48b7ebe34e60a10f7a4f5b75cd2a40b33fa3d3a1fde465fc70bffded2ba6cd3fd65a77
SSDEEP 384:TkWwb3X2lwZX8os7EQxrXsKvAadiFYI3KaXVvN75X3MxcnZ0wdS:T7lwZM17vpXwadrQKaXVV75MxcnewdS
MD5 SHA1 SHA512 SSDEEP

Wav/wrong.wav

SHA256 56102cb17fffd656e330e1c659371753c7e5102841e7a2140c0f897fe0701329
MD5 5c6733307c62b7c1cc9f1394c0cf9077
SHA1 da5da4de0c6cddab8d2a14afbc9eb895a40e2e64
SHA512 adee81e34fbcc04b3fd6ad96e1a3ec23a71a288d014cbc2b459f0d385e821a374739c9c322fb83307bbdd02d9909afff87207c3d2efaf620310157ab07210ca2
MD5 SHA1 SHA512

uninst.exe

IMPHASH dd1742eadfc6df18ded3c26ae64ad610
SHA256 c69ec5db01b49eed16c691f231ab0a3c911f41a57d910609c58f39038a8fc226
MD5 83cf7e39d1b9ee934fddec969a248259
SHA1 263a008e057adf378f78203a4dd1bc65f117d59d
SHA512 ded56d637871a89f629da392cd4411d77d1ad7c33fe99a301dea8b437d0269736d6a900608d0d315376fc74ac1d051c15d60d73b1fb4aa9179c56418b9d8efc8
SSDEEP 1536:gRhoEXBpnbfRpQmJB+1oDHECy3lvUyS1vg3XTsJLYKX:gjJ7nbppQmJBooDEx1vE1vg3XTsJsKX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA CloseHandle GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/FindProcDLL.dll

IMPHASH c480ee4d2a64d4a16edee43fdfe35079
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 c943e846e0b8aa03157891ba3566b7f78dee0272d240fd9d41fe89e9c4affe3b
MD5 bbe3e0417fe6bc04f20cd204800e32d3
SHA1 5baf85aee4e5a57ac9ef69aef7502621b40bf9f8
SHA512 066318a4e817c22a98ee210be5791c8ab6a8d9ab544d436dcb921173445f2e16c16fd2584fe8bccffaf03bb463cb50b74c1b10503c3e3cf6a36607f2796427cd
SSDEEP 768:swu/2kG61B631T+F3vJFstIVBraimiHFHVqUpQ2kP9:jG638bjBraifAU3kP9
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer