d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b

Sharing

Copy URL Twitter E-mail

General

Target
d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b
Size 2.0MB
Sample260805-bz8d2sbf62
SHA256 d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b
MD5 f4eb4b87dcb334ab41e1bb5875eb6c04
SHA1 55e82a53316daedf709583ae7ea8f7033a0d910e
SHA512 eb9e2d59aa20e9831d5151857084581e76a57e91df89fd26d80b5897c9e3f4660c4743353e391bea4f7908f5363746c18654367111788f2b5ebc3848dc8009e3
SSDEEP 24576:29yyBf+6YoUjbGUxMNEGI5nq+c8Rt96LxbFAPRIgmwCNJUE6awxFVleL:2hI3jbUIA+QLUTmpU2
TLSH
T1A7A54B01FAC5C1B1C52D11380C96A33A6275BE455B158BB3B3E8FF297D323916D263AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b

File Explorer

d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b

.dll 2.0MB

d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b

IMPHASH 0ca32edb14eef6abe1b7c95cc920a21a
SHA256 d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b
MD5 f4eb4b87dcb334ab41e1bb5875eb6c04
SHA1 55e82a53316daedf709583ae7ea8f7033a0d910e
SHA512 eb9e2d59aa20e9831d5151857084581e76a57e91df89fd26d80b5897c9e3f4660c4743353e391bea4f7908f5363746c18654367111788f2b5ebc3848dc8009e3
SSDEEP 24576:29yyBf+6YoUjbGUxMNEGI5nq+c8Rt96LxbFAPRIgmwCNJUE6awxFVleL:2hI3jbUIA+QLUTmpU2
TLSH
T1A7A54B01FAC5C1B1C52D11380C96A33A6275BE455B158BB3B3E8FF297D323916D263AE
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1195930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dcmlib

?ReadDcm@CDcmFile@@QAEHAAVCString@@HI@Z ?GetPixel@CDcmFile@@QAEPAXXZ ?GetPixelLength@CDcmFile@@QAEHXZ ?GetHeight@CDcmFile@@QAEHXZ ?GetWidth@CDcmFile@@QAEHXZ ?GetBitsStored@CDcmFile@@QAEHXZ ?GetDcmSQItemData@CDcmFile@@QAEHABVCDcmTagKey@@0AAPAXAAKH@Z ?GetDcmSQItemData@CDcmFile@@QAEHABVCDcmTagKey@@0AAHH@Z ?WriteDcm@CDcmFile@@QAEHPBDW4E_TransferSyntax@@HH@Z ?GetRefCount@CDcmFile@@QAEHXZ ?Release@CDcmFile@@QAEXXZ ?WriteMemDcm@CDcmFile@@QAEHPBDW4E_TransferSyntax@@HH@Z ?getDcmItemLength@CDcmFile@@QAEKABVCDcmTagKey@@@Z ?getDcmItemData@CDcmFile@@QAEHABVCDcmTagKey@@AAPAX@Z ?getDcmElement@CDcmFile@@QAEPAVCDcmElement@@ABVCDcmTagKey@@@Z ?AddRef@CDcmFile@@QAEXXZ ?SetDcmElementValue@CDcmFile@@QAEHVCString@@AAVCDcmTagKey@@@Z ?SetDcmElementValue@CDcmFile@@QAEHPAXKAAVCDcmTagKey@@@Z ??0CDcmTagKey@@QAE@GGAAVCString@@@Z ?ReadDataSet@CDcmFile@@QAEHAAVCString@@W4E_TransferSyntax@@H@Z ?RemoveDcmElement@CDcmFile@@QAEHVCDcmTagKey@@@Z ??8CDcmTagKey@@QBEHABV0@@Z ?WriteDcmJpeg@CDcmFile@@QAEHPBDHHW4E_TransferSyntax@@HH@Z ?CreateReleaseRejectAbortPDU@CDcmAssociatePDU@@QAEHPAUdul_rejectreleaseabortpdu@@EEEE@Z ?streamRejectReleaseAbortPDU@CDcmAssociatePDU@@QAEHPAUdul_rejectreleaseabortpdu@@PAEKPAK@Z ?GetDcmSQItemData@CDcmFile@@QAEHABVCDcmTagKey@@0AAVCString@@H@Z ?AddDcmElement@CDcmFile@@QAEHAAVCString@@AAVCDcmTagKey@@@Z ?AddDcmSQItemElement@CDcmFile@@QAEHAAVCDcmTagKey@@PAXK0H@Z ?getDcmItemData@CDcmFile@@QAEHABVCDcmTagKey@@AAVCString@@@Z ??0CDcmTagKey@@QAE@GGW4DcmEVR@@@Z ?AddDcmElement@CDcmFile@@QAEHPAXKAAVCDcmTagKey@@@Z ??1CDcmTagKey@@UAE@XZ ?WriteMemDcm@CDcmFile@@QAEHAAVCFile@@W4E_TransferSyntax@@HH@Z ??0CDcmTagKey@@QAE@GG@Z ?getDcmItemData@CDcmFile@@QAEHABVCDcmTagKey@@AAH@Z ?constructSubItem@CDcmAssociatePDU@@QAEHPADEPAUdul_subitem@@PAK@Z ?constructAssociatePDU@CDcmAssociatePDU@@QAEHPAUdul_associateserviceparameters@@EPAUdul_associatepdu@@@Z ??0dul_associatepdu@@QAE@XZ ??0CDcmAssociatePDU@@QAE@XZ ?StreamAssociatePDU@CDcmAssociatePDU@@QAEHPAUdul_associatepdu@@PAEPAKK@Z ?DumpAsTXT@CDcmAssociatePDU@@QAEHPBDPAUdul_associatepdu@@@Z ?UnpackAssociatePDU@CDcmAssociatePDU@@QAEHPAPAUdul_associatepdu@@PAEK@Z ??0CDcmFile@@QAE@XZ ??1CDcmFile@@UAE@XZ ?Empty@CDcmFile@@QAEXXZ ?ReadMemDcm@CDcmFile@@QAEHAAVCFile@@W4E_TransferSyntax@@@Z ??1CDcmAssociatePDU@@UAE@XZ ?findDcmItemData@CDcmFile@@QAEHABVCDcmTagKey@@@Z ??1dul_associatepdu@@QAE@XZ

goldimage

?CBmp2Jpeg@@YA?AW4ErrorCode@@PBD0KH@Z ?CBmp2AddGifFrame@@YA?AW4ErrorCode@@PBD0_NKKH@Z ?CBmp2Gif@@YA?AW4ErrorCode@@PBD0_NH@Z ?CBmp2Tif@@YA?AW4ErrorCode@@PBD0H@Z ?CBmp2Png@@YA?AW4ErrorCode@@PBD0H@Z

avifil32

AVISaveOptions AVIMakeCompressedStream AVIStreamSetFormat AVIStreamWrite AVIFileCreateStreamA AVIFileInit AVIFileOpenA AVIFileRelease AVIFileInfoA AVIFileGetStream AVIStreamRelease AVIFileExit AVIStreamStart AVIStreamLength AVIStreamGetFrameOpen AVIStreamInfoA AVIStreamGetFrame AVIStreamReadFormat AVIStreamGetFrameClose

msvfw32

ord2

ws2_32

htons inet_addr recv select send connect listen socket closesocket WSAGetLastError ntohl ioctlsocket

imgproc3d

?SaveTissue64BmpFile@CGoldScene@@QAEHPAD@Z ?SaveLUTFILe@CGoldColorSelect@@QAEXVCString@@@Z ?CancelCutVolume@CGoldScene@@QAEXPAVvtkAbstractMapper@@@Z ??1CGoldScene@@UAE@XZ ??1CGoldVR@@UAE@XZ ??1CGoldThreeView@@UAE@XZ ??1CGoldColorSelect@@UAE@XZ ??0CGoldColorSelect@@QAE@XZ ?AddImageData@CGoldDcmReader@@QAEHPAEH@Z ?RenderThreeView@CGoldThreeView@@QAEXXZ ?InitCamera@CGoldScene@@QAEXXZ ?SetParent@CGoldScene@@QAEXPAVCWnd@@@Z ?AddProp@CGoldScene@@QAEXPAVvtkProp@@@Z ?GetOutput@CGoldVR@@QAEPAVvtkProp@@XZ ??0CGoldScene@@QAE@XZ ?SetInput@CGoldVR@@QAEXPAVvtkImageData@@PAVCProgressCtrl@@@Z ?SetAlpha@CGoldVR@@QAEXHPAHPAM@Z ?GetANum@CGoldColorSelect@@QAEHXZ ?GetAGrey@CGoldColorSelect@@QAEPAHXZ ?GetA@CGoldColorSelect@@QAEPAMXZ ?SetColor@CGoldVR@@QAEXHPAHPAK@Z ?GetColNum@CGoldColorSelect@@QAEHXZ ?GetColGrey@CGoldColorSelect@@QAEPAHXZ ?GetCol@CGoldColorSelect@@QAEPAKXZ ??0CGoldVR@@QAE@XZ ?InitialColor@CGoldColorSelect@@QAEXXZ ?SetInput@CGoldThreeView@@QAEXPAVvtkImageData@@NNPAU_Gold3DInfo@@H@Z ?GetDicomInfo@CGoldDcmReader@@QAE?AU_Gold3DInfo@@XZ ?SetParent@CGoldThreeView@@QAEXPAVCWnd@@00@Z ?GetAllScrollChange@CGoldThreeView@@QAEXPAVCScrollBar@@00@Z ?GetOutput@CGoldDcmReader@@QAEPAVvtkImageData@@XZ ??0CGoldThreeView@@QAE@XZ ?SagittalScrollChange@CGoldThreeView@@QAEXM@Z ?CoronalScrollChange@CGoldThreeView@@QAEXM@Z ?AxialScrollChange@CGoldThreeView@@QAEXM@Z ?CameraLR@CGoldScene@@QAEX_N@Z ?SetToolType@CGoldScene@@QAEXH@Z ?CameraAP@CGoldScene@@QAEX_N@Z ?CameraHF@CGoldScene@@QAEX_N@Z ?Render@CGoldScene@@QAEXXZ ?SetVolumeType@CGoldVR@@QAEXH@Z ?ReadLUTFile@CGoldColorSelect@@QAEXVCString@@@Z ?InitMIPColor@CGoldColorSelect@@QAEXXZ ?CutVolume@CGoldScene@@QAEXPAVvtkAbstractMapper@@@Z ?GetCutMapper@CGoldVR@@QAEPAVvtkVolumeRayCastMapper@@XZ ?SetAxes@CGoldScene@@QAEXH@Z ?ShowFrame@CGoldScene@@QAEXPAVvtkImageData@@H@Z ?CopyImageToClipBoard@CGoldScene@@QAEHXZ ?CopyImageToClipBoard@CGoldThreeView@@QAEXHH@Z ?SaveBMPFile@CGoldScene@@QAEHPADPAVCProgressCtrl@@@Z ?SaveBMPFile@CGoldThreeView@@QAEHPADH@Z ?SetDicomInfo@CGoldDcmReader@@QAEXAAU_Gold3DInfo@@@Z ?Create3DImageData@CGoldDcmReader@@QAEXPAVCProgressCtrl@@@Z ??0CGoldDcmReader@@QAE@XZ

mfc42

ord4407 ord5280 ord4425 ord3597 ord324 ord641 ord4234 ord3698 ord765 ord860 ord1168 ord2302 ord6215 ord2086 ord755 ord470 ord4299 ord6453 ord3092 ord823 ord5148 ord3752 ord3753 ord537 ord2915 ord5572 ord3175 ord3499 ord2515 ord355 ord3920 ord2860 ord4220 ord2584 ord3654 ord2438 ord6270 ord2863 ord1644 ord6779 ord924 ord2818 ord3337 ord3811 ord4224 ord6197 ord6379 ord3721 ord795 ord2971 ord5759 ord6192 ord5756 ord6186 ord4330 ord6189 ord6021 ord6172 ord5873 ord5789 ord5794 ord5678 ord5736 ord5579 ord5571 ord6061 ord5864 ord3596 ord2380 ord3370 ord2582 ord4402 ord3640 ord693 ord2096 ord384 ord4243 ord668 ord3998 ord3185 ord3181 ord2781 ord2862 ord2770 ord941 ord5710 ord356 ord3301 ord1200 ord6334 ord2370 ord922 ord2578 ord2411 ord2023 ord4218 ord4398 ord3582 ord616 ord2513 ord293 ord3317 ord3573 ord2450 ord2754 ord4774 ord541 ord801 ord341 ord654 ord686 ord2097 ord3619 ord2494 ord2626 ord4235 ord3702 ord6154 ord2530 ord4364 ord4056 ord5471 ord4121 ord2389 ord5082 ord1712 ord6053 ord5234 ord6369 ord5279 ord5248 ord2444 ord3598 ord642 ord501 ord327 ord773 ord5642 ord2087 ord1083 ord3495 ord1832 ord5651 ord350 ord1871 ord665 ord1979 ord6385 ord5186 ord354 ord798 ord1997 ord6407 ord5194 ord533 ord802 ord542 ord5643 ord2393 ord1105 ord926 ord703 ord404 ord5445 ord403 ord3318 ord6569 ord2764 ord3742 ord818 ord4622 ord4226 ord940 ord939 ord2652 ord1669 ord1923 ord1825 ord4696 ord3058 ord3065 ord6336 ord2510 ord5243 ord5740 ord1746 ord5577 ord3172 ord5653 ord4420 ord4953 ord4858 ord4823 ord2399 ord4387 ord3454 ord3198 ord6080 ord6175 ord4623 ord4426 ord338 ord652 ord4238 ord1567 ord268 ord1842 ord2723 ord2390 ord3059 ord5100 ord5103 ord4467 ord4303 ord3350 ord5012 ord975 ord5472 ord3403 ord2879 ord2878 ord4151 ord4077 ord5237 ord5282 ord2649 ord1665 ord4436 ord5252 ord4427 ord366 ord674 ord4242 ord4145 ord2092 ord3232 ord1140 ord815 ord2724 ord3952 ord6375 ord4486 ord2554 ord2512 ord1146 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord4079 ord4698 ord5307 ord5289 ord5714 ord3401 ord3670 ord561 ord4129 ord5683 ord1247 ord6438 ord6354 ord1216 ord6467 ord1227 ord1980 ord6877 ord3010 ord2884 ord5805 ord1768 ord3949 ord923 ord925 ord4204 ord4278 ord6283 ord6282 ord2820 ord1877 ord4249 ord2486 ord2687 ord6364 ord3326 ord6365 ord4472 ord5498 ord3278 ord3353 ord3681 ord446 ord743 ord1177 ord1226 ord1210 ord4006 ord2727 ord2730 ord2729 ord2439 ord1693 ord5618 ord994 ord4342 ord4687 ord4639 ord5674 ord2156 ord4856 ord4920 ord6002 ord2137 ord1963 ord5213 ord4275 ord3868 ord5150 ord4705 ord4707 ord2876 ord2998 ord5649 ord4113 ord4661 ord4660 ord4768 ord4650 ord4903 ord4548 ord4521 ord4594 ord4988 ord4925 ord4930 ord4935 ord4659 ord4909 ord4908 ord4668 ord4667 ord4666 ord4648 ord4689 ord1775 ord4654 ord4643 ord4354 ord4780 ord4649 ord4637 ord4636 ord5060 ord4584 ord4371 ord4361 ord4356 ord4739 ord4741 ord4738 ord4409 ord4603 ord5008 ord4415 ord4992 ord4979 ord2488 ord3404 ord4539 ord2954 ord2384 ord6370 ord2983 ord3148 ord3260 ord4466 ord2986 ord3080 ord4081 ord4624 ord5825 ord723 ord3946 ord423 ord6170 ord5316 ord2541 ord4949 ord5574 ord3057 ord6605 ord4760 ord5573 ord2934 ord5888 ord4765 ord4756 ord4788 ord4914 ord4915 ord4913 ord5033 ord4480 ord656 ord793 ord692 ord2762 ord4502 ord4459 ord5607 ord4735 ord5979 ord5861 ord6143 ord4770 ord4769 ord4771 ord4694 ord4996 ord1601 ord2763 ord6876 ord6874 ord1892 ord4252 ord1212 ord4570 ord4672 ord4843 ord5011 ord4713 ord6371 ord5286 ord4438 ord3279 ord4625 ord746 ord5992 ord449 ord2278 ord2301 ord2358 ord2294 ord2362 ord3610 ord3719 ord1771 ord6366 ord2413 ord2024 ord4219 ord2581 ord4401 ord3639 ord2297 ord2363 ord2298 ord5981 ord998 ord6199 ord2642 ord2291 ord2367 ord5787 ord2753 ord3716 ord790 ord6111 ord3711 ord783 ord2359 ord6128 ord4476 ord3693 ord5600 ord3994 ord2452 ord6662 ord6883 ord2614 ord2293 ord2366 ord6442 ord1187 ord414 ord713 ord603 ord273 ord353 ord3803 ord5604 ord5859 ord690 ord389 ord1971 ord5773 ord5796 ord5442 ord5478 ord1638 ord967 ord2029 ord791 ord605 ord2077 ord3780 ord5856 ord278 ord523 ord2801 ord6404 ord5461 ord524 ord2542 ord4083 ord3706 ord3977 ord807 ord796 ord794 ord554 ord529 ord527 ord6000 ord2117 ord2627 ord4163 ord6625 ord4457 ord1232 ord5030 ord4413 ord4614 ord4613 ord1945 ord4370 ord5076 ord4341 ord4349 ord4531 ord4545 ord4543 ord4526 ord4529 ord4524 ord4964 ord4961 ord4108 ord5240 ord3748 ord1726 ord4432 ord813 ord560 ord4273 ord5260 ord4723 ord4892 ord2535 ord4890 ord6157 ord4588 ord4589 ord715 ord415 ord3452 ord3177 ord3184 ord5621 ord2112 ord2776 ord5597 ord1862 ord816 ord562 ord2841 ord2107 ord5450 ord5440 ord6383 ord6394 ord1081 ord5605 ord1133 ord3567 ord602 ord6648 ord3996 ord6007 ord6515 ord3286 ord6907 ord6743 ord2289 ord2299 ord6669 ord5858 ord4337 ord1948 ord5303 ord4699 ord5715 ord565 ord817 ord2726 ord536 ord4123 ord3797 ord3708 ord781 ord5823 ord3664 ord3692 ord2761 ord5791 ord5641 ord4317 ord6571 ord6141 ord2740 ord3984 ord879 ord882 ord5785 ord2414 ord3663 ord3626 ord825 ord567 ord556 ord323 ord609 ord809 ord640 ord3574 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord4353 ord6374 ord5163 ord5241 ord4396 ord1776 ord4078 ord6055 ord3571 ord269 ord826 ord600 ord1578 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1575 ord1176 ord1116 ord1132 ord3402 ord5277 ord5290 ord6052 ord2514 ord4710 ord4998 ord4853 ord4376 ord5265 ord858 ord535 ord2567 ord5053 ord289 ord6880 ord1640 ord1641 ord613 ord2122 ord2405 ord4160 ord1088 ord2859 ord5875 ord283 ord472 ord5788 ord4297 ord4133 ord540 ord3874 ord800 ord3089 ord2379 ord5023 ord2864 ord2385 ord2575 ord2953 ord5731 ord1131

msvcrt

__CxxFrameHandler _mbscmp _CxxThrowException strncpy _CIpow _ftol _CIacos atof atoi sprintf _mbsicmp _purecall fclose fopen fread fwrite fseek ftell fflush fputc getc free malloc sscanf atol memmove modf floor realloc ceil calloc div _wfopen strncmp longjmp _setjmp3 __CxxLongjmpUnwind abort fprintf _iob strtod exit getenv strcpy strlen memset memcpy memcmp pow qsort exp rand log sqrt fabs atan2 strstr _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv

kernel32

LocalFree SizeofResource LoadResource LockResource GlobalHandle GlobalLock GlobalUnlock lstrcpyA GlobalAlloc GlobalFree GetCurrentThread SetThreadPriority GetExitCodeThread CloseHandle ResumeThread CreateThread MulDiv CopyFileA MoveFileA GetPrivateProfileIntA GetModuleHandleA GetProcAddress WritePrivateProfileStringA GetLastError GlobalMemoryStatus WinExec GetPrivateProfileStringA CreateDirectoryA GetModuleFileNameA DeleteFileA lstrlenA Sleep LocalAlloc

user32

EmptyClipboard SetClipboardData CloseClipboard RegisterHotKey UnregisterHotKey GetMenuItemInfoA DrawIconEx DrawEdge SystemParametersInfoA MapVirtualKeyA GetKeyNameTextA DestroyIcon CreatePopupMenu GetClassInfoA IntersectRect IsRectEmpty RegisterWindowMessageA IsWindow PostMessageA SetWindowLongA GetDC OpenClipboard GetDesktopWindow GetIconInfo BringWindowToTop LoadCursorA KillTimer SetRect SetTimer GetKeyState DeleteMenu GetMenuItemCount GetMenu wsprintfA LoadBitmapA GrayStringA DrawTextA TabbedTextOutA GetClassNameA PtInRect LoadMenuA GetSubMenu GetScrollRange GetScrollPos SetScrollRange SetScrollPos IsIconic GetSystemMetrics DrawIcon LoadIconA EnableWindow FillRect GetWindowRect GetClientRect DestroyCursor ReleaseDC ReleaseCapture LoadImageA WindowFromPoint ClientToScreen SetCapture GetCapture AppendMenuA RedrawWindow GetParent GetActiveWindow SetCursor GetWindowLongA DrawStateA CopyRect FrameRect InflateRect GetSysColor OffsetRect DrawFocusRect PeekMessageA SendMessageA GetCursorPos ScreenToClient InvalidateRect

gdi32

GetObjectA SetTextColor SetBkColor CreateBitmap CreateSolidBrush GetCurrentObject PtVisible RectVisible TextOutA ExtTextOutA Escape SetBitmapDimensionEx EnumFontsA GetTextExtentPoint32A CreateFontA GetBkColor GetStockObject BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteDC SetPixel GetPixel RoundRect Rectangle PatBlt CreatePen PtInRegion GetRgnBox ExtCreatePen Ellipse CombineRgn CreateRectRgnIndirect GetDeviceCaps FillRgn CreateFontIndirectA GetTextColor CreateDIBitmap CreateDIBSection GdiFlush CreateEllipticRgnIndirect StretchBlt RealizePalette GetPaletteEntries Polygon CreateEllipticRgn CreateRoundRectRgn CreateRectRgn CreatePalette SetDIBColorTable GetDIBColorTable CreatePolygonRgn CreatePenIndirect CreateBrushIndirect GetDIBits SetDIBitsToDevice SetStretchBltMode ExtSelectClipRgn GetClipBox StretchDIBits SetBkMode PlayEnhMetaFile SelectPalette GetEnhMetaFilePaletteEntries DeleteEnhMetaFile SetWinMetaFileBits GetEnhMetaFileHeader SetEnhMetaFileBits DeleteObject

shell32

ShellExecuteA

comctl32

_TrackMouseEvent ImageList_Draw ImageList_GetImageCount ImageList_Remove ImageList_AddMasked

oleaut32

LoadRegTypeLi

urlmon

URLDownloadToFileA

msvcp60

??1Init@ios_base@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ?_Xlen@std@@YAXXZ ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ

??0CGoldScene@@QAE@ABV0@@Z ??0CGoldThreeView@@QAE@ABV0@@Z ??0CGoldVR@@QAE@ABV0@@Z ??0CxFile@@QAE@ABV0@@Z ??0CxFile@@QAE@XZ ??0CxIOFile@@QAE@ABV0@@Z ??0CxIOFile@@QAE@PAU_iobuf@@@Z ??0CxImage@@QAE@ABV0@_N11@Z ??0CxImage@@QAE@K@Z ??0CxImage@@QAE@KKJJ@Z ??0CxImage@@QAE@PAEKK@Z ??0CxImage@@QAE@PAU_iobuf@@K@Z ??0CxImage@@QAE@PAVCxFile@@K@Z ??0CxImage@@QAE@PBDK@Z ??0CxImageGIF@@QAE@ABV0@@Z ??0CxImageGIF@@QAE@XZ ??0CxImageTIF@@QAE@ABV0@@Z ??0CxImageTIF@@QAE@XZ ??0CxMemFile@@QAE@ABV0@@Z ??0CxMemFile@@QAE@PAEK@Z ??1CxFile@@UAE@XZ ??1CxIOFile@@UAE@XZ ??1CxImage@@UAE@XZ ??1CxImageGIF@@UAE@XZ ??1CxImageTIF@@UAE@XZ ??1CxMemFile@@UAE@XZ ??4CGoldScene@@QAEAAV0@ABV0@@Z ??4CGoldThreeView@@QAEAAV0@ABV0@@Z ??4CGoldVR@@QAEAAV0@ABV0@@Z ??4CxFile@@QAEAAV0@ABV0@@Z ??4CxIOFile@@QAEAAV0@ABV0@@Z ??4CxImage@@QAEAAV0@ABV0@@Z ??4CxImageGIF@@QAEAAV0@ABV0@@Z ??4CxImageTIF@@QAEAAV0@ABV0@@Z ??4CxMemFile@@QAEAAV0@ABV0@@Z ??_7CGoldScene@@6B@ ??_7CGoldThreeView@@6B@ ??_7CGoldVR@@6B@ ??_7CxFile@@6B@ ??_7CxIOFile@@6B@ ??_7CxImage@@6B@ ??_7CxImageGIF@@6B@ ??_7CxImageTIF@@6B@ ??_7CxMemFile@@6B@ ??_FCxIOFile@@QAEXXZ ??_FCxImage@@QAEXXZ ??_FCxMemFile@@QAEXXZ ??_OCxImage@@QAEXABV0@@Z ?Alloc@CxMemFile@@IAEXK@Z ?AlphaClear@CxImage@@QAEXXZ ?AlphaCopy@CxImage@@QAE_NAAV1@@Z ?AlphaCreate@CxImage@@QAEXXZ ?AlphaDelete@CxImage@@QAEXXZ ?AlphaFlip@CxImage@@QAE_NXZ ?AlphaGet@CxImage@@QAEEJJ@Z ?AlphaGetMax@CxImage@@QBEEXZ ?AlphaInvert@CxImage@@QAEXXZ ?AlphaIsValid@CxImage@@QAE_NXZ ?AlphaMirror@CxImage@@QAE_NXZ ?AlphaPaletteClear@CxImage@@QAEXXZ ?AlphaPaletteEnable@CxImage@@QAEX_N@Z ?AlphaPaletteIsEnabled@CxImage@@QAE_NXZ ?AlphaPaletteIsValid@CxImage@@QAE_NXZ ?AlphaPaletteSplit@CxImage@@QAE_NPAV1@@Z ?AlphaSet@CxImage@@QAEXE@Z ?AlphaSet@CxImage@@QAEXJJE@Z ?AlphaSet@CxImage@@QAE_NAAV1@@Z ?AlphaSetMax@CxImage@@QAEXE@Z ?AlphaSplit@CxImage@@QAE_NPAV1@@Z ?AlphaStrip@CxImage@@QAEXXZ ?Bitfield2RGB@CxImage@@IAEXPAEGGGE@Z ?BlendPalette@CxImage@@QAEXKJ@Z ?Clear@CxImage@@QAEXE@Z ?Close@CxIOFile@@UAE_NXZ ?Close@CxMemFile@@UAE_NXZ ?CompareColors@CxImage@@KAHPBX0@Z ?Copy@CxImage@@QAEXABV1@_N11@Z ?CopyInfo@CxImage@@IAEXABV1@@Z ?CopyToHandle@CxImage@@QAEPAXXZ ?Create@CxImage@@QAEPAXKKJJ@Z ?CreateFromARGB@CxImage@@QAE_NKKPAE@Z ?CreateFromHANDLE@CxImage@@QAE_NPAX@Z ?CreateFromHBITMAP@CxImage@@QAEXPAUHBITMAP__@@@Z ?CreateFromHICON@CxImage@@QAEXPAUHICON__@@@Z ?Crop@CxImage@@QAE_NABUtagRECT@@PAV1@@Z ?Crop@CxImage@@QAE_NJJJJPAV1@@Z ?Decode@CxImage@@QAE_NPAEKK@Z ?Decode@CxImage@@QAE_NPAU_iobuf@@K@Z ?Decode@CxImage@@QAE_NPAVCxFile@@K@Z ?Decode@CxImageGIF@@QAE_NPAU_iobuf@@@Z ?Decode@CxImageGIF@@QAE_NPAVCxFile@@@Z ?Decode@CxImageTIF@@QAE_NPAU_iobuf@@@Z ?Decode@CxImageTIF@@QAE_NPAVCxFile@@@Z ?DecodeExtension@CxImageGIF@@IAE_NPAVCxFile@@@Z ?DecreaseBpp@CxImage@@QAE_NK_NPAUtagRGBQUAD@@@Z ?Destroy@CxImage@@QAEXXZ ?Dither@CxImage@@QAE_NJ@Z ?Draw2@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z ?Draw2@CxImage@@QAEJPAUHDC__@@JJJJ@Z ?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@@Z ?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@@Z ?DrawTextA@CxImage@@QAEJPAUHDC__@@JJPBDUtagRGBQUAD@@1JJEE@Z ?Enable@CxImage@@QAEX_N@Z ?Encode@CxImage@@QAE_NAAPAEAAJK@Z ?Encode@CxImage@@QAE_NPAU_iobuf@@K@Z ?Encode@CxImage@@QAE_NPAU_iobuf@@PAPAV1@HK@Z ?Encode@CxImage@@QAE_NPAVCxFile@@K@Z ?Encode@CxImage@@QAE_NPAVCxFile@@PAPAV1@HK@Z ?Encode@CxImageGIF@@QAE_NPAU_iobuf@@@Z ?Encode@CxImageGIF@@QAE_NPAU_iobuf@@PAPAVCxImage@@H_N@Z ?Encode@CxImageGIF@@QAE_NPAVCxFile@@@Z ?Encode@CxImageGIF@@QAE_NPAVCxFile@@PAPAVCxImage@@H_N@Z ?Encode@CxImageTIF@@QAE_NPAU_iobuf@@PAPAVCxImage@@H@Z ?Encode@CxImageTIF@@QAE_NPAU_iobuf@@_N@Z ?Encode@CxImageTIF@@QAE_NPAVCxFile@@PAPAVCxImage@@H@Z ?Encode@CxImageTIF@@QAE_NPAVCxFile@@_N@Z ?EncodeBody@CxImageGIF@@IAEXPAVCxFile@@_N@Z ?EncodeBody@CxImageTIF@@IAE_NPAUtiff@@_NHH@Z ?EncodeComment@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeExtension@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeHeader@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeLoopExtension@CxImageGIF@@IAEXPAVCxFile@@@Z ?EncodeRGB@CxImageGIF@@IAE_NPAVCxFile@@@Z ?Eof@CxIOFile@@UAE_NXZ ?Eof@CxMemFile@@UAE_NXZ ?Error@CxIOFile@@UAEJXZ ?Error@CxMemFile@@UAEJXZ ?Flip@CxImage@@QAE_NXZ ?Flush@CxIOFile@@UAE_NXZ ?Flush@CxMemFile@@UAE_NXZ ?Free@CxMemFile@@IAEXXZ ?GetBits@CxImage@@QAEPAEXZ ?GetBpp@CxImage@@QBEGXZ ?GetBuffer@CxMemFile@@QAEPAEXZ ?GetC@CxIOFile@@UAEJXZ ?GetC@CxMemFile@@UAEJXZ ?GetColorType@CxImage@@QAEEXZ ?GetComment@CxImageGIF@@QAEXPAD@Z ?GetDIB@CxImage@@QBEPAXXZ ?GetDisposalMethod@CxImageGIF@@QAEJXZ ?GetEffWidth@CxImage@@QBEKXZ ?GetEncodeOption@CxImage@@QBEKXZ ?GetEscape@CxImage@@QBEJXZ ?GetFrame@CxImage@@QBEJXZ ?GetFrameDelay@CxImage@@QBEKXZ ?GetHeight@CxImage@@QBEKXZ ?GetJpegQuality@CxImage@@QBEEXZ ?GetLastError@CxImage@@QAEPADXZ ?GetLoops@CxImageGIF@@QAEJXZ ?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z ?GetNumColors@CxImage@@QBEKXZ ?GetNumFrames@CxImage@@QBEJXZ ?GetOffset@CxImage@@QAEXPAJ0@Z ?GetPalette@CxImage@@QBEPAUtagRGBQUAD@@XZ ?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z ?GetPaletteColor@CxImage@@QAE_NEPAE00@Z ?GetPaletteSize@CxImage@@QAEKXZ ?GetPixelColor@CxImage@@QAE?AUtagRGBQUAD@@JJ@Z ?GetPixelGray@CxImage@@QAEEJJ@Z ?GetPixelIndex@CxImage@@QAEEJJ@Z ?GetProgress@CxImage@@QBEJXZ ?GetSize@CxImage@@QAEJXZ ?GetTransColor@CxImage@@QAE?AUtagRGBQUAD@@XZ ?GetTransIndex@CxImage@@QBEJXZ ?GetType@CxImage@@QBEKXZ ?GetVersion@CxImage@@QAEPBDXZ ?GetWidth@CxImage@@QBEKXZ ?GetXDPI@CxImage@@QBEJXZ ?GetYDPI@CxImage@@QBEJXZ ?Ghost@CxImage@@IAEXPAV1@@Z ?GifMix@CxImageGIF@@IAEXAAVCxImage@@JJ@Z ?GifNextPixel@CxImageGIF@@IAEHXZ ?GrayScale@CxImage@@QAE_NXZ ?IncreaseBpp@CxImage@@QAE_NK@Z ?IsEnabled@CxImage@@QBE_NXZ ?IsGrayScale@CxImage@@QAE_NXZ ?IsIndexed@CxImage@@QAE_NXZ ?IsInside@CxImage@@QAE_NJJ@Z ?IsTransparent@CxImage@@QBE_NXZ ?IsValid@CxImage@@QBE_NXZ ?Load@CxImage@@QAE_NPBDK@Z ?Load@CxImage@@QAE_NPBGK@Z ?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z ?MakeBitmap@CxImage@@QAEPAUHBITMAP__@@PAUHDC__@@@Z ?Mirror@CxImage@@QAE_NXZ ?Negative@CxImage@@QAE_NXZ ?Open@CxIOFile@@QAE_NPBD0@Z ?Open@CxMemFile@@QAE_NXZ ?PutC@CxFile@@UAE_NE@Z ?PutC@CxIOFile@@UAE_NE@Z ?PutC@CxMemFile@@UAE_NE@Z ?Putword@CxImageGIF@@IAEXHPAVCxFile@@@Z ?RGBQUADtoRGB@CxImage@@QAEKUtagRGBQUAD@@@Z ?RGBtoBGR@CxImage@@IAEXPAEH@Z ?RGBtoRGBQUAD@CxImage@@QAE?AUtagRGBQUAD@@K@Z ?Read@CxIOFile@@UAEIPAXII@Z ?Read@CxMemFile@@UAEIPAXII@Z ?Resample@CxImage@@QAE_NJJHPAV1@@Z ?Rotate180@CxImage@@QAE_NPAV1@@Z ?Rotate@CxImage@@QAE_NMPAV1@@Z ?RotateLeft@CxImage@@QAE_NPAV1@@Z ?RotateRight@CxImage@@QAE_NPAV1@@Z ?Save@CxImage@@QAE_NPBDK@Z ?Save@CxImage@@QAE_NPBGK@Z ?Seek@CxIOFile@@UAE_NJH@Z ?Seek@CxMemFile@@UAE_NJH@Z ?SelectionAddColor@CxImage@@QAE_NUtagRGBQUAD@@@Z ?SelectionAddEllipse@CxImage@@QAE_NUtagRECT@@@Z ?SelectionAddPolygon@CxImage@@QAE_NPAUtagPOINT@@J@Z ?SelectionAddRect@CxImage@@QAE_NUtagRECT@@@Z ?SelectionClear@CxImage@@QAE_NXZ ?SelectionCopy@CxImage@@QAE_NAAV1@@Z ?SelectionCreate@CxImage@@QAE_NXZ ?SelectionDelete@CxImage@@QAE_NXZ ?SelectionGetBox@CxImage@@QAEXAAUtagRECT@@@Z ?SelectionInvert@CxImage@@QAE_NXZ ?SelectionIsInside@CxImage@@QAE_NJJ@Z ?SelectionIsValid@CxImage@@QAE_NXZ ?SelectionToHRGN@CxImage@@QAE_NAAPAUHRGN__@@@Z ?SetComment@CxImageGIF@@QAEXPBD@Z ?SetDisposalMethod@CxImageGIF@@QAEXH@Z ?SetEncodeOption@CxImage@@QAEXK@Z ?SetEscape@CxImage@@QAEXJ@Z ?SetFrame@CxImage@@QAEXJ@Z ?SetFrameDelay@CxImage@@QAEXK@Z ?SetGrayPalette@CxImage@@QAEXXZ ?SetJpegQuality@CxImage@@QAEXE@Z ?SetLoops@CxImageGIF@@QAEXH@Z ?SetOffset@CxImage@@QAEXJJ@Z ?SetPalette@CxImage@@QAEXKPAE00@Z ?SetPalette@CxImage@@QAEXPAUrgb_color@@K@Z ?SetPalette@CxImage@@QAEXPAUtagRGBQUAD@@K@Z ?SetPaletteColor@CxImage@@QAEXEEEEE@Z ?SetPaletteColor@CxImage@@QAEXEK@Z ?SetPaletteColor@CxImage@@QAEXEUtagRGBQUAD@@@Z ?SetPixelColor@CxImage@@QAEXJJK@Z ?SetPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@_N@Z ?SetPixelIndex@CxImage@@QAEXJJE@Z ?SetProgress@CxImage@@QAEXJ@Z ?SetStdPalette@CxImage@@QAEXXZ ?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z ?SetTransIndex@CxImage@@QAEXJ@Z ?SetXDPI@CxImage@@QAEXJ@Z ?SetYDPI@CxImage@@QAEXJ@Z ?Size@CxIOFile@@UAEJXZ ?Size@CxMemFile@@UAEJXZ ?Startup@CxImage@@IAEXK@Z ?Stretch@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@@Z ?Stretch@CxImage@@QAEJPAUHDC__@@JJJJ@Z ?SwapIndex@CxImage@@QAEXEE@Z ?Tell@CxIOFile@@UAEJXZ ?Tell@CxMemFile@@UAEJXZ ?Tile@CxImage@@QAEJPAUHDC__@@PAUtagRECT@@@Z ?TileToStrip@CxImageTIF@@IAEXPAE0KKHH@Z ?Transfer@CxImage@@QAEXAAV1@@Z ?Write@CxIOFile@@UAEIPBXII@Z ?Write@CxMemFile@@UAEIPBXII@Z ?b3spline@CxImage@@IAEMM@Z ?char_out@CxImageGIF@@IAEXH@Z ?cl_hash@CxImageGIF@@IAEXJ@Z ?compressLZW@CxImageGIF@@IAEXHPAVCxFile@@@Z ?compressNONE@CxImageGIF@@IAEXHPAVCxFile@@@Z ?compressRLE@CxImageGIF@@IAEXHPAVCxFile@@@Z ?decoder@CxImageGIF@@IAEFPAVCxFile@@PAVCImageIterator@@FAAH@Z ?flush_char@CxImageGIF@@IAEXXZ ?get_byte@CxImageGIF@@IAEHPAVCxFile@@@Z ?get_next_code@CxImageGIF@@IAEFPAVCxFile@@@Z ?get_num_frames@CxImageGIF@@IAEHPAVCxFile@@PAUtag_TabCol@1@@Z ?init_exp@CxImageGIF@@IAEFF@Z ?out_line@CxImageGIF@@IAEHPAVCImageIterator@@PAEH@Z ?output@CxImageGIF@@IAEXF@Z ?rle_block_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_block_out@CxImageGIF@@IAEXEPAUtag_RLE@1@@Z ?rle_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_compute_triangle_count@CxImageGIF@@IAEIII@Z ?rle_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_flush_clearorrep@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_flush_fromclear@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_flush_withtable@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_isqrt@CxImageGIF@@IAEII@Z ?rle_output@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_output_flush@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_output_plain@CxImageGIF@@IAEXHPAUtag_RLE@1@@Z ?rle_reset_out_clear@CxImageGIF@@IAEXPAUtag_RLE@1@@Z ?rle_write_block@CxImageGIF@@IAEXPAUtag_RLE@1@@Z DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer

Sharing

General

Malware Config

Signatures

File Explorer

d2b180cd1ff32532d3e60351d883641e130f7cc315f4d526e44680ecde19929b

dcmlib

goldimage

avifil32

msvfw32

ws2_32

imgproc3d

mfc42

msvcrt

kernel32

user32

gdi32

shell32

comctl32

oleaut32

urlmon

msvcp60

generic