$TEMP[.]zip | Triage™

resource
unpack001/$TEMP/AUTPRX32.DLL
unpack001/$TEMP/ActiveSkin.ocx
unpack001/$TEMP/BonziBDY_35.EXE
unpack001/$TEMP/BonziCTB.dll
unpack001/$TEMP/BonziCheckers.ocx
unpack001/$TEMP/ODKOB32.DLL
unpack001/$TEMP/RACREG32.DLL
unpack001/$TEMP/Regicon.ocx
unpack001/$TEMP/SSubTmr6.dll
unpack001/$TEMP/empop3.dll
unpack001/$TEMP/emsmtp.dll
unpack001/$TEMP/msvbvm60.dll
unpack001/$TEMP/sstabs2.ocx

resource
unpack001/$TEMP/MSCOMCTL.OCX
unpack001/$TEMP/MSINET.OCX
unpack001/$TEMP/MSWINSCK.OCX
unpack001/$TEMP/Runtimes/MSAGENT.EXE
unpack001/$TEMP/Runtimes/tv_enua.exe
unpack001/$TEMP/SSCALA32.OCX
unpack001/$TEMP/SSCALB32.OCX
unpack001/$TEMP/msvcrt.dll
unpack001/$TEMP/ssa3d30.ocx

$TEMP.zip

SHA256 77dfa4cce5c6f498d07d384b058088296c90f2e2f45a4caab5324048793abf83
MD5 6bb2b40971a6aca5b6a77a26dd4a471b
SHA1 33b27717e73c9510b57adcafc1c36e1781b3caf0
SHA512 f15a7906bdcda597641599ee931db353e95941fc23dc21f45b2638b53ea52dd991ed4790c178d2b10eff5c4d5f7c5b8468e2b9e6345d6f888ef950921f2bd74a
SSDEEP 196608:9B83DxYdEeRV3Yk5QW40E6k32P+cAAim91Y0SJH/a3s3Xf+fy3nHd+:/8deRplQx0622ct5HkEs3rnU
TLSH
T102A63365B214D30BD6AE27F92286C279E5CB7EE931D53B28C5019862CDE2F9600337F5
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/AUTPRX32.DLL

IMPHASH 301d3fe653a288a4bb9a0472123a9348
SHA256 0563e77b6bd63eb0561f6264badb5d07dacb7287ce029dc3ca3279a964ea6a6d
MD5 6e62806f4121eed119ef7d361f3322ca
SHA1 2265e83e068fd0bda58d0ed8366050614138787e
SHA512 fa5efb12fcd7d34a026b95a573c5a8b72dcacfa0c3df439e55691f27c9c0d8cd8905f0d3cad610259b9bdac474a3ed41796a91474e0ab522e78d8a2cf2a53dba
SSDEEP 1536:yTChuEXZnfAdeegEKMK53sORozp/pzbcsXG7fPKvKqRwYKIr0k7kZp:yTCUEXdowEc53sOc5b+n+05y0k7Up
TLSH
T110D34B76E1C3AAB1D9CB873C05E73A1B563B6B9087D2E5C346307811E6F36D19938392
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

91472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

GetMessageA PostMessageA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage PeekMessageA PostThreadMessageA

rpcrt4

RpcEpResolveBinding RpcSsDestroyClientContext RpcBindingFree RpcBindingSetAuthInfoA RpcBindingFromStringBindingA NDRCContextBinding NdrClientContextMarshall NdrConformantArrayBufferSize NdrConformantArrayMarshall NdrSimpleStructUnmarshall NdrClientInitializeNew NdrSimpleStructBufferSize NdrGetBuffer NdrSimpleStructMarshall NdrSendReceive NdrConvert NdrClientContextUnmarshall NdrFreeBuffer RpcBindingToStringBindingA RpcStringBindingParseA RpcStringBindingComposeA RpcStringFreeA

oleaut32

SysAllocStringLen DispCallFunc SysAllocString LoadTypeLi SafeArrayDestroyData ClearCustData VariantInit SafeArrayDestroy SafeArrayAllocDescriptor SafeArrayAllocData CreateErrorInfo SafeArrayLock SafeArrayUnlock VariantClear SetErrorInfo GetErrorInfo SysStringByteLen SysAllocStringByteLen SysFreeString SysStringLen

ole32

CLSIDFromString CreateFileMoniker CoDisconnectObject GetRunningObjectTable CoCreateInstance CoGetStandardMarshal CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream StringFromGUID2 CoGetMalloc CoRegisterMessageFilter OleInitialize OleUninitialize CoCreateGuid CoRevokeClassObject CoLockObjectExternal CoUnmarshalInterface CoMarshalInterface CoMarshalHresult CoUnmarshalHresult

kernel32

SetFilePointer GetStringTypeW SetStdHandle FlushFileBuffers GetACP GetCPInfo GetStartupInfoA GetStdHandle GetFileType SetHandleCount HeapDestroy HeapCreate ExitProcess RtlUnwind GetModuleHandleA GetProcAddress GetCommandLineA GetLocaleInfoA MultiByteToWideChar WideCharToMultiByte TlsAlloc HeapSize SetEvent GetCurrentProcess Sleep DuplicateHandle GetCurrentThreadId GetCurrentThread WaitForSingleObject CloseHandle CreateThread InterlockedDecrement InterlockedIncrement CreateEventA GetVersion HeapAlloc GetModuleFileNameA GetOEMCP FreeEnvironmentStringsA LoadLibraryA ReleaseMutex CreateMutexA TlsGetValue HeapReAlloc WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings TlsSetValue TlsFree GetLastError GetVersionExA LCMapStringA GetStringTypeA LCMapStringW HeapFree

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyA RegQueryValueA RegCreateKeyA RegSetValueA RegDeleteKeyA RegEnumKeyA RegSetValueExA

Name

.text

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/ActiveSkin.ocx

IMPHASH 565e1800bc82993fc37d2bbe43963eb1
SHA256 2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
MD5 3d225d8435666c14addf17c14806c355
SHA1 262a951a98dd9429558ed35f423babe1a6cce094
SHA512 391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1
SSDEEP 3072:TVKIgW9TkeIu2Yewxx3aGwz3OzT6pe3EhV665fi5sMfkjjyO0DtQo1fPqdXqvbFv:pKIkYPOpeUhV/oCMmjYtRne2LQ
TLSH
T1B1748E12F7C3C47AC15716314817BB7EA7B9E6028925928B236C3E4E2F72BC0695935F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190551

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread GetModuleHandleA HeapReAlloc DebugBreak Sleep WriteProcessMemory SetFilePointer ReadProcessMemory UnmapViewOfFile WriteFile GetACP GetProcessHeap HeapFree GlobalFree GlobalUnlock GlobalAlloc GlobalLock LoadLibraryA lstrcatA lstrcpyA IsDBCSLeadByte GetProcAddress HeapDestroy LoadLibraryExA lstrcpynA lstrcmpiA LoadResource GetLastError FindResourceA GetModuleFileNameA SizeofResource FreeLibrary GetSystemInfo GetShortPathNameA HeapCreate InitializeCriticalSection HeapAlloc DisableThreadLibraryCalls DeleteCriticalSection EnterCriticalSection GetCurrentThreadId TerminateProcess GetCPInfo GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA ExitProcess RtlUnwind GetTickCount WideCharToMultiByte MultiByteToWideChar GetStdHandle GetOEMCP lstrlenW GetWindowsDirectoryA CloseHandle ReadFile GetCurrentProcess TerminateThread GetFileSize CreateFileA lstrlenA LeaveCriticalSection InterlockedIncrement InterlockedDecrement FlushInstructionCache

user32

MessageBoxA GetWindowLongA RedrawWindow TrackPopupMenu ShowWindow LoadBitmapA WindowFromDC ReleaseDC GetDC IsChild IsWindow CharNextA GetKeyState SendMessageA GetMenuItemInfoA PtInRect UnionRect SetWindowRgn OffsetRect EqualRect GetClientRect PostMessageA BeginPaint CallWindowProcA GetWindowPlacement GetSysColor GetWindowTextA WindowFromPoint KillTimer SetCursor SystemParametersInfoA SetCapture GetWindowRgn GetWindowDC SetMenu GetCapture UpdateWindow DeleteMenu InsertMenuItemA AdjustWindowRect ReleaseCapture GetSystemMenu SetFocus GetFocus SetWindowPos GetWindowRect InvalidateRect DestroyWindow DefWindowProcA SetWindowLongA CreateWindowExA RegisterClassExA wsprintfA LoadCursorA GetClassInfoExA IntersectRect EndPaint SubtractRect IsRectEmpty GetDesktopWindow GetScrollInfo SetScrollInfo GetMenu GetSubMenu GetSystemMetrics SetForegroundWindow GetMessageA DispatchMessageA GetMenuItemCount GetMenuItemID GetMenuStringA MoveWindow SetWindowTextA GetCursorPos GetDlgCtrlID FillRect GetClassNameA GetParent DrawTextA

gdi32

DeleteDC RestoreDC SetWindowExtEx BitBlt SelectObject GetDeviceCaps CreateRectRgnIndirect CreateCompatibleDC CloseMetaFile SetWindowOrgEx DeleteMetaFile CreateMetaFileA SetViewportOrgEx SaveDC LPtoDP CreateDCA SetMapMode StretchDIBits SelectPalette CreateDIBSection DeleteObject SetDIBitsToDevice SetRectRgn CreateRectRgn CombineRgn OffsetRgn SetBkColor TranslateCharsetInfo SetTextColor LineTo SetBkMode CreatePen CreateSolidBrush MoveToEx Rectangle GetObjectA SelectClipRgn StretchBlt GetTextExtentPoint32A

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

RegEnumValueA RegQueryInfoKeyA RegDeleteKeyA RegQueryValueExA RegCreateKeyA RegSetValueA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey

ole32

StgCreateDocfile CreateBindCtx CLSIDFromString OleLoadFromStream CreateStreamOnHGlobal StringFromCLSID CreateOleAdviseHolder GetHGlobalFromStream StgOpenStorage OleRegGetUserType OleRegEnumVerbs CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree OleSaveToStream WriteClassStm CoCreateInstance CreateDataAdviseHolder OleRegGetMiscStatus

oleaut32

SysAllocStringByteLen OleCreatePictureIndirect OleLoadPicture RegisterTypeLi LoadTypeLi VarUI4FromStr OleCreatePropertyFrame LoadRegTypeLi SysStringByteLen VariantChangeType VariantClear SysAllocString SysStringLen SysAllocStringLen OleCreateFontIndirect SysFreeString

comctl32

InitCommonControlsEx

$TEMP/BG/Bg1.bmp

SHA256 e4843ab74d29d608e406d137892afced0661ee56c3cd899cf49bc863dfc9e99a
MD5 1b360ab50e93b123ab13f036d5c76f45
SHA1 f274fe317961cab9f2d9a8bf558e7734d7a7a338
SHA512 e23a7c7394944482a94c6a56fb875def9b51e44b4ed0dff907ed57cc1d681ee8dc878c2a14b3b34793c4afbe8ccbb54258281d37fa2d90bf066c2365e0f8471a
SSDEEP 12288:4a9s25MGQUdzOZ9NYoNxG/bTyy9Fifuz2eRIpl8p9VncBvYOHVyxHvYDqEnKwMTC:4kj5/fdcNX70nYOOEG9nr
TLSH
T19F15F107B4851EB6EBF2A6BA58064361B7C2E832F78A757521C90F079AF9CD44FD0217
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/BG/Bg2.bmp

SHA256 2066f7ede6410b790ee3446b6c27470526969eb837ab9187f61c10c611bdcc5f
MD5 c7263e35b3e47b805356e06cbca930dc
SHA1 4dc3f33674bd914c86a4608aaf0a65b91df86e3b
SHA512 5732403c83678f0b582e8940c00e94a5e0376e80263b5ae804cb7cff18108a3c69ada76af66fb331cb67c0d89d4129bae28c17f3a91230eaf4717f6cbe7ef2e9
SSDEEP 24576:Ua1IqcHaBedHXQuGahQaeGDqV48bnPs10b:UbqcH9dA34QTBPs1y
TLSH
T16C1501579B190B9CE06F07B82CB24F9C73E4E89AAD74D7C49C0D633BBDA92D21930159
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/BG/Bg3.bmp

SHA256 d983ff82ee546e5706da39531aff69721b9896fc99eacd59bfaeefdd0bef0147
MD5 fe0a9cbbb8b168c7f13b1669d2fbd801
SHA1 ca3eab96c7fe48fe27086941fc2c09549473e0d7
SHA512 59b3ada28a58795eabafe4b998062c6b5d27b3d370687666341fedc66f53e5ff5e8833b0eb378826fcc1a775706fcdba0dc1e4b99451aef8fb4aec6b1a3d8b3a
SSDEEP 12288:Q2hVooL/ozxPXQWNSc65DwyRVn/Vz39grtiL9AxrawMx9fDxiLvQXGFoPtniVuWF:rVoAoz9gWPEwA3WZiLaWEQXGFSnhWYr4
TLSH
T1311501145CC5CD9DFC37DA38ABAAC3D075B7528CC92C7C2F51A7A94065C8CCB906AA9C
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Bonzi/run.vbs

SHA256 b2959e49361d8d68b7ea82e42a03dd8c281764f1a2ad66a4019e84412c1653c7
MD5 69956ebd2616be211a92820cd07038ea
SHA1 ef4e9d29d16176ad8d3eb49c358c913ecfc3fcbc
SHA512 fb075f890d604a61344a003513f017d218004ea16d47a7e2def1c9688a24bc55c8287e8d4412b8ae444c4ae31e8253a3dc61cb78a1f45e31ac635b2feb13a28a
TLSH
T149B0924A3C8AF42142362EB5CA36688956A0A4F6040C88E91CC9911498882F82BB62B0
MD5 SHA1 SHA512 TLSH

$TEMP/BonziBDY.vbw

SHA256 4dd98f95113b70772308a4671a482b9b59bba5fbf41e928f2a833366c54424e4
MD5 b4d876161a7abb7bcaea37003dae158f
SHA1 5317af4e389e00103faf2ec0a1acfa2b59b30843
SHA512 3d5da08c1c39cb4ea24b66612a383e166500dbd891113f080c66ded8a29bf8e4094c6e407fc24f873d598e13daac8c06d91ba488f9d4ca10eecbc1f51f649767
TLSH
T1EA900231005445F882015B9141B12C5DFE1583882101909375055905470A144D319714
MD5 SHA1 SHA512 TLSH

$TEMP/BonziBDY_35.EXE

IMPHASH 2cda54480c88977341f0d69a768a13ce
SHA256 88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
MD5 73feeab1c303db39cbe35672ae049911
SHA1 c14ce70e1b3530811a8c363d246eb43fc77b656c
SHA512 73f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153
SSDEEP 24576:KAS+cA9B93P0k/ubqLss6/BAgGz+nDbZ65EeLpCeet7hNSw/yinPo1rCmUGCx9xH:pSQclDbZ65zpCeet7hNSw/yinPo1tm
TLSH
T10EC53B13FE44E00EE57285F07874926B5A28BD3524B4DA0B73907E59A1F27E3EDA071B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

65872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLineInputStr ord588 __vbaLateIdCall __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaVarIdiv __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 EVENT_SINK_Invoke __vbaVarIndexStore __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy ord517 _adj_fprem1 ord518 __vbaRecAnsiToUni ord519 __vbaI2Abs __vbaResume __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord552 __vbaLsetFixstr __vbaBoolErrVar ord553 __vbaWriteFile ord660 ord661 __vbaSetSystemError __vbaRecDestruct __vbaStrDate __vbaNameFile ord662 __vbaHresultCheckObj ord557 __vbaLenVar ord558 _adj_fdiv_m32 __vbaVarTstLe __vbaAryVar Zombie_GetTypeInfo __vbaVarCmpGe __vbaAryDestruct ord591 EVENT_SINK2_Release ord592 __vbaStrBool __vbaBoolStr ord593 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord594 ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 __vbaStrFixstr __vbaBoolVar ord520 ord521 __vbaRefVarAry __vbaVarTstLt __vbaBoolVarNull __vbaFpR8 _CIsin __vbaErase ord631 ord709 __vbaNextEachCollObj __vbaVarZero __vbaVarCmpGt ord632 __vbaChkstk __vbaCyVar __vbaFileClose ord526 EVENT_SINK_AddRef ord527 __vbaVarAbs __vbaGenerateBoundsError ord528 __vbaExitEachColl ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner3 __vbaPutOwner4 ord560 __vbaR4Str __vbaDateR8 __vbaPrintObj __vbaObjVar ord561 __vbaI2I4 DllFunctionCall ord670 ord563 __vbaVarOr __vbaCastObjVar __vbaLbound __vbaRedimPreserve __vbaStrR4 _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaStrR8 __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 _CIsqrt __vbaObjIs __vbaRedimVar __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaInputFile __vbaStrToUnicode ord606 __vbaDateStr _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd __vbaR8ErrVar __vbaI2Str __vbaFailedFriend ord608 __vbaVarCmpLe ord716 ord609 __vbaFPException ord717 __vbaInStrVar ord319 __vbaUbound __vbaStrVarVal __vbaGetOwner4 __vbaVarCat ord535 __vbaDateVar ord536 __vbaI2Var ord644 ord537 ord538 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord647 ord570 __vbaVarLateMemCallLdRf __vbaInStr ord648 __vbaVar2Vec __vbaR8Str __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef __vbaI4Str __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq ord689 ord610 __vbaVarAdd __vbaLateMemCall __vbaAryLock ord320 ord612 __vbaStrToAnsi __vbaVarDup ord321 __vbaVerifyVarObj ord614 __vbaFpI2 __vbaVarMod __vbaVarLateMemCallLd __vbaVarTstGe ord616 __vbaVarCopy __vbaFpI4 __vbaR8IntI2 __vbaLateMemCallLd __vbaRecDestructAnsi ord617 _CIatan ord618 ord540 __vbaAryCopy __vbaStrMove __vbaCastObj __vbaHresultCheckNonvirt __vbaR8IntI4 __vbaI4Cy ord619 __vbaVarNeg ord542 ord650 _allmul ord651 __vbaLateIdSt ord652 ord545 __vbaAryRecCopy _CItan __vbaNextEachCollAd ord546 ord547 __vbaFPInt __vbaAryUnlock __vbaVarForNext _CIexp __vbaRecAssign ord580 __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

$TEMP/BonziCTB.dll

IMPHASH 0a151413cae1263819c5ae21d88080bd
SHA256 f85525a3ebe334f7403f031ec47c2b32461650224223ee728107dce0e879ea93
MD5 6a4c7d730aed29b0405b03e128c1655a
SHA1 1dbb8dbbe7bac39196f7697486a36dedf59b31f1
SHA512 212ebd6b0cfa2500add4813860c74288e83a606676bcba837d500ac30960c10cbf1da25c7f7c526cf9953ea619f8a3244dc1d5fdccb1c1577b271e37289ecd7f
SSDEEP 384:MDM8av3HaAdlYeH73h0Bg/IX5HP30sLey:kU3HaAuAaagpvxC
TLSH
T1D5D28222B2EEC12ED51901B11E27E6ED10587E310FC5E61F75EDFB8E0E769409A24B0B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/BonziCheckers.ocx

IMPHASH ef48b9ebafbad3a44757bc3f4266181d
SHA256 9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
MD5 66551c972574f86087032467aa6febb4
SHA1 5ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
SHA512 35c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089
SSDEEP 1536:HtfBDnpy/MOuoHvCXDYd05gNsHzmDwUhUjm66UGi+axKQMArl4qwt4h0wcRv:dBLp4UoPC/zIwFsSp4pt4h0wov
TLSH
T143E30913B3A1820EC4955E74264BA3F8502D3E330660916F9797FA6C1EB5ED39E3472B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

__vbaStrI2 ord690 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaFreeVar __vbaAptOffset __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList _adj_fprem1 __vbaI2Abs __vbaCopyBytes __vbaStrCat ord660 __vbaRecDestruct ord662 __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaVarCmpGe __vbaAryDestruct ord593 ord594 __vbaObjSet __vbaOnError ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord520 __vbaVarTstLt __vbaBoolVarNull _CIsin __vbaChkstk EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaI2I4 ord561 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaRedim EVENT_SINK_Release _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler ord711 _adj_fprem _adj_fdivr_m64 ord714 __vbaI2Str __vbaFailedFriend __vbaFPException __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var _CIlog __vbaErrorOverflow __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 ord689 ord104 ord105 __vbaAryLock __vbaVarDup __vbaFpI2 ord617 _CIatan __vbaAryCopy __vbaStrMove ord619 _allmul __vbaLateIdSt _CItan ord546 __vbaAryUnlock _CIexp __vbaRecAssign __vbaFreeStr __vbaFreeObj

$TEMP/Books/Bonz and the Polizoof/page0.jpg

SHA256 4b0d3ac6305c56e814e87734d3798a4534b639fe7752a20bb398fa9eaf59bfd7
MD5 2f86991655a07f1e0ae608ae69c8de62
SHA1 89885605155e2a4162bdb5bd0631e01e350d7608
SHA512 1843da571ee2ab31f6449e94698e51445e458829fe37b98c8967e9d3572a06811c12438f3b7cb8e908d95dd583429d69c524a50bdfd0390a84af0ccef5f2b552
SSDEEP 1536:XF/EtriiF6Bh6jve8uwKht9APQv8gw7kZIz:XhwiiFaU2llt9APQv8TwZIz
TLSH
T132430267AF9E9F8BC7EC313013344F5C38E14D42FD642696477B48260BBAAEB61258D4
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Polizoof/page1.jpg

SHA256 bc48c07bc245bb7a7561c983c72851bc2f48cae594472c48d3447456dcbea804
MD5 66fe43801d34b46bf67ed75989779010
SHA1 a5f48e93f10129ec8b0ae0b71a3901229d936fb4
SHA512 0c3ee73b3f1009140a5bbf8a07b059db37bdb30e673d46b87992541b4f96545f663b083c97926da7dbee053b5be557186aa9ea6e3a7deb2d511daa5f9f3e59da
SSDEEP 768:X9bCx4GufcGl9YGb2rmfSEU4oZJJgCba6l+RAk+BgPR0vK+/u6t1OChHdPvMm42J:N7GufcGdPh+2KZ0Ajg50jftMChHdHMFO
TLSH
T19933026D0B4013FFD244FB6B87B90512AE6A35E310EAD696C7B346D2A079ABDA751300
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Polizoof/page10.jpg

SHA256 58007307843f33234f44cdb0b89d91d0d12d07401a9c31ea7d64d5b6688d71df
MD5 f1ff8656e3b3bc1a6ace48d232a04752
SHA1 da161d1725964dc78c44fbdd393294c75ae152ea
SHA512 e34b99174ae6918c1049fc686efeecaf9cd65e610f3dbdb6828266bab18407211033fb9397740b75193c2bfa64abd2c23ddcac623fd9a2208fcd84c61a70a2a3
SSDEEP 1536:L4zsbVjhFiYBrK+Nd9fHsn9HtYTeRDXgsw8c4/9Lk:MzeNh9NrfQtYT6HcGLk
TLSH
T19833F148A9C7CC145BC89FF1C560C9AAE0A01BA837D7B9DB9487001AFD5329B909FBC5
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Polizoof/page11.jpg

SHA256 1eec3c97c806459052a98661e0bfcdac4eafef0df5fd2af6c4c53916156e5eb1
MD5 deb89b81b2655a117454893c71cf39be
SHA1 1c573f99842e46abc56accd7cb4d7f4b0f93d063
SHA512 83536ba1b85b1822544997be4e4ec08e79684a747de5b2c1af3751d75d7dc848e0c743989cd5cc6996d3d8fad918cd7cf6420796d793e77c3261e58d61736107
SSDEEP 768:TNBT5XsT3Qkx6F61AJx292D3UQTpoN+qLf4dCqknXh+d4z2ZvhJcJbyFdDLam7nD:xy6F61AJ/DfTpMLfc6xOvhJqbyTL2Q
TLSH
T1152302E5C762DE228B51D3BA7C31EA17B28979D60413AEDE4893C95A2F7003DB0D24D9
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Polizoof/page12.jpg

SHA256 2f52d995e111b8c9ac693663a03ca0545861e94c53c7110270d21ff10cd4876b
MD5 75ab958c17806c34e8bff5833816ce56
SHA1 45410fa635d296b400da35cfa90e4207e43b084a
SHA512 7947fe6708c45109befcea84019b5f5f84ec1a80137c1895045a38c9151a525df283a47f9f300a386df992492b4f4b12b8a8eb2f0f9c98f8e4a9660723b53c8f
SSDEEP 768:JiG0Rn43Vggfbb72O+6mbTupZ4ttiEXaBzbzCrcoRO5tlLTaqvmi3qvNFOk:Q1nIVggDbt+bc4m2rw1acmi6vXOk
TLSH
T1B2330202C257BB9FB623441A1D7B29526405AA768537F9341A7D52C83EC0C3AD578FFC
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Polizoof/page13.jpg

SHA256 43f4e85f1c60b73fa8252dfc755e38649e8d23ba8a666a83d0cf859b0920f4a1
MD5 3b53202999c06a3fc163ca659dfa31de
SHA1 73fa0053205b67920f7d3e6eef7fe19819603847
SHA512 916aa4b595a91e13a0b1bddac0f9fedbd131fb024d0a925628fc332239fe053615298f5c18e2e8f4319f4d211c5d679aaa91350f5a781c8d0f18cbb71b3eb58c
SSDEEP 1536:BozxapdcGnnaRO6Rc9tK5D14lREgPRgyp7:qzx7Gnnf6CSQV
TLSH
T1E133027871D9CB05E7368A71DFF6C717D75D9FE821E68BC0C4E6848835A8A3934021B9
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Polizoof/page14.jpg

SHA256 aa9acde92741388db556b92bb3b3c7052faf78984835d4e05f3ff1bb44c07a3c
MD5 2f0b89fb6286f9cc3d4f698cfe915d3a
SHA1 fb613a71ba544fff7e26be88e8c5316daa99fb0b
SHA512 742841434414a05d9f5985674268c776123c504b38239f5552dc4e4431254a604e678f5b818570dfd99fafb905fcf052fdcb614952ff9f2befdfaf62453a36af
SSDEEP 768:V0AcKUPRovLoIFeI5wf69TP84HyqTlUXVQ7OX60Lv0SffAALRf9X7BXftM18d0Mx:V/LUu4FU04SqqFFfmAxXfq19MirkZ
TLSH
T19A4301FB4F9EBB5050D91AF24ABC96A08E7F0C5485066F266C331DE391E0355BF88D46
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb001.gif

SHA256 ab33039db90f44dbb3c9967ab157f40805dd68311a441ce5e819c286a3569ddd
MD5 b8d3f236077a74be9fc38fac772f1b16
SHA1 35f80cf295803363451dcf80c8e1f2b8610785d6
SHA512 a88b469bf08324ee4dc5679b4e8c574ef13b76be70612de910df088ab2bbfb177a6a447d622069735108562aaac68dc4ea745577d4c186412bfe4ca08a0feffc
SSDEEP 768:+YHxPbV9Gj6mrD+XOsTwtCehVMQcKHaDM/d/pTsMq3mCmZg6EOCFwYGBlo3/Nan/:91hcj6mn+XatFjVck1rq3mCmZ+OI44C/
TLSH
T10C03F1F4E6883AAD96001CB9CE2644EC1CBCCC695D399FF06419215DE88B1CFDD785BA
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb002.gif

SHA256 d68e785094c2f0016c735ad9ac891e2ea2b0b30b4f30d800446759ba0134b7ac
MD5 794dedfb9768a5272ba8793933a3a44d
SHA1 010de007d8aa5fc21319cc8506b2d20565b29520
SHA512 fe2f5809f1cc2d0b3ac310a8b732ce4e014353056005ee6681c13181e3b9017d04f3ee1f8ba39c97dac00e944bbfb684c65de42e2092689d9b0f1c46d15e098b
SSDEEP 768:b+hT5mgjtrq5keDgMvpxuTEVTpYsLBfy6NTgMxMcA3kZIGjTwR7ZlyImx:ihVdrS7xuTYhouhxZA3pmwRH4x
TLSH
T10113F14ADC997B9F37424995C61101F8E984CA738A813DEC9CAE936CD5897F9082FB06
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb003.gif

SHA256 95cbcbd9c41c128ae03b8536ee229771a8a42e3cbf57faf4697aaabe98c11108
MD5 ec0b47d2d9057ac9d80a3f7f6367de4f
SHA1 228c3f34695afaf8a3c48e9268cf49d93a94db17
SHA512 8a77ee085dc0b5065789757f310f0e4b02b9ffb4e00ac159b6e2bd4e6b6fa634344456b6958998bc6905dae95bfddcd3863dd0504f6daec3dce685e260f6dbbd
SSDEEP 768:t2zuowW/tLmjkVspTBnJdZ/FobUD6f+uX7WxEWJgbrDGsCeQqkSOfr8Tvk2rQDKz:JX5usptDASe+uXYEbDTSqkr+EDI
TLSH
T1EE33F2DB50CE5F931DA80E4C7747C5EC26EE8F1E87146E3BC4B15E6881201E9BB8B816
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb004.gif

SHA256 9f93891fe6aeeea23b10ae5aa680fd44e408b97ffd9df65cf0434fef1b049af0
MD5 b743e2052f735e7e2f132d2843e53641
SHA1 edf2545d4279ebcb965aa42523ef4a93cbaf67a3
SHA512 0a16105b057875b105f217b40d8305feb7039f5222d7ecae7c329ab1efb1e4811d4ba111124b4bf5cd40f6bcac843a99444795dd296cd97cc01547cb4cb6cd20
SSDEEP 768:h15afPZKJVPAQwrR2LFMZAVXeOVEq9VYLspbC+yo9KZz57AfLKwOEFqvNiIHhUXA:mcTABRKyZAVrVEq9GYla74fLSnQhZWh
TLSH
T1FF33F28788C5385A07EF9C266ED53859399C7B6C3FDEAF10416836C6A179803EC0D32B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb005.gif

SHA256 0d177be82265d4458b9ab22efc15418128742dcd60488a5bdecd5d334164dedc
MD5 618feaf37b7c85b693ce5ae0ac51a508
SHA1 d648be18ec2d54a7fe5e808517bea12e19a70fde
SHA512 9ba910a321de102eb56662acd4236030e64fdd0c026a8a81724b21ab0c0a9b6be7a45117730fbe27eeaa49e22a9ac746d48a8399263c389a338765d8afbdb0c9
SSDEEP 768:vbU/XQVgW2Or+FxTa5z1JQRKqYS/WQ6Dy3tn65XgNQDdtGSkzooq+laZCYfEtkN6:TU/XQVg5iATc/WK1Vy9YXgyJioofl3/p
TLSH
T19C03F1390E82957696718F5F5D99ECDEE4C06DE858581A0A18F820FDCCD82CAF05D43F
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb006.gif

SHA256 3f5adbc7bef95ac98d78d9b2e2f25c1b89dd6a14b02ad0c6801de51fe1e48843
MD5 0058727d44f8467d8283250a0b43556e
SHA1 f2b42f0abe25803dd04b87a8512de171034c27be
SHA512 520620f5b52a062d3b37eb866cf731ac0eb876683d929db7b84777c40cd645364c2c715aad50e87951ebf483cd4f45efe00319be1a36d63248b4f4d9c611350b
SSDEEP 768:26VCMbPonLGwj6gH++FblMLED5QBoJ+hfdOKMMY5l5BHwNRIj/pbVgd:2683nLG0rD1l6EtafBQhB5l/Hg83s
TLSH
T17813029A836170BBD485783D21E217573EA247C01B662D73B17C3AE2E61740E6CCF5B9
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb007.gif

SHA256 292ace5abc773d1dbe3db5c3a51d42b11a360e22b17643209b30f5988e437761
MD5 76a8d032c940da779016d3e356401758
SHA1 2d60e50d4830e1355863544effef81a153867503
SHA512 63abe8edd5bb928c4b594aded6da4e82efac7ea7ab086f2e5509391b1e0f5cb3fa6b965ffa4ffd342869d16d02b4c42e8b2c03b6b4a6fead8de581624d8643cc
SSDEEP 768:YjtOV94dzSId+OLzdlaSlQKaIJClau221xTjLnQ/ke:atOV949SyLfdXGIY5B1xTjj7e
TLSH
T1CCC2F158D0BCA66E9DF0CDB4080198C91305A2AD7FF1CD51E7E97075A60888FEC0029B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb008.gif

SHA256 bdae04f6d7694e1981771c0a76fc555009dae6e56f2f11f8fdff87b2d9dd0797
MD5 517e6ce305c098d358d27e6a606a4e81
SHA1 1f90118a88f4593ea4dd748526180f6c69ee617d
SHA512 044a47bb0115a0b8ec905f4b433acf00866e5faf4349e57aab219c80641d24dcedaed17a170d7bd7eed2e2727daf80fa6eebdfb95791bdabd1dcd2fc80ee9b9a
SSDEEP 768:dchLzR9ww7Yar9fX6zeSYiALxe+WATWk1rvZfYYff:dcT9ww7r9f/SYiwxe6TWaphff
TLSH
T107F2F17BA06DFABF6E7009D0467FF05A600850B6006583E0C67E88E6C6C4FA37C91A97
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb009.gif

SHA256 b5cb2f91a884e832c0eecfffbc4b0f6920a67e0513f3e2ac9130bf6b744ad146
MD5 62b85bbb9df60349a7c0d8cb06e090e4
SHA1 4c231a467127d6cfc1118fd51a0b0220296e255a
SHA512 87e6608e33ec84ce04b20a44c69d1da3ca9f70b7f8542739456b27eb1d8c589f3cf6f22ca1b4777d0135e55f2f7e15cc5306736a5231bac81acb6b5d27f14134
SSDEEP 768:RE/q4lw0oh+UOlsD/KWg72UKlkLTNVSmhZKwDM5nwHYkOBVJCdEPZhLibZC:RHPTqEKWg72TkdcgZK6Mm47VJCmvibZC
TLSH
T1590301F31A844666E53EDF71DD8A4F7C722F8E15C41ABCB89C0278BED3A0B611709512
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb010.gif

SHA256 a16ddc10725a33dd91e617de97cfad7372ee33bbdf195312b70b1d10194b68c7
MD5 79a9739cb814396f6cda31b59d3d87bb
SHA1 2993f8102994a1e238cd48541cad333ed950e88d
SHA512 2a3e5fb4e102134aaab34d72246b194bba61b630e5e6ef7ced96574a137723cb716eb1d9a7350b4981048fcdb1f496d11fdcfa9edb5007aa06731b8ba09c62ef
SSDEEP 768:VAcmJclPBwQ55QaOCoJ8qDjgWceZXLghu1ymtGDZeZEGD:VMult5QbRJ8gkWcGLGDZmT
TLSH
T15713F198A2D0C0B8051BDA1FF9D551BCE09439DDA963DA1C06BF35A8FD06DC8F4A2D98
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb011.gif

SHA256 741f4194e099e387d5b81753972074c2ec9944b36b442ee90f02f2e05a49e2f0
MD5 0420a172f5c3b557a58b9f51ed8c6249
SHA1 07c58efb0135071854091f6b3c504b380c971dd9
SHA512 eea3706f02d068df6e7f6744dc391400950cd635cb966fd224bd7818f140aea02e9389614e18887271cec6a167e699c36d37d2c972724222b9cdf978176ed755
SSDEEP 768:st8xDwGhRTy9eLtvLs1g8mmymVvt5NGHlpOdSlxUEkpFzTVbJAmmhIaxpnK+L:siSGGeLixFymVpgl8Ax0ZJcIaao
TLSH
T1C723012CF2961DCF02FAEE3CD8ACF8E12C95367099CA094D195DB4E7B14A1D54602E8A
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb012.gif

SHA256 47f4755a428995775089a622f33eb54c4505d8a6ad7963c6de646de0b2156017
MD5 03ac2cf533ad921fa2e570449c398d60
SHA1 b77a69ac67cc2ac113d997bf3c3d4cacd60b193d
SHA512 74acc8d75fcd3fdae5101b401e84042b6c04b3bd2347937d007201ffc9bcd06b84915beab9f58b3e1f0c09d9f49660eb979ff1d0d75db1e3396c31a5ebd0a794
SSDEEP 1536:8sTliWl9zQWGOEsaEfG3D+gZvRy9Zug9xj:jliWl93ysaND+gZMtbj
TLSH
T171330154506FEE6C1DCDF38ADCBE636C1221B1DE72DDBA90C8C171A9B5E0089A81B517
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb013.gif

SHA256 f7eebb0ae58ea8e64160bf2bf8bab0955603c0208c3bfb760d89d01088f042c5
MD5 5ff48f51be9c3bed3e81d908c08d7135
SHA1 7673287c411d65538b7e60d1e51a92d1acbe4d07
SHA512 c73ba4a996fa14f3ea9e70f6a1e980c3cb0d0ed57efa8b8d241a99ea2155bfede9d898e6404704ee005c9de130777a4d2c364012398fd839c5966a476ed05d76
SSDEEP 768:2le+/ymlYswmymS3k1i+tWHbW31oCBYTWaoTYokjQ+8Mn7YjQA06p+MqIryP/a:we+/xLKk1htWHilRCTWak4Q+9YRIx/a
TLSH
T14123F1E2CBD650132C8CC8FA7548C23D3656B1EB1D03EABE149341E6C43369E1E225A3
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb014.gif

SHA256 963bb112090949111b885ab790c9e032784d9dc6c0fb3388f47d011f5bdf6c7a
MD5 0c47d03a6d75689e2f84b925f87561de
SHA1 4782d1a60796d24f2406e35d18ee4c8fef59b64e
SHA512 c4e96977c2adfcd69cff2b22ff802bda3ae0c0ae6bfe3e2f1800a430d2f06749e450b4a39132be3e58c20e39e333eb7c79386ab69e8efbdb6256959c4a5a5feb
SSDEEP 1536:DFX9910RrVAcrsdRWc0Gl0wnM5fP38U64:ZX90Zsdz0GrKfPsn4
TLSH
T13B4302F9E6FF7429641960B6102BB246F63391E0B17B2322B8205354C11F89A76DCB7B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/cb015.gif

SHA256 84f12116cfbeeee6373bb94a0d878e134fff50d598d6f1578f4131d23be3703d
MD5 b9d7d09a834dc4541967ab78f7d0fd03
SHA1 9581e21ef862542ef9f6263ac81377c7f3469b0a
SHA512 a879dbacb814e1495f73a8a56aa46edefc6523ef9badf3d1845b6f9b234bb4daaea8d9537fd0babc4412c577860a1378802fe0a1bbe28a71283e4d5105c4176a
SSDEEP 768:+a9uy/miWwYeyCJnVfmWhhSH3BPyfdM9CKWb+12m+1YrxxlY:+rFlRwJVDQH3hKa9CKWbhAxi
TLSH
T1B5E2F1A2A1A13A4B1DE8B9C43C3644B60507588AAC3C8F7A4DD488F573B16D73DB8582
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonz and the Treasure Chest/page2.jpg

SHA256 d0a1151ef42147b7ab8c9e88bf3b926c7249ddedf72bd1515303085bdf34fdd0
MD5 3c449e12d7add81b7fd04f63989d3ab1
SHA1 425b4d9ee94b43982a77ff1fd76aac16f9eb386f
SHA512 750f18e49d22f7a688efe188a3b70f9c093ea78a0e85882fb02a8e0cf06e7d1eeb9535ab11bbb064397b75b9e27a6407dd5c5bea2bcf4780c54f94ecd30a4073
SSDEEP 768:wrEp/YWpbvISLptFtaPrMqSBGX+dLwjVwRSTWwujiOfJQSp4waDFqj5fRrPyqr:wrm/YWpkSLTFSlSBGX+dxRSTwGOfJvyI
TLSH
T1C223029751315912FEDB0A1CD86AD32823900AD2335BAB5B4C3D53EAE3863E3147D71C
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/book

SHA256 486c7e2d25096d871171fff1906c65f98e8c1fa888cc5c18558140f999274d4e
MD5 e2b9604a4c6c86aacc681d8e2e6b251f
SHA1 39b684099529adb2bfb78d0dd1233b03c9fc6528
SHA512 6ad292e3d20dfd42228387181322ec6d4622d35b85829910f760a3fecaf110a93f000e3cbdbc575cf8a95f6d621af04b973e7c027667f8b9adfe90273464c632
SSDEEP 192:2dhYeuT6k+F9xD8oSWMqQsCNHmYUlIkXm69Nr9RmK5I/RVT90EwYvysmi9DCaTLU:uhTuwZDtS7q4mYUKkXZ3RmYYlaEDKsDu
TLSH
T11C229F4A4C773E464135CA2B847118A77C961CE2558D32F5B4FEED77831EE8AE41CE09
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page0.jpg

SHA256 0b4aa121fea4ff7a39bc48136ec58799026d6ead1a41672832ca92d9dd8e5c7b
MD5 020c58862bc4617cc06981e6ac06cb54
SHA1 18b7b419214d8c26961ccb1f9a06f1b9a71a234d
SHA512 519d6f213872c85d7dc19585ec21de94652f8e48e25b016231dc3e88d164f2fdafff4849dda86bdd3625121290f9e70a05fabeec17bb163dd4628479af6509dd
SSDEEP 768:RdRPr46b+s7NMjLtEixWUpFYudummIQkEhFtdO8kBMgBuqow+/:RPNb7NMjLtEEpfAmuXd7kBru3w+/
TLSH
T197F2F20B7019ABA9AED710F18B95F840676E1F20E29BF7E1169D314DFD458EFE486031
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page10.jpg

SHA256 dc60db3b80e4c049bf870b2ce9981fefba35fba7afba5e60d75b9c0dac8ee141
MD5 e86ba8546995f30e9dd40e363f7de50d
SHA1 4cd4146839f61ae3709849a33a0bb95cba76d9ad
SHA512 88b50c7f7257d9e58f554e1d11cbcda57e30f56ce434a240f07152f6cf85ce4369e0185a9c3c96b18b886c22f35fae1383bfc79fb2d8c607659cdf5e19a5e450
SSDEEP 1536:2Fm73QnnMfnpsGG3BSg8LJ7/a7CKNZOPh3OsDXexTb7qk:V2WnyGQBSg8Ld/sw3OIonr
TLSH
T1736301B3D35AFE38FB96D7318034344307A5E560618D7A3AE02774654080F694EDABFA
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page11.jpg

SHA256 6a584c706ff3383b476fc4e55e7c16f0661c30c622237094f302db2f6cc7238a
MD5 7e1f1a4d240a827c40e9f3cd47d169e8
SHA1 a8587b711a0cbe45d6821750baf584d629e8c8d3
SHA512 30586da3a9227a91fd3437f9fc1aed54198a805ab970dd221bad7aa6ea47be598455ae54e3e5b664b01f60fe99736196f42fb832a10613b570ad162a4647bfaf
SSDEEP 1536:EFBCyvbFj4Ym5hzx6xGfzRlJIKpafsJhXdtkNfU:aBLvbFtm7xWUvoChttkc
TLSH
T1A65302EEEE96A7576EF3A3DC8F7D0BE4827ECDC6672A5B0091A3FAE541D08451C09110
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page12.jpg

SHA256 01006d2e7052d985101f0bce9c901c04fd55cd1cfb5e2d23385396f7e88e8fc0
MD5 739c4dcaad2aa6951b4c6b924d4078bc
SHA1 c85b0346d0bb95817ee94042b5e6bb4c1dd7065e
SHA512 a22e34ac31a6b8d98f8901b5f75faf0f5ee5c362781bc81d3135ef48cc63a30613f6db120b3716ff0094fae016f0be231557c41e31c6f40f8ea8bb2bb7d2aca1
SSDEEP 1536:NkhuqZWoh/DzWx2vcDThLAQTAgZ2XZCIwHSbEDDTumwl1A:NMuIWozjvOhLAQtLIwH2EDum4A
TLSH
T18C63021B932B9538F0A205A415B7C700D8D3678D91BA7798D1B44C2FBB5796E5302DCF
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page13.jpg

SHA256 013fec11189038bc36ed28631b90433284e839188c5d1e69c5533ea8e1048879
MD5 ee0221e955f4c4ed8dd1ca3a59cd6b23
SHA1 726cd536a91ca93392c49af94daea762d514a5f4
SHA512 3ef1e86b88612a50df3a75d0f401f811b149a0edab1ef5e3527c1fe47df9b5d46d207379f68726402d519bc4af53a18ae699780fd6770bf8068962d41ffca60c
SSDEEP 1536:vYUq+L5ynpAzsRmlNMvzBfFXFrkX0teK58NB/tecuxb8BgzFNbR+XhdaIIw:AskR4NMvzB9XF5teK58NHnubz3VNRw
TLSH
T1D58302172C6EAF1345AA4A84BEFB9D396B64520C7C5A03BD93248DD43FD42053CF554A
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page14.jpg

SHA256 8882f1cf6f0cae626f8677ff3d1b415a5df88f32b7e6f94690a5997823b4916b
MD5 628fa9eb07409a1cbb50639f2c6f29f3
SHA1 e1f92ed329cd99f69112059b8f7e60879ad4ffc7
SHA512 68b53043af8a63a559bb1f3490a05d604bc5bd54e38d9121bb5730c12e8d1a6a0100ddeb86b705e0f6f38f6dcf3e20a3e8ab6e9b062a3c7e3d3429712a0c5735
SSDEEP 768:fbxjis58lWlrGO438roNrLQDE/nEM+ugAplEq+k718ZVkuw3Sc4f0n1zEPyBmDTI:Vji2a18Ar0D2R+6p/18ZVFynuqBrxx
TLSH
T10153023D1F1BEAB544EF570C552BAEB96A0CC4B40558C38DDFA71E6058B06321A71E23
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page15.jpg

SHA256 e71359b05df80c15916fb273710c8a87702af891b11734663cf538a6baf0a32d
MD5 3e720f815cd37130935c0be313d7fe4b
SHA1 7005998c4541f6da091379f748af5394fe2b221d
SHA512 b665452711869dd9d774a87daf988041b5538d6bd903bbf7038193af9e13ecfbad9420dc50f03486995b76082c07d03da5d67a0858d2b0325e51a8ef8814e295
SSDEEP 1536:piZP79KnuHPQbQVWSoFaAOgZMVJ6pdEPbjjahJFcfQhjsP:piRJKnifY7AAOgoIpWmhJyasP
TLSH
T16E63028F650A16198EE7A97964737CDFAD4CB1C5214103BC38269CEC38759ABA33397C
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page16.jpg

SHA256 0f36eb4f571237452098816d03de25c9081625391a2295a5db4cd0a01933ddfc
MD5 4f25fd90fff473840ef608d23efb3967
SHA1 76e3b424c934e67d35fac4419f8b5561ba1f133b
SHA512 99b21e3431865bff3b9ad871a53a874d382b8612f1651198d03190e23e189dfaebeccde2e85ac8b59148a7c44487187ebc4b86c5c9d08286b3e27497a4e57306
SSDEEP 1536:GxGDEPNNsYATLmhH2kqjFKeXcY6l94WH95ACH:kGyNhAClxeXcb94C953
TLSH
T1284302512F825BD390B3DAB14C78ADEA83957F4E01609DDF5A392E4DE1700B305A3626
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page4.jpg

SHA256 d635654cda3fff19815d46e1ea912291adb2c553933709826c1a167b6b77dd53
MD5 fb612fa0ba27a05bdb5f2afacc5c9f74
SHA1 8b7ea2536a030b69c0e0ef578dd30897f4078768
SHA512 b86f8ae215a03d8f594197245f11617dbed4ca314eced6f8c7a6502e1313849a5d1ba7e08e001e8514f168d1c8ab7bbc87081c183ebf21608e086140ab74a97a
SSDEEP 1536:huG0NzAOopB02tyZz0iwRmjyuo5GD4wXjt/C/+:kG0N12tyZgiwRmOw
TLSH
T1B063026B96043B0BDF9941FB43B09D3114A5DFA82B41062E7CFDA94EDAC2C9D64A20D7
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page5.jpg

SHA256 38be8805a0cf6c7d34cfbb7256242d3e0aea0f3d36185ce6e73c7284bdd87e24
MD5 91fd681cdd4a73a0c0dc4da4f5c2dbc7
SHA1 8c4df7e7b87ba388d065a5732d2a48f2a2b4d5d4
SHA512 e01db87b87da9b4638ab9ef6a01c1440ca2a2c678563a0ce8eda219989092e43e94dce53778ce240296659a3ccb923a29ea142198281c3245cc5d2ed666f2611
SSDEEP 1536:ruHXejb6uYKmWWW84lfsOk2iTXddFrRufuBiCeQGw6V:ruHXejRPlk26V8fuACDy
TLSH
T1A253021BEDEE9E8771017A7666B40F528DC9CE88195EF77F5AE01B01429AC01E3313E2
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page6.jpg

SHA256 42a92022a12be3db39db1ed564edec32f031ec177da4db128d207cf9a9a83f35
MD5 2912f5369e6bf38e93649275d9f96b6e
SHA1 f5be690c042792ab01350238617fac858f79b312
SHA512 e5b4dd674fd8dcd34e3f54c33b521226144ed841e0f379958f51fbac0fe1ce5e10af8ba825f0958ba9caacc6cf60080433816fc16ccb8b3532557a26d4bb2f6d
SSDEEP 1536:nl9Ud5JMd/NwSMfrJbOqZsDCfsTz/KE+USZacH+1Sj1DWq1BLCXXm/kjQ:lzd2Smrs4saE+tgE1DWq1BuXX0
TLSH
T1776302A6EA5FEE8486446188B0C985E9014C4F45EFCFD2B43E720E6DFC4684A79345BD
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page7.jpg

SHA256 db7027e0f7d02fe75874ab15de847352099e36bf10650c54c860e4fdd301d418
MD5 60447490b257933c2de36bffbdfe1f7c
SHA1 375aec1f6c66453b0f0968dd497e668ea1695e31
SHA512 1bcfda7d1a75e1f39a16952e99f27bc042601b167caf230eb7bb78f32ca18ad9be7670708f6c5be99839fece81bff4d9a6aceb753335644e49edc77d15464bb3
SSDEEP 1536:e4grkaCdT8o1YhpD87E6nVCAwfMAvW1PjHEiiw6H/zL1iom0G6:orkaYg5LD87H+f1vKPjHETHLh7NG6
TLSH
T145631256857E0870B43819EF493E08231A1F7EAB9DF8FF91513E6239E8A40643955E3B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page8.jpg

SHA256 d8333b0964148b5263793ca0493f40c373a47ea53fb3fd637f1431f44c414b7a
MD5 05de4b67553680cd23c5fa741b6991a0
SHA1 13123c66da9c4997142e991adc6bb952cae57713
SHA512 56be6cf453fe8c346d8723d2fc6b3cf5f4d1f22b5fb791b43a4fd9196308fb2163207e58082e5a764d52647d5b13bf846a2b47a1912dbe44f6cfcb3f7f7667a7
SSDEEP 1536:5rWjXQCP9rnV2UBB8gPS9dt7Hhp5lWuFGxZngs0FTYLu+l1Cz:hOXQG4A9S399IngDTYLui1E
TLSH
T1B26301BC0CA58738FDFFD0CA72701BA054C60665E475E129CB6929B0926C07F9A758DB
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/page9.jpg

SHA256 c64ce0ded53d511f9a6deba02741d37e5c96e760bc34b294f546931c14d8137a
MD5 4b4178dcdd926771e2d601f07edf1e55
SHA1 3b87b64c316e43c46466b4b5b5d77112a7d6caad
SHA512 beb93360b8c1e3373d2fdc04afd7fc018033045918cf0587eca94ba65e4361415b29f0c779a86101ef1146072a88e2763552cc20c877b8816841a67d39a0bad9
SSDEEP 1536:mLxi4xcD/EvePlKNlu5WmvQF/vRBqMq2Gh6gm3n0O6:mZxUgLoTItpBqM+6j0H
TLSH
T1076302C4B4098120BCA49E634076BD72317B2BF631F02B1D592D8E72FD39D916E39D86
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/sp002.gif

SHA256 92d4e729520977fe8c3cee533c7e259ab5ab67810f36c557c747ca821bc19ca0
MD5 f1d401ed4184aa59fb75fca83e854fd1
SHA1 f3742178548022de8b6534817ff90c88e76ee6f6
SHA512 e745de3058317d6bad692880afc00d9362619382a71d8ecac79045d3cd8d37aeae91a2a4eb87f3fac6273f75e6f80b1809c2bc9d0a175f5f0dd7fdf5904c3685
SSDEEP 768:BORzYNblHKMKRka0FspUmilhAgyf6A9UTK1blhVsZcW7pEGVIP6O:qWb1KLRka8kLivAgy+TqXVseW7SGe6O
TLSH
T16703F294BB72774A86E21C51FD1F7DE5D2224C5230A5422BAC1D7C079CD9B87EBE1381
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/sp003.gif

SHA256 6078f5e78caa39fa31eaa23ab37e6939003b99e67a0c843335581cb8ec7c824b
MD5 e964851042773d0809582fde155b22c7
SHA1 6d8879362935fb3ab9364feda8fb78d30cc22187
SHA512 887eb03eb987df9c95b17ba93ad044bacae6dc9354eb5b994bfe0cb1a5c0959d360b3437f6eb4c8650176cd4cce9212bc5d5b9ba40359c0c33429391733cfd85
SSDEEP 1536:ycq7Eb2AjR6Osri/dD6u8K1PR7SEurrshS:5qIhMOsrIDL8K5R5+oE
TLSH
T10F4302A7D5EF33543296D612E21CC35CBC4907E79E3431B2E8151BAD2F1A85D1C1DB98
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/sp004.gif

SHA256 e113e023fc04095434a417689f7b436a4e4120427c0f7368beb89e48e6ad6616
MD5 501eae9da0aebf0c28706d3e3a831f17
SHA1 265db0cdd91a9f77dcb6d0d23884d74adc068ecf
SHA512 7fa85df145f470b74a2889a06d39c48dda006b0f85d13b8b8da5574ff8ba10d18965b57b5e6fcc577b09ccacc723446faff0a6b0d6a3ead512fb6b4cd8237501
SSDEEP 1536:tNhcPTn+07ba0Ns/yrglBbEKxEPblDXo1CDpiBy+cbb:fh+n+0i0NkbEKmJDXzIBa
TLSH
T1C76312303A0DDF66BDE901FCD7EC7F90E80474EF6925429D2BCA94F716D1AC80A46922
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/sp005.gif

SHA256 f30c86b0ffc248ab421f3d2cdf6dbfa1d7c3504400a8026b8548d8161c4fb081
MD5 07d266b7a8c8499c57452f6c50046167
SHA1 9e63e66164e18b4e6e151137316d92872ef9d470
SHA512 f3825788af9bb7c20e094f3652fea15b8beed76d78be231477d7ce4a1d13e6162ed451427f62d60c5bc7a434e539932fa7e41b81ef9675a749124110ba766a04
SSDEEP 1536:q3PYoSkN3NBk/moEKwg/A83nlIMOV2XL/:q3QuB6l/pXCo/
TLSH
T173430282E58590B9A8AD8EFA21965E03DD93FD672C624436258F20FD0076C1FAB7C747
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/sp006.gif

SHA256 1341f0db796d31c7382655362a682a45f00d5160ca149ddb0e13444bb622d9c9
MD5 1b853f839789d4c8a1d47393c06b1f25
SHA1 c65cab86f2dec503fc5caad740fbd1e81c1c0f3f
SHA512 60f523d36a5251dfa8ce373f046e246543b8b9b44b1beead17d9f2c6fb4ec6fa1cc3557c1342b1f8e90351d69023807ce415afcd92733845298f3e65a9e93c48
SSDEEP 1536:eAPVvk1I1VcCJR0VSIU+e3rMyECQqOamZL9Z:eH1I1VcCMwinntaG9Z
TLSH
T13F5301AC9173E56C6F57F2665304E0E701CEB34EBB44D0A4D0126D72CEA62C06E4E66E
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Books/Bonzi and the Alpha-net/sp007.gif

SHA256 4e7c34f76e045cf1acdc64071a7fe2d31fec2864d89fdd87e3d79e37dabf30fd
MD5 934535182612b7b90377550f6f1a7a49
SHA1 7fa2911dc190050ed7059259e3e55fb3ba3a0956
SHA512 44c2191ba807d53c0cad1a3297f5a114f15d270f80cb8900f7cedb432165d2f741f66c05bb724666a534c917782ce3108273164e3afb13d7c311db9f80d8b9c0
SSDEEP 768:0GaEbfiB0AWU76dfcTbXQvpmEeU/7ZafbiIuM73mwcbVLf5VPnhVRSDavH5t:0Hgo61cTbamIZafVLwbtnhVRYavHr
TLSH
T1E223021611E9D64CF08DA1FA831B5AE0C6A1DADE94E87ECB079E1FC6731C97501393CA
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/CHORD.WAV

SHA256 1cdb5e4d203f61e94c02f5eea5008289fb463c02174879887fc62574b34c12d3
MD5 e913f3f2201c09d938c63f10dc535bb1
SHA1 1e326ad6d1c2c538c429235006e0fa64f9aeec9d
SHA512 0838a26ee0d918cad1cec431ecd1ebe431f559951ccb85161823d234ae4157f0699d903af178b4af2d70046b04b29509bf1691f57c021f8f63dce579cbece233
SSDEEP 384:ExbeoR5vhvSHkvbG+uAK68LeqdyANaWoH9MJlNHRGke+:KbeoN6k3uAv4ec/wWo+vNHRR
TLSH
T17882BF46B726971D3932922E7DE34CA02511BF6E1D78C066E273C600B933AB74E57B91
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Intro2.wav

SHA256 1d648a27a0209959027567f793f8b3fd18a103b64e62eda3f20f11192bd0dfaa
MD5 125f1998a1e8fd06bb02f6168b0445fa
SHA1 d65ff4d8a79e47122ba872ee3f4986df7827766a
SHA512 62cf29c85efff23449f2cf0985c1eb5d71111bf5332e6932129ab9e9ec4d2fbf819851fbb9ea73946c24fa6a1715d1aea6eef58c5e52de340128a4aaf5267c56
SSDEEP 3072:vUF1vsEOPmTiWvqPNcHtPCChL7cuVzZDEoEvwLs:vU/vspmTlbz75law
TLSH
T1D5E3E132B8630F2117D6C111EAB26B201D5EF84DD9B63937DA9A8E14E602190F774FBD
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/J001.nbd-SR

SHA256 56ac8a4f90686b433297712de577ba68e0970458dee218764ed3acb3b3560f7b
MD5 35c46be741382648dbc6c7241d1f7148
SHA1 24fea5f70e437ecd40a37035d2e1ca3df293d0db
SHA512 ebbacc846af47d3e955a43291626470c73296c874b7d80f0021ec577922f29f453ab5794925b6372b8a75b732677d7c27c16c1f8728ee60a57c66dc4a6c4d86e
TLSH
T139C09B4247054635D1C007D5A154341B02C5CD775031707DF75139C9FD4D48784F6735
MD5 SHA1 SHA512 TLSH

$TEMP/MSCOMCTL.OCX

IMPHASH 50ccb1d881ea89a41a10cced45c79649
SHA256 3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
MD5 12c2755d14b2e51a4bb5cbdfc22ecb11
SHA1 33f0f5962dbe0e518fe101fa985158d760f01df1
SHA512 4c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf
SSDEEP 24576:2EIDiOd04txdEa1C42Xp1C33wQjrDRjE4FSpUBqutFPJq6:2vtxdEas42ijRprBzR7
TLSH
T1B9352A1277E58022D0FB2670197B27B59BB67EA16C39E54F1B50360E2D32E82DE35327
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2d:27:68:6f:14:8e:dc:1d:6e:89:fd:5e:ac:54:67:dd

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US

Chains

Jan 1, 0001

Subject

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Serial Number

03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10

Issuer

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Timespan

Apr 9, 1996 - Jan 7, 2004

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Serial Number

13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Timespan

May 12, 1997 - Dec 31, 1999

Subject

OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet

Serial Number

bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Timespan

May 12, 1997 - Dec 31, 1999

Subject

CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US

Serial Number

55:0d:88:f5:3f:64:16:d7:0c:73:00:d8:45:92:16:34

Issuer

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Timespan

Mar 19, 1999 - Apr 16, 2000

Minor OS version

0

Major OS version

4

Entry point

80520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CreateThread LocalReAlloc GetProfileIntA RtlMoveMemory LocalSize FreeResource GetCurrentProcessId MulDiv GetTickCount MapViewOfFile CreateFileMappingA UnmapViewOfFile GlobalReAlloc IsBadReadPtr Sleep WaitForSingleObject GlobalHandle GetThreadLocale LocalFree LocalAlloc GlobalAddAtomA SetFilePointer SetStdHandle FlushFileBuffers VirtualAlloc WriteFile VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetOEMCP GetACP GetCPInfo GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue GetCurrentProcess TerminateProcess ExitProcess RtlUnwind GetCommandLineA CompareStringW GlobalSize CreateFileA GetFileSize GlobalUnlock GlobalLock ReadFile CloseHandle GlobalFree IsDBCSLeadByte GetModuleHandleA FindResourceA LoadResource LockResource GetLastError GetFileAttributesA GetVersion DisableThreadLibraryCalls GetProcAddress GetLocaleInfoA LoadLibraryA GetWindowsDirectoryA lstrcatA GetModuleFileNameA IsBadWritePtr lstrcmpiA GetLocalTime GetTimeFormatA GetDateFormatA lstrcmpA GlobalAlloc GetVersionExA GetCurrentThreadId MultiByteToWideChar CompareStringA lstrcpyA InterlockedExchange lstrlenA GetSystemDefaultLCID lstrcpynA HeapAlloc DeleteCriticalSection FreeLibrary HeapFree WideCharToMultiByte lstrlenW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetProcessHeap InterlockedIncrement InterlockedDecrement HeapReAlloc

user32

DrawFocusRect AdjustWindowRect DrawFrameControl TrackPopupMenu GetMessageA AdjustWindowRectEx CopyRect GetKeyNameTextA ShowCaret SetCaretPos GrayStringA HideCaret DestroyCaret CreateCaret SetWindowTextA SetScrollInfo DrawTextExA InvertRect SetRectEmpty GetShellWindow SetKeyboardState GetKeyboardState GetScrollInfo GetKeyboardLayout DestroyCursor GetUpdateRgn GetUpdateRect GetWindowRgn ValidateRect CallMsgFilterA LockWindowUpdate IsZoomed GetDesktopWindow GetIconInfo GetCursor GetForegroundWindow InvalidateRgn EndDeferWindowPos EnumChildWindows GetDoubleClickTime FindWindowA GetMessageTime GetWindowThreadProcessId RemovePropA SendNotifyMessageA SetScrollPos SetScrollRange GetWindowTextLengthA EnableScrollBar ChildWindowFromPoint GetDlgItemInt EndDialog GetActiveWindow GetWindow GetPropA GetCursorPos WindowFromPoint GetClassNameA GetDlgCtrlID IsWindow SetPropA IsWindowEnabled IsWindowVisible UnregisterClassA CharNextA MessageBoxA SetActiveWindow CheckRadioButton SetFocus IsDlgButtonChecked SetDlgItemTextA SetDlgItemInt CheckDlgButton GetDlgItem GetDCEx DrawIconEx CreateIconIndirect SystemParametersInfoA IsIconic GetWindowPlacement GetClipboardFormatNameA SetCursorPos RegisterClipboardFormatA MessageBeep RegisterWindowMessageA PeekMessageA PostMessageW PeekMessageW VkKeyScanA SetParent CharUpperA GetDlgItemTextA SetCursor CreateDialogIndirectParamA GetNextDlgTabItem IsDialogMessageA ScrollWindowEx SendDlgItemMessageA SetWindowRgn IntersectRect EqualRect MoveWindow BeginPaint EndPaint DeferWindowPos BeginDeferWindowPos CharNextExA SetTimer KillTimer DrawIcon DestroyIcon MapWindowPoints CreatePopupMenu AppendMenuA TrackPopupMenuEx DestroyMenu WinHelpA PtInRect DefWindowProcA GetWindowDC SetRect LoadCursorA IsRectEmpty ClientToScreen GetWindowRect MapVirtualKeyA DestroyWindow CreateWindowExA GetSysColorBrush GetAsyncKeyState EnableWindow PostMessageA TranslateMessage DispatchMessageA wsprintfA DialogBoxParamA UpdateWindow GetWindowLongA SetWindowLongA GetDC ReleaseDC GetParent OffsetRect UnionRect GetFocus IsChild CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetMessagePos ScreenToClient SetWindowPos SetCapture GetWindowTextA WindowFromDC GetClientRect CallWindowProcA DrawEdge GetSysColor FrameRect InflateRect FillRect DrawTextA GetKeyState GetCapture ReleaseCapture GetClassInfoA RegisterClassA InvalidateRect LoadIconA GetSystemMetrics CopyImage SendMessageA LoadStringA RedrawWindow ShowWindow CreateAcceleratorTableA

ole32

ReleaseStgMedium DoDragDrop RegisterDragDrop RevokeDragDrop CreateStreamOnHGlobal OleLoadFromStream OleSaveToStream CreateOleAdviseHolder CoTaskMemAlloc CoTaskMemFree CoCreateInstance

advapi32

RegDeleteKeyA RegOpenKeyA RegQueryValueA RegQueryValueExA RegEnumKeyExA RegCreateKeyA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey RegDeleteValueA

oleaut32

SafeArrayRedim SafeArrayPutElement SafeArrayGetElement SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData GetErrorInfo OleCreateFontIndirect OleCreatePropertyFrame LoadTypeLibEx UnRegisterTypeLi RegisterTypeLi CreateErrorInfo SetErrorInfo LoadRegTypeLi LoadTypeLi VariantChangeTypeEx SysStringByteLen SysAllocStringByteLen OleLoadPicture SysAllocStringLen VariantCopy OleTranslateColor VariantChangeType OleCreatePictureIndirect VariantCopyInd SysStringLen SysFreeString VariantInit VariantClear SysAllocString SafeArrayCopy

comdlg32

GetOpenFileNameA

gdi32

Arc GetTextExtentPointA GetCharWidthA OffsetWindowOrgEx ExtTextOutW GetTextExtentPointW Polyline GetTextAlign SetTextAlign OffsetRgn GetTextColor CombineRgn GetTextMetricsA MoveToEx LineTo Ellipse DeleteObject SelectObject CreateSolidBrush SetViewportOrgEx SetWindowOrgEx SetViewportExtEx SetWindowExtEx SetMapMode GetDeviceCaps CreateFontIndirectA GetObjectA SelectClipRgn ExcludeClipRect RectVisible GetClipBox IntersectClipRect GetClipRgn CreateRectRgnIndirect RealizePalette SelectPalette PatBlt CreateCompatibleBitmap CreateBitmap CreateCompatibleDC GetTextExtentPoint32A TextOutA SetBkColor SetTextColor SetBkMode Rectangle CreatePen GetStockObject GetViewportExtEx GetWindowExtEx LPtoDP DeleteDC CreateDCA CreateRectRgn StretchBlt CreateICA CopyMetaFileA CopyEnhMetaFileA GetPaletteEntries GetDIBits CreateDIBitmap GetBitmapBits CreatePalette GetNearestColor CreatePatternBrush CreateDIBSection CreateHalftonePalette BitBlt SetDIBColorTable GetDIBColorTable GetPixel StretchDIBits SetBrushOrgEx GetBkColor ExtTextOutA RestoreDC SaveDC CreateFontA

$TEMP/MSINET.OCX

IMPHASH 96286284ff8e040938ba779778d1542e
SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
MD5 7bec181a21753498b6bd001c42a42722
SHA1 3249f233657dc66632c0539c47895bfcee5770cc
SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
TLSH
T1E3B33802B7E2417FF7A627346AF65BA95EF77D153C26984F9300328D5A32B40DA24327
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2f:46:b1:b6:11:28:7d:70:73:30:59:e1:8c:1f:eb:8a

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

4860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

wininet

FtpSetCurrentDirectoryA FtpCreateDirectoryA InternetCrackUrlA InternetSetOptionA InternetCreateUrlA InternetSetStatusCallback InternetOpenA InternetGetLastResponseInfoA InternetCloseHandle InternetFindNextFileA FtpDeleteFileA FtpGetFileA FtpPutFileA FtpRenameFileA InternetReadFile InternetConnectA FtpGetCurrentDirectoryA FtpRemoveDirectoryA FtpFindFirstFileA HttpQueryInfoA HttpOpenRequestA HttpSendRequestA InternetOpenUrlA

kernel32

LeaveCriticalSection DeleteCriticalSection FreeLibrary HeapFree WideCharToMultiByte lstrlenW HeapAlloc InitializeCriticalSection EnterCriticalSection GetProcessHeap CloseHandle LocalFree FormatMessageA SetEvent CreateEventA GetLastError MultiByteToWideChar lstrcatA lstrcpyA lstrlenA ResetEvent SetLastError lstrcpynA WaitForSingleObject WaitForMultipleObjects GetTickCount IsBadWritePtr DisableThreadLibraryCalls GetVersion GetFileAttributesA GetModuleFileNameA GetWindowsDirectoryA LoadLibraryA GetLocaleInfoA GetProcAddress InterlockedIncrement InterlockedDecrement HeapReAlloc lstrcmpiA LockResource LoadResource FindResourceA lstrcmpA

user32

SetDlgItemInt SendDlgItemMessageA GetMessageA PostQuitMessage GetDlgItemInt GetDlgItemTextA SendMessageA ReleaseDC GetDC CharNextA SetDlgItemTextA SetWindowPos SetWindowLongA SetParent EndPaint GetClientRect BeginPaint GetWindowLongA SetFocus MoveWindow GetWindow GetActiveWindow GetWindowRect IsWindowVisible TranslateMessage OffsetRect EqualRect IntersectRect DispatchMessageA GetWindowThreadProcessId PtInRect WinHelpA IsDialogMessageA GetNextDlgTabItem IsWindowEnabled GetDlgItem IsChild GetKeyState CreateDialogIndirectParamA MessageBoxA MessageBeep SetTimer PeekMessageA MsgWaitForMultipleObjects PostMessageA GetParent ClientToScreen CreateWindowExA EndDialog LoadIconA DrawEdge DrawIcon LoadCursorA RegisterClassA DestroyIcon KillTimer DestroyWindow GetSystemMetrics LoadStringA wsprintfA DialogBoxParamA SetWindowRgn ShowWindow DefWindowProcA PostThreadMessageA UnregisterClassA

ole32

CoUninitialize CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CreateOleAdviseHolder

advapi32

RegEnumKeyExA RegQueryValueExA RegQueryValueA RegDeleteValueA RegDeleteKeyA RegOpenKeyA RegCloseKey RegOpenKeyExA RegCreateKeyExA RegSetValueExA

oleaut32

OleCreatePropertyFrame RegisterTypeLi LoadTypeLi UnRegisterTypeLi LoadTypeLibEx SafeArrayCreate SetErrorInfo CreateErrorInfo GetErrorInfo LoadRegTypeLi SysStringLen SysAllocStringLen SysFreeString VariantInit VariantClear VariantChangeType SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetDim SafeArrayRedim SafeArrayDestroy VariantChangeTypeEx SysAllocString

gdi32

GetWindowExtEx SetViewportOrgEx LPtoDP DeleteDC SetWindowExtEx SetMapMode SetViewportExtEx GetViewportExtEx SetWindowOrgEx CreateDCA GetDeviceCaps CreateRectRgnIndirect

$TEMP/MSWINSCK.OCX

IMPHASH cb0275eec9ac31b6d4d44320e576fadb
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
TLSH
T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

69:2a:36:1f:e3:5a:77:be:50:6d:5c:24:76:db:24:df

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

4932

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

wsock32

accept listen inet_ntoa recv WSAGetLastError WSASetLastError select __WSAFDIsSet shutdown ntohs sendto recvfrom connect getsockopt setsockopt getsockname getpeername closesocket WSACancelAsyncRequest gethostbyaddr bind WSAAsyncSelect socket WSAStartup WSACleanup inet_addr WSAAsyncGetHostByName WSAAsyncGetHostByAddr gethostbyname htons gethostname ioctlsocket send

kernel32

lstrlenW GetFileAttributesA GetModuleFileNameA InitializeCriticalSection HeapFree HeapAlloc GetProcessHeap lstrcpynA lstrcpyA lstrlenA lstrcatA IsBadWritePtr WideCharToMultiByte GetVersion LeaveCriticalSection GetCurrentThreadId EnterCriticalSection LocalFree FormatMessageA GetTickCount MultiByteToWideChar SetLastError GetProcAddress GetLocaleInfoA DeleteCriticalSection FreeLibrary DisableThreadLibraryCalls lstrcmpA InterlockedDecrement GetWindowsDirectoryA LoadLibraryA HeapReAlloc InterlockedIncrement lstrcmpiA GetLastError LockResource LoadResource FindResourceA

user32

EndDialog DialogBoxParamA GetActiveWindow MessageBoxA DrawEdge GetDC CharNextA LoadCursorA wsprintfA GetWindowRect SetWindowPos ShowWindow IsDialogMessageA GetWindow GetNextDlgTabItem IsWindowEnabled GetDlgItem IsChild GetKeyState SetParent WinHelpA IsWindowVisible EndPaint GetClientRect BeginPaint SendDlgItemMessageA LoadStringA ClientToScreen OffsetRect EqualRect IntersectRect SetWindowRgn PtInRect MessageBeep LoadBitmapA GetSystemMetrics GetParent CreateDialogIndirectParamA GetDlgItemTextA SetDlgItemInt SendMessageA DefWindowProcA GetWindowLongA DestroyWindow KillTimer SetTimer UnregisterClassA RegisterClassA PeekMessageA PostMessageA SetDlgItemTextA SetFocus GetDlgItemInt MoveWindow SetWindowLongA CreateWindowExA ReleaseDC

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CreateOleAdviseHolder

advapi32

RegDeleteValueA RegQueryValueA RegOpenKeyA RegQueryValueExA RegEnumKeyExA RegDeleteKeyA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey

oleaut32

SysAllocString VariantChangeType SysAllocStringLen SysStringLen SafeArrayRedim RegisterTypeLi LoadTypeLi UnRegisterTypeLi LoadTypeLibEx OleCreatePropertyFrame LoadRegTypeLi SafeArrayDestroy SafeArrayUnaccessData SetErrorInfo CreateErrorInfo GetErrorInfo SysFreeString SysAllocStringByteLen SafeArrayCreate VariantClear SafeArrayGetUBound SafeArrayGetLBound SysStringByteLen SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim VariantInit

gdi32

GetDeviceCaps CreateCompatibleDC CreateRectRgnIndirect GetWindowExtEx GetViewportExtEx DeleteDC DeleteObject GetObjectA LPtoDP SetMapMode SetViewportExtEx SetWindowExtEx SetViewportOrgEx SetWindowOrgEx CreateDCA BitBlt SelectObject

$TEMP/ODKOB32.DLL

IMPHASH 4dbc86f1a708ba6684fae7efa63a5bf2
SHA256 c4b58c78dc14e247ba303f630e42e9e56667dafef7aba1f0fdfd058b658f0a36
MD5 94f66cd6a18efdb663a61f2025ab31c5
SHA1 527afb33ff31f5ad1e60225081db34ad5083454b
SHA512 e4c14a7db92c9c7b10950ee52f34be73138ced3873962dc5a875949c533d187dc2251b0d37e6f855d54018b8662b63a611b1f0a71fb5c4744444dbf86492ed1e
SSDEEP 384:Hn4REhgb62Uw18UctNhOO6VXe2SPo2gLF5WaC+GN:H4R8k62YUe5wSz26V
TLSH
T1FD72399997D60EE3D4F62A3840F7BB276A36BB7807D1E5E38353546A18722D06839342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/P001.nbd-SR

SHA256 3e8554436a52336c84117905b7b2383fe1aef01d613440d4cea70f035aaee28b
MD5 307f2e464cf4e0bb93fbf82037102e14
SHA1 b35f620a6dd2d0b5d04d669d4e2bb65c9c41363e
SHA512 d03df59f9ebd5040ec5f6fbd5c1e426d8f4881d61ac0e98423c26d39a56b170da6a3cde6bd231209739c9a89224220514371bab2ebc38f8d9e6d86c4a76721b8
TLSH
T105D0A7930B10539C56C404F18210331318E1C8032C9E402E7BC368DBFC1C50785A4750
MD5 SHA1 SHA512 TLSH

$TEMP/RACREG32.DLL

IMPHASH 23e6208bc8769fcfbe7438438446d2fc
SHA256 054fbd3c3a31cea5c69c78c1455d19d2f3486e07428ea951f107d5dac3e58d25
MD5 4e86f6e372d5f823e457ee5358b46079
SHA1 75bf76ac7de2a577532965c121aa0478076eace0
SHA512 73b55608c748479ddd4cbdb2046488972bc2e9340e8c6fe6cf9d0d9badb344de9f5e7ed66f508c47db402d9479066d7f0f4644ba6551cec6318a5a5a468e5087
SSDEEP 384:IGgp/5m0wfOnnW8if3M7LXN5GeqfnWQ0TgEjb1qi:IGxfOnnSILXNdcClqi
TLSH
T132E2B616F3CAD1A6E11E03794EBAC2E557707C105E139B0F3145B3AD2D76E6758A8B03
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Reg.nbd

SHA256 03b3858e5766b07b919d176b541a105faf76e1a28ba01e3593cc319ad87dc3b6
MD5 7c70fdb75615a12b46140d8e708b7fa6
SHA1 d2b5fe00939a1a53e249b7892b1d7d18f66adf45
SHA512 632568205be861f532da9bac3f423306f44ab6b8874c1a8dd5872534afbb809081c861bff6fe041a2d7296a627f7a988059989dc58f0ba3b4162439525695b3d
TLSH
T17FD072E2000648CE2809CC32605FF7A338EA2C689802928B8900CEA584DCBA41A1F5AA
MD5 SHA1 SHA512 TLSH

$TEMP/Regicon.ocx

IMPHASH 5f912ec5bcd0130e5b96a6b3b06a3dd7
SHA256 07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
MD5 32ff40a65ab92beb59102b5eaa083907
SHA1 af2824feb55fb10ec14ebd604809a0d424d49442
SHA512 2cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43
SSDEEP 1536:5rPNWKPzHUIZurPA28AxaVgEbk2NRi6cVbAYAS9jbbx2+cW8vYvYBgbN:5LNWKPzUI8B+Iz758vCgYN
TLSH
T17973C602B3D7812FE69D0BB8097796AD08647D921FB0D1AF2791FA8C1A36D859D3071F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Runtimes/MSAGENT.EXE

IMPHASH b83464d8132ecd9f810820e192566e15
SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
MD5 66996a076065ebdcdac85ff9637ceae0
SHA1 4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce
SHA512 e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c
SSDEEP 6144:SFfDAEl3mNlHuHgUaJG6KPHdQM6FoVsmzY4fPLrKHo1Aa1PyhPpcgiMg7:qUNlOAUao6edbs9eY4H3KHo1AaNy9pL2
TLSH
T12284F12393E08237F1E61B301AF14A532B74BDA56FB5DB8F5290804D1A73AD89A35377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

24:f9:37:59:02:7a:04:26:a3:37:a4:06:44:e7:d6:e5

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

5

Entry point

10019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA FreeSid RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

lstrcatA GetFileAttributesA GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA GetCurrentProcess lstrlenA lstrcmpiA lstrcpyA GetModuleFileNameA FreeLibrary LocalAlloc GetLastError GetSystemDirectoryA LoadLibraryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA _lclose _llseek _lopen GetWindowsDirectoryA GetProcAddress RemoveDirectoryA GlobalUnlock GlobalLock GlobalAlloc ExitProcess GetModuleHandleA GetStartupInfoA CloseHandle LoadResource FindResourceA CreateMutexA SetEvent CreateEventA SetCurrentDirectoryA CreateThread ResetEvent TerminateThread GetVersionExA LocalFree GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA FreeResource LockResource SizeofResource CreateFileA ReadFile WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetTempFileNameA GetSystemInfo GetDiskFreeSpaceA GetDriveTypeA lstrcpynA GetVolumeInformationA GetCurrentDirectoryA LoadLibraryExA GetCommandLineA CreateDirectoryA GlobalFree FormatMessageA IsDBCSLeadByte

gdi32

GetDeviceCaps

user32

EndDialog wsprintfA ExitWindowsEx CharNextA CharUpperA GetDesktopWindow SetWindowLongA GetWindowLongA CallWindowProcA GetDlgItem SetForegroundWindow SetWindowTextA SendDlgItemMessageA EnableWindow GetDlgItemTextA SendMessageA DispatchMessageA LoadStringA PeekMessageA MessageBoxA CharPrevA SetWindowPos ReleaseDC GetDC GetWindowRect ShowWindow DialogBoxIndirectParamA SetDlgItemTextA MessageBeep MsgWaitForMultipleObjects

comctl32

ord17

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

$TEMP/Runtimes/tv_enua.exe

IMPHASH b83464d8132ecd9f810820e192566e15
SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
MD5 3f8f18c9c732151dcdd8e1d8fe655896
SHA1 222cc49201aa06313d4d35a62c5d494af49d1a56
SHA512 398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7
SSDEEP 24576:+RuPGuSU5BiPic3l2iMVCKctDVq0HtPxZj+ihApGm7+MXnrejxAr:LH5Byd2PAd3q0HHZqJpFqMXn1
TLSH
T1B425236297EAC27BE1B277310EF641679A35BC962DF5E3DE4240901D0C22FA5187932F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b6:7c:27:bd:49:ea:8b:ad:45:c1:1e:be:0b:6d:ef:e6

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

5

Entry point

10019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA FreeSid RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

lstrcatA GetFileAttributesA GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA GetCurrentProcess lstrlenA lstrcmpiA lstrcpyA GetModuleFileNameA FreeLibrary LocalAlloc GetLastError GetSystemDirectoryA LoadLibraryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA _lclose _llseek _lopen GetWindowsDirectoryA GetProcAddress RemoveDirectoryA GlobalUnlock GlobalLock GlobalAlloc ExitProcess GetModuleHandleA GetStartupInfoA CloseHandle LoadResource FindResourceA CreateMutexA SetEvent CreateEventA SetCurrentDirectoryA CreateThread ResetEvent TerminateThread GetVersionExA LocalFree GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA FreeResource LockResource SizeofResource CreateFileA ReadFile WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetTempFileNameA GetSystemInfo GetDiskFreeSpaceA GetDriveTypeA lstrcpynA GetVolumeInformationA GetCurrentDirectoryA LoadLibraryExA GetCommandLineA CreateDirectoryA GlobalFree FormatMessageA IsDBCSLeadByte

gdi32

GetDeviceCaps

user32

EndDialog wsprintfA ExitWindowsEx CharNextA CharUpperA GetDesktopWindow SetWindowLongA GetWindowLongA CallWindowProcA GetDlgItem SetForegroundWindow SetWindowTextA SendDlgItemMessageA EnableWindow GetDlgItemTextA SendMessageA DispatchMessageA LoadStringA PeekMessageA MessageBoxA CharPrevA SetWindowPos ReleaseDC GetDC GetWindowRect ShowWindow DialogBoxIndirectParamA SetDlgItemTextA MessageBeep MsgWaitForMultipleObjects

comctl32

ord17

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

$TEMP/SSCALA32.OCX

IMPHASH 011d127b237b8a8364c6bea71f85b1f3
SHA256 8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
MD5 ce9216b52ded7e6fc63a50584b55a9b3
SHA1 27bb8882b228725e2a3793b4b4da3e154d6bb2ea
SHA512 444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7
SSDEEP 6144:H1v56AP7u/5b6HMpJVAtdP3IfZETrOn4jgO7jUvyDl2rwV2iM6QVS4AmuRkXc7k3:VvZ8YGZEeKUYlm827aREc7k3
TLSH
T1AEA47D13B8C0C56BCDB60630CE4F67B5F6FA96204E321E436354C7BC6B72F62961562A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bf:60:9b:b0:6e:e0:31:50:f8:d2:e2:46:ca:9d:30:4b

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

275417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord4249 ord2486 ord3260 ord4472 ord5498 ord2982 ord3147 ord4006 ord2687 ord3259 ord3136 ord3278 ord2985 ord3081 ord2976 ord3353 ord3830 ord3831 ord3825 ord4465 ord3079 ord4622 ord4424 ord3681 ord446 ord743 ord1177 ord6467 ord1226 ord1210 ord1168 ord2439 ord1693 ord5618 ord994 ord4342 ord4687 ord4639 ord5674 ord2156 ord4080 ord4920 ord6002 ord4856 ord1963 ord5213 ord2953 ord3868 ord5150 ord4705 ord4707 ord2876 ord2998 ord5649 ord4113 ord4768 ord4548 ord4521 ord4594 ord4988 ord4925 ord4930 ord4935 ord4659 ord4909 ord4908 ord4668 ord4667 ord4666 ord4648 ord4689 ord5023 ord4654 ord4643 ord4354 ord4780 ord4649 ord5060 ord4371 ord4356 ord4409 ord4415 ord2137 ord3404 ord4949 ord2954 ord6055 ord4078 ord2488 ord4407 ord5241 ord2384 ord5163 ord6370 ord4353 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord2983 ord3148 ord4466 ord2986 ord3080 ord4081 ord4624 ord5825 ord672 ord723 ord3946 ord362 ord423 ord5290 ord3571 ord3573 ord3693 ord3626 ord3663 ord4123 ord640 ord5785 ord1640 ord323 ord5647 ord2414 ord4133 ord4297 ord5788 ord1641 ord6605 ord5335 ord5334 ord5332 ord5325 ord5328 ord5340 ord2541 ord4651 ord4735 ord5058 ord4740 ord5059 ord4390 ord2729 ord5008 ord1146 ord1892 ord4252 ord6364 ord3326 ord6365 ord1212 ord4570 ord4672 ord4224 ord5011 ord5265 ord1776 ord6042 ord4998 ord2514 ord6052 ord1775 ord2385 ord6371 ord5286 ord4438 ord3279 ord5986 ord1877 ord449 ord746 ord6453 ord3460 ord2818 ord6374 ord3262 ord4627 ord3610 ord536 ord539 ord939 ord2763 ord926 ord940 ord941 ord4129 ord6662 ord4204 ord3402 ord656 ord567 ord4299 ord4275 ord815 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord4079 ord4698 ord5307 ord5289 ord5714 ord3401 ord3670 ord561 ord3952 ord2724 ord6354 ord1216 ord4637 ord4361 ord4741 ord6004 ord1567 ord5329 ord268 ord5314 ord5917 ord4760 ord4765 ord4756 ord4694 ord5148 ord5606 ord3986 ord500 ord2859 ord5333 ord3742 ord818 ord2112 ord5768 ord3711 ord783 ord2730 ord470 ord2152 ord1799 ord614 ord2623 ord2640 ord290 ord4226 ord6041 ord772 ord5860 ord6142 ord4003 ord5316 ord698 ord396 ord3437 ord911 ord4187 ord5630 ord5592 ord6166 ord3804 ord4019 ord1605 ord5710 ord2794 ord6262 ord4160 ord6261 ord2393 ord5233 ord5269 ord5280 ord3597 ord324 ord641 ord4234 ord4710 ord5802 ord1609 ord6273 ord4203 ord4903 ord6197 ord6380 ord2405 ord5983 ord5312 ord1896 ord2801 ord2700 ord2689 ord2705 ord2712 ord274 ord275 ord499 ord770 ord3760 ord5454 ord495 ord750 ord603 ord273 ord458 ord956 ord2165 ord2164 ord2158 ord5781 ord3706 ord353 ord4379 ord4459 ord1614 ord4992 ord4979 ord4603 ord5339 ord2727 ord858 ord537 ord3457 ord1601 ord540 ord3003 ord6030 ord825 ord823 ord3057 ord5574 ord3212 ord6281 ord2901 ord535 ord859 ord800 ord2379 ord4584 ord3119 ord4636 ord3206 ord5959 ord5868 ord3203 ord5984 ord4277 ord3230 ord4278 ord923 ord922 ord6199 ord3945 ord3204 ord1606 ord2915 ord2868 ord4083 ord1233 ord5572 ord924 ord6098 ord3874 ord1187 ord3139 ord3532 ord4982 ord5856 ord861 ord1685 ord5861 ord6883 ord5858 ord6040 ord860 ord1686 ord3820 ord475 ord6084 ord3502 ord758 ord2150 ord4202 ord3237 ord2614 ord4625 ord2764 ord4425 ord6819 ord2860 ord4025 ord2795 ord4480 ord4788 ord4660 ord5888 ord4661 ord4743 ord4650 ord4018 ord3199 ord3021 ord5573 ord4996 ord2864 ord5979 ord4376 ord5981 ord4853 ord4843 ord755 ord342 ord1131 ord1132 ord1116 ord1176 ord1575 ord1577 ord1182 ord269 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826

msvcrt

_initterm atol wcslen _strupr __CxxFrameHandler _EH_prolog _mbscmp _ftol strlen _mbsicmp atoi _itoa memset memcpy modf abs memcmp isdigit _purecall _ltoa _stat memmove __dllonexit _onexit _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ free malloc _adjust_fdiv

kernel32

LocalUnlock LocalFree LocalLock WinExec Sleep lstrlenW GetTempPathA GetTempFileNameA InterlockedExchange _llseek GlobalFree _hread lstrcpynA OpenFile GlobalSize _hwrite MulDiv _lclose lstrcatA LoadLibraryA InterlockedIncrement TlsGetValue TlsSetValue GetDateFormatA GetVersion GetLocalTime GetCurrentThreadId MultiByteToWideChar lstrcmpiA lstrlenA DeleteCriticalSection InitializeCriticalSection TlsFree lstrcpyA WideCharToMultiByte TlsAlloc GlobalLock GlobalUnlock GlobalAlloc GetSystemTime GetUserDefaultLCID IsDBCSLeadByte GetTickCount EnterCriticalSection GetLocaleInfoA LeaveCriticalSection LocalAlloc

user32

PostMessageA IsWindow PtInRect SendMessageA OffsetRect InvalidateRect UpdateWindow SetWindowPos SetWindowTextA ShowWindow IntersectRect GetCapture LoadStringA UnhookWindowsHookEx UnhookWindowsHook SetWindowsHookExA SetWindowsHookA GetDlgItem EnumWindows UnregisterClassA GetClientRect SetScrollPos SetScrollRange GetScrollPos DestroyCursor GetCursorPos ReleaseCapture SetCapture DrawFocusRect FrameRect EnableScrollBar GrayStringA IsRectEmpty SetRectEmpty GetDC ReleaseDC GetSysColor RemovePropA SetCursor RegisterWindowMessageA GetWindowRect HideCaret DispatchMessageA TranslateMessage PeekMessageA FillRect SetWindowLongA GetWindowTextLengthA DrawIcon CopyIcon GetWindowThreadProcessId LoadCursorA ShowCaret GetScrollRange SetRect GetForegroundWindow SetForegroundWindow GetWindowLongA GetPropA SetPropA KillTimer SetTimer MoveWindow CallNextHookEx GetWindow GetFocus GetParent GetClassInfoA OpenClipboard ScreenToClient EqualRect CopyRect GetSystemMetrics InflateRect LoadBitmapA EnableWindow MessageBeep wsprintfA GetKeyboardLayout RegisterClassA ClientToScreen GetKeyState SetClipboardData EmptyClipboard CloseClipboard

gdi32

GetTextMetricsA CreateCompatibleDC DeleteObject BitBlt CreateRectRgn CreatePen SelectClipRgn GetDeviceCaps GetOutlineTextMetricsA CreateSolidBrush SetTextColor SetBkMode GetTextExtentPoint32A GetCharWidthA GetCurrentPositionEx DeleteDC MoveToEx SetTextAlign TextOutA SetBkColor GetObjectA GetStockObject RealizePalette SelectPalette GetNearestColor CreateCompatibleBitmap CreateICA LineTo CreateBitmap CreateDCA GetPaletteEntries SelectObject GetTextColor CreateRectRgnIndirect CreatePalette CopyMetaFileA CreateDIBitmap GetDIBits GetSystemPaletteEntries StretchDIBits StretchBlt CreateFontIndirectA

advapi32

RegCloseKey RegCreateKeyA RegOpenKeyA RegQueryValueA RegSetValueA RegDeleteKeyA RegEnumKeyA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitialize StringFromGUID2 IIDFromString StgCreateDocfileOnILockBytes GetHGlobalFromILockBytes CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes GetHGlobalFromStream CreateStreamOnHGlobal CoCreateInstance CoGetMalloc

olepro32

ord251 ord252 ord253 ord254

oleaut32

VarBstrFromDate VarUdateFromDate VarDateFromStr LoadRegTypeLi VariantChangeType SysFreeString VariantCopy SysAllocString VariantInit VariantClear SafeArrayCopy SafeArrayPutElement SafeArrayCreate SafeArrayRedim SafeArrayGetElement SafeArrayGetUBound SafeArrayDestroy SysStringByteLen SystemTimeToVariantTime SysStringLen SysReAllocString SafeArrayGetLBound VarDateFromUdate

$TEMP/SSCALB32.OCX

IMPHASH e290d9c299fd60eb2519acf65ca53fae
SHA256 5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
MD5 97ffaf46f04982c4bdb8464397ba2a23
SHA1 f32e89d9651fd6e3af4844fd7616a7f263dc5510
SHA512 8c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002
SSDEEP 6144:ZD3OD+b26Wcix8swZOsfi8h72gYYXWQ+8MIdQpE:ZDeqb2Px8swss68h72gFWyum
TLSH
T1EF643A01F1415D27EDA70BB1486EE799B6683E211F2064D7A3C8ED7C1FB25F2AA1170B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3b:da:4a:21:5f:b2:2b:9c:3c:59:69:6c:91:a0:03:ff

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

218359

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord5023 ord4689 ord4666 ord4654 ord4354 ord4780 ord4371 ord4643 ord4356 ord4741 ord4409 ord4415 ord4979 ord2488 ord3404 ord2954 ord6055 ord4739 ord4078 ord4407 ord5241 ord2384 ord5163 ord6370 ord4353 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord1776 ord5277 ord3148 ord4466 ord2986 ord3080 ord4081 ord4624 ord5825 ord783 ord672 ord656 ord723 ord1206 ord3946 ord362 ord800 ord540 ord423 ord2414 ord825 ord535 ord860 ord323 ord823 ord4025 ord6281 ord1601 ord861 ord537 ord5334 ord5328 ord5332 ord5340 ord4018 ord2541 ord5325 ord1605 ord4949 ord5981 ord2983 ord5769 ord2795 ord2112 ord4459 ord640 ord2450 ord1640 ord3003 ord4603 ord4636 ord4992 ord1168 ord2859 ord3206 ord5917 ord5290 ord4735 ord4740 ord5573 ord4738 ord3693 ord3626 ord3663 ord5888 ord858 ord5979 ord4760 ord3573 ord1641 ord2860 ord3571 ord4756 ord3706 ord4765 ord4637 ord4361 ord3237 ord4650 ord2405 ord5785 ord5574 ord3057 ord4743 ord4996 ord5572 ord4649 ord2915 ord4019 ord4480 ord2056 ord4770 ord4771 ord4914 ord4915 ord4651 ord5033 ord1606 ord2729 ord2727 ord2730 ord5329 ord5008 ord4299 ord2379 ord2385 ord6374 ord3262 ord3402 ord4627 ord3610 ord567 ord3711 ord6375 ord4486 ord2554 ord2512 ord743 ord446 ord1089 ord5148 ord4668 ord3346 ord5300 ord5302 ord4079 ord4698 ord5307 ord5289 ord5714 ord3401 ord3670 ord4908 ord4667 ord3952 ord561 ord6354 ord1216 ord3945 ord1892 ord4252 ord6364 ord3326 ord6365 ord1212 ord4570 ord4672 ord4843 ord5011 ord5265 ord4376 ord4853 ord4998 ord2514 ord6052 ord1775 ord6371 ord5286 ord4438 ord3279 ord4625 ord4425 ord449 ord746 ord6453 ord2868 ord3460 ord2764 ord5875 ord924 ord4133 ord4297 ord5788 ord3199 ord5647 ord5787 ord472 ord922 ord4129 ord5683 ord4277 ord2763 ord939 ord940 ord926 ord4278 ord4224 ord3204 ord3457 ord2614 ord6379 ord6197 ord6380 ord6199 ord2089 ord6605 ord1233 ord4275 ord2152 ord3874 ord6042 ord3742 ord818 ord500 ord772 ord6142 ord5860 ord755 ord470 ord1799 ord614 ord2623 ord290 ord4226 ord5606 ord6041 ord1223 ord2794 ord6262 ord599 ord4160 ord5710 ord941 ord6261 ord2393 ord268 ord1567 ord1243 ord4204 ord4203 ord3139 ord4903 ord536 ord5314 ord5335 ord539 ord1609 ord6273 ord4083 ord1896 ord2801 ord2700 ord2689 ord2705 ord2712 ord274 ord5983 ord275 ord770 ord499 ord3760 ord5454 ord495 ord750 ord603 ord273 ord458 ord5312 ord5233 ord5269 ord5280 ord3597 ord641 ord324 ord4234 ord4710 ord5802 ord956 ord2165 ord2164 ord2158 ord5781 ord353 ord6166 ord3119 ord5959 ord3203 ord5984 ord3212 ord5986 ord3230 ord3681 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord3353 ord2976 ord3081 ord2985 ord3278 ord3136 ord4465 ord3259 ord3147 ord2982 ord5498 ord4472 ord2687 ord2486 ord4249 ord4006 ord4935 ord4909 ord4659 ord4988 ord4930 ord4925 ord4548 ord4594 ord4521 ord4661 ord4768 ord4660 ord2998 ord4113 ord5649 ord4705 ord2876 ord4707 ord2953 ord5150 ord3868 ord2137 ord5213 ord1963 ord4856 ord6002 ord4920 ord4639 ord2156 ord5674 ord994 ord4687 ord4342 ord2439 ord5618 ord1693 ord6467 ord1210 ord1226 ord815 ord1177 ord2724 ord3532 ord1187 ord6098 ord1685 ord4982 ord1614 ord3820 ord475 ord6084 ord6030 ord758 ord2150 ord1877 ord3502 ord3260 ord5868 ord5492 ord2901 ord5199 ord3804 ord2396 ord5731 ord3922 ord2864 ord342 ord1131 ord1132 ord1116 ord1176 ord1575 ord1577 ord1182 ord269 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826

msvcrt

free _ltoa ??1type_info@@UAE@XZ wcslen __CxxFrameHandler _purecall _mbsicmp _mbscmp labs abs floor ceil _ftol memcpy strlen memset atoi memcmp _EH_prolog _itoa atol _stat modf memmove __dllonexit _onexit _except_handler3 ?terminate@@YAXXZ _initterm malloc _adjust_fdiv

kernel32

LocalAlloc LocalFree MulDiv LocalUnlock Sleep GetTickCount WinExec GetTempPathA GetTempFileNameA InterlockedExchange _llseek GlobalAlloc _hread lstrcpynA OpenFile GlobalSize _hwrite _lclose GlobalLock GlobalFree InterlockedIncrement GlobalUnlock lstrcmpiA GetSystemTime lstrcatA lstrcpyA LoadLibraryA lstrlenA TlsSetValue IsDBCSLeadByte TlsGetValue GetVersion GetUserDefaultLCID GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetLocaleInfoA DeleteCriticalSection InitializeCriticalSection TlsFree EnterCriticalSection LeaveCriticalSection TlsAlloc LocalLock

user32

CreateAcceleratorTableA CharUpperA CharNextA InvalidateRect KillTimer ReleaseCapture SetTimer SetWindowTextA GetDlgItem ShowWindow SetWindowLongA GetWindowTextLengthA SetWindowPos PeekMessageA ReleaseDC VkKeyScanA RemovePropA GetForegroundWindow SetForegroundWindow LoadCursorA GetCursorPos MessageBeep GetPropA SetPropA GetCapture GetClientRect TranslateMessage DispatchMessageA SetCapture ScreenToClient ClientToScreen FrameRect DestroyCursor GetDC GetSysColor GetSystemMetrics CopyRect SetRectEmpty IntersectRect EqualRect PtInRect IsWindow FillRect SetCursor GetWindowLongA RegisterWindowMessageA MoveWindow GetWindowRect SendMessageA PostMessageA DrawIcon UpdateWindow OffsetRect CopyIcon GrayStringA GetWindowThreadProcessId wsprintfA EnumWindows UnhookWindowsHookEx CallNextHookEx SetWindowsHookA EnableWindow EnableScrollBar GetParent IsRectEmpty DrawFocusRect LoadStringA GetKeyState UnhookWindowsHook SetWindowsHookExA ShowScrollBar SetScrollPos MessageBoxA SetScrollRange ValidateRect

gdi32

CreateSolidBrush GetDeviceCaps CreateBitmap CreateCompatibleDC BitBlt LPtoDP CreateDCA RealizePalette SelectPalette GetTextMetricsA CreatePen GetBkColor GetStockObject Rectangle CreateHatchBrush GetTextColor DeleteObject LineTo GetTextExtentPoint32A SetTextColor MoveToEx CreateFontIndirectA GetObjectA DeleteDC CreateICA CreateDIBitmap GetDIBits GetSystemPaletteEntries StretchDIBits GetPaletteEntries SelectClipRgn SetBkMode CreateCompatibleBitmap SetBkColor CreateRectRgn TextOutA CreateRectRgnIndirect CopyMetaFileA StretchBlt SetTextAlign GetCharWidthA GetCurrentPositionEx GetOutlineTextMetricsA SelectObject

advapi32

RegCloseKey RegCreateKeyA RegOpenKeyA RegQueryValueA RegSetValueA RegDeleteKeyA RegEnumKeyA

shell32

ShellExecuteA

ole32

StringFromGUID2 IIDFromString GetHGlobalFromILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes GetHGlobalFromStream CreateStreamOnHGlobal CoGetMalloc

olepro32

ord252 ord253 ord251 ord254

oleaut32

SafeArrayPutElement SysAllocString VariantCopy VariantChangeType VarDateFromStr VarBstrFromDate SysAllocStringLen SysFreeString VariantInit SysStringByteLen LoadRegTypeLi SysReAllocStringLen SafeArrayCreate SystemTimeToVariantTime SysStringLen SysReAllocString VariantClear SafeArrayDestroy SafeArrayCopy SafeArrayGetLBound SafeArrayGetElement

$TEMP/SSubTmr6.dll

IMPHASH 009ca6296770e87a44d039c7eeeec064
SHA256 48bb226b418dae999d66731599996e042c5592d845ea11548a15ccd3a00fb5ab
MD5 1556c5b52a751c31b4ca6fe757704131
SHA1 a04263b37b69a5a53eaccc6d30dda61b2808224a
SHA512 ea306e09834bd08edf8a5930c096eaff4ab6c6a8799f3910ab8ea88a0a25fde45de36887c13d468046e9bb2e1439e7bd34c970e3ef9f71d8e4eeb95b5fd60074
SSDEEP 768:Xr65PC/JXxK5yO2Zw5WdSYEFrAdOnBiyFm:GPC/Jhip2Zw5wSYCEMUR
TLSH
T1DF03B721738AE431E1D906B91D1A93D42665BC211D51AF2BB38FF39F2E35F43E612722
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Snd1.wav

SHA256 11863d5b7fec50e3ca69f74066b68ed389a18b6990394f3ed21d6ea0e67262e5
MD5 7cf6069d29b9a66bf03ba1e554553fe9
SHA1 001de4b7b9082f951e782efb74601d8e0447bee6
SHA512 51414f0165ea67fcd96d0a5b2df1b321882145d3d3dcb146a0d896a3a0c395b2538cb01b7c27ce106acf65480d88bc5d2aba19e9ad03430bd756c5047f33d08d
SSDEEP 768:P0SgkJs9aE1NSGHd5W4AYVNwXLlNpm2y51mZ:PntE7IYVNwXLlNpmD5
TLSH
T195D25C2B2A0B0707E33367B4D87C21126454ACC8D56CEFA17AD34C5ADE0FC6A56F4B99
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Snd2.wav

SHA256 d59c9bc27494b2e68d5efdc1798dc5442f364bef46cfb1fcdf4b3b032358ac26
MD5 bd183af23b343b2789e61f03b536aad0
SHA1 66db4748e6214fdc4642e3f9a6bc4218b24ec5b4
SHA512 ad5191eddb6838ea7b9200bc7a10c06e0a41966ba627a52ccd5a4f1008b1b85edfc63939a264822b7e1e9caf40e3428ddaaaaa80c82bb5066afe802d0dc52211
SSDEEP 768:f9ZOco4aji+8S/y75qNGyFZraqGAJb9m:1/MjiEy7I8OZr7GATm
TLSH
T18603A36F2A1B1707D3326375DC7861024445ACC5D8ACEF91BBC2AE2FC90F85642E1BE9
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/T001.nbd-SR

SHA256 2f3d5ac26d4345be684f81cae8aa51f116334394680e9e6ac6a6ec49f58f3bac
MD5 877bd06f8b02ff562dd476306d8bb8a9
SHA1 ae4198c145e9d69e122f3a387519194d4280a089
SHA512 e8fa96008c4aaca4c4251bfb310c14a4501aa59b02827e68e91013f4089bd7e20a498923046bc4469985703c94b3c116da890270f0a806431601db605a840fc4
TLSH
T199E08C1317640AFEA58009CA8108762759F3C9BB1C1C608EBB6504EBF41E1866438772
MD5 SHA1 SHA512 TLSH

$TEMP/empop3.dll

IMPHASH 2b3636c08cbe20673ddf7fedb481a7c0
SHA256 f198ec842cf9b9d1e9e3f4bb6864fae7eea98d6919e0c6609e139e00c262d6bc
MD5 a0fdd2077934c34f08d48aa214da2c4e
SHA1 9b9593ef99515aac8665c6da73deb871815d73e9
SHA512 2bef50a54f8c06821e31771bac566992f7a8872709b8a993322a43750f19ccad773dd9fd88f87d819d317845ccfe1b66087c2b2bda094b3382e6054ccce2f62a
SSDEEP 3072:6eH6h4ZLkOO0qn4fZD82yuGqeWaZnYq2+DrDJxZbcG0Z3bp:s2yuGqeWaZnYq2er7lFKp
TLSH
T1E8E35A0273D0C075E2E9453D1E23B736EBBB59788E6605075F6817BD2FB2E90AE17206
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

86525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateDirectoryA GetTickCount GetTempPathA IsBadReadPtr WaitForSingleObject SetLastError FindFirstFileA SetEvent GetTempFileNameA CreateEventA CreateFileMappingA GetVersionExA InitializeCriticalSection DeleteCriticalSection lstrlenA GetShortPathNameA MapViewOfFile GetModuleFileNameA SizeofResource LoadResource FindResourceA LoadLibraryExA lstrcmpiA DisableThreadLibraryCalls ReadFile HeapDestroy GetProcAddress LoadLibraryA lstrcpyA lstrcatA IsBadWritePtr HeapFree HeapAlloc HeapCreate Sleep FlushViewOfFile UnmapViewOfFile EnterCriticalSection LeaveCriticalSection lstrlenW DeleteFileA RemoveDirectoryA InterlockedDecrement InterlockedIncrement CreateFileA SetFilePointer SetEndOfFile WriteFile CloseHandle MultiByteToWideChar FindClose GetFileSize lstrcpynA WinExec IsDBCSLeadByte GetModuleHandleA FreeLibrary CopyFileA WideCharToMultiByte GetLastError

user32

CreateWindowExA wsprintfA DispatchMessageA TranslateMessage PeekMessageA DestroyCursor EndPaint ScreenToClient GetClientRect BeginPaint SetCursor LoadCursorA SetClassLongA EndDialog PtInRect IsWindow GetDesktopWindow GetWindowRect GetDlgItem GetCursorPos DialogBoxParamA GetActiveWindow SetWindowLongA DestroyWindow DefWindowProcA GetWindowLongA SendMessageA CharNextA UnregisterClassA RegisterClassExA

gdi32

TextOutA SetBkMode SetTextColor CreateFontA DeleteObject SelectObject GetStockObject

advapi32

RegCloseKey RegQueryValueExA RegSetValueExA RegQueryValueA GetUserNameA RegOpenKeyExA DeregisterEventSource ReportEventA RegisterEventSourceA LookupAccountNameA RegCreateKeyA RegDeleteKeyA RegCreateKeyExA RegDeleteValueA RegEnumKeyExA RegQueryInfoKeyA RegEnumValueA

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateFreeThreadedMarshaler

oleaut32

VariantInit LoadTypeLi LoadRegTypeLi VariantCopy VariantClear SysAllocString SysFreeString SysStringLen SysAllocStringLen RegisterTypeLi VarUI4FromStr

wsock32

WSAAsyncSelect connect WSASetLastError shutdown inet_ntoa WSAAsyncGetHostByName WSAStartup WSAGetLastError setsockopt htons ioctlsocket send recv closesocket socket WSACancelAsyncRequest

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

msvcrt

?terminate@@YAXXZ srand memset strchr memcpy isalpha _strset strstr strtok atoi strcpy _beginthread memcmp strrchr _purecall ??2@YAPAXI@Z strcat strlen _wcsicmp _EH_prolog __CxxFrameHandler wcslen _strdate _CxxThrowException sprintf wcsstr _assert atol _itoa rand _stricmp _adjust_fdiv _initterm ??1type_info@@UAE@XZ time strncpy free wcschr _except_handler3 malloc memmove _strtime toupper realloc _strnicmp

$TEMP/emsmtp.dll

IMPHASH 9f8c724314a584c503a9b1a0fad089f8
SHA256 743857c8be216893265c231ad45f4ffd3babb67c024ef8ceb5a698e292464263
MD5 365920b74d38322571e16f66686ef56b
SHA1 d4a112bcc048526d1e6b7a6841c059c63d23d4f6
SHA512 f13a913e09b467a929fb25da3fce4c9eded9571c2f43d6a9365de4e86f4183434d643c32f35e5ee4b8d7798b5aa24beaf3898d61e92daa4df35f0a31ea338164
SSDEEP 3072:cx57Ipkh2yuGqeWa6oat9Ts9zAEzmTzFJSB0EKqTu:tg2yuGqeWa6Z9TsdGyB0ZQ
TLSH
T160C34B02F7D1C0B5F186023C490B2776ABBBAE345E551947ABA027DC3F71F51BE1622A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

70453

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenW lstrlenA GetShortPathNameA InterlockedDecrement GetModuleHandleA WideCharToMultiByte SizeofResource LoadResource FindResourceA GetLastError LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte HeapDestroy lstrcpyA lstrcatA GetSystemTime InterlockedIncrement GetTimeZoneInformation GetFileSize RemoveDirectoryA DeleteFileA ReadFile SetFilePointer GetLocalTime EnterCriticalSection HeapFree HeapAlloc HeapCreate IsBadReadPtr Sleep GetTickCount FileTimeToSystemTime SystemTimeToFileTime CompareFileTime GetSystemTimeAsFileTime LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection GetVersionExA DisableThreadLibraryCalls GetModuleFileNameA WaitForSingleObject MultiByteToWideChar CreateEventA LoadLibraryA GetProcAddress FreeLibrary CreateFileA WriteFile SetEvent LocalFree CloseHandle

user32

RegisterClassExA CreateWindowExA DispatchMessageA TranslateMessage MsgWaitForMultipleObjects PeekMessageA wsprintfA UnregisterClassA DestroyWindow CharNextA SendMessageA LoadStringA GetDesktopWindow SetWindowLongA DefWindowProcA GetWindowLongA

gdi32

GetStockObject

advapi32

RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyA RegDeleteKeyA RegCreateKeyExA RegDeleteValueA RegEnumKeyExA RegCloseKey RegEnumValueA RegQueryValueExA DeregisterEventSource ReportEventA RegisterEventSourceA LookupAccountNameA GetUserNameA

ole32

ProgIDFromCLSID CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

SysFreeString CreateErrorInfo SetErrorInfo VariantCopy VariantInit VariantClear SysAllocStringLen SysStringLen LoadRegTypeLi RegisterTypeLi LoadTypeLi SysAllocString VarUI4FromStr GetErrorInfo

wsock32

WSAStartup send WSASetLastError inet_ntoa socket shutdown closesocket WSACleanup htons WSAAsyncGetHostByName WSACancelAsyncRequest WSAGetLastError gethostbyname ioctlsocket setsockopt connect recv WSAAsyncSelect

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

msvcrt

_except_handler3 strcmp memmove wcslen strrchr _strnicmp srand rand _itoa realloc malloc free _purecall strcpy ??1type_info@@UAE@XZ atoi _CxxThrowException _stricmp _stat _strset _splitpath _endthread strncmp strchr strncpy memcpy memset memcmp ??3@YAXPAX@Z _strtime _strdate toupper isalpha ??2@YAPAXI@Z _ltoa strncat _adjust_fdiv _initterm ?terminate@@YAXXZ strcat _EH_prolog __CxxFrameHandler _beginthread strlen strtok strstr abs

$TEMP/favicon.ico

SHA256 d5343ff39d29ecd9b60fd31cc60321b2d4a36001d5d1ee24f6c766b10eef0095
MD5 e1a53bb79bcf97ae324b05552c1b3ca9
SHA1 5ee16e7d9fb3473df37f1c318881a59b1bf2d9ef
SHA512 1c8ac8b9a9e8e063f572c41ce9a7aac91dcf956763859716fa68247c3774cca00bf5aebd5dae3dfe6c0ef1a961cf640f7ad3c68965ec9d8b5e0d610b77c29c80
TLSH
T1EF712834B913B989C4566F3856E7CE860A60AEF4F28130634AC8887B8C5C202FF1B235
MD5 SHA1 SHA512 TLSH

$TEMP/j001.nbd

SHA256 e312728e0491e1a15405566c8f591cf3ca6128ca17e5e022a7550494a600ad27
MD5 98c9159b828cbcd8f13a0491218bf537
SHA1 6b9a736cb7840300e56acd2cbc635d5e451a68ff
SHA512 9d07bdd0b7fbc3e23c6940c72e5e151271c61b703f0f6d858e81887fd4819f9574e4bc078bef8e2c3c9c661793884f98cc6305556f34d0092c6ce7c657aa16f8
SSDEEP 192:nnW1LaScTPa+SUYPh0fAosSQEmJ3yptPouBHHdam4Gzy56l7pL:W1LRcTPawDA9MmJ8tPo8n7zDlx
TLSH
T1D1229F8105FC8F05694FD85D605A4E0C360E9FB4C9DE29E2BA165BE7C31EF13852765C
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/j2.nbd

SHA256 c032c71a49e0cb05072602c99251e6b1d76ca2db57120fc402b93d3392df7c3c
MD5 788b0ec30cc5fae75d2a6ee0a3ef10fa
SHA1 a879dc350bbe79dc2cae04ee804fd6ee9a1f8e1b
SHA512 df5e1097db5326c168b0c840b2d598f82caab5138d30f899233a777e7164b8178e4ba9934eb0c32029533b6ee5f72c07fa279fcd93f8e11d4108485724abac1b
SSDEEP 768:cm+rR22Cxd9eCFkw5KvaaBIlZZuQVZPym/F5V43uffAGBLXVCCQDtWIcjQ:cmv/9eLOKvaanQVZPPF52efLDk
TLSH
T1D313BF4141FD890183EFD60DB11C0E8FBD1B6C7815EA65DAB812678EDB3BF40D8E6A54
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/j2.nbd-SR

SHA256 1837a9f0653a4093e448de37fdbf2bb0e4c3e98abb1414b8e60793a2863208a9
MD5 6f8c402777457a1cc7b7ca6f7a7657de
SHA1 b05c00f28f9185ffd43c9ee479976382c64adbfe
SHA512 777d34f5e4e24c4f053050a99e00c6a7065bb89690c542362eadce7552c71005b6a7de0fdb20eeacece70610c900a1d51b6485332971d598e6c0dc475b228bda
TLSH
T12911449303890BBEF59E0ED2C85B255320F4D452BD155288ABB3AAEB7C3F8C95430A34
MD5 SHA1 SHA512 TLSH

$TEMP/j3.nbd

SHA256 197cd5e9b3bdec70314d3b3e5ddb5ee41578907a8a50d9ad2fc3683ff271656f
MD5 0b9550caef707aebf17f4c17a7e0f424
SHA1 06d91cae8ea9324f76b7828d2d2e9455ba2c6c7b
SHA512 d1cfda4b4d82a7cb0571e4c70dc5b8f4b2b19406364568a45e18dd68dfeeb1f37f4237b43448b0d1d12cfd388f54bd2d5f9390510593173c0dbcfddafcf18735
SSDEEP 1536:K6h3swrT9IiFyM0kQkjLlY2V1KBMlubUpkjQmwyFRx:Bhtrht/0LyLOUaUyHpx
TLSH
T1F423BE4040FC841143DBEA0EB12C1C4BBE114CBD69AA36DAF99653CBDB5FFA4E461B46
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/j3.nbd-SR

SHA256 2a9cbdbd1459111eac43d2d505e7828108c68cc5042c97b4e93d235962f8ad59
MD5 4c273ee71a2d85203ca95387fa78a315
SHA1 195a066b030685b1fb8b5e594f6a77889a1ff3ab
SHA512 6e833e069f410d73976c97031b61949cfc31e81df7363e724090f13a5a2306496a1a15aa3ee01fa1cff43cf91d37d191c84be293ebf6ae7c1c5c3b55cee06724
TLSH
T13C11264613852A7CF5CD0FC9988F242621F1C6167D680558AFF31AEBBC3B9C05430676
MD5 SHA1 SHA512 TLSH

$TEMP/msvbvm60.dll

IMPHASH ce5958d8adf86078d58c0c6f95621ee9
SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
MD5 5343a19c618bc515ceb1695586c6c137
SHA1 4dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA512 708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
SSDEEP 24576:LlDYRayxYMsEVcQtFyBw2fO+wgw7HsltDngDG+QryQF63xxWPByACxlQ6kMX1Kse:BOayxtXyrgs3DngDyyQFwxxWPcxlQ3cf
TLSH
T14655BF1373D5AC73CBA721380A2A2375F6B4AF245A34ED8B13A4356F2937741532B726
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

GetTimeZoneInformation CreateThread ExitThread FlushFileBuffers CreateDirectoryA RemoveDirectoryA MoveFileA LockFile UnlockFile TerminateProcess SetEnvironmentVariableA GetCPInfo GetACP GetOEMCP SetHandleCount GetStdHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetStdHandle GetStringTypeW RaiseException LCMapStringW GetStringTypeA GetModuleFileNameW GetUserDefaultLangID GetComputerNameA SetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime SetFileTime GetLocalTime SetLocalTime RtlUnwind OpenFile CreateProcessW IsValidCodePage FormatMessageW GetStartupInfoA UnhandledExceptionFilter ExitProcess SetCurrentDirectoryA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindNextFileA FindClose VirtualFree GetSystemInfo VirtualAlloc VirtualProtect FlushInstructionCache FindResourceExA GetShortPathNameA WinExec lstrlenW lstrcpyW WriteFile SetEndOfFile SetFilePointer GetSystemTime SystemTimeToFileTime WaitForMultipleObjects ReleaseMutex CreateMutexA GetCurrentProcess DuplicateHandle ResumeThread GetCommandLineA TlsSetValue TlsFree TlsAlloc GetVersion CompareStringW lstrcmpiW MulDiv CreateProcessA GetExitCodeProcess LoadLibraryExA WaitForSingleObject ResetEvent SetEvent CreateEventA GetTickCount GetEnvironmentVariableA FreeResource GetSystemDefaultLCID GetPrivateProfileIntA IsBadCodePtr GetUserDefaultLCID GetSystemDirectoryA LoadLibraryA GetProcAddress Sleep GlobalDeleteAtom HeapDestroy SetErrorMode GlobalAddAtomA ReleaseSemaphore LCMapStringA CreateSemaphoreA VirtualQuery GetCurrentProcessId MultiByteToWideChar GetProfileStringA WideCharToMultiByte HeapReAlloc GetDriveTypeA CompareStringA GetFileAttributesA GetCurrentDirectoryA GetModuleFileNameA SetLastError GetFullPathNameA SearchPathA GetFileType GlobalUnlock GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc GlobalLock _lwrite _lread LockResource GetTempPathA GetTempFileNameA lstrcpynA _lclose _llseek FreeLibrary GetLocaleInfoA lstrcmpiA GetLastError GetModuleHandleA GetSystemDefaultLangID FormatMessageA HeapCreate GetWindowsDirectoryA GetPrivateProfileStringA lstrcatA CreateFileA ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement IsDBCSLeadByte IsBadReadPtr TlsGetValue lstrcpyA DeleteFileA lstrcmpA GetCurrentThreadId GetVersionExA HeapAlloc HeapFree HeapSize lstrlenA

user32

DdeClientTransaction DdeAbandonTransaction DdeGetData DdeGetLastError DdeCreateDataHandle DdeCmpStringHandles SetCursorPos EnumClipboardFormats DestroyCursor GetAsyncKeyState WaitForInputIdle GetForegroundWindow VkKeyScanW SetWindowsHookExW keybd_event CharUpperBuffW CharUpperBuffA CharLowerBuffW FindWindowW FindWindowA SetActiveWindow GetClassInfoExA LoadIconA LoadImageA RegisterClassExA FrameRect CreateDialogParamA IsDialogMessageA EnableMenuItem ShowCursor OemToCharA CharToOemBuffA GetWindowTextA EndDialog DrawTextA SendDlgItemMessageA SetDlgItemTextA GetWindowPlacement GetSystemMetrics LoadBitmapA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects WaitMessage PostQuitMessage UnhookWindowsHookEx RegisterClipboardFormatA CreateCursor CreateIcon PostMessageW PeekMessageW EnumWindows EnumChildWindows GetPropA RemovePropA SetPropA SetForegroundWindow ClipCursor CallWindowProcA DefFrameProcA GetKeyState GetDlgItem IsWindow UnregisterClassA RegisterClassA AdjustWindowRect GetTabbedTextExtentA TabbedTextOutA FillRect CharToOemA MessageBoxA wsprintfA WinHelpA GetDesktopWindow SetRect GetWindowDC DestroyIcon GetClassInfoA AdjustWindowRectEx GetMenuItemCount RemoveMenu GetMenuStringA GetMenuState DdePostAdvise GetCaretPos CharPrevA CharNextA GetUpdateRgn GetUpdateRect PtInRect ChildWindowFromPointEx ReleaseCapture SetCapture InflateRect GetWindowRect ClientToScreen MoveWindow IsWindowEnabled IsChild SetParent IsIconic IsZoomed DefMDIChildProcA MessageBeep PeekMessageA PostMessageA LoadStringA AppendMenuA DestroyMenu CreatePopupMenu GetMessageTime GetMessagePos DrawFocusRect CopyAcceleratorTableA GetWindowRgn CharUpperA TranslateMDISysAccel SubtractRect IsRectEmpty InvalidateRgn InvalidateRect CopyRect GetDCEx IntersectRect LoadAcceleratorsA BringWindowToTop GetWindowThreadProcessId AttachThreadInput EqualRect EnableWindow SetFocus SendMessageA SetWindowsHookExA GetClassNameA LoadCursorA SetCursor SetWindowLongA GetWindow GetFocus GetKeyboardLayout GetSystemMenu CallNextHookEx GetParent DestroyWindow SetWindowTextA SetWindowPos UpdateWindow CreateWindowExA SystemParametersInfoA GetCapture WindowFromPoint ScreenToClient SetTimer IsWindowVisible ShowWindow KillTimer GetDC ReleaseDC MapWindowPoints GetCursorPos GetCursor OffsetRect GetIconInfo DefWindowProcA BeginPaint GetClientRect EndPaint GetSysColor GetActiveWindow GetWindowLongA DdeDisconnect DdeConnect DdeSetUserHandle DdeNameService DdeCreateStringHandleA DdeUninitialize DdeInitializeA DdeFreeStringHandle DdeQueryConvInfo DdeQueryStringA DdeFreeDataHandle SetScrollRange SetScrollPos DrawFrameControl LockWindowUpdate CharLowerBuffA IsClipboardFormatAvailable SetClipboardData GetClipboardData OpenClipboard EmptyClipboard CloseClipboard GetCaretBlinkTime SetCaretPos GetWindowTextLengthA CreateCaret ShowCaret HideCaret DestroyCaret GetScrollPos GetClipboardFormatNameA DrawTextExA SetWindowRgn ToAscii CreateAcceleratorTableA DestroyAcceleratorTable ShowScrollBar GetScrollInfo GetLastActivePopup GetMenuItemInfoA SetMenuItemInfoA SetKeyboardState GetKeyboardState GetQueueStatus GetDoubleClickTime SetWindowContextHelpId TrackPopupMenu SetMenuDefaultItem DrawMenuBar DeleteMenu InsertMenuA GetSubMenu GetMenuItemID GetMenu SetMenu CreateMenu ModifyMenuA CheckMenuItem BeginDeferWindowPos EndDeferWindowPos DeferWindowPos PostThreadMessageA VkKeyScanA CharLowerA DrawIcon MessageBoxIndirectA DialogBoxParamA IsCharAlphaA EnumThreadWindows SetScrollInfo

gdi32

RestoreDC RealizePalette SetROP2 SaveDC GetClipBox SetWindowOrgEx ExcludeClipRect CreateHalftonePalette GetTextMetricsA PatBlt EnumFontsA TranslateCharsetInfo GetROP2 SetBrushOrgEx GetDeviceCaps GetObjectType CreatePenIndirect CreateBrushIndirect Rectangle GetStockObject Arc LineTo MoveToEx Pie Ellipse SetStretchBltMode GetPixel GetTextExtentPoint32A SetPixelV StretchDIBits GetCurrentObject TextOutA GetBkColor StretchBlt CreateDIBitmap CloseMetaFile SetWindowExtEx CreateMetaFileA EndDoc AbortDoc StartPage CreateCompatibleBitmap StartDocA CreateDCA ResetDCA Escape ScaleViewportExtEx SetViewportExtEx SetMapMode DeleteMetaFile PlayMetaFile SetAbortProc DeleteEnhMetaFile PlayEnhMetaFile CreateICA GetEnhMetaFileHeader ScaleWindowExtEx GetWindowOrgEx GetPaletteEntries CreateDIBSection CloseEnhMetaFile CreateEnhMetaFileA LPtoDP EqualRgn ExtCreateRegion GetDIBits SetTextAlign GetWindowExtEx GetViewportExtEx CopyMetaFileA CopyEnhMetaFileA PathToRegion EndPath BeginPath WidenPath GetTextColor GetMapMode SetDIBColorTable RoundRect CreateEllipticRgnIndirect CreateRoundRectRgn GetSystemPaletteEntries GetNearestColor CreateCompatibleDC SetViewportOrgEx BitBlt DeleteDC IntersectClipRect OffsetWindowOrgEx SelectClipRgn SelectPalette CreatePalette PtInRegion OffsetRgn ExtSelectClipRgn CreateRectRgnIndirect CreateRectRgn SetRectRgn CombineRgn CreateFontIndirectA GetTextExtentPointA GetObjectA GetBitmapBits SetBkMode SelectObject ExtTextOutA CreateBitmap CreatePatternBrush SetTextColor SetBkColor CreatePen CreateHatchBrush UnrealizeObject CreateSolidBrush EndPage DeleteObject

advapi32

RegQueryInfoKeyA RegCreateKeyW RegQueryValueExW RegEnumValueA RegEnumValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegOpenKeyW RegSetValueExW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA ReportEventA DeregisterEventSource RegisterEventSourceA RegDeleteValueA RegSetValueA RegCreateKeyA RegSetValueExA RegEnumKeyA RegDeleteKeyA RegQueryValueA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA

ole32

CoTaskMemAlloc CoTaskMemFree BindMoniker RegisterDragDrop RevokeDragDrop DoDragDrop CreateILockBytesOnHGlobal OleFlushClipboard OleIsCurrentClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator CreateDataAdviseHolder CreateOleAdviseHolder CoRegisterClassObject CoRevokeClassObject CLSIDFromString OleDoAutoConvert OleRegGetUserType OleSaveToStream ReadClassStg ReadClassStm OleConvertIStorageToOLESTREAM OleConvertOLESTREAMToIStorage StgIsStorageILockBytes StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleCreateFromData OleCreateLinkFromData OleGetIconOfClass OleGetClipboard OleSetClipboard OleCreateLink OleCreateLinkToFile OleGetAutoConvert OleCreateFromFile CoMarshalInterface CoUnmarshalInterface CreateStreamOnHGlobal StringFromCLSID StringFromGUID2 CLSIDFromProgID ProgIDFromCLSID CoGetClassObject CoCreateInstance MkParseDisplayName CoIsOle1Class OleQueryLinkFromData OleQueryCreateFromData GetClassFile CreateBindCtx OleDuplicateData ReleaseStgMedium OleSetMenuDescriptor CoRegisterMessageFilter OleUninitialize OleInitialize CoGetMalloc OleRegGetMiscStatus CoCreateGuid IIDFromString CoFreeUnusedLibraries CoDisconnectObject IsAccelerator OleIsRunning OleRun OleLockRunning StgCreateDocfile WriteClassStg OleSave StgOpenStorage OleLoad CoLockObjectExternal

oleaut32

OleTranslateColor OleCreatePropertyFrame VariantInit VariantClear SysAllocString SysFreeString OleCreateFontIndirect OleCreatePictureIndirect SysAllocStringByteLen OaBuildVersion SysAllocStringLen VariantChangeType SetErrorInfo CreateErrorInfo GetErrorInfo DispGetParam LoadTypeLi SysStringByteLen LoadRegTypeLi RegisterTypeLi LoadTypeLibEx UnRegisterTypeLi LHashValOfNameSys SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate OleLoadPicture SafeArrayDestroy VariantCopy VariantCopyInd SafeArrayDestroyData VariantChangeTypeEx CreateDispTypeInfo DispGetIDsOfNames DispInvoke SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement SafeArrayPutElement SafeArrayRedim SafeArrayCopy OleIconToCursor RevokeActiveObject SafeArrayAllocDescriptor SafeArrayDestroyDescriptor SafeArrayAllocData SafeArrayLock SafeArrayUnlock VarDateFromStr SysReAllocStringLen GetActiveObject VarR8FromStr VarCyFromI4 VarBstrFromI2 VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarBstrFromDate VarBstrFromCy VarI2FromStr VarI4FromStr VarI4FromR8 VarR4FromStr VarCyFromStr SysReAllocString LHashValOfNameSysA SysStringLen

BASIC_CLASS_AddRef BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke BASIC_CLASS_QueryInterface BASIC_CLASS_Release BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo CopyRecord CreateIExprSrvObj DLLGetDocumentation DllCanUnloadNow DllFunctionCall DllGetClassObject DllRegisterServer DllUnregisterServer EVENT_SINK2_AddRef EVENT_SINK2_Release EVENT_SINK_AddRef EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke EVENT_SINK_QueryInterface EVENT_SINK_Release EbCreateContext EbDestroyContext EbGetErrorInfo EbGetHandleOfExecutingProject EbGetObjConnectionCounts EbGetVBAObject EbIsProjectOnStack EbLibraryLoad EbLibraryUnload EbLoadRunTime EbResetProject EbResetProjectNormal EbSetContextWorkerThread GetMem1 GetMem2 GetMem4 GetMem8 GetMemEvent GetMemNewObj GetMemObj GetMemStr GetMemVar IID_IVbaHost MethCallEngine ProcCallEngine PutMem1 PutMem2 PutMem4 PutMem8 PutMemEvent PutMemNewObj PutMemObj PutMemStr PutMemVar SetMemEvent SetMemNewObj SetMemObj SetMemVar ThunRTMain TipCreateInstanceEx TipCreateInstanceProject2 TipGetAddressOfPredeclaredInstance TipInvokeMethod TipInvokeMethod2 TipSetOption TipUnloadInstance TipUnloadProject UserDllMain VBDllCanUnloadNow VBDllGetClassObject VBDllRegisterServer VBDllUnRegisterServer VarPtr Zombie_AddRef Zombie_GetIDsOfNames Zombie_GetTypeInfo Zombie_GetTypeInfoCount Zombie_Invoke Zombie_QueryInterface Zombie_Release _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct __vbaAryConstruct2 __vbaAryCopy __vbaAryDestruct __vbaAryLock __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaAryVarVarg __vbaBoolErrVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs __vbaCyAdd __vbaCyErrVar __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 __vbaCyI4 __vbaCyInt __vbaCyMul __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt __vbaFailedFriend __vbaFileClose __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeObjList __vbaFreeStr __vbaFreeStrList __vbaFreeVar __vbaFreeVarList __vbaFreeVarg __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Abs __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2I4 __vbaI2Sgn __vbaI2Str __vbaI2Var __vbaI4Abs __vbaI4Cy __vbaI4ErrVar __vbaI4ForNextCheck __vbaI4Sgn __vbaI4Str __vbaI4Var __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew __vbaNew2 __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRedimVar2 __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCopy __vbaStrCy __vbaStrDate __vbaStrErrVarCopy __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike __vbaStrMove __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy __vbaUI1ErrVar __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarCopy __vbaVarDateVar __vbaVarDiv __vbaVarDup __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMove __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarVargNofree __vbaVarXor __vbaVarZero __vbaVargObj __vbaVargObjAddref __vbaVargParmRef __vbaVargUnk __vbaVargUnkAddref __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef __vbaVerifyVarObj __vbaWriteFile _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul rtBoolFromErrVar rtBstrFromErrVar rtCyFromErrVar rtDecFromVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtUI1FromErrVar rtcAbsVar rtcAnsiValueBstr rtcAppActivate rtcAppleScript rtcArray rtcAtn rtcBeep rtcBstrFromAnsi rtcBstrFromByte rtcBstrFromChar rtcBstrFromError rtcBstrFromFormatVar rtcByteValueBstr rtcCVErrFromVar rtcCallByName rtcChangeDir rtcChangeDrive rtcCharValueBstr rtcChoose rtcCommandBstr rtcCommandVar rtcCompareBstr rtcCos rtcCreateObject rtcCreateObject2 rtcCurrentDir rtcCurrentDirBstr rtcDDB rtcDateAdd rtcDateDiff rtcDateFromVar rtcDatePart rtcDeleteSetting rtcDir rtcDoEvents rtcEndOfFile rtcEnvironBstr rtcEnvironVar rtcErrObj rtcExp rtcFV rtcFileAttributes rtcFileCopy rtcFileDateTime rtcFileLen rtcFileLength rtcFileLocation rtcFileReset rtcFileSeek rtcFileWidth rtcFilter rtcFixVar rtcFormatCurrency rtcFormatDateTime rtcFormatNumber rtcFormatPercent rtcFreeFile rtcGetAllSettings rtcGetCurrentCalendar rtcGetDateBstr rtcGetDateValue rtcGetDateVar rtcGetDayOfMonth rtcGetDayOfWeek rtcGetErl rtcGetFileAttr rtcGetHostLCID rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetObject rtcGetPresentDate rtcGetSecondOfMinute rtcGetSetting rtcGetTimeBstr rtcGetTimeValue rtcGetTimeVar rtcGetTimer rtcGetYear rtcHexBstrFromVar rtcHexVarFromVar rtcIMEStatus rtcIPMT rtcIRR rtcImmediateIf rtcInStr rtcInStrChar rtcInStrRev rtcInputBox rtcInputCharCount rtcInputCharCountVar rtcInputCount rtcInputCountVar rtcIntVar rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsMissing rtcIsNull rtcIsNumeric rtcIsObject rtcJoin rtcKillFiles rtcLeftBstr rtcLeftCharBstr rtcLeftCharVar rtcLeftTrimBstr rtcLeftTrimVar rtcLeftVar rtcLenCharVar rtcLenVar rtcLog rtcLowerCaseBstr rtcLowerCaseVar rtcMIRR rtcMacId rtcMakeDir rtcMidBstr rtcMidCharBstr rtcMidCharVar rtcMidVar rtcMonthName rtcMsgBox rtcNPV rtcNPer rtcOctBstrFromVar rtcOctVarFromVar rtcPMT rtcPPMT rtcPV rtcPackDate rtcPackTime rtcPartition rtcQBColor rtcR8ValFromBstr rtcRandomNext rtcRandomize rtcRate rtcRemoveDir rtcReplace rtcRgb rtcRightBstr rtcRightCharBstr rtcRightCharVar rtcRightTrimBstr rtcRightTrimVar rtcRightVar rtcRound rtcSLN rtcSYD rtcSaveSetting rtcSendKeys rtcSetCurrentCalendar rtcSetDateBstr rtcSetDateVar rtcSetFileAttr rtcSetTimeBstr rtcSetTimeVar rtcSgnVar rtcShell rtcSin rtcSpaceBstr rtcSpaceVar rtcSplit rtcSqr rtcStrConvVar rtcStrConvVar2 rtcStrFromVar rtcStrReverse rtcStringBstr rtcStringVar rtcSwitch rtcTan rtcTrimBstr rtcTrimVar rtcTypeName rtcUpperCaseBstr rtcUpperCaseVar rtcVarBstrFromAnsi rtcVarBstrFromByte rtcVarBstrFromChar rtcVarDateFromVar rtcVarFromError rtcVarFromFormatVar rtcVarFromVar rtcVarStrFromVar rtcVarType rtcWeekdayName

$TEMP/msvcrt.dll

IMPHASH 179b04fb57bf5f17850c94a941db63fa
SHA256 d7cea69a98579d928e534070f5293e80ed7df38baf611b20717ef55aa1344a18
MD5 055b02d711cdedb8c5997274c4e99cb8
SHA1 5c816eeb6e4d5f1c11e9f56c992ee7d452e7c0f9
SHA512 4774431fe768e424f46c833236a41d68f05d98ed14353b04428a5d190dbe213bb56087a5e5cca5cd98598f2c1611fddfed3a7a79bbd362bc02e586cc367907c0
SSDEEP 6144:yk54RkH8RKDou3LlG/3Roe0Ro4zJsdF9gjFMgiFjNr7mcl2oZhogKLOmJxZR92l3:R4RtIR3BG/3We0RVJsdFFUzchogKLOmc
TLSH
T12854BF217F91CDB9E6DB81700D287F2E9BBEB69044B4CC43A7D89F982B316429717127
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

05:45:4e:84:dc:97:47:28:63:04:2e:f3:20:9d:f1:ea

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

7240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

EnumSystemLocalesA RtlUnwind IsBadReadPtr IsBadWritePtr IsBadCodePtr SetUnhandledExceptionFilter GetModuleFileNameA GetModuleFileNameW ExitProcess TerminateProcess GetCurrentProcess WriteFile GetStdHandle GetCommandLineA GetVersionExA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError ResumeThread CreateThread TlsSetValue ExitThread CloseHandle GetCurrentThreadId TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread FindNextFileA FindFirstFileA FindClose FindNextFileW FindFirstFileW HeapFree HeapAlloc GetModuleHandleA GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc SetHandleCount GetFileType GetStartupInfoA GetCPInfo GetACP GetOEMCP GetProcAddress LoadLibraryA MultiByteToWideChar GetCommandLineW FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW UnhandledExceptionFilter GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetConsoleCtrlHandler SetEnvironmentVariableW IsValidLocale IsValidCodePage GetLocaleInfoA RaiseException GetUserDefaultLCID GetLocaleInfoW GetTimeZoneInformation FlushFileBuffers SetFilePointer SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA Sleep Beep FileTimeToSystemTime FileTimeToLocalFileTime GetDiskFreeSpaceA GetLogicalDrives SetErrorMode GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetDriveTypeA GetCurrentProcessId CreateDirectoryA RemoveDirectoryA DeleteFileA GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW SetFileAttributesW GetFullPathNameW CreateDirectoryW DeleteFileW MoveFileW RemoveDirectoryW GetDriveTypeW MoveFileA GetExitCodeProcess WaitForSingleObject FreeLibrary CreateProcessA CreateProcessW HeapValidate HeapCompact HeapWalk HeapSize ReadConsoleA SetConsoleMode GetConsoleMode SetEndOfFile WriteConsoleA DuplicateHandle GetFileInformationByHandle PeekNamedPipe ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents LockFile UnlockFile CreateFileA CreatePipe ReadFile CreateFileW GetSystemTimeAsFileTime SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetLocalTime SetLocalTime

$I10_OUTPUT ??0__non_rtti_object@@QAE@ABV0@@Z ??0__non_rtti_object@@QAE@PBD@Z ??0bad_cast@@QAE@ABQBD@Z ??0bad_cast@@QAE@ABV0@@Z ??0bad_typeid@@QAE@ABV0@@Z ??0bad_typeid@@QAE@PBD@Z ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1__non_rtti_object@@UAE@XZ ??1bad_cast@@UAE@XZ ??1bad_typeid@@UAE@XZ ??1exception@@UAE@XZ ??1type_info@@UAE@XZ ??2@YAPAXI@Z ??3@YAXPAX@Z ??4__non_rtti_object@@QAEAAV0@ABV0@@Z ??4bad_cast@@QAEAAV0@ABV0@@Z ??4bad_typeid@@QAEAAV0@ABV0@@Z ??4exception@@QAEAAV0@ABV0@@Z ??8type_info@@QBEHABV0@@Z ??9type_info@@QBEHABV0@@Z ??_7__non_rtti_object@@6B@ ??_7bad_cast@@6B@ ??_7bad_typeid@@6B@ ??_7exception@@6B@ ??_E__non_rtti_object@@UAEPAXI@Z ??_Ebad_cast@@UAEPAXI@Z ??_Ebad_typeid@@UAEPAXI@Z ??_Eexception@@UAEPAXI@Z ??_G__non_rtti_object@@UAEPAXI@Z ??_Gbad_cast@@UAEPAXI@Z ??_Gbad_typeid@@UAEPAXI@Z ??_Gexception@@UAEPAXI@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?_query_new_handler@@YAP6AHI@ZXZ ?_query_new_mode@@YAHXZ ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ?_set_new_mode@@YAHH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z ?before@type_info@@QBEHABV1@@Z ?name@type_info@@QBEPBDXZ ?raw_name@type_info@@QBEPBDXZ ?set_new_handler@@YAP6AXXZP6AXXZ@Z ?set_terminate@@YAP6AXXZP6AXXZ@Z ?set_unexpected@@YAP6AXXZP6AXXZ@Z ?terminate@@YAXXZ ?unexpected@@YAXXZ ?what@exception@@UBEPBDXZ _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CxxThrowException _EH_prolog _Getdays _Getmonths _Gettnames _HUGE _Strftime _XcptFilter __CxxFrameHandler __CxxLongjmpUnwind __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD __argc __argv __badioinfo __crtCompareStringA __crtGetLocaleInfoW __crtLCMapStringA __dllonexit __doserrno __fpecode __getmainargs __initenv __isascii __iscsym __iscsymf __lc_codepage __lc_collate_cp __lc_handle __lconv_init __mb_cur_max __p___argc __p___argv __p___initenv __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__amblksiz __p__commode __p__daylight __p__dstbias __p__environ __p__fileinfo __p__fmode __p__iob __p__mbcasemap __p__mbctype __p__osver __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__winmajor __p__winminor __p__winver __p__wpgmptr __pioinfo __pxcptinfoptrs __set_app_type __setlc_active __setusermatherr __threadhandle __threadid __toascii __unDName __unDNameEx __unguarded_readlc_active __wargv __wgetmainargs __winitenv _abnormal_termination _access _acmdln _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _adjust_fdiv _aexit_rtn _amsg_exit _assert _atodbl _atoi64 _atoldbl _beep _beginthread _beginthreadex _c_exit _cabs _callnewh _cexit _cgets _chdir _chdrive _chgsign _chkesp _chmod _chsize _clearfp _close _commit _commode _control87 _controlfp _copysign _cprintf _cputs _creat _cscanf _ctime64 _ctype _cwait _daylight _dstbias _dup _dup2 _ecvt _endthread _endthreadex _environ _eof _errno _except_handler2 _except_handler3 _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit _expand _fcloseall _fcvt _fdopen _fgetchar _fgetwchar _filbuf _fileinfo _filelength _filelengthi64 _fileno _findclose _findfirst _findfirst64 _findfirsti64 _findnext _findnext64 _findnexti64 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fputchar _fputwchar _fsopen _fstat _fstat64 _fstati64 _ftime _ftime64 _ftol _fullpath _futime _futime64 _gcvt _get_osfhandle _get_sbh_threshold _getch _getche _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getws _global_unwind2 _gmtime64 _heapadd _heapchk _heapmin _heapset _heapused _heapwalk _hypot _i64toa _i64tow _initterm _inp _inpd _inpw _iob _isatty _isctype _ismbbalnum _ismbbalpha _ismbbgraph _ismbbkalnum _ismbbkana _ismbbkprint _ismbbkpunct _ismbblead _ismbbprint _ismbbpunct _ismbbtrail _ismbcalnum _ismbcalpha _ismbcdigit _ismbcgraph _ismbchira _ismbckata _ismbcl0 _ismbcl1 _ismbcl2 _ismbclegal _ismbclower _ismbcprint _ismbcpunct _ismbcspace _ismbcsymbol _ismbcupper _ismbslead _ismbstrail _isnan _itoa _itow _j0 _j1 _jn _kbhit _lfind _loaddll _local_unwind2 _localtime64 _lock _locking _logb _longjmpex _lrotl _lrotr _lsearch _lseek _lseeki64 _ltoa _ltow _makepath _mbbtombc _mbbtype _mbcasemap _mbccpy _mbcjistojms _mbcjmstojis _mbclen _mbctohira _mbctokata _mbctolower _mbctombb _mbctoupper _mbctype _mbsbtype _mbscat _mbschr _mbscmp _mbscoll _mbscpy _mbscspn _mbsdec _mbsdup _mbsicmp _mbsicoll _mbsinc _mbslen _mbslwr _mbsnbcat _mbsnbcmp _mbsnbcnt _mbsnbcoll _mbsnbcpy _mbsnbicmp _mbsnbicoll _mbsnbset _mbsncat _mbsnccnt _mbsncmp _mbsncoll _mbsncpy _mbsnextc _mbsnicmp _mbsnicoll _mbsninc _mbsnset _mbspbrk _mbsrchr _mbsrev _mbsset _mbsspn _mbsspnp _mbsstr _mbstok _mbstrlen _mbsupr _memccpy _memicmp _mkdir _mktemp _mktime64 _msize _nextafter _onexit _open _open_osfhandle _osplatform _osver _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _purecall _putch _putenv _putw _putws _pwctype _read _rmdir _rmtmp _rotl _rotr _safe_fdiv _safe_fdivr _safe_fprem _safe_fprem1 _scalb _searchenv _seh_longjmp_unwind _set_error_mode _set_sbh_threshold _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snwprintf _sopen _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _stat _stat64 _stati64 _statusfp _strcmpi _strdate _strdup _strerror _stricmp _stricoll _strlwr _strncoll _strnicmp _strnicoll _strnset _strrev _strset _strtime _strupr _swab _sys_errlist _sys_nerr _tell _telli64 _tempnam _time64 _timezone _tolower _toupper _tzname _tzset _ui64toa _ui64tow _ultoa _ultow _umask _ungetch _unlink _unloaddll _unlock _utime _utime64 _vsnprintf _vsnwprintf _waccess _wasctime _wchdir _wchmod _wcmdln _wcreat _wcsdup _wcsicmp _wcsicoll _wcslwr _wcsncoll _wcsnicmp _wcsnicoll _wcsnset _wcsrev _wcsset _wcsupr _wctime _wctime64 _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst _wfindfirst64 _wfindfirsti64 _wfindnext _wfindnext64 _wfindnexti64 _wfopen _wfreopen _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _winmajor _winminor _winver _wmakepath _wmkdir _wmktemp _wopen _wperror _wpgmptr _wpopen _wputenv _wremove _wrename _write _wrmdir _wsearchenv _wsetlocale _wsopen _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wstat _wstat64 _wstati64 _wstrdate _wstrtime _wsystem _wtempnam _wtmpnam _wtoi _wtoi64 _wtol _wunlink _wutime _wutime64 _y0 _y1 _yn abort abs acos asctime asin atan atan2 atexit atof atoi atol bsearch calloc ceil clearerr clock cos cosh ctime difftime div exit exp fabs fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws floor fmod fopen fprintf fputc fputs fputwc fputws fread free freopen frexp fscanf fseek fsetpos ftell fwprintf fwrite fwscanf getc getchar getenv gets getwc getwchar gmtime is_wctype isalnum isalpha iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv localeconv localtime log log10 longjmp malloc mblen mbstowcs mbtowc memchr memcmp memcpy memmove memset mktime modf perror pow printf putc putchar puts putwc putwchar qsort raise rand realloc remove rename rewind scanf setbuf setlocale setvbuf signal sin sinh sprintf sqrt srand sscanf strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtod strtok strtol strtoul strxfrm swprintf swscanf system tan tanh time tmpfile tmpnam tolower toupper towlower towupper ungetc ungetwc vfprintf vfwprintf vprintf vsprintf vswprintf vwprintf wcscat wcschr wcscmp wcscoll wcscpy wcscspn wcsftime wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstod wcstok wcstol wcstombs wcstoul wcsxfrm wctomb wprintf wscanf

$TEMP/p001.nbd

SHA256 6e39e8b14ac5a0dad47279595406a49c61c6748f16f4e69dd48738653e50882f
MD5 89baf0ce132d54517f89e6fdebb6764f
SHA1 41509f6bce097e434651148a36012cd8c66da2d7
SHA512 2b3d3fe6dc4bddc34005cbf461f27e10e7a330aba645dd27ce787bc79ff28e9627abd3adce27bc8741ed160ceda9c22fa0c62d9faa16454d6700437eb72a6e6b
SSDEEP 384:2Pt/eO/RjVAPQjOrjo9VrIxGs6PuobKQG1W1Wy9eNanfJzDxNp:2l/Z/xW3o9VMCJKQx1WyEKhhz
TLSH
T1ECA2CF1A683C730375BDD1D92074E93F2B7F9D92290AAB48BC6490ED45BBF208C28F40
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/s1.nbd

SHA256 abad946feed68057f15569c0df432790b0c19a21149c8f07ecfc99fac2311616
MD5 4e4d3a1400a1d0bcf482fc8da711ccba
SHA1 751769e1582ce3a057ba6fb0270698a2a48d5dae
SHA512 13b04814456172ea858c220c36d0c066286965a2bcd217c0216788e3fb84ecc1c007ed8f44124a368400b858af584a2fff855919cb7bb3fb195da39abb0e675a
SSDEEP 3072:7P0t9Ul1fX5RKr/xooFEZZzpiqHYhT0Jic3IYbMCMW4NktxiR/1jRXvcsaKWN:7PoohGd0Vp/4hT0JH4YAqqRX0saKS
TLSH
T19214D0914E5EF162693D953110D33E1B468A12523CCCA7EF263854626AEFDAF3C0F62D
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/sites.nbd

SHA256 5a8749440d441766dba442097d5956cd7bfc0f3bb1fb46d431df341bba1a2778
MD5 a8e5c2cef7e455ce4f6cdd601ac774bb
SHA1 0ebe0f1ddbdcaee08d4a5505b6f8a329022e554d
SHA512 186a9146263011c70dd8c342956564163c4d496b938842eb2c06382464ab9aef73e5cf87dd70ee2d8177d61c1ccb3fb71510b5064b18a014b394322859fd7c3b
TLSH
T1311163A151EE4281C91CF8D34E2F6A19A69E86921E32B877240C930BCE541BB87742F5
MD5 SHA1 SHA512 TLSH

$TEMP/speedup.ico

SHA256 aebda70076ae40f99896ee71d5a476444e91974a215663161b6b1d89faa3ab2c
MD5 6c9011742ff814f765779df48147fa58
SHA1 5519c010b4af11452d126439d9e670ef68c77057
SHA512 766005a4cfd5edb960346316725c1c4e427042118e1b702c0a67552b8c2de3a376ccd1422e0db0a8f955642a7e2686c70a266f01362bd17afefcea9823ce5d70
SSDEEP 384:y5R7s+8FEyEYGwnauSzZYPmeBjF6ScYrSY6w98MJlp:yT7s755qZYPnBh6pqJh9DJj
TLSH
T1B3B2D7A1E183F950C16CCD37C05FAE7C127D0C5ABDE9EA124154B90B7B3D2B42B03196
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/ssa3d30.ocx

IMPHASH 624318614059381482cbd80516416d6d
SHA256 7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
MD5 48c35ed0a09855b29d43f11485f8423b
SHA1 46716282cc5e0f66cb96057e165fa4d8d60fbae2
SHA512 779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99
SSDEEP 6144:OEIHG7QYXSCz6QEPbLhB8Fp5qycE5lVdBqxuu3:9Im77XSTPbLhWp5vUf
TLSH
T101646C03B3C289B3C8970E31491B3FB9AB799D006D36A25B67657B0D2D72791DE0532B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a4:58:25:1e:81:8a:da:cd:68:98:32:d1:56:15:95:e5

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

160779

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

olepro32

ord250 ord253 ord252 ord251

kernel32

LocalUnlock LocalLock MulDiv LocalFree GlobalReAlloc LocalAlloc GetSystemTime GetVersion lstrcpynA OpenFile GetLocaleInfoA GetProcessHeap DisableThreadLibraryCalls GetProcAddress lstrcatA LoadLibraryA lstrcmpiA GlobalFree lstrcpyA lstrlenW IsDBCSLeadByte lstrcmpiW WideCharToMultiByte HeapFree HeapReAlloc HeapAlloc GlobalAlloc GetModuleFileNameA MultiByteToWideChar FreeLibrary GlobalLock GlobalUnlock lstrlenA DeleteCriticalSection InitializeCriticalSection LockResource FindResourceA LoadResource GetVersionExA CreateThread CloseHandle GlobalSize CreateMutexA ReleaseMutex InterlockedIncrement Sleep WaitForSingleObject InterlockedExchange InterlockedDecrement LeaveCriticalSection EnterCriticalSection

user32

LoadCursorA DrawTextA RegisterClassA SendMessageA IsWindow ChildWindowFromPointEx ScreenToClient GetCursorPos KillTimer SetTimer SetRectEmpty IntersectRect GrayStringA InvertRect DrawIconEx VkKeyScanA CreateAcceleratorTableA GetDlgItemTextA SendDlgItemMessageA SetWindowTextA GetDlgItem GetForegroundWindow DialogBoxParamA EndDialog UnregisterClassA CharNextA CharUpperA GetKeyState SetCursor PostMessageA GetActiveWindow GetCapture SetCapture ReleaseCapture GetFocus MoveWindow BeginPaint EndPaint DefWindowProcA SetParent CreateWindowExA DestroyWindow RegisterClipboardFormatA GetPropA SetPropA SetWindowPos ShowWindow SetFocus GetWindowRect wsprintfA EnableWindow OffsetRect ClientToScreen SetWindowLongA FrameRect DrawFocusRect DrawEdge GetWindowRgn SetWindowRgn InflateRect GetSysColor GetAsyncKeyState FillRect GetClassNameA CopyRect GetSystemMetrics InvalidateRect UpdateWindow LoadStringA MessageBoxA GetWindowLongA GetParent PtInRect GetDC DispatchMessageA TranslateMessage GetWindow GetUpdateRgn IsWindowVisible PeekMessageA EqualRect ReleaseDC SetCursorPos GetClipboardFormatNameA IsRectEmpty GetClientRect MapWindowPoints SubtractRect

ole32

CoUnmarshalInterface DoDragDrop RegisterDragDrop CreateStreamOnHGlobal IIDFromString CoUninitialize CoMarshalInterface RevokeDragDrop CoGetInterfaceAndReleaseStream CoInitialize CoMarshalInterThreadInterfaceInStream ReleaseStgMedium CreateDataAdviseHolder CoTaskMemAlloc CreateOleAdviseHolder CoTaskMemFree CoCreateInstance StringFromGUID2

advapi32

RegEnumKeyExA RegQueryValueA RegDeleteKeyA RegOpenKeyA RegCreateKeyA RegSetValueA RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey

oleaut32

RegisterTypeLi CreateErrorInfo SysReAllocStringLen SystemTimeToVariantTime SysAllocStringLen SetErrorInfo LoadRegTypeLi SysAllocString VariantCopyInd VariantChangeType SysStringLen VariantClear VariantCopy UnRegisterTypeLi LoadTypeLibEx VariantInit SysFreeString SysStringByteLen SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement SafeArrayPutElement SafeArrayRedim SafeArrayCopy LoadTypeLi

gdi32

SetTextAlign ExtCreateRegion SaveDC CreateMetaFileA SelectClipRgn GetWindowExtEx LPtoDP GetViewportExtEx SetViewportExtEx CreateDCA SetMapMode GetPaletteEntries GetDIBits CreateFontIndirectA GetNearestPaletteIndex GetDIBColorTable SetDIBColorTable GetSystemPaletteEntries SetDIBitsToDevice CreatePalette CreateDIBitmap StretchDIBits PlayEnhMetaFile PatBlt PlayMetaFile StretchBlt IntersectClipRect CreatePatternBrush TextOutA GetTextColor GetTextMetricsA GetCurrentPositionEx ExtSelectClipRgn GetCharWidthA SetWindowOrgEx GetOutlineTextMetricsA RestoreDC CloseMetaFile SetWindowExtEx GetTextExtentPoint32A SetBkMode DeleteMetaFile Ellipse SetPixel CreatePen SetDIBits GetRegionData FillRgn FrameRgn GetObjectType SetTextColor GetBitmapBits CopyEnhMetaFileA CopyMetaFileA OffsetRgn CombineRgn CreateRectRgnIndirect GetNearestColor SetBkColor ExtTextOutA CreateSolidBrush SelectPalette RealizePalette GetStockObject CreateCompatibleBitmap MoveToEx CreateDIBSection GetClipRgn BitBlt CreateCompatibleDC CreateBitmap OffsetViewportOrgEx SetViewportOrgEx CreateRectRgn DeleteObject SelectObject CreateICA GetDeviceCaps DeleteDC GetClipBox PtInRegion GetRgnBox GetPixel GetObjectA LineTo

winmm

sndPlaySoundA

msvcrt

free strrchr wcslen _mbscmp malloc _ftol _beginthread _purecall wcscmp ??2@YAPAXI@Z _except_handler3 ??1type_info@@UAE@XZ _CxxThrowException _adjust_fdiv memset memcpy _initterm _onexit __dllonexit strstr atol memcmp _itoa ??3@YAXPAX@Z memmove

shell32

ShellExecuteA

$TEMP/sstabs2.ocx

IMPHASH 8243f65c3cd4a6c8c7ae92fdbede3127
SHA256 596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
MD5 7303efb737685169328287a7e9449ab7
SHA1 47bfe724a9f71d40b5e56811ec2c688c944f3ce7
SHA512 e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03
SSDEEP 6144:/sd14Jpad8qAuQGIBTOuCXMMpyU6XAcg0nTq:tS8qABGIBTJEMpIp
TLSH
T169549F43B3E1C4F3C2A31230592B57A99BB9B9106D34974BA390DF5C3D72647EA19327
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

174353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

__dllonexit _adjust_fdiv malloc _initterm free _onexit _strcmpi _beginthreadex _endthreadex strstr _mbschr _mbsinc atol ??2@YAPAXI@Z _except_handler3 _purecall memmove ??3@YAXPAX@Z islower _beginthread _ftol __CxxFrameHandler _EH_prolog _ismbcdigit wcscmp memcmp fclose fopen _itoa strrchr wcslen vsprintf _mbclen atoi ??1type_info@@UAE@XZ _CxxThrowException realloc memset memcpy

olepro32

ord251 ord252 ord250 ord253

kernel32

WaitForSingleObject GetSystemTime InterlockedExchange CloseHandle GetLastError MulDiv SetLastError CompareStringA GetLocaleInfoA lstrcpynA lstrcpyA lstrcatA DisableThreadLibraryCalls OpenFile GetVersion lstrlenW lstrcmpiA GetProcAddress InterlockedIncrement WideCharToMultiByte InterlockedDecrement MultiByteToWideChar GetModuleFileNameA lstrlenA DeleteCriticalSection TlsGetValue TlsSetValue TlsAlloc TlsFree InitializeCriticalSection LoadLibraryA GetModuleHandleA GetTickCount EnterCriticalSection FreeLibrary GetCurrentThreadId GlobalAlloc LeaveCriticalSection GlobalSize GlobalFree GlobalLock GlobalUnlock IsDBCSLeadByte lstrcmpA Sleep ResumeThread GlobalReAlloc LocalFree

user32

PtInRect PeekMessageA CharNextA InvertRect GrayStringA EndDialog DialogBoxParamA GetForegroundWindow GetDlgItem SetWindowTextA SendDlgItemMessageA GetDlgItemTextA CallWindowProcA CharUpperA CreateAcceleratorTableA GetActiveWindow RegisterWindowMessageA ShowWindow RemovePropA SetWindowLongA CreateWindowExA MoveWindow SetWindowPos DefWindowProcA BeginPaint GetWindowTextA EndPaint SystemParametersInfoA SetFocus VkKeyScanA MessageBoxA GetPropA SetPropA GetKeyState GetAsyncKeyState GetDoubleClickTime CallNextHookEx FrameRect wsprintfA GetSystemMetrics EqualRect SetRect IsWindowEnabled DrawEdge LoadStringA UnhookWindowsHookEx MapWindowPoints SetCursor SetTimer KillTimer ReleaseCapture SetCapture UpdateWindow SetWindowsHookExA GetWindow InvalidateRect IsRectEmpty RedrawWindow CopyRect DrawFrameControl LoadBitmapA ClientToScreen OffsetRect GetParent GetWindowRect ScreenToClient SendMessageA IsWindowVisible GetWindowLongA SetWindowRgn GetWindowRgn LoadCursorA RegisterClassA DestroyWindow GetClassNameA IsWindow GetCursorPos WindowFromPoint PostMessageA GetClientRect DrawTextA IntersectRect GetSysColor GetDC ReleaseDC GetFocus FillRect SetParent InflateRect DrawFocusRect SetRectEmpty SetCursorPos GetClipboardFormatNameA EnableWindow UnregisterClassA RegisterClipboardFormatA DrawIconEx

ole32

CoCreateInstance CoMarshalInterface CoUnmarshalInterface DoDragDrop RegisterDragDrop RevokeDragDrop IIDFromString StringFromGUID2 CoTaskMemFree CreateOleAdviseHolder CreateDataAdviseHolder ReleaseStgMedium CoTaskMemAlloc CoGetMalloc CoCreateGuid GetHGlobalFromStream CreateStreamOnHGlobal

advapi32

RegCreateKeyExA RegOpenKeyA RegCreateKeyA RegSetValueA RegQueryValueA RegEnumKeyExA RegDeleteKeyA RegOpenKeyExA RegSetValueExA RegCloseKey RegDeleteValueA

oleaut32

SystemTimeToVariantTime SysReAllocStringLen RegisterTypeLi CreateErrorInfo SetErrorInfo LoadRegTypeLi LoadTypeLi SafeArrayCopy SafeArrayRedim SafeArrayPutElement SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy VariantCopyInd SysStringByteLen SysAllocStringLen LoadTypeLibEx UnRegisterTypeLi VariantClear VariantInit SysStringLen VariantChangeType SysFreeString VariantCopy SysAllocString

gdi32

CopyEnhMetaFileA SetTextAlign GetCurrentPositionEx ExtCreateRegion GetNearestColor SetPixelV GetBitmapBits CopyMetaFileA LineTo MoveToEx DeleteObject SetTextColor SetBkColor SelectClipRgn IntersectClipRect GetClipRgn CreateRectRgn GetCharWidthA CreatePalette StretchDIBits GetSystemPaletteEntries CreateCompatibleBitmap CreateCompatibleDC DeleteDC RealizePalette SelectPalette LPtoDP EqualRgn CombineRgn GetOutlineTextMetricsA OffsetViewportOrgEx CreateBitmap SetViewportOrgEx CreateFontIndirectA GetObjectA GetDeviceCaps BitBlt GetObjectType OffsetRgn ExcludeClipRect GetStockObject PtInRegion GetPixel SetBkMode CreatePen CreatePolygonRgn GetTextExtentPoint32A CreateRectRgnIndirect GetPaletteEntries SetROP2 CreateICA StretchBlt DeleteMetaFile GetClipBox RestoreDC SetWindowExtEx CloseMetaFile SaveDC CreateMetaFileA SetWindowOrgEx GetWindowExtEx SetMapMode GetViewportExtEx CreateDCA CreateDIBitmap SetViewportExtEx PlayEnhMetaFile SelectObject ExtTextOutA PlayMetaFile GetDIBits ExtSelectClipRgn GetTextColor TextOutA CreateSolidBrush PatBlt GetViewportOrgEx CreatePatternBrush GetTextMetricsA CreateDIBSection SetDIBColorTable GetWindowOrgEx

winmm

sndPlaySoundA

comctl32

ImageList_Destroy

shell32

ShellExecuteA

$TEMP/t001.nbd

SHA256 b30e7a66488327c0cf090ae98eece036f326c7f5b2ffa9f9cac3bf7df3e7af47
MD5 15a02eb5a83be1c01ff9579f2ce06aed
SHA1 1c8ed5541fb243602e963759ea4d284b9842000f
SHA512 06a562d88eeb6ddd8c056df834bc8d0e02bba501c417f9a2531761492233e0f07d17ba65602c6acac2bdcbb463bd6aedba2f397b5b707bc64565958b78f27472
SSDEEP 768:qPWd2Os9M7mXPNKjiFi6YtZGbdMzRoPQ/9RVH1pocYz0NVXejY:q+d2t62PUiFiJcdMKPQ/el0vejY
TLSH
T130D2CFB809F6961582BFE42C151A0E03774E5CF128651AE2FF4B27678BBFF50487C524
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/t2.nbd

SHA256 87d531d27e9987f39934b0f093542790f25882c9e6e20ca554ca0405a16a4acf
MD5 3a538baefe6893b4997ffcd25f339329
SHA1 c2d3e1f16c663c435735cf27a6e114f5b2f85df7
SHA512 e9eed3c7a0b9935e769b56d430fc6081e63f97a7d9d0df0b1913220cc0519223353ecc48b3dcc4a0147f77741d0367c0ba9b8d9a56645c1f03524399155c8c50
SSDEEP 1536:6BBO22jqRuV8t01n8XCF7yXOi0SOHnbOGHOvBPUmKQ:QB/2jqRuV8vCF7yhOHbjOUA
TLSH
T12063DF7501FD4D8A838FD42CB20A5C12732E4DB62A5B68D4BA494B5BC3AFF14D874B71
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/t3.nbd

SHA256 94c638be958f83325f9b96303e050383881959f509bc6c4afacd890db3755672
MD5 132adcfde600f76d5f9e4e8d45b5d936
SHA1 619164a1f95d6f5c8286fa2ea7ab5513c6d4bb2b
SHA512 b3bfa48570fc472846ae11712616ba63c6fef5994f04d463ae06cac6dbe5bb19ce43816b0c4b15ec37bc537c8c24d747757df116dade99d2f3c42f0f312a021a
SSDEEP 768:UPPQ3iM/+52laQf145blVHuThJS/qiNpsBYmMFA5JPVqMPxR3lC87LOn2mx9gzTg:UPYw5Qj6OFJS189MAxP7EfM+
TLSH
T14143CE7802FA158A07ABEB5CB51D9D96B7AE0CB2996304C2BD075396C37FF408C71672
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/t3.nbd-SR

SHA256 a994e2ea053542543b647dc81d6e0aa7fc7585311b77f5fd76e13b1bd73a67cf
MD5 d58e9150a9a022012c421bb8229385d3
SHA1 9c1ecb6c18cddf731003e805914534635b0476b5
SHA512 90ae9db622ed832adcab70aab7833ee8eae4f18b006b89d5982586fb492a797f7ea0e5cdefde16b6929168f0db80ff56d49a39c53ac744e4e3487ef84d44f7cb
TLSH
T1E511668343841B7AF18D0FC9858B201224F6C82FBC180148BFB36EE77C3B9864830626
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

$TEMP.zip

$TEMP/AUTPRX32.DLL

user32

rpcrt4

oleaut32

ole32

kernel32

advapi32

generic

$TEMP/ActiveSkin.ocx

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

comctl32

generic

$TEMP/BG/Bg1.bmp

$TEMP/BG/Bg2.bmp

$TEMP/BG/Bg3.bmp

$TEMP/Bonzi/run.vbs

$TEMP/BonziBDY.vbw

$TEMP/BonziBDY_35.EXE

msvbvm60

generic

$TEMP/BonziCTB.dll

msvbvm60

generic

$TEMP/BonziCheckers.ocx

msvbvm60

generic

$TEMP/Books/Bonz and the Polizoof/page0.jpg

$TEMP/Books/Bonz and the Polizoof/page1.jpg

$TEMP/Books/Bonz and the Polizoof/page10.jpg

$TEMP/Books/Bonz and the Polizoof/page11.jpg

$TEMP/Books/Bonz and the Polizoof/page12.jpg

$TEMP/Books/Bonz and the Polizoof/page13.jpg

$TEMP/Books/Bonz and the Polizoof/page14.jpg

$TEMP/Books/Bonz and the Treasure Chest/cb001.gif

$TEMP/Books/Bonz and the Treasure Chest/cb002.gif

$TEMP/Books/Bonz and the Treasure Chest/cb003.gif

$TEMP/Books/Bonz and the Treasure Chest/cb004.gif

$TEMP/Books/Bonz and the Treasure Chest/cb005.gif

$TEMP/Books/Bonz and the Treasure Chest/cb006.gif

$TEMP/Books/Bonz and the Treasure Chest/cb007.gif

$TEMP/Books/Bonz and the Treasure Chest/cb008.gif

$TEMP/Books/Bonz and the Treasure Chest/cb009.gif

$TEMP/Books/Bonz and the Treasure Chest/cb010.gif

$TEMP/Books/Bonz and the Treasure Chest/cb011.gif

$TEMP/Books/Bonz and the Treasure Chest/cb012.gif

$TEMP/Books/Bonz and the Treasure Chest/cb013.gif

$TEMP/Books/Bonz and the Treasure Chest/cb014.gif

$TEMP/Books/Bonz and the Treasure Chest/cb015.gif

$TEMP/Books/Bonz and the Treasure Chest/page2.jpg

$TEMP/Books/Bonzi and the Alpha-net/book

$TEMP/Books/Bonzi and the Alpha-net/page0.jpg

$TEMP/Books/Bonzi and the Alpha-net/page10.jpg

$TEMP/Books/Bonzi and the Alpha-net/page11.jpg

$TEMP/Books/Bonzi and the Alpha-net/page12.jpg

$TEMP/Books/Bonzi and the Alpha-net/page13.jpg

$TEMP/Books/Bonzi and the Alpha-net/page14.jpg

$TEMP/Books/Bonzi and the Alpha-net/page15.jpg

$TEMP/Books/Bonzi and the Alpha-net/page16.jpg

$TEMP/Books/Bonzi and the Alpha-net/page4.jpg

$TEMP/Books/Bonzi and the Alpha-net/page5.jpg

$TEMP/Books/Bonzi and the Alpha-net/page6.jpg

$TEMP/Books/Bonzi and the Alpha-net/page7.jpg

$TEMP/Books/Bonzi and the Alpha-net/page8.jpg

$TEMP/Books/Bonzi and the Alpha-net/page9.jpg

$TEMP/Books/Bonzi and the Alpha-net/sp002.gif

$TEMP/Books/Bonzi and the Alpha-net/sp003.gif

$TEMP/Books/Bonzi and the Alpha-net/sp004.gif

$TEMP/Books/Bonzi and the Alpha-net/sp005.gif