3.zip
- SHA256 03555b6cf592067f1073f81a7cc4efc481bc4b79725c8870286f296b94311245
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
120 seconds
General
- Target 3.zip
- Size 13.5MB
- Sample261017-str9bahs3j
- SHA256 03555b6cf592067f1073f81a7cc4efc481bc4b79725c8870286f296b94311245
- MD5 089964d5bb2a468251b3befa34902650
- SHA1 5a8c28fa64b748f61568d30bf5373a36e37b05d0
- SHA512 b1b256d8911a93761ca5587ae23ca1b9d821d9c785dd533c8e1d6bc69893dbc5fd67619f47173fab1a7c94b08f1e46d876791fff85f472757f5566fd0f6e8080
- SSDEEP 393216:c8deRplQx0622ct5HkEs3rnbSNNtvr+01GoSgcLn:c8d0pmxL+NsbbUnIoyLn
- TLSH T182E633B8A624D31AD6EE23FC62DD96B8E5CB3CAE11D43918CD11C873C4F1E5640367A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 21 IoCs
Checks for missing Authenticode signature.
resource unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/UAC.dll unpack001/$PLUGINSDIR/UserInfo.dll unpack001/$PLUGINSDIR/nsDialogs.dll unpack001/$PLUGINSDIR/nsExec.dll unpack001/$TEMP/AUTPRX32.DLL unpack001/$TEMP/ActiveSkin.ocx unpack001/$TEMP/BonziBDY_35.EXE unpack001/$TEMP/BonziCTB.dll unpack001/$TEMP/BonziCheckers.ocx unpack001/$TEMP/ODKOB32.DLL unpack001/$TEMP/RACREG32.DLL unpack001/$TEMP/Regicon.ocx unpack001/$TEMP/SSubTmr6.dll unpack001/$TEMP/empop3.dll unpack001/$TEMP/emsmtp.dll unpack001/$TEMP/msvbvm60.dll unpack001/$TEMP/sstabs2.ocx unpack001/uninst.exe unpack002/$PLUGINSDIR/UAC.dll unpack002/$PLUGINSDIR/UserInfo.dll - Untrusted Codesign Signers 9 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/$TEMP/MSCOMCTL.OCX unpack001/$TEMP/MSINET.OCX unpack001/$TEMP/MSWINSCK.OCX unpack001/$TEMP/Runtimes/MSAGENT.EXE unpack001/$TEMP/Runtimes/tv_enua.exe unpack001/$TEMP/SSCALA32.OCX unpack001/$TEMP/SSCALB32.OCX unpack001/$TEMP/msvcrt.dll unpack001/$TEMP/ssa3d30.ocx
File Explorer
-
3.zip.zip 13.5MB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UAC.dll.dll 14KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
$TEMP/AUTPRX32.DLL.dll 137KB
-
$TEMP/ActiveSkin.ocx.dll 336KB
-
$TEMP/BG/Bg1.bmp868KB
-
$TEMP/BG/Bg2.bmp868KB
-
$TEMP/BG/Bg3.bmp868KB
-
$TEMP/Bonzi/run.vbs.vbs 124B
-
$TEMP/BonziBDY.vbw53B
-
$TEMP/BonziBDY_35.EXE.exe 2.5MB
-
$TEMP/BonziCTB.dll.dll 28KB
-
$TEMP/BonziCheckers.ocx.dll 152KB
-
$TEMP/Books/Bonz and the Polizoof/page0.jpg.jpg 58KB
-
$TEMP/Books/Bonz and the Polizoof/page1.jpg.jpg 52KB
-
$TEMP/Books/Bonz and the Polizoof/page10.jpg.jpg 51KB
-
$TEMP/Books/Bonz and the Polizoof/page11.jpg.jpg 48KB
-
$TEMP/Books/Bonz and the Polizoof/page12.jpg.jpg 49KB
-
$TEMP/Books/Bonz and the Polizoof/page13.jpg.jpg 51KB
-
$TEMP/Books/Bonz and the Polizoof/page14.jpg.jpg 55KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb001.gif.gif 38KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb002.gif.gif 42KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb003.gif.gif 51KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb004.gif.gif 49KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb005.gif.gif 39KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb006.gif.gif 43KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb007.gif.gif 26KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb008.gif.gif 35KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb009.gif.gif 39KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb010.gif.gif 43KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb011.gif.gif 47KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb012.gif.gif 52KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb013.gif.gif 47KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb014.gif.gif 55KB
-
$TEMP/Books/Bonz and the Treasure Chest/cb015.gif.gif 32KB
-
$TEMP/Books/Bonz and the Treasure Chest/page2.jpg.jpg 45KB
-
$TEMP/Books/Bonzi and the Alpha-net/book9KB
-
$TEMP/Books/Bonzi and the Alpha-net/page0.jpg.jpg 35KB
-
$TEMP/Books/Bonzi and the Alpha-net/page10.jpg.jpg 65KB
-
$TEMP/Books/Bonzi and the Alpha-net/page11.jpg.jpg 62KB
-
$TEMP/Books/Bonzi and the Alpha-net/page12.jpg.jpg 66KB
-
$TEMP/Books/Bonzi and the Alpha-net/page13.jpg.jpg 82KB
-
$TEMP/Books/Bonzi and the Alpha-net/page14.jpg.jpg 61KB
-
$TEMP/Books/Bonzi and the Alpha-net/page15.jpg.jpg 65KB
-
$TEMP/Books/Bonzi and the Alpha-net/page16.jpg.jpg 55KB
-
$TEMP/Books/Bonzi and the Alpha-net/page4.jpg.jpg 66KB
-
$TEMP/Books/Bonzi and the Alpha-net/page5.jpg.jpg 60KB
-
$TEMP/Books/Bonzi and the Alpha-net/page6.jpg.jpg 67KB
-
$TEMP/Books/Bonzi and the Alpha-net/page7.jpg.jpg 70KB
-
$TEMP/Books/Bonzi and the Alpha-net/page8.jpg.jpg 68KB
-
$TEMP/Books/Bonzi and the Alpha-net/page9.jpg.jpg 66KB
-
$TEMP/Books/Bonzi and the Alpha-net/sp002.gif.gif 37KB
-
$TEMP/Books/Bonzi and the Alpha-net/sp003.gif.gif 54KB
-
$TEMP/Books/Bonzi and the Alpha-net/sp004.gif.gif 71KB
-
$TEMP/Books/Bonzi and the Alpha-net/sp005.gif.gif 58KB
-
$TEMP/Books/Bonzi and the Alpha-net/sp006.gif.gif 63KB
-
$TEMP/Books/Bonzi and the Alpha-net/sp007.gif.gif 48KB
-
$TEMP/CHORD.WAV17KB
-
$TEMP/Intro2.wav151KB
-
$TEMP/J001.nbd-SR147B
-
$TEMP/MSCOMCTL.OCX.dll 1.0MB
-
$TEMP/MSINET.OCX.dll 112KB
-
$TEMP/MSWINSCK.OCX.dll 105KB
-
$TEMP/ODKOB32.DLL.dll 16KB
-
$TEMP/P001.nbd-SR231B
-
$TEMP/RACREG32.DLL.dll 32KB
-
$TEMP/Reg.nbd290B
-
$TEMP/Regicon.ocx.dll 76KB
-
$TEMP/Runtimes/MSAGENT.EXE.exe 391KB
-
$TEMP/Runtimes/tv_enua.exe.exe 997KB
-
$TEMP/SSCALA32.OCX.dll 472KB
-
$TEMP/SSCALB32.OCX.dll 320KB
-
$TEMP/SSubTmr6.dll.dll 40KB
-
$TEMP/Snd1.wav27KB
-
$TEMP/Snd2.wav38KB
-
$TEMP/T001.nbd-SR319B
-
$TEMP/empop3.dll.dll 148KB
-
$TEMP/emsmtp.dll.dll 116KB
-
$TEMP/favicon.ico3KB
-
$TEMP/j001.nbd10KB
-
$TEMP/j2.nbd44KB
-
$TEMP/j2.nbd-SR907B
-
$TEMP/j3.nbd48KB
-
$TEMP/j3.nbd-SR1KB
-
$TEMP/msvbvm60.dll.dll 1.3MB
-
$TEMP/msvcrt.dll.dll 288KB
-
$TEMP/p001.nbd22KB
-
$TEMP/s1.nbd188KB
-
$TEMP/sites.nbd888B
-
$TEMP/speedup.ico23KB
-
$TEMP/ssa3d30.ocx.dll 320KB
-
$TEMP/sstabs2.ocx.dll 288KB
-
$TEMP/t001.nbd29KB
-
$TEMP/t2.nbd65KB
-
$TEMP/t3.nbd54KB
-
$TEMP/t3.nbd-SR903B
-
$WINDIR/MsAgent/chars/Bonzi.acs5.0MB
-
uninst.exe.exe 75KB
-
$PLUGINSDIR/UAC.dll.dll 14KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
$PLUGINSDIR/System.dll
- IMPHASH 039bcbc605477e8e87ec550c2e60e748
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
10024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary
user32
wsprintfW
ole32
CLSIDFromString
StringFromGUID2
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
963B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=1, productName=Unmarked objects,
count=6, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/UAC.dll
- IMPHASH 0ef725341a4aecf8398c0e2132f38049
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetLastError
GetCurrentProcessId
GetCommandLineW
GetProcAddress
CreateThread
GlobalFree
LoadLibraryA
OpenProcess
GlobalAlloc
CreateFileMappingW
Sleep
MapViewOfFile
GetModuleHandleW
UnmapViewOfFile
CreateEventW
SetCurrentDirectoryW
GetVersionExW
GetExitCodeProcess
lstrcatW
LocalFree
GetPrivateProfileStringW
FormatMessageW
GetPrivateProfileIntW
CreateProcessW
CloseHandle
GetLastError
DuplicateHandle
GetCurrentThreadId
lstrlenW
SetEvent
WaitForSingleObject
lstrcmpiW
GetExitCodeThread
GetModuleFileNameW
user32
SetWindowPos
GetClientRect
GetWindowThreadProcessId
SetWindowLongW
DefWindowProcW
GetDlgItem
CallWindowProcW
CallNextHookEx
GetClassNameW
PeekMessageW
DestroyWindow
SendMessageW
SetForegroundWindow
IsWindowVisible
MsgWaitForMultipleObjects
LoadStringW
EndDialog
EnableWindow
DialogBoxParamW
LoadImageW
MessageBoxW
GetWindowLongW
DispatchMessageW
ShowWindow
wsprintfW
CreateDialogParamW
GetWindowRect
IsDialogMessageW
FindWindowExW
CharNextW
CreateWindowExW
LoadIconW
PostMessageW
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage
shell32
ShellExecuteExW
advapi32
OpenServiceW
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
EqualSid
ole32
CoInitialize
_
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=83, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/UserInfo.dll
- IMPHASH 45d25ca52c312b2254c60dbcb30342d1
- SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
- MD5 c7ce0e47c83525983fd2c4c9566b4aad
- SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
- SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
- TLSH T14481777F63B448B3E45907BB03A614D711E2D530530B401E498F1E6A1885DA7FD6E717
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc
advapi32
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
686B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
753B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=1, productName=Unmarked objects,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
- SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
- MD5 4ccc4a742d4423f2f0ed744fd9c81f63
- SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
- SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
- SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
- TLSH T1DE121A636694D5BBC2D2123736A53752CBA92338F0265C05CBB78E867D646C57E3A302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7445
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree
user32
LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW
gdi32
SetTextColor
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
comdlg32
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
590B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=1, productName=Unmarked objects,
count=6, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/nsExec.dll
- IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
- SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
- MD5 132e6153717a7f9710dcea4536f364cd
- SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
- SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
- SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
- TLSH T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess
user32
CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
454B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=46, id=1, productName=Unmarked objects,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$TEMP/AUTPRX32.DLL
- IMPHASH 301d3fe653a288a4bb9a0472123a9348
- SHA256 0563e77b6bd63eb0561f6264badb5d07dacb7287ce029dc3ca3279a964ea6a6d
- MD5 6e62806f4121eed119ef7d361f3322ca
- SHA1 2265e83e068fd0bda58d0ed8366050614138787e
- SHA512 fa5efb12fcd7d34a026b95a573c5a8b72dcacfa0c3df439e55691f27c9c0d8cd8905f0d3cad610259b9bdac474a3ed41796a91474e0ab522e78d8a2cf2a53dba
- SSDEEP 1536:yTChuEXZnfAdeegEKMK53sORozp/pzbcsXG7fPKvKqRwYKIr0k7kZp:yTCUEXdowEc53sOc5b+n+05y0k7Up
- TLSH T110D34B76E1C3AAB1D9CB873C05E73A1B563B6B9087D2E5C346307811E6F36D19938392
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91472
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
user32
GetMessageA
PostMessageA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
PostThreadMessageA
rpcrt4
RpcEpResolveBinding
RpcSsDestroyClientContext
RpcBindingFree
RpcBindingSetAuthInfoA
RpcBindingFromStringBindingA
NDRCContextBinding
NdrClientContextMarshall
NdrConformantArrayBufferSize
NdrConformantArrayMarshall
NdrSimpleStructUnmarshall
NdrClientInitializeNew
NdrSimpleStructBufferSize
NdrGetBuffer
NdrSimpleStructMarshall
NdrSendReceive
NdrConvert
NdrClientContextUnmarshall
NdrFreeBuffer
RpcBindingToStringBindingA
RpcStringBindingParseA
RpcStringBindingComposeA
RpcStringFreeA
oleaut32
SysAllocStringLen
DispCallFunc
SysAllocString
LoadTypeLi
SafeArrayDestroyData
ClearCustData
VariantInit
SafeArrayDestroy
SafeArrayAllocDescriptor
SafeArrayAllocData
CreateErrorInfo
SafeArrayLock
SafeArrayUnlock
VariantClear
SetErrorInfo
GetErrorInfo
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysStringLen
ole32
CLSIDFromString
CreateFileMoniker
CoDisconnectObject
GetRunningObjectTable
CoCreateInstance
CoGetStandardMarshal
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
StringFromGUID2
CoGetMalloc
CoRegisterMessageFilter
OleInitialize
OleUninitialize
CoCreateGuid
CoRevokeClassObject
CoLockObjectExternal
CoUnmarshalInterface
CoMarshalInterface
CoMarshalHresult
CoUnmarshalHresult
kernel32
SetFilePointer
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetACP
GetCPInfo
GetStartupInfoA
GetStdHandle
GetFileType
SetHandleCount
HeapDestroy
HeapCreate
ExitProcess
RtlUnwind
GetModuleHandleA
GetProcAddress
GetCommandLineA
GetLocaleInfoA
MultiByteToWideChar
WideCharToMultiByte
TlsAlloc
HeapSize
SetEvent
GetCurrentProcess
Sleep
DuplicateHandle
GetCurrentThreadId
GetCurrentThread
WaitForSingleObject
CloseHandle
CreateThread
InterlockedDecrement
InterlockedIncrement
CreateEventA
GetVersion
HeapAlloc
GetModuleFileNameA
GetOEMCP
FreeEnvironmentStringsA
LoadLibraryA
ReleaseMutex
CreateMutexA
TlsGetValue
HeapReAlloc
WriteFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
TlsSetValue
TlsFree
GetLastError
GetVersionExA
LCMapStringA
GetStringTypeA
LCMapStringW
HeapFree
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyA
RegQueryValueA
RegCreateKeyA
RegSetValueA
RegDeleteKeyA
RegEnumKeyA
RegSetValueExA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
103KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$TEMP/ActiveSkin.ocx
- IMPHASH 565e1800bc82993fc37d2bbe43963eb1
- SHA256 2c8f92dc16cbf13542ddd3bf0a947cf84b00fed83a7124b830ddefa92f939877
- MD5 3d225d8435666c14addf17c14806c355
- SHA1 262a951a98dd9429558ed35f423babe1a6cce094
- SHA512 391df24c6427b4011e7d61b644953810e392525743914413c2e8cf5fce4a593a831cfab489fbb9517b6c0e7ef0483efb8aeaad0a18543f0da49fa3125ec971e1
- SSDEEP 3072:TVKIgW9TkeIu2Yewxx3aGwz3OzT6pe3EhV665fi5sMfkjjyO0DtQo1fPqdXqvbFv:pKIkYPOpeUhV/oCMmjYtRne2LQ
- TLSH T1B1748E12F7C3C47AC15716314817BB7EA7B9E6028925928B236C3E4E2F72BC0695935F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190551
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
GetModuleHandleA
HeapReAlloc
DebugBreak
Sleep
WriteProcessMemory
SetFilePointer
ReadProcessMemory
UnmapViewOfFile
WriteFile
GetACP
GetProcessHeap
HeapFree
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
LoadLibraryA
lstrcatA
lstrcpyA
IsDBCSLeadByte
GetProcAddress
HeapDestroy
LoadLibraryExA
lstrcpynA
lstrcmpiA
LoadResource
GetLastError
FindResourceA
GetModuleFileNameA
SizeofResource
FreeLibrary
GetSystemInfo
GetShortPathNameA
HeapCreate
InitializeCriticalSection
HeapAlloc
DisableThreadLibraryCalls
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
TerminateProcess
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
ExitProcess
RtlUnwind
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
GetStdHandle
GetOEMCP
lstrlenW
GetWindowsDirectoryA
CloseHandle
ReadFile
GetCurrentProcess
TerminateThread
GetFileSize
CreateFileA
lstrlenA
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
FlushInstructionCache
user32
MessageBoxA
GetWindowLongA
RedrawWindow
TrackPopupMenu
ShowWindow
LoadBitmapA
WindowFromDC
ReleaseDC
GetDC
IsChild
IsWindow
CharNextA
GetKeyState
SendMessageA
GetMenuItemInfoA
PtInRect
UnionRect
SetWindowRgn
OffsetRect
EqualRect
GetClientRect
PostMessageA
BeginPaint
CallWindowProcA
GetWindowPlacement
GetSysColor
GetWindowTextA
WindowFromPoint
KillTimer
SetCursor
SystemParametersInfoA
SetCapture
GetWindowRgn
GetWindowDC
SetMenu
GetCapture
UpdateWindow
DeleteMenu
InsertMenuItemA
AdjustWindowRect
ReleaseCapture
GetSystemMenu
SetFocus
GetFocus
SetWindowPos
GetWindowRect
InvalidateRect
DestroyWindow
DefWindowProcA
SetWindowLongA
CreateWindowExA
RegisterClassExA
wsprintfA
LoadCursorA
GetClassInfoExA
IntersectRect
EndPaint
SubtractRect
IsRectEmpty
GetDesktopWindow
GetScrollInfo
SetScrollInfo
GetMenu
GetSubMenu
GetSystemMetrics
SetForegroundWindow
GetMessageA
DispatchMessageA
GetMenuItemCount
GetMenuItemID
GetMenuStringA
MoveWindow
SetWindowTextA
GetCursorPos
GetDlgCtrlID
FillRect
GetClassNameA
GetParent
DrawTextA
gdi32
DeleteDC
RestoreDC
SetWindowExtEx
BitBlt
SelectObject
GetDeviceCaps
CreateRectRgnIndirect
CreateCompatibleDC
CloseMetaFile
SetWindowOrgEx
DeleteMetaFile
CreateMetaFileA
SetViewportOrgEx
SaveDC
LPtoDP
CreateDCA
SetMapMode
StretchDIBits
SelectPalette
CreateDIBSection
DeleteObject
SetDIBitsToDevice
SetRectRgn
CreateRectRgn
CombineRgn
OffsetRgn
SetBkColor
TranslateCharsetInfo
SetTextColor
LineTo
SetBkMode
CreatePen
CreateSolidBrush
MoveToEx
Rectangle
GetObjectA
SelectClipRgn
StretchBlt
GetTextExtentPoint32A
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
RegEnumValueA
RegQueryInfoKeyA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
ole32
StgCreateDocfile
CreateBindCtx
CLSIDFromString
OleLoadFromStream
CreateStreamOnHGlobal
StringFromCLSID
CreateOleAdviseHolder
GetHGlobalFromStream
StgOpenStorage
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
OleSaveToStream
WriteClassStm
CoCreateInstance
CreateDataAdviseHolder
OleRegGetMiscStatus
oleaut32
SysAllocStringByteLen
OleCreatePictureIndirect
OleLoadPicture
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
OleCreatePropertyFrame
LoadRegTypeLi
SysStringByteLen
VariantChangeType
VariantClear
SysAllocString
SysStringLen
SysAllocStringLen
OleCreateFontIndirect
SysFreeString
comctl32
InitCommonControlsEx
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
196KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
76KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=12, version=7291,
count=24, id=14, version=7299,
count=34, productName=Unmarked objects (old),
count=18, id=19, version=8022,
count=13, id=19, version=8034,
count=252, id=1, productName=Unmarked objects,
count=56, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=26, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/BG/Bg1.bmp
- SHA256 e4843ab74d29d608e406d137892afced0661ee56c3cd899cf49bc863dfc9e99a
- MD5 1b360ab50e93b123ab13f036d5c76f45
- SHA1 f274fe317961cab9f2d9a8bf558e7734d7a7a338
- SHA512 e23a7c7394944482a94c6a56fb875def9b51e44b4ed0dff907ed57cc1d681ee8dc878c2a14b3b34793c4afbe8ccbb54258281d37fa2d90bf066c2365e0f8471a
- SSDEEP 12288:4a9s25MGQUdzOZ9NYoNxG/bTyy9Fifuz2eRIpl8p9VncBvYOHVyxHvYDqEnKwMTC:4kj5/fdcNX70nYOOEG9nr
- TLSH T19F15F107B4851EB6EBF2A6BA58064361B7C2E832F78A757521C90F079AF9CD44FD0217
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/BG/Bg2.bmp
- SHA256 2066f7ede6410b790ee3446b6c27470526969eb837ab9187f61c10c611bdcc5f
- MD5 c7263e35b3e47b805356e06cbca930dc
- SHA1 4dc3f33674bd914c86a4608aaf0a65b91df86e3b
- SHA512 5732403c83678f0b582e8940c00e94a5e0376e80263b5ae804cb7cff18108a3c69ada76af66fb331cb67c0d89d4129bae28c17f3a91230eaf4717f6cbe7ef2e9
- SSDEEP 24576:Ua1IqcHaBedHXQuGahQaeGDqV48bnPs10b:UbqcH9dA34QTBPs1y
- TLSH T16C1501579B190B9CE06F07B82CB24F9C73E4E89AAD74D7C49C0D633BBDA92D21930159
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/BG/Bg3.bmp
- SHA256 d983ff82ee546e5706da39531aff69721b9896fc99eacd59bfaeefdd0bef0147
- MD5 fe0a9cbbb8b168c7f13b1669d2fbd801
- SHA1 ca3eab96c7fe48fe27086941fc2c09549473e0d7
- SHA512 59b3ada28a58795eabafe4b998062c6b5d27b3d370687666341fedc66f53e5ff5e8833b0eb378826fcc1a775706fcdba0dc1e4b99451aef8fb4aec6b1a3d8b3a
- SSDEEP 12288:Q2hVooL/ozxPXQWNSc65DwyRVn/Vz39grtiL9AxrawMx9fDxiLvQXGFoPtniVuWF:rVoAoz9gWPEwA3WZiLaWEQXGFSnhWYr4
- TLSH T1311501145CC5CD9DFC37DA38ABAAC3D075B7528CC92C7C2F51A7A94065C8CCB906AA9C
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Bonzi/run.vbs
- SHA256 b2959e49361d8d68b7ea82e42a03dd8c281764f1a2ad66a4019e84412c1653c7
- MD5 69956ebd2616be211a92820cd07038ea
- SHA1 ef4e9d29d16176ad8d3eb49c358c913ecfc3fcbc
- SHA512 fb075f890d604a61344a003513f017d218004ea16d47a7e2def1c9688a24bc55c8287e8d4412b8ae444c4ae31e8253a3dc61cb78a1f45e31ac635b2feb13a28a
- TLSH T149B0924A3C8AF42142362EB5CA36688956A0A4F6040C88E91CC9911498882F82BB62B0
- MD5 SHA1 SHA512 TLSH
$TEMP/BonziBDY.vbw
- SHA256 4dd98f95113b70772308a4671a482b9b59bba5fbf41e928f2a833366c54424e4
- MD5 b4d876161a7abb7bcaea37003dae158f
- SHA1 5317af4e389e00103faf2ec0a1acfa2b59b30843
- SHA512 3d5da08c1c39cb4ea24b66612a383e166500dbd891113f080c66ded8a29bf8e4094c6e407fc24f873d598e13daac8c06d91ba488f9d4ca10eecbc1f51f649767
- TLSH T1EA900231005445F882015B9141B12C5DFE1583882101909375055905470A144D319714
- MD5 SHA1 SHA512 TLSH
$TEMP/BonziBDY_35.EXE
- IMPHASH 2cda54480c88977341f0d69a768a13ce
- SHA256 88c03817ae8dfc5fc9e6ffd1cfb5b829924988d01cd472c1e64952c5398866e8
- MD5 73feeab1c303db39cbe35672ae049911
- SHA1 c14ce70e1b3530811a8c363d246eb43fc77b656c
- SHA512 73f37dee83664ce31522f732bf819ed157865a2a551a656a7a65d487c359a16c82bd74acff2b7a728bb5f52d53f4cfbea5bef36118128b0d416fa835053f7153
- SSDEEP 24576:KAS+cA9B93P0k/ubqLss6/BAgGz+nDbZ65EeLpCeet7hNSw/yinPo1rCmUGCx9xH:pSQclDbZ65zpCeet7hNSw/yinPo1tm
- TLSH T10EC53B13FE44E00EE57285F07874926B5A28BD3524B4DA0B73907E59A1F27E3EDA071B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65872
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
ord588
__vbaLateIdCall
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaVarIdiv
__vbaFreeVarList
_adj_fdiv_m64
__vbaFpCDblR8
EVENT_SINK_Invoke
__vbaVarIndexStore
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
__vbaI2Abs
__vbaResume
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
ord552
__vbaLsetFixstr
__vbaBoolErrVar
ord553
__vbaWriteFile
ord660
ord661
__vbaSetSystemError
__vbaRecDestruct
__vbaStrDate
__vbaNameFile
ord662
__vbaHresultCheckObj
ord557
__vbaLenVar
ord558
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
Zombie_GetTypeInfo
__vbaVarCmpGe
__vbaAryDestruct
ord591
EVENT_SINK2_Release
ord592
__vbaStrBool
__vbaBoolStr
ord593
__vbaVarForInit
__vbaForEachCollObj
__vbaExitProc
ord594
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaFpR4
__vbaStrFixstr
__vbaBoolVar
ord520
ord521
__vbaRefVarAry
__vbaVarTstLt
__vbaBoolVarNull
__vbaFpR8
_CIsin
__vbaErase
ord631
ord709
__vbaNextEachCollObj
__vbaVarZero
__vbaVarCmpGt
ord632
__vbaChkstk
__vbaCyVar
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord527
__vbaVarAbs
__vbaGenerateBoundsError
ord528
__vbaExitEachColl
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner3
__vbaPutOwner4
ord560
__vbaR4Str
__vbaDateR8
__vbaPrintObj
__vbaObjVar
ord561
__vbaI2I4
DllFunctionCall
ord670
ord563
__vbaVarOr
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaObjIs
__vbaRedimVar
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
ord711
__vbaPrintFile
ord712
__vbaInputFile
__vbaStrToUnicode
ord606
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
__vbaLateIdStAd
__vbaR8ErrVar
__vbaI2Str
__vbaFailedFriend
ord608
__vbaVarCmpLe
ord716
ord609
__vbaFPException
ord717
__vbaInStrVar
ord319
__vbaUbound
__vbaStrVarVal
__vbaGetOwner4
__vbaVarCat
ord535
__vbaDateVar
ord536
__vbaI2Var
ord644
ord537
ord538
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord647
ord570
__vbaVarLateMemCallLdRf
__vbaInStr
ord648
__vbaVar2Vec
__vbaR8Str
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
EVENT_SINK2_AddRef
__vbaI4Str
__vbaVarCmpLt
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
__vbaR8Var
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
ord689
ord610
__vbaVarAdd
__vbaLateMemCall
__vbaAryLock
ord320
ord612
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaVerifyVarObj
ord614
__vbaFpI2
__vbaVarMod
__vbaVarLateMemCallLd
__vbaVarTstGe
ord616
__vbaVarCopy
__vbaFpI4
__vbaR8IntI2
__vbaLateMemCallLd
__vbaRecDestructAnsi
ord617
_CIatan
ord618
ord540
__vbaAryCopy
__vbaStrMove
__vbaCastObj
__vbaHresultCheckNonvirt
__vbaR8IntI4
__vbaI4Cy
ord619
__vbaVarNeg
ord542
ord650
_allmul
ord651
__vbaLateIdSt
ord652
ord545
__vbaAryRecCopy
_CItan
__vbaNextEachCollAd
ord546
ord547
__vbaFPInt
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaRecAssign
ord580
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr
ord581
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=60, id=9, version=8783,
count=1, id=13, version=8877,
$TEMP/BonziCTB.dll
- IMPHASH 0a151413cae1263819c5ae21d88080bd
- SHA256 f85525a3ebe334f7403f031ec47c2b32461650224223ee728107dce0e879ea93
- MD5 6a4c7d730aed29b0405b03e128c1655a
- SHA1 1dbb8dbbe7bac39196f7697486a36dedf59b31f1
- SHA512 212ebd6b0cfa2500add4813860c74288e83a606676bcba837d500ac30960c10cbf1da25c7f7c526cf9953ea619f8a3244dc1d5fdccb1c1577b271e37289ecd7f
- SSDEEP 384:MDM8av3HaAdlYeH73h0Bg/IX5HP30sLey:kU3HaAuAaagpvxC
- TLSH T1D5D28222B2EEC12ED51901B11E27E6ED10587E310FC5E61F75EDFB8E0E769409A24B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4996
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvbvm60
__vbaVarTstGt
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaFreeVar
__vbaAptOffset
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaResume
__vbaStrCat
ord662
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaDateVar
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
ord103
ord689
ord104
ord105
__vbaVarDup
_CIatan
__vbaStrMove
_allmul
_CItan
ord546
_CIexp
__vbaFreeObj
__vbaFreeStr
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1018B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=3, id=9, version=8783,
count=1, id=13, version=8964,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/BonziCheckers.ocx
- IMPHASH ef48b9ebafbad3a44757bc3f4266181d
- SHA256 9028075603c66ca2e906ecac3275e289d8857411a288c992e8eef793ed71a75b
- MD5 66551c972574f86087032467aa6febb4
- SHA1 5ad1fe1587a0c31bb74af20d09a1c7d3193ec3c9
- SHA512 35c1f500e69cdd12ec6a3c5daef737a3b57b48a44df6c120a0504d340e0f721d34121595ed396dc466a8f9952a51395912d9e141ad013000f5acb138b2d41089
- SSDEEP 1536:HtfBDnpy/MOuoHvCXDYd05gNsHzmDwUhUjm66UGi+axKQMArl4qwt4h0wcRv:dBLp4UoPC/zIwFsSp4pt4h0wov
- TLSH T143E30913B3A1820EC4955E74264BA3F8502D3E330660916F9797FA6C1EB5ED39E3472B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7188
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvbvm60
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
_adj_fprem1
__vbaI2Abs
__vbaCopyBytes
__vbaStrCat
ord660
__vbaRecDestruct
ord662
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaVarCmpGe
__vbaAryDestruct
ord593
ord594
__vbaObjSet
__vbaOnError
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
ord561
__vbaCastObjVar
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
_adj_fprem
_adj_fdivr_m64
ord714
__vbaI2Str
__vbaFailedFriend
__vbaFPException
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaR8Var
_adj_fdiv_r
__vbaVarTstNe
ord101
ord102
__vbaI4Var
ord103
ord689
ord104
ord105
__vbaAryLock
__vbaVarDup
__vbaFpI2
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaRecAssign
__vbaFreeStr
__vbaFreeObj
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
124KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=3, id=9, version=8783,
count=1, id=13, version=8877,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/Books/Bonz and the Polizoof/page0.jpg
- SHA256 4b0d3ac6305c56e814e87734d3798a4534b639fe7752a20bb398fa9eaf59bfd7
- MD5 2f86991655a07f1e0ae608ae69c8de62
- SHA1 89885605155e2a4162bdb5bd0631e01e350d7608
- SHA512 1843da571ee2ab31f6449e94698e51445e458829fe37b98c8967e9d3572a06811c12438f3b7cb8e908d95dd583429d69c524a50bdfd0390a84af0ccef5f2b552
- SSDEEP 1536:XF/EtriiF6Bh6jve8uwKht9APQv8gw7kZIz:XhwiiFaU2llt9APQv8TwZIz
- TLSH T132430267AF9E9F8BC7EC313013344F5C38E14D42FD642696477B48260BBAAEB61258D4
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Polizoof/page1.jpg
- SHA256 bc48c07bc245bb7a7561c983c72851bc2f48cae594472c48d3447456dcbea804
- MD5 66fe43801d34b46bf67ed75989779010
- SHA1 a5f48e93f10129ec8b0ae0b71a3901229d936fb4
- SHA512 0c3ee73b3f1009140a5bbf8a07b059db37bdb30e673d46b87992541b4f96545f663b083c97926da7dbee053b5be557186aa9ea6e3a7deb2d511daa5f9f3e59da
- SSDEEP 768:X9bCx4GufcGl9YGb2rmfSEU4oZJJgCba6l+RAk+BgPR0vK+/u6t1OChHdPvMm42J:N7GufcGdPh+2KZ0Ajg50jftMChHdHMFO
- TLSH T19933026D0B4013FFD244FB6B87B90512AE6A35E310EAD696C7B346D2A079ABDA751300
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Polizoof/page10.jpg
- SHA256 58007307843f33234f44cdb0b89d91d0d12d07401a9c31ea7d64d5b6688d71df
- MD5 f1ff8656e3b3bc1a6ace48d232a04752
- SHA1 da161d1725964dc78c44fbdd393294c75ae152ea
- SHA512 e34b99174ae6918c1049fc686efeecaf9cd65e610f3dbdb6828266bab18407211033fb9397740b75193c2bfa64abd2c23ddcac623fd9a2208fcd84c61a70a2a3
- SSDEEP 1536:L4zsbVjhFiYBrK+Nd9fHsn9HtYTeRDXgsw8c4/9Lk:MzeNh9NrfQtYT6HcGLk
- TLSH T19833F148A9C7CC145BC89FF1C560C9AAE0A01BA837D7B9DB9487001AFD5329B909FBC5
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Polizoof/page11.jpg
- SHA256 1eec3c97c806459052a98661e0bfcdac4eafef0df5fd2af6c4c53916156e5eb1
- MD5 deb89b81b2655a117454893c71cf39be
- SHA1 1c573f99842e46abc56accd7cb4d7f4b0f93d063
- SHA512 83536ba1b85b1822544997be4e4ec08e79684a747de5b2c1af3751d75d7dc848e0c743989cd5cc6996d3d8fad918cd7cf6420796d793e77c3261e58d61736107
- SSDEEP 768:TNBT5XsT3Qkx6F61AJx292D3UQTpoN+qLf4dCqknXh+d4z2ZvhJcJbyFdDLam7nD:xy6F61AJ/DfTpMLfc6xOvhJqbyTL2Q
- TLSH T1152302E5C762DE228B51D3BA7C31EA17B28979D60413AEDE4893C95A2F7003DB0D24D9
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Polizoof/page12.jpg
- SHA256 2f52d995e111b8c9ac693663a03ca0545861e94c53c7110270d21ff10cd4876b
- MD5 75ab958c17806c34e8bff5833816ce56
- SHA1 45410fa635d296b400da35cfa90e4207e43b084a
- SHA512 7947fe6708c45109befcea84019b5f5f84ec1a80137c1895045a38c9151a525df283a47f9f300a386df992492b4f4b12b8a8eb2f0f9c98f8e4a9660723b53c8f
- SSDEEP 768:JiG0Rn43Vggfbb72O+6mbTupZ4ttiEXaBzbzCrcoRO5tlLTaqvmi3qvNFOk:Q1nIVggDbt+bc4m2rw1acmi6vXOk
- TLSH T1B2330202C257BB9FB623441A1D7B29526405AA768537F9341A7D52C83EC0C3AD578FFC
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Polizoof/page13.jpg
- SHA256 43f4e85f1c60b73fa8252dfc755e38649e8d23ba8a666a83d0cf859b0920f4a1
- MD5 3b53202999c06a3fc163ca659dfa31de
- SHA1 73fa0053205b67920f7d3e6eef7fe19819603847
- SHA512 916aa4b595a91e13a0b1bddac0f9fedbd131fb024d0a925628fc332239fe053615298f5c18e2e8f4319f4d211c5d679aaa91350f5a781c8d0f18cbb71b3eb58c
- SSDEEP 1536:BozxapdcGnnaRO6Rc9tK5D14lREgPRgyp7:qzx7Gnnf6CSQV
- TLSH T1E133027871D9CB05E7368A71DFF6C717D75D9FE821E68BC0C4E6848835A8A3934021B9
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Polizoof/page14.jpg
- SHA256 aa9acde92741388db556b92bb3b3c7052faf78984835d4e05f3ff1bb44c07a3c
- MD5 2f0b89fb6286f9cc3d4f698cfe915d3a
- SHA1 fb613a71ba544fff7e26be88e8c5316daa99fb0b
- SHA512 742841434414a05d9f5985674268c776123c504b38239f5552dc4e4431254a604e678f5b818570dfd99fafb905fcf052fdcb614952ff9f2befdfaf62453a36af
- SSDEEP 768:V0AcKUPRovLoIFeI5wf69TP84HyqTlUXVQ7OX60Lv0SffAALRf9X7BXftM18d0Mx:V/LUu4FU04SqqFFfmAxXfq19MirkZ
- TLSH T19A4301FB4F9EBB5050D91AF24ABC96A08E7F0C5485066F266C331DE391E0355BF88D46
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb001.gif
- SHA256 ab33039db90f44dbb3c9967ab157f40805dd68311a441ce5e819c286a3569ddd
- MD5 b8d3f236077a74be9fc38fac772f1b16
- SHA1 35f80cf295803363451dcf80c8e1f2b8610785d6
- SHA512 a88b469bf08324ee4dc5679b4e8c574ef13b76be70612de910df088ab2bbfb177a6a447d622069735108562aaac68dc4ea745577d4c186412bfe4ca08a0feffc
- SSDEEP 768:+YHxPbV9Gj6mrD+XOsTwtCehVMQcKHaDM/d/pTsMq3mCmZg6EOCFwYGBlo3/Nan/:91hcj6mn+XatFjVck1rq3mCmZ+OI44C/
- TLSH T10C03F1F4E6883AAD96001CB9CE2644EC1CBCCC695D399FF06419215DE88B1CFDD785BA
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb002.gif
- SHA256 d68e785094c2f0016c735ad9ac891e2ea2b0b30b4f30d800446759ba0134b7ac
- MD5 794dedfb9768a5272ba8793933a3a44d
- SHA1 010de007d8aa5fc21319cc8506b2d20565b29520
- SHA512 fe2f5809f1cc2d0b3ac310a8b732ce4e014353056005ee6681c13181e3b9017d04f3ee1f8ba39c97dac00e944bbfb684c65de42e2092689d9b0f1c46d15e098b
- SSDEEP 768:b+hT5mgjtrq5keDgMvpxuTEVTpYsLBfy6NTgMxMcA3kZIGjTwR7ZlyImx:ihVdrS7xuTYhouhxZA3pmwRH4x
- TLSH T10113F14ADC997B9F37424995C61101F8E984CA738A813DEC9CAE936CD5897F9082FB06
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb003.gif
- SHA256 95cbcbd9c41c128ae03b8536ee229771a8a42e3cbf57faf4697aaabe98c11108
- MD5 ec0b47d2d9057ac9d80a3f7f6367de4f
- SHA1 228c3f34695afaf8a3c48e9268cf49d93a94db17
- SHA512 8a77ee085dc0b5065789757f310f0e4b02b9ffb4e00ac159b6e2bd4e6b6fa634344456b6958998bc6905dae95bfddcd3863dd0504f6daec3dce685e260f6dbbd
- SSDEEP 768:t2zuowW/tLmjkVspTBnJdZ/FobUD6f+uX7WxEWJgbrDGsCeQqkSOfr8Tvk2rQDKz:JX5usptDASe+uXYEbDTSqkr+EDI
- TLSH T1EE33F2DB50CE5F931DA80E4C7747C5EC26EE8F1E87146E3BC4B15E6881201E9BB8B816
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb004.gif
- SHA256 9f93891fe6aeeea23b10ae5aa680fd44e408b97ffd9df65cf0434fef1b049af0
- MD5 b743e2052f735e7e2f132d2843e53641
- SHA1 edf2545d4279ebcb965aa42523ef4a93cbaf67a3
- SHA512 0a16105b057875b105f217b40d8305feb7039f5222d7ecae7c329ab1efb1e4811d4ba111124b4bf5cd40f6bcac843a99444795dd296cd97cc01547cb4cb6cd20
- SSDEEP 768:h15afPZKJVPAQwrR2LFMZAVXeOVEq9VYLspbC+yo9KZz57AfLKwOEFqvNiIHhUXA:mcTABRKyZAVrVEq9GYla74fLSnQhZWh
- TLSH T1FF33F28788C5385A07EF9C266ED53859399C7B6C3FDEAF10416836C6A179803EC0D32B
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb005.gif
- SHA256 0d177be82265d4458b9ab22efc15418128742dcd60488a5bdecd5d334164dedc
- MD5 618feaf37b7c85b693ce5ae0ac51a508
- SHA1 d648be18ec2d54a7fe5e808517bea12e19a70fde
- SHA512 9ba910a321de102eb56662acd4236030e64fdd0c026a8a81724b21ab0c0a9b6be7a45117730fbe27eeaa49e22a9ac746d48a8399263c389a338765d8afbdb0c9
- SSDEEP 768:vbU/XQVgW2Or+FxTa5z1JQRKqYS/WQ6Dy3tn65XgNQDdtGSkzooq+laZCYfEtkN6:TU/XQVg5iATc/WK1Vy9YXgyJioofl3/p
- TLSH T19C03F1390E82957696718F5F5D99ECDEE4C06DE858581A0A18F820FDCCD82CAF05D43F
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb006.gif
- SHA256 3f5adbc7bef95ac98d78d9b2e2f25c1b89dd6a14b02ad0c6801de51fe1e48843
- MD5 0058727d44f8467d8283250a0b43556e
- SHA1 f2b42f0abe25803dd04b87a8512de171034c27be
- SHA512 520620f5b52a062d3b37eb866cf731ac0eb876683d929db7b84777c40cd645364c2c715aad50e87951ebf483cd4f45efe00319be1a36d63248b4f4d9c611350b
- SSDEEP 768:26VCMbPonLGwj6gH++FblMLED5QBoJ+hfdOKMMY5l5BHwNRIj/pbVgd:2683nLG0rD1l6EtafBQhB5l/Hg83s
- TLSH T17813029A836170BBD485783D21E217573EA247C01B662D73B17C3AE2E61740E6CCF5B9
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb007.gif
- SHA256 292ace5abc773d1dbe3db5c3a51d42b11a360e22b17643209b30f5988e437761
- MD5 76a8d032c940da779016d3e356401758
- SHA1 2d60e50d4830e1355863544effef81a153867503
- SHA512 63abe8edd5bb928c4b594aded6da4e82efac7ea7ab086f2e5509391b1e0f5cb3fa6b965ffa4ffd342869d16d02b4c42e8b2c03b6b4a6fead8de581624d8643cc
- SSDEEP 768:YjtOV94dzSId+OLzdlaSlQKaIJClau221xTjLnQ/ke:atOV949SyLfdXGIY5B1xTjj7e
- TLSH T1CCC2F158D0BCA66E9DF0CDB4080198C91305A2AD7FF1CD51E7E97075A60888FEC0029B
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb008.gif
- SHA256 bdae04f6d7694e1981771c0a76fc555009dae6e56f2f11f8fdff87b2d9dd0797
- MD5 517e6ce305c098d358d27e6a606a4e81
- SHA1 1f90118a88f4593ea4dd748526180f6c69ee617d
- SHA512 044a47bb0115a0b8ec905f4b433acf00866e5faf4349e57aab219c80641d24dcedaed17a170d7bd7eed2e2727daf80fa6eebdfb95791bdabd1dcd2fc80ee9b9a
- SSDEEP 768:dchLzR9ww7Yar9fX6zeSYiALxe+WATWk1rvZfYYff:dcT9ww7r9f/SYiwxe6TWaphff
- TLSH T107F2F17BA06DFABF6E7009D0467FF05A600850B6006583E0C67E88E6C6C4FA37C91A97
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb009.gif
- SHA256 b5cb2f91a884e832c0eecfffbc4b0f6920a67e0513f3e2ac9130bf6b744ad146
- MD5 62b85bbb9df60349a7c0d8cb06e090e4
- SHA1 4c231a467127d6cfc1118fd51a0b0220296e255a
- SHA512 87e6608e33ec84ce04b20a44c69d1da3ca9f70b7f8542739456b27eb1d8c589f3cf6f22ca1b4777d0135e55f2f7e15cc5306736a5231bac81acb6b5d27f14134
- SSDEEP 768:RE/q4lw0oh+UOlsD/KWg72UKlkLTNVSmhZKwDM5nwHYkOBVJCdEPZhLibZC:RHPTqEKWg72TkdcgZK6Mm47VJCmvibZC
- TLSH T1590301F31A844666E53EDF71DD8A4F7C722F8E15C41ABCB89C0278BED3A0B611709512
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb010.gif
- SHA256 a16ddc10725a33dd91e617de97cfad7372ee33bbdf195312b70b1d10194b68c7
- MD5 79a9739cb814396f6cda31b59d3d87bb
- SHA1 2993f8102994a1e238cd48541cad333ed950e88d
- SHA512 2a3e5fb4e102134aaab34d72246b194bba61b630e5e6ef7ced96574a137723cb716eb1d9a7350b4981048fcdb1f496d11fdcfa9edb5007aa06731b8ba09c62ef
- SSDEEP 768:VAcmJclPBwQ55QaOCoJ8qDjgWceZXLghu1ymtGDZeZEGD:VMult5QbRJ8gkWcGLGDZmT
- TLSH T15713F198A2D0C0B8051BDA1FF9D551BCE09439DDA963DA1C06BF35A8FD06DC8F4A2D98
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb011.gif
- SHA256 741f4194e099e387d5b81753972074c2ec9944b36b442ee90f02f2e05a49e2f0
- MD5 0420a172f5c3b557a58b9f51ed8c6249
- SHA1 07c58efb0135071854091f6b3c504b380c971dd9
- SHA512 eea3706f02d068df6e7f6744dc391400950cd635cb966fd224bd7818f140aea02e9389614e18887271cec6a167e699c36d37d2c972724222b9cdf978176ed755
- SSDEEP 768:st8xDwGhRTy9eLtvLs1g8mmymVvt5NGHlpOdSlxUEkpFzTVbJAmmhIaxpnK+L:siSGGeLixFymVpgl8Ax0ZJcIaao
- TLSH T1C723012CF2961DCF02FAEE3CD8ACF8E12C95367099CA094D195DB4E7B14A1D54602E8A
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb012.gif
- SHA256 47f4755a428995775089a622f33eb54c4505d8a6ad7963c6de646de0b2156017
- MD5 03ac2cf533ad921fa2e570449c398d60
- SHA1 b77a69ac67cc2ac113d997bf3c3d4cacd60b193d
- SHA512 74acc8d75fcd3fdae5101b401e84042b6c04b3bd2347937d007201ffc9bcd06b84915beab9f58b3e1f0c09d9f49660eb979ff1d0d75db1e3396c31a5ebd0a794
- SSDEEP 1536:8sTliWl9zQWGOEsaEfG3D+gZvRy9Zug9xj:jliWl93ysaND+gZMtbj
- TLSH T171330154506FEE6C1DCDF38ADCBE636C1221B1DE72DDBA90C8C171A9B5E0089A81B517
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb013.gif
- SHA256 f7eebb0ae58ea8e64160bf2bf8bab0955603c0208c3bfb760d89d01088f042c5
- MD5 5ff48f51be9c3bed3e81d908c08d7135
- SHA1 7673287c411d65538b7e60d1e51a92d1acbe4d07
- SHA512 c73ba4a996fa14f3ea9e70f6a1e980c3cb0d0ed57efa8b8d241a99ea2155bfede9d898e6404704ee005c9de130777a4d2c364012398fd839c5966a476ed05d76
- SSDEEP 768:2le+/ymlYswmymS3k1i+tWHbW31oCBYTWaoTYokjQ+8Mn7YjQA06p+MqIryP/a:we+/xLKk1htWHilRCTWak4Q+9YRIx/a
- TLSH T14123F1E2CBD650132C8CC8FA7548C23D3656B1EB1D03EABE149341E6C43369E1E225A3
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb014.gif
- SHA256 963bb112090949111b885ab790c9e032784d9dc6c0fb3388f47d011f5bdf6c7a
- MD5 0c47d03a6d75689e2f84b925f87561de
- SHA1 4782d1a60796d24f2406e35d18ee4c8fef59b64e
- SHA512 c4e96977c2adfcd69cff2b22ff802bda3ae0c0ae6bfe3e2f1800a430d2f06749e450b4a39132be3e58c20e39e333eb7c79386ab69e8efbdb6256959c4a5a5feb
- SSDEEP 1536:DFX9910RrVAcrsdRWc0Gl0wnM5fP38U64:ZX90Zsdz0GrKfPsn4
- TLSH T13B4302F9E6FF7429641960B6102BB246F63391E0B17B2322B8205354C11F89A76DCB7B
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/cb015.gif
- SHA256 84f12116cfbeeee6373bb94a0d878e134fff50d598d6f1578f4131d23be3703d
- MD5 b9d7d09a834dc4541967ab78f7d0fd03
- SHA1 9581e21ef862542ef9f6263ac81377c7f3469b0a
- SHA512 a879dbacb814e1495f73a8a56aa46edefc6523ef9badf3d1845b6f9b234bb4daaea8d9537fd0babc4412c577860a1378802fe0a1bbe28a71283e4d5105c4176a
- SSDEEP 768:+a9uy/miWwYeyCJnVfmWhhSH3BPyfdM9CKWb+12m+1YrxxlY:+rFlRwJVDQH3hKa9CKWbhAxi
- TLSH T1B5E2F1A2A1A13A4B1DE8B9C43C3644B60507588AAC3C8F7A4DD488F573B16D73DB8582
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonz and the Treasure Chest/page2.jpg
- SHA256 d0a1151ef42147b7ab8c9e88bf3b926c7249ddedf72bd1515303085bdf34fdd0
- MD5 3c449e12d7add81b7fd04f63989d3ab1
- SHA1 425b4d9ee94b43982a77ff1fd76aac16f9eb386f
- SHA512 750f18e49d22f7a688efe188a3b70f9c093ea78a0e85882fb02a8e0cf06e7d1eeb9535ab11bbb064397b75b9e27a6407dd5c5bea2bcf4780c54f94ecd30a4073
- SSDEEP 768:wrEp/YWpbvISLptFtaPrMqSBGX+dLwjVwRSTWwujiOfJQSp4waDFqj5fRrPyqr:wrm/YWpkSLTFSlSBGX+dxRSTwGOfJvyI
- TLSH T1C223029751315912FEDB0A1CD86AD32823900AD2335BAB5B4C3D53EAE3863E3147D71C
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/book
- SHA256 486c7e2d25096d871171fff1906c65f98e8c1fa888cc5c18558140f999274d4e
- MD5 e2b9604a4c6c86aacc681d8e2e6b251f
- SHA1 39b684099529adb2bfb78d0dd1233b03c9fc6528
- SHA512 6ad292e3d20dfd42228387181322ec6d4622d35b85829910f760a3fecaf110a93f000e3cbdbc575cf8a95f6d621af04b973e7c027667f8b9adfe90273464c632
- SSDEEP 192:2dhYeuT6k+F9xD8oSWMqQsCNHmYUlIkXm69Nr9RmK5I/RVT90EwYvysmi9DCaTLU:uhTuwZDtS7q4mYUKkXZ3RmYYlaEDKsDu
- TLSH T11C229F4A4C773E464135CA2B847118A77C961CE2558D32F5B4FEED77831EE8AE41CE09
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page0.jpg
- SHA256 0b4aa121fea4ff7a39bc48136ec58799026d6ead1a41672832ca92d9dd8e5c7b
- MD5 020c58862bc4617cc06981e6ac06cb54
- SHA1 18b7b419214d8c26961ccb1f9a06f1b9a71a234d
- SHA512 519d6f213872c85d7dc19585ec21de94652f8e48e25b016231dc3e88d164f2fdafff4849dda86bdd3625121290f9e70a05fabeec17bb163dd4628479af6509dd
- SSDEEP 768:RdRPr46b+s7NMjLtEixWUpFYudummIQkEhFtdO8kBMgBuqow+/:RPNb7NMjLtEEpfAmuXd7kBru3w+/
- TLSH T197F2F20B7019ABA9AED710F18B95F840676E1F20E29BF7E1169D314DFD458EFE486031
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page10.jpg
- SHA256 dc60db3b80e4c049bf870b2ce9981fefba35fba7afba5e60d75b9c0dac8ee141
- MD5 e86ba8546995f30e9dd40e363f7de50d
- SHA1 4cd4146839f61ae3709849a33a0bb95cba76d9ad
- SHA512 88b50c7f7257d9e58f554e1d11cbcda57e30f56ce434a240f07152f6cf85ce4369e0185a9c3c96b18b886c22f35fae1383bfc79fb2d8c607659cdf5e19a5e450
- SSDEEP 1536:2Fm73QnnMfnpsGG3BSg8LJ7/a7CKNZOPh3OsDXexTb7qk:V2WnyGQBSg8Ld/sw3OIonr
- TLSH T1736301B3D35AFE38FB96D7318034344307A5E560618D7A3AE02774654080F694EDABFA
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page11.jpg
- SHA256 6a584c706ff3383b476fc4e55e7c16f0661c30c622237094f302db2f6cc7238a
- MD5 7e1f1a4d240a827c40e9f3cd47d169e8
- SHA1 a8587b711a0cbe45d6821750baf584d629e8c8d3
- SHA512 30586da3a9227a91fd3437f9fc1aed54198a805ab970dd221bad7aa6ea47be598455ae54e3e5b664b01f60fe99736196f42fb832a10613b570ad162a4647bfaf
- SSDEEP 1536:EFBCyvbFj4Ym5hzx6xGfzRlJIKpafsJhXdtkNfU:aBLvbFtm7xWUvoChttkc
- TLSH T1A65302EEEE96A7576EF3A3DC8F7D0BE4827ECDC6672A5B0091A3FAE541D08451C09110
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page12.jpg
- SHA256 01006d2e7052d985101f0bce9c901c04fd55cd1cfb5e2d23385396f7e88e8fc0
- MD5 739c4dcaad2aa6951b4c6b924d4078bc
- SHA1 c85b0346d0bb95817ee94042b5e6bb4c1dd7065e
- SHA512 a22e34ac31a6b8d98f8901b5f75faf0f5ee5c362781bc81d3135ef48cc63a30613f6db120b3716ff0094fae016f0be231557c41e31c6f40f8ea8bb2bb7d2aca1
- SSDEEP 1536:NkhuqZWoh/DzWx2vcDThLAQTAgZ2XZCIwHSbEDDTumwl1A:NMuIWozjvOhLAQtLIwH2EDum4A
- TLSH T18C63021B932B9538F0A205A415B7C700D8D3678D91BA7798D1B44C2FBB5796E5302DCF
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page13.jpg
- SHA256 013fec11189038bc36ed28631b90433284e839188c5d1e69c5533ea8e1048879
- MD5 ee0221e955f4c4ed8dd1ca3a59cd6b23
- SHA1 726cd536a91ca93392c49af94daea762d514a5f4
- SHA512 3ef1e86b88612a50df3a75d0f401f811b149a0edab1ef5e3527c1fe47df9b5d46d207379f68726402d519bc4af53a18ae699780fd6770bf8068962d41ffca60c
- SSDEEP 1536:vYUq+L5ynpAzsRmlNMvzBfFXFrkX0teK58NB/tecuxb8BgzFNbR+XhdaIIw:AskR4NMvzB9XF5teK58NHnubz3VNRw
- TLSH T1D58302172C6EAF1345AA4A84BEFB9D396B64520C7C5A03BD93248DD43FD42053CF554A
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page14.jpg
- SHA256 8882f1cf6f0cae626f8677ff3d1b415a5df88f32b7e6f94690a5997823b4916b
- MD5 628fa9eb07409a1cbb50639f2c6f29f3
- SHA1 e1f92ed329cd99f69112059b8f7e60879ad4ffc7
- SHA512 68b53043af8a63a559bb1f3490a05d604bc5bd54e38d9121bb5730c12e8d1a6a0100ddeb86b705e0f6f38f6dcf3e20a3e8ab6e9b062a3c7e3d3429712a0c5735
- SSDEEP 768:fbxjis58lWlrGO438roNrLQDE/nEM+ugAplEq+k718ZVkuw3Sc4f0n1zEPyBmDTI:Vji2a18Ar0D2R+6p/18ZVFynuqBrxx
- TLSH T10153023D1F1BEAB544EF570C552BAEB96A0CC4B40558C38DDFA71E6058B06321A71E23
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page15.jpg
- SHA256 e71359b05df80c15916fb273710c8a87702af891b11734663cf538a6baf0a32d
- MD5 3e720f815cd37130935c0be313d7fe4b
- SHA1 7005998c4541f6da091379f748af5394fe2b221d
- SHA512 b665452711869dd9d774a87daf988041b5538d6bd903bbf7038193af9e13ecfbad9420dc50f03486995b76082c07d03da5d67a0858d2b0325e51a8ef8814e295
- SSDEEP 1536:piZP79KnuHPQbQVWSoFaAOgZMVJ6pdEPbjjahJFcfQhjsP:piRJKnifY7AAOgoIpWmhJyasP
- TLSH T16E63028F650A16198EE7A97964737CDFAD4CB1C5214103BC38269CEC38759ABA33397C
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page16.jpg
- SHA256 0f36eb4f571237452098816d03de25c9081625391a2295a5db4cd0a01933ddfc
- MD5 4f25fd90fff473840ef608d23efb3967
- SHA1 76e3b424c934e67d35fac4419f8b5561ba1f133b
- SHA512 99b21e3431865bff3b9ad871a53a874d382b8612f1651198d03190e23e189dfaebeccde2e85ac8b59148a7c44487187ebc4b86c5c9d08286b3e27497a4e57306
- SSDEEP 1536:GxGDEPNNsYATLmhH2kqjFKeXcY6l94WH95ACH:kGyNhAClxeXcb94C953
- TLSH T1284302512F825BD390B3DAB14C78ADEA83957F4E01609DDF5A392E4DE1700B305A3626
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page4.jpg
- SHA256 d635654cda3fff19815d46e1ea912291adb2c553933709826c1a167b6b77dd53
- MD5 fb612fa0ba27a05bdb5f2afacc5c9f74
- SHA1 8b7ea2536a030b69c0e0ef578dd30897f4078768
- SHA512 b86f8ae215a03d8f594197245f11617dbed4ca314eced6f8c7a6502e1313849a5d1ba7e08e001e8514f168d1c8ab7bbc87081c183ebf21608e086140ab74a97a
- SSDEEP 1536:huG0NzAOopB02tyZz0iwRmjyuo5GD4wXjt/C/+:kG0N12tyZgiwRmOw
- TLSH T1B063026B96043B0BDF9941FB43B09D3114A5DFA82B41062E7CFDA94EDAC2C9D64A20D7
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page5.jpg
- SHA256 38be8805a0cf6c7d34cfbb7256242d3e0aea0f3d36185ce6e73c7284bdd87e24
- MD5 91fd681cdd4a73a0c0dc4da4f5c2dbc7
- SHA1 8c4df7e7b87ba388d065a5732d2a48f2a2b4d5d4
- SHA512 e01db87b87da9b4638ab9ef6a01c1440ca2a2c678563a0ce8eda219989092e43e94dce53778ce240296659a3ccb923a29ea142198281c3245cc5d2ed666f2611
- SSDEEP 1536:ruHXejb6uYKmWWW84lfsOk2iTXddFrRufuBiCeQGw6V:ruHXejRPlk26V8fuACDy
- TLSH T1A253021BEDEE9E8771017A7666B40F528DC9CE88195EF77F5AE01B01429AC01E3313E2
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page6.jpg
- SHA256 42a92022a12be3db39db1ed564edec32f031ec177da4db128d207cf9a9a83f35
- MD5 2912f5369e6bf38e93649275d9f96b6e
- SHA1 f5be690c042792ab01350238617fac858f79b312
- SHA512 e5b4dd674fd8dcd34e3f54c33b521226144ed841e0f379958f51fbac0fe1ce5e10af8ba825f0958ba9caacc6cf60080433816fc16ccb8b3532557a26d4bb2f6d
- SSDEEP 1536:nl9Ud5JMd/NwSMfrJbOqZsDCfsTz/KE+USZacH+1Sj1DWq1BLCXXm/kjQ:lzd2Smrs4saE+tgE1DWq1BuXX0
- TLSH T1776302A6EA5FEE8486446188B0C985E9014C4F45EFCFD2B43E720E6DFC4684A79345BD
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page7.jpg
- SHA256 db7027e0f7d02fe75874ab15de847352099e36bf10650c54c860e4fdd301d418
- MD5 60447490b257933c2de36bffbdfe1f7c
- SHA1 375aec1f6c66453b0f0968dd497e668ea1695e31
- SHA512 1bcfda7d1a75e1f39a16952e99f27bc042601b167caf230eb7bb78f32ca18ad9be7670708f6c5be99839fece81bff4d9a6aceb753335644e49edc77d15464bb3
- SSDEEP 1536:e4grkaCdT8o1YhpD87E6nVCAwfMAvW1PjHEiiw6H/zL1iom0G6:orkaYg5LD87H+f1vKPjHETHLh7NG6
- TLSH T145631256857E0870B43819EF493E08231A1F7EAB9DF8FF91513E6239E8A40643955E3B
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page8.jpg
- SHA256 d8333b0964148b5263793ca0493f40c373a47ea53fb3fd637f1431f44c414b7a
- MD5 05de4b67553680cd23c5fa741b6991a0
- SHA1 13123c66da9c4997142e991adc6bb952cae57713
- SHA512 56be6cf453fe8c346d8723d2fc6b3cf5f4d1f22b5fb791b43a4fd9196308fb2163207e58082e5a764d52647d5b13bf846a2b47a1912dbe44f6cfcb3f7f7667a7
- SSDEEP 1536:5rWjXQCP9rnV2UBB8gPS9dt7Hhp5lWuFGxZngs0FTYLu+l1Cz:hOXQG4A9S399IngDTYLui1E
- TLSH T1B26301BC0CA58738FDFFD0CA72701BA054C60665E475E129CB6929B0926C07F9A758DB
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/page9.jpg
- SHA256 c64ce0ded53d511f9a6deba02741d37e5c96e760bc34b294f546931c14d8137a
- MD5 4b4178dcdd926771e2d601f07edf1e55
- SHA1 3b87b64c316e43c46466b4b5b5d77112a7d6caad
- SHA512 beb93360b8c1e3373d2fdc04afd7fc018033045918cf0587eca94ba65e4361415b29f0c779a86101ef1146072a88e2763552cc20c877b8816841a67d39a0bad9
- SSDEEP 1536:mLxi4xcD/EvePlKNlu5WmvQF/vRBqMq2Gh6gm3n0O6:mZxUgLoTItpBqM+6j0H
- TLSH T1076302C4B4098120BCA49E634076BD72317B2BF631F02B1D592D8E72FD39D916E39D86
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/sp002.gif
- SHA256 92d4e729520977fe8c3cee533c7e259ab5ab67810f36c557c747ca821bc19ca0
- MD5 f1d401ed4184aa59fb75fca83e854fd1
- SHA1 f3742178548022de8b6534817ff90c88e76ee6f6
- SHA512 e745de3058317d6bad692880afc00d9362619382a71d8ecac79045d3cd8d37aeae91a2a4eb87f3fac6273f75e6f80b1809c2bc9d0a175f5f0dd7fdf5904c3685
- SSDEEP 768:BORzYNblHKMKRka0FspUmilhAgyf6A9UTK1blhVsZcW7pEGVIP6O:qWb1KLRka8kLivAgy+TqXVseW7SGe6O
- TLSH T16703F294BB72774A86E21C51FD1F7DE5D2224C5230A5422BAC1D7C079CD9B87EBE1381
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/sp003.gif
- SHA256 6078f5e78caa39fa31eaa23ab37e6939003b99e67a0c843335581cb8ec7c824b
- MD5 e964851042773d0809582fde155b22c7
- SHA1 6d8879362935fb3ab9364feda8fb78d30cc22187
- SHA512 887eb03eb987df9c95b17ba93ad044bacae6dc9354eb5b994bfe0cb1a5c0959d360b3437f6eb4c8650176cd4cce9212bc5d5b9ba40359c0c33429391733cfd85
- SSDEEP 1536:ycq7Eb2AjR6Osri/dD6u8K1PR7SEurrshS:5qIhMOsrIDL8K5R5+oE
- TLSH T10F4302A7D5EF33543296D612E21CC35CBC4907E79E3431B2E8151BAD2F1A85D1C1DB98
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/sp004.gif
- SHA256 e113e023fc04095434a417689f7b436a4e4120427c0f7368beb89e48e6ad6616
- MD5 501eae9da0aebf0c28706d3e3a831f17
- SHA1 265db0cdd91a9f77dcb6d0d23884d74adc068ecf
- SHA512 7fa85df145f470b74a2889a06d39c48dda006b0f85d13b8b8da5574ff8ba10d18965b57b5e6fcc577b09ccacc723446faff0a6b0d6a3ead512fb6b4cd8237501
- SSDEEP 1536:tNhcPTn+07ba0Ns/yrglBbEKxEPblDXo1CDpiBy+cbb:fh+n+0i0NkbEKmJDXzIBa
- TLSH T1C76312303A0DDF66BDE901FCD7EC7F90E80474EF6925429D2BCA94F716D1AC80A46922
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/sp005.gif
- SHA256 f30c86b0ffc248ab421f3d2cdf6dbfa1d7c3504400a8026b8548d8161c4fb081
- MD5 07d266b7a8c8499c57452f6c50046167
- SHA1 9e63e66164e18b4e6e151137316d92872ef9d470
- SHA512 f3825788af9bb7c20e094f3652fea15b8beed76d78be231477d7ce4a1d13e6162ed451427f62d60c5bc7a434e539932fa7e41b81ef9675a749124110ba766a04
- SSDEEP 1536:q3PYoSkN3NBk/moEKwg/A83nlIMOV2XL/:q3QuB6l/pXCo/
- TLSH T173430282E58590B9A8AD8EFA21965E03DD93FD672C624436258F20FD0076C1FAB7C747
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/sp006.gif
- SHA256 1341f0db796d31c7382655362a682a45f00d5160ca149ddb0e13444bb622d9c9
- MD5 1b853f839789d4c8a1d47393c06b1f25
- SHA1 c65cab86f2dec503fc5caad740fbd1e81c1c0f3f
- SHA512 60f523d36a5251dfa8ce373f046e246543b8b9b44b1beead17d9f2c6fb4ec6fa1cc3557c1342b1f8e90351d69023807ce415afcd92733845298f3e65a9e93c48
- SSDEEP 1536:eAPVvk1I1VcCJR0VSIU+e3rMyECQqOamZL9Z:eH1I1VcCMwinntaG9Z
- TLSH T13F5301AC9173E56C6F57F2665304E0E701CEB34EBB44D0A4D0126D72CEA62C06E4E66E
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Books/Bonzi and the Alpha-net/sp007.gif
- SHA256 4e7c34f76e045cf1acdc64071a7fe2d31fec2864d89fdd87e3d79e37dabf30fd
- MD5 934535182612b7b90377550f6f1a7a49
- SHA1 7fa2911dc190050ed7059259e3e55fb3ba3a0956
- SHA512 44c2191ba807d53c0cad1a3297f5a114f15d270f80cb8900f7cedb432165d2f741f66c05bb724666a534c917782ce3108273164e3afb13d7c311db9f80d8b9c0
- SSDEEP 768:0GaEbfiB0AWU76dfcTbXQvpmEeU/7ZafbiIuM73mwcbVLf5VPnhVRSDavH5t:0Hgo61cTbamIZafVLwbtnhVRYavHr
- TLSH T1E223021611E9D64CF08DA1FA831B5AE0C6A1DADE94E87ECB079E1FC6731C97501393CA
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/CHORD.WAV
- SHA256 1cdb5e4d203f61e94c02f5eea5008289fb463c02174879887fc62574b34c12d3
- MD5 e913f3f2201c09d938c63f10dc535bb1
- SHA1 1e326ad6d1c2c538c429235006e0fa64f9aeec9d
- SHA512 0838a26ee0d918cad1cec431ecd1ebe431f559951ccb85161823d234ae4157f0699d903af178b4af2d70046b04b29509bf1691f57c021f8f63dce579cbece233
- SSDEEP 384:ExbeoR5vhvSHkvbG+uAK68LeqdyANaWoH9MJlNHRGke+:KbeoN6k3uAv4ec/wWo+vNHRR
- TLSH T17882BF46B726971D3932922E7DE34CA02511BF6E1D78C066E273C600B933AB74E57B91
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Intro2.wav
- SHA256 1d648a27a0209959027567f793f8b3fd18a103b64e62eda3f20f11192bd0dfaa
- MD5 125f1998a1e8fd06bb02f6168b0445fa
- SHA1 d65ff4d8a79e47122ba872ee3f4986df7827766a
- SHA512 62cf29c85efff23449f2cf0985c1eb5d71111bf5332e6932129ab9e9ec4d2fbf819851fbb9ea73946c24fa6a1715d1aea6eef58c5e52de340128a4aaf5267c56
- SSDEEP 3072:vUF1vsEOPmTiWvqPNcHtPCChL7cuVzZDEoEvwLs:vU/vspmTlbz75law
- TLSH T1D5E3E132B8630F2117D6C111EAB26B201D5EF84DD9B63937DA9A8E14E602190F774FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/J001.nbd-SR
- SHA256 56ac8a4f90686b433297712de577ba68e0970458dee218764ed3acb3b3560f7b
- MD5 35c46be741382648dbc6c7241d1f7148
- SHA1 24fea5f70e437ecd40a37035d2e1ca3df293d0db
- SHA512 ebbacc846af47d3e955a43291626470c73296c874b7d80f0021ec577922f29f453ab5794925b6372b8a75b732677d7c27c16c1f8728ee60a57c66dc4a6c4d86e
- TLSH T139C09B4247054635D1C007D5A154341B02C5CD775031707DF75139C9FD4D48784F6735
- MD5 SHA1 SHA512 TLSH
$TEMP/MSCOMCTL.OCX
- IMPHASH 50ccb1d881ea89a41a10cced45c79649
- SHA256 3b6ccdb560d7cd4748e992bd82c799acd1bbcfc922a13830ca381d976ffcccaf
- MD5 12c2755d14b2e51a4bb5cbdfc22ecb11
- SHA1 33f0f5962dbe0e518fe101fa985158d760f01df1
- SHA512 4c9b16fb4d787145f6d65a34e1c4d5c6eb07bff4c313a35f5efa9dce5a840c1da77338c92346b1ad68eeb59ef37ef18a9d6078673c3543656961e656466699cf
- SSDEEP 24576:2EIDiOd04txdEa1C42Xp1C33wQjrDRjE4FSpUBqutFPJq6:2vtxdEas42ijRprBzR7
- TLSH T1B9352A1277E58022D0FB2670197B27B59BB67EA16C39E54F1B50360E2D32E82DE35327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2d:27:68:6f:14:8e:dc:1d:6e:89:fd:5e:ac:54:67:dd
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US
Chains
Jan 1, 0001
Subject
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Serial Number
03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10
Issuer
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Timespan
Apr 9, 1996 - Jan 7, 2004
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US
Serial Number
55:0d:88:f5:3f:64:16:d7:0c:73:00:d8:45:92:16:34
Issuer
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Key Usages
KeyUsageDigitalSignature, KeyUsageKeyEncipherment
Timespan
Mar 19, 1999 - Apr 16, 2000
Minor OS version
0
Major OS version
4
Entry point
80520
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
LocalReAlloc
GetProfileIntA
RtlMoveMemory
LocalSize
FreeResource
GetCurrentProcessId
MulDiv
GetTickCount
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalReAlloc
IsBadReadPtr
Sleep
WaitForSingleObject
GlobalHandle
GetThreadLocale
LocalFree
LocalAlloc
GlobalAddAtomA
SetFilePointer
SetStdHandle
FlushFileBuffers
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentProcess
TerminateProcess
ExitProcess
RtlUnwind
GetCommandLineA
CompareStringW
GlobalSize
CreateFileA
GetFileSize
GlobalUnlock
GlobalLock
ReadFile
CloseHandle
GlobalFree
IsDBCSLeadByte
GetModuleHandleA
FindResourceA
LoadResource
LockResource
GetLastError
GetFileAttributesA
GetVersion
DisableThreadLibraryCalls
GetProcAddress
GetLocaleInfoA
LoadLibraryA
GetWindowsDirectoryA
lstrcatA
GetModuleFileNameA
IsBadWritePtr
lstrcmpiA
GetLocalTime
GetTimeFormatA
GetDateFormatA
lstrcmpA
GlobalAlloc
GetVersionExA
GetCurrentThreadId
MultiByteToWideChar
CompareStringA
lstrcpyA
InterlockedExchange
lstrlenA
GetSystemDefaultLCID
lstrcpynA
HeapAlloc
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
HeapReAlloc
user32
DrawFocusRect
AdjustWindowRect
DrawFrameControl
TrackPopupMenu
GetMessageA
AdjustWindowRectEx
CopyRect
GetKeyNameTextA
ShowCaret
SetCaretPos
GrayStringA
HideCaret
DestroyCaret
CreateCaret
SetWindowTextA
SetScrollInfo
DrawTextExA
InvertRect
SetRectEmpty
GetShellWindow
SetKeyboardState
GetKeyboardState
GetScrollInfo
GetKeyboardLayout
DestroyCursor
GetUpdateRgn
GetUpdateRect
GetWindowRgn
ValidateRect
CallMsgFilterA
LockWindowUpdate
IsZoomed
GetDesktopWindow
GetIconInfo
GetCursor
GetForegroundWindow
InvalidateRgn
EndDeferWindowPos
EnumChildWindows
GetDoubleClickTime
FindWindowA
GetMessageTime
GetWindowThreadProcessId
RemovePropA
SendNotifyMessageA
SetScrollPos
SetScrollRange
GetWindowTextLengthA
EnableScrollBar
ChildWindowFromPoint
GetDlgItemInt
EndDialog
GetActiveWindow
GetWindow
GetPropA
GetCursorPos
WindowFromPoint
GetClassNameA
GetDlgCtrlID
IsWindow
SetPropA
IsWindowEnabled
IsWindowVisible
UnregisterClassA
CharNextA
MessageBoxA
SetActiveWindow
CheckRadioButton
SetFocus
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
CheckDlgButton
GetDlgItem
GetDCEx
DrawIconEx
CreateIconIndirect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetClipboardFormatNameA
SetCursorPos
RegisterClipboardFormatA
MessageBeep
RegisterWindowMessageA
PeekMessageA
PostMessageW
PeekMessageW
VkKeyScanA
SetParent
CharUpperA
GetDlgItemTextA
SetCursor
CreateDialogIndirectParamA
GetNextDlgTabItem
IsDialogMessageA
ScrollWindowEx
SendDlgItemMessageA
SetWindowRgn
IntersectRect
EqualRect
MoveWindow
BeginPaint
EndPaint
DeferWindowPos
BeginDeferWindowPos
CharNextExA
SetTimer
KillTimer
DrawIcon
DestroyIcon
MapWindowPoints
CreatePopupMenu
AppendMenuA
TrackPopupMenuEx
DestroyMenu
WinHelpA
PtInRect
DefWindowProcA
GetWindowDC
SetRect
LoadCursorA
IsRectEmpty
ClientToScreen
GetWindowRect
MapVirtualKeyA
DestroyWindow
CreateWindowExA
GetSysColorBrush
GetAsyncKeyState
EnableWindow
PostMessageA
TranslateMessage
DispatchMessageA
wsprintfA
DialogBoxParamA
UpdateWindow
GetWindowLongA
SetWindowLongA
GetDC
ReleaseDC
GetParent
OffsetRect
UnionRect
GetFocus
IsChild
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetMessagePos
ScreenToClient
SetWindowPos
SetCapture
GetWindowTextA
WindowFromDC
GetClientRect
CallWindowProcA
DrawEdge
GetSysColor
FrameRect
InflateRect
FillRect
DrawTextA
GetKeyState
GetCapture
ReleaseCapture
GetClassInfoA
RegisterClassA
InvalidateRect
LoadIconA
GetSystemMetrics
CopyImage
SendMessageA
LoadStringA
RedrawWindow
ShowWindow
CreateAcceleratorTableA
ole32
ReleaseStgMedium
DoDragDrop
RegisterDragDrop
RevokeDragDrop
CreateStreamOnHGlobal
OleLoadFromStream
OleSaveToStream
CreateOleAdviseHolder
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
advapi32
RegDeleteKeyA
RegOpenKeyA
RegQueryValueA
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
oleaut32
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
OleCreateFontIndirect
OleCreatePropertyFrame
LoadTypeLibEx
UnRegisterTypeLi
RegisterTypeLi
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
VariantChangeTypeEx
SysStringByteLen
SysAllocStringByteLen
OleLoadPicture
SysAllocStringLen
VariantCopy
OleTranslateColor
VariantChangeType
OleCreatePictureIndirect
VariantCopyInd
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
SafeArrayCopy
comdlg32
GetOpenFileNameA
gdi32
Arc
GetTextExtentPointA
GetCharWidthA
OffsetWindowOrgEx
ExtTextOutW
GetTextExtentPointW
Polyline
GetTextAlign
SetTextAlign
OffsetRgn
GetTextColor
CombineRgn
GetTextMetricsA
MoveToEx
LineTo
Ellipse
DeleteObject
SelectObject
CreateSolidBrush
SetViewportOrgEx
SetWindowOrgEx
SetViewportExtEx
SetWindowExtEx
SetMapMode
GetDeviceCaps
CreateFontIndirectA
GetObjectA
SelectClipRgn
ExcludeClipRect
RectVisible
GetClipBox
IntersectClipRect
GetClipRgn
CreateRectRgnIndirect
RealizePalette
SelectPalette
PatBlt
CreateCompatibleBitmap
CreateBitmap
CreateCompatibleDC
GetTextExtentPoint32A
TextOutA
SetBkColor
SetTextColor
SetBkMode
Rectangle
CreatePen
GetStockObject
GetViewportExtEx
GetWindowExtEx
LPtoDP
DeleteDC
CreateDCA
CreateRectRgn
StretchBlt
CreateICA
CopyMetaFileA
CopyEnhMetaFileA
GetPaletteEntries
GetDIBits
CreateDIBitmap
GetBitmapBits
CreatePalette
GetNearestColor
CreatePatternBrush
CreateDIBSection
CreateHalftonePalette
BitBlt
SetDIBColorTable
GetDIBColorTable
GetPixel
StretchDIBits
SetBrushOrgEx
GetBkColor
ExtTextOutA
RestoreDC
SaveDC
CreateFontA
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
686KB
Virtual Size
685KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
279KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$TEMP/MSINET.OCX
- IMPHASH 96286284ff8e040938ba779778d1542e
- SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
- MD5 7bec181a21753498b6bd001c42a42722
- SHA1 3249f233657dc66632c0539c47895bfcee5770cc
- SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
- SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
- TLSH T1E3B33802B7E2417FF7A627346AF65BA95EF77D153C26984F9300328D5A32B40DA24327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2f:46:b1:b6:11:28:7d:70:73:30:59:e1:8c:1f:eb:8a
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
4
Entry point
4860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
wininet
FtpSetCurrentDirectoryA
FtpCreateDirectoryA
InternetCrackUrlA
InternetSetOptionA
InternetCreateUrlA
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetFindNextFileA
FtpDeleteFileA
FtpGetFileA
FtpPutFileA
FtpRenameFileA
InternetReadFile
InternetConnectA
FtpGetCurrentDirectoryA
FtpRemoveDirectoryA
FtpFindFirstFileA
HttpQueryInfoA
HttpOpenRequestA
HttpSendRequestA
InternetOpenUrlA
kernel32
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
HeapAlloc
InitializeCriticalSection
EnterCriticalSection
GetProcessHeap
CloseHandle
LocalFree
FormatMessageA
SetEvent
CreateEventA
GetLastError
MultiByteToWideChar
lstrcatA
lstrcpyA
lstrlenA
ResetEvent
SetLastError
lstrcpynA
WaitForSingleObject
WaitForMultipleObjects
GetTickCount
IsBadWritePtr
DisableThreadLibraryCalls
GetVersion
GetFileAttributesA
GetModuleFileNameA
GetWindowsDirectoryA
LoadLibraryA
GetLocaleInfoA
GetProcAddress
InterlockedIncrement
InterlockedDecrement
HeapReAlloc
lstrcmpiA
LockResource
LoadResource
FindResourceA
lstrcmpA
user32
SetDlgItemInt
SendDlgItemMessageA
GetMessageA
PostQuitMessage
GetDlgItemInt
GetDlgItemTextA
SendMessageA
ReleaseDC
GetDC
CharNextA
SetDlgItemTextA
SetWindowPos
SetWindowLongA
SetParent
EndPaint
GetClientRect
BeginPaint
GetWindowLongA
SetFocus
MoveWindow
GetWindow
GetActiveWindow
GetWindowRect
IsWindowVisible
TranslateMessage
OffsetRect
EqualRect
IntersectRect
DispatchMessageA
GetWindowThreadProcessId
PtInRect
WinHelpA
IsDialogMessageA
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsChild
GetKeyState
CreateDialogIndirectParamA
MessageBoxA
MessageBeep
SetTimer
PeekMessageA
MsgWaitForMultipleObjects
PostMessageA
GetParent
ClientToScreen
CreateWindowExA
EndDialog
LoadIconA
DrawEdge
DrawIcon
LoadCursorA
RegisterClassA
DestroyIcon
KillTimer
DestroyWindow
GetSystemMetrics
LoadStringA
wsprintfA
DialogBoxParamA
SetWindowRgn
ShowWindow
DefWindowProcA
PostThreadMessageA
UnregisterClassA
ole32
CoUninitialize
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder
advapi32
RegEnumKeyExA
RegQueryValueExA
RegQueryValueA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
oleaut32
OleCreatePropertyFrame
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
SafeArrayCreate
SetErrorInfo
CreateErrorInfo
GetErrorInfo
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
VariantChangeTypeEx
SysAllocString
gdi32
GetWindowExtEx
SetViewportOrgEx
LPtoDP
DeleteDC
SetWindowExtEx
SetMapMode
SetViewportExtEx
GetViewportExtEx
SetWindowOrgEx
CreateDCA
GetDeviceCaps
CreateRectRgnIndirect
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$TEMP/MSWINSCK.OCX
- IMPHASH cb0275eec9ac31b6d4d44320e576fadb
- SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
- MD5 9484c04258830aa3c2f2a70eb041414c
- SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
- SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
- SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
- TLSH T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
69:2a:36:1f:e3:5a:77:be:50:6d:5c:24:76:db:24:df
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
4
Entry point
4932
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
wsock32
accept
listen
inet_ntoa
recv
WSAGetLastError
WSASetLastError
select
__WSAFDIsSet
shutdown
ntohs
sendto
recvfrom
connect
getsockopt
setsockopt
getsockname
getpeername
closesocket
WSACancelAsyncRequest
gethostbyaddr
bind
WSAAsyncSelect
socket
WSAStartup
WSACleanup
inet_addr
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
gethostbyname
htons
gethostname
ioctlsocket
send
kernel32
lstrlenW
GetFileAttributesA
GetModuleFileNameA
InitializeCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
IsBadWritePtr
WideCharToMultiByte
GetVersion
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
FormatMessageA
GetTickCount
MultiByteToWideChar
SetLastError
GetProcAddress
GetLocaleInfoA
DeleteCriticalSection
FreeLibrary
DisableThreadLibraryCalls
lstrcmpA
InterlockedDecrement
GetWindowsDirectoryA
LoadLibraryA
HeapReAlloc
InterlockedIncrement
lstrcmpiA
GetLastError
LockResource
LoadResource
FindResourceA
user32
EndDialog
DialogBoxParamA
GetActiveWindow
MessageBoxA
DrawEdge
GetDC
CharNextA
LoadCursorA
wsprintfA
GetWindowRect
SetWindowPos
ShowWindow
IsDialogMessageA
GetWindow
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsChild
GetKeyState
SetParent
WinHelpA
IsWindowVisible
EndPaint
GetClientRect
BeginPaint
SendDlgItemMessageA
LoadStringA
ClientToScreen
OffsetRect
EqualRect
IntersectRect
SetWindowRgn
PtInRect
MessageBeep
LoadBitmapA
GetSystemMetrics
GetParent
CreateDialogIndirectParamA
GetDlgItemTextA
SetDlgItemInt
SendMessageA
DefWindowProcA
GetWindowLongA
DestroyWindow
KillTimer
SetTimer
UnregisterClassA
RegisterClassA
PeekMessageA
PostMessageA
SetDlgItemTextA
SetFocus
GetDlgItemInt
MoveWindow
SetWindowLongA
CreateWindowExA
ReleaseDC
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder
advapi32
RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
oleaut32
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
SafeArrayRedim
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
OleCreatePropertyFrame
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SetErrorInfo
CreateErrorInfo
GetErrorInfo
SysFreeString
SysAllocStringByteLen
SafeArrayCreate
VariantClear
SafeArrayGetUBound
SafeArrayGetLBound
SysStringByteLen
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetDim
VariantInit
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
DeleteDC
DeleteObject
GetObjectA
LPtoDP
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
CreateDCA
BitBlt
SelectObject
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$TEMP/ODKOB32.DLL
- IMPHASH 4dbc86f1a708ba6684fae7efa63a5bf2
- SHA256 c4b58c78dc14e247ba303f630e42e9e56667dafef7aba1f0fdfd058b658f0a36
- MD5 94f66cd6a18efdb663a61f2025ab31c5
- SHA1 527afb33ff31f5ad1e60225081db34ad5083454b
- SHA512 e4c14a7db92c9c7b10950ee52f34be73138ced3873962dc5a875949c533d187dc2251b0d37e6f855d54018b8662b63a611b1f0a71fb5c4744444dbf86492ed1e
- SSDEEP 384:Hn4REhgb62Uw18UctNhOO6VXe2SPo2gLF5WaC+GN:H4R8k62YUe5wSz26V
- TLSH T1FD72399997D60EE3D4F62A3840F7BB276A36BB7807D1E5E38353546A18722D06839342
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalHandle
GetProfileStringW
MultiByteToWideChar
LocalFree
GetLastError
LocalLock
LocalAlloc
FreeLibrary
GetProcAddress
FormatMessageW
GetUserDefaultLangID
LoadLibraryA
HeapFree
HeapAlloc
WriteFile
DisableThreadLibraryCalls
LoadLibraryW
GetEnvironmentStringsW
GetACP
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetOEMCP
WideCharToMultiByte
HeapCreate
GetCurrentProcess
GetCommandLineA
GetModuleHandleA
GetVersion
ExitProcess
TerminateProcess
GetModuleFileNameA
GetCPInfo
HeapDestroy
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
user32
LoadCursorW
MessageBeep
MessageBoxW
SetCursor
advapi32
RegGetKeySecurity
RegSetKeySecurity
ole32
ProgIDFromCLSID
OleInitialize
OleUninitialize
StringFromCLSID
oleaut32
LoadTypeLi
SysFreeString
OBGetDispInterfaceOfCoClass
OBGetDocumentation
OBGetFuncDesc
OBGetNames
OBGetObjectAttr
OBGetProgIDFromTypeInfo
OBGetTypeInfo
OBGetTypeInfoCount
OBGetVarDesc
OBLoadTypeLib
OBOleInitialize
OBOleUninitialize
OBRegSecurityDialog
OBReleaseTypeInfo
OBReleaseTypeLib
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$TEMP/P001.nbd-SR
- SHA256 3e8554436a52336c84117905b7b2383fe1aef01d613440d4cea70f035aaee28b
- MD5 307f2e464cf4e0bb93fbf82037102e14
- SHA1 b35f620a6dd2d0b5d04d669d4e2bb65c9c41363e
- SHA512 d03df59f9ebd5040ec5f6fbd5c1e426d8f4881d61ac0e98423c26d39a56b170da6a3cde6bd231209739c9a89224220514371bab2ebc38f8d9e6d86c4a76721b8
- TLSH T105D0A7930B10539C56C404F18210331318E1C8032C9E402E7BC368DBFC1C50785A4750
- MD5 SHA1 SHA512 TLSH
$TEMP/RACREG32.DLL
- IMPHASH 23e6208bc8769fcfbe7438438446d2fc
- SHA256 054fbd3c3a31cea5c69c78c1455d19d2f3486e07428ea951f107d5dac3e58d25
- MD5 4e86f6e372d5f823e457ee5358b46079
- SHA1 75bf76ac7de2a577532965c121aa0478076eace0
- SHA512 73b55608c748479ddd4cbdb2046488972bc2e9340e8c6fe6cf9d0d9badb344de9f5e7ed66f508c47db402d9479066d7f0f4644ba6551cec6318a5a5a468e5087
- SSDEEP 384:IGgp/5m0wfOnnW8if3M7LXN5GeqfnWQ0TgEjb1qi:IGxfOnnSILXNdcClqi
- TLSH T132E2B616F3CAD1A6E11E03794EBAC2E557707C105E139B0F3145B3AD2D76E6758A8B03
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvbvm60
MethCallEngine
ord592
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ProcCallEngine
ord537
ord101
ord102
ord103
ord689
ord104
ord105
ord616
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=8167,
count=1, id=4, version=8142,
$TEMP/Reg.nbd
- SHA256 03b3858e5766b07b919d176b541a105faf76e1a28ba01e3593cc319ad87dc3b6
- MD5 7c70fdb75615a12b46140d8e708b7fa6
- SHA1 d2b5fe00939a1a53e249b7892b1d7d18f66adf45
- SHA512 632568205be861f532da9bac3f423306f44ab6b8874c1a8dd5872534afbb809081c861bff6fe041a2d7296a627f7a988059989dc58f0ba3b4162439525695b3d
- TLSH T17FD072E2000648CE2809CC32605FF7A338EA2C689802928B8900CEA584DCBA41A1F5AA
- MD5 SHA1 SHA512 TLSH
$TEMP/Regicon.ocx
- IMPHASH 5f912ec5bcd0130e5b96a6b3b06a3dd7
- SHA256 07e91d8ed149d5cd6d48403268a773c664367bce707a99e51220e477fddeeb42
- MD5 32ff40a65ab92beb59102b5eaa083907
- SHA1 af2824feb55fb10ec14ebd604809a0d424d49442
- SHA512 2cfc5c6cb4677ff61ec3b6e4ef8b8b7f1775cbe53b245d321c25cfec363b5b4975a53e26ef438e07a4a5b08ad1dde1387970d57d1837e653d03aef19a17d2b43
- SSDEEP 1536:5rPNWKPzHUIZurPA28AxaVgEbk2NRi6cVbAYAS9jbbx2+cW8vYvYBgbN:5LNWKPzUI8B+Iz758vCgYN
- TLSH T17973C602B3D7812FE69D0BB8097796AD08647D921FB0D1AF2791FA8C1A36D859D3071F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
ord519
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
ord631
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord607
__vbaFPException
__vbaUbound
ord537
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaStrToAnsi
__vbaVarDup
ord616
__vbaVarCopy
_CIatan
__vbaStrMove
ord618
__vbaCastObj
ord650
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
__vbaI4ErrVar
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=5, id=9, version=8041,
count=1, id=13, version=8169,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/Runtimes/MSAGENT.EXE
- IMPHASH b83464d8132ecd9f810820e192566e15
- SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
- MD5 66996a076065ebdcdac85ff9637ceae0
- SHA1 4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce
- SHA512 e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c
- SSDEEP 6144:SFfDAEl3mNlHuHgUaJG6KPHdQM6FoVsmzY4fPLrKHo1Aa1PyhPpcgiMg7:qUNlOAUao6edbs9eY4H3KHo1AaNy9pL2
- TLSH T12284F12393E08237F1E61B301AF14A532B74BDA56FB5DB8F5290804D1A73AD89A35377
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
24:f9:37:59:02:7a:04:26:a3:37:a4:06:44:e7:d6:e5
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US
Chains
Jan 1, 0001
Subject
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Serial Number
03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10
Issuer
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Timespan
Apr 9, 1996 - Jan 7, 2004
Subject
CN=VeriSign Time Stamping Service CA SW1,OU=VeriSign Trust Network+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98,O=VeriSign\, Inc.
Serial Number
fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 16, 1999 - Jan 6, 2004
Subject
CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US
Serial Number
55:0d:88:f5:3f:64:16:d7:0c:73:00:d8:45:92:16:34
Issuer
OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet
Key Usages
KeyUsageDigitalSignature, KeyUsageKeyEncipherment
Timespan
Mar 19, 1999 - Apr 16, 2000
Minor OS version
0
Major OS version
5
Entry point
10019
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
FreeSid
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
lstrcatA
GetFileAttributesA
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetCurrentProcess
lstrlenA
lstrcmpiA
lstrcpyA
GetModuleFileNameA
FreeLibrary
LocalAlloc
GetLastError
GetSystemDirectoryA
LoadLibraryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
_lclose
_llseek
_lopen
GetWindowsDirectoryA
GetProcAddress
RemoveDirectoryA
GlobalUnlock
GlobalLock
GlobalAlloc
ExitProcess
GetModuleHandleA
GetStartupInfoA
CloseHandle
LoadResource
FindResourceA
CreateMutexA
SetEvent
CreateEventA
SetCurrentDirectoryA
CreateThread
ResetEvent
TerminateThread
GetVersionExA
LocalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
FreeResource
LockResource
SizeofResource
CreateFileA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetTempFileNameA
GetSystemInfo
GetDiskFreeSpaceA
GetDriveTypeA
lstrcpynA
GetVolumeInformationA
GetCurrentDirectoryA
LoadLibraryExA
GetCommandLineA
CreateDirectoryA
GlobalFree
FormatMessageA
IsDBCSLeadByte
gdi32
GetDeviceCaps
user32
EndDialog
wsprintfA
ExitWindowsEx
CharNextA
CharUpperA
GetDesktopWindow
SetWindowLongA
GetWindowLongA
CallWindowProcA
GetDlgItem
SetForegroundWindow
SetWindowTextA
SendDlgItemMessageA
EnableWindow
GetDlgItemTextA
SendMessageA
DispatchMessageA
LoadStringA
PeekMessageA
MessageBoxA
CharPrevA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
ShowWindow
DialogBoxIndirectParamA
SetDlgItemTextA
MessageBeep
MsgWaitForMultipleObjects
comctl32
ord17
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
342KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
$TEMP/Runtimes/tv_enua.exe
- IMPHASH b83464d8132ecd9f810820e192566e15
- SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
- MD5 3f8f18c9c732151dcdd8e1d8fe655896
- SHA1 222cc49201aa06313d4d35a62c5d494af49d1a56
- SHA512 398a83f030824011f102dbcf9b25d3ff7527c489df149e9acdb492602941409cf551d16f6f03c01bc6f63a2e94645ed1f36610bdaffc7891299a8d9f89c511f7
- SSDEEP 24576:+RuPGuSU5BiPic3l2iMVCKctDVq0HtPxZj+ihApGm7+MXnrejxAr:LH5Byd2PAd3q0HHZqJpFqMXn1
- TLSH T1B425236297EAC27BE1B277310EF641679A35BC962DF5E3DE4240901D0C22FA5187932F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b6:7c:27:bd:49:ea:8b:ad:45:c1:1e:be:0b:6d:ef:e6
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
5
Entry point
10019
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
FreeSid
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
lstrcatA
GetFileAttributesA
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetCurrentProcess
lstrlenA
lstrcmpiA
lstrcpyA
GetModuleFileNameA
FreeLibrary
LocalAlloc
GetLastError
GetSystemDirectoryA
LoadLibraryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
_lclose
_llseek
_lopen
GetWindowsDirectoryA
GetProcAddress
RemoveDirectoryA
GlobalUnlock
GlobalLock
GlobalAlloc
ExitProcess
GetModuleHandleA
GetStartupInfoA
CloseHandle
LoadResource
FindResourceA
CreateMutexA
SetEvent
CreateEventA
SetCurrentDirectoryA
CreateThread
ResetEvent
TerminateThread
GetVersionExA
LocalFree
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
FreeResource
LockResource
SizeofResource
CreateFileA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetTempFileNameA
GetSystemInfo
GetDiskFreeSpaceA
GetDriveTypeA
lstrcpynA
GetVolumeInformationA
GetCurrentDirectoryA
LoadLibraryExA
GetCommandLineA
CreateDirectoryA
GlobalFree
FormatMessageA
IsDBCSLeadByte
gdi32
GetDeviceCaps
user32
EndDialog
wsprintfA
ExitWindowsEx
CharNextA
CharUpperA
GetDesktopWindow
SetWindowLongA
GetWindowLongA
CallWindowProcA
GetDlgItem
SetForegroundWindow
SetWindowTextA
SendDlgItemMessageA
EnableWindow
GetDlgItemTextA
SendMessageA
DispatchMessageA
LoadStringA
PeekMessageA
MessageBoxA
CharPrevA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
ShowWindow
DialogBoxIndirectParamA
SetDlgItemTextA
MessageBeep
MsgWaitForMultipleObjects
comctl32
ord17
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
948KB
Virtual Size
952KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
$TEMP/SSCALA32.OCX
- IMPHASH 011d127b237b8a8364c6bea71f85b1f3
- SHA256 8e52ef01139dc448d1efd33d1d9532f852a74d05ee87e8e93c2bb0286a864e13
- MD5 ce9216b52ded7e6fc63a50584b55a9b3
- SHA1 27bb8882b228725e2a3793b4b4da3e154d6bb2ea
- SHA512 444946e5fc3ea33dd4a09b4cbf2d41f52d584eb5b620f5e144de9a79186e2c9d322d6076ed28b6f0f6d0df9ef4f7303e3901ff552ed086b70b6815abdfc23af7
- SSDEEP 6144:H1v56AP7u/5b6HMpJVAtdP3IfZETrOn4jgO7jUvyDl2rwV2iM6QVS4AmuRkXc7k3:VvZ8YGZEeKUYlm827aREc7k3
- TLSH T1AEA47D13B8C0C56BCDB60630CE4F67B5F6FA96204E321E436354C7BC6B72F62961562A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bf:60:9b:b0:6e:e0:31:50:f8:d2:e2:46:ca:9d:30:4b
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
4
Entry point
275417
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfc42
ord4249
ord2486
ord3260
ord4472
ord5498
ord2982
ord3147
ord4006
ord2687
ord3259
ord3136
ord3278
ord2985
ord3081
ord2976
ord3353
ord3830
ord3831
ord3825
ord4465
ord3079
ord4622
ord4424
ord3681
ord446
ord743
ord1177
ord6467
ord1226
ord1210
ord1168
ord2439
ord1693
ord5618
ord994
ord4342
ord4687
ord4639
ord5674
ord2156
ord4080
ord4920
ord6002
ord4856
ord1963
ord5213
ord2953
ord3868
ord5150
ord4705
ord4707
ord2876
ord2998
ord5649
ord4113
ord4768
ord4548
ord4521
ord4594
ord4988
ord4925
ord4930
ord4935
ord4659
ord4909
ord4908
ord4668
ord4667
ord4666
ord4648
ord4689
ord5023
ord4654
ord4643
ord4354
ord4780
ord4649
ord5060
ord4371
ord4356
ord4409
ord4415
ord2137
ord3404
ord4949
ord2954
ord6055
ord4078
ord2488
ord4407
ord5241
ord2384
ord5163
ord6370
ord4353
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2983
ord3148
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord672
ord723
ord3946
ord362
ord423
ord5290
ord3571
ord3573
ord3693
ord3626
ord3663
ord4123
ord640
ord5785
ord1640
ord323
ord5647
ord2414
ord4133
ord4297
ord5788
ord1641
ord6605
ord5335
ord5334
ord5332
ord5325
ord5328
ord5340
ord2541
ord4651
ord4735
ord5058
ord4740
ord5059
ord4390
ord2729
ord5008
ord1146
ord1892
ord4252
ord6364
ord3326
ord6365
ord1212
ord4570
ord4672
ord4224
ord5011
ord5265
ord1776
ord6042
ord4998
ord2514
ord6052
ord1775
ord2385
ord6371
ord5286
ord4438
ord3279
ord5986
ord1877
ord449
ord746
ord6453
ord3460
ord2818
ord6374
ord3262
ord4627
ord3610
ord536
ord539
ord939
ord2763
ord926
ord940
ord941
ord4129
ord6662
ord4204
ord3402
ord656
ord567
ord4299
ord4275
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord3670
ord561
ord3952
ord2724
ord6354
ord1216
ord4637
ord4361
ord4741
ord6004
ord1567
ord5329
ord268
ord5314
ord5917
ord4760
ord4765
ord4756
ord4694
ord5148
ord5606
ord3986
ord500
ord2859
ord5333
ord3742
ord818
ord2112
ord5768
ord3711
ord783
ord2730
ord470
ord2152
ord1799
ord614
ord2623
ord2640
ord290
ord4226
ord6041
ord772
ord5860
ord6142
ord4003
ord5316
ord698
ord396
ord3437
ord911
ord4187
ord5630
ord5592
ord6166
ord3804
ord4019
ord1605
ord5710
ord2794
ord6262
ord4160
ord6261
ord2393
ord5233
ord5269
ord5280
ord3597
ord324
ord641
ord4234
ord4710
ord5802
ord1609
ord6273
ord4203
ord4903
ord6197
ord6380
ord2405
ord5983
ord5312
ord1896
ord2801
ord2700
ord2689
ord2705
ord2712
ord274
ord275
ord499
ord770
ord3760
ord5454
ord495
ord750
ord603
ord273
ord458
ord956
ord2165
ord2164
ord2158
ord5781
ord3706
ord353
ord4379
ord4459
ord1614
ord4992
ord4979
ord4603
ord5339
ord2727
ord858
ord537
ord3457
ord1601
ord540
ord3003
ord6030
ord825
ord823
ord3057
ord5574
ord3212
ord6281
ord2901
ord535
ord859
ord800
ord2379
ord4584
ord3119
ord4636
ord3206
ord5959
ord5868
ord3203
ord5984
ord4277
ord3230
ord4278
ord923
ord922
ord6199
ord3945
ord3204
ord1606
ord2915
ord2868
ord4083
ord1233
ord5572
ord924
ord6098
ord3874
ord1187
ord3139
ord3532
ord4982
ord5856
ord861
ord1685
ord5861
ord6883
ord5858
ord6040
ord860
ord1686
ord3820
ord475
ord6084
ord3502
ord758
ord2150
ord4202
ord3237
ord2614
ord4625
ord2764
ord4425
ord6819
ord2860
ord4025
ord2795
ord4480
ord4788
ord4660
ord5888
ord4661
ord4743
ord4650
ord4018
ord3199
ord3021
ord5573
ord4996
ord2864
ord5979
ord4376
ord5981
ord4853
ord4843
ord755
ord342
ord1131
ord1132
ord1116
ord1176
ord1575
ord1577
ord1182
ord269
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
msvcrt
_initterm
atol
wcslen
_strupr
__CxxFrameHandler
_EH_prolog
_mbscmp
_ftol
strlen
_mbsicmp
atoi
_itoa
memset
memcpy
modf
abs
memcmp
isdigit
_purecall
_ltoa
_stat
memmove
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
free
malloc
_adjust_fdiv
kernel32
LocalUnlock
LocalFree
LocalLock
WinExec
Sleep
lstrlenW
GetTempPathA
GetTempFileNameA
InterlockedExchange
_llseek
GlobalFree
_hread
lstrcpynA
OpenFile
GlobalSize
_hwrite
MulDiv
_lclose
lstrcatA
LoadLibraryA
InterlockedIncrement
TlsGetValue
TlsSetValue
GetDateFormatA
GetVersion
GetLocalTime
GetCurrentThreadId
MultiByteToWideChar
lstrcmpiA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
TlsFree
lstrcpyA
WideCharToMultiByte
TlsAlloc
GlobalLock
GlobalUnlock
GlobalAlloc
GetSystemTime
GetUserDefaultLCID
IsDBCSLeadByte
GetTickCount
EnterCriticalSection
GetLocaleInfoA
LeaveCriticalSection
LocalAlloc
user32
PostMessageA
IsWindow
PtInRect
SendMessageA
OffsetRect
InvalidateRect
UpdateWindow
SetWindowPos
SetWindowTextA
ShowWindow
IntersectRect
GetCapture
LoadStringA
UnhookWindowsHookEx
UnhookWindowsHook
SetWindowsHookExA
SetWindowsHookA
GetDlgItem
EnumWindows
UnregisterClassA
GetClientRect
SetScrollPos
SetScrollRange
GetScrollPos
DestroyCursor
GetCursorPos
ReleaseCapture
SetCapture
DrawFocusRect
FrameRect
EnableScrollBar
GrayStringA
IsRectEmpty
SetRectEmpty
GetDC
ReleaseDC
GetSysColor
RemovePropA
SetCursor
RegisterWindowMessageA
GetWindowRect
HideCaret
DispatchMessageA
TranslateMessage
PeekMessageA
FillRect
SetWindowLongA
GetWindowTextLengthA
DrawIcon
CopyIcon
GetWindowThreadProcessId
LoadCursorA
ShowCaret
GetScrollRange
SetRect
GetForegroundWindow
SetForegroundWindow
GetWindowLongA
GetPropA
SetPropA
KillTimer
SetTimer
MoveWindow
CallNextHookEx
GetWindow
GetFocus
GetParent
GetClassInfoA
OpenClipboard
ScreenToClient
EqualRect
CopyRect
GetSystemMetrics
InflateRect
LoadBitmapA
EnableWindow
MessageBeep
wsprintfA
GetKeyboardLayout
RegisterClassA
ClientToScreen
GetKeyState
SetClipboardData
EmptyClipboard
CloseClipboard
gdi32
GetTextMetricsA
CreateCompatibleDC
DeleteObject
BitBlt
CreateRectRgn
CreatePen
SelectClipRgn
GetDeviceCaps
GetOutlineTextMetricsA
CreateSolidBrush
SetTextColor
SetBkMode
GetTextExtentPoint32A
GetCharWidthA
GetCurrentPositionEx
DeleteDC
MoveToEx
SetTextAlign
TextOutA
SetBkColor
GetObjectA
GetStockObject
RealizePalette
SelectPalette
GetNearestColor
CreateCompatibleBitmap
CreateICA
LineTo
CreateBitmap
CreateDCA
GetPaletteEntries
SelectObject
GetTextColor
CreateRectRgnIndirect
CreatePalette
CopyMetaFileA
CreateDIBitmap
GetDIBits
GetSystemPaletteEntries
StretchDIBits
StretchBlt
CreateFontIndirectA
advapi32
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegQueryValueA
RegSetValueA
RegDeleteKeyA
RegEnumKeyA
shell32
ShellExecuteA
ole32
CoUninitialize
CoInitialize
StringFromGUID2
IIDFromString
StgCreateDocfileOnILockBytes
GetHGlobalFromILockBytes
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
GetHGlobalFromStream
CreateStreamOnHGlobal
CoCreateInstance
CoGetMalloc
olepro32
ord251
ord252
ord253
ord254
oleaut32
VarBstrFromDate
VarUdateFromDate
VarDateFromStr
LoadRegTypeLi
VariantChangeType
SysFreeString
VariantCopy
SysAllocString
VariantInit
VariantClear
SafeArrayCopy
SafeArrayPutElement
SafeArrayCreate
SafeArrayRedim
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayDestroy
SysStringByteLen
SystemTimeToVariantTime
SysStringLen
SysReAllocString
SafeArrayGetLBound
VarDateFromUdate
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
284KB
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=25, id=19, version=8022,
count=23, productName=Unmarked objects (old),
count=12, id=19, version=8034,
count=2, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=667, id=1, productName=Unmarked objects,
count=77, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=6, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/SSCALB32.OCX
- IMPHASH e290d9c299fd60eb2519acf65ca53fae
- SHA256 5db33895923b7af9769ca08470d0462ed78eec432a4022ff0acc24fa2d4666e1
- MD5 97ffaf46f04982c4bdb8464397ba2a23
- SHA1 f32e89d9651fd6e3af4844fd7616a7f263dc5510
- SHA512 8c43872396f5dceb4ba153622665e21a9b52a087987eab523b1041031e294687012d7bf88a3da7998172010eae5f4cc577099980ecd6b75751e35cfc549de002
- SSDEEP 6144:ZD3OD+b26Wcix8swZOsfi8h72gYYXWQ+8MIdQpE:ZDeqb2Px8swss68h72gFWyum
- TLSH T1EF643A01F1415D27EDA70BB1486EE799B6683E211F2064D7A3C8ED7C1FB25F2AA1170B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
3b:da:4a:21:5f:b2:2b:9c:3c:59:69:6c:91:a0:03:ff
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
4
Entry point
218359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mfc42
ord5023
ord4689
ord4666
ord4654
ord4354
ord4780
ord4371
ord4643
ord4356
ord4741
ord4409
ord4415
ord4979
ord2488
ord3404
ord2954
ord6055
ord4739
ord4078
ord4407
ord5241
ord2384
ord5163
ord6370
ord4353
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord1776
ord5277
ord3148
ord4466
ord2986
ord3080
ord4081
ord4624
ord5825
ord783
ord672
ord656
ord723
ord1206
ord3946
ord362
ord800
ord540
ord423
ord2414
ord825
ord535
ord860
ord323
ord823
ord4025
ord6281
ord1601
ord861
ord537
ord5334
ord5328
ord5332
ord5340
ord4018
ord2541
ord5325
ord1605
ord4949
ord5981
ord2983
ord5769
ord2795
ord2112
ord4459
ord640
ord2450
ord1640
ord3003
ord4603
ord4636
ord4992
ord1168
ord2859
ord3206
ord5917
ord5290
ord4735
ord4740
ord5573
ord4738
ord3693
ord3626
ord3663
ord5888
ord858
ord5979
ord4760
ord3573
ord1641
ord2860
ord3571
ord4756
ord3706
ord4765
ord4637
ord4361
ord3237
ord4650
ord2405
ord5785
ord5574
ord3057
ord4743
ord4996
ord5572
ord4649
ord2915
ord4019
ord4480
ord2056
ord4770
ord4771
ord4914
ord4915
ord4651
ord5033
ord1606
ord2729
ord2727
ord2730
ord5329
ord5008
ord4299
ord2379
ord2385
ord6374
ord3262
ord3402
ord4627
ord3610
ord567
ord3711
ord6375
ord4486
ord2554
ord2512
ord743
ord446
ord1089
ord5148
ord4668
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord3670
ord4908
ord4667
ord3952
ord561
ord6354
ord1216
ord3945
ord1892
ord4252
ord6364
ord3326
ord6365
ord1212
ord4570
ord4672
ord4843
ord5011
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord1775
ord6371
ord5286
ord4438
ord3279
ord4625
ord4425
ord449
ord746
ord6453
ord2868
ord3460
ord2764
ord5875
ord924
ord4133
ord4297
ord5788
ord3199
ord5647
ord5787
ord472
ord922
ord4129
ord5683
ord4277
ord2763
ord939
ord940
ord926
ord4278
ord4224
ord3204
ord3457
ord2614
ord6379
ord6197
ord6380
ord6199
ord2089
ord6605
ord1233
ord4275
ord2152
ord3874
ord6042
ord3742
ord818
ord500
ord772
ord6142
ord5860
ord755
ord470
ord1799
ord614
ord2623
ord290
ord4226
ord5606
ord6041
ord1223
ord2794
ord6262
ord599
ord4160
ord5710
ord941
ord6261
ord2393
ord268
ord1567
ord1243
ord4204
ord4203
ord3139
ord4903
ord536
ord5314
ord5335
ord539
ord1609
ord6273
ord4083
ord1896
ord2801
ord2700
ord2689
ord2705
ord2712
ord274
ord5983
ord275
ord770
ord499
ord3760
ord5454
ord495
ord750
ord603
ord273
ord458
ord5312
ord5233
ord5269
ord5280
ord3597
ord641
ord324
ord4234
ord4710
ord5802
ord956
ord2165
ord2164
ord2158
ord5781
ord353
ord6166
ord3119
ord5959
ord3203
ord5984
ord3212
ord5986
ord3230
ord3681
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord3353
ord2976
ord3081
ord2985
ord3278
ord3136
ord4465
ord3259
ord3147
ord2982
ord5498
ord4472
ord2687
ord2486
ord4249
ord4006
ord4935
ord4909
ord4659
ord4988
ord4930
ord4925
ord4548
ord4594
ord4521
ord4661
ord4768
ord4660
ord2998
ord4113
ord5649
ord4705
ord2876
ord4707
ord2953
ord5150
ord3868
ord2137
ord5213
ord1963
ord4856
ord6002
ord4920
ord4639
ord2156
ord5674
ord994
ord4687
ord4342
ord2439
ord5618
ord1693
ord6467
ord1210
ord1226
ord815
ord1177
ord2724
ord3532
ord1187
ord6098
ord1685
ord4982
ord1614
ord3820
ord475
ord6084
ord6030
ord758
ord2150
ord1877
ord3502
ord3260
ord5868
ord5492
ord2901
ord5199
ord3804
ord2396
ord5731
ord3922
ord2864
ord342
ord1131
ord1132
ord1116
ord1176
ord1575
ord1577
ord1182
ord269
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
msvcrt
free
_ltoa
??1type_info@@UAE@XZ
wcslen
__CxxFrameHandler
_purecall
_mbsicmp
_mbscmp
labs
abs
floor
ceil
_ftol
memcpy
strlen
memset
atoi
memcmp
_EH_prolog
_itoa
atol
_stat
modf
memmove
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
malloc
_adjust_fdiv
kernel32
LocalAlloc
LocalFree
MulDiv
LocalUnlock
Sleep
GetTickCount
WinExec
GetTempPathA
GetTempFileNameA
InterlockedExchange
_llseek
GlobalAlloc
_hread
lstrcpynA
OpenFile
GlobalSize
_hwrite
_lclose
GlobalLock
GlobalFree
InterlockedIncrement
GlobalUnlock
lstrcmpiA
GetSystemTime
lstrcatA
lstrcpyA
LoadLibraryA
lstrlenA
TlsSetValue
IsDBCSLeadByte
TlsGetValue
GetVersion
GetUserDefaultLCID
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetLocaleInfoA
DeleteCriticalSection
InitializeCriticalSection
TlsFree
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
LocalLock
user32
CreateAcceleratorTableA
CharUpperA
CharNextA
InvalidateRect
KillTimer
ReleaseCapture
SetTimer
SetWindowTextA
GetDlgItem
ShowWindow
SetWindowLongA
GetWindowTextLengthA
SetWindowPos
PeekMessageA
ReleaseDC
VkKeyScanA
RemovePropA
GetForegroundWindow
SetForegroundWindow
LoadCursorA
GetCursorPos
MessageBeep
GetPropA
SetPropA
GetCapture
GetClientRect
TranslateMessage
DispatchMessageA
SetCapture
ScreenToClient
ClientToScreen
FrameRect
DestroyCursor
GetDC
GetSysColor
GetSystemMetrics
CopyRect
SetRectEmpty
IntersectRect
EqualRect
PtInRect
IsWindow
FillRect
SetCursor
GetWindowLongA
RegisterWindowMessageA
MoveWindow
GetWindowRect
SendMessageA
PostMessageA
DrawIcon
UpdateWindow
OffsetRect
CopyIcon
GrayStringA
GetWindowThreadProcessId
wsprintfA
EnumWindows
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookA
EnableWindow
EnableScrollBar
GetParent
IsRectEmpty
DrawFocusRect
LoadStringA
GetKeyState
UnhookWindowsHook
SetWindowsHookExA
ShowScrollBar
SetScrollPos
MessageBoxA
SetScrollRange
ValidateRect
gdi32
CreateSolidBrush
GetDeviceCaps
CreateBitmap
CreateCompatibleDC
BitBlt
LPtoDP
CreateDCA
RealizePalette
SelectPalette
GetTextMetricsA
CreatePen
GetBkColor
GetStockObject
Rectangle
CreateHatchBrush
GetTextColor
DeleteObject
LineTo
GetTextExtentPoint32A
SetTextColor
MoveToEx
CreateFontIndirectA
GetObjectA
DeleteDC
CreateICA
CreateDIBitmap
GetDIBits
GetSystemPaletteEntries
StretchDIBits
GetPaletteEntries
SelectClipRgn
SetBkMode
CreateCompatibleBitmap
SetBkColor
CreateRectRgn
TextOutA
CreateRectRgnIndirect
CopyMetaFileA
StretchBlt
SetTextAlign
GetCharWidthA
GetCurrentPositionEx
GetOutlineTextMetricsA
SelectObject
advapi32
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegQueryValueA
RegSetValueA
RegDeleteKeyA
RegEnumKeyA
shell32
ShellExecuteA
ole32
StringFromGUID2
IIDFromString
GetHGlobalFromILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
GetHGlobalFromStream
CreateStreamOnHGlobal
CoGetMalloc
olepro32
ord252
ord253
ord251
ord254
oleaut32
SafeArrayPutElement
SysAllocString
VariantCopy
VariantChangeType
VarDateFromStr
VarBstrFromDate
SysAllocStringLen
SysFreeString
VariantInit
SysStringByteLen
LoadRegTypeLi
SysReAllocStringLen
SafeArrayCreate
SystemTimeToVariantTime
SysStringLen
SysReAllocString
VariantClear
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetLBound
SafeArrayGetElement
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
216KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=23, id=19, version=8022,
count=12, id=19, version=8034,
count=2, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=635, id=1, productName=Unmarked objects,
count=51, productName=Unmarked objects (old),
count=25, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=6, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/SSubTmr6.dll
- IMPHASH 009ca6296770e87a44d039c7eeeec064
- SHA256 48bb226b418dae999d66731599996e042c5592d845ea11548a15ccd3a00fb5ab
- MD5 1556c5b52a751c31b4ca6fe757704131
- SHA1 a04263b37b69a5a53eaccc6d30dda61b2808224a
- SHA512 ea306e09834bd08edf8a5930c096eaff4ab6c6a8799f3910ab8ea88a0a25fde45de36887c13d468046e9bb2e1439e7bd34c970e3ef9f71d8e4eeb95b5fd60074
- SSDEEP 768:Xr65PC/JXxK5yO2Zw5WdSYEFrAdOnBiyFm:GPC/Jhip2Zw5wSYCEMUR
- TLSH T1DF03B721738AE431E1D906B91D1A93D42665BC211D51AF2BB38FF39F2E35F43E612722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4908
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord301
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord304
ord307
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
ord310
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord312
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
__vbaFPException
ord644
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
ord103
ord104
ord105
__vbaStrToAnsi
_CIatan
__vbaStrMove
__vbaCastObj
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=5, id=9, version=8041,
count=1, id=13, version=8169,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/Snd1.wav
- SHA256 11863d5b7fec50e3ca69f74066b68ed389a18b6990394f3ed21d6ea0e67262e5
- MD5 7cf6069d29b9a66bf03ba1e554553fe9
- SHA1 001de4b7b9082f951e782efb74601d8e0447bee6
- SHA512 51414f0165ea67fcd96d0a5b2df1b321882145d3d3dcb146a0d896a3a0c395b2538cb01b7c27ce106acf65480d88bc5d2aba19e9ad03430bd756c5047f33d08d
- SSDEEP 768:P0SgkJs9aE1NSGHd5W4AYVNwXLlNpm2y51mZ:PntE7IYVNwXLlNpmD5
- TLSH T195D25C2B2A0B0707E33367B4D87C21126454ACC8D56CEFA17AD34C5ADE0FC6A56F4B99
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/Snd2.wav
- SHA256 d59c9bc27494b2e68d5efdc1798dc5442f364bef46cfb1fcdf4b3b032358ac26
- MD5 bd183af23b343b2789e61f03b536aad0
- SHA1 66db4748e6214fdc4642e3f9a6bc4218b24ec5b4
- SHA512 ad5191eddb6838ea7b9200bc7a10c06e0a41966ba627a52ccd5a4f1008b1b85edfc63939a264822b7e1e9caf40e3428ddaaaaa80c82bb5066afe802d0dc52211
- SSDEEP 768:f9ZOco4aji+8S/y75qNGyFZraqGAJb9m:1/MjiEy7I8OZr7GATm
- TLSH T18603A36F2A1B1707D3326375DC7861024445ACC5D8ACEF91BBC2AE2FC90F85642E1BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/T001.nbd-SR
- SHA256 2f3d5ac26d4345be684f81cae8aa51f116334394680e9e6ac6a6ec49f58f3bac
- MD5 877bd06f8b02ff562dd476306d8bb8a9
- SHA1 ae4198c145e9d69e122f3a387519194d4280a089
- SHA512 e8fa96008c4aaca4c4251bfb310c14a4501aa59b02827e68e91013f4089bd7e20a498923046bc4469985703c94b3c116da890270f0a806431601db605a840fc4
- TLSH T199E08C1317640AFEA58009CA8108762759F3C9BB1C1C608EBB6504EBF41E1866438772
- MD5 SHA1 SHA512 TLSH
$TEMP/empop3.dll
- IMPHASH 2b3636c08cbe20673ddf7fedb481a7c0
- SHA256 f198ec842cf9b9d1e9e3f4bb6864fae7eea98d6919e0c6609e139e00c262d6bc
- MD5 a0fdd2077934c34f08d48aa214da2c4e
- SHA1 9b9593ef99515aac8665c6da73deb871815d73e9
- SHA512 2bef50a54f8c06821e31771bac566992f7a8872709b8a993322a43750f19ccad773dd9fd88f87d819d317845ccfe1b66087c2b2bda094b3382e6054ccce2f62a
- SSDEEP 3072:6eH6h4ZLkOO0qn4fZD82yuGqeWaZnYq2+DrDJxZbcG0Z3bp:s2yuGqeWaZnYq2er7lFKp
- TLSH T1E8E35A0273D0C075E2E9453D1E23B736EBBB59788E6605075F6817BD2FB2E90AE17206
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86525
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateDirectoryA
GetTickCount
GetTempPathA
IsBadReadPtr
WaitForSingleObject
SetLastError
FindFirstFileA
SetEvent
GetTempFileNameA
CreateEventA
CreateFileMappingA
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
GetShortPathNameA
MapViewOfFile
GetModuleFileNameA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
DisableThreadLibraryCalls
ReadFile
HeapDestroy
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
IsBadWritePtr
HeapFree
HeapAlloc
HeapCreate
Sleep
FlushViewOfFile
UnmapViewOfFile
EnterCriticalSection
LeaveCriticalSection
lstrlenW
DeleteFileA
RemoveDirectoryA
InterlockedDecrement
InterlockedIncrement
CreateFileA
SetFilePointer
SetEndOfFile
WriteFile
CloseHandle
MultiByteToWideChar
FindClose
GetFileSize
lstrcpynA
WinExec
IsDBCSLeadByte
GetModuleHandleA
FreeLibrary
CopyFileA
WideCharToMultiByte
GetLastError
user32
CreateWindowExA
wsprintfA
DispatchMessageA
TranslateMessage
PeekMessageA
DestroyCursor
EndPaint
ScreenToClient
GetClientRect
BeginPaint
SetCursor
LoadCursorA
SetClassLongA
EndDialog
PtInRect
IsWindow
GetDesktopWindow
GetWindowRect
GetDlgItem
GetCursorPos
DialogBoxParamA
GetActiveWindow
SetWindowLongA
DestroyWindow
DefWindowProcA
GetWindowLongA
SendMessageA
CharNextA
UnregisterClassA
RegisterClassExA
gdi32
TextOutA
SetBkMode
SetTextColor
CreateFontA
DeleteObject
SelectObject
GetStockObject
advapi32
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegQueryValueA
GetUserNameA
RegOpenKeyExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
LookupAccountNameA
RegCreateKeyA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
ole32
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
oleaut32
VariantInit
LoadTypeLi
LoadRegTypeLi
VariantCopy
VariantClear
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
RegisterTypeLi
VarUI4FromStr
wsock32
WSAAsyncSelect
connect
WSASetLastError
shutdown
inet_ntoa
WSAAsyncGetHostByName
WSAStartup
WSAGetLastError
setsockopt
htons
ioctlsocket
send
recv
closesocket
socket
WSACancelAsyncRequest
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
msvcrt
?terminate@@YAXXZ
srand
memset
strchr
memcpy
isalpha
_strset
strstr
strtok
atoi
strcpy
_beginthread
memcmp
strrchr
_purecall
??2@YAPAXI@Z
strcat
strlen
_wcsicmp
_EH_prolog
__CxxFrameHandler
wcslen
_strdate
_CxxThrowException
sprintf
wcsstr
_assert
atol
_itoa
rand
_stricmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
time
strncpy
free
wcschr
_except_handler3
malloc
memmove
_strtime
toupper
realloc
_strnicmp
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
88KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=2, id=14, version=7299,
count=4, id=10, version=8447,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, productName=Unmarked objects (old),
count=13, id=19, version=8022,
count=185, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=16, id=11, version=8447,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/emsmtp.dll
- IMPHASH 9f8c724314a584c503a9b1a0fad089f8
- SHA256 743857c8be216893265c231ad45f4ffd3babb67c024ef8ceb5a698e292464263
- MD5 365920b74d38322571e16f66686ef56b
- SHA1 d4a112bcc048526d1e6b7a6841c059c63d23d4f6
- SHA512 f13a913e09b467a929fb25da3fce4c9eded9571c2f43d6a9365de4e86f4183434d643c32f35e5ee4b8d7798b5aa24beaf3898d61e92daa4df35f0a31ea338164
- SSDEEP 3072:cx57Ipkh2yuGqeWa6oat9Ts9zAEzmTzFJSB0EKqTu:tg2yuGqeWa6Z9TsdGyB0ZQ
- TLSH T160C34B02F7D1C0B5F186023C490B2776ABBBAE345E551947ABA027DC3F71F51BE1622A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70453
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenW
lstrlenA
GetShortPathNameA
InterlockedDecrement
GetModuleHandleA
WideCharToMultiByte
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
lstrcpyA
lstrcatA
GetSystemTime
InterlockedIncrement
GetTimeZoneInformation
GetFileSize
RemoveDirectoryA
DeleteFileA
ReadFile
SetFilePointer
GetLocalTime
EnterCriticalSection
HeapFree
HeapAlloc
HeapCreate
IsBadReadPtr
Sleep
GetTickCount
FileTimeToSystemTime
SystemTimeToFileTime
CompareFileTime
GetSystemTimeAsFileTime
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetVersionExA
DisableThreadLibraryCalls
GetModuleFileNameA
WaitForSingleObject
MultiByteToWideChar
CreateEventA
LoadLibraryA
GetProcAddress
FreeLibrary
CreateFileA
WriteFile
SetEvent
LocalFree
CloseHandle
user32
RegisterClassExA
CreateWindowExA
DispatchMessageA
TranslateMessage
MsgWaitForMultipleObjects
PeekMessageA
wsprintfA
UnregisterClassA
DestroyWindow
CharNextA
SendMessageA
LoadStringA
GetDesktopWindow
SetWindowLongA
DefWindowProcA
GetWindowLongA
gdi32
GetStockObject
advapi32
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegCloseKey
RegEnumValueA
RegQueryValueExA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
LookupAccountNameA
GetUserNameA
ole32
ProgIDFromCLSID
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
CreateErrorInfo
SetErrorInfo
VariantCopy
VariantInit
VariantClear
SysAllocStringLen
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
GetErrorInfo
wsock32
WSAStartup
send
WSASetLastError
inet_ntoa
socket
shutdown
closesocket
WSACleanup
htons
WSAAsyncGetHostByName
WSACancelAsyncRequest
WSAGetLastError
gethostbyname
ioctlsocket
setsockopt
connect
recv
WSAAsyncSelect
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
msvcrt
_except_handler3
strcmp
memmove
wcslen
strrchr
_strnicmp
srand
rand
_itoa
realloc
malloc
free
_purecall
strcpy
??1type_info@@UAE@XZ
atoi
_CxxThrowException
_stricmp
_stat
_strset
_splitpath
_endthread
strncmp
strchr
strncpy
memcpy
memset
memcmp
??3@YAXPAX@Z
_strtime
_strdate
toupper
isalpha
??2@YAPAXI@Z
_ltoa
strncat
_adjust_fdiv
_initterm
?terminate@@YAXXZ
strcat
_EH_prolog
__CxxFrameHandler
_beginthread
strlen
strtok
strstr
abs
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=12, version=7291,
count=3, id=14, version=7299,
count=4, id=10, version=8447,
count=8, productName=Unmarked objects (old),
count=17, id=19, version=8022,
count=15, id=19, version=9049,
count=171, id=1, productName=Unmarked objects,
count=12, id=11, version=8447,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/favicon.ico
- SHA256 d5343ff39d29ecd9b60fd31cc60321b2d4a36001d5d1ee24f6c766b10eef0095
- MD5 e1a53bb79bcf97ae324b05552c1b3ca9
- SHA1 5ee16e7d9fb3473df37f1c318881a59b1bf2d9ef
- SHA512 1c8ac8b9a9e8e063f572c41ce9a7aac91dcf956763859716fa68247c3774cca00bf5aebd5dae3dfe6c0ef1a961cf640f7ad3c68965ec9d8b5e0d610b77c29c80
- TLSH T1EF712834B913B989C4566F3856E7CE860A60AEF4F28130634AC8887B8C5C202FF1B235
- MD5 SHA1 SHA512 TLSH
$TEMP/j001.nbd
- SHA256 e312728e0491e1a15405566c8f591cf3ca6128ca17e5e022a7550494a600ad27
- MD5 98c9159b828cbcd8f13a0491218bf537
- SHA1 6b9a736cb7840300e56acd2cbc635d5e451a68ff
- SHA512 9d07bdd0b7fbc3e23c6940c72e5e151271c61b703f0f6d858e81887fd4819f9574e4bc078bef8e2c3c9c661793884f98cc6305556f34d0092c6ce7c657aa16f8
- SSDEEP 192:nnW1LaScTPa+SUYPh0fAosSQEmJ3yptPouBHHdam4Gzy56l7pL:W1LRcTPawDA9MmJ8tPo8n7zDlx
- TLSH T1D1229F8105FC8F05694FD85D605A4E0C360E9FB4C9DE29E2BA165BE7C31EF13852765C
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/j2.nbd
- SHA256 c032c71a49e0cb05072602c99251e6b1d76ca2db57120fc402b93d3392df7c3c
- MD5 788b0ec30cc5fae75d2a6ee0a3ef10fa
- SHA1 a879dc350bbe79dc2cae04ee804fd6ee9a1f8e1b
- SHA512 df5e1097db5326c168b0c840b2d598f82caab5138d30f899233a777e7164b8178e4ba9934eb0c32029533b6ee5f72c07fa279fcd93f8e11d4108485724abac1b
- SSDEEP 768:cm+rR22Cxd9eCFkw5KvaaBIlZZuQVZPym/F5V43uffAGBLXVCCQDtWIcjQ:cmv/9eLOKvaanQVZPPF52efLDk
- TLSH T1D313BF4141FD890183EFD60DB11C0E8FBD1B6C7815EA65DAB812678EDB3BF40D8E6A54
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/j2.nbd-SR
- SHA256 1837a9f0653a4093e448de37fdbf2bb0e4c3e98abb1414b8e60793a2863208a9
- MD5 6f8c402777457a1cc7b7ca6f7a7657de
- SHA1 b05c00f28f9185ffd43c9ee479976382c64adbfe
- SHA512 777d34f5e4e24c4f053050a99e00c6a7065bb89690c542362eadce7552c71005b6a7de0fdb20eeacece70610c900a1d51b6485332971d598e6c0dc475b228bda
- TLSH T12911449303890BBEF59E0ED2C85B255320F4D452BD155288ABB3AAEB7C3F8C95430A34
- MD5 SHA1 SHA512 TLSH
$TEMP/j3.nbd
- SHA256 197cd5e9b3bdec70314d3b3e5ddb5ee41578907a8a50d9ad2fc3683ff271656f
- MD5 0b9550caef707aebf17f4c17a7e0f424
- SHA1 06d91cae8ea9324f76b7828d2d2e9455ba2c6c7b
- SHA512 d1cfda4b4d82a7cb0571e4c70dc5b8f4b2b19406364568a45e18dd68dfeeb1f37f4237b43448b0d1d12cfd388f54bd2d5f9390510593173c0dbcfddafcf18735
- SSDEEP 1536:K6h3swrT9IiFyM0kQkjLlY2V1KBMlubUpkjQmwyFRx:Bhtrht/0LyLOUaUyHpx
- TLSH T1F423BE4040FC841143DBEA0EB12C1C4BBE114CBD69AA36DAF99653CBDB5FFA4E461B46
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/j3.nbd-SR
- SHA256 2a9cbdbd1459111eac43d2d505e7828108c68cc5042c97b4e93d235962f8ad59
- MD5 4c273ee71a2d85203ca95387fa78a315
- SHA1 195a066b030685b1fb8b5e594f6a77889a1ff3ab
- SHA512 6e833e069f410d73976c97031b61949cfc31e81df7363e724090f13a5a2306496a1a15aa3ee01fa1cff43cf91d37d191c84be293ebf6ae7c1c5c3b55cee06724
- TLSH T13C11264613852A7CF5CD0FC9988F242621F1C6167D680558AFF31AEBBC3B9C05430676
- MD5 SHA1 SHA512 TLSH
$TEMP/msvbvm60.dll
- IMPHASH ce5958d8adf86078d58c0c6f95621ee9
- SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
- MD5 5343a19c618bc515ceb1695586c6c137
- SHA1 4dedae8cbde066f31c8e6b52c0baa3f8b1117742
- SHA512 708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
- SSDEEP 24576:LlDYRayxYMsEVcQtFyBw2fO+wgw7HsltDngDG+QryQF63xxWPByACxlQ6kMX1Kse:BOayxtXyrgs3DngDyyQFwxxWPcxlQ3cf
- TLSH T14655BF1373D5AC73CBA721380A2A2375F6B4AF245A34ED8B13A4356F2937741532B726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6904
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
GetTimeZoneInformation
CreateThread
ExitThread
FlushFileBuffers
CreateDirectoryA
RemoveDirectoryA
MoveFileA
LockFile
UnlockFile
TerminateProcess
SetEnvironmentVariableA
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetStdHandle
GetStringTypeW
RaiseException
LCMapStringW
GetStringTypeA
GetModuleFileNameW
GetUserDefaultLangID
GetComputerNameA
SetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
SetFileTime
GetLocalTime
SetLocalTime
RtlUnwind
OpenFile
CreateProcessW
IsValidCodePage
FormatMessageW
GetStartupInfoA
UnhandledExceptionFilter
ExitProcess
SetCurrentDirectoryA
GetStringTypeExA
GetVolumeInformationA
FindFirstFileA
FindNextFileA
FindClose
VirtualFree
GetSystemInfo
VirtualAlloc
VirtualProtect
FlushInstructionCache
FindResourceExA
GetShortPathNameA
WinExec
lstrlenW
lstrcpyW
WriteFile
SetEndOfFile
SetFilePointer
GetSystemTime
SystemTimeToFileTime
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
GetCurrentProcess
DuplicateHandle
ResumeThread
GetCommandLineA
TlsSetValue
TlsFree
TlsAlloc
GetVersion
CompareStringW
lstrcmpiW
MulDiv
CreateProcessA
GetExitCodeProcess
LoadLibraryExA
WaitForSingleObject
ResetEvent
SetEvent
CreateEventA
GetTickCount
GetEnvironmentVariableA
FreeResource
GetSystemDefaultLCID
GetPrivateProfileIntA
IsBadCodePtr
GetUserDefaultLCID
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
Sleep
GlobalDeleteAtom
HeapDestroy
SetErrorMode
GlobalAddAtomA
ReleaseSemaphore
LCMapStringA
CreateSemaphoreA
VirtualQuery
GetCurrentProcessId
MultiByteToWideChar
GetProfileStringA
WideCharToMultiByte
HeapReAlloc
GetDriveTypeA
CompareStringA
GetFileAttributesA
GetCurrentDirectoryA
GetModuleFileNameA
SetLastError
GetFullPathNameA
SearchPathA
GetFileType
GlobalUnlock
GlobalFree
FindResourceA
LoadResource
SizeofResource
GlobalAlloc
GlobalSize
GlobalHandle
GlobalReAlloc
GlobalLock
_lwrite
_lread
LockResource
GetTempPathA
GetTempFileNameA
lstrcpynA
_lclose
_llseek
FreeLibrary
GetLocaleInfoA
lstrcmpiA
GetLastError
GetModuleHandleA
GetSystemDefaultLangID
FormatMessageA
HeapCreate
GetWindowsDirectoryA
GetPrivateProfileStringA
lstrcatA
CreateFileA
ReadFile
CloseHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
IsBadReadPtr
TlsGetValue
lstrcpyA
DeleteFileA
lstrcmpA
GetCurrentThreadId
GetVersionExA
HeapAlloc
HeapFree
HeapSize
lstrlenA
user32
DdeClientTransaction
DdeAbandonTransaction
DdeGetData
DdeGetLastError
DdeCreateDataHandle
DdeCmpStringHandles
SetCursorPos
EnumClipboardFormats
DestroyCursor
GetAsyncKeyState
WaitForInputIdle
GetForegroundWindow
VkKeyScanW
SetWindowsHookExW
keybd_event
CharUpperBuffW
CharUpperBuffA
CharLowerBuffW
FindWindowW
FindWindowA
SetActiveWindow
GetClassInfoExA
LoadIconA
LoadImageA
RegisterClassExA
FrameRect
CreateDialogParamA
IsDialogMessageA
EnableMenuItem
ShowCursor
OemToCharA
CharToOemBuffA
GetWindowTextA
EndDialog
DrawTextA
SendDlgItemMessageA
SetDlgItemTextA
GetWindowPlacement
GetSystemMetrics
LoadBitmapA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects
WaitMessage
PostQuitMessage
UnhookWindowsHookEx
RegisterClipboardFormatA
CreateCursor
CreateIcon
PostMessageW
PeekMessageW
EnumWindows
EnumChildWindows
GetPropA
RemovePropA
SetPropA
SetForegroundWindow
ClipCursor
CallWindowProcA
DefFrameProcA
GetKeyState
GetDlgItem
IsWindow
UnregisterClassA
RegisterClassA
AdjustWindowRect
GetTabbedTextExtentA
TabbedTextOutA
FillRect
CharToOemA
MessageBoxA
wsprintfA
WinHelpA
GetDesktopWindow
SetRect
GetWindowDC
DestroyIcon
GetClassInfoA
AdjustWindowRectEx
GetMenuItemCount
RemoveMenu
GetMenuStringA
GetMenuState
DdePostAdvise
GetCaretPos
CharPrevA
CharNextA
GetUpdateRgn
GetUpdateRect
PtInRect
ChildWindowFromPointEx
ReleaseCapture
SetCapture
InflateRect
GetWindowRect
ClientToScreen
MoveWindow
IsWindowEnabled
IsChild
SetParent
IsIconic
IsZoomed
DefMDIChildProcA
MessageBeep
PeekMessageA
PostMessageA
LoadStringA
AppendMenuA
DestroyMenu
CreatePopupMenu
GetMessageTime
GetMessagePos
DrawFocusRect
CopyAcceleratorTableA
GetWindowRgn
CharUpperA
TranslateMDISysAccel
SubtractRect
IsRectEmpty
InvalidateRgn
InvalidateRect
CopyRect
GetDCEx
IntersectRect
LoadAcceleratorsA
BringWindowToTop
GetWindowThreadProcessId
AttachThreadInput
EqualRect
EnableWindow
SetFocus
SendMessageA
SetWindowsHookExA
GetClassNameA
LoadCursorA
SetCursor
SetWindowLongA
GetWindow
GetFocus
GetKeyboardLayout
GetSystemMenu
CallNextHookEx
GetParent
DestroyWindow
SetWindowTextA
SetWindowPos
UpdateWindow
CreateWindowExA
SystemParametersInfoA
GetCapture
WindowFromPoint
ScreenToClient
SetTimer
IsWindowVisible
ShowWindow
KillTimer
GetDC
ReleaseDC
MapWindowPoints
GetCursorPos
GetCursor
OffsetRect
GetIconInfo
DefWindowProcA
BeginPaint
GetClientRect
EndPaint
GetSysColor
GetActiveWindow
GetWindowLongA
DdeDisconnect
DdeConnect
DdeSetUserHandle
DdeNameService
DdeCreateStringHandleA
DdeUninitialize
DdeInitializeA
DdeFreeStringHandle
DdeQueryConvInfo
DdeQueryStringA
DdeFreeDataHandle
SetScrollRange
SetScrollPos
DrawFrameControl
LockWindowUpdate
CharLowerBuffA
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
GetCaretBlinkTime
SetCaretPos
GetWindowTextLengthA
CreateCaret
ShowCaret
HideCaret
DestroyCaret
GetScrollPos
GetClipboardFormatNameA
DrawTextExA
SetWindowRgn
ToAscii
CreateAcceleratorTableA
DestroyAcceleratorTable
ShowScrollBar
GetScrollInfo
GetLastActivePopup
GetMenuItemInfoA
SetMenuItemInfoA
SetKeyboardState
GetKeyboardState
GetQueueStatus
GetDoubleClickTime
SetWindowContextHelpId
TrackPopupMenu
SetMenuDefaultItem
DrawMenuBar
DeleteMenu
InsertMenuA
GetSubMenu
GetMenuItemID
GetMenu
SetMenu
CreateMenu
ModifyMenuA
CheckMenuItem
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
PostThreadMessageA
VkKeyScanA
CharLowerA
DrawIcon
MessageBoxIndirectA
DialogBoxParamA
IsCharAlphaA
EnumThreadWindows
SetScrollInfo
gdi32
RestoreDC
RealizePalette
SetROP2
SaveDC
GetClipBox
SetWindowOrgEx
ExcludeClipRect
CreateHalftonePalette
GetTextMetricsA
PatBlt
EnumFontsA
TranslateCharsetInfo
GetROP2
SetBrushOrgEx
GetDeviceCaps
GetObjectType
CreatePenIndirect
CreateBrushIndirect
Rectangle
GetStockObject
Arc
LineTo
MoveToEx
Pie
Ellipse
SetStretchBltMode
GetPixel
GetTextExtentPoint32A
SetPixelV
StretchDIBits
GetCurrentObject
TextOutA
GetBkColor
StretchBlt
CreateDIBitmap
CloseMetaFile
SetWindowExtEx
CreateMetaFileA
EndDoc
AbortDoc
StartPage
CreateCompatibleBitmap
StartDocA
CreateDCA
ResetDCA
Escape
ScaleViewportExtEx
SetViewportExtEx
SetMapMode
DeleteMetaFile
PlayMetaFile
SetAbortProc
DeleteEnhMetaFile
PlayEnhMetaFile
CreateICA
GetEnhMetaFileHeader
ScaleWindowExtEx
GetWindowOrgEx
GetPaletteEntries
CreateDIBSection
CloseEnhMetaFile
CreateEnhMetaFileA
LPtoDP
EqualRgn
ExtCreateRegion
GetDIBits
SetTextAlign
GetWindowExtEx
GetViewportExtEx
CopyMetaFileA
CopyEnhMetaFileA
PathToRegion
EndPath
BeginPath
WidenPath
GetTextColor
GetMapMode
SetDIBColorTable
RoundRect
CreateEllipticRgnIndirect
CreateRoundRectRgn
GetSystemPaletteEntries
GetNearestColor
CreateCompatibleDC
SetViewportOrgEx
BitBlt
DeleteDC
IntersectClipRect
OffsetWindowOrgEx
SelectClipRgn
SelectPalette
CreatePalette
PtInRegion
OffsetRgn
ExtSelectClipRgn
CreateRectRgnIndirect
CreateRectRgn
SetRectRgn
CombineRgn
CreateFontIndirectA
GetTextExtentPointA
GetObjectA
GetBitmapBits
SetBkMode
SelectObject
ExtTextOutA
CreateBitmap
CreatePatternBrush
SetTextColor
SetBkColor
CreatePen
CreateHatchBrush
UnrealizeObject
CreateSolidBrush
EndPage
DeleteObject
advapi32
RegQueryInfoKeyA
RegCreateKeyW
RegQueryValueExW
RegEnumValueA
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
ReportEventA
DeregisterEventSource
RegisterEventSourceA
RegDeleteValueA
RegSetValueA
RegCreateKeyA
RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
ole32
CoTaskMemAlloc
CoTaskMemFree
BindMoniker
RegisterDragDrop
RevokeDragDrop
DoDragDrop
CreateILockBytesOnHGlobal
OleFlushClipboard
OleIsCurrentClipboard
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
CreateDataAdviseHolder
CreateOleAdviseHolder
CoRegisterClassObject
CoRevokeClassObject
CLSIDFromString
OleDoAutoConvert
OleRegGetUserType
OleSaveToStream
ReadClassStg
ReadClassStm
OleConvertIStorageToOLESTREAM
OleConvertOLESTREAMToIStorage
StgIsStorageILockBytes
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
OleCreateFromData
OleCreateLinkFromData
OleGetIconOfClass
OleGetClipboard
OleSetClipboard
OleCreateLink
OleCreateLinkToFile
OleGetAutoConvert
OleCreateFromFile
CoMarshalInterface
CoUnmarshalInterface
CreateStreamOnHGlobal
StringFromCLSID
StringFromGUID2
CLSIDFromProgID
ProgIDFromCLSID
CoGetClassObject
CoCreateInstance
MkParseDisplayName
CoIsOle1Class
OleQueryLinkFromData
OleQueryCreateFromData
GetClassFile
CreateBindCtx
OleDuplicateData
ReleaseStgMedium
OleSetMenuDescriptor
CoRegisterMessageFilter
OleUninitialize
OleInitialize
CoGetMalloc
OleRegGetMiscStatus
CoCreateGuid
IIDFromString
CoFreeUnusedLibraries
CoDisconnectObject
IsAccelerator
OleIsRunning
OleRun
OleLockRunning
StgCreateDocfile
WriteClassStg
OleSave
StgOpenStorage
OleLoad
CoLockObjectExternal
oleaut32
OleTranslateColor
OleCreatePropertyFrame
VariantInit
VariantClear
SysAllocString
SysFreeString
OleCreateFontIndirect
OleCreatePictureIndirect
SysAllocStringByteLen
OaBuildVersion
SysAllocStringLen
VariantChangeType
SetErrorInfo
CreateErrorInfo
GetErrorInfo
DispGetParam
LoadTypeLi
SysStringByteLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLibEx
UnRegisterTypeLi
LHashValOfNameSys
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
OleLoadPicture
SafeArrayDestroy
VariantCopy
VariantCopyInd
SafeArrayDestroyData
VariantChangeTypeEx
CreateDispTypeInfo
DispGetIDsOfNames
DispInvoke
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
OleIconToCursor
RevokeActiveObject
SafeArrayAllocDescriptor
SafeArrayDestroyDescriptor
SafeArrayAllocData
SafeArrayLock
SafeArrayUnlock
VarDateFromStr
SysReAllocStringLen
GetActiveObject
VarR8FromStr
VarCyFromI4
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
VarBstrFromR8
VarBstrFromDate
VarBstrFromCy
VarI2FromStr
VarI4FromStr
VarI4FromR8
VarR4FromStr
VarCyFromStr
SysReAllocString
LHashValOfNameSysA
SysStringLen
BASIC_CLASS_AddRef
BASIC_CLASS_GetIDsOfNames
BASIC_CLASS_Invoke
BASIC_CLASS_QueryInterface
BASIC_CLASS_Release
BASIC_DISPINTERFACE_GetTICount
BASIC_DISPINTERFACE_GetTypeInfo
CopyRecord
CreateIExprSrvObj
DLLGetDocumentation
DllCanUnloadNow
DllFunctionCall
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EVENT_SINK2_AddRef
EVENT_SINK2_Release
EVENT_SINK_AddRef
EVENT_SINK_GetIDsOfNames
EVENT_SINK_Invoke
EVENT_SINK_QueryInterface
EVENT_SINK_Release
EbCreateContext
EbDestroyContext
EbGetErrorInfo
EbGetHandleOfExecutingProject
EbGetObjConnectionCounts
EbGetVBAObject
EbIsProjectOnStack
EbLibraryLoad
EbLibraryUnload
EbLoadRunTime
EbResetProject
EbResetProjectNormal
EbSetContextWorkerThread
GetMem1
GetMem2
GetMem4
GetMem8
GetMemEvent
GetMemNewObj
GetMemObj
GetMemStr
GetMemVar
IID_IVbaHost
MethCallEngine
ProcCallEngine
PutMem1
PutMem2
PutMem4
PutMem8
PutMemEvent
PutMemNewObj
PutMemObj
PutMemStr
PutMemVar
SetMemEvent
SetMemNewObj
SetMemObj
SetMemVar
ThunRTMain
TipCreateInstanceEx
TipCreateInstanceProject2
TipGetAddressOfPredeclaredInstance
TipInvokeMethod
TipInvokeMethod2
TipSetOption
TipUnloadInstance
TipUnloadProject
UserDllMain
VBDllCanUnloadNow
VBDllGetClassObject
VBDllRegisterServer
VBDllUnRegisterServer
VarPtr
Zombie_AddRef
Zombie_GetIDsOfNames
Zombie_GetTypeInfo
Zombie_GetTypeInfoCount
Zombie_Invoke
Zombie_QueryInterface
Zombie_Release
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
__vbaAptOffset
__vbaAryConstruct
__vbaAryConstruct2
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryMove
__vbaAryRebase1Var
__vbaAryRecCopy
__vbaAryRecMove
__vbaAryUnlock
__vbaAryVar
__vbaAryVarVarg
__vbaBoolErrVar
__vbaBoolStr
__vbaBoolVar
__vbaBoolVarNull
__vbaCVarAryUdt
__vbaCastObj
__vbaCastObjVar
__vbaCheckType
__vbaCheckTypeVar
__vbaChkstk
__vbaCopyBytes
__vbaCopyBytesZero
__vbaCyAbs
__vbaCyAdd
__vbaCyErrVar
__vbaCyFix
__vbaCyForInit
__vbaCyForNext
__vbaCyI2
__vbaCyI4
__vbaCyInt
__vbaCyMul
__vbaCyMulI2
__vbaCySgn
__vbaCyStr
__vbaCySub
__vbaCyUI1
__vbaCyVar
__vbaDateR4
__vbaDateR8
__vbaDateStr
__vbaDateVar
__vbaDerefAry
__vbaDerefAry1
__vbaEnd
__vbaErase
__vbaEraseKeepData
__vbaEraseNoPop
__vbaError
__vbaErrorOverflow
__vbaExceptHandler
__vbaExitEachAry
__vbaExitEachColl
__vbaExitEachVar
__vbaExitProc
__vbaFPException
__vbaFPFix
__vbaFPInt
__vbaFailedFriend
__vbaFileClose
__vbaFileCloseAll
__vbaFileLock
__vbaFileOpen
__vbaFileSeek
__vbaFixstrConstruct
__vbaForEachAry
__vbaForEachCollAd
__vbaForEachCollObj
__vbaForEachCollVar
__vbaForEachVar
__vbaFpCDblR4
__vbaFpCDblR8
__vbaFpCSngR4
__vbaFpCSngR8
__vbaFpCmpCy
__vbaFpCy
__vbaFpI2
__vbaFpI4
__vbaFpR4
__vbaFpR8
__vbaFpUI1
__vbaFreeObj
__vbaFreeObjList
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaFreeVarg
__vbaGenerateBoundsError
__vbaGet3
__vbaGet4
__vbaGetFxStr3
__vbaGetFxStr4
__vbaGetOwner3
__vbaGetOwner4
__vbaGosub
__vbaGosubFree
__vbaGosubReturn
__vbaHresultCheck
__vbaHresultCheckNonvirt
__vbaHresultCheckObj
__vbaI2Abs
__vbaI2Cy
__vbaI2ErrVar
__vbaI2ForNextCheck
__vbaI2I4
__vbaI2Sgn
__vbaI2Str
__vbaI2Var
__vbaI4Abs
__vbaI4Cy
__vbaI4ErrVar
__vbaI4ForNextCheck
__vbaI4Sgn
__vbaI4Str
__vbaI4Var
__vbaInStr
__vbaInStrB
__vbaInStrVar
__vbaInStrVarB
__vbaInputFile
__vbaLateIdCall
__vbaLateIdCallLd
__vbaLateIdCallSt
__vbaLateIdNamedCall
__vbaLateIdNamedCallLd
__vbaLateIdNamedCallSt
__vbaLateIdNamedStAd
__vbaLateIdSt
__vbaLateIdStAd
__vbaLateMemCall
__vbaLateMemCallLd
__vbaLateMemCallSt
__vbaLateMemNamedCall
__vbaLateMemNamedCallLd
__vbaLateMemNamedCallSt
__vbaLateMemNamedStAd
__vbaLateMemSt
__vbaLateMemStAd
__vbaLbound
__vbaLdZeroAry
__vbaLenBstr
__vbaLenBstrB
__vbaLenVar
__vbaLenVarB
__vbaLineInputStr
__vbaLineInputVar
__vbaLsetFixstr
__vbaLsetFixstrFree
__vbaMidStmtBstr
__vbaMidStmtBstrB
__vbaMidStmtVar
__vbaMidStmtVarB
__vbaNameFile
__vbaNew
__vbaNew2
__vbaNextEachAry
__vbaNextEachCollAd
__vbaNextEachCollObj
__vbaNextEachCollVar
__vbaNextEachVar
__vbaObjAddref
__vbaObjIs
__vbaObjSet
__vbaObjSetAddref
__vbaObjVar
__vbaOnError
__vbaOnGoCheck
__vbaPowerR8
__vbaPrintFile
__vbaPrintObj
__vbaPut3
__vbaPut4
__vbaPutFxStr3
__vbaPutFxStr4
__vbaPutOwner3
__vbaPutOwner4
__vbaR4Cy
__vbaR4ErrVar
__vbaR4ForNextCheck
__vbaR4Sgn
__vbaR4Str
__vbaR4Var
__vbaR8Cy
__vbaR8ErrVar
__vbaR8FixI2
__vbaR8FixI4
__vbaR8ForNextCheck
__vbaR8IntI2
__vbaR8IntI4
__vbaR8Sgn
__vbaR8Str
__vbaR8Var
__vbaRaiseEvent
__vbaRecAnsiToUni
__vbaRecAssign
__vbaRecDestruct
__vbaRecDestructAnsi
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaRedimPreserveVar
__vbaRedimPreserveVar2
__vbaRedimVar
__vbaRedimVar2
__vbaRefVarAry
__vbaResume
__vbaRsetFixstr
__vbaRsetFixstrFree
__vbaSetSystemError
__vbaStopExe
__vbaStr2Vec
__vbaStrAryToAnsi
__vbaStrAryToUnicode
__vbaStrBool
__vbaStrCat
__vbaStrCmp
__vbaStrComp
__vbaStrCompVar
__vbaStrCopy
__vbaStrCy
__vbaStrDate
__vbaStrErrVarCopy
__vbaStrFixstr
__vbaStrI2
__vbaStrI4
__vbaStrLike
__vbaStrMove
__vbaStrR4
__vbaStrR8
__vbaStrTextCmp
__vbaStrTextLike
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrUI1
__vbaStrVarCopy
__vbaStrVarMove
__vbaStrVarVal
__vbaUI1Cy
__vbaUI1ErrVar
__vbaUI1I2
__vbaUI1I4
__vbaUI1Sgn
__vbaUI1Str
__vbaUI1Var
__vbaUbound
__vbaUdtVar
__vbaUnkVar
__vbaVar2Vec
__vbaVarAbs
__vbaVarAdd
__vbaVarAnd
__vbaVarCat
__vbaVarCmpEq
__vbaVarCmpGe
__vbaVarCmpGt
__vbaVarCmpLe
__vbaVarCmpLt
__vbaVarCmpNe
__vbaVarCopy
__vbaVarDateVar
__vbaVarDiv
__vbaVarDup
__vbaVarEqv
__vbaVarErrI4
__vbaVarFix
__vbaVarForInit
__vbaVarForNext
__vbaVarIdiv
__vbaVarImp
__vbaVarIndexLoad
__vbaVarIndexLoadRef
__vbaVarIndexLoadRefLock
__vbaVarIndexStore
__vbaVarIndexStoreObj
__vbaVarInt
__vbaVarLateMemCallLd
__vbaVarLateMemCallLdRf
__vbaVarLateMemCallSt
__vbaVarLateMemSt
__vbaVarLateMemStAd
__vbaVarLike
__vbaVarLikeVar
__vbaVarMod
__vbaVarMove
__vbaVarMul
__vbaVarNeg
__vbaVarNot
__vbaVarOr
__vbaVarPow
__vbaVarSetObj
__vbaVarSetObjAddref
__vbaVarSetUnk
__vbaVarSetUnkAddref
__vbaVarSetVar
__vbaVarSetVarAddref
__vbaVarSub
__vbaVarTextCmpEq
__vbaVarTextCmpGe
__vbaVarTextCmpGt
__vbaVarTextCmpLe
__vbaVarTextCmpLt
__vbaVarTextCmpNe
__vbaVarTextLike
__vbaVarTextLikeVar
__vbaVarTextTstEq
__vbaVarTextTstGe
__vbaVarTextTstGt
__vbaVarTextTstLe
__vbaVarTextTstLt
__vbaVarTextTstNe
__vbaVarTstEq
__vbaVarTstGe
__vbaVarTstGt
__vbaVarTstLe
__vbaVarTstLt
__vbaVarTstNe
__vbaVarVargNofree
__vbaVarXor
__vbaVarZero
__vbaVargObj
__vbaVargObjAddref
__vbaVargParmRef
__vbaVargUnk
__vbaVargUnkAddref
__vbaVargVar
__vbaVargVarCopy
__vbaVargVarMove
__vbaVargVarRef
__vbaVerifyVarObj
__vbaWriteFile
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_allmul
rtBoolFromErrVar
rtBstrFromErrVar
rtCyFromErrVar
rtDecFromVar
rtI2FromErrVar
rtI4FromErrVar
rtR4FromErrVar
rtR8FromErrVar
rtUI1FromErrVar
rtcAbsVar
rtcAnsiValueBstr
rtcAppActivate
rtcAppleScript
rtcArray
rtcAtn
rtcBeep
rtcBstrFromAnsi
rtcBstrFromByte
rtcBstrFromChar
rtcBstrFromError
rtcBstrFromFormatVar
rtcByteValueBstr
rtcCVErrFromVar
rtcCallByName
rtcChangeDir
rtcChangeDrive
rtcCharValueBstr
rtcChoose
rtcCommandBstr
rtcCommandVar
rtcCompareBstr
rtcCos
rtcCreateObject
rtcCreateObject2
rtcCurrentDir
rtcCurrentDirBstr
rtcDDB
rtcDateAdd
rtcDateDiff
rtcDateFromVar
rtcDatePart
rtcDeleteSetting
rtcDir
rtcDoEvents
rtcEndOfFile
rtcEnvironBstr
rtcEnvironVar
rtcErrObj
rtcExp
rtcFV
rtcFileAttributes
rtcFileCopy
rtcFileDateTime
rtcFileLen
rtcFileLength
rtcFileLocation
rtcFileReset
rtcFileSeek
rtcFileWidth
rtcFilter
rtcFixVar
rtcFormatCurrency
rtcFormatDateTime
rtcFormatNumber
rtcFormatPercent
rtcFreeFile
rtcGetAllSettings
rtcGetCurrentCalendar
rtcGetDateBstr
rtcGetDateValue
rtcGetDateVar
rtcGetDayOfMonth
rtcGetDayOfWeek
rtcGetErl
rtcGetFileAttr
rtcGetHostLCID
rtcGetHourOfDay
rtcGetMinuteOfHour
rtcGetMonthOfYear
rtcGetObject
rtcGetPresentDate
rtcGetSecondOfMinute
rtcGetSetting
rtcGetTimeBstr
rtcGetTimeValue
rtcGetTimeVar
rtcGetTimer
rtcGetYear
rtcHexBstrFromVar
rtcHexVarFromVar
rtcIMEStatus
rtcIPMT
rtcIRR
rtcImmediateIf
rtcInStr
rtcInStrChar
rtcInStrRev
rtcInputBox
rtcInputCharCount
rtcInputCharCountVar
rtcInputCount
rtcInputCountVar
rtcIntVar
rtcIsArray
rtcIsDate
rtcIsEmpty
rtcIsError
rtcIsMissing
rtcIsNull
rtcIsNumeric
rtcIsObject
rtcJoin
rtcKillFiles
rtcLeftBstr
rtcLeftCharBstr
rtcLeftCharVar
rtcLeftTrimBstr
rtcLeftTrimVar
rtcLeftVar
rtcLenCharVar
rtcLenVar
rtcLog
rtcLowerCaseBstr
rtcLowerCaseVar
rtcMIRR
rtcMacId
rtcMakeDir
rtcMidBstr
rtcMidCharBstr
rtcMidCharVar
rtcMidVar
rtcMonthName
rtcMsgBox
rtcNPV
rtcNPer
rtcOctBstrFromVar
rtcOctVarFromVar
rtcPMT
rtcPPMT
rtcPV
rtcPackDate
rtcPackTime
rtcPartition
rtcQBColor
rtcR8ValFromBstr
rtcRandomNext
rtcRandomize
rtcRate
rtcRemoveDir
rtcReplace
rtcRgb
rtcRightBstr
rtcRightCharBstr
rtcRightCharVar
rtcRightTrimBstr
rtcRightTrimVar
rtcRightVar
rtcRound
rtcSLN
rtcSYD
rtcSaveSetting
rtcSendKeys
rtcSetCurrentCalendar
rtcSetDateBstr
rtcSetDateVar
rtcSetFileAttr
rtcSetTimeBstr
rtcSetTimeVar
rtcSgnVar
rtcShell
rtcSin
rtcSpaceBstr
rtcSpaceVar
rtcSplit
rtcSqr
rtcStrConvVar
rtcStrConvVar2
rtcStrFromVar
rtcStrReverse
rtcStringBstr
rtcStringVar
rtcSwitch
rtcTan
rtcTrimBstr
rtcTrimVar
rtcTypeName
rtcUpperCaseBstr
rtcUpperCaseVar
rtcVarBstrFromAnsi
rtcVarBstrFromByte
rtcVarBstrFromChar
rtcVarDateFromVar
rtcVarFromError
rtcVarFromFormatVar
rtcVarFromVar
rtcVarStrFromVar
rtcVarType
rtcWeekdayName
Name
.text
Size
1008KB
Virtual Size
1007KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ENGINE
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
64KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$TEMP/msvcrt.dll
- IMPHASH 179b04fb57bf5f17850c94a941db63fa
- SHA256 d7cea69a98579d928e534070f5293e80ed7df38baf611b20717ef55aa1344a18
- MD5 055b02d711cdedb8c5997274c4e99cb8
- SHA1 5c816eeb6e4d5f1c11e9f56c992ee7d452e7c0f9
- SHA512 4774431fe768e424f46c833236a41d68f05d98ed14353b04428a5d190dbe213bb56087a5e5cca5cd98598f2c1611fddfed3a7a79bbd362bc02e586cc367907c0
- SSDEEP 6144:yk54RkH8RKDou3LlG/3Roe0Ro4zJsdF9gjFMgiFjNr7mcl2oZhogKLOmJxZR92l3:R4RtIR3BG/3We0RVJsdFFUzchogKLOmc
- TLSH T12854BF217F91CDB9E6DB81700D287F2E9BBEB69044B4CC43A7D89F982B316429717127
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
05:45:4e:84:dc:97:47:28:63:04:2e:f3:20:9d:f1:ea
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows 2000 Beta,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
CN=Microsoft Windows 2000 Beta,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
72:b5:13:47:ab:f8:11:d2:a4:1e:00:c0:4f:79:fe:8e
Issuer
CN=Microsoft Beta PCA Authority,OU=Copyright (c) 1999 Microsoft Corp.+OU=Microsoft Corporation
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 13, 1999 - Feb 1, 2000
Minor OS version
0
Major OS version
4
Entry point
7240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
EnumSystemLocalesA
RtlUnwind
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
SetUnhandledExceptionFilter
GetModuleFileNameA
GetModuleFileNameW
ExitProcess
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetCommandLineA
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
ResumeThread
CreateThread
TlsSetValue
ExitThread
CloseHandle
GetCurrentThreadId
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
HeapFree
HeapAlloc
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetCommandLineW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetConsoleCtrlHandler
SetEnvironmentVariableW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
RaiseException
GetUserDefaultLCID
GetLocaleInfoW
GetTimeZoneInformation
FlushFileBuffers
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
Sleep
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
GetCurrentProcessId
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
HeapSize
ReadConsoleA
SetConsoleMode
GetConsoleMode
SetEndOfFile
WriteConsoleA
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
LockFile
UnlockFile
CreateFileA
CreatePipe
ReadFile
CreateFileW
GetSystemTimeAsFileTime
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
SetLocalTime
$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_E__non_rtti_object@@UAEPAXI@Z
??_Ebad_cast@@UAEPAXI@Z
??_Ebad_typeid@@UAEPAXI@Z
??_Eexception@@UAEPAXI@Z
??_G__non_rtti_object@@UAEPAXI@Z
??_Gbad_cast@@UAEPAXI@Z
??_Gbad_typeid@@UAEPAXI@Z
??_Gexception@@UAEPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?terminate@@YAXXZ
?unexpected@@YAXXZ
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CxxFrameHandler
__CxxLongjmpUnwind
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__argc
__argv
__badioinfo
__crtCompareStringA
__crtGetLocaleInfoW
__crtLCMapStringA
__dllonexit
__doserrno
__fpecode
__getmainargs
__initenv
__isascii
__iscsym
__iscsymf
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pioinfo
__pxcptinfoptrs
__set_app_type
__setlc_active
__setusermatherr
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__unguarded_readlc_active
__wargv
__wgetmainargs
__winitenv
_abnormal_termination
_access
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_amsg_exit
_assert
_atodbl
_atoi64
_atoldbl
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_cexit
_cgets
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_clearfp
_close
_commit
_commode
_control87
_controlfp
_copysign
_cprintf
_cputs
_creat
_cscanf
_ctime64
_ctype
_cwait
_daylight
_dstbias
_dup
_dup2
_ecvt
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64tow
_initterm
_inp
_inpd
_inpw
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcpunct
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lseek
_lseeki64
_ltoa
_ltow
_makepath
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscoll
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsicoll
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbcpy
_mbsnbicmp
_mbsnbicoll
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncoll
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_osplatform
_osver
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putenv
_putw
_putws
_pwctype
_read
_rmdir
_rmtmp
_rotl
_rotr
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_searchenv
_seh_longjmp_unwind
_set_error_mode
_set_sbh_threshold
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snwprintf
_sopen
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_stat
_stat64
_stati64
_statusfp
_strcmpi
_strdate
_strdup
_strerror
_stricmp
_stricoll
_strlwr
_strncoll
_strnicmp
_strnicoll
_strnset
_strrev
_strset
_strtime
_strupr
_swab
_sys_errlist
_sys_nerr
_tell
_telli64
_tempnam
_time64
_timezone
_tolower
_toupper
_tzname
_tzset
_ui64toa
_ui64tow
_ultoa
_ultow
_umask
_ungetch
_unlink
_unloaddll
_unlock
_utime
_utime64
_vsnprintf
_vsnwprintf
_waccess
_wasctime
_wchdir
_wchmod
_wcmdln
_wcreat
_wcsdup
_wcsicmp
_wcsicoll
_wcslwr
_wcsncoll
_wcsnicmp
_wcsnicoll
_wcsnset
_wcsrev
_wcsset
_wcsupr
_wctime
_wctime64
_wenviron
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst
_wfindfirst64
_wfindfirsti64
_wfindnext
_wfindnext64
_wfindnexti64
_wfopen
_wfreopen
_wfsopen
_wfullpath
_wgetcwd
_wgetdcwd
_wgetenv
_winmajor
_winminor
_winver
_wmakepath
_wmkdir
_wmktemp
_wopen
_wperror
_wpgmptr
_wpopen
_wputenv
_wremove
_wrename
_write
_wrmdir
_wsearchenv
_wsetlocale
_wsopen
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wsplitpath
_wstat
_wstat64
_wstati64
_wstrdate
_wstrtime
_wsystem
_wtempnam
_wtmpnam
_wtoi
_wtoi64
_wtol
_wunlink
_wutime
_wutime64
_y0
_y1
_yn
abort
abs
acos
asctime
asin
atan
atan2
atexit
atof
atoi
atol
bsearch
calloc
ceil
clearerr
clock
cos
cosh
ctime
difftime
div
exit
exp
fabs
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
floor
fmod
fopen
fprintf
fputc
fputs
fputwc
fputws
fread
free
freopen
frexp
fscanf
fseek
fsetpos
ftell
fwprintf
fwrite
fwscanf
getc
getchar
getenv
gets
getwc
getwchar
gmtime
is_wctype
isalnum
isalpha
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
labs
ldexp
ldiv
localeconv
localtime
log
log10
longjmp
malloc
mblen
mbstowcs
mbtowc
memchr
memcmp
memcpy
memmove
memset
mktime
modf
perror
pow
printf
putc
putchar
puts
putwc
putwchar
qsort
raise
rand
realloc
remove
rename
rewind
scanf
setbuf
setlocale
setvbuf
signal
sin
sinh
sprintf
sqrt
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtod
strtok
strtol
strtoul
strxfrm
swprintf
swscanf
system
tan
tanh
time
tmpfile
tmpnam
tolower
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
vfwprintf
vprintf
vsprintf
vswprintf
vwprintf
wcscat
wcschr
wcscmp
wcscoll
wcscpy
wcscspn
wcsftime
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstod
wcstok
wcstol
wcstombs
wcstoul
wcsxfrm
wctomb
wprintf
wscanf
Name
.text
Size
200KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=19, version=8034,
count=141, id=1, productName=Unmarked objects,
count=19, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=67, id=14, version=7299,
count=501, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/p001.nbd
- SHA256 6e39e8b14ac5a0dad47279595406a49c61c6748f16f4e69dd48738653e50882f
- MD5 89baf0ce132d54517f89e6fdebb6764f
- SHA1 41509f6bce097e434651148a36012cd8c66da2d7
- SHA512 2b3d3fe6dc4bddc34005cbf461f27e10e7a330aba645dd27ce787bc79ff28e9627abd3adce27bc8741ed160ceda9c22fa0c62d9faa16454d6700437eb72a6e6b
- SSDEEP 384:2Pt/eO/RjVAPQjOrjo9VrIxGs6PuobKQG1W1Wy9eNanfJzDxNp:2l/Z/xW3o9VMCJKQx1WyEKhhz
- TLSH T1ECA2CF1A683C730375BDD1D92074E93F2B7F9D92290AAB48BC6490ED45BBF208C28F40
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/s1.nbd
- SHA256 abad946feed68057f15569c0df432790b0c19a21149c8f07ecfc99fac2311616
- MD5 4e4d3a1400a1d0bcf482fc8da711ccba
- SHA1 751769e1582ce3a057ba6fb0270698a2a48d5dae
- SHA512 13b04814456172ea858c220c36d0c066286965a2bcd217c0216788e3fb84ecc1c007ed8f44124a368400b858af584a2fff855919cb7bb3fb195da39abb0e675a
- SSDEEP 3072:7P0t9Ul1fX5RKr/xooFEZZzpiqHYhT0Jic3IYbMCMW4NktxiR/1jRXvcsaKWN:7PoohGd0Vp/4hT0JH4YAqqRX0saKS
- TLSH T19214D0914E5EF162693D953110D33E1B468A12523CCCA7EF263854626AEFDAF3C0F62D
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/sites.nbd
- SHA256 5a8749440d441766dba442097d5956cd7bfc0f3bb1fb46d431df341bba1a2778
- MD5 a8e5c2cef7e455ce4f6cdd601ac774bb
- SHA1 0ebe0f1ddbdcaee08d4a5505b6f8a329022e554d
- SHA512 186a9146263011c70dd8c342956564163c4d496b938842eb2c06382464ab9aef73e5cf87dd70ee2d8177d61c1ccb3fb71510b5064b18a014b394322859fd7c3b
- TLSH T1311163A151EE4281C91CF8D34E2F6A19A69E86921E32B877240C930BCE541BB87742F5
- MD5 SHA1 SHA512 TLSH
$TEMP/speedup.ico
- SHA256 aebda70076ae40f99896ee71d5a476444e91974a215663161b6b1d89faa3ab2c
- MD5 6c9011742ff814f765779df48147fa58
- SHA1 5519c010b4af11452d126439d9e670ef68c77057
- SHA512 766005a4cfd5edb960346316725c1c4e427042118e1b702c0a67552b8c2de3a376ccd1422e0db0a8f955642a7e2686c70a266f01362bd17afefcea9823ce5d70
- SSDEEP 384:y5R7s+8FEyEYGwnauSzZYPmeBjF6ScYrSY6w98MJlp:yT7s755qZYPnBh6pqJh9DJj
- TLSH T1B3B2D7A1E183F950C16CCD37C05FAE7C127D0C5ABDE9EA124154B90B7B3D2B42B03196
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/ssa3d30.ocx
- IMPHASH 624318614059381482cbd80516416d6d
- SHA256 7a0418b76d00665a71d13a30d838c3e086304bacd10d764650d2a5d2ec691008
- MD5 48c35ed0a09855b29d43f11485f8423b
- SHA1 46716282cc5e0f66cb96057e165fa4d8d60fbae2
- SHA512 779938ec9b0f33f4cbd5f1617bea7925c1b6d794e311737605e12cd7efa5a14bbc48bee85208651cf442b84133be26c4cc8a425d0a3b5b6ad2dc27227f524a99
- SSDEEP 6144:OEIHG7QYXSCz6QEPbLhB8Fp5qycE5lVdBqxuu3:9Im77XSTPbLhWp5vUf
- TLSH T101646C03B3C289B3C8970E31491B3FB9AB799D006D36A25B67657B0D2D72791DE0532B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a4:58:25:1e:81:8a:da:cd:68:98:32:d1:56:15:95:e5
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
4
Entry point
160779
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
olepro32
ord250
ord253
ord252
ord251
kernel32
LocalUnlock
LocalLock
MulDiv
LocalFree
GlobalReAlloc
LocalAlloc
GetSystemTime
GetVersion
lstrcpynA
OpenFile
GetLocaleInfoA
GetProcessHeap
DisableThreadLibraryCalls
GetProcAddress
lstrcatA
LoadLibraryA
lstrcmpiA
GlobalFree
lstrcpyA
lstrlenW
IsDBCSLeadByte
lstrcmpiW
WideCharToMultiByte
HeapFree
HeapReAlloc
HeapAlloc
GlobalAlloc
GetModuleFileNameA
MultiByteToWideChar
FreeLibrary
GlobalLock
GlobalUnlock
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LockResource
FindResourceA
LoadResource
GetVersionExA
CreateThread
CloseHandle
GlobalSize
CreateMutexA
ReleaseMutex
InterlockedIncrement
Sleep
WaitForSingleObject
InterlockedExchange
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
user32
LoadCursorA
DrawTextA
RegisterClassA
SendMessageA
IsWindow
ChildWindowFromPointEx
ScreenToClient
GetCursorPos
KillTimer
SetTimer
SetRectEmpty
IntersectRect
GrayStringA
InvertRect
DrawIconEx
VkKeyScanA
CreateAcceleratorTableA
GetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
GetDlgItem
GetForegroundWindow
DialogBoxParamA
EndDialog
UnregisterClassA
CharNextA
CharUpperA
GetKeyState
SetCursor
PostMessageA
GetActiveWindow
GetCapture
SetCapture
ReleaseCapture
GetFocus
MoveWindow
BeginPaint
EndPaint
DefWindowProcA
SetParent
CreateWindowExA
DestroyWindow
RegisterClipboardFormatA
GetPropA
SetPropA
SetWindowPos
ShowWindow
SetFocus
GetWindowRect
wsprintfA
EnableWindow
OffsetRect
ClientToScreen
SetWindowLongA
FrameRect
DrawFocusRect
DrawEdge
GetWindowRgn
SetWindowRgn
InflateRect
GetSysColor
GetAsyncKeyState
FillRect
GetClassNameA
CopyRect
GetSystemMetrics
InvalidateRect
UpdateWindow
LoadStringA
MessageBoxA
GetWindowLongA
GetParent
PtInRect
GetDC
DispatchMessageA
TranslateMessage
GetWindow
GetUpdateRgn
IsWindowVisible
PeekMessageA
EqualRect
ReleaseDC
SetCursorPos
GetClipboardFormatNameA
IsRectEmpty
GetClientRect
MapWindowPoints
SubtractRect
ole32
CoUnmarshalInterface
DoDragDrop
RegisterDragDrop
CreateStreamOnHGlobal
IIDFromString
CoUninitialize
CoMarshalInterface
RevokeDragDrop
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
ReleaseStgMedium
CreateDataAdviseHolder
CoTaskMemAlloc
CreateOleAdviseHolder
CoTaskMemFree
CoCreateInstance
StringFromGUID2
advapi32
RegEnumKeyExA
RegQueryValueA
RegDeleteKeyA
RegOpenKeyA
RegCreateKeyA
RegSetValueA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
oleaut32
RegisterTypeLi
CreateErrorInfo
SysReAllocStringLen
SystemTimeToVariantTime
SysAllocStringLen
SetErrorInfo
LoadRegTypeLi
SysAllocString
VariantCopyInd
VariantChangeType
SysStringLen
VariantClear
VariantCopy
UnRegisterTypeLi
LoadTypeLibEx
VariantInit
SysFreeString
SysStringByteLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
SafeArrayCopy
LoadTypeLi
gdi32
SetTextAlign
ExtCreateRegion
SaveDC
CreateMetaFileA
SelectClipRgn
GetWindowExtEx
LPtoDP
GetViewportExtEx
SetViewportExtEx
CreateDCA
SetMapMode
GetPaletteEntries
GetDIBits
CreateFontIndirectA
GetNearestPaletteIndex
GetDIBColorTable
SetDIBColorTable
GetSystemPaletteEntries
SetDIBitsToDevice
CreatePalette
CreateDIBitmap
StretchDIBits
PlayEnhMetaFile
PatBlt
PlayMetaFile
StretchBlt
IntersectClipRect
CreatePatternBrush
TextOutA
GetTextColor
GetTextMetricsA
GetCurrentPositionEx
ExtSelectClipRgn
GetCharWidthA
SetWindowOrgEx
GetOutlineTextMetricsA
RestoreDC
CloseMetaFile
SetWindowExtEx
GetTextExtentPoint32A
SetBkMode
DeleteMetaFile
Ellipse
SetPixel
CreatePen
SetDIBits
GetRegionData
FillRgn
FrameRgn
GetObjectType
SetTextColor
GetBitmapBits
CopyEnhMetaFileA
CopyMetaFileA
OffsetRgn
CombineRgn
CreateRectRgnIndirect
GetNearestColor
SetBkColor
ExtTextOutA
CreateSolidBrush
SelectPalette
RealizePalette
GetStockObject
CreateCompatibleBitmap
MoveToEx
CreateDIBSection
GetClipRgn
BitBlt
CreateCompatibleDC
CreateBitmap
OffsetViewportOrgEx
SetViewportOrgEx
CreateRectRgn
DeleteObject
SelectObject
CreateICA
GetDeviceCaps
DeleteDC
GetClipBox
PtInRegion
GetRgnBox
GetPixel
GetObjectA
LineTo
winmm
sndPlaySoundA
msvcrt
free
strrchr
wcslen
_mbscmp
malloc
_ftol
_beginthread
_purecall
wcscmp
??2@YAPAXI@Z
_except_handler3
??1type_info@@UAE@XZ
_CxxThrowException
_adjust_fdiv
memset
memcpy
_initterm
_onexit
__dllonexit
strstr
atol
memcmp
_itoa
??3@YAXPAX@Z
memmove
shell32
ShellExecuteA
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
176KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=14, version=7299,
count=32, id=19, version=8022,
count=14, id=19, version=8034,
count=301, id=1, productName=Unmarked objects,
count=67, productName=Unmarked objects (old),
count=67, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$TEMP/sstabs2.ocx
- IMPHASH 8243f65c3cd4a6c8c7ae92fdbede3127
- SHA256 596f3235642c9c968650194065850ecb02c8c524d2bdcaf6341a01201e0d69be
- MD5 7303efb737685169328287a7e9449ab7
- SHA1 47bfe724a9f71d40b5e56811ec2c688c944f3ce7
- SHA512 e0d9cb9833725e0cdc7720e9d00859d93fc51a26470f01a0c08c10fa940ed23df360e093861cf85055b8a588bb2cac872d1be69844a6c754ac8ed5bfaf63eb03
- SSDEEP 6144:/sd14Jpad8qAuQGIBTOuCXMMpyU6XAcg0nTq:tS8qABGIBTJEMpIp
- TLSH T169549F43B3E1C4F3C2A31230592B57A99BB9B9106D34974BA390DF5C3D72647EA19327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
174353
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
__dllonexit
_adjust_fdiv
malloc
_initterm
free
_onexit
_strcmpi
_beginthreadex
_endthreadex
strstr
_mbschr
_mbsinc
atol
??2@YAPAXI@Z
_except_handler3
_purecall
memmove
??3@YAXPAX@Z
islower
_beginthread
_ftol
__CxxFrameHandler
_EH_prolog
_ismbcdigit
wcscmp
memcmp
fclose
fopen
_itoa
strrchr
wcslen
vsprintf
_mbclen
atoi
??1type_info@@UAE@XZ
_CxxThrowException
realloc
memset
memcpy
olepro32
ord251
ord252
ord250
ord253
kernel32
WaitForSingleObject
GetSystemTime
InterlockedExchange
CloseHandle
GetLastError
MulDiv
SetLastError
CompareStringA
GetLocaleInfoA
lstrcpynA
lstrcpyA
lstrcatA
DisableThreadLibraryCalls
OpenFile
GetVersion
lstrlenW
lstrcmpiA
GetProcAddress
InterlockedIncrement
WideCharToMultiByte
InterlockedDecrement
MultiByteToWideChar
GetModuleFileNameA
lstrlenA
DeleteCriticalSection
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
InitializeCriticalSection
LoadLibraryA
GetModuleHandleA
GetTickCount
EnterCriticalSection
FreeLibrary
GetCurrentThreadId
GlobalAlloc
LeaveCriticalSection
GlobalSize
GlobalFree
GlobalLock
GlobalUnlock
IsDBCSLeadByte
lstrcmpA
Sleep
ResumeThread
GlobalReAlloc
LocalFree
user32
PtInRect
PeekMessageA
CharNextA
InvertRect
GrayStringA
EndDialog
DialogBoxParamA
GetForegroundWindow
GetDlgItem
SetWindowTextA
SendDlgItemMessageA
GetDlgItemTextA
CallWindowProcA
CharUpperA
CreateAcceleratorTableA
GetActiveWindow
RegisterWindowMessageA
ShowWindow
RemovePropA
SetWindowLongA
CreateWindowExA
MoveWindow
SetWindowPos
DefWindowProcA
BeginPaint
GetWindowTextA
EndPaint
SystemParametersInfoA
SetFocus
VkKeyScanA
MessageBoxA
GetPropA
SetPropA
GetKeyState
GetAsyncKeyState
GetDoubleClickTime
CallNextHookEx
FrameRect
wsprintfA
GetSystemMetrics
EqualRect
SetRect
IsWindowEnabled
DrawEdge
LoadStringA
UnhookWindowsHookEx
MapWindowPoints
SetCursor
SetTimer
KillTimer
ReleaseCapture
SetCapture
UpdateWindow
SetWindowsHookExA
GetWindow
InvalidateRect
IsRectEmpty
RedrawWindow
CopyRect
DrawFrameControl
LoadBitmapA
ClientToScreen
OffsetRect
GetParent
GetWindowRect
ScreenToClient
SendMessageA
IsWindowVisible
GetWindowLongA
SetWindowRgn
GetWindowRgn
LoadCursorA
RegisterClassA
DestroyWindow
GetClassNameA
IsWindow
GetCursorPos
WindowFromPoint
PostMessageA
GetClientRect
DrawTextA
IntersectRect
GetSysColor
GetDC
ReleaseDC
GetFocus
FillRect
SetParent
InflateRect
DrawFocusRect
SetRectEmpty
SetCursorPos
GetClipboardFormatNameA
EnableWindow
UnregisterClassA
RegisterClipboardFormatA
DrawIconEx
ole32
CoCreateInstance
CoMarshalInterface
CoUnmarshalInterface
DoDragDrop
RegisterDragDrop
RevokeDragDrop
IIDFromString
StringFromGUID2
CoTaskMemFree
CreateOleAdviseHolder
CreateDataAdviseHolder
ReleaseStgMedium
CoTaskMemAlloc
CoGetMalloc
CoCreateGuid
GetHGlobalFromStream
CreateStreamOnHGlobal
advapi32
RegCreateKeyExA
RegOpenKeyA
RegCreateKeyA
RegSetValueA
RegQueryValueA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
oleaut32
SystemTimeToVariantTime
SysReAllocStringLen
RegisterTypeLi
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
SafeArrayCopy
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VariantCopyInd
SysStringByteLen
SysAllocStringLen
LoadTypeLibEx
UnRegisterTypeLi
VariantClear
VariantInit
SysStringLen
VariantChangeType
SysFreeString
VariantCopy
SysAllocString
gdi32
CopyEnhMetaFileA
SetTextAlign
GetCurrentPositionEx
ExtCreateRegion
GetNearestColor
SetPixelV
GetBitmapBits
CopyMetaFileA
LineTo
MoveToEx
DeleteObject
SetTextColor
SetBkColor
SelectClipRgn
IntersectClipRect
GetClipRgn
CreateRectRgn
GetCharWidthA
CreatePalette
StretchDIBits
GetSystemPaletteEntries
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
RealizePalette
SelectPalette
LPtoDP
EqualRgn
CombineRgn
GetOutlineTextMetricsA
OffsetViewportOrgEx
CreateBitmap
SetViewportOrgEx
CreateFontIndirectA
GetObjectA
GetDeviceCaps
BitBlt
GetObjectType
OffsetRgn
ExcludeClipRect
GetStockObject
PtInRegion
GetPixel
SetBkMode
CreatePen
CreatePolygonRgn
GetTextExtentPoint32A
CreateRectRgnIndirect
GetPaletteEntries
SetROP2
CreateICA
StretchBlt
DeleteMetaFile
GetClipBox
RestoreDC
SetWindowExtEx
CloseMetaFile
SaveDC
CreateMetaFileA
SetWindowOrgEx
GetWindowExtEx
SetMapMode
GetViewportExtEx
CreateDCA
CreateDIBitmap
SetViewportExtEx
PlayEnhMetaFile
SelectObject
ExtTextOutA
PlayMetaFile
GetDIBits
ExtSelectClipRgn
GetTextColor
TextOutA
CreateSolidBrush
PatBlt
GetViewportOrgEx
CreatePatternBrush
GetTextMetricsA
CreateDIBSection
SetDIBColorTable
GetWindowOrgEx
winmm
sndPlaySoundA
comctl32
ImageList_Destroy
shell32
ShellExecuteA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
188KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=32, id=19, version=8022,
count=14, id=19, version=8034,
count=72, productName=Unmarked objects (old),
count=2, id=14, version=7299,
count=4, id=10, version=8447,
count=312, id=1, productName=Unmarked objects,
count=67, id=11, version=8447,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/t001.nbd
- SHA256 b30e7a66488327c0cf090ae98eece036f326c7f5b2ffa9f9cac3bf7df3e7af47
- MD5 15a02eb5a83be1c01ff9579f2ce06aed
- SHA1 1c8ed5541fb243602e963759ea4d284b9842000f
- SHA512 06a562d88eeb6ddd8c056df834bc8d0e02bba501c417f9a2531761492233e0f07d17ba65602c6acac2bdcbb463bd6aedba2f397b5b707bc64565958b78f27472
- SSDEEP 768:qPWd2Os9M7mXPNKjiFi6YtZGbdMzRoPQ/9RVH1pocYz0NVXejY:q+d2t62PUiFiJcdMKPQ/el0vejY
- TLSH T130D2CFB809F6961582BFE42C151A0E03774E5CF128651AE2FF4B27678BBFF50487C524
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/t2.nbd
- SHA256 87d531d27e9987f39934b0f093542790f25882c9e6e20ca554ca0405a16a4acf
- MD5 3a538baefe6893b4997ffcd25f339329
- SHA1 c2d3e1f16c663c435735cf27a6e114f5b2f85df7
- SHA512 e9eed3c7a0b9935e769b56d430fc6081e63f97a7d9d0df0b1913220cc0519223353ecc48b3dcc4a0147f77741d0367c0ba9b8d9a56645c1f03524399155c8c50
- SSDEEP 1536:6BBO22jqRuV8t01n8XCF7yXOi0SOHnbOGHOvBPUmKQ:QB/2jqRuV8vCF7yhOHbjOUA
- TLSH T12063DF7501FD4D8A838FD42CB20A5C12732E4DB62A5B68D4BA494B5BC3AFF14D874B71
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/t3.nbd
- SHA256 94c638be958f83325f9b96303e050383881959f509bc6c4afacd890db3755672
- MD5 132adcfde600f76d5f9e4e8d45b5d936
- SHA1 619164a1f95d6f5c8286fa2ea7ab5513c6d4bb2b
- SHA512 b3bfa48570fc472846ae11712616ba63c6fef5994f04d463ae06cac6dbe5bb19ce43816b0c4b15ec37bc537c8c24d747757df116dade99d2f3c42f0f312a021a
- SSDEEP 768:UPPQ3iM/+52laQf145blVHuThJS/qiNpsBYmMFA5JPVqMPxR3lC87LOn2mx9gzTg:UPYw5Qj6OFJS189MAxP7EfM+
- TLSH T14143CE7802FA158A07ABEB5CB51D9D96B7AE0CB2996304C2BD075396C37FF408C71672
- MD5 SHA1 SHA512 SSDEEP TLSH
$TEMP/t3.nbd-SR
- SHA256 a994e2ea053542543b647dc81d6e0aa7fc7585311b77f5fd76e13b1bd73a67cf
- MD5 d58e9150a9a022012c421bb8229385d3
- SHA1 9c1ecb6c18cddf731003e805914534635b0476b5
- SHA512 90ae9db622ed832adcab70aab7833ee8eae4f18b006b89d5982586fb492a797f7ea0e5cdefde16b6929168f0db80ff56d49a39c53ac744e4e3487ef84d44f7cb
- TLSH T1E511668343841B7AF18D0FC9858B201224F6C82FBC180148BFB36EE77C3B9864830626
- MD5 SHA1 SHA512 TLSH
$WINDIR/MsAgent/chars/Bonzi.acs
- SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
- MD5 1fd2907e2c74c9a908e2af5f948006b5
- SHA1 a390e9133bfd0d55ffda07d4714af538b6d50d3d
- SHA512 8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171
- SSDEEP 98304:KdAMaWetTel1Q9ypfl1ydxUa751yGEFbnHEpAbY+/ERW3lc6u7/jtzVJdcbJ:KdAMaWetTeAkLIdx751qFTkub//73lcM
- TLSH T1FE361252FB82A840C420D6372D6AE9E17626FF945F53570E2F1B7E3C2672175E62B203
- MD5 SHA1 SHA512 SSDEEP TLSH
uninst.exe
- IMPHASH be41bf7b8cc010b614bd36bbca606973
- SHA256 f01ecaaa5bfb32d500a79ea28a64c5a25ec81c03f7cbf4206706e7580508ce4e
- MD5 6207aefc46ac857f836bf3669d91f7bd
- SHA1 a7df873db5acdbf3bfc6eb03401114a613e64946
- SHA512 0a3e9d8e69b12ce2900e0daf249d0dbb571c43caaa39a3952f126d958a14d5265fee777f4ffca0da521e61d87375efd2e58135926220acae45e442e81a7c4162
- SSDEEP 1536:cGarUa6LowvuhdNYh2Gf9rg6hzGPnZCryGL01sj0eBKOR+W:u5BuYAVrgUCPnZCryGzAsHRd
- TLSH T1A2739D437BE8847BE6B60E715E729B634ABAF8211C34D61F67009ECE7831641CD2476B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
14511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW
user32
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
advapi32
RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
900KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/UAC.dll
- IMPHASH 0ef725341a4aecf8398c0e2132f38049
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetLastError
GetCurrentProcessId
GetCommandLineW
GetProcAddress
CreateThread
GlobalFree
LoadLibraryA
OpenProcess
GlobalAlloc
CreateFileMappingW
Sleep
MapViewOfFile
GetModuleHandleW
UnmapViewOfFile
CreateEventW
SetCurrentDirectoryW
GetVersionExW
GetExitCodeProcess
lstrcatW
LocalFree
GetPrivateProfileStringW
FormatMessageW
GetPrivateProfileIntW
CreateProcessW
CloseHandle
GetLastError
DuplicateHandle
GetCurrentThreadId
lstrlenW
SetEvent
WaitForSingleObject
lstrcmpiW
GetExitCodeThread
GetModuleFileNameW
user32
SetWindowPos
GetClientRect
GetWindowThreadProcessId
SetWindowLongW
DefWindowProcW
GetDlgItem
CallWindowProcW
CallNextHookEx
GetClassNameW
PeekMessageW
DestroyWindow
SendMessageW
SetForegroundWindow
IsWindowVisible
MsgWaitForMultipleObjects
LoadStringW
EndDialog
EnableWindow
DialogBoxParamW
LoadImageW
MessageBoxW
GetWindowLongW
DispatchMessageW
ShowWindow
wsprintfW
CreateDialogParamW
GetWindowRect
IsDialogMessageW
FindWindowExW
CharNextW
CreateWindowExW
LoadIconW
PostMessageW
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage
shell32
ShellExecuteExW
advapi32
OpenServiceW
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
EqualSid
ole32
CoInitialize
_
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=83, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/UserInfo.dll
- IMPHASH 45d25ca52c312b2254c60dbcb30342d1
- SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
- MD5 c7ce0e47c83525983fd2c4c9566b4aad
- SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
- SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
- TLSH T14481777F63B448B3E45907BB03A614D711E2D530530B401E498F1E6A1885DA7FD6E717
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentThread
GetCurrentProcess
GetModuleHandleW
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynW
GlobalAlloc
advapi32
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
OpenThreadToken
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
686B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
753B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=1, productName=Unmarked objects,
count=3, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,