b3bc2b33320defe98bf6360699b76afb

resource
b3bc2b33320defe98bf6360699b76afb
unpack001/$PLUGINSDIR/AccessControl.dll
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/UAC.dll
unpack001/lzma.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 7981c067ad5f8c4880fff55719b09c0c8511ab4d41205de662ad017f02ff8bba
MD5 b3bc2b33320defe98bf6360699b76afb
SHA1 a98d03be26e248dd6409775e88eafbc999535efd
SHA512 5350a8259d4cc487256232f9e660d5d5cdc9c6d6ad01581d04b1667fee41f311282f2db9f17e3c9c101ea71ce3b1bbb586f6275949322e25fa40fb376d1bcd45
SSDEEP 49152:mgLYS8PhtzTy5kWiQT8TLqoadxT4hhK6DvxCoC:mUYS8zeqW5TqNab4hNZCoC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AccessControl.dll

IMPHASH ed83f419402bc3b83a08e3aaf8b5b5b7
SHA256 4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
MD5 055f4f9260e07fc83f71877cbb7f4fad
SHA1 a245131af1a182de99bd74af9ff1fab17977a72f
SHA512 a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
SSDEEP 192:8SEWBGgiJM4LN+xq56XdNcNz/NWdlJmlyOcROQ:8SEPgii9KTzyt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DcryptDll.dll

IMPHASH 322977d1ab076375f887588994151f0a
SHA256 debc1bc6f2f109a0fc230d9cf8cbb74055ac7513ff78a81fd12c0015be680add
MD5 e35a86826715716a069bd52201dabc57
SHA1 0d679294d68250d22d3854ebf193263bf8b20bfe
SHA512 dae618bfa1f012d2cdfc7199ba8aca20f7aa6f6614e57d9bd74658a17a72e17b6127231b86b3c966b258b24731c17e0a6ad2a315bd722d3f407ae52c97bcbf26
SSDEEP 384:KZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMj6:KbtwnmR/xQdckUSEMj6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

10783

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 51cc377db2a9db8d63bafd8fe8dffb97
SHA256 3a18cf504265ab2267e1545106217767877fa9db6e2b5dd0a3a761dead33a99b
MD5 07841403d5371183c4eaa5cab50663fb
SHA1 b0cee6e01502fdd2ee775922051333d626c63906
SHA512 436c1932d4ff56a11673beac5416ac0f2c7e90e5b993b3b8c8f589069d655da40c3ed514b99291ddf06aad66b0a634896daac19adf459ff791dccf3234af0e05
SSDEEP 192:sQNEcPshjd/dVaWnYPSZWrR6CM6CjVWsqCDLjJO/FEg98ZH:sQvshxFVaeYPoWH0VWsqCHQ/FEg9w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetProcAddress GetVersionExA lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA SetForegroundWindow PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA IsWindowVisible CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog LoadImageA DestroyWindow GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA SetWindowLongA

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation CloseServiceHandle OpenProcessToken FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/UACPage

SHA256 3c57e2caf4d4dea3d14fb7c544ed30ff177a55ea192337c49aa869288317c385
MD5 9f5a160f9d71cd1744c2a7c9524211a5
SHA1 74acd0b83bc9a442d877faed785c423b858fd836
SHA512 a4e63084bf5b1ccffd7dfbc1e5c28289929e0aa3308ce6ca33bb05ac0ee5ae2a512bb4b423c8b70d666aa5dde4f6eb031ad53d773288d73245537226c9d97b4d
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
MD5 173391c2c5228607d99ca65f29c8fb3e
SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

1.dat

SHA256 dcbecee8ed9d8070354d4946dcf017f8336e04498c31d4b0beb169746b4fe3cb
MD5 91dcdce7449fabddfbc117681b788436
SHA1 b3474abc75073b2cf0f859414ea7b167701fb667
SHA512 1c52b16ade1a37ea3e073faa19fd109e9b983fcdfb237fd970d93808d144d2239c959463a6a979a62a77d9b3ce13ee4ecf3a9b9cfc871540b3aef14408592075
SSDEEP 12288:1ZL3WIX3M9paUJCJScr855FphpWoJjJzpHTCmA9giGZgRAV8WXJQJO2h7CTy:/L3En3i8PhZJNzM+i/y851
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

2.dat

SHA256 4a2b9ae2bbc672188b33f2fe26174c5b479aa562f714613a95a9ee59e89c776c
MD5 1e66ad4036710f2c19d1c50af0918aff
SHA1 a25bd2f70175b78424155ddb1d182687ecf06397
SHA512 376fc9362d7c1bf0dfe6c8b34a9650361a3a39071d3e92662762e43128ee1b6109f952898fdced8d374d874e84366b7d6297af7ae15aa2052f4bf76accb337ef
SSDEEP 768:6xNSO/7S+RAeJgiqBqrk27k7QVEoDJqV94w07dAJz4VheYsCHwTF:SxOuld47QVEoY7KdAJkVUYFHCF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

3.dat

SHA256 43f394c888e0cf52ad4bffb4aa7e3f0d49ca0d1df81d0b6b1acee601d647febf
MD5 3383f30f8ea04b8896dfab5d1d2127f9
SHA1 8823d502f9f03c16a55eeadc7c90db27f0d643ac
SHA512 efbd1bc9ffde5ba771310b7008618e7ee9a3e8b0e394f6c1b1d201ca22e12780a58c133d32cd0f7c16e82b0a4968be2680956ff75951707ac960fc356803d966
SSDEEP 384:QrcfhoLQRjjwcxM3cA4j8BwcT4wFLUlIZ8uXX8uV/S76uIwWhtNpnnf3Q8zlJPkr:DpoEiw4V3OunpUlacuo6CWhtDf1Pkr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

5.dat

SHA256 24f15b9d046b81b7719fa97a23c09b4565aff6deb9191a7f0bd4165f91d80f22
MD5 ed5fbc0b9b504780c043185f20f89071
SHA1 242b4fa0e9c294a664618afbd44149cf7ef6f673
SHA512 28347091b625a4c9b603521e3ecbc7cd4f1be8e79121cb79ceccda6aabc8e8dc9532ae685796cc470aeeadac724e0446e6cbb733dc21696066d9479c60bc0012
SSDEEP 6144:Cg9Bp0DaEAbbJwQ4nQOF+gA0i6uVbmr7Hit:VHzGnQvg1ixVbQ4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

6.dat

SHA256 0d42f173cf485bb3f9f7e21bc352314f4d1553fcce8212557ba17f4a96fcabc7
MD5 3ff14fed75db04bd6eb09e1f890de301
SHA1 a8e36fecb99e23abff5060bb95f2d5755c3ff5f1
SHA512 ce5a2da20899e9182e0b2d32307b01c12b3f16dfd07a87bae8527998d7f24531a3ce3ae45c965e9c6db471ff824e60e8f65af1eafd33a0fac9db78d099de8f4d
MD5 SHA1 SHA512

NSIS installer

installer

7.dat

SHA256 85908b6a1cd2d7c29a0d2756a7f5b8804f6c2c88effe962d3fc1e790a89ff531
MD5 72fa71d1c200c5cf722dabde575a6c1a
SHA1 ea4736a728b9487e8951b806f6c3ad8d83863436
SHA512 e96a85546e8203ba57cffa3c19b45bd521849dc0964b1b9f5f143f79884176c53bba661271f683739baefb4f952819126aac38c89fdd98cffb1ebd5372bcb199
SSDEEP 384:Ax6aBzJWwGpzMFek0Xsu/F3eR0PSJyUVGvbG6WsYmLf3f:a1BzJ/0Xp3eR0PJjG6Ws5L
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

8.dat

SHA256 6bb67e9865373cc6fb639825a000422d377e3b8651af13df2523d06f32bbd950
MD5 73b4363aa9a8202edcf8e9bc3711ad3e
SHA1 95254060eb6fa5981cc988b73d67b2f420d35594
SHA512 812f99542e8663c893982ca76b4becb95ff43f2c5ee6cf66a9f7ecb9312031088949088ae1e2605e7ac7fe271e2de4abeb7ed96f45004e990ed34a300774e923
SSDEEP 384:IfRUYu/i/irblRqsWKJMK6AWg25SdOTr106MPwonPH3VrmRh/eFTv:IuOibWKdzPqv10rPwogh/ex
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

9.dat

SHA256 5beeee61a78adb8580618acedf76bce86ca641c34f330a3072983b41431241bc
MD5 372c5ca89c310bdd42b698ef1b652f1c
SHA1 0cb674412b3efba092afd535bec08e6d2fc25f40
SHA512 c2f82e10737189b0375b5b83dd8ff3ae9226af5f6266a89869fa2be676a9dcd829024281558affdcec05a3f490e8380b93929e64c4b38dabce7d07e43bed307d
SSDEEP 24576:UrJUMlZNyu0roZN6dxdgCsthLAif+R6lM80EcAx8hdLor:eLqoadxT4hhK6DvxCor
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 4ebdc9cf0c1addadf0070c64424d1792a90006dfa762b6459ddcae813e0c0825
MD5 e98c4556ea75dbfccb0f7ec340ca3548
SHA1 d41ffd10b8c5279c0e6273576f8a5855360f0087
SHA512 8e1c660a9da7c674fbc865b4c7667f3e7c97bf99aff6ca91ba8740f136cfc3c1bd6a3dc1c02432ccb55bb361bb36b62cb985ae7c543bb6c008cebaa9dce215eb
SSDEEP 1536:wLXB65939tY6HBg4sXJJlitGl1VhurNmvOq0A:wLk395hYXJ7PTu5I7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/UAC.dll

IMPHASH 51cc377db2a9db8d63bafd8fe8dffb97
SHA256 3a18cf504265ab2267e1545106217767877fa9db6e2b5dd0a3a761dead33a99b
MD5 07841403d5371183c4eaa5cab50663fb
SHA1 b0cee6e01502fdd2ee775922051333d626c63906
SHA512 436c1932d4ff56a11673beac5416ac0f2c7e90e5b993b3b8c8f589069d655da40c3ed514b99291ddf06aad66b0a634896daac19adf459ff791dccf3234af0e05
SSDEEP 192:sQNEcPshjd/dVaWnYPSZWrR6CM6CjVWsqCDLjJO/FEg98ZH:sQvshxFVaeYPoWH0VWsqCHQ/FEg9w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetProcAddress GetVersionExA lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA SetForegroundWindow PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA IsWindowVisible CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog LoadImageA DestroyWindow GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA SetWindowLongA

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation CloseServiceHandle OpenProcessToken FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
MD5 173391c2c5228607d99ca65f29c8fb3e
SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

data

SHA256 6f065230a27d51972c6698554da7d03a435cc9ea64b327cff2acfecb786b054e
MD5 8168ff95d8d140c33d9005ad86c04386
SHA1 95cde285018d27354888785ba8ae34c07513c4c5
SHA512 0a21139e4bfc83eccc6e11406927bc5f1b6bebe3a2d14084880e6e729531e1cf7b5fe9a067372b2b93e2723c23b9185732ab0fccf8aefbcb4d2990d3f8213dbf
MD5 SHA1 SHA512

NSIS installer

installer

lzma.exe

IMPHASH 725d7c328da8b5c7989b84fbe16f738f
SHA256 f776415281ed68268577142b60839d0937c112be1ba0fb8470f5a387afc3ba62
MD5 1c4d758c0954e843d2fa22703f653421
SHA1 d577e6f63cb53f5f68f094b9fbaefe5b0087e933
SHA512 5b8c02473b8f57d243cac5ae1f5381a9a1dbd55bc976a172f36060b2d0c2ad80d4f956cd38d4ba7434b9b27583e0e753bcdb8b4772c1c54e926b365c90357c3e
SSDEEP 1536:ax7F8DW6pErklzKbDir++/McTJctWOrLRCIbDO+9a:akDWTrMKb2MFQCRCIe+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

59404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer