5bc727948f15a1e96ee0cd47df641a6f_JaffaCakes118

resource
unpack001/$PLUGINSDIR/SimpleFC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/7ZipBuilder.dll
unpack001/7zxa.dll
unpack001/BugTrap.dll
unpack001/Crux P2P.exe
unpack001/DocumentReader.dll
unpack001/GFLImageServices.dll
unpack001/GFLLibraryBuilder.dll
unpack001/GeoIP.dll
unpack001/HashLib.dll
unpack001/ImageViewer.dll
unpack001/MediaImageServices.exe
unpack001/MediaLibraryBuilder.exe
unpack001/MediaPlayer.exe
unpack001/Preview.dll
unpack001/RARBuilder.dll
unpack001/RatDVDReader.dll
unpack001/RazaWebHook32.dll
unpack001/RegExp.dll
unpack001/SWFPlugin.dll
unpack001/SearchExport.dll
unpack001/Skin.exe
unpack001/SkinScanSKS.dll
unpack001/TorrentWizard.exe
unpack001/UpdateApp.exe
unpack001/VirusTotal.dll
unpack002/YellowFillDemo.svp
unpack001/Vis/phase.svp
unpack001/Vis/pulse.svp
unpack001/ZIPBuilder.dll
unpack001/bzlib.dll
unpack001/libgfl340.dll
unpack001/sqlite3.dll
unpack001/unrar.dll
unpack001/zlibwapi.dll

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 a9a0001ad68153b66d7d479e8a1b5059a22297db703c24fbe47c3bda8915c0e0
MD5 5bc727948f15a1e96ee0cd47df641a6f
SHA1 8020590bbac9b74b8e0acc9218fccce5066c8ecb
SHA512 6b4248f81dfd5c2bbccc87c3cff23f3b5321277efbcbd3eeb932537cb992f323994ad73d7f88c85958753f2f478e503547adaafd9cbc51b4626d6adf3cc52caa
SSDEEP 196608:Bqtzhek/k5UmOsSUrgpaIurqFYVIvSiyx1UuU4:sdskJpsrqFMIvbe59
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

22:9b:fd:84:7f:78:14:15:fa:4d:5a:7b:9a:37:52:3e:c6:f6:0f:e6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=4539 Arbor Crest Place,L=Suwanee,ST=Georgia,C=US,2.5.4.18=#13053330303234

Chains

May 16, 2024

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NSISPluginW.dll

IMPHASH e371ef89780fa4568c29c05c9604b0ea
SHA256 43b09fec17785a2db3a957ce135648779ad326cc080eeb60748635c9dfc85090
MD5 75e094b6270c6c3f2a7022d70c937064
SHA1 8221ff739905447d96bad2afde3c5108ed248060
SHA512 773462e72af91b7e639a9bfe2cdc822d686650bfd511c6d61799834d4a77530a466c00e97b4527d6a5a40941bc5ba986b7012492c7e0bb4796824ee6dbc0b830
SSDEEP 3072:f8zzg+IDR5zmnoidUS1aMG0LoQOmgnlKUYzF6Qs28I+YiwnfKDl9c:f8z8+Y4NXahQOmgnl+F6TStA4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

95:4c:d6:33:fa:23:2f:85:13:e5:8b:9c:64:8f:c7:87:f1:9c:70:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Spigot\, Inc.,O=Spigot\, Inc.,POSTALCODE=89451,STREET=774 Mays Blvd. #10-456,L=Incline Village,ST=NV,C=US

Chains

Apr 7, 2015

CN=Spigot\, Inc.,O=Spigot\, Inc.,POSTALCODE=89451,STREET=774 Mays Blvd. #10-456,L=Incline Village,ST=NV,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Spigot\, Inc.,O=Spigot\, Inc.,POSTALCODE=89451,STREET=774 Mays Blvd. #10-456,L=Incline Village,ST=NV,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Spigot\, Inc.,O=Spigot\, Inc.,POSTALCODE=89451,STREET=774 Mays Blvd. #10-456,L=Incline Village,ST=NV,C=US

Serial Number

82:84:11:55:37:81:06:31:38:86:b8:da:4a:06:d2:b3

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 26, 2014 - Nov 26, 2015

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

0

Major OS version

5

Entry point

94862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

HttpOpenRequestW HttpQueryInfoW InternetSetOptionW HttpSendRequestW InternetConnectW InternetReadFile InternetQueryOptionW InternetOpenW InternetCrackUrlW InternetCloseHandle InternetGetConnectedState

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW RegSetValueExW RegEnumValueW RegEnumKeyExW

kernel32

GetConsoleCP GetConsoleMode FindResourceW FreeLibrary LoadResource LoadLibraryExW InterlockedIncrement InterlockedDecrement GetModuleHandleW InitializeCriticalSection SizeofResource LeaveCriticalSection GetModuleFileNameW MultiByteToWideChar lstrlenW RaiseException GetLastError GetProcAddress EnterCriticalSection lstrcmpiW DeleteCriticalSection GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte FindResourceExW LockResource WaitForSingleObject SetEvent GetExitCodeProcess CreateEventW RemoveDirectoryW CloseHandle CreateThread MoveFileExW CreateDirectoryW WriteFile CreateFileW GetTempPathW DeleteFileW GetCurrentProcess GlobalLock MulDiv lstrcmpW GlobalUnlock FlushInstructionCache SetLastError GetCurrentThreadId SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringA InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle ExitProcess Sleep HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA VirtualAlloc VirtualFree GetModuleHandleA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

wsprintfW DefWindowProcW CallWindowProcW IsWindow ShowWindow SetWindowLongW GetWindowLongW DestroyWindow MoveWindow GetWindow UnregisterClassA GetParent EndPaint ClientToScreen GetWindowTextLengthW DestroyAcceleratorTable ScreenToClient GetWindowRect RegisterWindowMessageW FillRect IsChild SetCapture GetKeyState GetFocus SetWindowTextW InvalidateRgn LoadCursorW GetClientRect CreateAcceleratorTableW SetFocus BeginPaint GetClassInfoExW GetDC RegisterClassExW InvalidateRect GetWindowTextW GetClassNameW ReleaseDC GetDlgItem RedrawWindow GetDesktopWindow GetSysColor SetWindowPos CreateWindowExW ReleaseCapture SendMessageW UpdateWindow CharNextW

gdi32

GetStockObject GetObjectW CreateCompatibleBitmap CreateCompatibleDC SelectObject DeleteObject GetDeviceCaps DeleteDC BitBlt CreateSolidBrush

shell32

ShellExecuteExW

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize StringFromGUID2 CoGetClassObject OleUninitialize OleInitialize CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID OleLockRunning CoCreateGuid

oleaut32

VariantInit SysAllocStringLen LoadRegTypeLi OleCreateFontIndirect VarUI4FromStr SysFreeString SysAllocString SysStringLen VariantClear SafeArrayCreateVector SafeArrayAccessData LoadTypeLi SafeArrayDestroy SafeArrayUnaccessData

shlwapi

PathFileExistsW PathIsDirectoryW

$PLUGINSDIR/SimpleFC.dll

SHA256 72f33da081b8d579f437e7aa2ba8d9cb9602270b88093ff9411ac6316b52fc6e
MD5 d38543fc9ae37d188a23e06ee11d3504
SHA1 174fe778f66db4a527fddf21b1c23e1bc1ceceeb
SHA512 43d1874e5821d8e5530eaa34d42b76aa867528368779fadcfd2691825297accf04e94bd34867442a76c25d4729edefba9469de6500acfe6f665949f11878c54b
SSDEEP 3072:l2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVn5O4z6ULfLb6Cu:Us4zIg+rKTTmnhfAoSxZ5OVu/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

156036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 11cd6df8cede073a0e00bd840833dd26
SHA256 4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e
MD5 1fc1fbb2c7a14b7901fc9abbd6dbef10
SHA1 4d9ed86f31075a3d3f674ff78f39c190a4098126
SHA512 76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2
SSDEEP 384:ya3Bj/GAqvdXP4P4IVlht8zNHxKNSJvor9e9dQTIHzOZwceyeZwd6TJdpq:yRtqLhtqKNS5sAvQTIB86T0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetErrorDlg HttpQueryInfoW HttpEndRequestW HttpSendRequestExW HttpSendRequestW HttpAddRequestHeadersW HttpAddRequestHeadersA HttpOpenRequestW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetOptionW InternetQueryOptionW InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW

comctl32

ord17

kernel32

GlobalAlloc WideCharToMultiByte MultiByteToWideChar LoadLibraryW lstrlenW lstrlenA lstrcatW lstrcpyW lstrcmpiW GlobalFree MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetTickCount TerminateThread CreateThread SleepEx lstrcmpW lstrcpynW CreateFileA CreateFileW DeleteFileW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextW SendDlgItemMessageW SetTimer KillTimer EnableWindow UpdateWindow RedrawWindow SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW GetParent FindWindowExW LoadIconW IsDialogMessageW SystemParametersInfoW GetDlgItem wsprintfA wsprintfW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW IsWindow DestroyWindow ShowWindow SetWindowPos IsWindowVisible CreateDialogParamW

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/vcredist_x86.exe

IMPHASH c63ba316533609531fac22f3877f847b
SHA256 eb00f891919d4f894ab725b158459db8834470c382dc60cd3c3ee2c6de6da92c
MD5 5c82be7ad1775b67916ee19c15b99331
SHA1 7dfa98be78249921dd0eedb9a3dd809e7d215c8d
SHA512 2c505476c81ad32a4904d57d9214bbaa805891c261e010b08055896dca32cfd426f4d13d14a96022fda9a5d8ecd638d65bc37baefed216a2517f07e9acb6939d
SSDEEP 49152:7XOOTQyCR1e8HkA7pFomV4d4QN3uoxFit39/SZrPfLHkAZ0oI006q/HVFlQE+QD9:77EzzzJp0+ojyFALE4hIP/HRXP7x
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

bc:02:7c:76:1b:ab:4d:a5:a9:3e:ef:53:79:b8:ae:b4:89:fe:1d:3d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 18, 2007

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:47:52:ba:00:00:00:00:00:04

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:49:7c:ed:00:00:00:00:00:05

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

2

Major OS version

5

Entry point

23868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

FreeSid AllocateAndInitializeSid EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

LocalFree LocalAlloc GetLastError GetCurrentProcess GetModuleFileNameA lstrlenA GetSystemDirectoryA RemoveDirectoryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA lstrcatA lstrcpyA _lclose _llseek _lopen WritePrivateProfileStringA GetWindowsDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA IsDBCSLeadByte GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA lstrcmpiA GlobalFree GlobalUnlock GlobalLock GetProcAddress FreeResource LockResource LoadResource SizeofResource FindResourceA CloseHandle WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetCurrentDirectoryA GetTempFileNameA ExitProcess CreateFileA LoadLibraryExA lstrcpynA GetVolumeInformationA FormatMessageA GetCurrentDirectoryA GetVersionExA GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA GetSystemInfo CreateMutexA SetEvent CreateEventA CreateThread ResetEvent TerminateThread GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess SetUnhandledExceptionFilter ReadFile LoadLibraryA GetDiskFreeSpaceA MulDiv EnumResourceLanguagesA FreeLibrary GlobalAlloc

gdi32

GetDeviceCaps

user32

ExitWindowsEx wsprintfA CharNextA CharUpperA CharPrevA SetWindowLongA GetWindowLongA CallWindowProcA DispatchMessageA MsgWaitForMultipleObjects PeekMessageA SendMessageA SetWindowPos ReleaseDC GetDC GetWindowRect SendDlgItemMessageA GetDlgItem SetForegroundWindow SetWindowTextA MessageBoxA DialogBoxIndirectParamA ShowWindow EnableWindow GetDlgItemTextA EndDialog GetDesktopWindow MessageBeep SetDlgItemTextA LoadStringA GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

7ZipBuilder.dll

IMPHASH 7a15a2418eb17136c12e5120c3bf5ff3
SHA256 807d62849083fba827c54f3461f820dff32033e666f2f6845c61ea22ca341a4a
MD5 ae58a65957b0582620f602158d2b022f
SHA1 ae2883a00420c3cd8a0cc922e1f594a5c879fa17
SHA512 b5272530793dc5ef502e6388c848368aa71eee803be3e5779acbeb1f4c2452d5e157bdce0ae848f82ebde892eb0bf1b70b12fadff3efc725e07fa8e7baa0d372
SSDEEP 1536:4oJPWvozDqtbkJEtPH/PsmA+7DbK7r14nm:7tGofqtQJi/PsmA+7DbSb
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

21092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection LoadLibraryW lstrcpyW GetThreadLocale SetThreadLocale GetLastError InterlockedDecrement CreateFileW CloseHandle SetFilePointer ReadFile GetFileSize LockResource FindResourceExW SetLastError EnterCriticalSection LeaveCriticalSection RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW InterlockedIncrement FreeLibrary GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime

user32

wvsprintfW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 PropVariantClear

oleaut32

SysAllocStringLen UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen RegisterTypeLi VarUI4FromStr

7zxa.dll

IMPHASH f4b9b424b41e7abf6593ab07c658d67b
SHA256 d86b46836fd0a1d7488d1f8a01dbd831c5301c2a7b733aef584de7891cf2771a
MD5 1cf011c4c0aeb50a46ce6d04ec47adf2
SHA1 80edc3f772084a8cbec182f1c588cd9f6f9c7df4
SHA512 095f340db7c279832711ac4ed3bd932fe809f3d30d72ee6dc1357ffe4d77c6a68825967eaef4a33763bd1bfc1b476314dac44bb0552fac152ba6acd73d0660b8
SSDEEP 3072:Gc1Cwwna6ODBgYc6MDV3WX+87F0z19T1BoFOysbK9IKFFZpGCGklyIAv:GtaHDBgYP0wB7F03xysmBEC0Lv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

106981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocString VariantClear SysFreeString SysAllocStringByteLen

user32

CharUpperW CharUpperA

kernel32

ExitProcess GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar WideCharToMultiByte GetLastError GetSystemInfo GetProcAddress GetModuleHandleA LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects GetVersionExA DeleteCriticalSection VirtualAlloc VirtualFree CloseHandle WaitForSingleObject CreateEventA SetEvent ResetEvent InitializeCriticalSection HeapAlloc RaiseException HeapFree RtlUnwind HeapReAlloc CreateThread GetCurrentThreadId TlsSetValue TlsGetValue ExitThread GetCommandLineA GetVersion GetModuleFileNameA GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr SetUnhandledExceptionFilter TlsAlloc TlsFree SetLastError TerminateProcess GetCurrentProcess HeapSize UnhandledExceptionFilter SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW WriteFile IsBadReadPtr IsBadCodePtr GetCPInfo GetACP GetOEMCP LoadLibraryA InterlockedDecrement InterlockedIncrement LCMapStringA

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

BugTrap.dll

IMPHASH eefe124a03660920dde6b567e34e8c8d
SHA256 80fac535f67fa93304bfd181cb77be2cdd7a263b34e19d477b3c6f1fb974d03a
MD5 05c7a07dee252bfebbd8da6d6c33a5f8
SHA1 2d006834bb45ce6fa3ac07a0a871323b9d60137d
SHA512 1bfcd25386fe8560ff842a346f51b27d900498e029e0a047ea0d3151960a42b41557d621d028420c6ce8ac2c1250de8f4f8b839d8d55371adeae9b33ecc2e42b
SSDEEP 3072:Vuj9UeV71NBHRSDUPxfCFRFYFE0szgzXyILt2vD0qcxrParYEctBYWBL17dK:Vues7pHgDUPxfCFRFYFrsiXykF9asdK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\MIHAELA\PROIECTE\CruxP2P\Crux P2P\vc9\Win32\Release\BugTrap.pdb

kernel32

WriteConsoleW SetEndOfFile GetLocalTime ReadProcessMemory GetCurrentProcess LocalFree LocalAlloc GetCurrentThread FormatMessageW GetSystemInfo GlobalMemoryStatus GetThreadContext GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThreadId SuspendThread ResumeThread GetDateFormatW GetTimeFormatW SystemTimeToFileTime GetComputerNameW GetCommandLineW GetCurrentDirectoryW GetFileAttributesW DeleteFileW SetUnhandledExceptionFilter LoadLibraryExW CreateProcessW TerminateProcess CreateEventW DisableThreadLibraryCalls GetUserDefaultLangID VirtualQuery VirtualProtect GetModuleHandleA WaitForMultipleObjects LocalReAlloc ResetEvent GetExitCodeThread GetTempPathW RemoveDirectoryW CreateDirectoryW GetTickCount GetStringTypeW GetWindowsDirectoryW IsDBCSLeadByte FlushFileBuffers CreateFileA GetConsoleOutputCP GetStdHandle SetStdHandle RtlUnwind InitializeCriticalSectionAndSpinCount LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetLocaleInfoA GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapDestroy HeapCreate HeapReAlloc VirtualAlloc VirtualFree ExitProcess HeapSize Sleep IsValidCodePage GetOEMCP GetACP GetCPInfo InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA IsDebuggerPresent UnhandledExceptionFilter GetCommandLineA HeapFree HeapAlloc CreateThread ExitThread LoadLibraryA InterlockedExchange InitializeCriticalSection OutputDebugStringW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetLastError OpenProcess GetModuleFileNameW GetCurrentProcessId GetModuleHandleW GetVersionExW WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryW GetProfileIntW MulDiv ReadFile GetFileSize SetFilePointer GetStringTypeA MultiByteToWideChar WaitForSingleObject SetEvent FindNextFileW FindClose FindFirstFileW RaiseException CopyFileW CloseHandle WriteFile WriteConsoleA CreateFileW

user32

DestroyIcon DrawIconEx GetClassLongW CopyIcon LoadCursorW DrawTextW GetWindow SendMessageTimeoutW GetWindowThreadProcessId GetForegroundWindow GetActiveWindow AppendMenuW GetSystemMenu EnumDisplayDevicesW GetTabbedTextExtentW TabbedTextOutW EndDeferWindowPos DeferWindowPos BeginDeferWindowPos MapWindowPoints DrawEdge IsZoomed IsWindowVisible SetScrollPos GetDialogBaseUnits IsChild ReleaseCapture EndDialog GetParent GetDlgItem SetFocus GetWindowTextW SetCursor SetCapture GetCapture GetMessagePos DrawFocusRect GetFocus PtInRect GetKeyState ReleaseDC GetDC ScrollWindowEx SetScrollInfo GetScrollInfo GetScrollPos DefWindowProcW RedrawWindow EndPaint BeginPaint FillRect GetSysColorBrush IsRectEmpty KillTimer SetTimer PostMessageW DispatchMessageW GetMessageW PostQuitMessage SetWindowPos ScreenToClient GetWindowRect CreateDialogParamW LoadIconW MessageBoxW SetForegroundWindow SetWindowLongW GetWindowLongW CheckRadioButton LoadImageW ShowWindow DestroyWindow IsWindowEnabled EnableWindow CreateWindowExW DialogBoxParamW UpdateWindow InvalidateRect LoadStringW GetSystemMetrics GetClientRect GetSysColor GetDlgCtrlID SetWindowTextW SendMessageW GetWindowTextLengthW SystemParametersInfoW

gdi32

TextOutW MoveToEx LineTo GetTextExtentPoint32W GetObjectW GetTextMetricsW CreateDCW GetDeviceCaps GetDIBits CreateFontIndirectW PatBlt SetTextColor DeleteDC BitBlt GetClipBox SelectObject SetBkColor DeleteObject CreateCompatibleBitmap StretchBlt SetViewportOrgEx CreateCompatibleDC

advapi32

RegEnumValueW AdjustTokenPrivileges GetTokenInformation OpenProcessToken GetUserNameW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

zlibwapi

zipOpen zipCloseFileInZip zipWriteInFileInZip zipOpenNewFileInZip zipClose

BT_AppLogEntryF BT_CallCppFilter BT_CallNetFilter BT_CallSehFilter BT_InsLogEntryF BT_InterceptSUEF _BT_AddLogFile@4 _BT_AddRegFile@8 _BT_AppLogEntry@12 _BT_AppLogEntryV@16 _BT_ClearLog@4 _BT_ClearLogFiles@0 _BT_CloseLogFile@4 _BT_CppFilter@4 _BT_DeleteLogFile@4 _BT_ExportRegistryKey@8 _BT_FlushLogFile@4 _BT_GetActivityType@0 _BT_GetAppName@0 _BT_GetAppVersion@0 _BT_GetDialogMessage@4 _BT_GetDumpType@0 _BT_GetExitMode@0 _BT_GetFlags@0 _BT_GetLogEchoMode@4 _BT_GetLogFileEntry@20 _BT_GetLogFileName@4 _BT_GetLogFilesCount@0 _BT_GetLogFlags@4 _BT_GetLogLevel@4 _BT_GetLogSizeInBytes@4 _BT_GetLogSizeInEntries@4 _BT_GetMailProfile@0 _BT_GetNotificationEMail@0 _BT_GetPostErrHandler@0 _BT_GetPreErrHandler@0 _BT_GetReportFilePath@0 _BT_GetReportFormat@0 _BT_GetSupportEMail@0 _BT_GetSupportHost@0 _BT_GetSupportPort@0 _BT_GetSupportURL@0 _BT_GetUserMessage@0 _BT_InsLogEntry@12 _BT_InsLogEntryV@16 _BT_InstallSehFilter@0 _BT_MailSnapshot@0 _BT_MailSnapshotEx@4 _BT_NetFilter@4 _BT_OpenLogFile@8 _BT_ReadVersionInfo@4 _BT_SaveSnapshot@4 _BT_SaveSnapshotEx@8 _BT_SehFilter@4 _BT_SendSnapshot@0 _BT_SendSnapshotEx@4 _BT_SetActivityType@4 _BT_SetAppName@4 _BT_SetAppVersion@4 _BT_SetDialogMessage@8 _BT_SetDumpType@4 _BT_SetExitMode@4 _BT_SetFlags@4 _BT_SetLogEchoMode@8 _BT_SetLogFlags@8 _BT_SetLogLevel@8 _BT_SetLogSizeInBytes@8 _BT_SetLogSizeInEntries@8 _BT_SetMailProfile@8 _BT_SetNotificationEMail@4 _BT_SetPostErrHandler@8 _BT_SetPreErrHandler@8 _BT_SetReportFilePath@4 _BT_SetReportFormat@4 _BT_SetSupportEMail@4 _BT_SetSupportHost@4 _BT_SetSupportPort@4 _BT_SetSupportServer@8 _BT_SetSupportURL@4 _BT_SetUserMessage@4 _BT_SetUserMessageFromCode@4 _BT_UninstallSehFilter@0

Crux P2P.exe

IMPHASH da260bf68780ac3152283f53757f1098
SHA256 b1b93d41f98bd9bd05bd9d515a912e9a416372a49355e6390e45ad9c0fac577e
MD5 7550f1594b3982fd9dd4910b93645650
SHA1 8e7cd68becd100a692bb7da22fbb5bc13a2d6e70
SHA512 fcd342c6870a669fd506940091ed98b2c9c2dbdf6d3d37ddc5c3e008a6a3e60ddeae4c03cb0f2d6aa53730450f75a9fb454fa91a7ade8715a1c4e278b44d053d
SSDEEP 98304:7UVf1o+MqM42eu9N41xY3vpkqBcIZCtPlbdC0PJDe:7UR1oPPeu0vKPcwCTE0PJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

364060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\MIHAELA\PROIECTE\CruxP2P\Crux P2P\vc9\Win32\Release\Crux P2P.pdb

hashlib

?ToBytes@CTigerTree@@QAEHPAPAEPAKK@Z ?ToBytesLevel1@CTigerTree@@QAEHPAPAEPAK@Z ?FinishFile@CED2K@@QAEHXZ ?FinishFile@CTigerTree@@QAEHXZ ?AddToFile@CED2K@@QAEXPBXK@Z ?AddToFile@CTigerTree@@QAEXPBXK@Z ?BeginFile@CED2K@@QAEX_K@Z ?BeginFile@CTigerTree@@QAEXK_K@Z ?Save@CED2K@@QBEXPAE@Z ?GetSize@CED2K@@QBEKXZ ?Load@CED2K@@QAEXPBE@Z ?GetSerialSize@CED2K@@QBEKXZ ?SetSize@CED2K@@QAEXK@Z ?Save@CTigerTree@@QBEXPAE@Z ?Load@CTigerTree@@QAEXPBE@Z ?GetSerialSize@CTigerTree@@QBEKXZ ?SetHeight@CTigerTree@@QAEXK@Z ?ToBytes@CED2K@@QAEHPAPAEPAK@Z ?GetRawPtr@CED2K@@QBEPBXXZ ?SetupParameters@CTigerTree@@QAEX_K@Z ?FinishBlockTest@CED2K@@QAEHK@Z ?FinishBlockTest@CTigerTree@@QAEHK@Z ?AddToTest@CED2K@@QAEXPBXK@Z ?AddToTest@CTigerTree@@QAEXPBXK@Z ?BeginBlockTest@CED2K@@QAEXXZ ?BeginBlockTest@CTigerTree@@QAEXXZ ?GetBlockCount@CED2K@@QBEKXZ ?Clear@CED2K@@QAEXXZ ?GetRoot@CED2K@@QBEXPAE@Z ?FromBytes@CED2K@@QAEHPAEK_K@Z ?FromRoot@CED2K@@QAEXPBE@Z ?IsAvailable@CED2K@@QBEHXZ ?GetHeight@CTigerTree@@QBEKXZ ?GetBlockCount@CTigerTree@@QBEKXZ ?GetBlockLength@CTigerTree@@QBEKXZ ?Clear@CTigerTree@@QAEXXZ ?GetRoot@CTigerTree@@QBEHPAE@Z ?FromBytes@CTigerTree@@QAEHPBEKK_K@Z ?FromBytesLevel1@CTigerTree@@QAEHPBEK_K@Z ?IsAvailable@CTigerTree@@QBEHXZ ??1CED2K@@QAE@XZ ??0CED2K@@QAE@XZ ??1CTigerTree@@QAE@XZ ??0CTigerTree@@QAE@XZ ?GetHash@CMD5@@QBEXPAE@Z ?Finish@CMD5@@QAEXXZ ?Add@CMD5@@QAEXPBXI@Z ??1CMD5@@QAE@XZ ??0CMD5@@QAE@XZ ?Reset@CSHA@@QAEXXZ ?GetHash@CSHA@@QBEXPAE@Z ?Finish@CSHA@@QAEXXZ ?Add@CSHA@@QAEXPBXI@Z ??1CSHA@@QAE@XZ ??0CSHA@@QAE@XZ

bugtrap

BT_CallCppFilter _BT_InstallSehFilter@0 _BT_AddRegFile@8 _BT_SetSupportURL@4 _BT_SetSupportEMail@4 _BT_SetDumpType@4 _BT_SetExitMode@4 _BT_SetFlags@4 _BT_SetAppName@4 _BT_SetAppVersion@4

sqlite3

sqlite3_close sqlite3_prepare16_v2 sqlite3_busy_timeout sqlite3_step sqlite3_reset sqlite3_data_count sqlite3_column_name16 sqlite3_open16 sqlite3_enable_shared_cache sqlite3_finalize sqlite3_bind_blob sqlite3_bind_text16 sqlite3_bind_int64 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_int64

regexp

?Match@RegExp@@YAHPB_W0@Z ?Split@RegExp@@YAIPB_W0PAPA_W@Z

bzlib

BZ2_bzBuffToBuffDecompress BZ2_bzBuffToBuffCompress

zlibwapi

inflateInit2_ inflate inflateEnd inflateInit_ deflateEnd deflateInit_ deflate compressBound compress2 compress uncompress

kernel32

lstrcpyW lstrcmpiW GlobalSize lstrcmpiA ResumeThread TerminateThread GetFileTime FindCloseChangeNotification FindNextChangeNotification FindFirstChangeNotificationW WritePrivateProfileStringW GetStringTypeExW GetFileSizeEx GetComputerNameW ResetEvent GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetDateFormatW GetTimeFormatW GetLocalTime RemoveDirectoryW GetLongPathNameW GetCurrentProcessId LoadLibraryA RaiseException lstrcmpA GetPrivateProfileIntW GetVersionExA lstrcmpW CompareStringW GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GetModuleHandleA ReleaseMutex CreateEventW WaitForMultipleObjects GetThreadLocale LockFile UnlockFile DuplicateHandle GetVolumeInformationW SuspendThread FileTimeToLocalFileTime TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree CompareStringA EnumResourceLanguagesW ConvertDefaultLocale GlobalGetAtomNameW VirtualProtect GlobalFlags SetErrorMode GetCurrentDirectoryW GetSystemDirectoryW FindResourceExW GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc RtlUnwind SetStdHandle GetFileType ExitThread CreateThread ExitProcess HeapSize VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate GetCPInfo GetACP IsValidCodePage LCMapStringW GetTimeFormatA GetDateFormatA LCMapStringA GetStringTypeA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA CreateDirectoryW GetWindowsDirectoryW FileTimeToSystemTime LoadLibraryExW GetSystemInfo GetModuleFileNameW GetPrivateProfileStringW CreateMutexW DeleteFileW GetFullPathNameW GetCurrentProcess HeapAlloc GetProcessHeap HeapFree GlobalUnlock GlobalLock GlobalAlloc FoldStringW GetStringTypeW SetThreadExecutionState GlobalMemoryStatusEx LocalAlloc GetLocaleInfoW IsValidLocale FreeLibrary GetSystemDefaultLangID GetUserDefaultLangID VirtualFree GetCurrentThread VirtualAlloc QueryPerformanceCounter QueryPerformanceFrequency SetThreadPriority InterlockedCompareExchange UnmapViewOfFile MapViewOfFile CreateFileMappingW FreeResource MoveFileWithProgressW SetEndOfFile SetFilePointerEx FlushFileBuffers InterlockedExchange MulDiv GetShortPathNameW CopyFileW GetExitCodeThread SetFileAttributesW WriteFile ReadFile SetFilePointer GetFileSize CreateFileW CloseHandle SystemTimeToFileTime GetSystemTime GetSystemTimeAsFileTime CompareFileTime FindClose FindNextFileW FindFirstFileW GetDiskFreeSpaceExW MoveFileW MoveFileExW GetFileAttributesW GetCurrentThreadId GetVersionExW GetProcAddress GetModuleHandleW LoadLibraryW SetLastError LocalFree FormatMessageW SwitchToThread lstrlenA GetFileAttributesExW GetLastError InterlockedDecrement InterlockedIncrement Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject SetEvent WideCharToMultiByte GetOEMCP MultiByteToWideChar GlobalFree lstrlenW FindResourceW LoadResource LockResource SizeofResource GetTickCount CopyFileExW

user32

LockWindowUpdate SetClassLongW SetActiveWindow DrawFrameControl DrawTextW GetMenuState GetMenuCheckMarkDimensions SetMenuItemBitmaps LoadMenuW GetWindowPlacement SystemParametersInfoA GetMenu DefWindowProcW GetDlgCtrlID SetWindowPlacement SetScrollInfo GetScrollInfo RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW MessageBoxW GetScrollPos SetScrollPos GetScrollRange SetScrollRange SetMenu MapWindowPoints GetMessagePos GetMessageTime GetTopWindow GetDlgItem GetLastActivePopup GetWindowTextW GetWindowTextLengthW SetFocus GetClassLongW GetCapture IsChild WinHelpW SendDlgItemMessageA SendDlgItemMessageW RegisterWindowMessageW IsDlgButtonChecked IsDialogMessageW SetWindowTextW IsWindowEnabled ScrollWindowEx FillRect TabbedTextOutW DrawTextExW GrayStringW GetWindowDC BeginPaint EndPaint GetActiveWindow GetMessageW MapDialogRect SetWindowContextHelpId GetDialogBaseUnits GetNextDlgGroupItem GetNextDlgTabItem MessageBeep EndDialog CreateDialogIndirectParamW PostQuitMessage ShowOwnedPopups DefFrameProcW DefMDIChildProcW DrawMenuBar InsertMenuItemW LoadAcceleratorsW ReuseDDElParam UnpackDDElParam CopyAcceleratorTableW InvalidateRgn CharNextW DeleteMenu GetSysColorBrush UnregisterClassW PostThreadMessageW GetDCEx TranslateMDISysAccel TranslateAcceleratorW ValidateRect GetAncestor FlashWindowEx DestroyWindow AnimateWindow CheckMenuItem GetClipboardData EnableMenuItem ChildWindowFromPointEx GetKeyState MoveWindow FindWindowExW IsRectEmpty ClientToScreen SetLayeredWindowAttributes MonitorFromPoint WindowFromPoint IsMenu GetFocus TrackPopupMenuEx RedrawWindow ClipCursor EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetParent ChildWindowFromPoint CharLowerBuffW UnionRect GetSystemMenu SetWindowRgn SetWindowPos IsIconic MonitorFromWindow IsZoomed SetRectEmpty SetRect SetMenuDefaultItem DestroyMenu CreateMenu AttachThreadInput RegisterClipboardFormatW EqualRect GetMonitorInfoW MonitorFromRect GetWindowThreadProcessId DispatchMessageW TranslateMessage PeekMessageW GetDesktopWindow CreateIconIndirect GetIconInfo LoadIconW PrivateExtractIconsW ShowWindow FindWindowW GetWindow ExitWindowsEx SendMessageTimeoutW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ReleaseCapture SetTimer SetCapture GetParent KillTimer SystemParametersInfoW DrawIconEx InvertRect LoadBitmapW LoadCursorW SetCursor ScreenToClient GetSystemMetrics InvalidateRect IntersectRect CharUpperW GetAsyncKeyState UpdateWindow IsWindow BringWindowToTop DdeUnaccessData DdeAccessData DdeQueryStringW DdeUninitialize DdeFreeStringHandle DdeNameService DdeCreateStringHandleW DdeInitializeW GetClientRect IsWindowVisible AdjustWindowRectEx CallNextHookEx RemovePropW SetWindowLongW SetPropW GetWindowLongW GetForegroundWindow GetPropW GetClassNameW TrackPopupMenu SetForegroundWindow UnhookWindowsHookEx SetWindowsHookExW OffsetRect WindowFromDC ReleaseDC GetDC ModifyMenuW AppendMenuW GetMenuItemInfoW GetSysColor InflateRect CopyRect LoadImageW DestroyIcon CreatePopupMenu InsertMenuW RemoveMenu GetMenuStringW SetMenuItemInfoW GetMenuItemID GetMenuItemCount GetSubMenu SendMessageW PtInRect GetWindowRect GetCursorPos PostMessageW MsgWaitForMultipleObjects EnableWindow CallWindowProcW

gdi32

CreatePatternBrush ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx SetViewportExtEx PatBlt SetRectRgn GetMapMode DPtoLP CreateCompatibleDC CreateCompatibleBitmap SetLayout GetObjectW BitBlt StretchBlt CreateFontW GetTextExtentPoint32W DeleteDC SetDIBits SelectObject GetDeviceCaps CreatePen SetPixel Polyline ExtTextOutW GetDIBits CreateDIBSection GetStockObject TranslateCharsetInfo CreateEllipticRgn SetStretchBltMode CreateFontIndirectW GetBkColor CreateSolidBrush GetCurrentObject CreateBitmap RemoveFontResourceExW AddFontResourceExW GetTextAlign CreateRectRgnIndirect GetTextColor CreateEllipticRgnIndirect CreateRoundRectRgn CombineRgn GetPixel EnumFontFamiliesExW GetRgnBox ScaleViewportExtEx RectVisible SetBkMode GetTextMetricsW SetTextColor SetBkColor GetClipBox SaveDC RestoreDC SetMapMode ExcludeClipRect IntersectClipRect LineTo MoveToEx SetTextAlign SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx PtVisible TextOutW Escape SetViewportOrgEx OffsetViewportOrgEx DeleteObject

advapi32

RegSetValueW GetUserNameW RegEnumKeyExW RegCreateKeyW RegCreateKeyExW StartServiceW CloseServiceHandle QueryServiceStatusEx OpenServiceW OpenSCManagerW RegEnumValueW FreeSid CheckTokenMembership AllocateAndInitializeSid CryptAcquireContextW CryptReleaseContext RegDeleteValueW RegSetValueExW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken InitiateSystemShutdownExW RegCloseKey RegQueryValueExW RegOpenKeyExW CryptGenRandom RegEnumKeyW RegQueryValueW RegOpenKeyW

shell32

SHFileOperationW SHGetPathFromIDListW SHGetFileInfoW ExtractIconExW SHGetMalloc SHChangeNotify DragQueryFileW Shell_NotifyIconW ShellExecuteW SHGetDesktopFolder SHBrowseForFolderW DragFinish ExtractIconW

shlwapi

PathFindFileNameW PathIsDirectoryW PathFindExtensionW PathCompactPathExW AssocQueryStringW SHRegOpenUSKeyW SHRegEnumUSValueW SHRegCloseUSKey SHRegGetUSValueW SHRegSetUSValueW PathRemoveExtensionW PathFileExistsW SHDeleteValueW PathIsSameRootW StrStrIW StrChrW PathMakeSystemFolderW PathUnmakeSystemFolderW PathStripToRootW PathIsUNCW PathRemoveFileSpecW

Data/AdultFilter.dat

SHA256 d2b957d1ba2d3e4f9ba04e51596c7ffaedb3621fed158452d41db63e3b6f4de0
MD5 262817ca0e7164d286d4166590826067
SHA1 aaa36f85a0e2914574aeb24229a1e4b19b4ecbc5
SHA512 0b5c731f058096a8d40931d5b170ad1e3358cbaafe03368263ad6b767a31465fa7ded7d25a659aa99755fe8bfaf32fd1012bccf21a3f51eb38cc832b08b72279
MD5 SHA1 SHA512

Data/DefaultAvatar.png

SHA256 14f0b504e25245ca511cbd4b5a3177c6542538151e0fe7c580eb8035615c3e33
MD5 2f9104bcdef9b136205a095f5ab8b1e3
SHA1 ceb3a5a1a7c3f1de693f9bdcdd2da61292431f09
SHA512 2549453a95a2338f7e6a811c0bc8e3ff83dcf81cf35bfb965fa60cf777a7c02fd2fc092bc05104e8df2bd6511466abcfe57f06807d696387c245b682ea3437d1
MD5 SHA1 SHA512

Data/DefaultSecurity.dat

SHA256 251ee2d98469255573e2803f3ecedf3347a782ec1c279fa7d88fc16460fce5a4
MD5 9307618adefdd687302dc824ee0a8ff9
SHA1 9402bc59b85fdf35a9f4a1c9f7edf56bd58ab80b
SHA512 4eacaf94c0eaefaa72a42da92b548d942c607432a42371bb82fc527535434f066e6189ea208613b161939f6d6ae2d9584b2c9361d56c0b53219050dac89d83e2
SSDEEP 192:ec9nUA4XtmtFL2/9nAq1Wybf3Ehk2QPex22NRrlBlyljGl/RQbRqKRkHFKvYWB:ctmtexCTP8qHF+YWB
MD5 SHA1 SHA512 SSDEEP

Data/DefaultServices.dat

SHA256 08c6c793089556f4df6349de1d3555f45e938670b40d23a7c3d2d6e325bc0a7c
MD5 bf275bf22d57e38db1abc081c4ac09be
SHA1 76a680c0c1b7560544819b50e643eaf036284635
SHA512 a6f11a7c439318d93f394391334445547440b9c46a81a25f18719c325a2bd83d133a47ebbe158b5e036f1bf6c4ef43b37788e9431ff46a27fc8e6874b9c46465
MD5 SHA1 SHA512

Data/Emoticons.bmp

SHA256 4d7d95bfaba53760c83f5661995440bde543c80d45335e7ffe8f2b4be86f7189
MD5 6c690aea3447f10af00b4bb54202fcf1
SHA1 ddc6b9efc60015ec3e810912ba25c40aa691b153
SHA512 0e5ed6fda734746910ea9a133925fe92bf532ebb6ee7c589da3e43858656e9f3d7b06276646b7272290cb85e11eba6f7e1dc9630c00b30ee41dd71ec7bb3ae1c
SSDEEP 768:k/O/ujDa2pLDkEQxAwYKNVqkeBvEyGOxLhDBaTu3OH1:9CrFKHq1KYFDB4uE
MD5 SHA1 SHA512 SSDEEP

Data/Emoticons.xml

SHA256 5a8670bf9e779f0cad887e037170d6ef5a6641707e9c5ba303b7e4a2390cd5da
MD5 c2f3c709c8ff67e172253dcbaf3a6223
SHA1 c0711e8a421a4e4c7e67c7485e1997d66a701334
SHA512 2519ad394f471542b5124ef2726ba826af364b57720cc9718199cc3f75fff47e6cc925487a5e97828b07574b1912491198f909cab9a348add66294827efed476
SSDEEP 192:S3IKNXBmS7fNDea4Hi8trN3k6Llwp/3YV+R4yh7K0XLmJJB7/NlPDhl1lw5pbR:S3wO
MD5 SHA1 SHA512 SSDEEP

Data/Flags.png

SHA256 81564fd17eb5e27f1b10bc4095c76491fdd92342406e2158a1c9dea4d3e55240
MD5 d643f8247786e6c31df6b0bd8099e1fc
SHA1 2bc9a881d3837fdd9e4fb41c960048741d776a27
SHA512 e59b78364ae6b72bd807a58b319234c03ea38e7e938533c83d88e65efc50044c499756e6b0abd72796252fc54a13d2d854a1d3d92aee3f8015ca4033a844902c
SSDEEP 768:fwFPOboAYQcRioC136tsyTHUFzio1LCc1m3ZLC:fwxwpYlTOtxLB1qC
MD5 SHA1 SHA512 SSDEEP

Data/MessageFilter.dat

SHA256 d50f7ffa78a58885b76e3eb6802bab3b8f5f9598f95c9dcbee6951a17e8630ae
MD5 9fa3797d68f2fc5ed490e91385f718be
SHA1 b0bfb98d9474dd497b0e0cbdf66d5ed90e2c5db6
SHA512 c779496c2912db304f8d601965ee018b90d3f5123e93e1d7ba6c17fa7b48e1ee782425625073f638a0f164fa63ec1007fc4e8f4235edb1e14e2b8bcb86e6d39e
MD5 SHA1 SHA512

Data/Splash.png

SHA256 06a14b6f224275d08369ef039d03be0ade124ab22071c9d1a373f537d4a1a310
MD5 26ccd0e4ea45b436e77af3f1041ffb89
SHA1 4999ed57f72984eec62e6b1b126ce8cbae317b40
SHA512 972fc2d7860547fe0a47670c9854cb2427de4dbb2049c6f0ebf051f3515244a5e558da96b41bc1df1729adc4fb7848b9bf9c4de2e842c94007c2d6dc8290e854
SSDEEP 384:JJXE05g28JS/Lmv7l6UdpWaZcFtKEA/MN5ONtwqh8QuYvMdgOhBzvq17ZJw3w/:7358Jimjl6Ui+ym/WOzwqvggshvUQI
MD5 SHA1 SHA512 SSDEEP

Data/Thumbs.db

SHA256 3c1d8c21bf3a8a79b2bccac2c02e85b9994141c4ee988adb54d4e6ac5456a80c
MD5 50c6768f0c37fb84cedc16887aac464c
SHA1 aa678c266cc7680c4d5e842d0af69b5ba9227b91
SHA512 251c5da84479b16e25b9357a54ee1442f9ba0ce96f67e9883f68a4bf5252cacba8b0b17bf79d7391abd4d651c6addc76d1d372d0c973a7f8477ba49bdb49c2fb
SSDEEP 96:tus+hD8LiK4RiKm/HnJRsFtZcFrxbKHbd9lrddzc3g:tus+y3yLZFJvdC3g
MD5 SHA1 SHA512 SSDEEP

Data/Vendors.xml

SHA256 5ca8db5b95eae6282ea10d679f5a140fce58f3ca0962f8660fc43a6c1dac6841
MD5 cb48d946c2be8269527471d4a8302c5d
SHA1 82bed7521ec8d962d483bf37d4314452d351ebf2
SHA512 6e2c487bf0438ee878ea8f597f1d0bb4bd39787d6ea660fa636c0210da5b9f4e1f657594c0f77f678abb166fb21c874112609b9ab21d9e8a1c8d3cc8b1996f30
SSDEEP 96:DoScQeRSY4svDIbOWaq/fK4gcnkvky1iSSP2:DoScQeRSY4svDIBaq/fK4gckvZYY
MD5 SHA1 SHA512 SSDEEP

Data/WorldGPS.dat

SHA256 a782de9106a314a255999c2a7673e61ef4512a67943fda66cca62b4dd94a2429
MD5 b0c2ff8d2963dcfc864db44e9a60aed2
SHA1 14fee50be5d32d5bcaf4615504bf02c57ab37bb6
SHA512 0c6f1c3112b602c92da46b006a49033ad1a680b84ec24418a67a46765e70f0e49a1ec1ab2546ff6e50662a348c6b9df1a46fd3bbbc3623b154bf8250f29c3e67
SSDEEP 6144:BRNpvQJenOeIWlAT/usfqnS3JKgZkjxLGSB:BRaenOZiS3JN68SB
MD5 SHA1 SHA512 SSDEEP

DocumentReader.dll

IMPHASH d62bd61eaac00da87ab892721be5d98f
SHA256 d1b76d39ee0358407025a4214a8e8b58ba85dcc807f29294fb56991b02c7d50f
MD5 57a119e53a13833a2b17a66c283d60a4
SHA1 6de7d3a844e8157b71e9fef01e9ce00140c73c14
SHA512 bd93faedc07475881c737f1ad2e23f70fc4681151b1acfa1532c0b3eeb9f76717f92da27c8a86485fea06dd0e4dd63224dcd2318852d3ad6fba272251f263b84
SSDEEP 3072:ASGlTEZNIr1KqsnVA5OctzRD+T0XO+mu:ASQhV5xrtX
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

25176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection InterlockedIncrement InterlockedDecrement GetShortPathNameW HeapCreate GetVersion DisableThreadLibraryCalls HeapDestroy SetThreadLocale InitializeCriticalSection GetLocaleInfoA LoadLibraryExA FindResourceA LoadResource SizeofResource EnterCriticalSection RaiseException LeaveCriticalSection IsDBCSLeadByte lstrcmpiA FreeLibrary GetProcAddress GetModuleHandleA GetModuleFileNameA GetModuleFileNameW SearchPathA SearchPathW GetThreadLocale lstrlenA lstrlenW WideCharToMultiByte MultiByteToWideChar GetLastError IsValidCodePage HeapFree HeapAlloc LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetModuleHandleW GetACP GetStringTypeW GetStringTypeA LCMapStringA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount LCMapStringW SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetOEMCP GetCPInfo GetStdHandle WriteFile ExitProcess Sleep VirtualFree IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCommandLineA GetCurrentThreadId VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect GetProcessHeap HeapSize HeapReAlloc

user32

CharNextW wsprintfA CharNextA FillRect ReleaseDC GetDC

gdi32

GetEnhMetaFileHeader RestoreDC PlayMetaFile SetBkMode CreateSolidBrush SetViewportExtEx SetWindowExtEx SetWindowOrgEx SetMapMode SaveDC CreateDIBSection DeleteObject DeleteDC GetDIBits BitBlt SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectA SetEnhMetaFileBits CreateBitmapIndirect SetMetaFileBitsEx PlayEnhMetaFile

advapi32

RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegQueryInfoKeyA RegCloseKey RegDeleteKeyA RegDeleteValueA

ole32

PropVariantClear StringFromGUID2 StgOpenStorage StgIsStorageFile StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoTaskMemFree

oleaut32

VariantTimeToSystemTime SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SysAllocString SystemTimeToVariantTime SysFreeString VariantClear SysStringLen VarUI4FromStr UnRegisterTypeLi LoadTypeLi RegisterTypeLi VariantCopy VariantChangeType SafeArrayGetUBound VariantInit VarBstrCat SysStringByteLen SysAllocStringByteLen SysAllocStringLen SafeArrayCreateVector

zlibwapi

fill_win32_filefunc unzOpen2 unzClose unzGoToFirstFile unzLocateFile unzOpenCurrentFilePassword unzGetCurrentFileInfo unzReadCurrentFile unzCloseCurrentFile

GFLImageServices.dll

IMPHASH 86083eb233d67a2b17bb5f0df5ff6508
SHA256 eb67c04ad1fc64e16d3f34a19194b321b6736e42a3a9975522b0570e399679d5
MD5 7f490c0df4f4b406f885e33871f16303
SHA1 7c138c8740823f8f17b5cfbf64515881332096e6
SHA512 f82f884fdb4b5692a9d37361c804f595e329e63b3cc366b9c3cb7cb39b49f0d7266ffc587d4a0fb39b78ade483462d82ec96c4e5ce38772dd90677866f889c86
SSDEEP 1536:swrH/GZD0ctEyrt1R4KnGhglPjCVHSDTAn6KOxjEY+f6E1YuX:sSOZoSEyJ17GhO/iujEY+f6E1z
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

22959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libgfl340

gflLoadBitmap gflLoadBitmapFromMemory gflSaveBitmapIntoMemory gflLibraryInit gflGetFormatInformationByIndex gflLibraryExit gflEnableLZW gflMemoryFree gflGetDefaultSaveParams gflAllockBitmapEx gflGetFileInformationFromMemory gflFreeBitmap gflGetDefaultLoadParams gflGetFileInformation gflGetFormatIndexByName gflSaveBitmap gflGetNumberOfFormat

kernel32

GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA LoadLibraryA FreeLibrary lstrlenW GetProcAddress GetModuleHandleW lstrcmpiW RaiseException LeaveCriticalSection EnterCriticalSection GetLastError GetLocaleInfoA SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection GetThreadLocale SetThreadLocale WideCharToMultiByte LockResource FindResourceExW InterlockedIncrement InterlockedDecrement GetShortPathNameW InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar GetModuleHandleA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings IsValidCodePage GetOEMCP GetACP GetCPInfo SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile FreeEnvironmentStringsA GetStartupInfoA GetFileType HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess SetHandleCount

user32

CharLowerBuffW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree

oleaut32

SafeArrayGetUBound SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen RegisterTypeLi VarUI4FromStr

shlwapi

SHDeleteValueW SHSetValueW

GFLLibraryBuilder.dll

IMPHASH c581a0258a3f870004faad62efbe769c
SHA256 4f552fe9d1752a3e83fefacd51432e87d7f03082bd49105634e02372ae5a775d
MD5 94c436a39c7a0a5b5a2a67dc33d8b6b2
SHA1 691afd5f8d88ad6ac6de6f38be9d8389e8c7d28d
SHA512 fd0f169520dcdf0d924b68bc1694f860f24676f00d2942000898321e08b4dfdb5d6b18dec4cd15a92799d7c8da9fa697b86a1be2b43a8562e58930add50b6d88
SSDEEP 1536:Va2bA5dMuyhOfgr/BLkv5onLKR9CinKy+Twtogh4tDIF:Va2s5dQSgrITfCiKy+TwSSF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

23102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libgfl340

gflLibraryInit gflGetFormatInformationByIndex gflGetNumberOfFormat gflGetFileInformation gflLibraryExit gflEnableLZW

kernel32

lstrlenW GetProcAddress GetModuleHandleW lstrcmpiW RaiseException LeaveCriticalSection EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW FreeLibrary GetShortPathNameW InterlockedIncrement InterlockedDecrement WideCharToMultiByte SetLastError GetThreadLocale SetThreadLocale LockResource FindResourceExW GetStringTypeW DeleteCriticalSection InitializeCriticalSection GetModuleHandleA GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType

user32

wvsprintfW CharLowerBuffW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance StringFromGUID2 CoTaskMemFree

oleaut32

SysStringLen VarUI4FromStr SysAllocStringLen UnRegisterTypeLi LoadTypeLi SysFreeString RegisterTypeLi SysAllocString

shlwapi

SHDeleteValueW SHSetValueW

GeoIP.dll

IMPHASH b31bb1c1e6c5571c97e8214c18471549
SHA256 7c9bc79832d4d95bacdcc7c3d3b9a09e907b0486a83f2b51ba97379ffb8b107f
MD5 18acbac35973dd1a370eb084d3248a1c
SHA1 06d9b1011e8da4d32966f3f9b99d09914937c956
SHA512 169e6d70e552d487bb89987beba8b15d0e3086ba484c436494f189c3d780b3a680e67d851ce31bbb63fe86c88ace464123752a3f649be36937e0a0a4155d02a4
SSDEEP 1536:JvYtAjfQa/bvEB7dD/xFUyYW0AVGURtgty90Dxp+Clo:SPaI7dlFUac+gW0Df+Clo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetSystemTimeAsFileTime GetModuleFileNameA GetModuleHandleA LocalAlloc GetProcAddress FreeLibrary InterlockedExchange GetLastError LoadLibraryA RaiseException HeapFree FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFileType HeapAlloc EnterCriticalSection LeaveCriticalSection HeapReAlloc FindClose GetDriveTypeA FindFirstFileA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection VirtualAlloc SetStdHandle SetHandleCount GetStdHandle GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile RtlUnwind MultiByteToWideChar ReadFile SetFilePointer CloseHandle GetFullPathNameA CreateFileA GetCurrentDirectoryA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetTimeZoneInformation FlushFileBuffers SetEndOfFile GetProcessHeap LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CompareStringA CompareStringW SetEnvironmentVariableA

GeoIPRegion_delete GeoIP_assign_region_by_inetaddr GeoIP_assign_region_by_inetaddr_v6 GeoIP_charset GeoIP_code3_by_id GeoIP_code_by_id GeoIP_continent_by_id GeoIP_country_code3_by_addr GeoIP_country_code3_by_ipnum GeoIP_country_code3_by_ipnum_v6 GeoIP_country_code3_by_name GeoIP_country_code_by_addr GeoIP_country_code_by_ipnum GeoIP_country_code_by_ipnum_v6 GeoIP_country_code_by_name GeoIP_country_id_by_addr GeoIP_country_id_by_name GeoIP_country_name_by_addr GeoIP_country_name_by_ipnum GeoIP_country_name_by_ipnum_v6 GeoIP_country_name_by_name GeoIP_database_edition GeoIP_database_info GeoIP_db_avail GeoIP_delete GeoIP_id_by_addr GeoIP_id_by_addr_v6 GeoIP_id_by_code GeoIP_id_by_ipnum GeoIP_id_by_ipnum_v6 GeoIP_id_by_name GeoIP_id_by_name_v6 GeoIP_last_netmask GeoIP_name_by_addr GeoIP_name_by_addr_v6 GeoIP_name_by_id GeoIP_name_by_ipnum GeoIP_name_by_ipnum_v6 GeoIP_name_by_name GeoIP_name_by_name_v6 GeoIP_new GeoIP_num_countries GeoIP_open GeoIP_open_type GeoIP_org_by_addr GeoIP_org_by_addr_v6 GeoIP_org_by_ipnum GeoIP_org_by_ipnum_v6 GeoIP_org_by_name GeoIP_org_by_name_v6 GeoIP_range_by_ip GeoIP_range_by_ip_delete GeoIP_region_by_addr GeoIP_region_by_addr_v6 GeoIP_region_by_ipnum GeoIP_region_by_ipnum_v6 GeoIP_region_by_name GeoIP_region_by_name_v6 GeoIP_set_charset GeoIP_setup_custom_directory

HashLib.dll

IMPHASH ce68a956611d680da4eb6ddd51dec748
SHA256 6c5356f08f65135ae30e7208f91cf87f1e89731794ca5d0b5e8464efb5b82ffd
MD5 d4c56b38c61b62cd4fda14f9e46a4a3d
SHA1 e63a2cd59ff19042fd5fece5a9812f10e426639e
SHA512 e71ff82a905ba903726f05e0b18a403d0bb7bf769d4dfbaa01092c41a9d03c89303daa1363ab00c81b9b4cba81b4fe24fb326e828f6e0a2f4cb5c3499ca6fcb9
SSDEEP 1536:ou+QKy8A04dWZVRxyMfKpKQwOmu2JiQykO8hvELviU0:kdA04RbZ2J9ykOT6U
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

24324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

??0CED2K@@QAE@XZ ??0CMD4@@QAE@XZ ??0CMD5@@QAE@XZ ??0CSHA@@QAE@XZ ??0CTigerNode@@QAE@XZ ??0CTigerTree@@QAE@XZ ??1CED2K@@QAE@XZ ??1CMD4@@QAE@XZ ??1CMD5@@QAE@XZ ??1CSHA@@QAE@XZ ??1CTigerTree@@QAE@XZ ??4CED2K@@QAEAAV0@ABV0@@Z ??4CMD4@@QAEAAV0@ABV0@@Z ??4CMD5@@QAEAAV0@ABV0@@Z ??4CSHA@@QAEAAV0@ABV0@@Z ??4CTigerNode@@QAEAAV0@ABV0@@Z ??4CTigerTree@@QAEAAV0@ABV0@@Z ??4Digest@CMD4@@QAEAAU01@ABU01@@Z ??4Digest@CMD5@@QAEAAU01@ABU01@@Z ??4Digest@CSHA@@QAEAAU01@ABU01@@Z ??4TigerTreeDigest@CTigerTree@@QAEAAU01@ABU01@@Z ??ADigest@CMD4@@QAEAAKI@Z ??ADigest@CMD4@@QBEABKI@Z ??ADigest@CMD5@@QAEAAKI@Z ??ADigest@CMD5@@QBEABKI@Z ??ADigest@CSHA@@QAEAAKI@Z ??ADigest@CSHA@@QBEABKI@Z ??ATigerTreeDigest@CTigerTree@@QAEAA_KI@Z ??ATigerTreeDigest@CTigerTree@@QBEAB_KI@Z ?Add@CMD4@@QAEXPBXI@Z ?Add@CMD5@@QAEXPBXI@Z ?Add@CSHA@@QAEXPBXI@Z ?AddToFile@CED2K@@QAEXPBXK@Z ?AddToFile@CTigerTree@@QAEXPBXK@Z ?AddToTest@CED2K@@QAEXPBXK@Z ?AddToTest@CTigerTree@@QAEXPBXK@Z ?Assume@CTigerTree@@QAEXPAV1@@Z ?BeginBlockTest@CED2K@@QAEXXZ ?BeginBlockTest@CTigerTree@@QAEXXZ ?BeginFile@CED2K@@QAEX_K@Z ?BeginFile@CTigerTree@@QAEXK_K@Z ?BlocksToNode@CTigerTree@@AAEXXZ ?CheckIntegrity@CED2K@@QAEHXZ ?CheckIntegrity@CTigerTree@@QAEHXZ ?Clear@CED2K@@QAEXXZ ?Clear@CTigerTree@@QAEXXZ ?Collapse@CTigerTree@@AAEXXZ ?Finish@CMD4@@QAEXXZ ?Finish@CMD5@@QAEXXZ ?Finish@CSHA@@QAEXXZ ?FinishBlockTest@CED2K@@QAEHK@Z ?FinishBlockTest@CTigerTree@@QAEHK@Z ?FinishFile@CED2K@@QAEHXZ ?FinishFile@CTigerTree@@QAEHXZ ?FromBytes@CED2K@@QAEHPAEK_K@Z ?FromBytes@CTigerTree@@QAEHPBEKK_K@Z ?FromBytesLevel1@CTigerTree@@QAEHPBEK_K@Z ?FromRoot@CED2K@@QAEXPBE@Z ?GetBlockCount@CED2K@@QBEKXZ ?GetBlockCount@CTigerTree@@QBEKXZ ?GetBlockLength@CTigerTree@@QBEKXZ ?GetHash@CMD4@@QBEXPAE@Z ?GetHash@CMD5@@QBEXPAE@Z ?GetHash@CSHA@@QBEXPAE@Z ?GetHeight@CTigerTree@@QBEKXZ ?GetRawPtr@CED2K@@QBEPBXXZ ?GetRoot@CED2K@@QBEXPAE@Z ?GetRoot@CTigerTree@@QBEHPAE@Z ?GetSerialSize@CED2K@@QBEKXZ ?GetSerialSize@CTigerTree@@QBEKXZ ?GetSize@CED2K@@QBEKXZ ?IsAvailable@CED2K@@QBEHXZ ?IsAvailable@CTigerTree@@QBEHXZ ?Load@CED2K@@QAEXPBE@Z ?Load@CTigerTree@@QAEXPBE@Z ?Reset@CMD4@@QAEXXZ ?Reset@CMD5@@QAEXXZ ?Reset@CSHA@@QAEXXZ ?Save@CED2K@@QBEXPAE@Z ?Save@CTigerTree@@QBEXPAE@Z ?SetHeight@CTigerTree@@QAEXK@Z ?SetSize@CED2K@@QAEXK@Z ?SetupAndAllocate@CTigerTree@@QAEXK_K@Z ?SetupParameters@CTigerTree@@QAEX_K@Z ?Tiger@CTigerTree@@CAXPBX_KPA_K22@Z ?ToBytes@CED2K@@QAEHPAPAEPAK@Z ?ToBytes@CTigerTree@@QAEHPAPAEPAKK@Z ?ToBytesLevel1@CTigerTree@@QAEHPAPAEPAK@Z

ImageViewer.dll

IMPHASH 7c243d365f44afcec80532bb549440e7
SHA256 64d2966963e06a796cd8e572144bacf543ccbbdf8e9de67622a99c442019b521
MD5 3498184df35bc11fb117f5ee8b4327e2
SHA1 964f8ddc2a4c0020b6dfc5602af4a036907cf25a
SHA512 1ca7c4f21d00794523f95e59a9dc297d7a7df681c17d8f0e91f78c605a9fe1a064fb573a1f7e5b6ba1a69d10adbf679246e2302592c05ab7891db12df8fb80b0
SSDEEP 3072:W7VEXahYB7035OL/6g+vhtp66VhoLVF32TJK5T:u+X7h0pX7G8oLVMTJ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SizeofResource LoadResource FindResourceW LoadLibraryExW lstrcpyW lstrcatW GetLocaleInfoA MultiByteToWideChar GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW FreeLibrary InterlockedDecrement InterlockedIncrement GetModuleFileNameW GetLastError lstrlenW GetModuleHandleW GetProcAddress InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale DeleteCriticalSection GetThreadLocale lstrcmpiW UnmapViewOfFile MapViewOfFile SetFilePointer CreateFileMappingW CloseHandle GetFileSize CreateFileW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetModuleHandleA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle WriteFile HeapReAlloc VirtualAlloc VirtualFree HeapDestroy HeapCreate IsValidCodePage GetOEMCP GetACP GetCPInfo ExitProcess HeapSize Sleep SetLastError HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree

user32

LoadCursorW DestroyWindow LoadStringW CharNextW ReleaseDC GetDC ReleaseCapture SetCapture PostMessageW EndPaint InflateRect BeginPaint MoveWindow OffsetRect GetClientRect GetParent SetTimer KillTimer SetCursor LoadImageW DestroyIcon InvalidateRect BringWindowToTop ShowWindow GetActiveWindow MessageBoxW

gdi32

Rectangle DeleteDC BitBlt SelectObject CreateCompatibleDC GetObjectW SetBkColor SetBkMode ExcludeClipRect DeleteObject SetDIBits CreateDIBitmap ExtTextOutW

advapi32

RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteValueW

shell32

SHGetFileInfoW

ole32

StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CLSIDFromString CoCreateInstance

oleaut32

SysAllocStringLen VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysStringLen RegisterTypeLi SafeArrayGetUBound SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayDestroy SysFreeString SysAllocString

MediaImageServices.exe

IMPHASH 3d364806f3805d2f51903990795ff62d
SHA256 a14280ad39be0f491e2825988af7c07903e51956f0596a89dded1a96c794aef5
MD5 000a796161b38ceccde0a528d694d698
SHA1 1048fc2fd274b1ca60fbd7ee52489faa2b6ecd52
SHA512 3babb76b116bfaf85cfe4c28bb008645cd9b2cd2531125fbc0a08fc308f9e59be6293c72ae6dec184295300d7d6b45f9231b9274b49b7b1d8030a0863031bc6e
SSDEEP 1536:rc7QTyRcHS5kJP6BLINox7piYnsKEYh+k6rnrroa/x5:rc7QTYcH6kJSBLMu0YEYh+k6froQx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection SetErrorMode GetCurrentThreadId InterlockedDecrement SetEvent GetCommandLineW GetLastError WaitForSingleObject Sleep CreateEventW CreateThread InterlockedIncrement IsDebuggerPresent LCMapStringW LCMapStringA GetStringTypeW EnterCriticalSection LeaveCriticalSection RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW CloseHandle FreeLibrary GetStringTypeA WideCharToMultiByte GetLocaleInfoA IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetModuleHandleA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType HeapAlloc HeapFree GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter VirtualFree VirtualAlloc HeapReAlloc HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapSize TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount

user32

CharNextW CharUpperW GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoInitializeEx CoTaskMemAlloc CoUninitialize CoCreateInstance CoTaskMemFree CoResumeClassObjects CoRegisterClassObject CoRevokeClassObject CoSuspendClassObjects CoTaskMemRealloc StringFromCLSID StringFromGUID2

oleaut32

SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector LoadTypeLi SysAllocString SysFreeString SysStringLen RegisterTypeLi VarUI4FromStr UnRegisterTypeLi

MediaLibraryBuilder.exe

IMPHASH c27c044464e971f0f1d50aa7096799fe
SHA256 2d2702eaef0a9850bbbc030aeeeaf113c40218f9e7e19984798853e4b7881d49
MD5 7f3df74bb60ba6f66ddc3ccf99538001
SHA1 0ae34b24db6a2db76f6ec4c32791d290e2b3e44b
SHA512 d9fa61c06c3ca6edc93ef69edc5375cf2e99bf6719b2f4c4d4d7c88c57bf99ec94163b0b3593844edf0c04bd9187ee69f8ffa52acf790fe2ce3769959cb24499
SSDEEP 1536:ttdTzLoVgOD106eMI5IR/EYDL6fkpPJ8M7an+KS4PU+GotYw14XnrroOuGV:bdHLcT10xxAEsL6m78SsU+GotYfroBG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

20286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection InterlockedDecrement InterlockedIncrement SetLastError SetErrorMode GetCurrentThreadId SetEvent EnterCriticalSection CloseHandle WaitForSingleObject Sleep CreateEventW CreateThread FlushFileBuffers CreateFileA LeaveCriticalSection RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary GetCommandLineW DeleteCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP WideCharToMultiByte SetFilePointer HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA GetModuleHandleA

user32

CharNextW PostThreadMessageW CharUpperW GetMessageW TranslateMessage DispatchMessageW wvsprintfW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoInitializeEx CoResumeClassObjects StringFromGUID2 CoRegisterClassObject CoRevokeClassObject CoCreateInstance CoSuspendClassObjects CoUninitialize

oleaut32

UnRegisterTypeLi LoadTypeLi SysStringLen RegisterTypeLi SysAllocString SysAllocStringLen SysFreeString VarUI4FromStr

MediaPlayer.exe

IMPHASH 0e3b6419b753915e6f9f9228d2add89d
SHA256 592668782aa09cb30c3a5115222549caeb02315eff3102f521c3e5906667f275
MD5 7d0dfdc1d22334549db6597b6d899ed4
SHA1 6c4c5733247c13d0133efaa22f571e572d1bc8a9
SHA512 57ca18531f3cc2acb95622eb154d6599100ea2f334c9a4bfc6b6e4685f1d63f58791db087ff49300125a891c841e94a24e9617c44c7df48bf6453792353c41bb
SSDEEP 1536:8uvzmRhoNzQ3rL1JpRaAyxJnPLwWbkT2r3nEk/DuB9iAWExnhKevNx5aQF+gcFdI:8uvoCo1XRnyxtL18/iAXus5aq+gcyH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

37743

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress CreateEventW CreateThread CloseHandle WaitForSingleObject InterlockedIncrement EnterCriticalSection LeaveCriticalSection SetLastError GetCurrentProcess FlushInstructionCache GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA Sleep GetLocaleInfoA GetConsoleMode GetConsoleCP WideCharToMultiByte SetFilePointer IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW TlsFree TlsSetValue TlsAlloc TlsGetValue HeapSize GetModuleFileNameA GetStdHandle InitializeCriticalSection GetCommandLineW SetEvent InterlockedDecrement DeleteCriticalSection GetCurrentThreadId SetErrorMode GetModuleFileNameW GetModuleHandleW FindResourceW LoadLibraryExW LoadResource SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW FreeLibrary lstrlenW WriteFile ExitProcess HeapCreate HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetModuleHandleA

user32

GetClassInfoExW UnregisterClassA CharNextW PostThreadMessageW CharUpperW GetMessageW TranslateMessage DispatchMessageW IsWindow SetWindowPos RegisterClassExW LoadCursorW DefWindowProcW SetWindowLongW GetWindowLongW DestroyAcceleratorTable IsWindowVisible ShowWindow RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint IsChild GetFocus GetDesktopWindow GetWindow GetDlgItem SendMessageW GetClassNameW GetSysColor RedrawWindow SetFocus CreateWindowExW DestroyWindow CreateAcceleratorTableW ClientToScreen GetParent ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect GetClientRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush

advapi32

RegCreateKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitialize CoUninitialize StringFromGUID2 CoCreateInstance CoRegisterClassObject CoRevokeClassObject OleUninitialize OleLockRunning CreateStreamOnHGlobal CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize

oleaut32

SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi OleCreateFontIndirect LoadRegTypeLi VariantClear VariantInit SysAllocStringLen RegisterTypeLi VarUI4FromStr SysStringLen

Preview.dll

IMPHASH 547d2499a8ea189ae5c4d932f977c807
SHA256 e5bc87d9994f1d606e0936a9a61b4e8a6c1220f773e2128ecbd4a0f72d0f9a85
MD5 8550534068b0220bd0e9a2ffe7c4165f
SHA1 ca741e867965b8cbdfc600104a5e26ea7dc59577
SHA512 989c7e20d0462ce557b9ce1f0a98918917bf3cf3d673747f5cb3310b8c015fc3d44a140e9c958402fb7bf290a68cca3ea74352b41e84a601e4c9bae28af2e993
SSDEEP 3072:FXq18eZcrFOkAGzxSAYew0cf+Z+w/0cqTMJeAmey0nX:FXS8eCFOxG1jL1Z07YUA+0n
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

44061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcess FlushInstructionCache MulDiv lstrcmpW lstrlenA FindResourceExW FreeLibrary GetProcAddress GetModuleHandleW LoadLibraryExW GetThreadLocale SetThreadLocale CloseHandle WaitForSingleObject TerminateProcess GetFileAttributesW GlobalHandle GlobalFree FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetCurrentThreadId LoadResource LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile ExitProcess Sleep HeapCreate InterlockedIncrement InterlockedDecrement GlobalUnlock GlobalLock GlobalAlloc LockResource lstrcatW lstrcpynW DeleteCriticalSection GetModuleFileNameW InitializeCriticalSection GetStringTypeW FindResourceW SizeofResource MultiByteToWideChar GetLastError EnterCriticalSection LeaveCriticalSection RaiseException lstrcmpiW lstrlenW GetStringTypeA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetModuleHandleA

user32

GetDlgItem SetDlgItemTextW EnableWindow UpdateWindow SetFocus LoadStringW SetWindowTextW GetClientRect GetSystemMetrics MessageBoxW GetDlgItemTextW CharNextW UnregisterClassA SendMessageW DialogBoxIndirectParamW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW BeginPaint EndPaint IsChild GetFocus IsWindow GetClassNameW GetSysColor RedrawWindow GetClassInfoExW DestroyWindow CreateAcceleratorTableW ClientToScreen GetParent ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable GetWindowLongW SetWindowLongW DefWindowProcW LoadCursorW RegisterClassExW CreateWindowExW SendDlgItemMessageW MapDialogRect SetWindowPos SetWindowContextHelpId GetWindow EndDialog GetActiveWindow

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteExW ShellExecuteW

ole32

CoTaskMemAlloc CreateStreamOnHGlobal OleUninitialize StringFromGUID2 OleLockRunning CoCreateInstance CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize StringFromCLSID CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemRealloc

oleaut32

UnRegisterTypeLi RegisterTypeLi SysFreeString SysStringLen SysAllocStringLen SysAllocString OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VariantClear VariantInit VarUI4FromStr

shlwapi

PathRemoveArgsW PathUnquoteSpacesW PathQuoteSpacesW SHRegCloseUSKey SHRegSetUSValueW StrTrimW SHDeleteValueW SHDeleteKeyW SHRegEnumUSValueW SHRegOpenUSKeyW PathFindExtensionW StrChrW

RARBuilder.dll

IMPHASH 63f5d82d813920e56b38fc4996823f1b
SHA256 2f1b4a09998a9f24b474927a18b080879503a77d5f42192c7be1b5c6b4167687
MD5 b5f83c062ae61781e8eded59198c7162
SHA1 e73e0588aa9b30b3ab3bf68716051dcb7c4db65a
SHA512 ca36d62e296a4ae3dac432e733c462c3132315d2280baa8db5c5470d6c7511950a2cb95b93d8ac5cf94cda53b0474c8570a572d3de08a7ee566c2effcaad4a4c
SSDEEP 1536:nFvJ7fDHXwOgUDpamk/DnJt+Mcd5kUtN4BD5:nFR7fLwiDuDJt+Mcd5PgF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

21376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection InterlockedDecrement InterlockedIncrement EnterCriticalSection FindResourceExW SetLastError LoadLibraryW lstrcpyW GetThreadLocale SetThreadLocale LeaveCriticalSection RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary LockResource DeleteCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind

user32

wvsprintfW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance StringFromGUID2

oleaut32

UnRegisterTypeLi LoadTypeLi SysStringLen RegisterTypeLi SysAllocString SysAllocStringLen SysFreeString VarUI4FromStr

RatDVDReader.dll

IMPHASH 10abf616ff7d95dd029c3c7603d77c29
SHA256 413e1749c95f6dcdc4dab17ac3c2049cfa44bf56c1a9266e07d6196e12f7872f
MD5 82f6b3c70b63d71cd098db8488ebca43
SHA1 1fc287d47f05128faf572ada21139da3ed0db9fe
SHA512 006bf3ac8c75a368d5606aefc3b27be588513b8a7d8a76892256dfb294eb836ffc845c045d684c6b85cab463568371155f3f5c3bc6bc385393e1d9ab734a01dc
SSDEEP 1536:2E6mFC4m3ky7FgcWtRXkQsyZbz3sg+TcTd5N4RSSBegZJKnt6cvS0:2JmFC4g71W3sg+TcTdm9Kt6gS0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

25820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection HeapAlloc HeapFree IsValidCodePage WideCharToMultiByte SearchPathW EnterCriticalSection SizeofResource CreateFileW CloseHandle SetFilePointer ReadFile LockResource FindResourceExW HeapCreate DisableThreadLibraryCalls HeapDestroy GetThreadLocale SetThreadLocale MultiByteToWideChar GetLastError RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW LeaveCriticalSection FreeLibrary CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc HeapSize GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RtlUnwind VirtualFree VirtualAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCPInfo GetACP GetOEMCP LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime

user32

CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoCreateInstance CoUninitialize CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoTaskMemAlloc CoInitialize

oleaut32

LoadTypeLi RegisterTypeLi SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector SysAllocStringLen SysAllocStringByteLen SysStringByteLen VarBstrCat SysAllocString SysFreeString SysStringLen VarUI4FromStr UnRegisterTypeLi

RazaWebHook32.dll

IMPHASH 74f331050506a8da2f220d5896420d3c
SHA256 36b7a497f7ec7952bf96fc83b3c69cc9fd2cb235dee335682ff2178df6cf1703
MD5 45ef9bdd876ea9e58a460d81fec26ec7
SHA1 883e050caaf38baab1bd334016f54fb1b345fc3f
SHA512 ffb559f675941102d7eff7d7f2fc5f14e85ee3b9a661fb364667645e3e332f8ff8a784c5e2eab253fb5d052942c08bcf90ce074e0e10281165970f43b2c17a8f
SSDEEP 1536:WtRjm7OPKCVeHWm7vRHkvsVsTN+ns2Nqg1CacCiU7mLEDGF:WnjmytVeP7vlVsx+nJNZ19YUaLjF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

22390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadResource FindResourceW LoadLibraryExW GetModuleHandleW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection InterlockedIncrement SizeofResource LockResource FindResourceExW GetThreadLocale SetThreadLocale GetProcAddress MultiByteToWideChar GetLastError EnterCriticalSection LeaveCriticalSection RaiseException lstrcmpiW lstrlenW InterlockedDecrement FreeLibrary GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW

user32

CharLowerBuffW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

shell32

ShellExecuteW

ole32

StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance

oleaut32

VarUI4FromStr UnRegisterTypeLi SysAllocString RegisterTypeLi LoadTypeLi LoadRegTypeLi SysFreeString SysStringLen

shlwapi

SHRegGetUSValueW

RegExp.dll

IMPHASH 66591c94e08d52d3fe115bc02b6e3cb1
SHA256 11a4d791e078adbb487555a2d1f35f6427963abb8041e8485c5f2f284d48b553
MD5 45b1ecae838a6252d8413a9c9f070ab9
SHA1 18d7761e41fdc65315bf192dacd3d0645eda3838
SHA512 c5e5bf7024109a5bde77dcb194fdbd1d7e8d0d5de58fe5b1d26155752a7e07048b537f44aa28e00434072f8e8f8174fb322e976ccec56352016a19817c8e3e53
SSDEEP 3072:IW7THGIrptN19ya7mEXw11OiZ2eBNCgld/aRV5tvrJ6kz7B:lPHGTjOiZVC0diB90Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

57122

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalAlloc InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree GetModuleHandleW GetProcAddress ExitProcess HeapReAlloc HeapAlloc GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetStringTypeW GetCPInfo LCMapStringA LCMapStringW CompareStringW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate HeapDestroy VirtualFree VirtualAlloc WriteFile GetStdHandle GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetLocaleInfoW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA

Remote/commonFooter.htm

SHA256 fd0bbe56d19430ee94411f32f27806892baba16796b2cfd711ece7c15faaceb1
MD5 5b77f72375c4bfa2422e40925aee62db
SHA1 39f026cabb2d8a873924a68b7038661151724288
SHA512 b84c5ad65ac36624350d07e16207e2ac84a3a37731f9da9705499c4e3f8564b4fcfcfcc6f912df1536cb783399432458f030c9da641b63b0b5b1f2138b91fc76
MD5 SHA1 SHA512

Remote/commonHeader.htm

SHA256 936d0e18251d4895d75d2505a923b9736bda0aa759f0429052cafa1f4cccb9e9
MD5 62bf95da542905459bbb989ec5263444
SHA1 797a741efb8b795f1a57cb641a4129065ac32ed0
SHA512 df5336dac205e4dbafcb069351c518267d08e33f01f34cb1fc3b0c71ec778647cd07134b3619f3b44af52f163407cf20ac71097932cb0ae281ceb85b74976df7
MD5 SHA1 SHA512

Remote/downloadsBottom.htm

SHA256 29058954ad8b9ceea7a5e8b562fd35a65ec24ac454a8cc11c2f452d794da4551
MD5 e0382e4d7446039d5564ec2c80c6d0e2
SHA1 feb34e388eab17c5306e70bfd33f356688a32530
SHA512 d256e6c2eac2c1cb56277d8705833023d6180cc9f6714f358c34a18b9387c047495a7cb851923e9f1afdbf65fe7916db02faf7d1fa25deddaff299a6b8e08b05
MD5 SHA1 SHA512

Remote/downloadsDownload.htm

SHA256 613883bf3275184de0223e85bd1655ed56d4d71599f2bfe443d55b2f6f34bb84
MD5 8653d8c4a2ca9c59b967c29a6bdaec36
SHA1 cc1746976d46f9aa0ad34aa6a78897c660182f7a
SHA512 ccc74df0947f166f9e17927c76a002e02939ff0383778c4d50322b533daf98df85ca7ccf70b97130787464a82f1d48d589826c311a1e9db447a6cc2b3d470acf
MD5 SHA1 SHA512

Remote/downloadsFooter.htm

SHA256 292641e16fa2319d9daf00a196c7a0af7b4bfeb51b3a23088b57ee702902d520
MD5 9e03d9e79bc6c71d4247921203f81aa8
SHA1 939d3e87b0a05c246d85142f5beab272c44a92d4
SHA512 6ef4355a684a312319614e7a42f768ecde75086459f3426ec5a80ecca3c850ee053d0384e78c9971ad2d9d2df1f2ed015260f22408cdb7c54e7ce8c0fa82a095
MD5 SHA1 SHA512

Remote/downloadsHeader.htm

SHA256 0ca14f67abbd09624b3d504449b7185b571c5f121a92207f1329fc7eb2b31e10
MD5 9b87b85cc44cdae5f2cdf396aad5c3ff
SHA1 26254b8c67b8ec387546dec5fd85f63355419ea7
SHA512 01f5a7a3c7825794d68b7f9661a7913aebe6b89cb6fc813b39ff97ae3938f188809b350b332a94f5a7402970a2ddba7b8b553055ca7e5c3fb58eb8161b9e8c95
MD5 SHA1 SHA512

Remote/downloadsSource.htm

SHA256 370a6b8ca894afe33ae25a51dede34a13492027e3422e8e37d148809617ff7cb
MD5 55af0facdb54e5944e01c781a54c2896
SHA1 9900ab12f17b95ac1ce83fca35aa87b036555577
SHA512 3318193e268a08309a75bb81be7f40f19156824fa0a059f3dd93f632bcf88e26f74470f672fc6ec49ad9da39c51e96ea2be214665238ee7f4182767cced242ce
MD5 SHA1 SHA512

Remote/downloadsTab.htm

SHA256 28e215a4371410929083c2f373636e7bab628793d50cd093cbe4fcde02852456
MD5 79480e7903362657c79622ccbeff1072
SHA1 86be734b27695add732a7e81fa8e0baeb71b1db0
SHA512 3af6804a96215e98a66571ea85a967766bb89c3bf38fd7eee6246874e2c501b21de8adefefbe2312c0c232cfe19ff0e77c82107a4fc52e86ea9a5356ea571f5f
MD5 SHA1 SHA512

Remote/downloadsTop.htm

SHA256 4da1c4f8b6d447b83c83d3b38f8334d4536ef40c8396e6aec3009e61613b2c23
MD5 1ddfa1289cc21e94c9b064166630acb6
SHA1 02821d72a9b1bb6df13f45279e74ae88afde4b85
SHA512 06df3aa1fc9316d9688757115a1c27158d879fdafa9023675abda0515cc5170397211945af3cc191f0222acb8f191a7297e5d3dc9e567fe052735624fffeb5ad
MD5 SHA1 SHA512

Remote/home.htm

SHA256 394bbf92542514cf1d325579aac7c5f693951c76edc7ec6927062fda2d421f00
MD5 83dd2a978b8d5f82672692b399022d79
SHA1 71a4fce9beecdf6bc93933761567d571d4131922
SHA512 07b18ad6e5633ee2b93a5190796d419b21f2f8a4bde9e3f60402a6e38173356d8e8cf619a8cb83824c01913396f49d83ec35d03b35fad02bbcc0059373238322
MD5 SHA1 SHA512

Remote/images/shareaza.css

SHA256 75f542baac9da2aab7cd5392b5fa5bf37f23846cc21433658191c3957579e57f
MD5 4755ae0a9b75146597e585a77b66f31b
SHA1 8ec738143292d68fe3d9cbd1c89036327db2aa11
SHA512 74462def80a5d059512b1becddd0f5a2b227ad51735587affbed3beb1dab4262dadba19bfd82b87c8b60f09ecb6418bf47f0d10500a073ad82bdc9c70646f12f
MD5 SHA1 SHA512

Remote/login.htm

SHA256 5749c2e0994ed41d9393c72ad968aba3d361d7115d4d3219e26060e335c8b283
MD5 47727ca7501497f773ba0d1ebc67845f
SHA1 548eec85c7d2fc588e3689ecdb67f248529973fd
SHA512 afdb240176ea37c40f35933e204cfc95ecde1b0abbb14ef5137bbab4d3c7f92c5353a51bb2702385619a76cde514afecc21efd52d6419375baa21789e605b745
MD5 SHA1 SHA512

Remote/networkFooter.htm

SHA256 b68ac71bba60c53d2c308c94782393a52a9efcbe1fc5129068ac54316245f5c7
MD5 04d3c901959d173451c7ea652301aa84
SHA1 836211328b1ead4a9365e59a165813afd48e05aa
SHA512 4f347d22c372c2a6cba354b2d46e5e590f3b830c15423c2633ac95ce6cc70ef6f7b76363145f15879d232c275b342e87360ea204f86c5822a20932fd897b3c55
MD5 SHA1 SHA512

Remote/networkHeader.htm

SHA256 02a93f582546d1e34932ad5c0ba657be60ef16f50596023b12267ce461770957
MD5 3cdb94d48e882fb88c41299f0c8464d3
SHA1 57fd127da6a5352cf45519b384bbffca2b0102d4
SHA512 8bb36eb382e3ee286df4818d0a33d09d3615f7025fa269be840b23634aae387ebfdaf19aeeea99619b3972d903c15fbc360298ea1d6453bf52a33c3393f3518a
MD5 SHA1 SHA512

Remote/networkNetEnd.htm

SHA256 181cd1d217087988e613ff7e46e2b7d88ae85ff9a7550a37f67ee71b21a7f5d8
MD5 742c5a09bcf6032c5856627fc3e09628
SHA1 2ddcf4ae1572a94ac91b31bff98d35f1c610f11a
SHA512 1f6c5ec202b4281fbe6df35d02d230870970dfc45eeab4f89950262631b01cdc7c9bd7dd765e70eaa0ea487b6df8a45f82ac914bca452167333a9a98da97d5b8
MD5 SHA1 SHA512

Remote/networkNetStart.htm

SHA256 6133d2b5a5d7c48c60ab3ade1667a2e5d37e1b64f844479cf77787929c712a28
MD5 3c78600c63b3bfac55ff0c9ec6b7a7a0
SHA1 afbb896fb85cc82eb46987339e1a73bf14bcce74
SHA512 6f2aeb2461dbb91d77ce0aef0391e5ad888bc730d0f207791d85f8684b1b88fb25749707dd540e428bf3589343b21cbb90b8b5993ce83072277327f9d732c9db
MD5 SHA1 SHA512

Remote/networkRow.htm

SHA256 1659d7a8d4965e9dde338c0885dc6b990f4a2862d699b2a1a9425fc57deeacd0
MD5 d895b5f4efa0151accffb2bf6c244005
SHA1 40ec02294bc7b3657b4341154ed4ecfc2d8fcc45
SHA512 6f74a0ba35687bdccccea96edbba64a2102914ca9dc627e380ec53e4b905d9552a1beb122319c6c7d55575961624f1ae1d7d330863a2e387ba67c5b1c0839c71
MD5 SHA1 SHA512

Remote/searchBottom.htm

SHA256 154347cdeb3d87b5fcbea8079080a0f7ab2622b89ca6774c8f5c7d9bcadc8902
MD5 3a0fc27bfab8f79be6bb3ed5bd291fff
SHA1 a0790bdedbfe81cca1aa0c68f6685863f0bc9385
SHA512 ee04c74046538610d48d25f63c15c1c4c4670035eddd4c6631dbeb3835ac2add53f8b45966f46882a89e227e2372c0f5868da90847075dddb321b8b627c08fe9
MD5 SHA1 SHA512

Remote/searchColumn.htm

SHA256 a8e562e980bc433849d61fc060e7406f4f61074750e57f5ec087e3bfdf7d74ae
MD5 4ddf6aa2040fc237117fe2f5fb022b40
SHA1 231e81cd23f3fb648961cf709b5f3e27caa42084
SHA512 c7013114cce32a15a661415b237243f0f397025dcd40e6a51560d70d7fec007dccf8628693b63a9117e8557bd2f54b80a673916f6d09e0d9bd28ecf8d1613a51
MD5 SHA1 SHA512

Remote/searchFooter.htm

SHA256 9421b01b9c46cfe99d7251f0c046ffc6fcd4e2fcd8633d118e674a3800c9937d
MD5 d4f3b460413121b97a3c285d50b838f9
SHA1 2048704e8b4764cc497edf12cd1f548191997f1e
SHA512 99ed29c7f15d5fe6fe73a485bfbfb9afba73b2f4614626ff87db3c2bb01a9c4f8c130a7fffee1fd6f98ca3c0184d50dbfbf236a40654b60769552095317fca2c
MD5 SHA1 SHA512

Remote/searchHeader.htm

SHA256 d4b41ace5ab3fae584cb386082cf29d07b0e7ff089e12d386c50bd0197ced372
MD5 d48a8d7d62b15272b2db550212c5621d
SHA1 a2893d77c43a7aabd9122b8f1737331648dfbd13
SHA512 e48b9d37c81c56cb14af0fec3246d74bad15cca1cb516c6a2a3cedb6b313d9fea342a3ae825047186a17c3fda43ffd81492d894a3db87af6157f1e5f86fe3f22
MD5 SHA1 SHA512

Remote/searchMiddle.htm

SHA256 4a333c9a87d4b12840623eb3e280efd1832d3379a80a351e2d0bd290c0acde45
MD5 570767e5af2672ec45924d336c1057d1
SHA1 bd44fe6517978677d27be65418e36d7d54c398e2
SHA512 8f40697bb537251b2e17adeefd6987f3aa5fe8de684914f7e2f4c3126fba6102fb1b49335fb840d5b92885af8e0454c221405d717e3ac9ec37c8badbeddf9aa1
MD5 SHA1 SHA512

Remote/searchNew.htm

SHA256 c9ebe019f8f5bc34707a31f47c36434c678f3b7435aa3d41ca21a495412a9460
MD5 ff31d357e5c8fb9989294361ad1c96f0
SHA1 027770e47f22801f00f0297de816ce8008d95d32
SHA512 96c62c10ce31342ee5ce3ebf1df5fbfa73dd91ddbaaf16b9ec52feb09d16555848ccb79b3eca6fd8c96df77f9197937a5d1231deabc4d154a1d6fbe35d4b9c76
MD5 SHA1 SHA512

Remote/searchRowColumn.htm

SHA256 651406cb596e1b44f6fbc0b001329da4da91a1cf1fc374bf0f0a32f4a99ca7fc
MD5 65c3aebd185930ce2162a177542b5315
SHA1 6265a7876b43539d610623aece8504e3658e3743
SHA512 344af473395ec1d477471dea58fad2c2fc0462e132d556d65c8d42971a27b766d5f7998d3401d157036129bf5fbb6aa37ebc3285a0936eae96f6b95ead4dcfa6
MD5 SHA1 SHA512

Remote/searchRowEnd.htm

SHA256 2b16c0205308ae89a5d4053cd4b01e3941ea31c152ce3ded928e2c61c0c75bc9
MD5 ac26a27d2890b00e2a63153ad44e0141
SHA1 a019865d09784db352ce5f54189200aa60aa0c9e
SHA512 82d9b5c375d1c18734c899b9ec17da0d449071318ca95ce355c70f7325abc123a72ab85c89acdd82824f068b5ef4ed3114acf7ad12f6d46dab7d6d0b8ac814da
MD5 SHA1 SHA512

Remote/searchRowStart.htm

SHA256 054517c9fcf1fc9ed4db25cdd012e3f766ad85bbd4546cf0b024aa317d76bbb4
MD5 ed3aa28475f33e5fe8d87fd867687b0e
SHA1 af23e28230058483b71f64d1d5948574fa32b0d6
SHA512 b41e280dbc7c586253b476d98c0a2c2fc360dcd90fa12776d46c53f27f41af1d1b84efedbdf64af0398ef42a4348d5716c25163a7d00c533f42e6f29b7c979c8
MD5 SHA1 SHA512

Remote/searchTab.htm

SHA256 a69198a4dbd8bd0f863e37acc084ae0b27cf6ff9008278e373129ce171c4f777
MD5 b67bacc2ce112ac557212fe70c5fcdce
SHA1 25f8f40831a9cc6ca7feb2e83162074b2836060b
SHA512 0152a8f84551470569a420c89398ef4a8e4c0690757ba51e8dd6891c5d69cb51da170107b1b7e01782b41e9bf63fe17385b12fca2159312754c4e86fdba56b76
MD5 SHA1 SHA512

Remote/searchTop.htm

SHA256 8a38f14832bad584345c1d96ce39ba1512db6665bca315eceb34059c66f8e082
MD5 fe27418b1c3abe24ee4016ca141199f2
SHA1 4b93e91961b2ae748e15d04397e391cc0f6cf7e5
SHA512 8f26b82d78bfba3e4203bedf970fd532d244f837a9ef88e5c7af9e4959576960010d705e7a915992db6551d514719259a4ae9152023d74d5ba8ac962a496e679
MD5 SHA1 SHA512

Remote/uploadsFile.htm

SHA256 85ee02561e0282cfdc754215befa93c3714663dc293d549da62523569850b84d
MD5 c641d1e0a83c5385db6fd3fb424507d0
SHA1 51b4428cdbb9eb009820968b39f8fee5b711056c
SHA512 01169f9c4bfcc6ee0ca5590fbedde153e95f5c5bb25ab0e5964e21cdcb31ff3def7dfdb5f0cb97c0ebadbbe12c9fb4ce64b0705c0353c67f0ff50be6a2d3a753
MD5 SHA1 SHA512

Remote/uploadsFooter.htm

SHA256 6e04f0440b56b147150a52c32fe891963d03e70d82505894f5f602f06a99d487
MD5 253de26d2778a094a3370f4a5268bd7a
SHA1 a08f0fbb1131fb2c8f1a8f813e675181bb5c6eb4
SHA512 1edcbb773c2cbe62f5633b0e7f39d731e2c41f9bbf5b39f2caee0582dd384cb2fcaede811d28515e73dfb092c4c2853e90542b5aedc9a1970e63fbfd55155425
MD5 SHA1 SHA512

Remote/uploadsHeader.htm

SHA256 269625a4480ca276d25d870193aba41fdcc4b4646679a524212136da5b21ebfc
MD5 a5d898fe0e3572d24be296dc19462afc
SHA1 1a070497d49167301483a7c4e30dd5f3cab942eb
SHA512 291b5f212b721e0d6f89636e9d5ca67a825af9065eabfb06a9128943a8b0d4e5d95a66f1577f0c2b3673009ee82a29dc3f1ab97e7baed4413d81c47ade1cf9a7
MD5 SHA1 SHA512

Remote/uploadsQueueEnd.htm

SHA256 3e9329a1c0e1cb8a9bd038e9d70f4430de93a3495d91930a1941944e0c39b28c
MD5 21dbc0432c177e4806471e45f688470b
SHA1 14fa6c48a8d3df7f09f726e1b6824b8acf3289c3
SHA512 9cac1a196a41c6a5fc65dcc2a57f3876d05014170832ed260493509990dab8e6157f264309204e0979100bc4d41de112cdf50c490138f5ceb9db8429de73042f
MD5 SHA1 SHA512

Remote/uploadsQueueStart.htm

SHA256 bf154534479cca4488f9805f73116da9709c82ccd947bc379cac6c0738db107f
MD5 e0b674da922b8b81cbcde388c8b88120
SHA1 b36d0d2df31a51dc4ecb563903e7016f664448e0
SHA512 41ad35646d4ac403cdb5c9dbf7dae05cd5615718be4e9ff1bd23f915fa7cac6448fe71b16fee5afcbe17d6041d0d3d2c4076cb2e8e0b96f9f2a3ef40010a46a0
MD5 SHA1 SHA512

SWFPlugin.dll

IMPHASH c6f6d26b6912f2dae6563de5eb1cbd2b
SHA256 de81b1d1c4a763ff69ab803d5362c809c2e1611d4539dfce8b028a06baa8211f
MD5 f9e4eec0eb2aa3be0bab406ec29a8e2e
SHA1 d5610a81c7283a43afcf42aa19a52790f99e4a09
SHA512 9dadd95c879d989edcd4b19f6a9fd48734479e42965852a61fac2f7f630e53c922446c3e7985c139c4baa1990e8a684a21fc9fd2991ea44c01a663eb2c6b7021
SSDEEP 3072:TmgQhg611Dpwb2SBzcWL42TNrgx+CkEljyvrmm:TmgbC19wb2+zHhJEsN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

40623

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetThreadLocale GetCurrentThreadId GetCurrentProcess FlushInstructionCache GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW GetTickCount Sleep CreateThread WaitForSingleObject CloseHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW GetThreadLocale EnterCriticalSection GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile ExitProcess HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA SetLastError InterlockedDecrement InterlockedIncrement InitializeCriticalSection GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar WideCharToMultiByte GetLastError RaiseException LeaveCriticalSection DeleteCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary FreeEnvironmentStringsW InterlockedCompareExchange FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

UnregisterClassW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint IsChild GetFocus SetFocus GetWindow GetDlgItem SendMessageW UnregisterClassA GetClassNameW GetSysColor SetWindowPos RedrawWindow LoadCursorW GetClassInfoExW RegisterClassExW DefWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW DestroyWindow CreateAcceleratorTableW ClientToScreen GetParent ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect GetClientRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable wvsprintfW CharNextW IsWindow

gdi32

CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject GetObjectW GetDeviceCaps GetDIBits

advapi32

RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW

ole32

CoUninitialize OleDraw OleRun CoInitializeEx OleInitialize OleUninitialize CLSIDFromString CLSIDFromProgID CoGetClassObject CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

oleaut32

UnRegisterTypeLi OleCreateFontIndirect LoadRegTypeLi VariantClear VariantInit SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SysStringLen RegisterTypeLi SysAllocString SysAllocStringLen VarUI4FromStr SysFreeString LoadTypeLi

Schemas/Collection.ico

SHA256 5ed32372ffd6b0188b7f7361252a2f12f3da0f27715afa820fdaa97568934bd8
MD5 a7d0286a46017ff3b992d3a4a0f4b266
SHA1 198d7abdca4d42e1cd5817472f5eecb5de078b9f
SHA512 107d843a0833d1516059b02aad9f2b7e5ad4c66958f146ff5833fc15449e18870b863555ff0cecf3af9fa7d247f9585c81c7bbdd7af3832d41e1acc4499913a3
SSDEEP 96:YnHAfyqAAAdpDPWzOy7bMICb/g2geuscWAIqQTr+fgeuscWAM:YnkAAEwOy7bMICb5hc/xQTqfhc/M
MD5 SHA1 SHA512 SSDEEP

Schemas/CollectionXP.ico

SHA256 cd2863728b75082e3b75cd086f692ae0b2a1bccc1223d59c53b943989eb3f233
MD5 71d5d44667bd23c14478bc4f61769b40
SHA1 b1b3e49a7a6bc5fa233e38d34389759f4922a41d
SHA512 e71e06ef3c2dc98caa4bb29fbab5a4b53edbaf2bddaba8b3d8ff10362a18f2fb61c6048fc5701efb653059172e41312ebc3dfb147e2b5d25971568f891b055d1
SSDEEP 96:jM2lBnlanLEDleVB+syNlRNdOCudLY0N/i0aiLXMf+CigvsfXlh+Rd9/Gdh7Pdd6:jMiBsYes3RXOH1W0c2tthEbAS95de6
MD5 SHA1 SHA512 SSDEEP

Schemas/allFiles.xml

SHA256 6a6dcfdf21ceda8481bf4d8381d968b8403dd3d4e2b91ca80d9a82e6835ae662
MD5 168fbb2c4793b1177a48102cdaff50d6
SHA1 4f2bccd95771463583032f7961b9d4ec797180bc
SHA512 55df44bb508a629b8041cc4ca56c3aa02035d2612c6a5c3fabb02268d52b312837b8a2a5e058ed7841bcbaf8164a317ecd453c101ed552e836a2dc5acf55fc56
SSDEEP 96:cx0g4Z8P5tivNHEvbzZO/2xX4YzIZ33EvibCGJ9DyihZL69ul:+hxUlHEzA8iZbb5TDnZL6K
MD5 SHA1 SHA512 SSDEEP

Schemas/allFiles.xsd

SHA256 7cc87befd8558a785121651fd171fdca72a2b1f23fadbdc42f0b853f019574d0
MD5 2b6de82d6b607c98055acab134caf8d6
SHA1 d5684158e57daa7d147dcaafd8e086d34bb60969
SHA512 7b2691c0a98dc1957a012ff2d9831056ff5e04b4f756249ba1cd0c95e29cb3df9c6ca90b2c61dc606a92aa0579378b89eba8baaed6911a79915f6b53c4bf8794
MD5 SHA1 SHA512

Schemas/allfilesFolder.ico

SHA256 5604cdbd61d63da3b0f5284011df65eb612119b107b182ec4c935cd858a7e23d
MD5 e42d3bc3059fde03ffbfacab49694691
SHA1 95f422102e743825deb1d97b72687fa5cdad027a
SHA512 613f131f53f8f20f1095651ec0f9e4efac6118d6cd662cb01458c0df38e13d4776a697bad55947946866e03447c181aba46bd1a9b2b4aadaf5ff9082fffda32f
SSDEEP 96:PMemUKT0EQ+xqbAEiGv2mey5VBkIFBFkUlo6FxEPyORXFqdaTr7fyo6FxqB:EeKT0H+NlGv2meQkIFBPSRUIzGo
MD5 SHA1 SHA512 SSDEEP

Schemas/allfilesFolderXP.ico

SHA256 ff8f8a4dcbd0d35b42231c13bf232fdd2cedc78cca1dc12672bb479db9d1c685
MD5 6d04a9671ca42110d9807e3e055cd414
SHA1 23d1bcd40c8609116c42dab2d6acee661eaa7304
SHA512 300a417fac26a8b073f0b26a006bb6294f4453d2a252e99f3c1d8626b8f89b89d7bf17a5c6b9dabcd7febcd2471238c655772d31de3ec6110f51cd62d86ed96a
SSDEEP 192:j9YQeu8p1hWV+1iK8SiLFXcqPxDNLQyvXKAAAujkx+ubL4W0ZD:j9leuQ1hR58Sip7D1raAAAuje+ug7F
MD5 SHA1 SHA512 SSDEEP

Schemas/application.ico

SHA256 9cb6e71b2742c4760883e8294d41eb8e670e14760699bdeebc3f58fece4d089d
MD5 8a4a4de1f1477ee6d4b12b3e5acbe636
SHA1 71fdeb67bc7ee00d7b659f7601525d2182fe2a39
SHA512 4b85078243508bc67080b695104d191976a766aa53e254b4e96a6f314435dcd7c1fc25dd2f699260e0bfd36d63c9630576c1a3a9be242141e51d58939e4b97aa
SSDEEP 192:3hFYcPbwZRzQ+mxiJDKADAvWYc6rp0JYch:xFYQ+mYsADAvWy6Z
MD5 SHA1 SHA512 SSDEEP

Schemas/application.xml

SHA256 2e140a98e8a05e5bcdd8e5e917f6224123b3f2a5a0ea8d0bc124594af11c10c0
MD5 ef2e01704d5524684ab4776dcc78fc8f
SHA1 037c579abb2959bfac36f582f3ad1d35b47570be
SHA512 897220b3a506270cfe95a479d9e10793158baccded005dfdec0e1fccf6dd9dcea14462a406f443c9a118f86947184ee1d7cf150a8d998b53c3d18d7ff6c2aaba
SSDEEP 192:+hxUlHEz9KSIJouOaRMD04cGwrghhEkxXSgL5zlFCXTC/KW9C:I0Hh1NyzcjyPKmCT
MD5 SHA1 SHA512 SSDEEP

Schemas/application.xsd

SHA256 4345c3a4359d968f96357c2d7d35f0612443a255e400a09aa98adbf880abbae8
MD5 ca258feb3dcceaa58b71a3cfca0a6a83
SHA1 f90e38498272d55607c541f5838318d657c7995c
SHA512 eb67115989187f75edc4fd0adcea7ea12e757a371d0d3d877f6d31721d1fb7d537b9de44bfbafa9efb269b492dab0f39aa5e4ff601a0cf3e32fd328e08bddb98
MD5 SHA1 SHA512

Schemas/applicationAll.xml

SHA256 8174f39186f9a1fc9c54b9139c720975328dbe13d10bcc7655d4883e86a96c24
MD5 a58852cc2613deef2bb076160252b813
SHA1 a470d916472c303fc8c34eda8bc5538de741e7e5
SHA512 979a625143b2561d4f77cde2478cebe27ee896d55ec3cb94d862bd800cf2493a60eee6fbafcaba91e014a67943c5156d49cbf2c9d75d9a434a58db0c81c03b99
SSDEEP 96:cx0g4Z8P5tivNHEvb+1T66xXA6EQquCyD9HfXyn479/l:+hxUlHEz+zAPruzB/CWd
MD5 SHA1 SHA512 SSDEEP

Schemas/applicationAll.xsd

SHA256 88f21ca992e6fbaecfbf9b95cde81c0dff3ec28cf43752b025c15f1f0a4fcd94
MD5 f776d334c1047092e7cf3e0cd93901bf
SHA1 35aa5711123f3274f82e7d6b52e80bae9689bae7
SHA512 34d91c094fcf8d349fbcf903c659fd31b112cb637649000c0f2b5b75808319d2176a74f74cc21733980b5564099144f86ab16ee6575a51e9439bf91a26daff25
MD5 SHA1 SHA512

Schemas/applicationFolder.ico

SHA256 866c561dcf9b40557289840e829b6872981837b302bbc24f49fc91e9c2550433
MD5 d50805b05f94730aab997ec074ddeddf
SHA1 ba72c1219014476c7be700ce8ea3c7463746a435
SHA512 b5f8c75cdd8e3d6c760669aa09859ef700cdc6f171fdbf2c3aca2ab47e96add73e57bb05f0e2d6bcbeb8cea6cd86588affd5a5d2f39d25472fec3cee1e676d23
SSDEEP 96:/zHeP16GYIupCJmNxKNQE2XRHA9PADAgjMxkuyM2pCJNLN6Urn+uK3fbpCJ68N:/zHA16GYIdOzWPADAgji1VNLgqnRam6q
MD5 SHA1 SHA512 SSDEEP

Schemas/applicationFolderXP.ico

SHA256 b5ff3c76aaa4894f3f46d3cafc339d0fa5e9a62d0958819c09d4a12b9d3f0884
MD5 91d4fa1b75ecba8860f44914b76d3a18
SHA1 a45fcf778b336a5627536c7890e065a3e4f1678f
SHA512 ca105430e2347e20ecfa589094a5c8a0177c14edfd3e48f0ba4efaad67bc1e57fd7c2972ddcf6f2b71c01519c3d5364aa617fb142b9969229dec1c9fa581073a
SSDEEP 384:jscpmtopFzO7OvybJSsYcP5vw+jinHyYRuF:orkzq+KdvtjiHyYRuF
MD5 SHA1 SHA512 SSDEEP

Schemas/applicationRoot.xml

SHA256 2018a8c6945e1d151afbf5c36e9387ddb75312879f02d4665b12cb6bffcf6a64
MD5 e93e5d5538d4d9ce5d90b2103e3ab7d6
SHA1 a9a4e9ec06bbdaa3e7baf122f096ded8cde9c0eb
SHA512 60d4a2b1fa7fbc4f764700ae67dd1497c66cb04dff2c97d4ea60cd41dcb8041109635cde2962727f40fd140049ada1be09084157758b3f93fa0bfb1c85f7e663
SSDEEP 96:cx0g4Z8P5tivNHEvbkSEtOOpxX0UUyiOf3LW2BlIkCpPf40r3c:+hxUlHEzo0UU4LUkce
MD5 SHA1 SHA512 SSDEEP

Schemas/applicationRoot.xsd

SHA256 ecef25fd25cd4d89e7b38d73e93e441dd7d80731788a9e0891be549203aa3892
MD5 788b1c03c6a5772ba66ea16069269bbf
SHA1 184a49ea087ea3322fa77554bb85021efea15640
SHA512 03471264230cbd41aa98790387ab8584cfe91bc0b494d69c63f2f992a908af222db4a04b14457dc40a9c85cccb46d532829b8a7e09d8be20b62b784e1d58ebc7
MD5 SHA1 SHA512

Schemas/applicationXP.ico

SHA256 4df5498fec14ff5405c39338946b5ad615931e16ef569ae00ed1df4a7cb21479
MD5 ecadece917400821260bfa2c15a591a8
SHA1 ede1708b11116dd56c4fed06ff2cb3d42949ed88
SHA512 13ee51632aac490ff2454353751f57a3ac9d1cbafad9012dd3d77dd8560bf8284f31482b90f0aa6496d8201fa13878d7b6a1f12c7e85c6590df85619bd34473f
SSDEEP 192:jvtGpS1to5JGiFIqJ2DEZ+bWdquFh0zLZ00rQc6kaTFz5dmiSSjF46FifgjPp:jvcpmtopFze5WgzLZ0dcSz1jFNK6Pp
MD5 SHA1 SHA512 SSDEEP

Schemas/archive.ico

SHA256 472212ea43497d78c80b4ea2eeb800f0d27912304168a3b9e8ab9ee72e1be980
MD5 19551ebd2d4497c106b3f44315ad6580
SHA1 f7a65fa53f670731717bb25fea645cccd5283671
SHA512 0f09313162a13521edbe9c3f16b62a2993f009b32d34d58d4d5bf2ae67a16fc4ce01ffb22544f9f6d7f59ecf01122449a0cf45f3706501d86810c302df06918e
SSDEEP 48:n0Ij1B6ouY5Lv5Bk4T3aY4yL750yF8cEGovI8lkm+hG50yF8cEGovy:Dj1Uon5TEOJ4038cf4n+Q38cf4y
MD5 SHA1 SHA512 SSDEEP

Schemas/archive.xml

SHA256 51217d041fd1b3005bb951667244bc253d19eef0bf9d7ae3e3005a29aa82660b
MD5 61159a5e5c9acbd602a58a9fb5bb6eaf
SHA1 9514a98d10c3cca1bd0094b1424437d3a44081b9
SHA512 1b43a5db99b10324c70b4f3370bf4090811802e5ba31b92b59066962ca46227878d94e93b57e4fb08249026bbda22a91529ad4980545126d6089e96cc7a5a9f1
SSDEEP 192:rmxdlyxSzTK6UNl6NPpQ2csrgChnCJLvIo35:MLyxB5Gk2csTet35
MD5 SHA1 SHA512 SSDEEP

Schemas/archive.xsd

SHA256 25f04a58410acf7f3a98765b45247de9d020a63834f42611f108f59666c16983
MD5 3967192ff04c20d8f9fa9fd93192b838
SHA1 b9e593bf0557c0b9a733df88de640e48aa41b5cc
SHA512 88193b75010f902961add97ba1e12af1974f42de96ce60cc78d58756809e8fa2b24e9f51f14a254272f8fa5148d26da699f4f7a38b493487d32215df82becdfd
MD5 SHA1 SHA512

Schemas/archiveXP.ico

SHA256 748b30d456ede3c5cf1b217683382de45977102b1f44862d42b18af6474e621a
MD5 ca546cc3283a09b606cffd2042e441ab
SHA1 212b20baf4a614fbc1d4a2b848d626addab3f5cc
SHA512 44fe8bd5526fa7dde617369151f2b922a7c302f50918be474dcfe528451d02744f3b766d2dc9d896b3f8e8d5230d98978ecd7a5537fe5f057da6ebb2610c835e
SSDEEP 96:jSloikdgW1QjyuysVBZhBnKK/MTlmrflzhe1N:jSlnegW+jPVfHfslAuN
MD5 SHA1 SHA512 SSDEEP

Schemas/audio.ico

SHA256 a23adf02f41647af8ed142265fd784e4dedfb57a89df9d805c67a06ba2a19ba2
MD5 f0a9ef3ebf5d57e3cc55b2f7cd26d5db
SHA1 b31d9e26c1e4d9594cb4829a3844e7331b79052c
SHA512 6a623bd39d2d5f8b983d168c05d93f43662840f621fa966a62de589d35428ca8897a7f8335b4f232b06fdf2e434f62cd342e2b674f9f2e432f8975297ae3ff3b
SSDEEP 96:SMG/VcRYghFJzAzpZ50a4CcoraeRYwctQz2cJyxTiNsoUyWEraeRYxpDT0:SBOYghFyzpZ+aNco7YwK8v7YxpDT0
MD5 SHA1 SHA512 SSDEEP

Schemas/audio.xml

SHA256 1ba4c00f6edf443c785be6d242ff98912efd7677ecc48a62993bce5dc3dc83e0
MD5 bd9bb2afc35bdc7b3d0c3d0d593bef54
SHA1 c1e73dfd1ad9b45a6ca0429e3c11e24d70990a5a
SHA512 26b6088c7548c7fb80ab3a97efcb5aeb1996b06278a0cc4014f2d9b8cbfb4ef5f45c6ebffb67bf8ba146fefe727b0d44e83c836f8123efd4b8170f9f1f6a530f
SSDEEP 384:I0HegabtkVYL9cOC7eI1ixTDT7xo7QHacjyuYnz7tIm:EtbgG9cVCI8t7xLHT2u4Im
MD5 SHA1 SHA512 SSDEEP

Schemas/audio.xsd

SHA256 1a189a50213138b1260d5f7c3eeb6f31523fcb2b9929a7f6f0482ee6abf14881
MD5 dea1e232721e380a8a2da4a4cd5c9de1
SHA1 0906173f9aa9f7bd83da6e26c8a2d88bf3a962b7
SHA512 9d42d27d6f5760b07b4b180f300046228fafb63591ffcb91827ec08a908567bf171c03c67b42d18c0be62d0db74ddfa10607594a0cd6b75e673e0ca62b3f91bb
SSDEEP 96:uQYoiZmTElUq/uFiX/KN6NqoMcceSXg6ckS1B8KrKXiK58CejrIO:5YCTElUq/uUX/K8MfeSXg67Ar2IjEO
MD5 SHA1 SHA512 SSDEEP

Schemas/audioXP.ico

SHA256 4dda40236a81aee203d4c5452f9295dc13b6170166a905e789573ad7f721475e
MD5 6c1a55cb0525d6c6791dce33a0baaa35
SHA1 7973a9dae6ab347f9b59fdc804848785cf6cf2dd
SHA512 a4740b57093ad2558004218e1a85cf9317c2fbf2157e2a504dce324da29fc155596bfb44183885a7f71e12c8ec8d202bffbeb8a19be57e508e33d415e82e00f4
SSDEEP 192:jTbM6uFk8JeXab9138qHJooo2dc8AwSb6XQgBc4Qm:jTbM6uFdJaw913PJooo2dfAgBFL
MD5 SHA1 SHA512 SSDEEP

Schemas/bittorrent.ico

SHA256 42dc7d29334940c7511216b0a6511df850fc863905559d3d9d0497894cc2d5c2
MD5 ac7bdc5abe82e26faee8bf77fc0337bb
SHA1 f481cd139e0b4e506ebdba2cfef8935c1cf9bcc0
SHA512 8986f45020ae7c355cf4c3a34446ffd378e19e4b4d4e7ee0c4f3c950fce6b97378cad259ac5f4ea56e0b3ef167853036d84d97a0093d680872648622ad027ec6
SSDEEP 48:jYQIrraHJeh5EHuk6zdqfoBgwTHClvR9bZzM7huRkTbVuHSRl5G98E6:jZM/E8z4FjbZIMAuHSc6E6
MD5 SHA1 SHA512 SSDEEP

Schemas/bittorrent.xml

SHA256 0762150ee35f48010065bad71b73323d7c9508b4976bc94a1b8ffd3a4c73c6a4
MD5 057ee0e1424bb40d9e0365a73900069e
SHA1 b3b101eff8f7dba2a5c828531b7e4522c3cfc52d
SHA512 e0bdcebf16aa6b20f4d434cfed91ffe37f7e1403f8bec32d5f40e35a9ad491c5852e4abc9ba63241320d0bd512295c3f04d3e7589f20a914115670bc6147f46c
SSDEEP 96:cx0g4Z8P5tivNHEvbR3Xd938pKPtufAmMcPnBCd:+hxUlHEzR3spFDMcpi
MD5 SHA1 SHA512 SSDEEP

Schemas/bittorrent.xsd

SHA256 3d79eeaaab1339e19db11549926d2d8a460a4e5c86e631aebf5dde0d4867ebf4
MD5 01b47cb93c243342c9e84650e16660ff
SHA1 43e13dcaaef6839009b26a8b89feb2a4d6cdf30c
SHA512 2adf185d93a525e823160845c6b6737aa7c4b61aae976cba8a079ed49b4f681ba39274e292750c9b50b3c66c0ad5e9762d96c92b0f3c6eaa0e30c6a72ef5d02b
MD5 SHA1 SHA512

Schemas/bittorrentXP.ico

SHA256 dbe6869a0d12e508a494ddd29c20fad7e546e564a35d001bf26bf101d2802787
MD5 5125b7bcf16e413acdf185c91c084c00
SHA1 334e597d1c6037d1f37bae59106d1cf8ee86020c
SHA512 cddb2ee74d5a80a0ff0e0f93d5290d4243549cfe0841febd1a58812d986efc441b4fdb85ac176a6c6966a8c150529bbbdecdbd943b96d7942b641d68014266f5
SSDEEP 192:j98CCQ5555ABeoRLLSgEsAz7eFP4qgvxWhUcRUrbuR4Q:j9JCQ5555NoRLLQkgvxWO5u3
MD5 SHA1 SHA512 SSDEEP

Schemas/book.ICO

SHA256 71d7f7581a98b4d6fcc60cfe96e2e4334330fabbdd19eaa898872d00caf864c1
MD5 2dd7fc2b2e86b79c62fea722a3336338
SHA1 9e4a09f8a94bf400f0e121161b0123629cc11a62
SHA512 d28869270f8cfd4f390de4c27bd49e8461afb8f7321b8a1134616c62e04b5b55fa1367febc6af76aac653c89ea7f052e915c665efdd50ba096d72dc4f77dba8d
SSDEEP 96:ohPT4ioY0Yc+vAFViS7oVEioY0YcTlK+poGWaEioY0YcmD4:0PTB50YG+j50Y0DlZ50Y5D4
MD5 SHA1 SHA512 SSDEEP

Schemas/book.xml

SHA256 c8749121eccc38fcff9cd45986f4f1236f235b70e7c1a3823e95e9db9e773f31
MD5 93b2c7f2c663d5b8f4566abd7d4f4ec8
SHA1 b9db59589a2e6a45b87b0cc4b47c69dae3198157
SHA512 c980edbc38e22683eb16e90b99ec4e59e864a3ab805d1b38e773cf6a97aa41ca418114b428a7763d4d862af958e040ccf9c5cf5645caf6147c08847865d0de4f
SSDEEP 192:+hxUlHEzSYDK/GiJCcAU9s7oUcGwrghh1+sqb9xiQskxXSgLHzlFCXTC/KWMo:I0H0m+ICi9slcjy8b9xbYmCW
MD5 SHA1 SHA512 SSDEEP

Schemas/book.xsd

SHA256 51f2d6e8a3fac0d3059c8c50c7e4396feb8fb2145c50f280f9738912ac6da3fd
MD5 63be1aed70fd0fc14ac6c8496c7c6767
SHA1 6c5c5f52936e8311c3dc900528bd4c43dcdc5c77
SHA512 b8a630b47f6fd95c3f75e9630fdb737cd7365b4112e2362b449ba877faaf64fb51517605aa35cfe1c5bb49a3140171f3ee4a99ad8c35cc8a3472ef58fda0ed72
SSDEEP 48:c4YxD2yDyyyOo4823+kVCmoBDLlfzTb0dX8xRz3GaLbVzyjRJZbDWlJBl:BG2Wxo45SmKPlZRz7ySJT
MD5 SHA1 SHA512 SSDEEP

Schemas/bookAll.xml

SHA256 c5a3c0414c8c8efc369ca86d1f74e37c44a4dae4d1a20845265fb3c1360349db
MD5 f06c358579c62ffc7e63c16cd814383e
SHA1 c05e11fcbbeb197f99a2f138fb169edf2f4c5d9c
SHA512 c56d55b0f2846a2f138308fe10f08d045261abcd8c354abc3bdf45ac8928d150f8970d66f27aa5a5725a6d3e9d67b68c4f7c74f4f50df51c43a90845fdd15c94
SSDEEP 96:cx0g4Z8P5tivNHEvbretNm+xXyPLmOUXg4nCiwnZFuibddrgnEl:+hxUlHEzrcmkqLsXJnzwnukrgnE
MD5 SHA1 SHA512 SSDEEP

Schemas/bookAll.xsd

SHA256 3ae33f6ddb8a7d541f94efbc9c7f7c866c29f8a36d860b801a7674d32c575b2d
MD5 610faec15684f1f3db550bc91aa68d30
SHA1 231378e8448c8fead9aae9f8890ca6b47af08547
SHA512 895f9045ef2ae7f723bf4828cd8f8e26de0e1dba4435e1395eebf17c30a5dd0d00e032eb81603b339613c3c73efa80a739d76594d6a7a5f8ee0974608946bae0
MD5 SHA1 SHA512

Schemas/bookFolder.ico

SHA256 bcba5cb8d822300aeaf8b7e1bbb48a9ba3ef5c35e589b68b47b8e1f1a050d4f2
MD5 4c7eafa6c7ee31235b351b8363308ed2
SHA1 ce56e16d7fe78e5d072e1c8a11abec91a1c5fb41
SHA512 eb1fba9abf12b159c0dd8ec6842d16a39bb55284a570802bb4b5ef08e935b10f270968741b3d689158b9ab0e05d8073eca808b65e7e2ca28f8d8de5f99325143
SSDEEP 96:j85zr19PrXYz+oDGk1EcpOeaXI5yoNU9VX2v00SYzJjgAxE6X2v00SYzvHi:azr19P4+oDz1rpraRmcgJj96VcgvHi
MD5 SHA1 SHA512 SSDEEP

Schemas/bookFolderXP.ico

SHA256 669bf871b8b18ae46135ad4a478412d48b5d6d85e0cc3f183e54040ed6b4742c
MD5 eeeca8d39ef47ab6976b5a7f8205ac4c
SHA1 b866454b13354b9f1333ab7c097077cfdaeb5a42
SHA512 cdc1fdd8e70f4d3863210c251df1808978636ce2008963a9e205e789b31ed3ea6d87ff7d97df6308fa7c870a7deebe98f4c6800cdff45f630f64ae44784c1c3b
SSDEEP 192:j8fjc724pcljAoYmzeFmY8FTIQk8xAuEc5BgDT3wq5SKuU:j8fjcjWXYmS2F8EmuEc5WfNfp
MD5 SHA1 SHA512 SSDEEP

Schemas/bookRoot.xml

SHA256 8b906efcaf67dc8309f3c337e817be6f2c9f3f6c9bb8f93a5d7165044d0f464e
MD5 e94fa55dc29f1c433cba68d8bb5a3fe5
SHA1 9471f006fd31ba14b15e2becf58de96a2ae42b74
SHA512 9e1f28e4efef298bc5d55693d07ec42d164e18c8f6978c76264d2754834ff8ac1b114f59777f9d38aa4807bb1e16fec80c3147c6307aabe69466004d5cafdd75
SSDEEP 96:cx0g4Z8P5tivNHEvb3JIb3eZuExXgjy9fT2AHU/Csevfa3ofGc:+hxUlHEzAcumOs2f/P68ofb
MD5 SHA1 SHA512 SSDEEP

Schemas/bookRoot.xsd

SHA256 f38af0eefc3fdc9b3b8427d43f56c41ce080da6ed3416e38407a7bb70b45cb61
MD5 19e69619e5e19ebebae0b2e0e8e92200
SHA1 282b7088c9cf72ad9a1902e350ed4ac36ac6a065
SHA512 624d0fa70a7f73c72cc183eb7b69bb70c845da7fa718ce77eebe8b4c8f7508535ccf5dea0b16395442c15dd9c69b363faaa5b0cc4bcd853aa8675506cf7541e9
MD5 SHA1 SHA512

Schemas/bookXP.ico

SHA256 e46a2a3c2ef4c51e2a6423cf2c2b8b00a6f429a9a2101f50543d704cd69168d6
MD5 eccaaa00b59bb60f1bfeb6b9f0c594ac
SHA1 f7f81d04d161e371c1a09fbb8e9493815771654e
SHA512 c46ee082883d66bd41047120a82455a3510925da3ebef522b53f3f5dcac4357cb7c3f0a9bc22c9d8be55b398ba3616ae59cab38d80d609a871cdd53bc687018d
SSDEEP 192:jgP0GPWcA/FmzZFmJChupHNCxAtDc5BgDWnbLul:jgPboFmj1h64mtDc5WGbLo
MD5 SHA1 SHA512 SSDEEP

Schemas/collection.xml

SHA256 a6933a777974cffaf9216bc0d641d2b4b5362729b4dd7d8f6dee9328113221b1
MD5 a4561602c6fe74196b79f2c3a05d803d
SHA1 d5dfe41a28101636ac752ee75136c8fd0115eca1
SHA512 9622228ddb92898a5ff98cd4dbbdc9652365fb08b4606b09e487bbb7703209cd9ea9ddfc5f2634ca9ff355f68e1e2a58eeebe682dc7bd7dc685966401c679667
SSDEEP 192:+hxUlHEzZ+O5KSIJouOaRMD0Cq6cGwrghhEkxXSgL5zlFCXTC/KWVY:I0Hrl1Ny06cjyPKmCQY
MD5 SHA1 SHA512 SSDEEP

Schemas/collection.xsd

SHA256 220a941b007e392cf9b2caa3ae729a889eb3b2f870be1df0d77f2b03b7411fb0
MD5 07bd74ef781f756f721099258894ffd5
SHA1 d408ba84dc38ab222ebb3eea786f68d0dabc558b
SHA512 fd09e03a39dd1772a1639558a697ca99ec32ed4d8e0a5718a59ae97c398aca3a754d70042ad2177c0efd2935cdf5cdb0db1a7d35bb780994601b10a1fceb8ba8
MD5 SHA1 SHA512

Schemas/collectionsFolder.ico

SHA256 8641811fec9c7dafeb9a89ef693b15c70037ba719eaae54e7e0c89fa9ca7a496
MD5 81fc03f305443ce4de3bae266c9ddee0
SHA1 fad7fa68aafecf4ee6324f9d096cdeb23ef191f5
SHA512 9f2f5dd0216f6be59edd74a22c9221755cd3634aa3492ee05434f812f0a427046f34ddada17c33887cbc7c7df7e4fed82f4656bf64bd930e3ec40281390ce05c
SSDEEP 96:t0MT0Ixm6c8V0H000C000500X0M0000hm000/w00e0000uv20N0Ya00m000+c0sk:bT0Ixm6JE9253ySenllQFKADhvk1
MD5 SHA1 SHA512 SSDEEP

Schemas/collectionsFolder.xml

SHA256 89e8ca0d6cc16e9ac73a9726f2264a67151c9f66c9dd1cf9806a3c5a2cefa694
MD5 4e220c2cae374c476731a19cf31c979e
SHA1 4213eda5dca5c15b200544106e030704fa3eeed3
SHA512 65825faf8d9ec93c5fc41233b6a3903b8447949829a81c00bfcd953973a8e6093e8b7c1b616b1166d18e6c794074115f5cb88d7e04a08e2b3a2f7c24f6aec93e
SSDEEP 96:cx0g4Z8P5tivNHEvbZilL0myBvMPxXVYBUzwEhm+xHCLj9ztCx6jRSuh69Jc:+hxUlHEz5VRGy+zw4meHMhBCxgRS06G
MD5 SHA1 SHA512 SSDEEP

Schemas/collectionsFolder.xsd

SHA256 6be40828c852f6a3c427e37f9cf215fb912bf98ba8ed0cbb8a2b2490abbded72
MD5 97977893b974c6f8ec8e8fcaaa758166
SHA1 371ab79cdda216144f864196990f47393902211f
SHA512 d3db0a75d85e3a4c1828b27557afcecb206fdb88b8504773612f7f154ece5bf5c8c7c5a7bf864b73cbbfce3d597e96bb0e57d661616955958f00190b3e5de6d3
MD5 SHA1 SHA512

Schemas/collectionsFolderXP.ico

SHA256 0bc3c8845713c20005fea0993a2a9e7e77bc0e0b8a7be06d22c32d6d0c1fe1e7
MD5 f6272d9c06a6144eb3e5d447b42f994b
SHA1 2baaa1246c95f83d930b7f65b79ce77463b83dfe
SHA512 51b5245ba6ef5bf809f8d8c1d09b039bba272bb36c73457c7c9b1c8be85ee7b58d0cde2ae8cf878ded673fd4dddd76bb8aee1e566f512b01676a6b76df4497e5
SSDEEP 192:jMLBsB/Y3Zi1H+3Gm6RVvjIytJfoOgd7TgMxdbeWY:jTFv/FRCyAOgxTgMxdaWY
MD5 SHA1 SHA512 SSDEEP

Schemas/documentAll.xml

SHA256 2d190db42b47f543dc3c79648707f8026f410718ec4bec88daab95e61e55ca07
MD5 878fc3794f9cc0c98c6e6e2a0dae13c7
SHA1 ea8d05397b260d7ca1036a9cd72088d94c334836
SHA512 e377b0ff164e905f8291dc7bee2e3154c27912a08558c6ca5b5f96698b2b76f37d857a9c27553022bb842878a7facce7ef496d377aaf49063889e05806374534
SSDEEP 192:+hxUlHEzmyC2an5vNvMVuC8PXb5wD7jBzsuxO8Qab9K:I0Hoksu2dzR2
MD5 SHA1 SHA512 SSDEEP

Schemas/documentAll.xsd

SHA256 45248b60a61f7910afd91d3cfcee3b0d18fe412d46d40a5dfb390d33e066610a
MD5 d650de1605df9fa8adf25796ce6d3f3c
SHA1 41170fb3089d3db47070f8d922d0ce2e6acefbf0
SHA512 776d5db1d1a48daee9dafce0d5379b3dd7ac6a18ccdaa78c1992260c59a63dddfb1152dcc16a05c2a88d18dac14ae72a63c2ed8d470f5a1b01ab49cc6d89509c
MD5 SHA1 SHA512

Schemas/documentFolder.ico

SHA256 1f2ce638b4cccc1155480e1ec928080773c6698ef15dc032f210ab77577e984b
MD5 0b9763e9bca57fa7537fb5b1a4519ddb
SHA1 a5cd61bbbddb72dd8a904b4ef577d16b6c738b17
SHA512 8182f903932d7c289173f45c0c01cbb9bcf5b1176a6b1abf6ecc589bf7cec77dc2a4fc176522396bba976312ceffba7c04598aa6eca945429ca07ee38ae07e34
SSDEEP 96:D5ze2fRRRxy4WgTvlzI0R7M/b7gjmRx2KPPE/GWjmRxAOo:D5zeURRRY1+900ROPg6RhPE/GW6ReD
MD5 SHA1 SHA512 SSDEEP

Schemas/documentFolderXP.ico

SHA256 d11bab02582894c100a49eac5f6b7012681c322470b394ee0d5fea87adc3b4a2
MD5 c9bdd24821937cf115983943d3ba5851
SHA1 d816521ae032a47bb68eaaafd7dc2d6adf03f35b
SHA512 02b399bdce1a94175c3ea3d12cf8e863557ab239791bdaf2916aaaa55ec41862c0030a4423ff4fb664dd13b11ca5a795bb7bbff4dc00bea8f28bb1d18594593f
SSDEEP 192:j262s8QU7kLaEtPzICK0q9dY0833o3laozjPnEw4SNy7Lp:jg9kLat0q9smaoHETGyHp
MD5 SHA1 SHA512 SSDEEP

Schemas/documentRoot.xml

SHA256 6b62e45a868e03fcd75974f02c78f2daae0ee6d90fc35bc8257cf3152b7a6fd4
MD5 ca152470a8247f0393d01d9abe926810
SHA1 06278a3a0e0274c88dfbb13457f573a12c3d94f4
SHA512 dbccd3f4d23fa3afab6666bfc5de1b20687fab82f9d1e0e4bbe5712cda71303e910f2e974736517add5e7f8e7eb4a2253600cd9b610453c2d0d45f63b3f719e8
SSDEEP 96:cx0g4Z8P5tivNHEvbPUJGWJyiFzfcsxXPswXrfuuFXiI5yxtwHChVfbriCxc:+hxUlHEzGGjiFfr0wqEXYI8hf6
MD5 SHA1 SHA512 SSDEEP

Schemas/documentRoot.xsd

SHA256 1e359c49b76933a591cd08be4efcfbefe01bae3058a11178cb2cbb27f5bc57fa
MD5 00dca69d67ad138699ae03684edf47f9
SHA1 5c2d08799be5f4a5387fd1d3401955ca800b5716
SHA512 e6fc1a59aa193ad9d3e3e3b764cfa187b71c6853562cb4d1886d21efa3d31820bbac597e74a73228d2d2b0081aa7235438858e97ed7afb0eb07577050dcee7c5
MD5 SHA1 SHA512

Schemas/favourites.ico

SHA256 e587924362a6d52134598003f4c3acb5f5b1380ea020db6ec49206bbc66a0bdd
MD5 5203f6f50d59b8408bd84d660ced2716
SHA1 bbd18ccf632582936ed6c7cb35fca8d1451b6d26
SHA512 77b1ae48096c8a7188ce6fd000fddf63c8527a6b6724830ed788a3165fc984ea49a0698ffe192f99822b579fb7331d3ceb63c1ecdf5ea66ba9aa45473993a513
SSDEEP 96:FWb5HVas5hmKUzz12QiCBQ6emOjU/xllVptymCkXvwrGXvlytymCkX/6:E17VUz8QN4Gzkm+rY9ykmI
MD5 SHA1 SHA512 SSDEEP

Schemas/favouritesFolder.xml

SHA256 3e62b83922cda8981938d6f546f7c5819cba13ae88f7d4cdf284e64538cb1012
MD5 d307208b50fed6cf9e5f6f573ed9586a
SHA1 4d8cff4006f0e2e3c2c2f0de96509ef9bbcae174
SHA512 065319ee04e0406ae89dcdf0f447b42d7265aad5d327a472b4db8b7b96157e5d2cdab791029c571582d0273eb26ddbcca1d5cfea41f927f66b25229450a03493
SSDEEP 96:cx0g4Z8P5tivNHEvbpvWygfKqixXeJJhqNQY0KsvEZ9QEQ6hxCVVoqTj0bp3U/DT:+hxUlHEzpYoBQYgUFPmj0bp3k1Z
MD5 SHA1 SHA512 SSDEEP

Schemas/favouritesFolder.xsd

SHA256 b12678672bbefe4327076b665683aea32621a86c121f18640d7d8f2e85fe682e
MD5 d58450c410ab9fae0d0fe5b9a276c53b
SHA1 56332c412f736f00d706c95b755c89e8797faed9
SHA512 0fed073865fcc02c1ffd76f6b8a4fdd9ae3b6685ca222ed5aacd848c148cd1c5826563e25f7161208b9837e524672e5031be0b9b5d7f8a48667f8f029d9baebd
MD5 SHA1 SHA512

Schemas/favouritesXP.ico

SHA256 38d09dacdc0729badbba6bb22fd962e7f2fe75110c6a526df7eed6e8dd6cc2a4
MD5 4ae6b5d4786956f6fd131dff263995f3
SHA1 b5a9b226c105d0ccbe1a94c386eedd4ae0a203d5
SHA512 4d4061005c03dee7a9a9d2f367e88e0bdec52bfd1eda2fac3bfb0a7ce1ef1bb765b45eaf4e90ae7c9b1f1ebaa1ab272860b8fca7e98824bee9718add6f700dfe
SSDEEP 192:j3TDyALA3h77mrQaaS+TccWa/Jt3Pz65vF0q9dY0833o342oYzemGP0Nw4Sgd6mr:j3w3hvkaS+TnWaBiF0q9sWoQNTvfr
MD5 SHA1 SHA512 SSDEEP

Schemas/folder.ico

SHA256 78c9eb90300c46d99f5f727b3723f824686752e6119cdbd766a40a1a4708be0c
MD5 8dafec42d583404b3a3c58264caa850b
SHA1 419209958f9b97bd749c27a1c0f52f5b9b81b469
SHA512 3752d71bd1edbf29bd4700f218badcab98d57e0d11dad18eff90137d9f8af957e1b6f3fc8120491cc998ade32b54e43f74f5d5bacbe09b73fd36f906770d2793
SSDEEP 96:czr19aS4bcxslKVmCD4eL3QIM9cf79Bq0Icxqc7mBrA2Bq0IcxF1q:czr19aSacQamLeL09cDwcI6meawcNq
MD5 SHA1 SHA512 SSDEEP

Schemas/folder.xml

SHA256 ee7dfcd780e7487bc27ecab97af2940dced109ecaafa08040a8525288246f349
MD5 d206b2290e0553ad8cce3ab7b10ed67e
SHA1 ad885432a0c8eb6156ec74319599bd82381c1e3c
SHA512 b62a4b5e0186aeeb0be110da6b4f5b5447285d153bb704057bea8478a4c47c1596fb4791c62f897d1a3d1e9bcf88441031ed421be61ec0d34e212b50f2a4d6d3
SSDEEP 96:cx03Z8P5tivNHEvb3wfF/3exXR7uGQSgPnBCuc:kxUlHEz3S/0J+pA
MD5 SHA1 SHA512 SSDEEP

Schemas/folder.xsd

SHA256 4b2c6c69cea6180948aa175c7fdf09be9f6feec4a246956242f08855d06f464f
MD5 a32c29cfeb077b8c1e2c40ea4a1a1dea
SHA1 2fa887745e8e0efe530755c0ed2db6fd785edc3c
SHA512 22e9917dd90f447a641070eb3434116cdd8216ae2bbfdaf580d916d90484e73d05dea75e78f13f8d475c9d983b1d16b3a7bdd04b96d04721357d8c5e0c0f1d2a
MD5 SHA1 SHA512

Schemas/folderXP.ico

SHA256 d9d78f2191c8be3183b0fe2d0860a956ef83f45178ef221b8d15ccc1b50a89fe
MD5 67530250b82368c2567b8067b102fc6e
SHA1 5c169b371c882085f072718f45a09a46ba686ffe
SHA512 a35188c906f9be03bb75d692364cbe3f878deae7df94ddf1c31a841a81e10d3dcc7fd222cb11ee91c1742c8604f883db675bd062d5837bd409d0c80fb63705ae
SSDEEP 192:jTjBsG71g7ssja7ja6jUVOKbd28ngwHqLNLJCLjzFkCOCvP:jyG7gssjay7dJxHq5Jqj2COqP
MD5 SHA1 SHA512 SSDEEP

Schemas/ghostFolder.ico

SHA256 7809995e45796d5f1d65fcaa6e7c4134f3b63eb02e079bbbd5e5109a12e3d153
MD5 3faef4f9173700bfd6a95aab61d18614
SHA1 127cba2ce8bd0f1288127b411140413ce42cf834
SHA512 45f5bbde84411a5f691ced764b629fa8b5c7e44fbced887aa54f1e05d3ffe97ea3aabd7bb5aab8bc0aba0a334014b6a659df978da100c23738da7a56e45cc2e7
SSDEEP 96:vAZXKKJxUnyOq/4eFsbTEb7f0KtDKbZ2hQOSRniGimPTtDKbZ2hQO9:vOKIxMPEgTEb7fzKAhhOXhKAhh9
MD5 SHA1 SHA512 SSDEEP

Schemas/ghostFolder.xml

SHA256 74ec49711cfdeed2e9afc64c60a7d9d9d4e4141881fda5b0d6e50d8c3d5352b9
MD5 ce224b574edfe48d87d2ea1484d1ef4d
SHA1 18634a11a1cbcb3a5ea577b19e07c14f8edfee0d
SHA512 631fc231c79d043329c54c03c071108999c09b53aa60a597915a4ea8c06fbede4777fde115a07cdfeb4127008188d877e28bc49930825f7282dcbd342c3e5edd
SSDEEP 96:cx0g4Z8P5tivNHEvbvQzOG6xXIzzcoF9rQQw70l2GbCxPgfDXkO7ikV:+hxUlHEzvQdAI0oXjJl2EmPkkO+8
MD5 SHA1 SHA512 SSDEEP

Schemas/ghostFolder.xsd

SHA256 07c9f42f09b9cdaa7a2268d82f07800b0bdb0a55a7aeb96a1b51477f9fbd03ba
MD5 eab0b13476eb55548940c4b599f1aae3
SHA1 943031af38a3dcfbd267f408fb1c5efbfc6ec4b7
SHA512 a314e04650cdb12890f485e128e5b4e989f0adf52faad658f0e67b627f9212ceb9060f5d1acb6c986c0e23008b8535ba61f593f2126eda8d238b5ece36f34da4
MD5 SHA1 SHA512

Schemas/ghostFolderXP.ico

SHA256 f3297f80e7d1dc2a4088054086e22604713b21518d71b9452825195ebf3a427e
MD5 6f916c0adcef10244d7a382ddd8c65c9
SHA1 fc779c6f99db73283f4d0ac2d87862321bd101f1
SHA512 d610feaef96b4b0706553d0908101f9bbf5e6cd95ddc880ace5eaeab808dcf07c9f4889f0e8187351d0ffcb74684a1cc5b7ffb7b35834ba6d63ed5570a617ada
SSDEEP 192:jt17nl+r0BHIHFafQPz72l0q9dY0833o3zjtpwJGPj1w4Ss9aCWI+/:jTbJHIHFafv0q9s+r1TfYhT/
MD5 SHA1 SHA512 SSDEEP

Schemas/image.ico

SHA256 6b338a8def0357c080f8d7b8c2135a6f594da44f06186b9bdc7dcd0e4fb3e645
MD5 d7384c138951a21ab56949e5a6103792
SHA1 9565922303d043e28057a8f06aac12c1cdef53d1
SHA512 3a28e1ea017f3207c056ad3f1955f89804ac6d899a8d6b8a5615fcc8f9d5128871c995def600cdfd85cd91fb15d77b8ee9e505a07d75768b6b6f3b634755a319
SSDEEP 192:W/ifuY6RiaW3j1mVFsUOhTw7bgLvNNM1n:W/ifuTiaWT0VFsUOJw3T
MD5 SHA1 SHA512 SSDEEP

Schemas/image.xml

SHA256 ae60f87605bdf5dca18520b45b92f06c66bf650cf499851e85bfb3e7e0a04861
MD5 14c1d29289027cc7e68c2a16989cd0b7
SHA1 d47fec1d4cb974bda834bcc930ef9a589a663f1c
SHA512 f2995dddc8bbbdcc6088875f03c3263b73a5a3abf3d0e0a22a4a68c8b262e227173d83d879bb957fa45a584a50e197d7ae2b368526998a1dc7782f74896d1be5
SSDEEP 192:+hxUlHEz/h/guhOxRr43ExXSgLHzlFCXTC/CUcGwrghhPW0txpz:I0HS4YOxRMUYm3cjyPZ
MD5 SHA1 SHA512 SSDEEP

Schemas/image.xsd

SHA256 7a323e79f5462f941831e1e0bc0e0e5d2f4c35e6a5a9b665dafc84292ce5e311
MD5 2e93fe2a3e1378462321ca4882b01f47
SHA1 6c74035e7bf5467cf33f9cacc741e42527a85ee5
SHA512 02e5fc6f8c054ed2cd877f619720edae7d16325838990a97140e9af3d5c850e45a3f4af9c07981aed6df360927235fb6b920f8207deef0bdb1cb4d5ef9052080
MD5 SHA1 SHA512

Schemas/imageAlbum.xml

SHA256 9433c6aa7848f334e7a1f889c331fec07b9e343e4a55414dc819f7ec873cd328
MD5 1743ca64f7402644cb084f7b4a3f8f62
SHA1 4354333355bd0da668cc74b5b70b421e65000cf0
SHA512 d92a06d033b08d6aa1a5d0484f28b2af63c4cfb0621ae147a3c7afbc93800e0dab2166ead34a16f7deb34f7edb9bde74acba166c095fa1be5e91afba96d6b7df
SSDEEP 192:+hxUlHEzl8QKEr4hDYNpSkLZzlFCXTC/CUcGwrghhn:I0HRfEMh8Cm3cjyn
MD5 SHA1 SHA512 SSDEEP

Schemas/imageAlbum.xsd

SHA256 9ad944e78c83f93d8adfa462f7ee254a557f4a806e958019ea599da49bb4d2a8
MD5 9a8bc34d9692602c1e9346a3b72b9de5
SHA1 f51b5858e9818e376fd60c51afb8207f81d6a3c9
SHA512 5536d19c4d61d0093d44d01bce074de7b42156603b19548a608c890bbf2b898b18e38a754f97f01de7874b67e75360cb9539809c45b7c691b09e566e10069685
MD5 SHA1 SHA512

Schemas/imageAll.xml

SHA256 86a12705fdfb861d74c1b849e79ab542b2b4685d5a78062f1424de145db945f9
MD5 44e45fa8c842fbb61c4bd342a6ec78ce
SHA1 95172f0deec3f7752ceed1ae93ab1144f719bd15
SHA512 dd129ecc96e482e5a81bf26b7a8d3cfc78817f2197c5a7c454cad8f6e5a6c2fa2ba2a81897557fffe2dfadc61a4e97516777366cfe713d7a8fcc9675acd6b93f
SSDEEP 96:cx0g4Z8P5tivNHEvbQ9+SlK8WVxX/WASky914NCBMa97X1z28LQS98s:+hxUlHEzO+SqI/9SNpal3bH
MD5 SHA1 SHA512 SSDEEP

Schemas/imageAll.xsd

SHA256 214cfa2f083c1219aa0d22806e65cc72967d43fda41e4e1845d6e44d2c8efee7
MD5 ef6088e378110f06dc26a273b29b9f39
SHA1 a6bbee2f09cdcc8dab797434f4fc52fff96c1fa0
SHA512 099653276e436f907b885bd541ed363bfdbe02a813141bf81bf74a7287e0dbd15a498865eed6175c75ae92699290f7662908974c37ac926430d00af273bdf007
MD5 SHA1 SHA512

Schemas/imageFolder.ico

SHA256 1970d2fd4bdff4db298070f63021db62771e06c1e1d0ffe2fe7a4a35e808c14a
MD5 485eda7316bad3740bf663c2042a4a36
SHA1 6ffb143cafe3b87f079f2aac4224e7f994e17ed9
SHA512 68cc233b1462509bab048c137f0be3f4bb2d59ebd8fe3192e5f8d271ffaf75250bb5b67b0860828104ca38fbc09c6e0c5570d0da6c0d9d715d6da490ba193c6f
SSDEEP 96:V/o21u1pFelPsTd3FjP9/L666jFjXArt+xpFexPVLuxA1/MMwl9t+xpFe+WDwn:VgR1pFZ5IFbArt6pFWpuS149t6pFfn
MD5 SHA1 SHA512 SSDEEP

Schemas/imageFolderXP.ico

SHA256 8a925d84709cffc24b38bb158ee68c45cff0ab3ddba33d902c0930b7067ce5d2
MD5 d03be0c0b68b2eb196710a92d02edb77
SHA1 f198db28f3bda3ed496129ff3b7315cda1cfa134
SHA512 7904dfca35a5451cf34561ece669a033d56e286d0b45518013b77328dea6bdca92244ca6eb1ea76ec5cf0a433f7e364c4ae8efd01cd9f61ba99f522c5ab62ac2
SSDEEP 192:jr858RFfKX4Z54ISqmoigiKKxdcyCf1hbn5diyUW:jIORFfKIZ54NqdXWQyc3lQW
MD5 SHA1 SHA512 SSDEEP

Schemas/imageRoot.xml

SHA256 9d73a15348c696b1e098ef7904366649cf2fee5b39db967272e65035d86576ca
MD5 a2aaeb936a1370a375641186dacfeb25
SHA1 1ad1dafb287539f055ffbc9f6c6b46ff5409161d
SHA512 08c2e98bd775fdea96dbe2ac5f2fad0a4daf90dd970a7944889144d3dc053e278edf78f00d24cc0d02e025e9d29d7fc5b934c49504f424a808beab7e872d509b
SSDEEP 192:kxUlHEzbT6dL2RFpCUc9xiBc6bXNE1lupzn6VCnZ:e0Hm6dKRTCfiBcQdeoz1Z
MD5 SHA1 SHA512 SSDEEP

Schemas/imageRoot.xsd

SHA256 a605438526eba0cc8878aa338296916f18971de9079f45f4e89d61c524abd187
MD5 d7d2f3f25b42faa9d36b97daba46bf6f
SHA1 ba79effe5665ed86ec74137a25ae1d3c3fda5907
SHA512 ebf858110753aaa635633e3a4f23d205d7cd249784ab704e41985d3db48033adfb41553d4f0cfb8ee645ebe5aff16a40a560db92f1c182219dfd171694b9435c
MD5 SHA1 SHA512

Schemas/imageXP.ico

SHA256 a455af0668972b21095178a02f08fcf64f465e6399712efacf9f3767712176c3
MD5 472fcafeeda0be8f04a045a0c1588992
SHA1 27229246601f19866c9661e9cc1e6ed4da5a33e4
SHA512 b319ad24e6299d1183da1ef8c0f2e9e4deca93cae10e1e3d275bb5b238b539899d94dc8e688c9d83f2c2de5e65b43baa8ec18be496c539465f14e36f75c05254
SSDEEP 192:jfnF7a78kaZ54ipTKmoi7DrFWW3E1sbn6pR3g:jdi8lZ54eKdsdr3EWOng
MD5 SHA1 SHA512 SSDEEP

Schemas/libraryRoot.ico

SHA256 5f141d7d987e78b0f2fbb1d585754dacb5476ffeaa4e32697dd567844c3e77a3
MD5 6c554d00bd76a45538f4010b58966f8c
SHA1 9d786a57380188bebc5562f06794fa8aa40265de
SHA512 056c1efa4c4499b3ea91e50f01dfa5018549f20cbb061a3384984824c8741b46352ba3e25aac9c451132bc7036a90ffbcfde7f92d492dc451144b5964f712969
SSDEEP 96:PMemUKT0EQ+xmdGzjUr29mOu0DO9ypvePlo6FxNkKYsNgZlgxW7fyo6FxZaF:EeKT0H+BzjUSO0DDpv+vkKzNgZkoGKF
MD5 SHA1 SHA512 SSDEEP

Schemas/libraryRoot.xml

SHA256 e33d5a912fe2d0785134758f6db1aeb2ba12829f5023d990329df1fb900799a0
MD5 570fbc22f106436f8247a61ff97a4080
SHA1 3b59a94c792f99c60cefd361222c9fd0913a1811
SHA512 a0e149e24caecc5f113f5f9ef1448c29f2cb2fdfd4d1c72d4a29d49c8f26e606d21f624fb598bb998cd5dac71d4fbe3d1e121cc23f8cab23585ba3ae6d2b9af8
SSDEEP 96:cx0g4Z8P5tivNHEvb2aD21WOQy3YxX8HZ6UihPnBC9W/1fbNpGzIp+qpm484uf+a:+hxUlHEzi1EyKNXhpMWhNCIC484uf+Qz
MD5 SHA1 SHA512 SSDEEP

Schemas/libraryRoot.xsd

SHA256 46ad595f0ff98bed7ccb8f0077691ed48c78ead380bde71132b7f21e6a5f2e18
MD5 554b977d3bfd2aed15588be42dde3a69
SHA1 5ca237479e5d8c17987cf0b3cf72291877e59847
SHA512 dd34ed4d1a4e0af0b944499da215df27e16495ad405ebd6ea36718bd3a8493086bbe36fa3f49328353e245e2fa067c12680d3ba1d565571d55349582e4e02185
MD5 SHA1 SHA512

Schemas/libraryRootXP.ico

SHA256 1b38a726b788045d115fba6d9180517138618586632551a90fbae7be5d2d3a2c
MD5 188c78aecb538a3f29cbc3cd449d3bde
SHA1 8d3d915e1126c5a393303d990c3977c7aa6b88b0
SHA512 70edf59b23b8f323cd1f57986514c233e7b778f65873aa89a7847a6f5806d8c92bbbe05d36f452abba3b13c5ecac68978e3467da31678f6c593c6420e890834e
SSDEEP 192:jBH5EHld0RL2iyPjCE8XqL5kxFsGRK/Ws6qnndmrUKdChKdV1Oo5PkS5Jhmo0fo:jBZwlctya6lWsCKrxnnMrsKDUusKmfQ
MD5 SHA1 SHA512 SSDEEP

Schemas/musicAlbum.xml

SHA256 6af35cc4d8da317ee90ec8d2954bc6e4c68f004d7eff2c165fbebd870a61bb28
MD5 fc49b889fe311037740468dcd025bc6f
SHA1 903cb82607d53e7993bdb17b32b7575fbcb23b1f
SHA512 b13302b651cc4ca0ca60f5f9378a4c39664427e254159be7a7afd4d303b6224bd16903d2ef22802d1219ca45f89a00ddd82d4d258566dbddb7c2ce018a45b202
SSDEEP 192:+hxUlHEzlt++KnjrVCAU952Wvlj1qJF0UIXy6FdexXSgLnzlFC3TC/n4WX:I0HQt+5ji9rvljgTwi6m4GgO
MD5 SHA1 SHA512 SSDEEP

Schemas/musicAlbum.xsd

SHA256 b7402171812828e8bf6cde2e9d6b0c03874ac3486b8d4d07c794a0d7fcda1e7a
MD5 2fe6cea6b56313d87e182a15c7ffb5ce
SHA1 816fa837d7c5fe5e875fbddd8defaebd554609b8
SHA512 caec29ff17f5b71cb4a14b9fd0a5b9c1c9829fbd18c43a33d2f4d0f3f87e523ed5a8b3b3379bde1c4bd44f1e02f4361e4e7c64cdae47a057ab9f9acb8508c872
SSDEEP 96:zLmuR8g88KI4xj6/yDqy01tIhv3K7rPJwjL:r9RKI4d6/k0LIhv3yzJwf
MD5 SHA1 SHA512 SSDEEP

Schemas/musicAlbumCollection.xml

SHA256 89744c3fc21dc505fdb4f1b234ad341d42d3fcad271491c58195ceba5fde66ce
MD5 db6be635536c95ca626812b4cb2cfccc
SHA1 2c63baa96112027ad4fd8d8add3544bbac657974
SHA512 86b83b6dbfab442ce911a4e02c7ea84f32c8d5a7ba1851ce0925508ae4a50ba18eb5809092aef9824cf8738bde65002ca5ef2416504c972f5d8e7facd166db77
SSDEEP 96:cx0g4Z8P5tivNHEvbzbycKYxXyVQYnqS3smzLCeHokAtGqr7jv+RoZUc:+hxUlHEzzbl/QqSvzLFHofGqrWRo7
MD5 SHA1 SHA512 SSDEEP

Schemas/musicAlbumCollection.xsd

SHA256 c9504a026ef1529fa2093e7ff037887487a2d3bb0514ceb7a7a9bc630bfb8669
MD5 3c4a188c187205782bab4aa045aad2f1
SHA1 426c4b4d5d48452887ba497c100fd090cc1b2ec6
SHA512 49661321be7750fb79acd44d7a290f431ad5d17d31bef6abf5fb34ec0e95dddb60d271b4309a2ed7f1d24ca5ef213d6f29ad1edfe0d826289913675313188cfa
MD5 SHA1 SHA512

Schemas/musicAll.xml

SHA256 73de24e3fbec16a01c824071787b673dbb323a76954469520f880d1e61aabcbe
MD5 b53bd802b06819b327be50c094f833c2
SHA1 5589811f955bbbe3b6b67ac2d87391b5df01b3b2
SHA512 466818774fe74fc456dbe1298e9c88d2847198d259288d2c0c2521db0075554c34390bd1aaa71439ec38dde88cc5bc5e451ccf0fef38f84de54f60e8b8ac99a3
SSDEEP 96:cx0g4Z8P5tivNHEvbfrwB++KDtRQYxXysPs7FAAjmjduDWRn/Cf/89lILfpsG90t:+hxUlHEzZRqmEW1/wAufpT2
MD5 SHA1 SHA512 SSDEEP

Schemas/musicAll.xsd

SHA256 32f76d18906d020dbb87f67d18599e75521a78d887ba1f90f7b48a1b6c05666c
MD5 c902a549fb822babdb5542542bdc4bfd
SHA1 88ca32a22e62f5a17578e798c6676ad5405856d5
SHA512 4f21d1f28f9bc2a68f4ad5a57809a58948ccb7ea0a82ee1781168f4eccda68e5ce122119aec2d7074704f0ac5f98b3af235e3fce998e62e23a8f61150182013c
MD5 SHA1 SHA512

Schemas/musicArtist.xml

SHA256 5d0917940647f7ab6aacb63172870c59edf2a10c35e4db7b15486e66302edb61
MD5 65f97b794d0ec634d24e93caf173f21c
SHA1 94beb4a27b8d579c77131a00bbcb8ca268826a11
SHA512 9b1c64bbe906334d0d11dbe6dae618be46608ad0e780c202f1795351aa539329fadeedf10c2d8e970527810dd604770c2bd422b285552cb4730696a71aeb3e0e
SSDEEP 192:+hxUlHEzMurULqm+pmMWN9hWqweWawPvwl:I0HeoLVfMW/Aqwtawg
MD5 SHA1 SHA512 SSDEEP

Schemas/musicArtist.xsd

SHA256 900617aea9426c9e8bf5b53d987dc9261edd86c7c9a2e510a37ddc7ba33b016b
MD5 746e718d130c8de358c0f38936a63a4e
SHA1 975a590b46794f9d79be25925ca0ddeb4a69d6de
SHA512 cf10fe5ce7103d5be99334204c10a8ef608c5b51dea1ed24c416ac822fd9ff4fa1351cc891ecfa55ba443f3d6577ac7573af1c5b45c686b4c422dc8d23657443
MD5 SHA1 SHA512

Schemas/musicArtistCollection.xml

SHA256 4a7803e81b1a6a38ed8693b86f042a524b905dc6559ce7734c28398d7615b0ed
MD5 96c38429dcde6d51570add802aa70586
SHA1 da2629884f1ca90abb8d673ec9f3d7350dcaea65
SHA512 26a021dbbe0671f89b8cfeaf8053ae0ec80b0bffb8dd730d4391b3f0e40167082379de571516390f53894c0971a1edec310ca4463b484f6980983a3b1214688c
SSDEEP 96:cx0g4Z8P5tivNHEvbPGzefpRnNTsxXsNlEFflmW7ihvv+n9EJPQCJ59oqbjOgv+P:+hxUlHEzPEepTOomghv2neJPQitbKTBZ
MD5 SHA1 SHA512 SSDEEP

Schemas/musicArtistCollection.xsd

SHA256 9d560b9efb6f60af40da2e838480e3a963ddbab10d0c011c8abd3f22ea44ce66
MD5 3a8ab302655c95a2a48123095c0e5974
SHA1 00ae889e11ebd9d27d5517b3c46b926ab73b8a2f
SHA512 a46bb4811adcb7a485d39cfadb84f3856bc0cea5a6f5f4be4da223529c7db09febd55f91f392d701354164b6230c16c5a4b786c5c49650da7f3148a45f9771c9
MD5 SHA1 SHA512

Schemas/musicDisk.ico

SHA256 becc2d794efe6fffdd6a82680fc5316ca3268052e8f5f91c49165a7775448268
MD5 0e2f37240d4a04a222a8e6704d31db05
SHA1 e9b35cea7003e77f60219814820683e951b3ce41
SHA512 4a48b275453b2e7333ec99bf62c9d11409bd72c91d2e93255ec349b709fa86dbfc8aabc5aa34ed81dfcb5c923dbae5773a1af3c4094dc0b6e8454dc89b77a903
SSDEEP 96:I1c4fWS6tjfBC8JNma+61y9CTm/nw2zSHRhYeOPnKw2Nw1:I1c4X69JdJMiycmbfPCc
MD5 SHA1 SHA512 SSDEEP

Schemas/musicDiskXP.ico

SHA256 89416797c806b25165f41dc822162064e4aae222e612e27ac1a193737eaa401d
MD5 1d67ffd37122d91609f249668c622cfe
SHA1 3430a9587f21e183e92cca7f95eb1de7828af5c4
SHA512 02210e4431fd5d869f4ddd31db560a283790c05766e55d5ee195acbc4ac035c0678f92b35a455622d9a4e571151c5a226c3cf995c6ac1463ead7ea6bba88cbef
SSDEEP 192:j/DlMumwLHJOuL4RzckhXwu23IUxasMiyfGGwaVrHGLiISwsrCuR:j/DLmwLHJOuL4qkhXT23InsMb0nSXh
MD5 SHA1 SHA512 SSDEEP

Schemas/musicFolder.ico

SHA256 1212fc4485bb0fb651bbcfcf45f83b517944720a7308d9acc46bcee9ec25fe3b
MD5 55f71d7c63784e4f953496539e9707eb
SHA1 0296a17abeffa777950c61bac09edff927d8cbaa
SHA512 48082431f8d06e44b53190b4a47e211afcda6398dd723643c8e1d9382bad0aad2ebf930fa0c7d1e253e3f23008b4b63cccaef21323c9b411aff54fd531594d68
SSDEEP 96:YIRhXGx1hmJdayggzuitnYcAj/L62Oyi4qGxvQP40Jb11Xi5ztIqGxWEONSl:3GVmWygNita362ObG5zMCz9GEEUSl
MD5 SHA1 SHA512 SSDEEP

Schemas/musicFolderXP.ico

SHA256 f4998e950df7e89409722357a71f8217cb1e0e7078b36ea399b6160cabe72151
MD5 9ac7f9b99c9b1b6db21b7f1ffc253440
SHA1 91514b38fa294b22c342f0d16dc11a0dbe5ec59f
SHA512 461d8ee21a6cd88f1aaa16d98420fa82bbb5f588225f59a66adbf109d78dd7e608d3bdb01d17cb2277359d34aa9aa36fe7161e5361e976a5a02da6a66ba54d86
SSDEEP 192:jB0+snEZnNLW22s5p0a9O03Qkw923IPx60DJMQPyKuuJiccrfLizBJHNE+Kug:jBnNK22sD0p03Hg23II0DqQPogzVl2
MD5 SHA1 SHA512 SSDEEP

Schemas/musicGenre.xml

SHA256 fa0a29f6d2f3c374d98830f3087e372a0a6f702d0b5b4308782a17aa51f993de
MD5 65c7d6d0101dc1cfa09cece2dc7eed3c
SHA1 c7952406c1388adfe8c7f1d4a83bb005db2c09c8
SHA512 42f55665bf03ca36fb5fc6b47eb7e2f443ceb29411061ee51a76621af44b5fc7fa5de1e119635d8ed563c1fd6694e133a534dd92e99b7ce9e485f7c1bfd4cdaf
SSDEEP 96:cx0g4Z8P5tivNHEvbVGxI2dxXR7uGQSgPnBCy7lggowJoBXmhROW0JE2COvbUo5y:+hxUlHEzUx9J+pwg56dWgWkE2J5uZ
MD5 SHA1 SHA512 SSDEEP

Schemas/musicGenre.xsd

SHA256 8bfff9ddd5bd3e4dc4a7491b235921c48539a0b840ea703029c382af2e3dbf85
MD5 18d8acf1f08df3427db7afcfdb98acb9
SHA1 297101bab42ccda35647644eefdab7f0971cf2bb
SHA512 2f864c85fec26ba71ffed5bced28f7772089b115533256f8ac64d72342d75daa62de1fbf1c4cd723ff9e2dea5888935293fa72676e8eaaa92e6795b72f92cc76
SSDEEP 48:c+muw6YAT0MbLkGsZzYlGcycRU/3Aj9/V0IjG0afDydE3ikI9FP0t8Eo6iK7:XmuNY+0Mb46lUF/3IhWM1ak2ikI3DDK
MD5 SHA1 SHA512 SSDEEP

Schemas/musicGenreCollection.xml

SHA256 8b617c4b796217f5c28f0cd093e84a7d59c68f17f544835174ec103f38ec047d
MD5 6dbc62dab7d46122bae477b95818784b
SHA1 2fda79152a001938c53fe3c4c202a22997663d17
SHA512 7e28b2be44c4ef65885e4207502cfa953d6dd2c161464447156d83ad064ce94954d675f43afa90cf40d8107d137f6e875438f21998aba53b9657dd2806c660f1
SSDEEP 96:cx0g4Z8P5tivNHEvb7w/FIBOYxXL7HYCUIpBNToCb/3Zmyrjv+Vmc:+hxUlHEz7wNIBLACUeNToe3QyrSV7
MD5 SHA1 SHA512 SSDEEP

Schemas/musicGenreCollection.xsd

SHA256 ef34726705ded6755e53b1e88bd9033ea7a9333c379955ef32e6ac00111a1921
MD5 c8d2530117113b26ea5bc391b04d0fa7
SHA1 49cc633282a49c1b685a88455ad2e84e04fa07f5
SHA512 745aec2b75d4f473024ee4b1884386879ffc53d60c6a92c935ba9773ba6408dcdb0a3e3b957c4ab12b5ebf769f5790e67912559161c09be30007e8e097977434
MD5 SHA1 SHA512

Schemas/musicRoot.xml

SHA256 dab16ea52f365541b43c8ed76a57f3823fe547ec4675efefb341154fd50a4735
MD5 8907dd994b84982f2ecc616831d30571
SHA1 addc8c9b14d5e96aa69836b79d17bd1205175b90
SHA512 13c2be28f02c7ecf3a7736e86e56d9c3df84caa1ed146f885d0fd8bf6911bfcb69ace893963a10195718044282801b1f9f1ad345729fdee94b5f406d05af7918
SSDEEP 192:+hxUlHEztTJ/OZN3XCIO9fWF86n/3Epk955UMn2jUC:I0Hu1/wXCIOVWF8a/EkZLi
MD5 SHA1 SHA512 SSDEEP

Schemas/musicRoot.xsd

SHA256 94112ef050aae6b353b3ba33a0197c968d07c1df0bc7c20b81bb46a54b96f325
MD5 657ce2b80299fcce3c45516614ddfa6d
SHA1 79af024bbe239ae94764b88cbd7f9e3d82d46e65
SHA512 a0dd90c548364b6495d2b4e926322bfdca8200e06cadfa85dd654952e627ea438ff9a83175090dc4e458592d9d2c45a32f0c5bc5c0fdc55d60ace44d119fa36b
MD5 SHA1 SHA512

Schemas/presentation.ico

SHA256 154b9b96755ccc5a6cfac74bc3c842979800a50134e8e27ee684389c2f6c7e21
MD5 2c79d22b0e1b51bc105d973c38ae1d2d
SHA1 25ab1a20a14e8b1766293a455cc7f87ee656ec8b
SHA512 5af54d92560117332189e87d70843eead05851395748de7fb95517b1b5a479fe7682ef5ac9cccba24af85b842b7a07f500ad37ad5de3d066489a3febd01b85b0
SSDEEP 192:pgkFYjRDVqwlBfx7gkMZ8YjRFydXZ8YjRd:pg0YRDT5dsuYRFyduYRd
MD5 SHA1 SHA512 SSDEEP

Schemas/presentation.xml

SHA256 475407dff72e42265e270d13e67ecc0323ef7613b52534298b277cfe8854c6c1
MD5 ed219554d08c5b9ed0b311a9c255ebc6
SHA1 2c06e2fe3ebbead4b007e81c3fa133ccf3299c63
SHA512 c7db40bf178486070cf619c7f53f6c6281808f817b0ab3434887c14a297e9cf95619d77c7ea8503dbac5ef9569e82b02530b78c8f48867e768e3b5d02bcc576a
SSDEEP 192:Jn4xUlHEzZK/GZqAcGwrghhZ84pDKFPa7T7j5GqWwpik:Jny0HF+EAcjyZxKFSf1z
MD5 SHA1 SHA512 SSDEEP

Schemas/presentation.xsd

SHA256 1ddc9c143c6ab38f7e4a61af48c9f78fda40a25b0de564d7528666d24e97082a
MD5 566ba9c30faad1afa7da51b477e0eb75
SHA1 71dd327e1ec8f2e1134ab2bc75a87ca954170434
SHA512 44f8e4ca0ca48b8717fc33dd9977f42937162f7e3b3b2177c9d747c582da71fcd4e871481f24af56012cbb6a8fb940cc808198c6e714613720ba17f3bf3cebd1
MD5 SHA1 SHA512

Schemas/presentationXP.ico

SHA256 58b3689e25e029cf6ac0d990a48fedbc96ef587a9e397811ef7a5a88ea967537
MD5 0aa168838bfbcd90616c4a197a4f6b42
SHA1 33f90b2fdcede293cdfecbb2c9ccd6eb5e6bdffc
SHA512 dac549201caa1ae5ef8db851faf6b29a62fc4f55d234427deae06945a279c2e16aba9e9114a6aa65866b534a1e64fce1a429e4a35201428d82b2b13ac8d350cb
SSDEEP 192:jzcROV3itPnb1MI8kIQTG+9TxcjzLjRJGncWAToZoLg/zlpppppppppa:jwi3iNbiN9QT/cX6oLg/z+
MD5 SHA1 SHA512 SSDEEP

Schemas/rom.ico

SHA256 05c76a0d03e5220ff6aa63fa5719578b0cb471cad947699416d2fd0b4d3a27e1
MD5 5dbd97a8a525a1a55ac73f276bbabe0d
SHA1 0fbf6f1a42b67e8c024922312c2693c65b3c19c6
SHA512 edc14598bd4e60a814e47e800918a345118bab24e095fa286e55332530274ab811103c368318c300bbe9fdca42720e43fc9cc01bf98f509c8a10759125c04775
SSDEEP 96:q0AgQYa5xqr384sxpbgQYa5xAiLJlFwvgQYa5xu0G:q0AgQYEMrMfxpbgQYEhFwvgQYE8j
MD5 SHA1 SHA512 SSDEEP

Schemas/rom.xml

SHA256 c1da52e39962ccab98cbc8c901f127e4db997dcf20fa85bdd3ad63668a73360c
MD5 90edfc53d6df2b013f05b79edf4ffb08
SHA1 19e624266a43bf3a6fcada7857fb45604c48b609
SHA512 08095c2576261ddc11e14f7e4716ac83621fcfe43c52e9275cc1570919ca7ff20af211e731082cc20ba141033f6f39133510110c50ba0fcc4b431314e8cc1c57
SSDEEP 96:IXox0g4Z8P5tivNHEvbC/B/rkgVwC3YxXj3K0EkkJkmlqRr4SIaMJiSsvyPnBCrV:+ChxUlHEzUKjaRkA7qRr4JaMtWypCwar
MD5 SHA1 SHA512 SSDEEP

Schemas/rom.xsd

SHA256 411aa564b81909913190858dd117631ca15cfa1334ef358ad6a893356b9e5899
MD5 430f6129cdf4bd7995d9c5805adaa49f
SHA1 54d5027699f98fa3a8fb3c122e4decc593e25d5c
SHA512 867467d13f84e0bdb9dfc74fb74d914f736ab62b4e29ae6fbe8b0708230fe4b81627a079b1166bb0880c6918471c23fe8c9b1a97457383d477305bc5cc984918
SSDEEP 48:c4eWRSzivaiuHFp1US6BnTeYp1vW1vCv7/oTzuTZtxFT7xJFe0T/E469+Tw7/VTq:TXkziiiw1T2EuLLBfLJyxjv5w
MD5 SHA1 SHA512 SSDEEP

Schemas/romXP.ico

SHA256 6009fd3a9e17123c5b916a72a0aade50f55addfc84c753cfdef81bc0138ac11f
MD5 a140a19cf4339ff1900a1f75bc85aa29
SHA1 5f83df2bf4c8808e53963a1c994b580a7331f18e
SHA512 def2b81aca51d6589947cf26cf0946a515db511202472cbd6144e2c6cfb8c37a1d2a141347413d7c38178bf4bffce5ceb844988172f629ec00840c250c56da83
SSDEEP 96:jSFBZ5r2HRnwpfIcgVG3CuLzDuPTD75skT3Y7HKn3Nd/82/hwZaZzjOhTcB9caZM:jGBnIYI9onsTD1OH23PwZktB9caZb9VQ
MD5 SHA1 SHA512 SSDEEP

Schemas/searchFolder.ico

SHA256 b4d5ad5771f619cadf256bae5f1570ab42c186f249fcdc3699e543e234313c6d
MD5 529a62e5259fbb7ac58136dc405b5159
SHA1 5c23d37228e075d6a50b0acbc7b72bbb0b66d954
SHA512 c52d9069dcd0578f17e950f1a34a6c620b0ea5cf343d8409b04cb4ef2283259693309ac1f0235acc79d72b265886c2deefebd834ab5d77f3ec9a058a80bf1b89
SSDEEP 96:gC2D9PeHlJGxu38wtSceY34m6vWJbZ6CMnfjnVXxus+erjMnfjnVXxuk:gxBPeH2Y38KSTY34m6+ZZ6C8lYcj8lYk
MD5 SHA1 SHA512 SSDEEP

Schemas/searchFolder.xml

SHA256 7cceacb443593c2d2a6ad01c1bf70e2e12986b4d2b203267fe387ba92094bca4
MD5 167fe0bc19bc72718e17cc216149fabf
SHA1 d96ef918e266492fcde85ef4678ecec806de2cac
SHA512 f6a7d3e518fe37ca2ce81f45ab3a4ea2f64c9f1e377011d2486a01569d44d062bfb437244dff38872641eb281ea54ec2f405b85758f99b023cb0235d1d5bf173
SSDEEP 192:+hxUlHEzxNr5FHGKg45sYWt5dbdplx2JCe2pK7nf:I0H6JzeVZdvx8
MD5 SHA1 SHA512 SSDEEP

Schemas/searchFolder.xsd

SHA256 c79af52f1ef1f5d3113fbecfc2f326a5f62bdab4f1ec16a50aec13af5ce7bcbe
MD5 2ce87d7c662e78f3aaa271d91ec1af5d
SHA1 d6738a71824cb5483f34181a6d5a3f93bc342fd8
SHA512 26e112edf19b13c18bebc27faddfcff5181ef56111b4abc97fb62c6952142acfe283a943b5167d75fe8bae94d64199faca7417e49a627177f5f939a480c6dbbc
MD5 SHA1 SHA512

Schemas/searchFolderXP.ico

SHA256 5d19659a1ea9a39fea5c4190c9b5152e199dad4a2e9370d373a945da7a332033
MD5 52fb64e6a77ea634cec738c4c2a9aa89
SHA1 4b2c1fe6b18c1a05e57e591f17e1569407634399
SHA512 879db661099d9abdf5ad0851ed3bc5fd04ad3a6c098e5ec998ef3ea43579204436aaf7dccdc6ee478e31952c2e354aed69702b72001a5272d282de9dc32f54c5
SSDEEP 192:jVTjjV+UZ60PG6AU1Pz29sX40q9dY0833o3AXAsmya9JQH3fjPNBgw4SvcrtuM:jNdKT6A1eX40q9s/AHySJ2RBgTwcrgM
MD5 SHA1 SHA512 SSDEEP

Schemas/shareazaSkin.ico

SHA256 089241c9530940ff3111945d3d225615de30eb876a3e0c0183dac5e1956e79a5
MD5 1098e0cb6a5a8195522684ebd1d95b87
SHA1 b96ad94f99d5c4e7d7ffac4e3c871aca44a32fa4
SHA512 dcced5c789a1b4b24d7967540e58d73a2ae3a4107a29e1b4d68025bc082f0f863f3c8f32703c17ccd4c68067eeb818cbe4831fe1f213bd5cd39e27dd2cccd3fb
SSDEEP 96:NitAAcBgAI6b1s/Mn+xvjJ9R0UOVnc/WX0557GZohqA59YzOVy3f6:NiuALAIvkuvpHqniWX0557GZf09YzoG6
MD5 SHA1 SHA512 SSDEEP

Schemas/shareazaSkin.xml

SHA256 9bad4ff0b70794b5914d9671c412d285dd10251a43c9d1dd6076d68bb0abc6f5
MD5 c796760ab6d00cbe682bbbfc3c8e13f5
SHA1 f35fb66dc1ab79979049588bb2e5ac5c7b02d140
SHA512 65fcb6627b1d62d86768eb0c7e3b641518ced1f6518b58011b9f95bc6548c34b89a1e301f48dcb401f9cd90a587de3b1d2408227fdaadb80416a598a41ef9b46
SSDEEP 96:cx0g4Z8P5tivNHEvbV/zd37Ptqr3w5Cwv+iSsveOBjlQGlqlgPnBCs:+hxUlHEzVBBqrgmWrpNqepJ
MD5 SHA1 SHA512 SSDEEP

Schemas/shareazaSkin.xsd

SHA256 763af82ff580bea7cdc73b9d495ae519b55cd6ce6ec43a350b1b6a0670c6e9a9
MD5 41d53d3c8bb64f17c609c859fa9cd948
SHA1 01dbf75a4ad08138b963a5a434eee661e6b9e678
SHA512 7662b7c1d302911323bcf443f45663fba499382762edb7578a2fa8c0f08d1c39293bb0e7a60e414fc184631e2f80a222edb3b3c5cd0392de616fd80e5085f897
MD5 SHA1 SHA512

Schemas/shareazaSkinXP.ico

SHA256 a902668e09ae3fabb6a8fe9b449f6cde0468ed74ef0bdea79b8691ca148af2d7
MD5 38ddfebd8cdcf236aa0855702798e2ca
SHA1 3d67205cd6ca5ab2ee805d92dffed71832e0da1d
SHA512 13786290871337e7ccc9fdf41db407b2d0e7c8ba829a237a0c3d33cb836e9bb6768797e6762e774dca777eb73836d381523ac36795e29f92d3b10804ac37ed26
SSDEEP 384:jnS+szg5XRWH9+GhdEXHCzQWJw37Nf5D2n:dcoXCgouXCzLUL
MD5 SHA1 SHA512 SSDEEP

Schemas/sourceCode.ico

SHA256 2574be496928c284d222bce13ca6bf4bc61cacf42a1dd9bb61f2f0e801346c0b
MD5 fd104c0ec157232fb7c4bab535ae3bc2
SHA1 589492e68b9f3b02160b4ac63928946b2f5d8bcb
SHA512 1865fad1e5f544d4d3afa3d756651d3e4ad9348a8b2b910d775f1104c3a0d856612da24c20f2c483ece1e94f1e1bf1d15a31bb71a8a399a0c891a4a57d0d5b3c
SSDEEP 96:hYj0GHL/4jkWqK46tZauoduHL/4jkWqisduHL/4jkWq736k:OrHL/QTqK/t7HL/QTq6HL/QTqz6k
MD5 SHA1 SHA512 SSDEEP

Schemas/sourceCode.xml

SHA256 0ff690b696a7b56a5de506e5b51f1bc7d1ca7c39fece615f1d5db2c651c85100
MD5 c3700e6b9a13a8c487190f00993b56f8
SHA1 fcff0d27eea2b8c43de3f840c43bf7fa74976388
SHA512 e9ee061e16a80dac6bdb57693c8504d6715e34163b433345cdd0ab80a958987fd92ae57791ef3bc131024529c0359ba887ba102265d0099c07a880ab6f6a75ef
SSDEEP 192:x4xUlHEzHFiK/GmRvcGwrghhD8z3qQTO0XWypq6O7Zq:xy0HiFt+8cjyD9QL/4Zq
MD5 SHA1 SHA512 SSDEEP

Schemas/sourceCode.xsd

SHA256 10512f510829fef654d11f2bd255cc608e6f62170c63f43559c9de560091efde
MD5 43dd687086e6439a62470f1b16c60f41
SHA1 ae5a18755a5f460d0fd538ed620f1f7eaa671372
SHA512 59b331fbfc370951fbf5be82470938c1dfe735f037aba98050e78125934d755ab2c023c28940656b03ca8f7bda6668627236fefbe36372979fd32d5a8ab5370b
SSDEEP 48:cIcRDzeaaqFMwQJ6xfrgBSEqxqvn8P7NuQWT1uKi8NF/z/GT/gPRzoLcDW1T9Q3v:M9z1at1cmESebFJL2gw
MD5 SHA1 SHA512 SSDEEP

Schemas/sourceCodeXP.ico

SHA256 2b8b5f339d47250a10eec9688d7eb61bb7fc0bc9b709fa961d18fa932ce10b71
MD5 c6e5c1f021134ac1f6de1722c76db22a
SHA1 f76493a7f7f0005664a4636b7d611478054b01fc
SHA512 fe16005da28e0a8d099a8cc43d46690228679a0a5152a10d68737906b0c876afeeed2cb76f876c631aa333a0fa469b422a2799cf680d8cfa51e67dbb19691e07
SSDEEP 384:jYdddddddddddddddddddddddddddddddddddbsMOMMMMMMMMMMMMMMMMMMMMMMg:Uddddddddddddddddddddddddddddddp
MD5 SHA1 SHA512 SSDEEP

Schemas/spreadsheet.ICO

SHA256 2b17f3ef1a404eb80e0c7b94da9729683283a05df432071f4430fbcba3ac6200
MD5 4bb490028e0dada5eaaea14d50075b23
SHA1 0b815ced5139eeb75d11faf97c3e911b89c23454
SHA512 c30fcc3901f955f609ec4773f0b2db8cd6fee1952a5b24dff10f2888a59f95f41b5f5a20711b6979591405906775944d85f9f24f6e7b23f4d5186d2504c8b15a
SSDEEP 96:Xdn/8eoj40BOOK5sAuX1ITngVsHzIq03VmSrJuKF/8eoj403HgGwJcCBFjW+/8eP:h/98V1oBn+uwLJuQ/98ryc6C+/984
MD5 SHA1 SHA512 SSDEEP

Schemas/spreadsheet.xml

SHA256 b3d205d4ff72f0b4059e4477567e7476af7a44fba4114b9c489b08d00dedf2a8
MD5 ecee386677e371098063d277253e53db
SHA1 8f02d33cd61b67ac8a12b09caade2b1335a56097
SHA512 e00d47a62937efda9327c4821246f35d6be1f9da86b8385cb55fbeeb8c1a6400a3757281c567abb8f1aeaac6dd22ebe5c3e906bc5e8e8c0a2c7a4d96e2c67232
SSDEEP 192:JDChxUlHEzqhQgK/GZq6cGwrghhD84pDKFFD7T7jmdIAt7pWwpL3s:JDc0H2+E6cjyDxKFVfOdIAt1g
MD5 SHA1 SHA512 SSDEEP

Schemas/spreadsheet.xsd

SHA256 37cf473e67dd586d914948a97c54ed9d1de1f94c5fa2b74eb23b6d3caa92ddd5
MD5 7a0b1ae73568d82a4e6f34b736e5dd89
SHA1 dd897ef3a7a0adf54eec1b505dfd600863f1c98e
SHA512 cecc68211737dbc9e1a2fbb1d25c320811bb04d06d29507fc34db70e4208947c104dddaab191238afc3ead7497a0fdd8c857af8fb92a2b24aa16de5730bdd629
MD5 SHA1 SHA512

Schemas/spreadsheetXP.ico

SHA256 b2222e5462598cdacbd6c5c424778cb177a546d80046e2b9a7eb346a1c4fd8eb
MD5 11e04d3b5057514fbe5f1e1d6a7c7f17
SHA1 06503e0530488bcdc2c8c7aacebd829af5fbe774
SHA512 b585d17dd8d8aa447781a01bc3296596f7b8ad2429ef2836b95836e8cfaa67f6f7347696e11228af73000b364f9bb26d18a9ed9436e692aa89afc0f5bf060371
SSDEEP 192:j3PgeRv9VXpIEEBNgEr1oa4H0Dl5lJcuxZhxOxuZksWdXXHauYRZ9Mk4h3m:j3PDRvLWhbz1oa4exZhxOxM86hIztm
MD5 SHA1 SHA512 SSDEEP

Schemas/subtitle.ico

SHA256 08b9ce98a78af44f5b165c72d6f9245c2a5c17e79ebb172105f812b867819d6d
MD5 45c817d71b8fd015c4f62f5c560f6dff
SHA1 0a44ee9a1c7bac2a9b3fa6f2ee7526dcd3c51d3b
SHA512 d676a054abb611ea29c2d1fed1e0e52ab393ad968562e23c3b487bdc95d041eb5f94882cbd1b2f037bc4c71a67a8b4e7443cdbc592ac15f9670a07b0db41cd2a
SSDEEP 48:6q2YoqaqBdeAN+FHoU/2TZwNEOJ6Ota08t7E/gbN1pv6usn:J2lKBQAzU/mu6OtJyg4Da
MD5 SHA1 SHA512 SSDEEP

Schemas/subtitle.xml

SHA256 dadb190fe25c5ff01b8baa0bfc4b360cc3c6ff1660315ebbd226f82a93a457ff
MD5 7ac1600c95d7d81ff813dcd2aee467b2
SHA1 75ccc97e04b72b310e7f13d5d8acf2d318236e36
SHA512 27aa23166208692e395ce474554604dfc04da22fab51b07ee74a2831a5b93a372aecd1bc3c290baea6185e2a877f1de6eb81ee995f36fc6699f496dd9911c4c1
SSDEEP 384:I0Ho+Zrax2ctf0P0pPYO/dp364m3cjyPS:e+ZraxrtC0pPB6W2K
MD5 SHA1 SHA512 SSDEEP

Schemas/subtitle.xsd

SHA256 caf112dc043865e859d3d66436ed68d661b25da67f63ff867c2d5952547beea0
MD5 424df50d9d4894286b594cc6deb9fff4
SHA1 c833b3bf062bb03f5c77dc02543ea100a186248b
SHA512 51cf2e3e9fda4f6843b4669695a90db2522c26215b58f8c4698fbd423a300f85c604a87e4dc8f49d57fbe55e5a48c3217ca55a668e6fa9a20438f8197434a186
MD5 SHA1 SHA512

Schemas/subtitleXP.ico

SHA256 4797076409e64236c36d3135bb51dbbb1d22991cb3c0f337cfca64b242a2b769
MD5 cd73028d6c7825653ae93f48d62bea9e
SHA1 1e194319d6337c7a36cfe5233fc1eb161c751be7
SHA512 0f0489f96a7d0aaba9d5ce7cd0989fc829914c17641ec437c16ccb7bb93d2e3054762d949bf4c396ed409f71401620bc4c9129898508d1aba63bfbc3a8965a72
SSDEEP 48:xCmomDm6KRmPF8YYYYYYYYYYYYYYYYYYYYYYYpn:xCdmtKst9
MD5 SHA1 SHA512 SSDEEP

Schemas/video.ico

SHA256 da63d577dfd4242f54c986144e601ed73fde90ea8ca3b944e52645042457906d
MD5 06d80a4e09e19715e9a419a1b19ed7c4
SHA1 56c54b1023b18b03ba778cdfa86fa7157cfb065d
SHA512 348920bbc1bea57cf1e4bc2e0c07b69194c66557fb3dd1c0475059c67cc96d350815ebf61cf92d77d76d46419938df13b43e881e343014614c0a6c9352a01c74
SSDEEP 96:lILoNQwARrX3BXPM2wR+x4kxPPl9zqIlPNUPzaHk7HJa9zqIlPNVGC:lIsiFXFU2px4kxnlcmUUk7pacmVGC
MD5 SHA1 SHA512 SSDEEP

Schemas/video.xml

SHA256 96ca0cd344d1c8e7fcbf9239049c5f102791ae3077cc68cebe446c2dc28c42c6
MD5 b068b37c4da1b95b832eb0f575df6a43
SHA1 0d8c8ca1d5b539dbfcb9cd37ae2301b6c9293dfa
SHA512 fb0dabe180a2c87070f3f6b1802f77801cda6f48db573278bc54dda855875ce9f82c06b98423f9d18758327e87910002b3e14f30f8dfa233b14d262d24dd1a7d
SSDEEP 384:I0HT9t19dZrax2c13f0P0pPYhL7xs/C4xqKMGp3H4m3cjyP1r:V9L9dZraxr13C0pu7xaxj3BHW2N
MD5 SHA1 SHA512 SSDEEP

Schemas/video.xsd

SHA256 f883804d63bcf1b9cefbb94f092dde4c4ef3b90e609457b7c25dba7352ee7a14
MD5 3eaf61ef5233a581fc35e84893e28d82
SHA1 b261af91b62edf33cb3d630cc22af861c834af8e
SHA512 34bb56eb99ba27e3947f4e4c088e49914b0232572313fd98562b72975c609f9d6cca4ce95690334b0cb06e4167a17d0fab666d6b732cbbc988c32654845c815a
SSDEEP 48:c4OgLzDajFykvJLW6CiUih3HQ8sKvAQE04KMEBh6Y3y3z6Y3y36qxZHp+eIhyxco:BJLzmkAJLW657zVMwZYgXSHY59
MD5 SHA1 SHA512 SSDEEP

Schemas/videoAll.xml

SHA256 b3a2ed6c7b6c612406450f604e3199339c15addff0fa0aac16f137e2c4e88a3d
MD5 052d01b94ee24dc4f7f7369f623c0f81
SHA1 3e448407ff13194c9bd6339a72c5b5b5356d60b6
SHA512 d1ea6201a77f5df44a52e0389b51ef2d62bf6192f4ad82c1d74e4dd21303d5a90ab893f667fbdbec22fe7c819978354db7b903ee619a4677be24e8f3872a326e
SSDEEP 96:cx0g4Z8P5tivNHEvbefgXFMuCC3YxXySw7sgvL65cPCGIy9I/HzYthq9Ts:+hxUlHEzeoX1CCKQ7hvLhP4iAqso
MD5 SHA1 SHA512 SSDEEP

Schemas/videoAll.xsd

SHA256 a5d8707bcc6762872044ef7869b74a8f39c2090532b9486ea1aa9a02b2cea3ef
MD5 2c69c602f2db63acc66bbb97a52f0efa
SHA1 cb43f644e123027dd884a7b985626d8171c830b2
SHA512 b4d3c57db27951e7344feddab42de88e31a7d1b59ee0209eb6b1c8df67f7602c4544aa0df789daaa54d0d37c4e9121788d4193ea905d39d5ca4cacb87c00ff6e
MD5 SHA1 SHA512

Schemas/videoFilm.xml

SHA256 d5459ee67c94d0f08d149918e72076c5945ab87681065e265fc851f72957216e
MD5 ca406201e09cd656ca83ccec8246a631
SHA1 d304bcbe5028e47c2b7bd8e3bbba1331f6b3b5a9
SHA512 6510c3447faef8f1cdacd9217b440fd339cefdce9517215ebd013c1995edfe0a93b3f0ca138baa6fe3d20f0cf3c6c04b412700dc3f252df2c918a98c0418af15
SSDEEP 192:+hxUlHEzbwmKqxSK1qZ+q5FpQ3/Ir4EAU9xNvFiXYNpSkLZzlFCXTC/CUcGwrghg:I0HYeK7+DgwMq9FlCm3cjyPej
MD5 SHA1 SHA512 SSDEEP

Schemas/videoFilm.xsd

SHA256 4fabe5b37d15dbcfe5149e2fc5d5ae38b51c70090a34c6920b185a8dbc07c184
MD5 4e29166b458dbde78578c56b770371a0
SHA1 66b2779995a596ad72fb9570b423dca002476a66
SHA512 2a35177cb4d3c8cd28dc7f63bc9c4cf54a9826e41db4687f890cc9e3cb89db1ed42df6466b50c13c33707daa6fb38426aebf17cf081100490cd4461951a9db3d
MD5 SHA1 SHA512

Schemas/videoFilmCollection.xml

SHA256 ae856ccf673e14cc6fca6b47288210f810686254a098ae3eae3e3477c998ffce
MD5 afa38de4858d7cee6c97d4d3750bfd52
SHA1 560ab38cb29978321f0b744f1d2f9a4359d572e1
SHA512 7d2e4e0e8bb36e5c52c18fec8324284577e3d0bc2220bf190879692f4df8252f7d699eed82ec8e9510d34c155e8962908b9815d80a33713cd6d9adc6bcabaa0e
SSDEEP 96:cx0g4Z8P5tivNHEvbgDL1g6F3YxXyI5xIGy7CFKGcqLx+ghc:+hxUlHEzgDhg6FKyKxIP7KKvqL0g+
MD5 SHA1 SHA512 SSDEEP

Schemas/videoFilmCollection.xsd

SHA256 5d805a49b31ec009b61b2599d19962786ccbbe4376e884a97e240d883e1c581b
MD5 7e3f85915e41e71c0a89590c492bffc2
SHA1 4da03a43a84fbe951d600e21553894c6905ab99b
SHA512 1289b12b14146c1efe4c8d23a5af0a916535312ce7edc1f8a39c6252ff7d60b32b8cb0c06d20cb94d4f1f0c28518a9320d00e747eb34e995ff4339a556460151
MD5 SHA1 SHA512

Schemas/videoFolder.ico

SHA256 cfe3683b9f4e7eca09975603b33ac55d9342193c4741c1320991b81e9851a373
MD5 abd89758050d869e19c66774a2324953
SHA1 b3789873cfed9078de0a2ea5d1ff496d1944614c
SHA512 7db0fda60f4e34bb2099fcff324c967f9b5f11c8bce3bdf261feec8b0e5a7ab352cc3fb22d5ddc393f8498b91237ec75906cb93ba276a04d22bc2e0bd44c34bc
SSDEEP 96:A8le8MkCX1FjxYK6cLT9FCKSWXv5xjYMJv/aYo+dt8U9WXv5xn:A0ckClFjC7YT9FC5WBFhcB+WB1
MD5 SHA1 SHA512 SSDEEP

Schemas/videoFolderXP.ico

SHA256 039887a989b8fb12d4d36c14f97c732944b1e4cd6c079849c3b1719c9d64d912
MD5 b59f97c54b27af107e33982562fe917c
SHA1 fac7afeade46856cf7c298bc6345f1b5ddd1360f
SHA512 2b656f6f30ae3de65fb1e11300f0ca7ffc4e9a9f096132533bcecbffad90bffd1eecd099206bfef08e25fe8e13b8133aa461f8e8971610720edbd8172c10e300
SSDEEP 192:jX0yeeEyiUPJnibTiM5d1k8OohRWGsRPiuUtsIhTQK0FVMjruWI:jEye2LNibTiMtfmUMIhXTtI
MD5 SHA1 SHA512 SSDEEP

Schemas/videoMusicCollection.xml

SHA256 fe7c876f62e0abf7bc9b5f0d08d7d56837dc622af7fc6ac1160f22bdb9424f5c
MD5 63b44371cf8a35307efca8e7bba12dd5
SHA1 90a3ee2fa3cbb706974099016d0d21dc6788dfb5
SHA512 cbee66d84e5a73b03498f70c764b54fb85d578df095fdc1121f05d68de81e9810a07499be37906ea2df32d3ba554b08b3749e249f4f4300c799afbb8fa2debfc
SSDEEP 96:cx03Z8P5tivNHEvb3NwS92RIb/3YxXyROsPkO8gpfrTgCOdQeqOc:kxUlHEz3Nb2RIDKItkO/pfrTgOe0
MD5 SHA1 SHA512 SSDEEP

Schemas/videoMusicCollection.xsd

SHA256 f59ca3aeb6f33c80479e6dc9c63f10bf303b19e1e2b91c695267fe24560652b2
MD5 46dcb00b833c98602e007101aa2c7e7a
SHA1 3be7827e1e96eb851071fb6b70ce9ae9714274f1
SHA512 22b8b92de84d2c9b813f8316e56caa632e427618a7efa504038db47881b5cd72e0a082243c44880e079c78a50b6f78999472a4c13eab0bb42063ec26da875d66
MD5 SHA1 SHA512

Schemas/videoRoot.xml

SHA256 c20a923c9bdb7ef706bd7edef7a85da2d6880c84830bb00e3d6241d86bb09999
MD5 2a64aac1552ebebddfb33042077ce1b0
SHA1 46c2a8f6fc8ab7e52a15e9562efa7086fda2fe38
SHA512 5b522b62a335c90607097e20138fef1c6aa43ddeaf43045783b0a4cbaafcc461fb0fb82fb91d1638c6d48544748bf88dac8778f9a4ae01ab8a1e50ea58c0ed72
SSDEEP 192:+hxUlHEzqemvK7FDx4uuO3qqO9GsK36tbaQEb0yMStojZ:I0H/wj4uY0sK3YbxwE
MD5 SHA1 SHA512 SSDEEP

Schemas/videoRoot.xsd

SHA256 4f33d858c0b7d58ced13a6e67ca25c2b57f0a42f2646ef3c182f0e5c862604db
MD5 a8da21239f8a0da557151679b7532f58
SHA1 ad7019d2128d6e8a8c117e4de7133a41d19739ff
SHA512 9fd999024a86f089fdaadd2df16ee6fc2f353625f9dab764ade941a183e86d421aa2f7c22fc77dc3f1cea635157a460295450da735e8ec279297f9d6066cb209
MD5 SHA1 SHA512

Schemas/videoSeries.xml

SHA256 00095c68c74d2e74c16a04c73ef214bcdd255e0e9fd25d714de5b94ccecf3b4e
MD5 a2c9a4ff9a093df5bc753644547b7926
SHA1 42f74f6f1cd1d547e8a9a24e2904a92ce0bf43f7
SHA512 163dfda6c8bc19b2b92d0a94d67d3e6f575bda73169ffb0e2874c50c24fae64c09af5bec3f828fdd2d7aa264b65dfa2e85001ecbb9de6ece7af96155545decb1
SSDEEP 192:+hxUlHEzKzVMqhjj+SK1NFiq5r4wpf0P0pi4BZ6kxXSgLT/zlFCXTC/KUcGwrgh4:I0H3ei+7l5Mwpf0P0pPXZ4mfcjyPedHP
MD5 SHA1 SHA512 SSDEEP

Schemas/videoSeries.xsd

SHA256 e06266503dba7b22a0c90e1c319ed67430b6c8d1179eaceb048ca31bba6e1119
MD5 71d11e057e9a7367c3f1a011346ce01d
SHA1 03583aa05190168a7c6dad006f210bceb0168f5e
SHA512 60941715cfb8124873e526ae55dca4eb35d34e815c5e0eeec9c30cd9edf02b7d2d46ea16e15ed630b78b0cd387a92cb4297090597dbad0b195b43597f6e09005
SSDEEP 48:cexuXUz0pTUHl6cDmFzyj7yjAgJB6CiUiyvVMIbV52wb3DSBcs1L5fK7:txuxpqAPvJB65cEK
MD5 SHA1 SHA512 SSDEEP

Schemas/videoSeriesCollection.xml

SHA256 cb16ae26b6ff57fa4dce5941e989ac542eb1ba2d59252541b68219df211024ce
MD5 71f11cec484835a05de2fc360bf55bdb
SHA1 e706be5f4ffaa3bb42029772acb92f299eeb4be9
SHA512 cce50f3e6c2c98fc24cb24c9cd92bf799ce4edb9edff3d9e7730718e5e26918796ef12f8db4a5f1e09378e7d930fb1e147cdbf089de7e88101cab1cb32972877
SSDEEP 192:+hxUlHEz939AZMXEK6Y3JOeaDFFaSakqaLDfVQ:I0H890Q6AJOeePaSff+
MD5 SHA1 SHA512 SSDEEP

Schemas/videoSeriesCollection.xsd

SHA256 86f55a3a42f78b7d8bbe5b5bd52243698cc169be97bdb848a6fe7cc2dba6f4be
MD5 483ffea27c70fa8435166b78d60d2e42
SHA1 7af2373cf39474e997ba95f5ca31b9d8da92a77c
SHA512 dab9ea5dd4c77c993d70a6c43e98f969fbeab5ff7c862b8d916528ab5c4400181f71397bb9b457b1fc424fd013b14daf69b780166cb2d2c63d0849e6ea698353
MD5 SHA1 SHA512

Schemas/videoXP.ico

SHA256 444c593a5ecc6bf9752f9d91be781b26c770d9f756ea30ec76e6fb2c83b214ef
MD5 52a5b37a7820358380cd96be29a0d769
SHA1 65b6e2716cbeeb3e772e89d1104d8820a7a056ac
SHA512 fd51b25ae4f7f7552cda6af00c531cebaad5419e8f5424a7174f7dff04b18f74dbb2a7f7d566b712d819dbb4a09bc99d05ddfb518c9179d7487f58e1a5e74cc7
SSDEEP 192:jPfAEHQz8noicwil5dTa3A2GNROizUisIhMQK0FUru0:jU8oicwilb5X2Ih8V7
MD5 SHA1 SHA512 SSDEEP

Schemas/wordProcessing.ICO

SHA256 c753d679ddd7e194709343037da19452a3b7e695c2e2cb034e92d5e74afda6ef
MD5 678d678ca7ca90f32688b7f2fa25b0c6
SHA1 861398f7edd9246bcf09a4298a4f1912870f92a0
SHA512 02981d0d285aabad4a2e52115a0619f3f3aac9e53e2510ec5a13cf1961ba718cf191b7b4e6a58e84863a875b303353376ea248e126fcfa7c62fc4814dde7d8ea
SSDEEP 48:6czeWRYJ6Ta4UsyzUcI5b7lwvnd+x5feWRYJ6eM2tOl6eXerqYkeWRYJ6BtfRLAf:6I7RYSa43coi87RYiXS87RY2NACS
MD5 SHA1 SHA512 SSDEEP

Schemas/wordProcessing.xml

SHA256 ecfce6a3cf25772595ec34c8ec8e7b830855ba1e5fe29efbefc856f862e0de0f
MD5 157bd1c2aca941dd44464d98e9b274bb
SHA1 169740787aff6dc7eff306e44fc8f24cc1e02101
SHA512 14fff6d839c1613c6620a7e41473c61be16d5ce48c503b6a3bb6395939c0789a40627d68b648e750d8b1797d2ff985f7cd894d0ef57a2abdcbdde97be46f4981
SSDEEP 192:JBwhxUlHEzIx0W7lWZK/GZqAcGwrghhZ84pDKFPD7T7jYAWwp5:JB20H76g+EAcjyZxKFLfXB
MD5 SHA1 SHA512 SSDEEP

Schemas/wordProcessing.xsd

SHA256 140c0e74ad3e9189d158d43d7f637043cc763d6212c3a57830989bc8e4561cb2
MD5 2111ac78ab58517cae3f9a4b5cecb3cf
SHA1 e0b799e10222b0b664527409e1365f88b7647336
SHA512 d762efb2f8a31104549dad62c3b7613d9b9572e1f8953ba689f874a0909c903da48dffbc94c6ad46e37bc836d3349f33a9f521055c70f3f936ea28b84a62ea4f
SSDEEP 96:GBQzoFTQIp3UErTgEzcBl0hqP6HNkOMfF:GBQUsgUyVHzMfF
MD5 SHA1 SHA512 SSDEEP

Schemas/wordProcessingXP.ico

SHA256 f1aa0f75124449ec377703210db8f6e0f53e9068384a89dd4f0c333042102d15
MD5 c6f60317eecae4a18b66de70b7ac775e
SHA1 eeeedf2e2b52a571b292059af8c590aa70716b8e
SHA512 73eeaeee5571536beece73483363f86ad7a05998bfc6fa9f1ec84f01f897c06d4720b55f984f8311493af8b7912da07c0b1c3190a6ef35a97f098381ed82752f
SSDEEP 384:jEHn99999H99Hk66999H6wCkUwAQxrlZ202ANyrVu4Z:oHn99999H99Hk66999H6wCkUwAQx+TAS
MD5 SHA1 SHA512 SSDEEP

SearchExport.dll

IMPHASH 7a3986bf0e3997dc07c76fbade689632
SHA256 e17fc5d469de6ebf7226bb226f49b31b1ce362d42b6f629d86ac1a83e922c0b9
MD5 da9611f104157226255c045b34c34eed
SHA1 388334737cb4a5870fd2a4691573e4fb48b01103
SHA512 7a2febc74b873fcdc1b58b4fac1f34c005c0378b52ae18b26f0b7295ae7489ec76b38a0d5c0566ca3ae0a630e707cf4076736af18389953611b84cc3279fa52f
SSDEEP 3072:f9nkjQP6AtsdCuij4T0Md3tNyWPiE+uoYPAKIkmRdC:f9OQ3t2Fij4Td/pq34Vs
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

25935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleHandleW GetModuleFileNameW WideCharToMultiByte lstrlenA CloseHandle CreateFileW GetFileSize ReadFile FindFirstFileW FindNextFileW WriteFile InterlockedIncrement LoadLibraryExW InitializeCriticalSection LockResource FindResourceExW GetThreadLocale SetThreadLocale EnterCriticalSection LeaveCriticalSection GetProcAddress LoadResource FindResourceW SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW lstrlenW FreeLibrary InterlockedDecrement DeleteCriticalSection FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetModuleHandleA

user32

LoadIconW CharNextW

comdlg32

GetSaveFileNameW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

shell32

ShellExecuteW

ole32

CoCreateInstance CoTaskMemFree StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc

oleaut32

VarUI4FromStr VariantClear SysAllocString UnRegisterTypeLi LoadTypeLi RegisterTypeLi VarBstrCmp SysStringLen VariantInit SysStringByteLen SysAllocStringByteLen SysFreeString

shlwapi

PathFindExtensionW SHGetValueW PathFindFileNameW

Skin.exe

IMPHASH 553942f2f9a61fbb3ace1064eaff2ab5
SHA256 2b79cbb5735826641f29fbf378d8bfd85adedd0f452a1fe6cdb315337ff62454
MD5 ee0dc39224ee3a83d2614ad3a74e40d7
SHA1 d1dc80668ca5e2d7581c47322eeeb01d54dcb2cd
SHA512 f8889b6fd29f57b1486635298b5123fbcd012546a2a0dc4905ea9a9d06e7a8b8d9448f73a96493ac4de79cbb02fb956d407c6a81d6e858bfd897bedda0e80428
SSDEEP 3072:A8LQsTELHAX5BRK3VLsHD+I8rjbdFE59VEB/yDP+:A8LQsTELgX5wuT8esD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9075

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA GetProcessHeap SetEndOfFile HeapSize WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA GetLastError CreateDirectoryW GetVersion GetShortPathNameW CloseHandle SetCurrentDirectoryW MultiByteToWideChar CreateFileW GetModuleFileNameW WriteFile FlushFileBuffers GetModuleHandleW LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP WideCharToMultiByte GetSystemTimeAsFileTime GetCurrentProcessId LocalAlloc GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA RaiseException HeapFree HeapAlloc GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind ReadFile FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount

user32

SetWindowTextW SendDlgItemMessageW GetDlgItem DialogBoxParamW MessageBoxW EnableWindow SendMessageW SetDlgItemTextW FillRect LoadImageW PostMessageW DrawTextW IsZoomed FindWindowW SetFocus LoadIconW SetWindowLongW EndDialog CreateWindowExW GetDlgItemTextW

gdi32

SetTextColor CreateFontIndirectW SetBkMode DeleteObject GetObjectW ExtFloodFill

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegEnumValueW

zlibwapi

unzReadCurrentFile unzOpen unzCloseCurrentFile unzGetGlobalInfo unzClose unzOpenCurrentFile unzGetCurrentFileInfo unzGoToNextFile

SkinScanSKS.dll

IMPHASH 7e64d514a54cb97dd5206e77586fc109
SHA256 6a8c068275988cdc2543c6d2d778e3b28b256f996c9eb600f58ead2184a72a08
MD5 ffe6615d289c0bb351a0e653f47ef343
SHA1 bc160f381d7728cd5c2df74cab541076f8173ad7
SHA512 1ddecd9974fc4f07256fdc9bfa41107469cf21225ad8063156fbbf2f76844155e14d06167a3312f4ee2f613361ae43567aac7299ee9ca6fcf2f6dd21534cc12a
SSDEEP 1536:dlNe9qwGJWzyegWcGZrNk82R+TyWLLgV4tZmv:rNegnJW9gW7p2R+TyW/5kv
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection GetShortPathNameW EnterCriticalSection lstrlenA WideCharToMultiByte InterlockedDecrement InterlockedIncrement GetThreadLocale SetThreadLocale LeaveCriticalSection RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary lstrcmpiA DeleteCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapAlloc HeapFree GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapSize TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings

user32

CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance StringFromGUID2

oleaut32

VarUI4FromStr SysAllocString SysFreeString RegisterTypeLi SysStringLen LoadTypeLi UnRegisterTypeLi

zlibwapi

unzCloseCurrentFile unzOpenCurrentFile unzGetCurrentFileInfo unzGoToNextFile unzGetGlobalInfo unzClose unzOpen unzReadCurrentFile

Templates/Audio Collection/audio.ico

SHA256 aebf70b01e2a208a0cd8308208ba82dab8f0a7ac8d1079f0999f1403d4df8911
MD5 85513b695c134e4feae6ee4c622a0e23
SHA1 8c65ec2b38117b8778c87350ce9981b9d0d978ff
SHA512 c5352ffea720199639e7f72ce761616b669be489a86a9a5cabec2ea59eae630489f6c8f74b7a5a4c8dad455483c2007be5179b103847b3c5e64e81c9041728bc
SSDEEP 96:E9k9hqpBGVN20u7WM91sIRU1u32yLprlRk3eXPWrQE2qHP1r2huSgm2UHrsXJDux:YOhqfv3nUtsrlLWrR2K1r2hmUHrS73az
MD5 SHA1 SHA512 SSDEEP

Templates/Audio Collection/audio.tpl

SHA256 af93d053a721c05e72554c235380c8cdafd6cfa5765eaf5519bc88720078a665
MD5 ac3f4114ac2e562120fda743f5bf3b45
SHA1 23d18467dc639aad3a1118e6166c1e1334dd6748
SHA512 b1030b11e3f9563e780ad7ffacd4eb059001875ea1d0e548a3ac3b95c6293d7958c916bf140d47e1a7e9c6217881b541c65b77d12bbdfeba2ea3fd645b3e0ae1
MD5 SHA1 SHA512

polyglot

Templates/Audio Collection/audioCollection.xml

SHA256 ae7d6bbf3a314fe8f3cd60a7e523fca90e35d218123a9860b59e0a63dca5c993
MD5 b6d87d1ef848dd460aae8f5e4db90d2e
SHA1 db41fa6bbb967ea7b840dc418a19378e1ae0f411
SHA512 b4f3a52b35c9f3ceaeed7eb3643a67e3164688875844f405cdee12dd6047e0f14db78ed180e2788e9b063bd937145411bdda9f9fe14ac3cdd61511235ef6efb2
MD5 SHA1 SHA512

Templates/Audio Collection/audioEven.tpl

SHA256 8fa3df5a0dbe4e12749ecf0a42551ffeeb3c1407ebf66a845da95b74497a30bb
MD5 bbfbbf2f19e2d5b483f2dd6f6917c90c
SHA1 8d271873971a365aa780802fc3c415e25efa5184
SHA512 41a7bc13eb7f64e2909130c632345adf8e9d80fad4928cf519c6e4d0a1d2b2688e0d6e94f1c8c8645c96332ce6df84150618af0891114c990b928231114596fc
MD5 SHA1 SHA512

Templates/Audio Collection/audioOdd.tpl

SHA256 f70b45acd483b0e80fa584c372a0033f2d89832b5cbb82f314a83846ed641b47
MD5 2286a0201b83c1485b755fe04aac5504
SHA1 9aed2fc0d951e0c38ad4e9d1feb14c5ebef6b758
SHA512 559107fb8e752e2faeb54573496eb4fac198909ca9f3ceb166304acbb33cecbefb487dc6de2699f28252ad88792fa2c08631849d38331676945ceeecdc735a1c
MD5 SHA1 SHA512

Templates/Audio Collection/bar_off.gif

SHA256 a2f0b8900a8036f521ace51a2dc2b71409c1d1ec6d6079da1bf38bbc524e22ab
MD5 52a20313b0b2c55b8610a2a359f8291a
SHA1 594c83e7aecbc506553e7f208a1ab6c8a4fb2dd9
SHA512 802969fe50962b68cc2c42b7212f027a2fb33e664b24d4fd806c1f98c5fb9655d6b9293680edeba89ecb117a55f443a54ca79112eaed161839a7cb398c4f451a
MD5 SHA1 SHA512

Templates/Audio Collection/bar_on.gif

SHA256 ff2251c37dcb9bafebac71c25ded83014c3f0134c8a851da53b31a1ad7742d09
MD5 17bbcbc2f764b7dc341c8b2af03f5015
SHA1 98737b4abc5fd70bdc97e7fb728be165be763052
SHA512 e785fbe0698efe45a6e1b865f013b04e7ac8f89de19cada6b30f3fbe8ce4b1959126e82068e520fc0439e2facdd9f6f770fc1bcab8381469c4d226a9a839143e
MD5 SHA1 SHA512

Templates/Basic Collection/basic.tpl

SHA256 fa74e4cbb6a83cd3bd602eeacc7e9947e4a0e74fc121176626375645e6973995
MD5 d47def92a7c55a3fbb30533667f38456
SHA1 6a30f65e902b6f8e4d572cc0725ffb8068df3708
SHA512 47e4aaa943ba8f0078592c63561fac028702fb498ede3cac3f565e4d8c0f6e2c9a86cc3cdac7f7ef35e11af398ac11f493abbb63c5c95d0183d89b4d0c8d5b77
MD5 SHA1 SHA512

Templates/Basic Collection/basicCollection.xml

SHA256 40e1718a21a9c9a9c1538a40ea367561c66c3b1ddb2a2ed27bebc15f41fe62b2
MD5 2dbc3ad5c8f284d023bed7332087d7f7
SHA1 b1a71f2a366dc6938928c5d304314bb3da242c42
SHA512 352ea122d00928c763a432c8996558f85e0d9f90cd9d3ddda9487f63656d009b3fed043356a2cfd2cae915fe30f9d97deceb7be96cbd9d7463bf031a5c0df8b6
MD5 SHA1 SHA512

Templates/Basic Collection/basicRow.tpl

SHA256 09c631bf98f01c97daf40eacfee168ec5e2dc159ea1e7cce583a4c653332d074
MD5 b2a9bd66c5b36f4387e261140574341f
SHA1 c4b0323bb5507fcdf59e4be50a0c4b17e8bac305
SHA512 4c00d0b522d00a614c6d85a090fc4a082028fd3e2cf5ff8db3fd96a4b4cf31332e050ee8ba831cbe3866103abede9efb849a513ad923df4b012d7654afe43ffa
MD5 SHA1 SHA512

Templates/General Purple Collection/GeneralPurpleCollection.tpl

SHA256 d8074731e092251d4b8a6c07e3a50245985a12d5d226699253d988ef0e62f24e
MD5 8c2de611674217a29ba72aa61951f6db
SHA1 cab1cee1d537c1f4503cc01d1395b430fba63188
SHA512 a8c9249c8a9714714cc48280018167a75f2a4c70b79c3a19b20d5d6e05a03acc659855621a83f63bf0c5bb70ec25183cb49c8c4b1e8befb6dadbdd3611504bf9
MD5 SHA1 SHA512

polyglot

Templates/General Purple Collection/GeneralPurpleCollection.xml

SHA256 c724a6f48e4a1da4e6b9f4d3277cdfcdb51e03e854fa86160e37149d67c32e84
MD5 292cf90ed6f0a78211f6e34fd137473d
SHA1 2a65f60a927b389a9f3087564a7d0e72f88abe7b
SHA512 5ec5af9c7951ab04ba42ae721436407c2c560dbfa0d4ee43849cbfc2228a493bd5c555b78a3ed6516fc85b00df2312bcf1404849be7c4a7f5ecb551c795477b8
MD5 SHA1 SHA512

Templates/General Purple Collection/GeneralPurpleCollectionRow.tpl

SHA256 3176ce60bc56569a6c92551fd6a1526398a7cc36049b7c276878daeb6bff1ffe
MD5 33036fda184cea5e0287a11770cac659
SHA1 8f91e44f630b7e54232cb5422838e0454b7fc928
SHA512 194571857dd70b6234a4a87c52a494fd47f66963c66623b2637fbc7f535f8f049dbe9ae8f5b008772ed674ec011ee476471c174307f282b0e9e8c9e32875db8e
MD5 SHA1 SHA512

Templates/General Purple Collection/bar_off.gif

SHA256 a2f0b8900a8036f521ace51a2dc2b71409c1d1ec6d6079da1bf38bbc524e22ab
MD5 52a20313b0b2c55b8610a2a359f8291a
SHA1 594c83e7aecbc506553e7f208a1ab6c8a4fb2dd9
SHA512 802969fe50962b68cc2c42b7212f027a2fb33e664b24d4fd806c1f98c5fb9655d6b9293680edeba89ecb117a55f443a54ca79112eaed161839a7cb398c4f451a
MD5 SHA1 SHA512

Templates/General Purple Collection/bar_on.gif

SHA256 ff2251c37dcb9bafebac71c25ded83014c3f0134c8a851da53b31a1ad7742d09
MD5 17bbcbc2f764b7dc341c8b2af03f5015
SHA1 98737b4abc5fd70bdc97e7fb728be165be763052
SHA512 e785fbe0698efe45a6e1b865f013b04e7ac8f89de19cada6b30f3fbe8ce4b1959126e82068e520fc0439e2facdd9f6f770fc1bcab8381469c4d226a9a839143e
MD5 SHA1 SHA512

Templates/General Purple Collection/icon.gif

SHA256 70d4287f742cfb5f129e40622c1296ff015cad16c2791cb24aafe9125410a392
MD5 f5e126f830d21d2e10cade419ad7ec57
SHA1 e1ba30930c49ffbc279a764d73f7bdb462bb79a2
SHA512 59d14a0aa30d5266f559daf5bf4457a05c89381a8af6442f17483f9ee7b4b2a98c54de2c880b6df1472d530bf33b8971e5803711338ca608b7a913786dabb2a2
MD5 SHA1 SHA512

Templates/Video Collection/EvenFile.tpl

SHA256 ee6bcc5d965263fcace35c10153a814b99277f1d88224951c588319b07497c9e
MD5 b5be70d77898fb3ccfd7fdfe23309322
SHA1 c713e80f9b372b8ebc2061becf049506121edcd8
SHA512 b6bfd4f0fd9cd2ae75b364a541257917067df800fa4919da5171a569884778c966ebbff7c651b594798c09513d91ac61c095be884f4f961f44a8f1e24196fb11
MD5 SHA1 SHA512

Templates/Video Collection/OddFile.tpl

SHA256 91da275ed40a3718a2686a453391818fa9a22f4206625c451f08789bde8ec4dc
MD5 591b4e7615bbf8c06ac8762152572236
SHA1 490b8cf305bdfdfe78b4a0a365b7b32c598d3188
SHA512 ec27af5cb39157220b598a2844a131d2d66070f91d7d4b46523f41c473ec470a322212c89098f30fa419211bfad0c6ca2b21309e5dad65abaf080214bf98b1db
MD5 SHA1 SHA512

Templates/Video Collection/VideoCollection.tpl

SHA256 a9424bbf9ded0e8bb27746525b0667c274697a90aaadc88060dfe56f50796abe
MD5 3cb435a538f182ccfc72163e668b5d61
SHA1 0d1505f29d13804b2ed834dfd3bc54393f22d9ad
SHA512 bfde72e327bb216aba47d13a8b8407c369805d1556b5d2e9d3869a2c53c5ddaf033fdb65aec067891bbf537c78f014f079d04bff00fd958dd6a4efc7df29856d
SSDEEP 192:SeBOWfihyMVY8znu7kGJlsrKgS5VSqflXt/19dfCRdYrOqRWCNYo2qpdMibRUiHI:SxH3D4sO33Sqfl9N9dfCDYrjRWCj2eM/
MD5 SHA1 SHA512 SSDEEP

polyglot

Templates/Video Collection/VideoCollection.xml

SHA256 3e0612b91e0a2673ca65a59bd8275914909fee9d7212d4c1251b5b27bbc82619
MD5 02e387cfbe65b9c86c055f8e56ccb6ba
SHA1 fb5c423318a013d284a8b44c007468ebce990efd
SHA512 3cadc7ac632329da5c522b70c9e77c0957aa1949c478ff1fedcd2debd46656c81d060cee2c12cee9cfef1e2065bbf1db1fd21ce5f1963dd2c9793946af713778
SSDEEP 96:DRvSC7h1l2Imv3x3OkOWkpLNvx5wWJTLuztkJA5huBdu0P547XhPKZdM7J08J8uT:DRl7hL2Imv3x3POWktaqTL8MA5hGxOXX
MD5 SHA1 SHA512 SSDEEP

Templates/Video Collection/images/Screenshot_Part.png

SHA256 1abec4def4914421f46922dfcbcd1f0293270e6dd40b73ec6643436719ae7a21
MD5 4b9f8f0bdb0f64b34228fce1e8ae7a87
SHA1 5d28aaf3a8d602dd650a2c4c8ab94d23de90ddf7
SHA512 211e3dadd0a610e9f5cc68d9e9c70782941d47fc8e16894b3cc06c638fdd8c603d339ec1b39623b778cccecb51a2e46c79c5667d1b10c3baeefe612d594d031a
SSDEEP 384:XbDyn/pnw8txGY6F1nSsN+M0QIqwsoCCUciYVdQQtlsE6Bl3us1gsuINryHZLkI:AdfGk/ZwoCCUXOIbrAMyHtkI
MD5 SHA1 SHA512 SSDEEP

Templates/Video Collection/images/Top.png

SHA256 8a8cf59f36d9b856cc3c3333bd5f1e7b50c802415f0051863b3c550eaf0cc079
MD5 3409981151c376bf4eef0e51da926e0b
SHA1 dcf54c18417aed0b55db04254425452f676e4045
SHA512 ada2cf76ae3bd1596a4a89c1218e15f325beb7f8fc8db58de2a924cc49455c73ccc540f4501dd5c38b0f4e54c942047f60dca55d3a0e026f982578cf8aeaecb6
SSDEEP 1536:ukHbxNAkLmAx441AikbcuU6KBVgbO3jMIivgp:j0NAO41lVBTnYtgp
MD5 SHA1 SHA512 SSDEEP

Templates/Video Collection/images/bar_off.gif

SHA256 a2f0b8900a8036f521ace51a2dc2b71409c1d1ec6d6079da1bf38bbc524e22ab
MD5 52a20313b0b2c55b8610a2a359f8291a
SHA1 594c83e7aecbc506553e7f208a1ab6c8a4fb2dd9
SHA512 802969fe50962b68cc2c42b7212f027a2fb33e664b24d4fd806c1f98c5fb9655d6b9293680edeba89ecb117a55f443a54ca79112eaed161839a7cb398c4f451a
MD5 SHA1 SHA512

Templates/Video Collection/images/bar_on.gif

SHA256 ff2251c37dcb9bafebac71c25ded83014c3f0134c8a851da53b31a1ad7742d09
MD5 17bbcbc2f764b7dc341c8b2af03f5015
SHA1 98737b4abc5fd70bdc97e7fb728be165be763052
SHA512 e785fbe0698efe45a6e1b865f013b04e7ac8f89de19cada6b30f3fbe8ce4b1959126e82068e520fc0439e2facdd9f6f770fc1bcab8381469c4d226a9a839143e
MD5 SHA1 SHA512

Templates/Video Collection/images/bg.png

SHA256 9fd1578f6c16709b84e2cd0cd86d947a46ee3a94036949cb356aee6ccff940d6
MD5 cd640a94f90b4d97978c91c4b9d77ae0
SHA1 6db724cd630d4626e459265a7604737309bc5502
SHA512 0740766dbeb9d43661a15eccadb14243f8ffcaaafeca4e20d517a78161f21617444d5d31d6b6cac4899ba65823837659348688e787ef4fee24c9e29f2da55f27
MD5 SHA1 SHA512

Templates/Video Collection/images/res.gif

SHA256 4d1b015ef9b0d6a3337d3b4780bc94ded3b9ab3f52560cc4469810987a7f53fc
MD5 c7e724801e03bdb18beb3027d4bca260
SHA1 9adb76eaff80e39c3cf60bb5d2015f32c46469ad
SHA512 e27e9aaaca3d82065090c784e6f8f9c1b80e66b495b33c1472427697d6f867ae239ceaa04e9acb5e4cbc095b81ed4addb7e4fa8876adb034624c1dd11d4a4171
MD5 SHA1 SHA512

Templates/Video Collection/images/top-tile.jpg

SHA256 cd70e5256a20171f31c607466be90c96ebae5ced907ddd7bc35aee274a7bd678
MD5 3de0fa9a21e569ec5e9d3040426dd765
SHA1 90dd6f46a929356631a91179b60957e8be6054bd
SHA512 d62dc01e0a9876f2b2cf8db7e2871fc6b399b6295fa6fbb2947ffeadc09219e26e68183220aabb8d3c516c94582c273c16a693254c892208f06d9aebe82ce67c
MD5 SHA1 SHA512

Templates/Video Collection/video.ico

SHA256 727882deb14d1bbd59fe58929091b578384938acb84ad2595ce967fa62cd9b6d
MD5 ee6f5c5364414264cbd6471248e6fec0
SHA1 e87794b6e5067aa94a7220e0f12d294a46c4b724
SHA512 8428b7c2081047d921511847baa89426e558279e430aabb09f8d20785516707d8e3a18a6fe1a9a9c32df1552f3713a41814a0e8a5f5e88f130352526a98dddc7
SSDEEP 96:3Ji3nSc6K0KSy38qlQcLZXlFIZqQNWZjrY8C6soib4JzIgqtBdC2wWZfD7kQCokc:m96KMyMMZXl2qeWW6lIYzXAdC2wwH/gA
MD5 SHA1 SHA512 SSDEEP

TorrentWizard.exe

IMPHASH 3b5264952705f2f1420c184e16196880
SHA256 714a6e80e7c3eca4f388fda2861b8215cf2c472b5787e1d01e43a36ddb35323c
MD5 d998a57606b66331d514e6b9ac9a2470
SHA1 cceba458cf05ffe44e41cbf95fe10f92d2304d70
SHA512 cecf2a47a7abab3def5d2f8e71afbe038941f7603aff37743eb3bc71674a4d67c46a8ab3683d5fb8e3b32c0ee1dff739a538d1bff2c4269c941df3e90342dfd5
SSDEEP 6144:CGd/Y8ECafU0Wq6QoxFyLpbD8nCC3UYa1kqGZTJgn:jafOxFyNbD8nCANOGZTi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

92385

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

hashlib

?GetHash@CMD5@@QBEXPAE@Z ?GetRoot@CED2K@@QBEXPAE@Z ?GetHash@CSHA@@QBEXPAE@Z ?Add@CMD5@@QAEXPBXI@Z ?AddToFile@CED2K@@QAEXPBXK@Z ?Finish@CMD5@@QAEXXZ ?FinishFile@CED2K@@QAEHXZ ?Reset@CMD5@@QAEXXZ ?BeginFile@CED2K@@QAEX_K@Z ?Reset@CSHA@@QAEXXZ ??1CMD5@@QAE@XZ ??0CMD5@@QAE@XZ ??1CED2K@@QAE@XZ ??0CED2K@@QAE@XZ ?Finish@CSHA@@QAEXXZ ?Add@CSHA@@QAEXPBXI@Z ??1CSHA@@QAE@XZ ??0CSHA@@QAE@XZ

kernel32

TlsSetValue LocalReAlloc TlsFree lstrlenA GlobalFlags FindResourceExW SetErrorMode GetStartupInfoW HeapFree HeapReAlloc HeapAlloc GetSystemTimeAsFileTime RtlUnwind ExitProcess ExitThread CreateThread HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter TerminateProcess UnhandledExceptionFilter IsDebuggerPresent VirtualAlloc GetCPInfo GetACP IsValidCodePage InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA SizeofResource LockResource LoadResource FindResourceW GetOEMCP WideCharToMultiByte GetVersionExW GlobalAlloc GlobalLock GlobalUnlock GetFileAttributesW CreateDirectoryW DeleteFileW CreateFileW GetFileSize CloseHandle FindFirstFileW FindNextFileW FindClose GetStringTypeW GetLastError InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetExitCodeThread Sleep TerminateThread SetThreadPriority ReadFile lstrlenW WriteFile GetModuleFileNameW GetTickCount LocalAlloc LocalFree GetProcAddress FreeLibrary InterlockedExchange LoadLibraryA TlsAlloc RaiseException MulDiv FormatMessageW GlobalFree SetLastError GetModuleHandleA GetModuleHandleW lstrcmpW CompareStringA LoadLibraryExW GetLocaleInfoW lstrcmpA EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThreadId GetCurrentThread GlobalDeleteAtom VirtualProtect LoadLibraryW GetCurrentProcessId GetVersionExA CompareStringW GlobalFindAtomW GlobalAddAtomW FreeResource InterlockedDecrement GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW FileTimeToSystemTime FileTimeToLocalFileTime SetFilePointer FlushFileBuffers GetCurrentProcess GetFullPathNameW ResumeThread WaitForSingleObject SetEvent SuspendThread CreateEventW InterlockedIncrement TlsGetValue GlobalReAlloc GlobalHandle MultiByteToWideChar

user32

DispatchMessageW GetForegroundWindow IsWindow GetClassLongW CallNextHookEx SetWindowsHookExW WinHelpW SendDlgItemMessageA SendDlgItemMessageW RegisterWindowMessageW EndDialog GetNextDlgTabItem CreateDialogIndirectParamW GetDesktopWindow CheckMenuItem EnableMenuItem ModifyMenuW GetMenuCheckMarkDimensions SetMenuItemBitmaps IsDialogMessageW SetWindowTextW MoveWindow ValidateRect GetCursorPos TranslateMessage GetMessageW SetCursor GetSysColorBrush LoadCursorW DestroyMenu UnregisterClassW GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SystemParametersInfoA IsIconic GetWindowPlacement GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId GetLastActivePopup MessageBoxW SetPropW GetCapture GetActiveWindow SetActiveWindow MapDialogRect SetWindowPos ShowWindow GetPropW RemovePropW GetAsyncKeyState GetFocus SetFocus GetDlgItem IsWindowEnabled PostQuitMessage GetSysColor EndPaint ReleaseDC GetDC ClientToScreen ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetParent GetClassNameW GetWindow SetWindowLongW GetWindowLongW OffsetRect GetWindowRect LoadIconW LoadBitmapW CharLowerBuffW UpdateWindow GetSystemMetrics GetClientRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard KillTimer PostMessageW SetTimer SendMessageW EnableWindow BeginPaint

gdi32

SetTextColor SetMapMode GetClipBox SetBkMode SetBkColor RestoreDC SaveDC GetDeviceCaps CreateSolidBrush BitBlt CreateCompatibleDC GetObjectW EnumFontFamiliesExW GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject CreateFontW

advapi32

RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegOpenKeyW RegEnumKeyW RegQueryValueW RegCloseKey

UpdateApp.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3012adea80c90e5fabb0dc794d6bd0bd6a8be1076d2a7381c56af952bc750be5
MD5 dd3f55f51b18813dcadf40b2690bb9fd
SHA1 81699d1641af3e2218350f9d26feefc8c2dcf991
SHA512 a2de0aca5e53dd15a5e69283bce285d5d36f1e5d0af08965437ab90a0e2cc33e9bdf7d3fa79984f47b925cc963a35156bd232b915b987ee3c2785a8d960df40a
SSDEEP 3072:DOtBlrzu2WI0OHzHtBlrzu2WI0OHzumg9ytBlrzu2WI0OHz:Dqnzu2WITnzu2WIc30nzu2WI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

232606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Work\Visual Studio\UpdateApp\UpdateApp\obj\Release\UpdateApp.pdb

VirusTotal.dll

IMPHASH 72689afc7a839b4c650817c72431ab75
SHA256 eb0cee158ecc426a7c710ddb6ed35383a7ff5a6a8b382f4a17b0f7e1de9a434a
MD5 344e5769ad29e7c920d9becbdc77ffaf
SHA1 9052277543f09be9d28f7827352c3d2c4bad08cc
SHA512 075d35a67ea26cba14e41b5b8817fbba361b52fa8223879b032a06a964d01f6a7f9a179e036887a840214718a3ea68af67891d7c3070eba7a78230fa100f8cdb
SSDEEP 1536:7U8peo/XjylF2Jw08i9GZkzY/z1fq+aydqGPt4RpzldGM95C:7U80AjyKJw0Z9GEY/z1y+aydqG4jN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

19844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindResourceW LoadLibraryExW GetModuleHandleW GetModuleFileNameW InterlockedIncrement InterlockedDecrement InitializeCriticalSection LockResource LoadResource GetThreadLocale SetThreadLocale EnterCriticalSection LeaveCriticalSection GetProcAddress SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW lstrlenW FreeLibrary FindResourceExW DeleteCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount

user32

LoadIconW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

shell32

ShellExecuteW

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoTaskMemFree CoCreateInstance

oleaut32

UnRegisterTypeLi LoadTypeLi RegisterTypeLi SysStringLen VariantInit SysFreeString SysAllocString VariantClear VarUI4FromStr

Vis/VisPluginSample.zip

SHA256 95e28ef6b5a9a693a1ca8f32e00b81fa5854476296d7ab7cd783f2ac9aa4eb32
MD5 7c1ad3ae386448063b1a6d0f1045e70c
SHA1 1e5126d7c0961d7184a05257c5ba805790a7c78b
SHA512 381a263be1efdfbd8e1107c1f210712e744b3f7e49f68fce25970667294927723f010d4c98e6c384835105094f445ed5137e0669bb878219464cb5d6c9ce68a6
SSDEEP 768:Xk63Ud1K7PMo/dAQLO6140MuQ6VpGBrtHERJLtB/:0kUW70oKcxrMn6VpGBrtHwz
MD5 SHA1 SHA512 SSDEEP

Vis Sample Code/SoniqueVisualPlugin.dsp

SHA256 c0361f04e374008410c8766b0eeaecb89b87a8d6a5193df686613830854d596b
MD5 f014c4eb892b57c3f0ec8f336252c682
SHA1 4154c5b95503034cb4875153fbb63efe80073c31
SHA512 2802a1aa1202b1769d80b777da11530097f224aa849463ded09b872c3c666a338a8d913eb0f69f8bb80ef7e22641cf15639895114f31dd7c1fd890e061efea73
MD5 SHA1 SHA512

Vis Sample Code/SoniqueVisualPlugin.dsw

SHA256 f13dd59df2ed47eae3d078e4b93199fd878d091c7ff145e064e3eb194bd357e2
MD5 3e811d16729c077b2d60c609a4feca15
SHA1 db7dc3ab980a579c0b2844cbde3c6f67ada06186
SHA512 f748037a33242098daf87fc598c1eb527de45916af58c61ed4f68bf29603893bb786d91332e77bfcff24072a6e8d0603ce6c069ae79f50b97f4d143ab5e32663
MD5 SHA1 SHA512

Vis Sample Code/SoniqueVisualPlugin.opt

SHA256 fecc5af596a54b7a9e2c188d9a1607db46e99f8cfca51e2de9836d0e39af9185
MD5 1140666c20eba37b5297b284ab7c300f
SHA1 49b070ba52fe19a53f20d76d07167fe333bda377
SHA512 d935718c2831d2a1b08c5607bfe1e4f2a3a425e5a659818b83eaaea7a0a52dd15f6b7e3921fe78b24f590f4dc4182794a9d7e0a1612532ab2af07511afed7cfa
SSDEEP 768:ESLUR5tSLUR5fSLUR5sLUR5Rp5EkWyLUR57p5EkWyLUR50p5EkWyLUR5Fgp5EkWt:nLDLhLbLULeLrLdLyLR
MD5 SHA1 SHA512 SSDEEP

Vis Sample Code/SoniqueVisualPlugin.plg

SHA256 a3801a3be659c668afb65c955bb03579fcf04c9114bfbd4cf1da0595b994c5bd
MD5 82d45e047fd39f205d0a312d9f1bb2eb
SHA1 d1c2f6542455f600f66e7329220fa556933d6fe9
SHA512 24c64b4dc2eae970b22edd478a7771e70aaf6e7a5b6bad1c29321ffe7f8952573776b1a81ccc0ccab0d2eee31355a5610ac57a1e209b2a712dbc66aa8521faf8
MD5 SHA1 SHA512

Vis Sample Code/SoniqueVisualPlugin.sln

SHA256 3a33d88540e1d5779cb91671551ab99434c6c166506647abca08790cecf683ab
MD5 4e7b66c6acd4235a0f292d6fb7b6957b
SHA1 1f1d14d48fb21b2d478c0f87c41f92424a242c0b
SHA512 f4b3e51b373af69543469172a507c45abca6321b38668b80d21964f54a2dfa0973ec33f4102d0a85708d985f0295641caa7fb6b139db61596eec0e47a2f2f9aa
MD5 SHA1 SHA512

Vis Sample Code/SoniqueVisualPlugin.suo

SHA256 16dd9fb3a8b933a46547c3cd01e77d2801ed1a7d39484382a7604b205784768d
MD5 27fb28a0f9e16ba89de09a890ce5efcf
SHA1 44ad85503f980633546d3d29441ac16a068a897a
SHA512 ddd4ff79cfaf97581b7613bfa0835e203a98f38b15d9e087b94f8b2a1f070daa9cf2270d36e037f2ea58d5b2581b2c653b4dd953e8cf777689a52894471e3c68
SSDEEP 96:BU/OWExiyVJcP2JxMKSM2M1R/2e85Op1T+NE:TyyVJq81T+NE
MD5 SHA1 SHA512 SSDEEP

Vis Sample Code/SoniqueVisualPlugin.vcproj

SHA256 3828e38a609e980325a06a2b4655bd9495c47a46ef38c07cbdee7e02dc5c347d
MD5 58715bb23815a9ecafee33fc59b9393f
SHA1 3e8180431cd7884969f59969058903a9ff80082b
SHA512 095383a8475d37a8fbff84c70a9fa81346e65a5664f7ae8f006b465079c1c50dd3d93eb9c05da89d212db53decca3eed2783d26e65f6bb9211ca648e73bf5d0a
SSDEEP 96:SJlQEEzKIFcipf1817QQEEzgKzzu4TmcSupD91UbUi5w9bI4:SMEOj6ipdM7BEOggzu4TzSupDzUgi5wt
MD5 SHA1 SHA512 SSDEEP

Vis Sample Code/vis.c

SHA256 e1e5f3e30a25fc0b60b0cfe7d1d51ca7848f4739c31ef6dc731e7bdfb3bdda77
MD5 9ee36b5867e7681389e91544b6ef0ef1
SHA1 8dc66d0c04d883510d10263f0b1eb1579c0c3607
SHA512 065ad20f39f701200f02668f77e71c45988a3ca5b5b3143fe38f9b0124bf2046ab10ca5dbeaf4580f0bac7bcbd1e620f02309b2861bb1bd1ac0b55b61942a50f
SSDEEP 96:2COYV1CZXSL8L3/kNPfzKM0r3rYK70afS2h3Mc3kUUXTrr:2COYVsZXw8TsXzKX70H2UUUXTrr
MD5 SHA1 SHA512 SSDEEP

Vis Sample Code/vis.h

SHA256 8e325d69f07919a769c22801728d0204d26231042831b3f6e6aeea79397715c2
MD5 eb6c5117a4f1bff5aa19a7738acce853
SHA1 95f0a214c9862943ec4949d7607896479d3e04a8
SHA512 354a2325411688c75e7587e7ede1a2ec67721db31cf1b0ff5ad056d42e1472161e85b373c3f3e2eb450470cc73a1d4a52eb0096be525e145172db3182d884515
MD5 SHA1 SHA512

Vis Sample Code/vis.updated.h

SHA256 6eb01937ca3e9eacb5edc8f2d510907120ef7adc256c456d39850a67248e9057
MD5 3a419f9523fda8074fa982cbe8432b1c
SHA1 6b7488a407af5d93134e4e3ae16e4f1a059312d6
SHA512 742b03ef1a084cecf72c47438af794257cff09ad42560dd23b1b0805419794d3c6a54345d56702ea4d158551b342632744b1ff632604d3ab6f1fb3d09fff7359
SSDEEP 96:khk1Fyhdg5rw7GPREaJhrr+2HWBAkPG/QTsolDK:khOJEa+ZAk+/D
MD5 SHA1 SHA512 SSDEEP

YellowFillDemo.svp

IMPHASH d0b0ab81bf0e4cd20070f6525db9fd67
SHA256 4a6995984872f31850dd8d987bcf484d3edf8293eb00259865c3ba4dd182d7d1
MD5 f140b7ab6297a6b5ec334f871a9aff50
SHA1 cd102cf1f92af486f22a7ce4757e4d4a571f8daa
SHA512 11d1d4da1ed4a4bb774570dbeb8728813953ca33d21f01b851ba4de9746a4b24f5432dc1f3bff78af9e7133fd5f7105cc61816f8be2b9aa471d42a3fb6766b7e
SSDEEP 768:iiW9UoiPvvDB6NCGUQGtxxo0oQ/01GTMRbdB:iiW90FBQexSFFRbdB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Vis/license.txt

SHA256 b3a0789ed4ab8e746868e70846d73b79ba3639a7419fe0b0d1af50bf26e87bfd
MD5 a07e33ab884ffdb28c76cfc9b83529f1
SHA1 4853ff43320e8c1d45ea4613fd6611a4d8054fbc
SHA512 615ff2e2ac3890ddc4e1a56f67a20f18c1b2cef18b8ba732a6965207f5146b0e1b53c38f0cec0b966c5871fc96e2b546a7bdbba8c8f4df8af130555f59fd6a37
MD5 SHA1 SHA512

Vis/phase.svp

IMPHASH 8a4944c5d51a5ac58494fc1da9234c37
SHA256 0c900b1d8c29087cf0fae060d18a28669891af6fb4726398d5729619f0a60a60
MD5 e3e94eab295c8ace580113f13c9ef11b
SHA1 1747064490b4b031b4e6d760b5f25c7d7a5499c3
SHA512 5d1e7ccbef1765437c356b7f2f9148d584efbdc8b07a377ee56522b64abc4b42db0f396bbac8d6647c4b7559117c36e2a93ac9cad406c3e45ad99db837d2f319
SSDEEP 1536:i1asCLNAK6I/vii8lRAeJLixQdL02TNP+Op1xHow2U7ggKmcM6oX0WEoGtI:i1XCiKLslRAeJYSjPj9VvH6o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

53858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Vis/pulse.svp

IMPHASH f180c91d6e38f45e6b462ebd41624946
SHA256 99b989409d279195d2194a424b3c832f82e601ad1e3a51acd5908e5298991f3a
MD5 a393352d09827a965492aeb857b670dd
SHA1 9f543da5d1cb4a29c71c2b55713f8568d9524447
SHA512 18410688e2fc61462831447a3e6a8830e78651bf5ea231ff68a31b855f8cd48347a66a8d3472d823c572b77a2f32c655f1b2a213508a6dbee9ec9bd436506699
SSDEEP 1536:RtdPfDMBPRQkNW0kPtT9hqoPdwoH/Or9XGoPt9oWRBak7:RHPfDMxW0kPhqoboWol9oSa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ZIPBuilder.dll

IMPHASH 7d209872283662af34ae1cc99ea0b08c
SHA256 032f9982ce779149c2d8759221525f0fac6f687e6ff84440f3ea630dd2af8605
MD5 409119a7e4176045a36c4d3234b35ba2
SHA1 8d749576417878af8639bfb645e1f68cc48d2d86
SHA512 1b0aa9a048e13ad93000102b46c8708e6614f551b5981ef5948c29d0d7cc31d83bf7c103f1d54d0d8905a82ae6d811b70f105e47670500ff14828c7ba5c6f70b
SSDEEP 1536:RzPxuPQrAI87RmRmbqEeCk/IB+6nC09op4uVB5:dP0PQ0fRimbqEMIB+6nC6Wv
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

22075

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection GetShortPathNameW WideCharToMultiByte EnterCriticalSection InterlockedIncrement LockResource FindResourceExW SetLastError GetThreadLocale SetThreadLocale LeaveCriticalSection RaiseException lstrcmpiW GetModuleHandleW GetProcAddress lstrlenW FreeLibrary InterlockedDecrement DeleteCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA

user32

OemToCharA wvsprintfW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr SysFreeString SysAllocStringLen SysAllocString RegisterTypeLi SysStringLen UnRegisterTypeLi LoadTypeLi

zlibwapi

unzGoToNextFile unzGetGlobalComment unzGetGlobalInfo unzClose unzOpen unzGetCurrentFileInfo

bzlib.dll

IMPHASH 064643785ff11a43d6c3c84e76877593
SHA256 78e622fa64a88ab40778dd6ceeb16aacbc4d7fc3d5ef223491bc927feb192deb
MD5 6918d1e158efc7e6acfd606662453bfe
SHA1 b2239db2c647077d9218eb8b94f1868b23bb0267
SHA512 9399c92bbdab21db6709810eac27574c3164430c182ca998389219f4b4eba07d2b6b095968e157f6a90176180f312d342bf66099c6911c22f9afe9c38d5b2a83
SSDEEP 1536:x9FAKMtncp1n52pNIx/we0pJMyNm441c9bxbmiYNFUnoKY+IR++/8+dp7v:bFRMO5dPc91bg7QTIs+k+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9681

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dbghelp.dll

IMPHASH 3f5a00ef2a36f3cd8924690a5a1d6f3c
SHA256 0f40c17f2c10a5b751460a3a75e54474cc13f77ad714cd78428196d04b3328be
MD5 3a6645c125f7c1fa67c3adde279b9b6f
SHA1 1bf77d20bdbe7ba9c00326a75370e2ca70ba4a66
SHA512 2fb8db8a05bc4ce28913026a9a2440e2b244919a9a1aa738b71b3451f1748613151ec631587a387a0534bf83a93060bf30be1e3b0f09d5a0de30918174b5dac4
SSDEEP 24576:JA/40DVD9vQYvfPlhPbZA28wtdzswxeqWiZUCM2OLmoQKXIgzodo:CVDZQYvfPlhPbZ97tdKeUCPOLmoQW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

2c:60:39:ea:22:12:68:2c:86:88:cd:43:0f:e3:68:bf:49:78:c7:f3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 31, 2009

Minor OS version

1

Major OS version

6

Entry point

439441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dbghelp.pdb

msvcrt

_isatty _write _lseeki64 ??3@YAXPAX@Z _fileno _read __pioinfo __badioinfo ferror wctomb _snprintf isleadbyte mbtowc _onexit _lock __dllonexit _unlock _ismbblead _amsg_exit _initterm _XcptFilter memmove _iob __mb_cur_max strchr _vsnwprintf _errno __CxxFrameHandler iswspace calloc _itoa _wcsdup towlower tolower _wcslwr time _wctime _ltoa _wcsnicmp _purecall ctime malloc strncmp isspace _stricmp _strlwr free wcsrchr strstr memcpy _wcsicmp qsort wcschr wcsstr wcsncmp iswxdigit memset ??2@YAPAXI@Z iswprint atol fclose __unDName iswdigit _CxxThrowException bsearch _wfsopen fread fseek wcstol _wfullpath _wgetenv _get_osfhandle _chsize _close _open_osfhandle ftell _memicmp _mbscmp ??1type_info@@UAE@XZ _wsopen

kernel32

HeapReAlloc MapViewOfFileEx GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount GetFileType DeviceIoControl SetFileAttributesW CreateFileMappingW InterlockedIncrement InterlockedDecrement LocalFree FormatMessageW DelayLoadFailureHook SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetTickCount QueryPerformanceCounter RtlUnwind InterlockedExchange GetThreadSelectorEntry CreateThread TerminateThread VirtualQueryEx GetPriorityClass GetThreadPriority GetThreadTimes GetThreadContext ResumeThread SuspendThread GetCurrentThreadId GetSystemTimeAsFileTime Sleep GetVersion GetSystemInfo LoadLibraryExA InterlockedCompareExchange ReadProcessMemory GetProcessHeap GetFileAttributesA SetErrorMode WriteFile OutputDebugStringA VirtualFree OpenProcess GetCurrentProcessId GetModuleHandleA CreateFileMappingA MapViewOfFile DuplicateHandle VirtualAlloc VirtualProtect CreateDirectoryA UnmapViewOfFile GetCurrentProcess SetFilePointer IsDBCSLeadByte HeapFree HeapAlloc GetVersionExA InitializeCriticalSection HeapCreate HeapDestroy FindClose LocalAlloc SetLastError LeaveCriticalSection EnterCriticalSection CloseHandle ReadFile GetFileSize CreateFileA GetLastError TlsSetValue TlsGetValue FreeLibrary LoadLibraryA TlsAlloc TlsFree DeleteCriticalSection FlushViewOfFile

DbgHelpCreateUserDump DbgHelpCreateUserDumpW EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx MakeSureDirectoryPathExists MapDebugInformation MiniDumpReadDumpStream MiniDumpWriteDump SearchTreeForFile SearchTreeForFileW StackWalk StackWalk64 SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymCleanup SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrW64 SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW UnmapDebugInformation WinDbgExtensionDllInit block chksym dbghelp dh fptr homedir itoldyouso lmi lminfo omap srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

libgfl340.dll

IMPHASH e7c59fb74e7851c4b99a042c5673cb1a
SHA256 7a00b2c60f914205371cd49ec683c0720ac7ac90360d604def30227b4e6fabd2
MD5 edfca3d1cb2147de6ced48284932f5ed
SHA1 0325f3486204c9dbd8d8b517e8f09b3918f5ffb7
SHA512 3316b5480cb73cc33afc50bf4c6f12c4aab53bc7a742eec2994d3910bdccf0acb88cc0b42408e601b2f691ff9f9c25c57ab2adc79c6f6711514d9abf49a5638e
SSDEEP 24576:fw1Q4nKiRz4I1u2yHT1+2BlQ9hSwBlQRtGWTJbtIh:f6ZzeHdrul1WTAh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

130826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

RaiseException GetProcAddress Sleep SetHandleCount GetStdHandle GetFileType GetStartupInfoA CloseHandle ReadFile WriteFile SetFilePointer GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetStringTypeA GetStringTypeW GetCPInfo IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID FlushFileBuffers CreateFileA SetStdHandle CreateFileW GetACP GetOEMCP LoadLibraryA LCMapStringA RtlUnwind SetEndOfFile GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA DeleteCriticalSection InitializeCriticalSection VirtualAlloc VirtualFree HeapCreate HeapDestroy WaitForSingleObject CreateMutexW ReleaseMutex GetFileSize GetVersionExW MoveFileW GetTempFileNameW GetTempPathW FindClose FindNextFileA FindFirstFileA LoadLibraryExA FreeLibrary LocalFree LocalUnlock LocalLock GetModuleHandleW GlobalFree GlobalReAlloc GlobalUnlock GlobalLock GlobalAlloc MulDiv MapViewOfFile CreateFileMappingW UnmapViewOfFile EnumResourceNamesW LoadLibraryExW SizeofResource LockResource LoadResource FindResourceW GetVersionExA GetEnvironmentVariableA GetModuleFileNameA GetModuleHandleA GetVersion GetCommandLineA GetCurrentProcess TerminateProcess ExitProcess DeleteFileW GetLastError LeaveCriticalSection EnterCriticalSection GetLocalTime GetSystemTime GetTimeZoneInformation InterlockedIncrement InterlockedDecrement HeapReAlloc HeapAlloc HeapFree MultiByteToWideChar LCMapStringW WideCharToMultiByte

user32

CreateIconFromResourceEx CreateIconFromResource GetIconInfo DrawIconEx DestroyIcon wsprintfW FillRect GetDC ReleaseDC

gdi32

DeleteEnhMetaFile SelectObject PlayEnhMetaFile DeleteDC GetObjectW GetStockObject CreateCompatibleDC RealizePalette GetDIBits CreateSolidBrush CloseEnhMetaFile SetDIBitsToDevice CreateEnhMetaFileW CreateDCW CreatePalette GetSystemPaletteEntries SelectPalette GetEnhMetaFileW DeleteObject CreateCompatibleBitmap GetEnhMetaFileHeader SetWinMetaFileBits GetDeviceCaps

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegEnumKeyA

shell32

ExtractIconExW

EXIFGetDPI EXIFGetOrientation EXIFRemoveThumbnail EXIFSetOrientation EXIFThumbGet crc32 deflate deflateEnd deflateInit_ deflateReset gffAllock gffAllockEx gffCleanAndSetBitAtBuffer gffCopy gffCopyExtendedData gffFileRename gffFree gffGetBitAtBuffer gffGetClippingRect gffGetTemporaryFilenameA gffGetTemporaryFilenameW gffResize gflAllockBitmap gflAllockBitmapEx gflApplyLutFile gflAutoCrop gflAutoCrop2 gflBitblt gflBitbltEx gflBitmapCopyICCProfile gflBitmapGetEXIF gflBitmapGetEXIF2 gflBitmapGetEXIFValue gflBitmapGetICCProfile gflBitmapGetIPTC gflBitmapGetIPTCValue gflBitmapGetXMP gflBitmapHasEXIF gflBitmapHasICCProfile gflBitmapHasIPTC gflBitmapIsSupportedByIndex gflBitmapIsSupportedByName gflBitmapRemoveEXIFThumbnail gflBitmapRemoveICCProfile gflBitmapRemoveMetaData gflBitmapSetComment gflBitmapSetEXIF2 gflBitmapSetEXIFThumbnail gflBitmapSetEXIFValueInt2 gflBitmapSetEXIFValueRational2 gflBitmapSetEXIFValueRationalArray2 gflBitmapSetEXIFValueString2 gflBitmapSetIPTC gflBitmapSetName gflBitmapTypeIsSupportedByIndex gflBitmapTypeIsSupportedByName gflChangeColorDepth gflClearIPTCKeywords gflCloneBitmap gflCombineAlpha gflCompressionIsSupportedByIndex gflCompressionIsSupportedByName gflCrop gflEnableLZW gflFileAddPicture gflFileClose gflFileCreate gflFileCreateW gflFlipHorizontal gflFlipVertical gflFormatIsReadableByIndex gflFormatIsReadableByName gflFormatIsSupported gflFormatIsWritableByIndex gflFormatIsWritableByName gflFreeBitmap gflFreeBitmapData gflFreeEXIF gflFreeEXIF2 gflFreeFileInformation gflFreeIPTC gflGetBuildData gflGetColorArray gflGetColorAt gflGetColorAtEx gflGetDefaultFormatSuffixByIndex gflGetDefaultFormatSuffixByName gflGetDefaultLoadParams gflGetDefaultSaveParams gflGetDefaultThumbnailParams gflGetEXIFDPI gflGetErrorString gflGetExtraInfos gflGetExtraInfosCount gflGetFileInformation gflGetFileInformationEx gflGetFileInformationFromHandle gflGetFileInformationFromMemory gflGetFileInformationW gflGetFormatDescriptionByIndex gflGetFormatDescriptionByName gflGetFormatIndexByName gflGetFormatInformationByIndex gflGetFormatInformationByName gflGetFormatNameByIndex gflGetLabelForColorModel gflGetNumberOfFormat gflGetVersion gflGetVersionOfLibformat gflIsCompatibleLutFile gflIsLutFile gflJPEGGetComment gflJPEGGetCommentW gflJPEGSetComment gflJPEGSetCommentW gflLibraryExit gflLibraryInit gflLibraryInitEx gflLoadBitmap gflLoadBitmapBegin gflLoadBitmapEnd gflLoadBitmapFromHandle gflLoadBitmapFromMemory gflLoadBitmapReadLine gflLoadBitmapW gflLoadEXIF gflLoadEXIFW gflLoadIPTC gflLoadIPTCW gflLoadThumbnail gflLoadThumbnailFromHandle gflLoadThumbnailFromMemory gflLoadThumbnailW gflMemoryAlloc gflMemoryFree gflMemoryRealloc gflMerge gflNewIPTC gflPNGGetComment gflPNGGetCommentW gflPNGSetComment gflPNGSetCommentW gflRemoveIPTCValue gflReplaceColor gflResize gflResizeCanvas gflRotate gflRotateFine gflSaveBitmap gflSaveBitmapBegin gflSaveBitmapEnd gflSaveBitmapIntoHandle gflSaveBitmapIntoMemory gflSaveBitmapW gflSaveBitmapWriteLine gflSaveIPTC gflSaveIPTCW gflSaveParamsIsSupportedByIndex gflSaveParamsIsSupportedByName gflScaleToGrey gflSetColorAt gflSetColorAtEx gflSetIPTCValue gflSetPluginsPathname gflSetPluginsPathnameW gflSetTransparentColor inflate inflateEnd inflateInit_ inflateSync

sqlite3.dll

IMPHASH 4b9f7b87e7e6e5ae4595949eefa09937
SHA256 67919601dfec4138e51d3fa8092dfa48b9de57cce2930f3bcf5efe7bed4346c4
MD5 910483ec15c2cd4b7e63ab395f5ca046
SHA1 a9464bb82e69fa35b7fb144137e8383122f07e77
SHA512 45d7362c873b09e8d059ab8e7285869d774245164824f893fe3a27a82a334ccc16210d748b8f24421e0e1580140dcedf09f093a4240d84062a4fc590e05cf986
SSDEEP 6144:mWwEi0rYN5Eo78iURT/r97iuSlF/pOzEzlQvzUuAfHK5iZt+nMdwqRRB:mpDugJUB9mHczEzlksfaiZFdw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFullPathNameW GetFullPathNameA CreateFileA GetFileSize SetFilePointer MapViewOfFile UnmapViewOfFile SetEndOfFile FreeLibrary QueryPerformanceCounter InterlockedCompareExchange UnlockFile LockFile GetTickCount UnlockFileEx GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW LeaveCriticalSection GetFileAttributesA GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA HeapFree HeapAlloc HeapReAlloc GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree VirtualAlloc GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameA GetTimeZoneInformation TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA GetModuleHandleA

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_db_config sqlite3_db_handle sqlite3_db_mutex sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strnicmp sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8

uninstall.exe.nsis

SHA256 d22e3f5277af65322c11972c6ef067d80e97d86ccedd8193fbd98765606c16ed
MD5 1c0860a34c2c861f458272a1e4670b7a
SHA1 e0ef4c54b5adf6db760252c8447c58dd5b44ccaf
SHA512 e69bc494b912ff45796f01b0c10217c5b29a695e5a973869750504714b5dce2c39144571c135f6c6c31d46cde08607671c6698cf6b596dbe2b988ff9c219eaca
SSDEEP 96:IlLcsbTNieWuG+vb84i64DcXX1+UlDA2QHuqoryHvYGT0Hq2GYaAo6CShNZshO:gNzb8b64D8X1TcOqEyHMGY9NUO
MD5 SHA1 SHA512 SSDEEP

unrar.dll

IMPHASH a75fae54c1e1f631cb497bdbcbb7aa68
SHA256 8a94325adca2351352029604dadef4803acd3cf153bcbbbf6276aaa7e4dfb578
MD5 c0ba0003cb354093cedb27a991ad0702
SHA1 349bf46e2935bcd8f43923029f5309545274224f
SHA512 f02497eea8362367ea920512b98f12e36db952429fc208aa4040f170984c617fb00be6089bd35d4371e7958cc7c198698e8b19a5a369ca48b78f31cae77f353d
SSDEEP 3072:We+YWNSHZ3V89k15kIZ8Fjpg4Jjgpor4tiHRjikdAFZjYQ+Bvo0X:qYWkFIk15lKNuorW46FxYvp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

109496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\WinRAR\rar\build\unrardll32\Release\unrar.pdb

kernel32

GetFileType CreateFileA CreateFileW ReadFile GetStdHandle WriteFile GetProcAddress GetModuleHandleW GetFileAttributesA GetFileAttributesW SetFileAttributesA SetFileAttributesW DeleteFileA DeleteFileW DeviceIoControl CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetVersionExW GetModuleFileNameA CompareStringA LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetSystemTime WideCharToMultiByte MultiByteToWideChar CompareStringW IsDBCSLeadByte GetCPInfo GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetEndOfFile SetFilePointer FlushFileBuffers MoveFileW SetFileTime GetCurrentProcess GetLastError Sleep CloseHandle GetFullPathNameA GetLocaleInfoA GetStringTypeW RtlUnwind HeapAlloc HeapFree HeapReAlloc RaiseException GetModuleHandleA ExitProcess GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree VirtualAlloc HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage HeapSize LoadLibraryA GetVersion InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetStringTypeA WriteConsoleW

user32

CharLowerW CharLowerA CharToOemA CharUpperW CharToOemBuffW OemToCharA OemToCharBuffA CharUpperA

advapi32

SetFileSecurityW SetFileSecurityA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

zlibwapi.dll

IMPHASH 367162a21fd13e6a0611c558949d0e72
SHA256 7645ef64b5717758ef01d071388ffc28f9afb99de13e55b1665e221e1b37542e
MD5 1814459214334cbebee276b85cc48902
SHA1 7b5474f11ff2cba976f3b97addc4d02cb14cb4da
SHA512 346022bb694dd89470d2507d104aebf50d6098e59d771a2415aba6db894a3f01576cea66a472fcad2a575cab1fad36c6a3e2fb87386279db8638f50829ca2a71
SSDEEP 1536:3uqgjpqdPY9mb0bnbcIfxWMUa2H0jz83MK7MITc3LGuw8bbLDIOlIOKnToIfv+Dy:+hzYk2pHR9wCmLGK/LlvmTBfv+DaW7Y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

adler32 adler32_combine compress compress2 compressBound crc32 crc32_combine deflate deflateBound deflateCopy deflateEnd deflateInit2_ deflateInit_ deflateParams deflatePrime deflateReset deflateSetDictionary deflateSetHeader deflateTune fill_win32_filefunc get_crc_table gzbuffer gzclearerr gzclose gzclose_r gzclose_w gzdirect gzdopen gzeof gzerror gzflush gzgetc gzgets gzoffset gzopen gzprintf gzputc gzputs gzread gzrewind gzseek gzsetparams gztell gzungetc gzwrite inflate inflateBack inflateBackEnd inflateBackInit_ inflateCopy inflateEnd inflateGetHeader inflateInit2_ inflateInit_ inflateMark inflatePrime inflateReset inflateReset2 inflateSetDictionary inflateSync inflateSyncPoint inflateUndermine uncompress unzClose unzCloseCurrentFile unzGetCurrentFileInfo unzGetFilePos unzGetGlobalComment unzGetGlobalInfo unzGetLocalExtrafield unzGoToFilePos unzGoToFirstFile unzGoToNextFile unzLocateFile unzOpen unzOpen2 unzOpenCurrentFile unzOpenCurrentFile2 unzOpenCurrentFile3 unzOpenCurrentFilePassword unzReadCurrentFile unzStringFileNameCompare unzeof unztell zError zipClose zipCloseFileInZip zipCloseFileInZipRaw zipOpen zipOpen2 zipOpenNewFileInZip zipOpenNewFileInZip2 zipOpenNewFileInZip3 zipWriteInFileInZip zlibCompileFlags zlibVersion

Sharing

General

Malware Config

Signatures

File Explorer