Sausage_Fattener.zip
- SHA256 8febbfb26ae58d34ca70187f364c73d9fad69b2e34bfd64faff6a5d7f95db0dd
Overview
overview
10Static
static
10Sausage Fa...60.sfv
windows11-21h2-x64
3Sausage Fa...up.exe
windows11-21h2-x64
10$PLUGINSDI...sh.dll
windows11-21h2-x64
3$PLUGINSDIR/Bass.dll
windows11-21h2-x64
3$PLUGINSDI...on.dll
windows11-21h2-x64
3$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...in.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/bass.dll
windows11-21h2-x64
3Resource/S...32.dll
windows11-21h2-x64
3Resource/S...64.dll
windows11-21h2-x64
1Sausage Fa...64.dll
windows11-21h2-x64
1Sausage Fattener.dll
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
7Behavioral task
behavioral1
Sample
Sausage Fattener/asgn1160.sfv
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Sausage Fattener/setup.exe
Resource
win11-20240802-en
windows11-21h2-x64
9 signatures
1800 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AdvSplash.dll
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Bass.dll
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bass.dll
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Resource/Sausage Fattener 32.dll
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Resource/Sausage Fattener 64.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Sausage Fattener x64.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral13
Sample
Sausage Fattener.dll
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
1800 seconds
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win11-20240802-en
windows11-21h2-x64
5 signatures
1800 seconds
General
- Target Sausage_Fattener.zip
- Size 3.9MB
- Sample240921-vnmsratcld
- SHA256 8febbfb26ae58d34ca70187f364c73d9fad69b2e34bfd64faff6a5d7f95db0dd
- MD5 151f58087e9baeee26d9253e06aaeb23
- SHA1 7a673a2192c68855ec60803c752a50862c518538
- SHA512 71e49b17f4abbabdb6ef735333e4d02714e2a7a84e974d4409c27f780108c8d92fdafeb8782002b6832cbf94a1ff244cd60b67dfc62e16063d6c9663c0a18b84
- SSDEEP 98304:7VvVBumEwCFD5mcqTRy+gKAM3qGTbD2gsqUA2yfQFPJ:7VvrFC5ROk+9AANDwqUA25J
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Strela Stealer payload 1 IoCs
resource yara_rule static1/unpack002/$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll family_strela - Strela family
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/Sausage Fattener/setup.exe unpack002/$PLUGINSDIR/AdvSplash.dll unpack002/$PLUGINSDIR/Bass.dll unpack002/$PLUGINSDIR/GetVersion.dll unpack002/$PLUGINSDIR/InstallOptions.dll unpack002/$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/bass.dll unpack002/Resource/Sausage Fattener 32.dat unpack002/Resource/Sausage Fattener 64.dat unpack002/Sausage Fattener x64.dll unpack002/Sausage Fattener.dll unpack002/uninstall.exe - NSIS installer 4 IoCs
resource yara_rule static1/unpack001/Sausage Fattener/setup.exe nsis_installer_1 static1/unpack001/Sausage Fattener/setup.exe nsis_installer_2 static1/unpack002/uninstall.exe nsis_installer_1 static1/unpack002/uninstall.exe nsis_installer_2
File Explorer
-
Sausage_Fattener.zip.zip 3.9MB
-
Sausage Fattener/asgn1160.sfv69B
-
Sausage Fattener/setup.exe.exe 3.9MB
-
$PLUGINSDIR/AdvSplash.dll.dll 6KB
-
$PLUGINSDIR/Bass.dll.dll 101KB
-
$PLUGINSDIR/GetVersion.dll.dll 8KB
-
$PLUGINSDIR/InstallOptions.dll.dll 14KB
-
$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll.dll 5.8MB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/bass.dll.dll 101KB
-
$PLUGINSDIR/dat_bgm.ogg165KB
-
$PLUGINSDIR/dat_skin.skf551KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-wizard.bmp150KB
-
$PLUGINSDIR/splash.bmp600KB
-
Resource/1.bmp132KB
-
Resource/10.bmp132KB
-
Resource/11.bmp132KB
-
Resource/12.bmp132KB
-
Resource/13.bmp132KB
-
Resource/14.bmp132KB
-
Resource/15.bmp132KB
-
Resource/16.bmp132KB
-
Resource/2.bmp132KB
-
Resource/3.bmp132KB
-
Resource/4.bmp132KB
-
Resource/5.bmp132KB
-
Resource/6.bmp132KB
-
Resource/7.bmp132KB
-
Resource/8.bmp132KB
-
Resource/9.bmp132KB
-
Resource/AboutBox.bmp261KB
-
Resource/Background.bmp1.1MB
-
Resource/BigKnob.bmp100KB
-
Resource/Fonts.dat417KB
-
Resource/GreenLight.bmp6KB
-
Resource/OrangeLight.bmp6KB
-
Resource/OverlayKnob.bmp100KB
-
Resource/RedLight.bmp6KB
-
Resource/Sausage Fattener 32.dat.dll 845KB
-
Resource/Sausage Fattener 64.dat.dll 745KB
-
Resource/SausageBottom.bmp86KB
-
Resource/SausageBottomAlpha.bmp86KB
-
Resource/SmallKnob.bmp1KB
-
Resource/Wheel2.bmp53KB
-
Sausage Fattener x64.dll.dll 92KB
-
Sausage Fattener.dll.dll 95KB
-
uninstall.exe.exe 38KB
Sausage Fattener/asgn1160.sfv
- SHA256 60884f40d4d020c4cba50b9d209b11c7bcaa48bc5d4d26ff9049d40736192124
- MD5 3aa8f6b8f0e367638d12e9cbe3e0a20b
- SHA1 bc85e493be89698941b448042fcda0aacc4b9219
- SHA512 d78f8e99ea491b33709a3e9afc202658ce70ecc9651a9fa89cde0613754911e3482f77151aba3d8779b4eb3e968509147f41d4d486537400ad9c843b15387688
- MD5 SHA1 SHA512
Sausage Fattener/setup.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 81e45c1e6d6a718624159e116e6daa8c1547f39bef7f56163303e7eca8abfae1
- MD5 81e69b29c4c09391a12b665e7661f48e
- SHA1 b103b694d12544c9db444badd9e2263d219698b1
- SHA512 5476b9fa6967aefcb73793c965224c93d2ab46268830fcb71c69bc864e22e0cb92512959fe7a728ee77c2bde00e3ce9eda64d015ff1ef34273292707680c0042
- SSDEEP 98304:QhVVJqioKMFh1qKsbZcMgsGwNmlCNE4CJgcMyfQP/4:QhV1pMzHQCMFGImHgcM54
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AdvSplash.dll
- IMPHASH 741b6bafe355b63a372d737b30543a95
- SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
- MD5 13cc92f90a299f5b2b2f795d0d2e47dc
- SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
- SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
- SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4448
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
GetVersion
lstrcpyA
lstrcatA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
user32
LoadCursorA
RegisterClassA
SetWindowPos
SetWindowLongA
SystemParametersInfoA
EndPaint
GetClientRect
BeginPaint
DefWindowProcA
DestroyWindow
LoadImageA
CreateWindowExA
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
PostMessageA
SetWindowRgn
EnumDisplaySettingsA
gdi32
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectA
DeleteDC
BitBlt
DeleteObject
winmm
timeSetEvent
PlaySoundA
timeKillEvent
show
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/Bass.dll
- SHA256 14a38f56be50a3829eb1eda2a908da2de5913f81d5cb01d8b668593d0fc36594
- MD5 a8af308ff01b4477657955fbf0cc8408
- SHA1 0794c059f0326e4a71be8a3ee4ac17a657d90d88
- SHA512 9e221967db95d4b86bf311891193dfd1515806aa0d43198d3bc26a17d77f06f212ab9dba1ca8575f50d224380e8b109529faccf2f56daac834da83a83677a0fd
- SSDEEP 3072:kR+vccy3LIweO1vFCLPkG9dfSD0BXZXmpw69Qe:S+vccy3hF1vFCT99dTBX5mupe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
311363
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASS_Apply3D
BASS_CDDoor
BASS_CDFree
BASS_CDGetID
BASS_CDGetTrackLength
BASS_CDGetTracks
BASS_CDInDrive
BASS_CDInit
BASS_CDPlay
BASS_ChannelBytes2Seconds
BASS_ChannelGet3DAttributes
BASS_ChannelGet3DPosition
BASS_ChannelGetAttributes
BASS_ChannelGetData
BASS_ChannelGetEAXMix
BASS_ChannelGetFlags
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelIsActive
BASS_ChannelIsSliding
BASS_ChannelPause
BASS_ChannelRemoveDSP
BASS_ChannelRemoveFX
BASS_ChannelRemoveLink
BASS_ChannelRemoveSync
BASS_ChannelResume
BASS_ChannelSeconds2Bytes
BASS_ChannelSet3DAttributes
BASS_ChannelSet3DPosition
BASS_ChannelSetAttributes
BASS_ChannelSetDSP
BASS_ChannelSetEAXMix
BASS_ChannelSetFX
BASS_ChannelSetLink
BASS_ChannelSetPosition
BASS_ChannelSetSync
BASS_ChannelSlideAttributes
BASS_ChannelStop
BASS_ErrorGetCode
BASS_FXGetParameters
BASS_FXSetParameters
BASS_Free
BASS_Get3DFactors
BASS_Get3DPosition
BASS_GetCPU
BASS_GetDSoundObject
BASS_GetDeviceDescription
BASS_GetEAXParameters
BASS_GetGlobalVolumes
BASS_GetInfo
BASS_GetVersion
BASS_GetVolume
BASS_Init
BASS_MusicFree
BASS_MusicGetChannelVol
BASS_MusicGetLength
BASS_MusicGetName
BASS_MusicLoad
BASS_MusicPlay
BASS_MusicPlayEx
BASS_MusicPreBuf
BASS_MusicSetAmplify
BASS_MusicSetChannelVol
BASS_MusicSetPanSep
BASS_MusicSetPositionScaler
BASS_Pause
BASS_RecordFree
BASS_RecordGetDeviceDescription
BASS_RecordGetInfo
BASS_RecordGetInput
BASS_RecordGetInputName
BASS_RecordInit
BASS_RecordSetInput
BASS_RecordStart
BASS_SampleCreate
BASS_SampleCreateDone
BASS_SampleFree
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SamplePlay
BASS_SamplePlay3D
BASS_SamplePlay3DEx
BASS_SamplePlayEx
BASS_SampleSetInfo
BASS_SampleStop
BASS_Set3DAlgorithm
BASS_Set3DFactors
BASS_Set3DPosition
BASS_SetBufferLength
BASS_SetCLSID
BASS_SetEAXParameters
BASS_SetGlobalVolumes
BASS_SetLogCurves
BASS_SetNetConfig
BASS_SetVolume
BASS_Start
BASS_Stop
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamCreateURL
BASS_StreamFree
BASS_StreamGetFilePosition
BASS_StreamGetLength
BASS_StreamGetTags
BASS_StreamPlay
BASS_StreamPreBuf
BASS_Update
_
Name
Size
96KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$PLUGINSDIR/GetVersion.dll
- IMPHASH fb1aa2bbc159c94cb45792330366bd5f
- SHA256 16dd6da98b7e53d374830cd4c644c01b112955f8487a285f34dc0353e9cfac15
- MD5 e013b625f5ae1e2f0b442cf39c0069df
- SHA1 9ec785b63279144c091366badda65278c4cdee20
- SHA512 306f7e674d119d129db48012c43f825bffabd078fac8518aea9d514b0787752a2e876bda2ad15df7332bfc8cfba38a0d1be17ee7c58a27e09678fce9aec58418
- SSDEEP 192:9r/9XGqK7s/AlHdJZBi46AQ5VuNxHA8/1:HXGqM93Bi46AQ5Vujg8/1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7247
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiA
GetModuleHandleA
lstrcpynA
GlobalAlloc
GetProcAddress
GetSystemInfo
GetVersionExA
user32
GetSystemMetrics
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
WindowsName
WindowsPlatformArchitecture
WindowsPlatformId
WindowsServerName
WindowsServicePack
WindowsServicePackBuild
WindowsServicePackMajor
WindowsServicePackMinor
WindowsType
WindowsVersion
Name
.text
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
470B
Virtual Size
558B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$PLUGINSDIR/InstallOptions.dll
- IMPHASH b1cd0d78f652ce5fc63f0879371af012
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
dialog
initDialog
show
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll
- IMPHASH 8a595235c826f2ae0f0362f688723bd0
- SHA256 8b25cf3f7aa82fadccb2ce615ce0e40c5a8a3ea7bc51180a92173ee113a0ccfe
- MD5 028251654a4d65509aa8ccb5f2ee284a
- SHA1 4a4ad468a86df6b903002be4f8919017fea0c152
- SHA512 f252670bca0da9e8e2c519a6ef4ad6dd0c4e548aeb7566693a7d203e73e63345fc58683072020ef771d836429bed1d7b4fdf105aa3e62a969e9c8d39556e1d2d
- SSDEEP 98304:kj0Kg9frmFcqlMZ4vpHfOVlQnzW4Aogn/oXFdAaTZ8GcB7d0s:kjFA7t2RHfYlQZJgTamGcBis
- MD5 SHA1 SHA512 SSDEEP
-
Detects Strela Stealer payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
FindResourceA
GlobalFree
lstrcpyA
MultiByteToWideChar
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
RtlUnwind
RaiseException
ExitProcess
GetFileAttributesA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
HeapAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetUnhandledExceptionFilter
WriteFile
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
CloseHandle
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
HeapSize
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
SetStdHandle
ReadFile
GetLocaleInfoW
CreateFileA
SetEndOfFile
user32
MessageBoxA
destroy
skin
Name
.text
Size
60KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5.7MB
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$PLUGINSDIR/System.dll
- IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=42, version=8803,
count=4, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/bass.dll
- SHA256 14a38f56be50a3829eb1eda2a908da2de5913f81d5cb01d8b668593d0fc36594
- MD5 a8af308ff01b4477657955fbf0cc8408
- SHA1 0794c059f0326e4a71be8a3ee4ac17a657d90d88
- SHA512 9e221967db95d4b86bf311891193dfd1515806aa0d43198d3bc26a17d77f06f212ab9dba1ca8575f50d224380e8b109529faccf2f56daac834da83a83677a0fd
- SSDEEP 3072:kR+vccy3LIweO1vFCLPkG9dfSD0BXZXmpw69Qe:S+vccy3hF1vFCT99dTBX5mupe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
311363
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASS_Apply3D
BASS_CDDoor
BASS_CDFree
BASS_CDGetID
BASS_CDGetTrackLength
BASS_CDGetTracks
BASS_CDInDrive
BASS_CDInit
BASS_CDPlay
BASS_ChannelBytes2Seconds
BASS_ChannelGet3DAttributes
BASS_ChannelGet3DPosition
BASS_ChannelGetAttributes
BASS_ChannelGetData
BASS_ChannelGetEAXMix
BASS_ChannelGetFlags
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelIsActive
BASS_ChannelIsSliding
BASS_ChannelPause
BASS_ChannelRemoveDSP
BASS_ChannelRemoveFX
BASS_ChannelRemoveLink
BASS_ChannelRemoveSync
BASS_ChannelResume
BASS_ChannelSeconds2Bytes
BASS_ChannelSet3DAttributes
BASS_ChannelSet3DPosition
BASS_ChannelSetAttributes
BASS_ChannelSetDSP
BASS_ChannelSetEAXMix
BASS_ChannelSetFX
BASS_ChannelSetLink
BASS_ChannelSetPosition
BASS_ChannelSetSync
BASS_ChannelSlideAttributes
BASS_ChannelStop
BASS_ErrorGetCode
BASS_FXGetParameters
BASS_FXSetParameters
BASS_Free
BASS_Get3DFactors
BASS_Get3DPosition
BASS_GetCPU
BASS_GetDSoundObject
BASS_GetDeviceDescription
BASS_GetEAXParameters
BASS_GetGlobalVolumes
BASS_GetInfo
BASS_GetVersion
BASS_GetVolume
BASS_Init
BASS_MusicFree
BASS_MusicGetChannelVol
BASS_MusicGetLength
BASS_MusicGetName
BASS_MusicLoad
BASS_MusicPlay
BASS_MusicPlayEx
BASS_MusicPreBuf
BASS_MusicSetAmplify
BASS_MusicSetChannelVol
BASS_MusicSetPanSep
BASS_MusicSetPositionScaler
BASS_Pause
BASS_RecordFree
BASS_RecordGetDeviceDescription
BASS_RecordGetInfo
BASS_RecordGetInput
BASS_RecordGetInputName
BASS_RecordInit
BASS_RecordSetInput
BASS_RecordStart
BASS_SampleCreate
BASS_SampleCreateDone
BASS_SampleFree
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SamplePlay
BASS_SamplePlay3D
BASS_SamplePlay3DEx
BASS_SamplePlayEx
BASS_SampleSetInfo
BASS_SampleStop
BASS_Set3DAlgorithm
BASS_Set3DFactors
BASS_Set3DPosition
BASS_SetBufferLength
BASS_SetCLSID
BASS_SetEAXParameters
BASS_SetGlobalVolumes
BASS_SetLogCurves
BASS_SetNetConfig
BASS_SetVolume
BASS_Start
BASS_Stop
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamCreateURL
BASS_StreamFree
BASS_StreamGetFilePosition
BASS_StreamGetLength
BASS_StreamGetTags
BASS_StreamPlay
BASS_StreamPreBuf
BASS_Update
_
Name
Size
96KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$PLUGINSDIR/dat_bgm.ogg
- SHA256 ddae02d386f23c8d03792d06beb5100f1d230fa6c9c66b007fa5a3808e5dedaf
- MD5 f484a5db943fbefe894146a109513ff9
- SHA1 3097181ce18c30933da3566d77b6beea5c9092ca
- SHA512 634615101e5ccef3fbd6bb9fdac881808f231eccb79bd135dd804251b4d564cc89c7a14fe2fe548e7345a6437383edb8fb00ba19666834e4aeaced2103f3ff6d
- SSDEEP 3072:tpbseuX0bbGvARsR9Eq9TBECn066ZCtALQOcCL3qFf4vklt/9Rs5BK2KAfnVGsGB:E7XXAc9NEmwmOb3qFztwBK2KAf2/KvT8
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/dat_skin.skf
- SHA256 2f2f3ff75f666826f4b40b8e277040d286e6d7ad883cabd5f4bf64670d4579aa
- MD5 f172c4e44639c2c67c019e94172c780a
- SHA1 2e60045e6d80e9964698f95ecdcba3e12635cae0
- SHA512 3eac9c5357590a6851b59b14130aa6c22c57caff107fc24b74f984a8f7a0fdd78610bb4277553d8746a77a6d5531b06ce1b20bbcfa08cf0e9c600ebb518572dd
- SSDEEP 3072:B5/dAtjL20Lr9UiaTqXDY5LNMiSJxJig+uzVZ+WrPWruDkhUj8YNj2YeQiwe39Lm:2/20LrGi1XDo8+UPUuj9kQiLNLif
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-wizard.bmp
- SHA256 fe2f71f6a9baa4bf426ae4710f4edce296ce3d89c6e0a03448cb00fa562462ed
- MD5 344eacb265063cadfd6d3ee3ee66f895
- SHA1 5606fed6dea08aebe1d7eb0187e7f5bd53c96fdb
- SHA512 c7f48ba8e8ef4602de74c71fce1a08e7b4c3299808d8525339b6af37b6f30a76024c45a1f182f32c77bb3389edc6e6c45d0ff37549d201bf1f86b4f84b14b641
- SSDEEP 1536:E7xAG/O+g3Q/H8/T9jtYVmj42ucaKBlZ7b:E7xAGmI/H8b9je84TcaKlZ7b
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/splash.bmp
- SHA256 d91b10d9516f3153cfad2e00b9975a835b1538be1dc0ec0e2821a7f3755322b0
- MD5 94f52dc67c016167d6eaf6e0c3cf0942
- SHA1 e03a061117872d458d106ff67a70df5b4b236e08
- SHA512 f2439352039abd0894e1addb23dd3033434300804c5c2d0139c1c74e8f02832033a54a0792a1bf2fabfbc220e5645bc4e4f77b9831edcf7cdecd162e7a5b6273
- SSDEEP 6144:kcoYVYZtkKsq1ReH8z1UMKFAeH4kTBERaZN:kcoYVYZtPReczGM8qRaZN
- MD5 SHA1 SHA512 SSDEEP
Resource/1.bmp
- SHA256 acbb674a36c859af77de0aa1d3d95c1cedf000e54febb31020e6f938194ffc6b
- MD5 cd5ff562751a97fe101a67e771ba502d
- SHA1 40ab4ef194902fed97926363fe6f82f3ddb905c0
- SHA512 4d8d1bce35189b6b20e478330e9d94c5b4863446366da8bfebd5e29303ea2560c1749c00ea181716ef9b873d19f7bb0b0b67217bf33fbcf14ef06034eb93da2f
- SSDEEP 768:GZlzyFOQrMisKWPDWPQ6HxZ5/LVlSXhyuFKTuZ/tzIywza2oHVWWHwSKY7FgqwxH:cPorwX1du
- MD5 SHA1 SHA512 SSDEEP
Resource/10.bmp
- SHA256 ffa4a594d09f8faad81a30ba0999692530b1c248939328c57781ccae55129536
- MD5 315fbe95e7b2a86b874b197fbdf15849
- SHA1 1cfb80ce65a3ec7797a236bd21c5de45ff49ffaf
- SHA512 d0ed7b6cac55509e08dcfb6ce4bfef8da2945cab9372e0e044297fd21f8d9a74fcb601bf8faf2e97d1350bbf9363d3d25421da34747a7a2dc7660c8b3be253b7
- SSDEEP 768:UqL8imr7IriZj7gNPfkxD5KhPY9dx0FHH5m1ngJMNZ7sCBTiCabGZ95YqQ+9PaW/:U7p/WGHGk
- MD5 SHA1 SHA512 SSDEEP
Resource/11.bmp
- SHA256 fd3a02f023176a6ae82935f00f72fa13d42be28d58eec0422b9783184ea852f3
- MD5 8379b1c3d19f3648f9236187e16149e9
- SHA1 d1d4ef0d7071ac00c8d3abae6b79d8ebf2798452
- SHA512 1822e9eb3c1943d0a6e78a78d6920db26f92257a5a368e5524162c65c08eada27a4d7fdc1714279910665189398ebe510e1e4d982bedb4915d75ce9f825b215b
- SSDEEP 768:SDbNi/9re4I3yTa3xz5bZKvnedS0hHHiOGa3JRNQJCFcimltHLAFEpJvhdb1hHWt:C0Uu/IAY
- MD5 SHA1 SHA512 SSDEEP
Resource/12.bmp
- SHA256 67c1e8f97cb11fe2d5d658e994682dcb9b81ec73ee221e2d704bff5da8f7a360
- MD5 ba19c720c62fb04a6d0687763eb3f0f9
- SHA1 80ca6d7bda2b287c87d36ad2535bf9ffb5bf00c2
- SHA512 298128377ca05e88fd5000725e4871ffb81f0b49de805552c7fc205b48a1739a64cfe246f360186259322ed162fb31320fe4f7f511b0f106677e0eb8c7ed84ce
- SSDEEP 768:SDbNi/9re4I3yTa3xz5bZKvnedS0hHHiOGa3JRNQJC6U1WAXoIpFAPlpUwgzHQ6X:C4GskgrY
- MD5 SHA1 SHA512 SSDEEP
Resource/13.bmp
- SHA256 f329a87886a84e7d36a03ab620221ce2e5909bf595210a0a70e62065b68bd458
- MD5 a0e8b1c81ddc511fcb5310c5deee8e9b
- SHA1 88f9b448d7f5ca3a00b36b06e25fbbe94ca0a451
- SHA512 3e7b08f44e8534b2208c37e8f78fc91831ef7a7f9e634577b40be3ba970141437565182e2fb5f659fceedadbadf1bb562db351a95c4ce531913a72ea35cef272
- SSDEEP 768:/nk0jLE2Lr8RnfWncJZx/5/N6r4VndtGgHHxoZPNPX4lXICR8nmItsNHdqoQ9F9o:zZriT
- MD5 SHA1 SHA512 SSDEEP
Resource/14.bmp
- SHA256 9058e0d9ea998c21309757586d30b0e5378c0c1904ebc2d95bf01223ddba269c
- MD5 22fcb3ea5ee2414880ef094b6b965c94
- SHA1 dbfb1cbb08981fdd3878faf4179f5fddf67a4a9d
- SHA512 f104e05e5fff7ea1b5e7e983ed8185ee5fcb3d5affe07f9d60663b61027c4de76743b4b67d21578de7f35eca75d953a8182c7d3330c2ec65966cca6a4363c294
- SSDEEP 768:TVDtEq8oBHHtrCOVPggBFxxwi5N6rcvyNvP24pTkgXN39OC6hk1J+BOUozzGLjYO:2QiqbJrGBO
- MD5 SHA1 SHA512 SSDEEP
Resource/15.bmp
- SHA256 46ed9e0e6d46d8840fc3771c5b8b5a9457d91e0a994e72a8289481dcf4a83c32
- MD5 db6d2dbb0a0f2836f725f942453b29ec
- SHA1 83448f73bb9104178ab354128e47a239b1abdeba
- SHA512 5542a2a8dcaf436d2610cf685a2760bcc93d077086658cffe2361f3da0fae5f5f76a1761034cea5f8e9ac1151944bafa726761213acccf012bd01ba38f4d5ed4
- SSDEEP 768:TVDtEq8oBHHtrCOVPggBFxxwi5N6rcvyNvP24pTkgXN39OC6hk1J+BOUohzLLdDz:2Qi5T9rGBO
- MD5 SHA1 SHA512 SSDEEP
Resource/16.bmp
- SHA256 d2bf6a0edd77365e2593a2fa154a9a7e1c609111316e17538706d7d453cd5b43
- MD5 74963a0e21b0a442f0e327a9e83fcf02
- SHA1 4aeba2036721e7d73a346c295eb436067c8d3976
- SHA512 b5c0eadd8cebcfefa98b6080a51f1801233dd4f2e72b9df028fbcd571d046466ca9b7cf36172a524ff7c60820d40475a8e190d5bada901d3fd485e17c41daaea
- SSDEEP 768:gj/TdkCTjrGQ5PMXISjxV5CzANeXWOWbXvpHV7eNsdoVELCeRNsF5nyt2JHg9B2A:QcEERWglz/MAlVgQT
- MD5 SHA1 SHA512 SSDEEP
Resource/2.bmp
- SHA256 5de6fac064d9897c7865b71528b0f4ee4375a9a1f94cfdd8ab355c17099ed75a
- MD5 b983fb2e8d67378f2eead3af35a41276
- SHA1 001d4dcdd316b285845f82743bc9353040365221
- SHA512 c71980ee0466bf58518d914ac667516f484e991fcd03751536225ea76707e732f939e55c49137431f1d72417827339af6817ae2ef32098fe9af354c2619ecc3b
- SSDEEP 768:T1+8TJ6ioYhMrr+xUxhAPbdBx05ngWQJuJB3ue3TBNq6h4HoTrJcRqLbDpaqNpIt:hHKgW/7mI6
- MD5 SHA1 SHA512 SSDEEP
Resource/3.bmp
- SHA256 91d0a751e34a1cdf6329bdab73d8c583a2600d359d4a6ee78e0a557a56d6825c
- MD5 a21bc00d83d44f8ac7a4025e352a9cdd
- SHA1 b44314553d206c68f901e623227b257b9b1cf4e6
- SHA512 928c5060e863c6ca2052cbd51d4a4bb0170b8f5499a0cd8c6434a5ffa3c1314cc557f17bc550d8e356687c943538462b854175452e873ec256e515ad5e20fbb4
- SSDEEP 768:T1+8TJ6ioYhMrNbxEicfDze4yckExo+535895beufdRTaNG/6P/VBnL0Ct7USTOM:hHBzCLEiWI6
- MD5 SHA1 SHA512 SSDEEP
Resource/4.bmp
- SHA256 3ffb2919fe2597e3ddc3e39922e44fb1a904af0dd715f30bea1de84136fdd4c6
- MD5 9ad72b8e9d020a07af384e0852b0ecd9
- SHA1 8db3484a1d695a913b45e9970eaf9c945b8bf028
- SHA512 a08420200e5ebffe4f00868b8abc6172f17686719cb581afb12af6ce901cb074c1823f960bac66d50e2fa99fd228270774b5a41e1cbb14ce5fa63d996cfa37b2
- SSDEEP 768:jHQkYBVJOrRl7tsAOMxd5M4sJorHkuzS5TGmZoSvbpbRD4zJYWijZSXrHdDTJl/I:ophUGFXp
- MD5 SHA1 SHA512 SSDEEP
Resource/5.bmp
- SHA256 94f649cbb0e250d378b1f432b04faca475965e7de8a02535fc2a1f56890660fc
- MD5 d659f87c193a47bdc497410bed0e443e
- SHA1 12629ad7b5dfb0cf9134d7ba83f8693c897a2c58
- SHA512 0bfba7ee57c0df82b52501750a7f79af77fb7dc231621452c838456bfb43f183806b52098122780f3f94c715e65fa9e08f59836895714b5b0395bd1633b2010a
- SSDEEP 768:Nps1Bq7LBrmYBONU48pUqgCw5mdk8tX0tPUZO/fdeA4RAfBB8FEVRGC+IikbEs6h:kqlFkJLZyjp0DbRyBPl
- MD5 SHA1 SHA512 SSDEEP
Resource/6.bmp
- SHA256 719967864c4c6ed44a07ee40d9474047635f98ff970bdefc5229aaa4e2bf3bef
- MD5 f508f16cbeba970dc3929da448f21098
- SHA1 245bdeccbcda280250a37617a497d9b3321978da
- SHA512 87ab56a227998c8da0b4934b1f1029c187b86f20b7c2a83107edd58334642a478b93d54ca0f7aa09c5083060a8b59e4d5f2dbea3d289a791c920db5001029301
- SSDEEP 768:Nps1Bq7LBrmYBONU48adeqDK5G2E8kPPEZi/W6JZJtAHXymz7CARFDvkb4XCRzr9:kqlcaHTrcufDRyBPl
- MD5 SHA1 SHA512 SSDEEP
Resource/7.bmp
- SHA256 e2b22df0d33ba6fb7b3a3e766560c074b15a0357714430586034f3f26ff5deb4
- MD5 39799c0964d71e02398c91c45a46f45c
- SHA1 cecbae88c112059bb6503cfb0081f4e680798be3
- SHA512 cdaa3bc6def877991b0c42466b8e0ae9674ac18c742610f0b4775e92fc2f5a142579f6e3c28acc04793981606d6f22a6bf57c720a575ee6e9be593f3a4c9113f
- SSDEEP 768:qrGxUqErtBwFrtnIxxq57mwaBkr3rJHpItmaq5MgXm3TUXm+Qlvv6bFUfNH8u5MX:hMtLntV2XhufIv
- MD5 SHA1 SHA512 SSDEEP
Resource/8.bmp
- SHA256 4f027fa514a301e6281d1cab0362eeb315df6c773a4c2d3974dbcb7dad74f655
- MD5 ab990f0dd2ad493b807647e0cd25fd3f
- SHA1 6bb429442e42f04eb5f1037fc73dc15fc35e44aa
- SHA512 f0b96c5bb7d39c3260e33123c937c95b4c15ef9aab2d8dc6afbcb440a152806af0f63fcc2cd92950aa89b0c62c54bae5396b4f7816b4be4eaf8e5662da283aec
- SSDEEP 768:qrGxUqErtBwFrtnIxxq57mTFzhJHH3iKBpWIqS9ZmcmgC0OjwvqUl6bJvLJ5Jslw:hOZ6gsQS5HZ/l5hv
- MD5 SHA1 SHA512 SSDEEP
Resource/9.bmp
- SHA256 ba8ca656f0e81b8205ac3f4a3f944d61b7b1d988d7936b82d9143b8dafeed7fe
- MD5 dc1faf224db8690ec068079fb1fef01f
- SHA1 beb18c46955e435ba33c7ef4c028e43cb08f05ba
- SHA512 b25654ac3775af1ab97673738a09d0122fca5ec201e5de6352c7fe87e37e3007f726852a182f1abf9e5009fb5370b6715b431cd7e4698350ecc8444ee0f46d82
- SSDEEP 768:UqL8imr7IriZj7gNPfkxD5KhPY9dx0FHH5m1ngpMNU9sCL3B1W3nznDd3iOvRwJp:U7pRJSOJk
- MD5 SHA1 SHA512 SSDEEP
Resource/AboutBox.bmp
- SHA256 9f41ccadf3e51aeacb40aca9bf0a37a8f81cb5240e5d9d35bbfd85857125f0af
- MD5 8d54f93d237afeac0f9a1f38419ec778
- SHA1 d46781264b4d056fa2180ac4c8e514c192e6f813
- SHA512 a8c5fa1686bc508a417fda165c7dde3c09a9b1e12256be2b29d86f90373ac6221c3b05244687de0b6795555f508061db38f1bcfe7d96fca8b7c3dfd579b92f2d
- SSDEEP 1536:BQSNjG0phPqY54aUmMgNNjepTcr9H5GRyptiM7s:SSNsqNNjPGRn
- MD5 SHA1 SHA512 SSDEEP
Resource/Background.bmp
- SHA256 cbc2262ac4da76d3eedec54f95f18b0bc6f8e070b673f7e1e1d38f0c4e0e1c2a
- MD5 b0df33ef469eb32ac0361082ca79e24b
- SHA1 48ba103f7396206de392311d3bd85890eef6ca1e
- SHA512 3c8652c20327c5d73cd85e52c5773bcdb301dfaf03729db18790569a69245fb455641c52c454a2b696e40aeaff9a3f4ecdd6a4fb7626a8ee354a7d94c0df8035
- SSDEEP 6144:9r7r4H029RuSWqyvbfnTwq/hEyO8n7IofgcsUSIem53pwi:dArwSVANhEy7IofgTIZhei
- MD5 SHA1 SHA512 SSDEEP
Resource/BigKnob.bmp
- SHA256 d0b440b71f97e14f9cdaa534daa3b6695c4639730be01fbb7d8643c4fe5c3d52
- MD5 038308b664c7c730f28f6db0a9f4e5f1
- SHA1 9535db7fa280882e827c2edd0c557547921b3ab9
- SHA512 6a13bf662b3fe4e138da744644547e3c7184502d3b7b0c68aafef40673748252f4d371c207d6c9a752eda719abd9dd76b440806cdeff3a746cbb1c6c76ed7777
- SSDEEP 384:J6BGy+U2cqJFI8AosWWaV9mp8YADM4addZWUFazcrOGYMs2DD7E7myC18:3y+PcqJFI8zsWWk9SZSM4InFIEvLL
- MD5 SHA1 SHA512 SSDEEP
Resource/Fonts.dat
- SHA256 2e07347d0d6ca356a51fdaab611673c3748aabc73599edafc255af33a6d95664
- MD5 9214d2202b9f4d8374668200f6be09e4
- SHA1 049c8125e7e89385d79e14e6ddb48d297f1ccefe
- SHA512 b0de7e0b7e52ed9aa546de79066b314b00fed40bed911afbdf9f75a4df75fe3611285ba9f51219b7ad5469f71f4a09a87949da2b6281a439e36f9f6a0570c229
- SSDEEP 192:zLEzVkc1uTrTi98cCub3gKaqNDKTOMUyHlU3JWtbyJ3MI4Bpe8RTGAxAEwIQsCvr:zLEzVkc1uT+HmM3IhEzFrwDk1DDMB4fT
- MD5 SHA1 SHA512 SSDEEP
Resource/GreenLight.bmp
- SHA256 dae8344797318866589485444c0fdc69bd708c69b975c82ce0ce949a8cbf221d
- MD5 ac16658dc8cd56e5fcc586bc5ea00a50
- SHA1 08a6fa7376251cd6a4f0989090fa6d7c5e4f314d
- SHA512 ee15b3f29a916d54d58caef920fdf5a70d029c9e578ea71e8850c2962e0c41049c492a9e7870e3a6c17b5757d9a1851b5d6ebd4c772bce2d70739614c8ec90bb
- SSDEEP 192:5oG1yXBrr/MA92BWOp4tz0suw+ykelKfbkhF:5B141klQtzR+ykegIhF
- MD5 SHA1 SHA512 SSDEEP
Resource/OrangeLight.bmp
- SHA256 f961fce5458d40d996876c7c0802e0555f621d6a901cc1fb1560cf1ca362ad8e
- MD5 c599581a4a128aefe283fc78f0164fe9
- SHA1 1dd263fcfad1d5b2054e9c670925ba88677a0822
- SHA512 ddb5725bc3bfa52fe5c57525a949f8ef63b9fc437859e26b36a95b98b7e9ec61a05ddc8942b6a80052e33af42e19a71685a3e0da243b136d8bc5bbfde19ee3df
- SSDEEP 192:5DkjcTF9VAmItogfqOzYpJt3+YcWmgqzbCoLTCr4LA374ma4AIE:5ojcTtOfB8pP3mWmgq9lLA3m4AL
- MD5 SHA1 SHA512 SSDEEP
Resource/OverlayKnob.bmp
- SHA256 6418a8be1d341df869be125fee4a4530dd8b2fed02133c318525ae903d231c75
- MD5 abff5a6d250d20116dd3539922ad60c0
- SHA1 7a9216973e5b7a8003ef4df16e7cf0e43f638a70
- SHA512 e53e3b1fabc1d2519780a3c4c089e8622853325785d7cb77fac4fef480abcef89870c757cccd50ce9089544f76d77888955dd0e507bf5bff948d3d239780a494
- SSDEEP 6:j//68lY6t000000000000000000000000000000000000000000000000000000/:b/U6F
- MD5 SHA1 SHA512 SSDEEP
Resource/RedLight.bmp
- SHA256 8663024c93b4d2379401bb178db9be8c9beb427d3c231ac6876cd70731d0f45f
- MD5 674ab57e3f97ca76ac9d3face6689e41
- SHA1 350ebd0d9d23ac753198d833a24953c106d0c556
- SHA512 bd466b46a5839c7957eba5d717163f20cb9f8ccd1a9f201b1c334a4df88cc00b0418de6168f31366655a1b2798cfd03435dae8a1d696852db336f9aea7401df3
- SSDEEP 192:5DkjyF3FQa5Yh/277eb3U6BoqDxnzUVjsC6WmkQIB4uvbs8KskKr3LN:5ojyZBm216BogdKIC6Ovbs85kKrR
- MD5 SHA1 SHA512 SSDEEP
Resource/Sausage Fattener 32.dat
- IMPHASH 62b0a5f873cb2de51be602047c657213
- SHA256 662c308546fc42506073e1f12d38252f7cdaad888e13ee4cf109d062ac609955
- MD5 69d6f94235a27ef0e06544e9ce0d632e
- SHA1 ea92ea58a7db386092a868eea87949fc5d8fa626
- SHA512 39432cea09d8a9921176f14aaae140ce6638c8321f5fe3808616152dc84473bcbfd0215150632d6cfc32f78c7419576a20d5e00f19507018f7de88761e577ea3
- SSDEEP 12288:8E980FzsrMFYul42/YkXE7bZ0TaOI7Yme6lvWHSRukPOGx4FCN225w/l4n:54MJ9TYYmZoSwGYCxC/l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
363294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Build\SausageFattenerPC\Win32\Release\Sausage Fattener.pdb
user32
BeginPaint
MessageBoxA
KillTimer
EndPaint
GetSysColorBrush
GetWindowLongA
SetWindowLongA
InvalidateRect
SetCursor
LoadCursorA
SetTimer
CreateWindowExA
DestroyWindow
SetForegroundWindow
ScreenToClient
ReleaseCapture
SetFocus
SetCapture
DefWindowProcA
GetClientRect
GetUpdateRect
UnregisterClassA
RegisterClassExA
ole32
OleInitialize
OleUninitialize
gdiplus
GdipCreateSolidFill
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipDisposeImage
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipSetPenWidth
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipCloneBrush
GdipRestoreGraphics
GdipSetPenEndCap
GdipSetStringFormatAlign
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawLine
GdipDrawLines
GdipDrawRectangleI
GdipDrawEllipseI
GdipDrawPolygon
GdipFillRectangleI
GdipFillPolygon
GdipFillEllipseI
GdipDrawString
GdipDrawImageRectRect
GdipDrawImagePointRectI
GdipSetClipRectI
GdipSaveGraphics
GdipGetGenericFontFamilySansSerif
advapi32
RegOpenKeyA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
DragFinish
DragQueryFileA
ShellExecuteA
DragAcceptFiles
kernel32
IsValidCodePage
LCMapStringW
ReadFile
SetFilePointer
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetLastError
TlsFree
TlsGetValue
TlsAlloc
ExitProcess
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
GetCommandLineA
CreateThread
GetCurrentThreadId
ExitThread
DecodePointer
EncodePointer
RaiseException
RtlUnwind
GetModuleFileNameA
VirtualQuery
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryW
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
WriteFile
OutputDebugStringA
IsProcessorFeaturePresent
CreateDirectoryA
InitializeCriticalSection
DeleteCriticalSection
UnmapViewOfFile
CreateFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetFileAttributesExA
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
Sleep
GetLastError
GetProcAddress
GetSystemInfo
TlsSetValue
SetEndOfFile
comdlg32
GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA
main
Name
.text
Size
520KB
Virtual Size
519KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
155KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=62, id=158, productName=VS2010 build 30319, version=30319,
count=154, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=95, version=2067,
count=6, id=18, version=8444,
count=122, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=272, id=1, productName=Unmarked objects,
count=196, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Resource/Sausage Fattener 64.dat
- IMPHASH 71eef6a4413fd0527c0d774b1d1d1e98
- SHA256 59b707eefe8286a9468d8ddb4cab4fc5ad4090ef21d68f4c57a3da2c9a5df58d
- MD5 54796ccdb2d6031b2e0d1259e534caac
- SHA1 5c46b4ee988900a2da2a0a60314ac45ac265c9ef
- SHA512 d3fc2c18f431bb7a7aa08ebc70026409363700bc509c22e53d12e14e480fb9096cb0e583cead0e882ebeb21c1b29e7655d86bad65a041b27c377404fe41c186a
- SSDEEP 6144:B12aJOgYCwbtc6bZ7e7c30XnmT/0Vn3wTpyw4156CM5uG7t6q5bAy2WGvy+Vv1nC:5kgob6QZJ0Xnq/3N5uG7eyDcFbA8oKo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
296048
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Build\SausageFattenerPC\x64\Release\Sausage Fattener.pdb
user32
SetWindowLongPtrA
SetTimer
CreateWindowExA
DestroyWindow
KillTimer
InvalidateRect
SetCursor
LoadCursorA
DefWindowProcA
SetForegroundWindow
ScreenToClient
ReleaseCapture
SetFocus
SetCapture
EndPaint
GetClientRect
GetUpdateRect
BeginPaint
RegisterClassExA
GetSysColorBrush
UnregisterClassA
MessageBoxA
GetWindowLongPtrA
ole32
OleUninitialize
OleInitialize
gdiplus
GdipSetPenEndCap
GdipSetPenWidth
GdipCreateSolidFill
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipDisposeImage
GdipDeleteFont
GdipCreateFont
GdipSetStringFormatAlign
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawLine
GdipDrawLines
GdipDrawRectangleI
GdipDrawEllipseI
GdipDrawPolygon
GdipFillRectangleI
GdipFillPolygon
GdipFillEllipseI
GdipDrawString
GdipDrawImageRectRect
GdipDrawImagePointRectI
GdipSetClipRectI
GdipSaveGraphics
GdipRestoreGraphics
GdipCloneBrush
GdipCloneImage
GdipDeleteFontFamily
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
SHGetSpecialFolderPathA
ShellExecuteA
DragQueryFileA
DragFinish
DragAcceptFiles
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
IsValidCodePage
HeapReAlloc
LoadLibraryW
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameW
SetFilePointer
ReadFile
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetStdHandle
GetModuleHandleW
GetProcAddress
HeapSize
HeapFree
HeapAlloc
FlsAlloc
SetLastError
FlsFree
FlsGetValue
GetCommandLineA
FlsSetValue
CreateThread
GetCurrentThreadId
ExitThread
DecodePointer
EncodePointer
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
FlushFileBuffers
WriteConsoleW
GetStringTypeW
GetModuleFileNameA
CreateFileW
SetEndOfFile
CreateDirectoryA
InitializeCriticalSection
DeleteCriticalSection
UnmapViewOfFile
CreateFileA
CreateFileMappingA
GetFileSize
CloseHandle
FindFirstFileA
FindNextFileA
FindClose
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetFileAttributesExA
GetTickCount
Sleep
GetLastError
MultiByteToWideChar
ExitProcess
GetProcessHeap
MapViewOfFile
comdlg32
CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA
main
Name
.text
Size
469KB
Virtual Size
468KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=148, id=170, productName=VS2010 build 30319, version=30319,
count=26, id=158, productName=VS2010 build 30319, version=30319,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=221, id=1, productName=Unmarked objects,
count=194, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Resource/SausageBottom.bmp
- SHA256 223283d885aa71d8e1ff73f02c4df8d6d40c6b2c9b371c984a5ffedfc9244ced
- MD5 34af6f4249eabf73d03f18404d4e279e
- SHA1 e60617c8e9cbad6773d29e45b9dd361f1646a3d8
- SHA512 cdb44bf28b005c5b8220ab5bcedc8bc49b6962e96840048b700073eafba8faf0b9b637ce9bd8d3018ef01a053a696a43ba63dd616c554579348519da29ac061a
- SSDEEP 768:MzSbNWB7BXWh/HO50X3bbC3AhsWZP7aZORCPqRDkd2B:Znbt1tDkd2B
- MD5 SHA1 SHA512 SSDEEP
Resource/SausageBottomAlpha.bmp
- SHA256 040fc672e445e01866ba76ad0c9aca0039b6d96ce574b61d79cb4089b48716de
- MD5 a2ee9a815337bff1292f9dfb707c0858
- SHA1 06069c862f101e6767950aa9f991f6087cfa6a53
- SHA512 807246e5565f369ac94f080047859809d65c86c80833270ca0b1a560ad259dfd8ac2c7e007bb91cf90ff6c74d61c92db51eba8c2e2d5a95c6955d6381ef43dc2
- SSDEEP 768:MzS+wZYHJ7NUPLe8qG9OZA1hZTKZrYYkRuLB:+w68dmkR2B
- MD5 SHA1 SHA512 SSDEEP
Resource/SmallKnob.bmp
- SHA256 3c12dbd602c83761453ad6e83273c75dcd16e72e254fcb0b5874c9112d7fcf44
- MD5 74d08b6908b10f665a2782e099d8137e
- SHA1 c10238fc58d698334917276d1e2380cb86e47ada
- SHA512 d0e7e5451bec6824d95545d6f4aa2a34894a3aca5cb28ec082b5f8f95e164e3f5b0dc6d1c503c91473cbb3f465f20fff228bd1a6b01991a2e823d9554499eba9
- MD5 SHA1 SHA512
Resource/Wheel2.bmp
- SHA256 d14b8d4dae6875bfc11d2501c9bb972770d91164f7cf503b4477fa275b3d91b5
- MD5 53ce88ab4c2136c751b33526ed11e617
- SHA1 aa101ca595414bd291ea1a4da2d295d654cc6445
- SHA512 a593b9df9e49de8bae1e2cef19ba7dd9ae75b56b818a1346557e5f82b85e09b913381be20fc94c2a6629222228bcad14072ea07325dee3ac260cd2af08cdfb64
- SSDEEP 192:90YdY/eWQLmeioGLX18HRNInhkPDCVXkKYUwF09YVU6+:90PomeioGWH6hkkYUDx
- MD5 SHA1 SHA512 SSDEEP
Sausage Fattener x64.dll
- IMPHASH fc5e8bca03e7a8bd189935814ca20665
- SHA256 7ef161e760e967040516a79d961bd137fb12a54753dad80d16caf26fc2421994
- MD5 8d7608fa89581b1fb6f35c48a6f110ec
- SHA1 9741b557de8207c934b81e00983eeba1f71e1f7b
- SHA512 e962f63c38bb37b65d0adbfd5020243f2bed6cffebb40c61c8ebaa43d8ae1e58e7f8d51a77c28c56046a4c7f03c65440e30f59ac6f8ae05141254228b2fc33e4
- SSDEEP 1536:a7wHSj5Heqr6T2b2XrVx4GHNsCqhmMQfVuzoC2BXTt3xHH5ZuMBuNpHoUqNJ4X:aO4kq2T2q7H4uNXqhmMQfLjxn5FAoxLm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
7232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Build\WinVSTWrapper\x64\SausageFattener\Sausage Fattener.pdb
kernel32
GetLastError
CloseHandle
CreateFileW
GetProcAddress
LoadLibraryA
FreeLibrary
DecodePointer
EncodePointer
GetCurrentThreadId
FlsSetValue
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
HeapAlloc
RaiseException
RtlUnwindEx
FlsGetValue
FlsFree
SetLastError
FlsAlloc
Sleep
GetModuleHandleW
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
FlushFileBuffers
user32
MessageBoxA
advapi32
RegQueryValueExA
RegOpenKeyExA
main
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=102, id=170, productName=VS2010 build 30319, version=30319,
count=15, id=158, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=1, productName=Unmarked objects,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Sausage Fattener.dll
- IMPHASH f4b67d0e8e832c5f08a33a057f12be13
- SHA256 42349ce1da21c41e2f72641a76d64fca1a7c7f6c405a50d331c581d2fbf10f76
- MD5 52e95d9e2e0cfc550ce4e40f1d686480
- SHA1 59984bb6becc0f6084851b623f0f2c4bbc901fe1
- SHA512 95b59db3be017ba7486dc774d80af1bc55e50dfcb86b918f266d4db77fc88061b84ba77fd1682a2af81e49608b23ffa4153763a264c85078b32d399b6ebffd03
- SSDEEP 1536:YVoTTf6N2C80UWDOS1Vjw2+OSqbUSovFFvJnystkH+vtmgMbFu6kN:NTxtlB0GNBo4Ag0Fu6kN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7877
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Build\WinVSTWrapper\Win32\SausageFattener\Sausage Fattener.pdb
kernel32
GetLastError
CloseHandle
CreateFileW
GetProcAddress
LoadLibraryA
FreeLibrary
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
LoadLibraryW
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
FlushFileBuffers
user32
MessageBoxA
advapi32
RegQueryValueExA
RegOpenKeyExA
main
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=158, productName=VS2010 build 30319, version=30319,
count=112, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=78, id=1, productName=Unmarked objects,
count=36, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
uninstall.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 09511049b3b5d519bd9ad7fffe29fbae5bde288364e69cff6490a64d6e4f601e
- MD5 4d80cf1dcb4050035ababe91073376ed
- SHA1 66479ddbc4426fb45a526d7a6fb1df1ad09eedde
- SHA512 972bddb89968cb422c6e35aad471b3ca262a40169ff624a207d5a4053efd211251fa04f6381a34230163d0a22239897e751b24dbfa8390444ffe77b7d3c261cb
- SSDEEP 768:c4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJ3Tc8F1:PLXB65939tY6HBg4sXJ3TJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12491
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,