3815dcbacb4fc56386bfccebb18e3d8e_JaffaCakes118

resource	yara_rule
static1/unpack004/out.upx	Nirsoft

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx
static1/unpack001/$TEMP/xcmd.exe	upx

resource
3815dcbacb4fc56386bfccebb18e3d8e_JaffaCakes118
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/registry.dll
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/inetc.dll
unpack003/$_10_/CCPMachineInfo.dll
unpack003/$_10_/Coopen.scr
unpack003/$_10_/CoopenActiveControl110.dll
unpack003/$_10_/CoopenLottery.cop
unpack003/$_10_/CoopenMainManager.dll
unpack001/$TEMP/xcmd.exe
unpack004/out.upx
unpack001/Uninstall.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$TEMP/coopen_setup_100030.exe	nsis_installer_1
static1/unpack001/$TEMP/coopen_setup_100030.exe	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 620534ff2c2258d9f208e7084b6727318a686e9176b588cce21193d76e140538
MD5 3815dcbacb4fc56386bfccebb18e3d8e
SHA1 0fd9a3084487b61c132f19437932be608da5c4fc
SHA512 398d0995cc8ac84b478ea013b1d7caee206109397746bf1e83a6dd446a2051ff072aae4657f60b13362a175ce1564170630594178d57896f4e3d159817ec17ad
SSDEEP 49152:VmgCgtIgv4a1ey0SJfDiSzmd5MIcMhnslUEvJmbu1aWktJ3Zi842l:VdCgWbwJBDiEhI9siEvJ0u8WOEpW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/StartMenu.dll

IMPHASH a648aeaa164b592c1e8892a10400b5ae
SHA256 05f699d932f1fea8e6f1a711c3bc8ba51463b924b78a68bfd0683295de008da1
MD5 72f18eaa88886bd0d46de64a17d9720c
SHA1 e604c84de0ded023cf4c5e215c0534faf1d18227
SHA512 5a80e303f1418dde67ffe0b9b60d574b85634de0d2b557a6691229812e9b376fb34ba7e276efd0e20f35baec91f1030b738e2138d7b7ee146715fcab5cd7e018
SSDEEP 96:VgJbo7bG2VHk3C45rJixqE+6nSvMn0iGLG8wq/aAtJ1t2RhU1fU:qJk7ZHgRJRHvcwBwqP/t6wf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 761dcdf12f41d119f49dbdca9bcab3928bbdfd8edd67e314d54689811f9d3e2f
MD5 2b54369538b0fb45e1bb9f49f71ce2db
SHA1 c20df42fda5854329e23826ba8f2015f506f7b92
SHA512 25e4898e3c082632dfd493756c4cc017decbef43ffa0b68f36d037841a33f2a1721f30314a85597ac30c7ecc99b7257ea43f3a903744179578a9c65fcf57a8b7
SSDEEP 192:ibEOXfXZQ6i1AZ2q6grklcm/iaULQAos:ib/41AZN6uklckLUJo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 79914940cbbf70a385f13a9970a9d577d7a7e07d240fe44563b45a472cd4bc3f
MD5 c6284e23cd7e4d11db8298deb4541083
SHA1 e338686c7579620383ab8cc5a51bbb8d846f60cf
SHA512 72103e470d770fb402a18e975ff339526a3e4c9aeb8fac1b0977995a6eace0eca965b1915404df9b5a25b59628db1b199d2b9b10372841309c137054356a5cd7
SSDEEP 96:q0HzOxnC1hncrcpRciM8wcxMkDOW6LbUXv8X2PXv5bcndYosRn:qJxw3pmiMRxNE/8c5bcdo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 f2633b3604a80a7b1be67858fb43288fd7b686730bad158f347dfa38c6df59d9
MD5 40909a97db3a51fc83aaeff503128b3f
SHA1 9693d68a1fb11db70f61b8277e1195dd298abbab
SHA512 cd1425e28302dfeced644fa155a09549aae25b96f5f6a7688624135a69be7abee8e6eaac89194dc6ec89281c45e00451fae43db5953360ee9a47dc0d11d07c77
SSDEEP 96:+Vyk3+0P+gcVUzWKw1lq4xNmuUUOnyX3z9zJ5cVK23EHC:+40P+gcVUzWlyuUStJ5cVKXHC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/registry.dll

IMPHASH cd53277eaa7bbb8fb5b2b678274dcb4e
SHA256 b610ab13da00e05b000026c73081cfdf0d2ebd3f2fad05e1d0f277060fc3c07f
MD5 351f89337642c165a48dd763aa210023
SHA1 a5b204cbc51a0ad84248aa680b85be7824f3354e
SHA512 10326b95ea81b377f74cb9e42135e891930a354b65ce50a4562246da33ca6816f5397089bb60cd1eb647bd28829d70f6425c3113440e11f9a9a4f7fecaac7f4c
SSDEEP 384:tTVUUuJHxgeh2OTU+X9pCtlohiTV0pWY7:tTqzHxgeh5X9oaiTgW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5427

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/coopen_setup_100030.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 4b2b035586333f7c16e6035e67bed9f4120b43933e74e8a29f64d04775e86328
MD5 86417458dc5b33ed2d64ec7ca79be209
SHA1 4786aef18d2409c6e5aa255c4663d455196292ad
SHA512 6b2153538d758b35ebb46cb0ff8485c3f8213c36d6a995329a439826225174333a068dfb08d6755e2fe19f2aa0bd752f962a2bcb80fd9a294f878586ee6e9da3
SSDEEP 24576:kLBUwTKA2P9U/cDeCiFwM9hmYYvNKt6n5duze92xK/zftXhp/:kLqsPihZieBYYvNKt65j2W7tXhF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cc:2f:76:ab:a4:76:cc:11:a7:d3:95:d1:0d:12:f3:46:0b:b7:3a:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京首都在线网络技术有限公司,O=北京首都在线网络技术有限公司,C=CN

Chains

Dec 14, 2010

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=北京首都在线网络技术有限公司,O=北京首都在线网络技术有限公司,C=CN

Serial Number

01:00:00:00:00:01:2a:22:5d:6d:d7

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 30, 2010 - Jul 30, 2011

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2017

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/PartnerDlg.ini

SHA256 2a5bed02c9fd0858d8dfb19e5d0b6b7dc50278ae3dd0bc40af176cf6987f51d5
MD5 4edfec9a953caec3feec6faa484f44f8
SHA1 1918cb4396242b0d4f6a9b3c29387b9671e59e4b
SHA512 5fddca040af28ab56e7dee4ac854fa057afe0604c6bbfc25e9052d281755b222b03109689015c147a83d1f2d69a1a61b02683c6f05b32664308ee1be4e4a0963
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 3663f682b9e6fbc0650a729555d6fc432c146e352791ad00a19212d64cc7da27
MD5 7cb5d7847bed05bcd661f07d97727786
SHA1 ec62aba9ece5897ae037db3e4a98e5fe5edd3b6c
SHA512 51b2b773a8fca7d3346b349c8dc4b0da6d6972350bd9754cf02ab6c093c61c95ee478d562db88c6d046fd341ef0a2d1b06148384c203037dba89abb3e9f5ccc8
SSDEEP 384:jKtc0vzG1ioSUspKthBTTN/o7Hleya9cM0Ac9khYLMkIX0+GCBgBTm:jucKiSUV3ZTNmFta9c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14223

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/install.bmp

SHA256 4f69420d6b100a17b0742ed5d1722e501d1830eaabd7e93d5ffc0d5e1a41333e
MD5 710c28daee6fc404154233d034716fc3
SHA1 e729fb05d98076c40fbd740000ddae847d1738bb
SHA512 642b362ffa026466168c318f434072558f0c6df52036733a5cf35662d444949f27d31e56ed2e1148df906d4e50ac6c135af96ab6c00f42af5f50a0853a571f8d
SSDEEP 384:IGLWviUVkEf+HzZExlcZYDgoyQCM5G0y073lwA1Le5l3o/PuQd6T:JLWLkpGcZYDHt5G6iA1Le5tYPug6T
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 4f69420d6b100a17b0742ed5d1722e501d1830eaabd7e93d5ffc0d5e1a41333e
MD5 710c28daee6fc404154233d034716fc3
SHA1 e729fb05d98076c40fbd740000ddae847d1738bb
SHA512 642b362ffa026466168c318f434072558f0c6df52036733a5cf35662d444949f27d31e56ed2e1148df906d4e50ac6c135af96ab6c00f42af5f50a0853a571f8d
SSDEEP 384:IGLWviUVkEf+HzZExlcZYDgoyQCM5G0y073lwA1Le5l3o/PuQd6T:JLWLkpGcZYDHt5G6iA1Le5tYPug6T
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/$_10_/HttpDownloader.exe

IMPHASH 4095847f15924fd0fef7c9ebf1826f51
SHA256 8272cb736920cd24f54dadfc6623ed5cf1ca2a8c465bad56d8857af9ab76830e
MD5 04d01d4b16285a63ce6a91822a892f64
SHA1 b23239a598877def3a073d3405d28eb3f6a63a3b
SHA512 8cbb2ebd6dbaa725722f75f17aa9d23cdaa6e87ba68335145abd314f0ce965c1ef2ad849830810894308bbacaa98ce1480fa8520a97d2a6a32fccdebff002fac
SSDEEP 384:RF9Z8VZeOTH+yuiAdoL8T10KJdAncr89du9y3K3iW0hdSAKNQ8LiiEUKDtPKDb/i:tZ8VZFTexTzPocWAwL3IGsJku+6Q5vV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c3:74:fe:a8:e1:18:3a:a1:0a:ac:b8:99:08:b9:e8:ce:89:45:99:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Capital Online Network Technology Co.Ltd.,O=Beijing Capital Online Network Technology Co.Ltd.,C=CN

Chains

Oct 19, 2009

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:00:f9:7f:aa:2e:1e

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 16, 2003 - Jan 27, 2014

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:e2:4e

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Serial Number

04:00:00:00:00:01:10:92:eb:82:95

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 5, 2007 - Jan 27, 2014

Subject

CN=Beijing Capital Online Network Technology Co.Ltd.,O=Beijing Capital Online Network Technology Co.Ltd.,C=CN

Serial Number

01:00:00:00:00:01:23:5a:e0:e4:3b

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 27, 2009 - Aug 27, 2010

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2017

Minor OS version

0

Major OS version

4

Entry point

9748

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord5186 ord858 ord924 ord800 ord5710 ord5683 ord860 ord540 ord350 ord354 ord825 ord1105 ord4673 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord815 ord641 ord609 ord795 ord765 ord2514 ord2621 ord1134 ord665 ord4376 ord4853 ord4998 ord4710 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord324 ord4234 ord2575 ord4396 ord3574 ord3721 ord6055 ord1776 ord5290 ord3402 ord3698 ord823 ord1146 ord1168 ord567 ord2302 ord537 ord4160 ord2863 ord2379 ord755 ord470 ord2642 ord3092 ord5953 ord2645 ord4224 ord3810 ord920 ord6385 ord1979 ord3663 ord3616 ord3127 ord5265 ord5651 ord1576

msvcrt

exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp _exit _onexit __dllonexit sprintf _mbscmp vsprintf _ftol __CxxFrameHandler atol _XcptFilter _setmbcp

kernel32

GetTempFileNameA WideCharToMultiByte GetCommandLineW WaitForSingleObject CreateProcessA GetModuleHandleA GetStartupInfoA GetLastError

user32

AppendMenuA GetSystemMenu DrawIcon GetClientRect LoadIconA IsIconic ShowWindow EnableWindow GetSystemMetrics SendMessageA SetDlgItemTextA PostMessageA

shell32

CommandLineToArgvW

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetOpenA HttpQueryInfoA

$_10_/$_10_/uninst.exe.nsis

SHA256 f382df122e2b5fa3004eeb5fbcfcdf5df2f4d16ae1db05232dc68700e928889d
MD5 8f660a6497f36d92a17261eb2f5b7985
SHA1 3138449f8e639c45f8f9245a7e2015c0d07d301a
SHA512 72fcdfbf9c69f5f8ee62886b5216de02afd722d5b929b06c3bd4bf94b9d676f9e06fee0214e0aa867383c725abe0e5081e5a10a35afa4f4e3cee4e16409ae35e
SSDEEP 384:j87d8jzr78eVoNDr+Og0MGPfbmGsNMv7B8J:A7grqrK0Mmz4Q18J
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/CCPMachineInfo.dll

IMPHASH 22abd1238fcf6f0b3b1549f2db91446e
SHA256 e09d28d706602648537a0c80e655db60520ba4d1005585e01f4c4afe68205760
MD5 4448afc124d4c041a689606cc5c4ce86
SHA1 0cbadd5f0b0087e26910aa97f3074f8dd35f7fee
SHA512 2bc53e6e2a683ac095ffd453d01861ce428fe7a94a7586f6e40e826f75b67ff114f26d5f38209ac30d85b9f3eeddfbc79ce029e277d9ca6a0ca8f38ed5c12f13
SSDEEP 192:sz0vqiqlYXfmHtGJRSUaQTBoF15UZNqSm5EzX8S8X8USY9kyYUv7n:MplW4IJ1LBguWv5Ez8t8UeyYUj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord823 ord924 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord3953 ord2982 ord3147 ord3259 ord4465 ord3136 ord4204 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord825 ord815 ord1176 ord1575 ord1168 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord6467 ord860 ord922 ord540 ord2818 ord939 ord800 ord4202 ord3262 ord535 ord1578 ord600 ord826 ord269 ord1116

msvcrt

__CxxFrameHandler __dllonexit ??1type_info@@UAE@XZ _adjust_fdiv malloc _initterm free _onexit

kernel32

LocalFree GetCurrentProcess SetPriorityClass CreateFileA CloseHandle DeviceIoControl GetVersionExA LocalAlloc

user32

wsprintfA MessageBoxW IsCharAlphaNumericA

iphlpapi

GetAdaptersInfo

$_10_/Coopen.scr

IMPHASH 275692bec0100c18fbd1963bea45a23d
SHA256 7c5500ef23b0fedffb0155cf00130f8b2b1e66932e2a0cdbadaae355fd6f8b03
MD5 3238b5035688cc6949293247b08c015e
SHA1 076d1a4467981297fa6d26278a798711639df02f
SHA512 18aba14c669c17825c0a428f9f2ea3f8f9b42afe584b89a3c6dc6b249aacaf517c179349242bb950161d3889c7e5c16ed9f03f580dcc377143b220709ff045e9
SSDEEP 768:rKyo7Qvdv6GRE0g5caH+cSev9E3Rkx2K:WJQIGRE0g59Ku96O2K
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

22908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAlloc ReadFile GetFileSize GetCommandLineA SetThreadPriority GetCurrentThread FreeLibrary GlobalLock LoadLibraryA GetModuleFileNameA WritePrivateProfileStringA GetStartupInfoA GetModuleHandleA GlobalUnlock MultiByteToWideChar GlobalFree GetTickCount Sleep CreateThread SetEvent WideCharToMultiByte OutputDebugStringA GetPrivateProfileIntA CreateFileA FindFirstFileA FindClose FindNextFileA WaitForSingleObject GetVersionExA CloseHandle CreateEventA GetSystemDirectoryA GetPrivateProfileStringA ExpandEnvironmentStringsA GetProcAddress

user32

wsprintfA GetClientRect FillRect BeginPaint GetWindowRect ReleaseDC GetDC DispatchMessageA TranslateMessage GetMessageA UpdateWindow ShowWindow MessageBoxA RegisterClassA LoadIconA LoadCursorA SystemParametersInfoA PostQuitMessage PostMessageA GetSystemMetrics CreateWindowExA AdjustWindowRect SetTimer KillTimer SetCursor DefWindowProcA EndPaint

gdi32

GetDeviceCaps CreateDCA StretchBlt SetStretchBltMode GetStockObject CreateCompatibleDC CreateCompatibleBitmap GetObjectA SelectPalette RealizePalette GetDIBits DeleteObject SelectObject DeleteDC TextOutA

advapi32

RegQueryValueExA RegOpenKeyA RegQueryValueA RegCloseKey RegCreateKeyExA

ole32

StringFromGUID2 CoCreateInstance CreateStreamOnHGlobal CoUninitialize CoInitialize

oleaut32

OleLoadPicture

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_Xlen@std@@YAXXZ ?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

msvcrt

_onexit __dllonexit free atoi isdigit atol memmove _except_handler3 _exit srand rand _mbscmp _strnicmp ??2@YAPAXI@Z __CxxFrameHandler strstr _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp time

$_10_/CoopenActiveControl110.dll

IMPHASH 6aa21ccdbbbb0d1fd90240b162f05b98
SHA256 a929ac8a08eeb966441646549a9e925a306aaea374ccba9996225ea0e14852f5
MD5 78e522aa4f7dc6ca322eabe916dd7190
SHA1 e7f40650e3de52e26f5d07dd8a4dc53f935ea97c
SHA512 9ec165d5acf2b1e5aa0bf79986a2458f5db910e7d2c739cfd0b092e392b3acc94f9df9c871b9d6484986dda5f5652ff60bb555c5d43e5f659df35adc12a667cd
SSDEEP 768:wuy+NqkvXDLvfkDrSXw456fXpTFWMcP6XFO5Bx9v7d+rT:wC/8DuXw456f5CPsFETN7dOT
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ExpandEnvironmentStringsW GetModuleHandleW GetModuleFileNameW CreateDirectoryW CreateFileW CloseHandle WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalLock GlobalUnlock lstrlenW DisableThreadLibraryCalls EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement InitializeCriticalSection LocalFree

user32

IsChild UnionRect SetFocus GetKeyState PtInRect GetFocus GetClientRect FindWindowW SendMessageW wsprintfW CreateWindowExW CallWindowProcW GetWindowLongW SetWindowLongW BeginPaint DefWindowProcW EndPaint InvalidateRect IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos IsWindow DestroyWindow GetParent ShowWindow

gdi32

GetDeviceCaps LPtoDP SetMapMode SetViewportOrgEx TextOutW SetTextAlign Rectangle CreateRectRgnIndirect CloseMetaFile DeleteMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileW DeleteDC

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

OleRegGetMiscStatus CreateDataAdviseHolder CoTaskMemFree CreateOleAdviseHolder CoTaskMemAlloc OleRegGetUserType OleRegEnumVerbs

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear SysStringLen LoadRegTypeLi SysFreeString OleCreatePropertyFrame

atl

ord30 ord45 ord31 ord27 ord26 ord58 ord50 ord44 ord43 ord16 ord21 ord32 ord57 ord15 ord51 ord23 ord18

msvcp60

?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z

msvcrt

wcslen wcscpy fclose malloc realloc memset memcmp ??2@YAPAXI@Z memcpy ??1type_info@@UAE@XZ _adjust_fdiv _purecall _initterm _CxxThrowException free wcscat fgetws _wfopen swprintf fwprintf _wtoi

$_10_/CoopenAir.exe

IMPHASH 7811f517d961bce7675eefabcb7f4606
SHA256 d94657d062b2abdcbf5b8fa9dd8974ad2218abca7426fdc7534a6d4aeaed523c
MD5 81caf14643c2fe71ee456f99a4ebbd87
SHA1 cc6fc467ee8b05dd12080fa1e8f1725e07e180cb
SHA512 69a15ecd6df384f648789bfe2cb1401b210d45a1c939c19ab6ad17c6271e0acf527d439a488d55f365757324a4aef1337e20ba044647c11606c424e1de86f059
SSDEEP 3072:eagesmM3HPxqeiQz0nbhmWTWNM2tyhWT+KKjLNDGbzMVZ+/joty7qeg27uOX:UJHPxDii4V5TWvcobzMVuqfs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

27:f7:47:29:51:54:d9:c2:86:5f:93:16:b3:a5:5a:be:e4:6e:89:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京首都在线网络技术有限公司,O=北京首都在线网络技术有限公司,C=CN

Chains

Nov 4, 2010

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=北京首都在线网络技术有限公司,O=北京首都在线网络技术有限公司,C=CN

Serial Number

01:00:00:00:00:01:2a:22:5d:6d:d7

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 30, 2010 - Jul 30, 2011

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2017

Minor OS version

0

Major OS version

4

Entry point

43775

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FormatMessageW GetStartupInfoW ExitProcess RtlUnwind TerminateProcess HeapFree HeapAlloc RaiseException HeapReAlloc HeapSize GetTimeZoneInformation UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentStrings GetCommandLineW GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter LCMapStringA LCMapStringW IsBadReadPtr IsBadCodePtr GetCPInfo GetStringTypeA GetStringTypeW SetStdHandle CompareStringA GetACP GetOEMCP SetEnvironmentVariableA FindResourceA GlobalAddAtomA GetProfileStringA GetFileTime GetFileSize GetFileAttributesW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileW GetCurrentProcess DuplicateHandle SetErrorMode FileTimeToLocalFileTime FileTimeToSystemTime GetTickCount SizeofResource GetProcessVersion WritePrivateProfileStringW GlobalFlags lstrcmpiW GetThreadLocale MulDiv SetLastError lstrcpynW TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc InterlockedDecrement GlobalUnlock GetModuleHandleA LoadLibraryA FreeLibrary lstrlenA MultiByteToWideChar GetVersion lstrcatW GlobalAddAtomW GlobalFindAtomW lstrcpyW GetModuleHandleW GetProcAddress FindResourceW LoadResource LockResource GlobalFree GetModuleFileNameW GlobalLock lstrcmpW GlobalAlloc GlobalDeleteAtom lstrcmpA lstrcmpiA lstrlenW WideCharToMultiByte GetCurrentThread GetCurrentThreadId CompareStringW OutputDebugStringW InterlockedIncrement CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseMutex CloseHandle CreateMutexW GetLastError CreateEventW GetVersionExA ResetEvent

user32

GetSysColorBrush RegisterClipboardFormatW InvalidateRect CharUpperW PostThreadMessageW SetFocus AdjustWindowRectEx ScreenToClient GetCapture WinHelpW wsprintfW GetClassInfoW RegisterClassW GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetDlgItem GetWindowTextW GetDlgCtrlID DestroyWindow CreateWindowExW SetPropW UnhookWindowsHookEx GetPropW CallWindowProcW RemovePropW DefWindowProcW GetMessageTime GetMessagePos GetForegroundWindow SetWindowLongW RegisterWindowMessageW IntersectRect SystemParametersInfoW GetWindowPlacement GetWindowRect MapDialogRect SetWindowPos SetWindowContextHelpId IsDialogMessageW MessageBeep GetNextDlgGroupItem GetWindow GetTopWindow GetMenuCheckMarkDimensions LoadBitmapW GetMenuState ModifyMenuW CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageW TranslateMessage DispatchMessageW GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible PeekMessageW GetCursorPos SetWindowsHookExW GetParent GetLastActivePopup IsWindowEnabled GetWindowLongW MessageBoxW SetCursor PostMessageW GetDesktopWindow UnregisterClassW GetWindowTextLengthA HideCaret ShowCaret ExcludeUpdateRgn GetWindowTextA SetForegroundWindow CopyRect EnableWindow KillTimer IsIconic GetSystemMetrics GetClientRect DrawIcon GetSystemMenu AppendMenuW SendMessageW RegisterHotKey PtInRect GetClassNameW OffsetRect SetTimer LoadIconW DrawTextA DrawFocusRect GetClassInfoA DefDlgProcA DefWindowProcA CharNextA CallWindowProcA RemovePropA SetWindowsHookExA GetWindowLongA SendMessageA IsWindowUnicode GetClassNameA SetWindowLongA SetPropA GetPropA FindWindowW PostQuitMessage IsWindow LoadCursorW InflateRect CharNextW GrayStringW DrawTextW TabbedTextOutW EndPaint BeginPaint GetWindowDC ClientToScreen DestroyMenu LoadStringW ShowWindow MoveWindow SetMenuItemBitmaps SetWindowTextW GetDC SetActiveWindow SetRect CopyAcceleratorTableW EndDialog CreateDialogIndirectParamW UpdateWindow SendDlgItemMessageW SendDlgItemMessageA MapWindowPoints IsChild GetSysColor ReleaseDC

gdi32

SetBkMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx IntersectClipRect DeleteObject GetStockObject GetDeviceCaps GetViewportExtEx GetWindowExtEx CreateSolidBrush PtVisible RectVisible TextOutW ExtTextOutW Escape BitBlt CreateCompatibleDC GetTextColor GetBkColor GetMapMode PatBlt SelectObject RestoreDC SaveDC DeleteDC SetMapMode LPtoDP DPtoLP GetObjectW SetBkColor SetTextColor GetClipBox CreateDIBitmap ExtTextOutA GetTextExtentPointA CreateBitmap

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegCreateKeyExW

comctl32

ord17

oledlg

OleUIBusyW

ole32

CoRegisterMessageFilter CoRevokeClassObject CoFreeUnusedLibraries OleUninitialize CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID OleInitialize OleFlushClipboard OleIsCurrentClipboard

olepro32

ord253

oleaut32

VariantCopy VariantChangeType VariantTimeToSystemTime VariantClear SysAllocStringLen SysFreeString SysAllocString VariantInit SysStringLen

urlmon

CoInternetSetFeatureEnabled

wininet

InternetGetConnectedState InternetCheckConnectionW

winmm

timeGetTime

$_10_/CoopenLottery.Config

SHA256 bc9e69aa19bd65d27933b647e8705cf9defda65b5cde987faca9c89a855b1942
MD5 b9e496c93b47af19a3e835327cc6259e
SHA1 464ef3e31b8e5fc2df887c9b01d3b47a1d588c68
SHA512 3440dc9071ec5a14277c603268ccc83f5daaaf68f3d2ed8b2c6db17c9186b22e5378d951c20f59fc80d873045837496565eb6e5dd84e786f15984244b6b054d0
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/CoopenLottery.cop

IMPHASH d2100ef740f57bc1437c03b2d4968029
SHA256 1cc7c64fa43e5a432562c8b2835888377f7d23bf81f6955f3588c856362619da
MD5 0279ba094e7ba00c168c34af9b10e76d
SHA1 035ce61141f04d19d5b42c14e3273617e600b66f
SHA512 bb40deb6656cbefc98b836c73a9cb3f2b9642df7f3af2786171e4cc98ec789f3cbf435c4afd88d4b256ee37d98daa3ae9ffb7f18a3702acd43c41fdca6e03853
SSDEEP 6144:tXBF2vDhOIMUAvyWS2GLdV4m/pVn9YZPb0OW64mGSIeiHWzLnjj/a:ovDhhXgPBud2IiFi6XGSpi23PC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

70961

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapAlloc GetCommandLineA ExitProcess TerminateProcess HeapFree RaiseException GetTimeZoneInformation HeapSize HeapReAlloc GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetHandleCount GetStdHandle GetFileType RtlUnwind FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetUnhandledExceptionFilter LCMapStringA LCMapStringW IsBadReadPtr IsBadCodePtr GetCPInfo GetACP GetOEMCP GetStringTypeA GetStringTypeW SetStdHandle CompareStringA SetEnvironmentVariableA GetFileTime GetFileSize GetFileAttributesW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileW GetCurrentProcess DuplicateHandle GetProcessVersion GetLastError GlobalFlags lstrcmpiW SetErrorMode FileTimeToLocalFileTime FileTimeToSystemTime GetThreadLocale MulDiv SetLastError FormatMessageW GetModuleHandleA LoadLibraryA GetVersion lstrcatW GlobalAddAtomW GlobalFindAtomW lstrcpyW GetModuleHandleW MultiByteToWideChar lstrlenA InterlockedDecrement lstrcpynW TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc LockResource CloseHandle lstrcmpW GlobalDeleteAtom lstrlenW WideCharToMultiByte GetCurrentThread FindResourceW SizeofResource LoadResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentThreadId GetTickCount GetModuleFileNameW ExpandEnvironmentStringsW GetVersionExW LoadLibraryW GetProcAddress FreeLibrary CompareStringW InterlockedIncrement GetPrivateProfileIntW GetStartupInfoA WritePrivateProfileStringW

user32

DestroyMenu CharUpperW PostThreadMessageW LoadCursorW GetClassNameW UnregisterClassW CharNextW GrayStringW DrawTextW TabbedTextOutW GetWindowDC ClientToScreen WindowFromPoint LoadIconW SendDlgItemMessageA MapWindowPoints GetSysColor AdjustWindowRectEx ScreenToClient GetCapture WinHelpW wsprintfW GetClassInfoW RegisterClassW GetMenu GetMenuItemCount GetSubMenu GetMenuItemID SetPropW GetPropW CallWindowProcW RegisterClipboardFormatW DefWindowProcW GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow RegisterWindowMessageW IsIconic GetWindowPlacement EndDialog SetActiveWindow CreateDialogIndirectParamW MoveWindow GetDlgCtrlID GetWindowTextW SetWindowTextW SendDlgItemMessageW GetDlgItem GetClientRect SetFocus SetRect CopyAcceleratorTableW OffsetRect CopyRect MapDialogRect SetWindowContextHelpId MessageBeep IsWindow IsChild GetNextDlgGroupItem GetWindow GetTopWindow GetMenuCheckMarkDimensions LoadBitmapW GetMenuState ModifyMenuW SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageW TranslateMessage DispatchMessageW GetActiveWindow GetKeyState ValidateRect IsWindowVisible PeekMessageW LoadStringW RemovePropW GetSysColorBrush GetLastActivePopup IsWindowEnabled PostQuitMessage SetTimer MessageBoxW IsDialogMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW BringWindowToTop PostMessageW ShowWindow SystemParametersInfoW GetCursorPos PtInRect KillTimer GetDC GetWindowLongW SetWindowLongW ReleaseDC UpdateWindow SetWindowPos EnableWindow SetCursor InvalidateRect GetParent GetWindowRect CreateWindowExW SendMessageW GetSystemMetrics DestroyWindow GetDesktopWindow

gdi32

GetDeviceCaps GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape GetTextColor GetBkColor ScaleWindowExtEx GetMapMode DeleteDC SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetStockObject RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox SetMapMode LPtoDP DPtoLP CreateBitmap CreateCompatibleDC CreateDIBSection SelectObject StretchBlt DeleteObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegCreateKeyExW RegCloseKey RegSetValueExW RegOpenKeyExW

comctl32

_TrackMouseEvent ord17

oledlg

OleUIBusyW

ole32

CoRevokeClassObject OleFlushClipboard CoInitialize CoUninitialize OleInitialize OleUninitialize CreateStreamOnHGlobal CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoTaskMemFree CoTaskMemAlloc CoFreeUnusedLibraries OleIsCurrentClipboard CoRegisterMessageFilter

olepro32

ord253

oleaut32

SysStringLen VariantChangeType VariantCopy SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData VariantTimeToSystemTime SysAllocStringLen SysFreeString VariantClear SysAllocString VariantInit

gdiplus

GdipFree GdipCloneBrush GdipAlloc GdipCreateFontFamilyFromName GdipCreateFont GdipCreateSolidFill GdipDrawString GdipDeleteBrush GdipDeleteFont GdipDrawImageI GdipSetTextRenderingHint GdipDrawImageRectI GdipReleaseDC GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDrawImagePointRectI GdipDeleteGraphics GdiplusStartup GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipDeleteFontFamily GdipCloneImage GdipDisposeImage

wininet

InternetSetCookieW

$_10_/CoopenMainManager.dll

IMPHASH c46dbef156038cf8343e2004d38045a0
SHA256 4675621564a482c0d242e86d0da3ce818e60143672155570a3a14ec09f6afa26
MD5 60aee0a9b29f56e333093d237fb20f6b
SHA1 a3023dab4d74a0e9803382e20b64ce780c9c2ff3
SHA512 9f7224e38056fe18bc34730496faa739fb245a70fb429365b1044c606ca22d2bb5338323013c436dbda63bf863683eb2bfc3a0364777c8df2149a8691c4ffdda
SSDEEP 24576:wuDnWTh+oi/Epr/xOUr3hrp/zUP9Ujb2xkY:wuiFO/Ep0irpWUjb2xkY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

468765

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GlobalFlags SetLastError GetModuleHandleA GlobalFindAtomW GlobalAddAtomW LoadLibraryA GetProcessVersion RtlUnwind CreateThread ExitThread GetCommandLineA TerminateProcess HeapAlloc HeapFree RaiseException HeapSize HeapReAlloc UnhandledExceptionFilter SetHandleCount GetStdHandle GetStartupInfoA lstrcpynW FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr GetCPInfo GetACP GetOEMCP SetStdHandle GetStringTypeA GetStringTypeW lstrcpyW lstrcatW SetErrorMode TlsGetValue LocalReAlloc TlsSetValue GlobalReAlloc TlsFree GlobalHandle TlsAlloc LocalAlloc lstrlenA InterlockedIncrement GlobalDeleteAtom GetCurrentThread GetCurrentThreadId FindResourceW SizeofResource LoadResource LockResource FreeResource GetExitCodeThread TerminateThread OpenEventW OpenProcess lstrcmpW ResetEvent LocalFileTimeToFileTime SetFileTime DosDateTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime GetFileType GetDriveTypeW LocalFree FormatMessageW GetTempPathW MulDiv GetVersion InterlockedDecrement GetLastError GetLocalTime DuplicateHandle GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW CreateDirectoryW SetCurrentDirectoryW SetEndOfFile GetFileSize SetFilePointer FlushFileBuffers ReadFile CopyFileW DeleteFileW FindNextFileW FindFirstFileW FindClose WideCharToMultiByte MultiByteToWideChar WriteFile CreateFileW GetModuleHandleW ExitProcess GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentProcess SetPriorityClass CreateFileA DeviceIoControl SetEvent EnterCriticalSection LeaveCriticalSection WaitForSingleObject CloseHandle DeleteCriticalSection InitializeCriticalSection CreateEventW GetVersionExW lstrlenW GetModuleFileNameW Sleep ExpandEnvironmentStringsW GetFileAttributesW SetFileAttributesW FreeLibrary GetTickCount LoadLibraryW GetProcAddress GetModuleFileNameA GetSystemDirectoryW

user32

GetMessagePos GetMessageTime RemovePropW GetPropW SetPropW GetMenuItemID GetSubMenu GetMenu RegisterClassW GetClassInfoW WinHelpW GetTopWindow CopyRect AdjustWindowRectEx LoadStringW DestroyMenu GetMenuCheckMarkDimensions GetMenuState ModifyMenuW CheckMenuItem EnableMenuItem GetNextDlgTabItem GetMessageW TranslateMessage DispatchMessageW GetKeyState CallNextHookEx ValidateRect PeekMessageW SetWindowsHookExW GetLastActivePopup PostThreadMessageW DrawTextExW FillRect GetDesktopWindow GetForegroundWindow GetAncestor GetWindowTextW GetWindowThreadProcessId RegisterWindowMessageW SetWindowTextW TrackMouseEvent FindWindowExW SetClassLongW CreateDialogParamW IsWindowEnabled LoadBitmapW SendDlgItemMessageW GetDlgItemTextW SetDlgItemTextW CheckDlgButton SetDlgItemInt CheckRadioButton GetDlgItemInt IsDlgButtonChecked DrawFocusRect CallWindowProcW GetCapture MapWindowPoints GetWindow SetFocus GetDlgItem GetActiveWindow SetActiveWindow EnableWindow IsWindow GetDoubleClickTime PostQuitMessage SetForegroundWindow GetSysColorBrush UpdateWindow DrawFrameControl GetFocus InvalidateRect GetSysColor DrawEdge DrawStateW SetRect PostMessageW EqualRect GetParent GetWindowDC wsprintfW InflateRect ScreenToClient IsWindowVisible ClientToScreen SetParent GetWindowLongW LoadIconW SetWindowLongW GetDC SetCapture MessageBoxW FindWindowW IsIconic GetWindowPlacement GetClassNameW ReleaseCapture SetWindowPos ReleaseDC SetTimer LoadCursorW SetCursor KillTimer GetCursorPos PtInRect GetWindowRect GetSystemMetrics GrayStringW TabbedTextOutW GetMenuItemCount GetDlgCtrlID UnregisterClassW WindowFromPoint UnhookWindowsHookEx SystemParametersInfoW OffsetRect DestroyWindow LoadImageW DestroyIcon ShowWindow RegisterClassExW CloseWindow MoveWindow DefWindowProcW CreateWindowExW SendMessageW IsCharAlphaNumericW wsprintfA EndPaint DrawTextW GetClientRect BeginPaint SetMenuItemBitmaps

gdi32

SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox SetMapMode PtVisible RectVisible Escape RestoreDC SaveDC CreateBitmap CreateDCW SelectPalette RealizePalette GetDIBits CreateFontW CreateFontIndirectW SetBkColor ExtTextOutW GetTextExtentPointW GetNearestColor SetBkMode SetTextColor ExtCreatePen GetStockObject TextOutW GetDeviceCaps GetPixel BitBlt CreateDIBSection GetObjectA CreateCompatibleDC CreateSolidBrush CreateCompatibleBitmap SelectObject PatBlt DeleteDC DeleteObject GetObjectW

comdlg32

ChooseColorW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHFileOperationW SHGetMalloc SHGetSpecialFolderLocation SHBrowseForFolderW SHGetPathFromIDListW Shell_NotifyIconW SHGetSpecialFolderPathW ShellExecuteW

comctl32

ImageList_Destroy ImageList_GetIcon ImageList_AddMasked ImageList_Create _TrackMouseEvent ord17 ImageList_ReplaceIcon PropertySheetW ImageList_GetImageInfo ImageList_Add

iphlpapi

GetAdaptersInfo

gdiplus

GdipGetStringFormatFlags GdipGetFontHeight GdipGetFontSize GdipDeleteGraphics GdipDisposeImageAttributes GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetCompositingMode GdipSetSmoothingMode GdipSetImageAttributesColorMatrix GdipCreateImageAttributes GdipCreateFromHDC GdipDrawImageI GdipDrawImageRectI GdipFillRectangleI GdipCreateSolidFill GdipCreateFontFromLogfontW GdipSetStringFormatFlags GdipCreateLineBrushFromRectI GdipDrawImagePointsRectI GdipGetLogFontW GdipDeleteFontFamily GdipReleaseDC GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipDeletePath GdipDeleteRegion GdipGetRegionHRgn GdipCreateRegionPath GdipAddPathPolygon GdipCreatePath GdipDrawPolygon GdipFillRegion GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipMeasureString GdipGetDC GdipCloneBrush GdipCreateStringFormat GdipCreateFontFromLogfontA GdipDrawImagePointsI GdipCreateFontFromDC GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipCreateBitmapFromHBITMAP GdipCreateTexture GdipDrawString GdipGetImageHeight GdipDrawImageRectRectI GdipCreatePen1 GdipDrawRectangleI GdipDeletePen GdipAlloc GdipLoadImageFromFile GdiplusShutdown GdiplusStartup GdipDeleteBrush GdipDeleteFont GdipDeleteStringFormat GdipCloneImage GdipDisposeImage GdipFree GdipCreateFont GdipGetImageWidth

ole32

OleRun CreateStreamOnHGlobal OleInitialize CoTaskMemFree CoCreateInstance OleDraw OleCreate OleSetContainedObject CoUninitialize CoInitialize OleUninitialize

oleaut32

SysAllocString OleLoadPicture VariantClear SysStringLen VariantInit VariantChangeType GetErrorInfo SysFreeString

wininet

HttpQueryInfoW InternetReadFile InternetGetLastResponseInfoW InternetGetConnectedState HttpOpenRequestW InternetConnectW InternetCloseHandle InternetOpenW InternetSetOptionW InternetOpenUrlW HttpSendRequestW

shlwapi

PathFileExistsW PathFindExtensionW StrCmpIW StrToIntW

psapi

EnumProcessModules GetModuleBaseNameW

$_10_/Resource/Plugins/CoopenLottery.png

SHA256 9775d9738c56faa37e5db4c2d9f0db706e48e876009482ceebd9fa1a7cc15a56
MD5 e44baf18674e028f39e72a5b55c0d089
SHA1 31bd3fc4383d1efaae44157d0e00047a2562d257
SHA512 c0b7a68467b9def16beff289f54d1e84ac9cb5123b2ab5e994c1a50b147ca8fac2b63e802e7deb05eb065bf4cf3d03675dc311941d1d7eabbeb4b257a71e74cd
SSDEEP 96:tAESMllcHitlIxv9vk7C1+I4wWHLihk/xzY3FJx3RMixY+09vG:1SHIIHUCD4wagzx3eA709e
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/Plugins/CoopenNotepad.png

SHA256 daa625dff26d76315e8f4af22035b4189361119deba3c6f13f5390a78ecd1637
MD5 f58fdfbd5766728f96ca15bc6d84a139
SHA1 bb3f24a4f0b2f92f08260a8e4d90fce6fe0f80a6
SHA512 a190d997e03ce3361907bcc779de2647375be2511d596054dbe2bc39e51df3946bb83577e8cab47592610d9c2993c276ec2037a3f28ceda6d0ebccb885675232
SSDEEP 96:tAESMllcHitlIxv9vk7C1+I4wWHLihk/xqsmgti5KlE+ozgg+nL+pbvwU2iFv+0K:1SHIIHUCD4waK+2Xziov+/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/Plugins/CoopenSearchTool.png

SHA256 a8d6fea86285ffb94aad288d9acc2672a24e60bbd92f4ef1395db60d9cc8c204
MD5 c328e9cf64b02235ae496afa14889cdc
SHA1 822b0ca6406c4a7756e471e718042dfb6c9fa67f
SHA512 0f700ba9a0e3efb0dd4adf5adf8c8eced52af7f4020fbdaa81c3a306f26380372cf140d13ba04758119b3b0eaf566cb16d6f1bdfb7e4551d58343decc3d01d2a
SSDEEP 96:tAESMllcHitlIxv9vk7C1+I4wWHLihk/xr+w9Y7UtN7V43pi0yof3dv:1SHIIHUCD4waYw9Y7UJ4Zief3dv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/Plugins/CoopenWeather.png

SHA256 210f20c618117ce30a6862f06d204348f02ac65d7d2270f07b1f13e1c5386e9f
MD5 56893f72cd5cc42466703296c4b77d55
SHA1 b2bf1e0111451259af658e611708a375a170b8bb
SHA512 9c61025c50ea7075d1a49a156c6eb303b3a1a35d18980b793853c341f067bd60b2532bb856f4b704b0476c9dfa76df4a601db6ac75fee133e7148f7a7552340f
SSDEEP 96:tAESMllcHitlIxv9vk7C1+I4wWHLihk/xMf8SKEEIQz3Mdd:1SHIIHUCD4waCf8VJSd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/Plugins/border.png

SHA256 b36ab191f95a7da400bd9878d8bff5ce125b2274944c5d9bdeea89c09153add4
MD5 c2ede0a3cda081ec1bb553b4d0c89603
SHA1 a3ee63614a95e879d9e0e631aac8f0d72223c8d2
SHA512 3ee1c44d52376d92771d919eaa75b3bdc378b27f1f3c81142cd2afffb40429bc53ad42d21b3048a1f7f3b8ec207473a67b87a17b6f6e907e811d278fbe822b7f
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/Plugins/hover.png

SHA256 55cab15be83c98d2981bb8fe5c3f21bccdd5baf49fa846207a4f878826338e63
MD5 fbd850539d41bd6cd7b4b4e0d13ce0a0
SHA1 e1bade7444981eb021d99f9231fedaf9fb5d606f
SHA512 db9a16b7f4d76122440112a39fa31801efe32e4091831d859024d631846ba7a92e928e5275383c663d3350f76b2b723f5b46c1f8bc640529da0834058edf6285
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/Plugins/running.png

SHA256 f9c485900d770ecd7756e1cfe4df50354ceb16bc9104934d2ce62b03858c125f
MD5 62ecf37944b36bb2c0226dfde267b8ac
SHA1 d2b11b002b3e5279e28190ecf6abb9f0caf46004
SHA512 ed4c55661cf85ac62bbaca891d97c573759e1aba667208063a53ca01aabe23b67ecd67f5c83148c021b1ce751a90cf7453e8e49e7325199081eb3eb3e7da2d4b
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/Plugins/tip.png

SHA256 44aa21f1e6fa02f58cebdca813122c2360f3cbe87dfe8f9f702d8fc3c0684e63
MD5 892f3fb38e0ce23c407b38af0f1bb923
SHA1 42e9b23ec6c369c3a35282e8d3d0a52cec866a99
SHA512 1c368cc80e8da2c5dcc5c6c11acfeb8b65dac80a99a8228eb46179aaacc1fca5ec7259311a615e3217c4004716d3eeb5b09e55b5741cf1662e615b0cb5f7611a
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Background.png

SHA256 a441f330499453a3ecb20b7ac00f086dfae1fcf8c523cc4d2535c52723ce9a40
MD5 af3fc561248514b757b1e1ca3ed933ac
SHA1 6f65624a45a267ec0ff48f323be99b100f79db9f
SHA512 05cd63672031d5469d735923ea26ec9b459cb07078af46d107e390906927999c8572b6d2c44383ab3419644b476131fae762ac8b8d08e1d113f2de8c00c915dc
SSDEEP 96:mMZkItTHYDuXp35WmPQyvcMDRynA4U4Cx6ouRSbXSbIwXc7oJ5F2yLEsNQ3ttg:mok8J5pWuQyjtyux6obbqIwMMkyLtNOs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Channel.png

SHA256 07a4013a51c36fa265ab621fe673c2e2c5dd1af480f51ecc54b7b2c919242477
MD5 4dd7916a2eadda37420721628143f823
SHA1 a00187f9fd16b59ac23272292363bfa6a1860630
SHA512 f8058f209a24eb99da466b866024e04bc627086976b9733493e5e67b10b6a0df3db9c5b3fb050f8f458d6656e72e00306bde2457b7e171907b684bf7262328b6
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Close.png

SHA256 c2fff663bcdf180985f6b45fba7fd0e526ffd11d8b27eae6eb1eb302fd9cd767
MD5 3866af8e64c640812c954641ba87d8d7
SHA1 e602a7934f74d9d59ee8923ec37113041be54e79
SHA512 8afe1e59424759f1c336bcfc5229a14c626d4c92a173a64bd8354823411a7a9ad066d4e9a9e42820d73ca052b4a97009ac8b1356c339722742ef93384474f43d
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Commit.png

SHA256 6987ad414741684bde8472c1aa252cb0066311c01a1dd27a70b5a51c524551ff
MD5 dc09fdd540cbffd051bce8a3403212bd
SHA1 fdbfa319d99e426ec06d3401418221305220a7df
SHA512 3f37e41d842b77f6704ba53b7f16d4ed747c69e8797d305451dc54b6519a88996be3d85c982cceca01675db0d6efa9c46be468b0516bfaba364413bd18f2ca5e
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Next.png

SHA256 eb522f713ffdac54d5029243700ea142dfa0b1e4dc11a88257ac19148be6642d
MD5 2917cad3e39ac06e082780f167fa0f44
SHA1 df07535366f50c5a0b00205bbb868eae9623094d
SHA512 75baa151fce8ee5c7b4317a92822612d6dd0d5052b560252831e06a5de05ac7c01dc8700be2b6c72e9831e796951df3859689ed44377162662e51298f74172bc
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Pause.png

SHA256 eedc79110acc5dddcc4cc57c62961f141120359ed20a6c9de40a9f9e78476c2e
MD5 faaaaf227d4eb429f8b69fc4e0e1b16c
SHA1 6816313798ef3ea247621bb440bcff3440c6c446
SHA512 94af7615b0b39fb9a969bc324a24b29bffa08bbf8907fbc897179fc3885ca3510b6c3ddcc06ecff880165c05cead9f681dade263d52cc1247472d13796e3be93
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Play.png

SHA256 6d68a9929c52ae8652ad5716e7b8ec4c545b0b7f550121ddf698887e310dab74
MD5 26dbe609718c95a139f599d59b36657b
SHA1 470876b1776c2b9ea3745ab4585ed5e2f956afb8
SHA512 3f2c237904aad2a06c26b50e946e12244b29ce10ff5c9c85d56b6b90518c6aa8bde265f2f5c91984c3bb04e31622ed8b9e1bfc7dab01bcd9bd0fa5a5546c00d7
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Prev.png

SHA256 ba0a735ccc5aaa30ecc0454f2d1465c0a313e7e45a1a7b8cfecf169944c6d351
MD5 e74c72f68eb70580e2a1cbd4e78d571a
SHA1 1be39fff6e7988718233632aa2be59acce14a285
SHA512 51259aed26144bf1ffbefea7421352606ae708093d7e5fea3f068718fe70a7840204944297fba225ee645244f4f41fc989d3244507ad931a5051f50a0ae0ff27
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Button_Widget.png

SHA256 b6b8d9f590e46d3f8ea11bd4ec578e6f12d45143af4554fd14cc9a13869c35e6
MD5 7381c99fabae123b943046adffb95ac8
SHA1 ce905f92de5db8eab537cba9015ceb4739d41b92
SHA512 2f9f2f73c615a6398ec1efb6190a8d89dc2a0933612ea3759033bbb1722767cd5c855d2c6e85b02a2b2b31c57464ea154db03f7f9e6c31b90610e670a0351624
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/CheckC.png

SHA256 9533d5f2401544227ba1a57372342f9855f96563e7c664c3650ed0f933b6d34b
MD5 802348f0375ae8abb60811603f467686
SHA1 efc6db2665e1ad12560af266eae1b716c0a679f6
SHA512 248e3c66452ff712a55fc91944efe4a55d0d0fdf29707cb21adca779eff07f3cfc140e235cf5e5245b06b90ee1e66075f673274ce5fd71ae835696f1ad8a03f1
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/CheckU.png

SHA256 7de19fd4f2de853574254c5d59957c33931a350eafdef6584747765437a94d63
MD5 076dfa5034079dfab55491cbcf53d70d
SHA1 061c80e6e54936441ef9a37509c1eef2930640e2
SHA512 cfff1acad930f447ec321d34d4640b1686241d1febf650910987737d0eb25c692658fad0752dc4bf368d1e051b0694fd3f817739fe3f4a58f9af1b6bc7c5652a
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Indicator1.png

SHA256 c9a90a114fe376d43695c18bae61d435adf81912f3d7e854e0f70d107744d928
MD5 07a11c1eb1c78145c8567ad3eb7dee96
SHA1 40040da83d8fc55fee26646c3c8b4f3123ef504b
SHA512 c3c5e53110c884b440e80bf2d1ca198e7ebce2b76115d10701a5eb9d028f553fb59dc6f46358ecc0feb818ec045231b943c168b3b4b5e082f0b06d0ffaef0f53
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Indicator2.png

SHA256 ed95e300710799ee8030eb8f8fbd0a0b11be0553eaa09e290b30353d13f0e4b0
MD5 26e9da50c4bd42549dc8720ca38e6e8b
SHA1 9e00c1e4357bd37c505d375b35b013ef845272c1
SHA512 dd7ddfd05d4fae1a79d0d73dfc8674353382df9e334770b79570c5051356a04ae0f3401bcde8a57959d4055c778d6f556635f099b5f7e9565d320a4b26f509bb
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/MainIcon.png

SHA256 dccd8b4ab98dd10f226f450fe6d9626fd4be91679542f088a6bb2444d75eb70b
MD5 47ad98e1168aac8e6e58a0b20304391d
SHA1 3e153de12d65b417cb80c7d357c782453a6cbea0
SHA512 c1cb2860c0edc2ca1ae15075c563f073a9bd3a6b7653439f05a99c0b2e8732cc8432d1a3ba2a43c2171e869e56928afd4b773c4c111eeca1d9fe8593895a9c93
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Message.png

SHA256 dc3d3de1390847a35195e07b4f044c6f7875c056e34c307589594d2a6481aa75
MD5 bee0c831238ef3ddc61562443ea1609f
SHA1 d5a7d73265bc63384abab86caf9c9328afdaa074
SHA512 1eb020ca3d450d02e1fa96896983a205354a01665349ec5d409a45dab2fb99e7fe0370f27cb4394a6462b466fd1575cbab04ee61f64c58e25e9e7b3ef1b3f390
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Notify.png

SHA256 de34dc04811c566873646b8d8138d23da930482f92c15c07405bc40c8dbd43bb
MD5 f35f019b36eaae792611288d2569e50a
SHA1 c2cafec252ec2490df488825aa405271ce7cbebb
SHA512 fa6fcca7bade525a87091ce521b00d5b8b2a9a22571b74f157bc9ed03ee61867b74fd90bfb635cc5f81eb5018caf5f6076557affeb7a4b74569e58331db14c09
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Progress.png

SHA256 1879cd50d901d9be4a7f6dcfbb38ba98fb7ff6e4001798dae66415479eef8f9b
MD5 a3c16f92de8cc28ef8c96df2e40f6ced
SHA1 4f1f8fedd6f93be9e06105e0723d5d441cd37762
SHA512 78b89745d755101b59d6e89ba0c3c54e312d1145de8c9b2994042b69e7a49bd4755a50e96071728908352289fb0c2e10d6d9b9b78b55f00cf5222efad62c71ba
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Push_Cancel.png

SHA256 866f7bf4e902370f59e259aa96b152bd508eeb17109c9272e35bcd4da6c10319
MD5 942c75380e160f36715e3c45fdd767d2
SHA1 06b5d66533ecb1842a99c533518faf46ccb727d9
SHA512 3f5c858164178c800274b2fc65021d9e12134f190100b8c24747df3e2cc2bb98a19730700411d0a2d073eccb795a941f9b92cf1096ee4f9002b372a67ea5a81e
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Push_Config.png

SHA256 3673c03c1b30bc2db7aee9f52563a39713673cf3fb5cf820423ca797cce017bf
MD5 eb7ced298a71ef5a572de68f0e9beb3f
SHA1 fb5036ee0c63e90352e3bed5e7b83a9a3f5fdec4
SHA512 a7e8a69c9de70014a05affd4fee3a566ab053e1951baaf7daaf8799bfd20cf79019520c9317c4f78bbb9711cee82763c9a425846d9d2b38b0104933efe94698b
SSDEEP 96:kllcHitlIxv9vk7C1+I4wWHLihk/xwoojFaoru17GYUtXIhkr+5DqWRxRur:/IIHUCD4wa2oo5aoCcYUehkK8W3Rur
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/Push_Confirm.png

SHA256 422cb0a655ae6335cce7865e5efab8a159e9b98a9e4083d7fb63cf88d264b39d
MD5 4ed06ecc713c0354c6306b1fe566a52a
SHA1 f602e9449dc48a2d0a3bba92791a3ea2c70228f2
SHA512 c03800ad1844a6a5f25cdaccce28f8b6678649484ae1ec4b58b8ae4fe926dfea3174a7bd9491d9f7c457a25c8b5a4a82237254c0548b079bb0e5b777c9781477
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Push_Folder.png

SHA256 f156643753fba950edd22d231a6c83f9be0c2f63d05e0cde8d1b37247ad383ca
MD5 924155138abba11aa9b96736c69b4a54
SHA1 a594f44a88c1aed070cc16fe6a7db473486f35fe
SHA512 b5074975c00f6f937360be6c1aa7aaa43f0cefad5a8a15722d80ea0c0b5c7973c017f87eb2d66bd296e9d1072613084034ae8054c8a90126749302ea710062d5
SSDEEP 96:2llcHitlIxv9vk7C1+I4wWHLihk/xsyiI6dXvhzbT9/j6ZxgqwB3k:VIIHUCD4wagJD5qGVBU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/RadioC.png

SHA256 53d887bfa4179b992bcf98648af8b097c41b7e3c85b553d0a7946bae2a8ecdf9
MD5 cec767ca1b71ed97bbc04251fd0234e5
SHA1 d8bee401da45db0e6004a1d2ca67aed7e4a53f9d
SHA512 d65c6a54eea210707f5851b5d005a131e20758ef85ef8237553a7a23f40d412fb740d4e53f1d80435e61f013bf644b9ec7e33759c1ce72df512a4d99da283213
SSDEEP 96:1nSY8ZkItQRUTBbYeIBmkyPOHeISqNggFL7R9lb:1nSrkLeINyPOhSmFnRL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/RadioU.png

SHA256 7a20e5e3ff4b2a1530536eeb7c2ecab99e47c1dfcb4a590d7d251e6f3a866705
MD5 ff3b90284203e41aefdeb3b09613ba0b
SHA1 4dd3ed7b3f5d657d5b3a1d713d85a842ba98547f
SHA512 16ef7e824ecb54996eba30a902248bb9fbb1dab1099b2065cbd729843af6cb7ad301dfd1908bcf6758931d1e141f26f30d426a5d31d22cd0e2a6997623e82b31
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/SkinClient.ini

SHA256 2b84849d7be3dfc1d6ca56cfddfe1234fae14369bcec05fb1a200eb0dd676e0c
MD5 f1c1c686020403197cbebaee1d4097dd
SHA1 6f114e31b221aba01f60d839ceed1f057b939835
SHA512 c9894ca952fb99de4a042301ff136515ad97d0be798aa15e201401853d61c5344fd4a4201b986c200d0f27fb1bfd9ddbf0b35a848a0acce20665491b8416e4f5
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/SkinClose.ini

SHA256 350eb41aae5f4c868095308f0ff6b73bebbd2da4859cc845f4ed89d7fd1d2c32
MD5 1a0464e54036509a02a4be85f6265d12
SHA1 edb0b5641c09cb55e661290011724ad496649135
SHA512 808fcedb26697483b642d764a161d804e6ed3092151d0972e70e0802ea3377a770aa06bd9f70825ca1ba1d331f2c80525a45100e920156bc975b3001adcafbdf
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Synopsis1.ini

SHA256 ebd9ab67d875320aa18e6b9e54e9a5a288bb3f47bf986e3a796af3ce67a34a7e
MD5 8c31f51b4722141f996add69ee79f7ce
SHA1 a9a750d723f19f713f27f58a763bd141d046e583
SHA512 d180b0af6088458a861b68a30943ac1915c579fbf330861118d01155d666f222cef01972ee619e780dbfb8d26e4d79df74e13659b5b9bd07d73ab772b35c71d6
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/Synopsis1.png

SHA256 0fcfe7cfe876b13ba80be3495382a3f1c645f9424974528482d649024d132ee4
MD5 b902dc9f6454c516095ecaa268722f88
SHA1 a5a502e684fcb71f82829d72616fa66eb3a38bfe
SHA512 10f4230c143b41e04b1a6b1ef961b724fa531de619a8e15c68f5d5d5e29546b7b4957811c733f21142d3568871a3bdfd49a8d121cf824306be83b398d24d31db
SSDEEP 1536:oXsKe0pwrhf9tmSYIA1MpAHB/HaoIFTtRPeyAetK4vnd3Ie0CJUG9Gs9kD4ph9E:sH4vgvIO5Ha/bRmZe39Ie0CeGY4p/E
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/Synopsis2.png

SHA256 c83af320d2fbce999407eec5dce02e47acd4e63a0b2c2330336af36cb0ebd54b
MD5 360d5adcbca3a847c1415ddc0c4d269f
SHA1 cf8275ca0a3e6dc4f31fa37e9530ec5b04bc59ca
SHA512 115ae3c92e6ca175cecfd7228dd9b8a3b11d8adda2b2cec320856100f864976b27b445e5726deb41e4012692721a7f393a5173759d2e310ce54a0d62d57d4e3a
SSDEEP 3072:Sbo6ftJBd6yovxz6Cus50GfxXBxh6ahfq:H61Jn6y2xz6C90OJBI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/close.png

SHA256 6fbfb4832e4108553292f9553520dc428ac6784623cb3d24c6987c6a4852bc7a
MD5 262a055c050ed111d140f53398daedd6
SHA1 58673ad8296f92f1b49c8969c65b50bc1da2b732
SHA512 65cc60ace339b911da28eb5498bc248b6eb5bae5ea48abd43c625bef2577d54bc566941d211ff23397b8f5abd5341ee26e73fa92ce8e76c9bb1613fc36e9271b
SSDEEP 96:ESMllcHitlIxv9vk7C1+I4wWHLihk/xQc/Cmqv0qkDVM2Qq+Qq9E7znA:ESHIIHUCD4wavqb0qkqE+f9E7zA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/downarrow.png

SHA256 f53f26dbdf02b6d4ff70345eaa41079f142339bb80065025deadcba2df9740d1
MD5 00f43d51c8649ffa590a4dd091794e86
SHA1 1bf4d6734b6babe0b506e7e9203184fccc5d17d8
SHA512 0ba599d941741bb83b5315ad01f9bf9d0d4c8b5234076c836981d6ce590e03d6029de50bc21ead7f0dcc4e02bda0bfc85a6fc160f9ddc85c144c0692b5d882d1
SSDEEP 96:RSMllcHitlIxv9vk7C1+I4wWHLihk/xA6KGaHN34hZgbfAsn3+pgN:RSHIIHUCD4waVK/F4hZgLAsn3oG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Resource/SkinFormal/hover.png

SHA256 28449b5cbbb8def094f0d5e7c0a305b1368a71925316b91ad8c5c9fb1eebf781
MD5 1f258fc3efa419ac2d6bfac5fda8512c
SHA1 e63af0e876ddf8d0ed233bda1038ffecf4ddb1dc
SHA512 aa75979efe4ce7b6431fdaebb8f441e9fc1df2f00579549a321d628844135c98fe905d96536e0f17511e787fa37a41975532021b86aa295c7d0d6c47d5fb3037
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/leftarrow.png

SHA256 9a318c2fc99f3a06ced8264990dbd14313a231aec77347969592db78fec67661
MD5 42b59435df825fa56821d50c067c4fe4
SHA1 9de62f135e1b35583c07c611aa1506f59e759e5a
SHA512 b6d0ad926f75c8d5813b4f4db559de4fa37ca244ba821798be8ecb3a2441371a9f2528077c137d8509e4c25043ea10df678fdb8ed8026f6163cea855338d03db
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/rightarrow.png

SHA256 3157b531e14886435c3c25b0cb837e7c4945e6d8a53739ffcacc36f270e3e3e5
MD5 110713dc3072a294fa26468f06300c9a
SHA1 a16c3b4f3b129caaaebd7076fbb38d884c47c89f
SHA512 81fe56b87acf045717688886137c7a68f3dea843c43a940068906957c7674b264e7b56a6577c96fe0f38afc39807aeb78433bc75af66982419cd79ac1d567ff2
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/setting.png

SHA256 8a6e9029179e766a439b5096db71e94ad829ef84fccc5e53387b5cc45fdbd829
MD5 34785d6f476e5b9bf7a60f96425aee5c
SHA1 966cffad09ba1449a79aeae356a34a96872a4d75
SHA512 5cc95e48fa7d6f2fa5877cc86fbca2b6ac5a59d30e7e8c185eb2dc66cff5f18189daf34843d038cb5db8f44ac5774ea8ee3c0c800d3446a4adcf29ac86c6440b
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Resource/SkinFormal/uparrow.png

SHA256 662b1840ea3f21f57d3d2b03e6eeb6aaada6b95389c1bdda233229cecdb0ee29
MD5 ae2c924d5c02b5c569ef06c7c3fae876
SHA1 eaaf45f68000e63eada4d6952e436282778a73ea
SHA512 bc84144ed288028955fe65d437618c12cfb0f3b1e31ba4db51347e715fa2295589d7480ad737026ceee27c3e2ed574d3e34c938043fc21941e9427243c29eda1
SSDEEP 96:RSMllcHitlIxv9vk7C1+I4wWHLihk/xP34lE+ibWnGdt7z+THXz:RSHIIHUCD4waKElndtv+THXz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Templete/CoopenPhoto.jpg

SHA256 75567d2330980cc86e726f147cf616e27afff9bfe865d4f63b1bd3dbc808a001
MD5 3b02d5b9023ff6a7440f0786ab0559b1
SHA1 9dbe26234b7856ab4ef0f62163c9c074857816a3
SHA512 1cf3a34b7e4439ec5b553ef20c37027282798e20159d2b8896e7cc9ab264738d4eedd3e3e0cddc786d3ff8277b3464bc28ea243edd36b71f63172c72909214c5
SSDEEP 3072:K/al+O3Hi1oVJYcbtt/3chtjVHjFF6kGgdVZNR:K/alm1oj7mtjP1FR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Templete/DefaultCoopenWallpaper.jpg

SHA256 f2df1c5aaf11b57af873a82237a08abfb685fe23371aafe73b7927da9075d711
MD5 3a1aef530244c5246688ada270ca479e
SHA1 49fb60b890a2ace02641d7d4774ada8c1abd356f
SHA512 b8cd7b8ce830655d65ff366a0ee8af80b6ba8365a8a0bf2ea5c50a50630995a3a816eb6925be5599c94cddfb8ffd74ddde5f4854d4c5f2e54dc1775092d21c29
SSDEEP 1536:WTTllvazmMs2ygxUbf0E/BdQyq0ZHpNy+dEcytfqLTt4aD:AloCMGDD0E/9FZofGtjD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/Templete/ModeB.tpl

SHA256 d16e0bdda39bfb9f84d9e6973efb1f4955083058738a545091b6dbde5ff6f0fb
MD5 d34d4306a459f62b0986f2b1ea6451ac
SHA1 55cfa477f0baf4519e121bf5d4224aea2ca6e94e
SHA512 b5bee44f9f0a9da3c31aaf059cfe07348d7807afdc74f654bbac6f01487acf439b789f4eadee7dc68f52584406876165cc746bc18a832f58ceb4552b416d833f
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Templete/ModeB_logo.jpg

SHA256 a3516b0c5e453aab78a02253f2d40f7233883d730b38e266dc7b9e881c168a5c
MD5 32379106f3126fc63fc4a2a9c2ddada4
SHA1 402949f0d3c33ee660cb73d8b23b9a76d6420cd1
SHA512 49a0fe293a8f0165b46580ec63a334141948d64be252707a1265a3ee57e0f94bc71c4f4fd5f9e069fcb364be8a9f6c3e0763dbf9a2a7358ebe4ce48c4e873401
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/Templete/ModeC.tpl

SHA256 1f5918577e8d5a803295df29eb2f33e0087912acf2b09c33a628542567ef8c94
MD5 142089669117502b171e7b2e040b8854
SHA1 511d43b776a4409ba5a9ff4d3f7e91d9a10fb52d
SHA512 3924e9425e6b245734ae46463fd2500aa34ee5e0a650f6da4d7ccddc9621488d391d71c351470ce0ce981a59cd53a6135a5283fb05854e47e85c014bd5aeae63
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/conf/ChannelListReal.txt

SHA256 78ea53fb5305c65f7e78f1a331f60f09ef0ee8f3f54d47f202ce4c84dec62ddc
MD5 429c106d3337f9e4a606f663e8e92bb9
SHA1 e7d11f453d9a8eeb2bd67c97723956d63714d57e
SHA512 69be1e8fb5eabf24522325a9c44f1e59f4fa8c1c40ad109f0bdc8535487b6025e2dd5a6238dfd75e7cb70f0d02bd0c8209232fe709108a4e5091be221766b761
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/conf/PluginConfig.ini

SHA256 b72997d6aea481af28fbacf9463d9de324a74096d81aa51b239fdd5c46fc55d5
MD5 cf305214622c5d2234854c71e021ae74
SHA1 b885a1bb8dca458ed3acf1b9aa2c143251428dfd
SHA512 6a746494bdb0450b2e8f259b16e55feb85285470eab6289ba7493695d71fdbd5d29fdeb64b5b8fdffabfe2414e401df406a611f204699f5000bc3ff7833a01af
MD5 SHA1 SHA512

NSIS installer

installer

$_10_/image/Photo/local Photo/B_0.jpg

SHA256 52fc00a529f81c995de46e1a7b385a0f1980156a7d801e89ab882c68de010ed6
MD5 99a8c45855589849e375d59faf91180d
SHA1 3620f790e30df268e99271d5b65cdf3acff1c3d1
SHA512 38499178548ed758b51b331e6fd0544060ec0432c617dbaa892b723a04510793c1557bb69ce0c6edc7dfdcbd823b0a539b3f8d77355f5653a388381d94ebfbfa
SSDEEP 768:qJUSxszhRXh3nbIS4X7mALSs8nQ26E4wRpEXfb4THb0LwPrixVvhQ8J:qpsz9XbctGn74wpEa00PEqi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/image/Photo/local Photo/B_1.jpg

SHA256 14727f909abc6e8410881a294bf7d9e59a0560cbdcd3db8903b0cf262efa763a
MD5 4910d875ffd92f8a2fd2f4831b7c56c3
SHA1 5856502b3af0c595ef8367655a8e498ae5ba1edc
SHA512 c35fda4e85f057b6dfe371d0b217994ec832a31ffc575389b213c6e0e415da1c6add34a7925c5b449eac807d884df851668187a0cc455d2797ed980882b1a2c6
SSDEEP 768:WIqKCTaAjHpeHLw8TtqgW3kpm0ayatlDhz8IBt:RCtjHaBTAgwkQhBpPBt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/image/Wallpaper/coopen wallpaper/DefaultCoopenWallpaper.jpg

SHA256 f2df1c5aaf11b57af873a82237a08abfb685fe23371aafe73b7927da9075d711
MD5 3a1aef530244c5246688ada270ca479e
SHA1 49fb60b890a2ace02641d7d4774ada8c1abd356f
SHA512 b8cd7b8ce830655d65ff366a0ee8af80b6ba8365a8a0bf2ea5c50a50630995a3a816eb6925be5599c94cddfb8ffd74ddde5f4854d4c5f2e54dc1775092d21c29
SSDEEP 1536:WTTllvazmMs2ygxUbf0E/BdQyq0ZHpNy+dEcytfqLTt4aD:AloCMGDD0E/9FZofGtjD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/image/Wallpaper/local wallpaper/DefaultCoopenWallpaper.jpg

SHA256 f2df1c5aaf11b57af873a82237a08abfb685fe23371aafe73b7927da9075d711
MD5 3a1aef530244c5246688ada270ca479e
SHA1 49fb60b890a2ace02641d7d4774ada8c1abd356f
SHA512 b8cd7b8ce830655d65ff366a0ee8af80b6ba8365a8a0bf2ea5c50a50630995a3a816eb6925be5599c94cddfb8ffd74ddde5f4854d4c5f2e54dc1775092d21c29
SSDEEP 1536:WTTllvazmMs2ygxUbf0E/BdQyq0ZHpNy+dEcytfqLTt4aD:AloCMGDD0E/9FZofGtjD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_10_/licence.txt

SHA256 4429f7676caa5fbd2f45346fe972a826f4bb4b8059ac54ddf0441ad7a853923b
MD5 c8f8eda48dd572e929a240c0e0eb1628
SHA1 452c625b17123b3f5f748445b2864cf8229a0700
SHA512 8cf54b9cda45b1e1d64675e01cd8884861398e6c303b7672720509774ac48dd840331d0cf478e6abfc13acc6216dce2e670b1a28fe20bd7797a74bbf3ff5bc8d
SSDEEP 192:HSH0vItzpawEOI8XuijSgMNTiiNNC/wkPB7o:HZIKwDI8Xu+jTB7o
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Coopen.exe

IMPHASH 37bdd694e262b9b644cfec8bf5405995
SHA256 b6f9170d208cfb347ab0095b811a65a1a717ea1246ca25796923b45d2f986e41
MD5 f9193966e62c1956bf3c9a716e958a0e
SHA1 87401d4a6cb2f023537398fdbf6fc721cacbd93b
SHA512 25d9a1b5c7702ebccbfdbcbdd81f6dc5d0aeb5bb6df4a8e8e05ba7cf5840e92b7e64d448d923775345e860ee5939bb34228de81e4b3044f750bab1b5b44ca3bd
SSDEEP 1536:4YkBsegRUdTqWXYBT6V8pNDlrLcNityC+OEnU:xHegR2XSH/ZrLcUqOd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ca:1f:12:42:63:4b:3d:4b:d3:9d:be:f8:64:04:52:cc:b8:7c:49:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=北京首都在线网络技术有限公司,O=北京首都在线网络技术有限公司,C=CN

Chains

Nov 4, 2010

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:23:9e:0f:ac:b3

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 1999 - Jan 27, 2017

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Serial Number

04:00:00:00:00:01:20:19:c1:90:66

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Jan 28, 2028

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Serial Number

01:00:00:00:00:01:25:b0:b4:cc:01

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2009 - Dec 22, 2020

Subject

CN=北京首都在线网络技术有限公司,O=北京首都在线网络技术有限公司,C=CN

Serial Number

01:00:00:00:00:01:2a:22:5d:6d:d7

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 30, 2010 - Jul 30, 2011

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:1e:44:a5:ec:be

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2017

Minor OS version

0

Major OS version

4

Entry point

15040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError CreateMutexW CloseHandle TerminateProcess OpenProcess GetCurrentProcessId GetVersionExW Process32NextW Process32FirstW ReleaseMutex WaitForSingleObject LocalFree GetCommandLineW FreeLibrary GetProcAddress LoadLibraryW CreateProcessW GetModuleFileNameW CreateToolhelp32Snapshot Sleep GetOEMCP GetACP SetStdHandle GetStringTypeW GetStringTypeA GetCPInfo IsBadCodePtr EnterCriticalSection LeaveCriticalSection ExitProcess InitializeCriticalSection DeleteCriticalSection WriteFile MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsW SetCurrentDirectoryW CreateDirectoryW GetFileAttributesW SetFileAttributesW DeleteFileW CopyFileW FlushFileBuffers SetFilePointer WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW GetCurrentProcess GetModuleHandleA GetStartupInfoW GetVersion RtlUnwind InterlockedDecrement InterlockedIncrement UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentStrings GetCommandLineA SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree HeapFree HeapAlloc LCMapStringA LCMapStringW HeapReAlloc HeapSize VirtualAlloc IsBadWritePtr LoadLibraryA SetUnhandledExceptionFilter IsBadReadPtr

user32

FindWindowExW ShowWindow wsprintfW MessageBoxW GetWindow FindWindowW SendMessageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CloseWindow

shell32

ShellExecuteW CommandLineToArgvW SHFileOperationW

ole32

CoInitialize CoCreateInstance CoUninitialize

$TEMP/xcmd.exe

SHA256 82fbc8842aceeb471967d2e78b7336c972e3d1379fcd23662df022af958f40c1
MD5 378e0103156f2e6844c83087d80a7156
SHA1 c3e577e294ee81cd763625b4f6657795c4a8a6c4
SHA512 0d9e162042f0894aeefb4d43a2c98161686b4451605cbaddcf12f367b17ed1a3796370e770dfbbe6b2ce7ddfba7dc42747ce564b8f80c292b331a600910103bb
SSDEEP 768:vGw9ERxPw5DAKshWRjzrjBav9+IZ5deSbA:vGQc4TsYznBA9LISbA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

82624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 a87886f9b1cae398105673e66a95deaac0ae5093c08684f6b27c5c5afa8194c8
MD5 9f81eb3f1bc847fbd7903b7b347d6423
SHA1 b1341517c01a8eb340fbfa3bc9671267f784e9af
SHA512 fa68d93487d9c00d301a97f1735f7b8ca6624da202f6645da8956f28d928711ce71b4644fe3fda4f92b2323fd27e3d76f4137e32700733b6207a94a78a24b913
SSDEEP 768:hSKUKmoQkoLABcqMZKj3nJuAtszmmWjkPpmw9XoP66xuajkLtn2RT1Dj6qHiA:0KUKQqcq1XIdWopN9Xl6oajPWaiA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

51884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$_48_/$APPDATA/$_49_

SHA256 2e700bfb765ced8bcb200935f5726bf0d4443804432e850742255fa304a1c7ec
MD5 87000ba5b503f17bef27893b00ab29a3
SHA1 1d2f7f521a17c92993b1c5467a1cdcf83982c5f8
SHA512 cbb43e92420865a0fac993bdbbc765213c4ab9821fcc765c686cbbf5b91e654d9faafe236beca136bfe515ecf0352f846afd8cf3e71e1ce3b2e533715023c296
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/$DESKTOP/$_49_

SHA256 2e700bfb765ced8bcb200935f5726bf0d4443804432e850742255fa304a1c7ec
MD5 87000ba5b503f17bef27893b00ab29a3
SHA1 1d2f7f521a17c92993b1c5467a1cdcf83982c5f8
SHA512 cbb43e92420865a0fac993bdbbc765213c4ab9821fcc765c686cbbf5b91e654d9faafe236beca136bfe515ecf0352f846afd8cf3e71e1ce3b2e533715023c296
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/$STARTMENU/$_49_

SHA256 2e700bfb765ced8bcb200935f5726bf0d4443804432e850742255fa304a1c7ec
MD5 87000ba5b503f17bef27893b00ab29a3
SHA1 1d2f7f521a17c92993b1c5467a1cdcf83982c5f8
SHA512 cbb43e92420865a0fac993bdbbc765213c4ab9821fcc765c686cbbf5b91e654d9faafe236beca136bfe515ecf0352f846afd8cf3e71e1ce3b2e533715023c296
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/$SYSDIR/game.ico

SHA256 a9d67989b751b2f7f1f68fcd780e86d67dce3d9ca7bd19c340fb28174303301f
MD5 5247e8ea837641b306ff471b4aa11fd9
SHA1 4850775541509bbf556eb07d21571402ca2270dc
SHA512 aa3a55fd67194dd234f4b86b85dff35804efb533f09412a57c3daf70ffc6a227a5ff615902088f8603584c18879d54f73d03a0e0f3f78c68c813714f935afb17
SSDEEP 192:0wQT0ANScfnMcxn1cfUjEj10hFKuev6Avt2hVbLtxJTFJBZ0t0KX1Rds:LaSonMEoIK0hQuevnYLbLtxJTFnZ05G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_48_/$SYSDIR/taobao.ico

SHA256 091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d
MD5 468fada123f5548ac87e57bae81f6782
SHA1 edb8f012c25906e6afd8bf335b495e16c440243d
SHA512 635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa
SSDEEP 384:jdsFALc7CTsMVlmVrgDZZPZ9jWgtPnqNIcTj:Rbc765DmODZZPZB52jv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_48_/1.html

SHA256 2e700bfb765ced8bcb200935f5726bf0d4443804432e850742255fa304a1c7ec
MD5 87000ba5b503f17bef27893b00ab29a3
SHA1 1d2f7f521a17c92993b1c5467a1cdcf83982c5f8
SHA512 cbb43e92420865a0fac993bdbbc765213c4ab9821fcc765c686cbbf5b91e654d9faafe236beca136bfe515ecf0352f846afd8cf3e71e1ce3b2e533715023c296
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/3.bat

SHA256 92e10f9c0167afecd12dc35603d013c4e9aadde83aabc0266a83f683637656a2
MD5 1e88e617af7115b75107743b99b9f242
SHA1 d25ba3ea280e4bf1a00000db09e69e6fc67c7ebb
SHA512 a6a93bdb573469c215ffc56983e2db5f5715fa0e4e68f170c0a145036393793a2f4bfb2dff5c18e7ea45c534bf2f4193859beac9ba890e25cf4b72ee23909009
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/3.vbs

SHA256 6216a272f8c69dca24e219951e76b2fc6fd36c8df1a1ee0f68340d242f138f64
MD5 50a891e996a49df4a64246929b9b5c34
SHA1 fc6fdf00438d9b28174a42b49018694f1319e322
SHA512 3b025dab65d0d1c9276e211da225f2ca797fb6c8138a580abdca3d3c84653b70524a50a1203a4c556a75b757e6985676853cc64d79201f92708050f39d34d171
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/game.ico

SHA256 a9d67989b751b2f7f1f68fcd780e86d67dce3d9ca7bd19c340fb28174303301f
MD5 5247e8ea837641b306ff471b4aa11fd9
SHA1 4850775541509bbf556eb07d21571402ca2270dc
SHA512 aa3a55fd67194dd234f4b86b85dff35804efb533f09412a57c3daf70ffc6a227a5ff615902088f8603584c18879d54f73d03a0e0f3f78c68c813714f935afb17
SSDEEP 192:0wQT0ANScfnMcxn1cfUjEj10hFKuev6Avt2hVbLtxJTFJBZ0t0KX1Rds:LaSonMEoIK0hQuevnYLbLtxJTFnZ05G
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_48_/qq

SHA256 eb4f728e68653295c84de49e22ad8ebf7cada89300523737fef02aa272b8aa02
MD5 2736c2b8977108d0cc3b7a14ce5425e9
SHA1 1050acde5881d3ebd0cac5879d4f6696732197e6
SHA512 62262fce0d8f74668f595b06a90a5c518d0a6ac1ce13b20932dd087b384978c08fbc5945c079c67d06bf2f1698b7ebe65729e178e76937f9e8d79c0c2e90adda
MD5 SHA1 SHA512

NSIS installer

installer

$_48_/qq.ico

SHA256 f5df2917175c3a0e65cce1130fa059ef0a1ccaf6e7e19bc9925a757f3d920b2a
MD5 c206ae3072dee0411b7fa8b28b540e5a
SHA1 20a5bd0bd7b146aa900e7b51152078f0d535c33c
SHA512 472c00ae672a707c77cca569bced31d803a7409653357044313979be31ad2a45eb6e8cb2e5693791aad0d77045ada338856638afce953b5effad02d55983d90a
SSDEEP 192:eb/K3aWf883JsxwCmC4cY/ouDWCNzH5VTMZ:ezK3a48QJsxLPOouDWCNL5R4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_48_/taobao.ico

SHA256 091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d
MD5 468fada123f5548ac87e57bae81f6782
SHA1 edb8f012c25906e6afd8bf335b495e16c440243d
SHA512 635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa
SSDEEP 384:jdsFALc7CTsMVlmVrgDZZPZ9jWgtPnqNIcTj:Rbc765DmODZZPZB52jv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Uninstall.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 7db1c7f34b106ef323b8d90f29077e232813f30b2f9d812c7d96e55c37422e75
MD5 e0ae7b2bfbcc08ec0080133876b606bc
SHA1 7f1f5648a8972d22e12e455d9b7f19877ccde0ed
SHA512 88e85b2c4fc58464643fc16c134001f9268d3ee2b8c5b5cfc0f825c7f362cbd6abdf629695331e81dce238f6dd2b7e0e6b7645f44acd583265e9d2839487fc61
SSDEEP 768:SoOjbhlc7sUoQnAz3ppOo0QJSHijv5js/wJJQPgd2iZQAm6kRRS+NoJRnOO6g:XOPhlosUoAarDX1JJQgdLeAyNZOf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

oem.ini

SHA256 3dadf0bfe620d91445037008717cc0e1b6bb6765b100abaeb87a1db276ae7fc9
MD5 2a3d80f7a838a09ca57b0709d9c1af74
SHA1 a6084c7102825ddeaeec4013f15e52e290fc75ff
SHA512 c4cc203f7a9a282bb73671e6a7271d5f50693f9fb5792aa1238bdc3905f2b74f636cecd486015b75253da6ae48b74e7a134c8bba5bab7368f69557311db349c0
MD5 SHA1 SHA512

NSIS installer

installer

֮.exe

IMPHASH 529e31f77e52cbf0a3f800a64416df7b
SHA256 4dbc3ae45a04dea291f318cfefdd091af2d6a2a747f4970a1c369752ca093558
MD5 5b09029117dedb91f4b06ef3c0e8b94f
SHA1 6cef43f5147d5fe01b66748157782626cce44c28
SHA512 fdd0385a7f094774fb77bec9830c7eb62fa081936c55c91539394421d2b0b8dde8ea7bb84a48001814a1e0b496e741cc5ee5c2ebd905c9ef945e7dbb22e38c32
SSDEEP 24576:SRFS7Iid6Nx7izcFsaWrtLTOITQA6kOStpbspT63cGnD:vDd6ziVTOITQAOpT63cGnD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Serial Number

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning, ExtKeyUsageClientAuth

Timespan

Apr 25, 2007 - Jul 9, 2019

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Jul 9, 1999 - Jul 9, 2019

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Serial Number

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 30, 2007 - Apr 29, 2012

Subject

CN=Beijing ShengjingWanwei Technology Co.\,Ltd.,OU=Class 3 - for Microsoft Authenticode Signing,O=Beijing ShengjingWanwei Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

7f:43:34:d8:ea:88:95:32:91:21:c9:7d:8f:df:3a:d3

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Jul 6, 2009 - Jul 6, 2011

Minor OS version

0

Major OS version

4

Entry point

870602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveOutWrite midiStreamClose midiStreamOut

ws2_32

recv WSARecv WSAGetLastError connect closesocket send

imm32

ImmNotifyIME ImmGetContext ImmGetOpenStatus ImmReleaseContext ImmDisableIME

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

FileTimeToSystemTime FileTimeToLocalFileTime GetLongPathNameW WriteProcessMemory ReadProcessMemory VirtualProtect lstrcmpW SearchPathW LoadLibraryA CreateThread TlsGetValue CreateProcessW GetModuleHandleW GetCurrentThread HeapFree HeapAlloc HeapCreate HeapDestroy ReadFile GetFileSize TlsSetValue DeviceIoControl OpenProcess GlobalFree LockResource SizeofResource LoadResource FindResourceW SetCurrentDirectoryW GetCurrentDirectoryW GetWindowsDirectoryW GetProcessHeap LocalFree TerminateThread GetExitCodeThread LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA CancelWaitableTimer SetWaitableTimer CreateWaitableTimerW SetEndOfFile SetFilePointer GetFileTime WriteFile TlsFree TlsAlloc GetFileAttributesW GetSystemDefaultLangID GetUserDefaultLangID EnumResourceLanguagesW GetVersion FreeResource LocalAlloc SetProcessWorkingSetSize LoadLibraryExW GlobalDeleteAtom GlobalAddAtomW CreateSemaphoreW ReleaseSemaphore FlushInstructionCache FindFirstChangeNotificationW CreateEventW SetEvent ResetEvent lstrcmpiW GetPrivateProfileIntW SetFileAttributesW LoadLibraryW GetProcAddress GetCurrentThreadId GetCurrentProcessId FreeLibrary GetTempFileNameW VirtualAlloc VirtualFree GetCurrentProcess GetStartupInfoA GetModuleHandleA SetLastError SuspendThread SetThreadContext GetThreadContext ResumeThread InterlockedCompareExchange SetFileTime GetLastError WaitForMultipleObjects FindNextChangeNotification GetDiskFreeSpaceExW CreateDirectoryW InterlockedDecrement lstrlenW FindClose FindNextFileW WritePrivateProfileStringW GetShortPathNameW GetPrivateProfileStringW FindFirstFileW GetModuleFileNameW CloseHandle DeleteFileW Sleep GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection InterlockedIncrement EnterCriticalSection LeaveCriticalSection lstrlenA MultiByteToWideChar FindCloseChangeNotification GetTickCount GetTempPathW lstrcatW GetLocaleInfoW WaitForSingleObject CopyFileW RemoveDirectoryW CreateMutexW ReleaseMutex GetSystemDirectoryW IsBadWritePtr IsBadReadPtr MoveFileExW MoveFileW ExpandEnvironmentStringsW CreateFileW SystemTimeToFileTime GetSystemTime GetVersionExW GetCommandLineW VirtualQuery SetUnhandledExceptionFilter SetErrorMode TerminateProcess

user32

GetMenuInfo PostQuitMessage IsMenu GetMenuStringW GetMenuItemID keybd_event MapVirtualKeyW CheckMenuRadioItem SubtractRect EndMenu IsChild EnumChildWindows IntersectRect RemoveMenu SetCursorPos DialogBoxParamW LoadImageW SetWindowPos GetWindowRect ShowWindow SetWindowLongW GetDlgItem LoadStringW SendMessageW SetWindowTextW GetWindowTextW PostMessageW EndDialog SetFocus MessageBoxW IsIconic UnhookWindowsHookEx IsWindowVisible SetPropW RemovePropW ScreenToClient GetPropW CheckDlgButton EnableWindow CreateWindowExW IsWindow InflateRect CopyRect SetWindowsHookExW CallNextHookEx MenuItemFromPoint SystemParametersInfoW SetParent SetActiveWindow CopyIcon DrawIconEx MoveWindow RegisterClassExW CopyImage GetForegroundWindow DestroyIcon CloseClipboard GetClientRect EndPaint GetSysColor IsDlgButtonChecked DrawEdge DrawTextW FillRect BeginPaint DestroyWindow SetForegroundWindow GetParent DefWindowProcW ReleaseDC GetDC OffsetRect CallWindowProcW GetWindowLongW GetComboBoxInfo PtInRect GetCursorPos GetKeyState InvalidateRect GetWindowTextLengthW GetSystemMetrics RegisterClipboardFormatW IsClipboardFormatAvailable EnableMenuItem GetSubMenu LoadMenuW GetAsyncKeyState SetCursor LoadCursorW CharNextW DrawIcon LoadIconW MapWindowPoints GetDesktopWindow SetDlgItemTextW IsZoomed SetWindowRgn SetClipboardData EmptyClipboard OpenClipboard WindowFromPoint InsertMenuW IsWindowEnabled GetKeyboardLayoutNameW LoadKeyboardLayoutW LoadAcceleratorsW TranslateAcceleratorW DestroyAcceleratorTable CreateAcceleratorTableW CopyAcceleratorTableW GetKeyNameTextW GetClipboardData GetMonitorInfoW MonitorFromWindow SetRect RegisterHotKey UnregisterHotKey GetWindow SetRectEmpty TrackPopupMenu TrackPopupMenuEx GetWindowDC GetMenuState EqualRect GetGUIThreadInfo GetSystemMenu GetMenuItemInfoW SetMenuInfo GetMenuItemCount CheckMenuItem GetSysColorBrush DestroyMenu FindWindowW GetWindowPlacement SetWindowPlacement TrackMouseEvent UpdateWindow RegisterWindowMessageW GetWindowModuleFileNameW SetWindowLongA SetMenuItemInfoW EnumWindows GetWindowThreadProcessId FindWindowExW GetMenu SendMessageTimeoutW EnumThreadWindows GetClassNameW GetMessagePos SetCapture ReleaseCapture ShowCursor KillTimer ClientToScreen SetTimer RedrawWindow GetFocus DeleteMenu GetAncestor CreatePopupMenu InsertMenuItemW GetDlgItemTextW LoadBitmapW PeekMessageW TranslateMessage DispatchMessageW CharUpperW DdeGetData DdeFreeDataHandle DdeQueryStringW DdeFreeStringHandle DdeUninitialize DdeInitializeW DdeCreateStringHandleW DdeNameService GetMessageW PostThreadMessageW CharLowerW

gdi32

CreateRectRgnIndirect FillRgn GetDIBits CreateDIBSection MoveToEx LineTo CreateRoundRectRgn CombineRgn CreateRectRgn SelectClipRgn GetObjectW GetTextMetricsW SetBkColor CreatePen CreateCompatibleDC CreateFontIndirectW CreateCompatibleBitmap BitBlt DeleteDC CreatePatternBrush Rectangle EnumFontsW GetStockObject SetTextColor SetBkMode SelectObject CreateSolidBrush DeleteObject

comdlg32

ChooseColorW GetOpenFileNameW GetSaveFileNameW

advapi32

RegDeleteKeyW FreeSid RegGetKeySecurity GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA RegOpenKeyExW RegCreateKeyW RegSetValueExW RegOpenKeyW RegQueryValueExW RegCloseKey InitializeSecurityDescriptor AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid RegEnumKeyW RegQueryInfoKeyW RegSetKeySecurity RegCreateKeyExW OpenProcessToken GetTokenInformation CopySid SetSecurityDescriptorDacl

shell32

ExtractIconExW ShellExecuteExW SHGetFileInfoW ShellExecuteW SHFileOperationW DoEnvironmentSubstW SHChangeNotify SHFreeNameMappings SHAppBarMessage SHGetPathFromIDListW SHGetSpecialFolderLocation DragQueryFileW SHGetMalloc SHGetDesktopFolder SHBrowseForFolderW Shell_NotifyIconW SHGetSpecialFolderPathW

ole32

OleUninitialize CoCreateGuid CoGetInterfaceAndReleaseStream CLSIDFromString StringFromCLSID CoTaskMemFree CoGetClassObject CoRegisterClassObject CoRevokeClassObject CoUninitialize ReleaseStgMedium RegisterDragDrop CoGetMalloc DoDragDrop CoInitialize CoCreateInstance OleDraw OleInitialize RevokeDragDrop OleDuplicateData CreateStreamOnHGlobal CLSIDFromProgID OleSetContainedObject CoMarshalInterThreadInterfaceInStream OleRun CoTaskMemAlloc OleCreate

oleaut32

SysFreeString SysAllocString VariantClear SysAllocStringLen SysAllocStringByteLen SafeArrayDestroy SafeArrayAccessData SafeArrayCreateVector SysStringLen

wininet

HttpOpenRequestW HttpSendRequestExW InternetOpenW InternetConnectW InternetSetStatusCallbackW InternetCloseHandle InternetReadFileExA InternetReadFile HttpEndRequestW FtpOpenFileW InternetWriteFile InternetGetLastResponseInfoW FtpCommandW InternetQueryOptionW InternetSetOptionW InternetCanonicalizeUrlW FtpGetFileSize UnlockUrlCacheEntryFileW FindNextUrlCacheEntryW FindFirstUrlCacheEntryA UnlockUrlCacheEntryFileA FindNextUrlCacheEntryA FindCloseUrlCache InternetSetOptionA DeleteUrlCacheEntryA HttpAddRequestHeadersA InternetConnectA CommitUrlCacheEntryA HttpOpenRequestA DeleteUrlCacheEntryW InternetCrackUrlW GetUrlCacheEntryInfoW CommitUrlCacheEntryW CreateUrlCacheEntryW HttpQueryInfoW InternetGetConnectedState FindFirstUrlCacheEntryW

dsound

ord1

shlwapi

StrStrIA PathMatchSpecA UrlCanonicalizeW PathFileExistsW PathRemoveFileSpecW SHEnumKeyExW StrCpyNW StrCmpW PathIsUNCW UrlIsW SHQueryInfoKeyW StrRetToBufW SHDeleteValueW SHDeleteKeyW SHSetValueW UrlGetPartW SHAutoComplete PathIsRootW PathFindFileNameW UrlCombineW PathMatchSpecW UrlIsOpaqueW StrStrIW PathCombineW PathFindExtensionW PathGetDriveNumberW PathIsDirectoryW PathIsURLW SHGetValueW SHEnumValueW PathFindFileNameA

msvcrt

swscanf fseek ftell fread _wtol _ltow malloc free _wfopen fwprintf fclose iswdigit swprintf vswprintf wcsncmp _ftol _wtoi _except_handler3 wcscat _snprintf _itow wcschr time _wcsnicmp _beginthreadex memmove wcscmp _wcsicmp wcsstr ??2@YAPAXI@Z wcsrchr wcsncpy wcscpy _snwprintf wcslen wcspbrk __CxxFrameHandler gmtime wcsftime localtime _ui64tow _wtoi64 _i64tow wcsncat fopen fwrite _purecall mktime fputs strrchr strncpy strchr iswspace wcstod realloc strpbrk strstr sscanf iswlower atoi sprintf _strlwr strncat _CIpow strncmp _atoi64 fputws wcstok exit scanf printf isalnum toupper towlower towupper _ismbslead fprintf _strnicmp fgets rewind memset memcpy _CxxThrowException __dllonexit _onexit _stricmp ?terminate@@YAXXZ _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type ??1type_info@@UAE@XZ _controlfp _wstrtime

urlmon

ObtainUserAgentString CoInternetGetSession CoInternetCombineUrl CoGetClassObjectFromURL RegisterBindStatusCallback RevokeBindStatusCallback

netapi32

Netbios

gdiplus

GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateImageAttributes GdipSetInterpolationMode GdipCreateFromHDC GdipFree GdipDisposeImage GdipCloneImage GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusStartup GdipAlloc GdipLoadImageFromStream GdipGetImageHeight GdipDeleteGraphics GdipDrawImageRectRectI GdipGetImageWidth

wintrust

WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext

comctl32

ImageList_DragEnter ImageList_BeginDrag ImageList_GetIconSize ord16 ImageList_ReplaceIcon ImageList_GetIcon ImageList_Duplicate ImageList_GetImageCount ImageList_AddMasked InitCommonControlsEx ImageList_Create ImageList_Remove ImageList_Destroy ImageList_DrawEx ImageList_GetImageInfo ImageList_DragShowNolock ImageList_DragMove ImageList_EndDrag ImageList_Add ImageList_SetBkColor ImageList_Draw

֮.ini

SHA256 4874869eef7dec44e654db37c725363c29574b2a12a169e5d11b104255e1cdca
MD5 9950ddbb86e6f5196744ced9bce3c8b2
SHA1 25a64c796ad615080d2455260d7b589b3d462825
SHA512 7ab7121be5875fe91fc96419e5025f89b8dfee54b7abf3d2c1089a59be50c6466ae8f9b0df3e10d599c57eec055bc9f3eb923052c9f487f646e6ecb3025b45df
SSDEEP 96:zNDtQjotV/P8oTQka0Gjp4xBScy8xPnzk6E/0tOcwkEkKv:zV+YV5TQpUBS7anzkSDA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer