0.0.26.zip
- SHA256 c60e8d31d641c7a37ff1e7c7d0b1bafdd5847495e6973b466356e40fe48154ee
Password
roblox
Overview
overview
10Static
static
3ui_0.0.26_...up.exe
windows10-ltsc_2021-x64
10ui_0.0.26_...up.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3ui.exe
windows11-21h2-x64
6ui.exe
windows10-ltsc_2021-x64
6uninstall.exe
windows11-21h2-x64
7uninstall.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ui_0.0.26_x64-setup.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
20 signatures
900 seconds
Behavioral task
behavioral2
Sample
ui_0.0.26_x64-setup.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20250314-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250313-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20250314-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20250313-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral13
Sample
ui.exe
Resource
win11-20250313-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral14
Sample
ui.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
Behavioral task
behavioral15
Sample
uninstall.exe
Resource
win11-20250313-en
windows11-21h2-x64
7 signatures
900 seconds
Behavioral task
behavioral16
Sample
uninstall.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20250313-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250313-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20250313-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
General
- Target 0.0.26.zip
- Size 6.0MB
- Sample250404-cfehasxzcv
- SHA256 c60e8d31d641c7a37ff1e7c7d0b1bafdd5847495e6973b466356e40fe48154ee
- MD5 538bca27d79f2214ec556569297fdc98
- SHA1 bc33c1179dccb1979c6a5fe3609b4cd0ffb5fab6
- SHA512 968005932226079cbb15f9ce3cad691678e8386ca71797023e4d7110a2f44b022776a7384ff4c351230c9a55cff3a09163fbced34158c2a0670fd624f9d7a0ec
- SSDEEP 98304:WRL4iWaKZn3jYiZ71YDO+7v2GrWFZd8jHLZO8JUcEZ7ORxBIjMHlcuaLmyMGGuN4:WyHp3Z71Yq+72M2SLYa2kBIofhGFN2bD
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/ui_0.0.26_x64-setup.exe unpack002/$PLUGINSDIR/NSISdl.dll unpack002/$PLUGINSDIR/StartMenu.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/$PLUGINSDIR/nsis_tauri_utils.dll unpack002/ui.exe unpack002/uninstall.exe unpack009/$PLUGINSDIR/LangDLL.dll unpack009/$PLUGINSDIR/System.dll unpack009/$PLUGINSDIR/nsis_tauri_utils.dll
File Explorer
-
0.0.26.zip.zip 6.0MB
-
ui_0.0.26_x64-setup.exe.exe 6.0MB
-
$PLUGINSDIR/NSISdl.dll.dll 15KB
-
$PLUGINSDIR/StartMenu.dll.dll 7KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsis_tauri_utils.dll.dll 29KB
-
ui.exe.exe 15.8MB
-
uninstall.exe.exe 74KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/nsis_tauri_utils.dll.dll 29KB
ui_0.0.26_x64-setup.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 e3e6c7ac473c963276dc3c1e4595658aebc9ed4ba4585b6600dccbd5b82e3d49
- MD5 257e0184c3b29f7acfa018b11d23cef1
- SHA1 4756b5466ab51b7a83a83cb0347a5fb24ee992b3
- SHA512 f96c0259ea0ef194f0c7abc89797f60907395d9c85c0370e5ba8d79d5fda8954a88f30dd08ad62755034febe3741ddf5376a866eb969a4bcfdb5ecd33af8e248
- SSDEEP 98304:xRL4iWaKZn3jYiZ71YDO+7v2GrWFZd8jHLZO8JUcEZ7ORxBIjMHlcuaLmyMGGuNP:xyHp3Z71Yq+72M2SLYa2kBIofhGFN2bm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/NSISdl.dll
- IMPHASH ed06d61f6957c32cd324837726a5a070
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
- MD5 ee68463fed225c5c98d800bdbd205598
- SHA1 306364af624de3028e2078c4d8c234fa497bd723
- SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
- SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
4
Entry point
8905
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
wsock32
__WSAFDIsSet
WSAStartup
WSACleanup
send
WSAGetLastError
recv
select
connect
shutdown
closesocket
socket
htons
inet_ntoa
ioctlsocket
gethostbyname
user32
SetWindowLongW
CharPrevA
SetDlgItemTextA
RegisterWindowMessageW
DestroyWindow
EnableWindow
wsprintfA
CallWindowProcW
CreateWindowExW
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExW
SetWindowTextA
GetWindowRect
SendMessageW
GetWindowLongW
kernel32
MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
lstrcpyW
CreateFileW
WriteFile
Sleep
DeleteFileW
GetTickCount
MulDiv
GlobalFree
GlobalAlloc
lstrcatA
lstrlenA
lstrcpynA
WaitForSingleObject
CloseHandle
lstrcmpiA
CreateThread
lstrcpyA
download
download_quiet
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
882B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=14, version=7299,
count=59, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=5, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/StartMenu.dll
- IMPHASH 80469f6834e579db68a646d49780b9d5
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
- MD5 d070f3275df715bf3708beff2c6c307d
- SHA1 93d3725801e07303e9727c4369e19fd139e69023
- SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
- SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
4
Entry point
6430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcatW
FindClose
FindNextFileW
lstrcmpW
GetModuleHandleW
lstrcmpiW
MulDiv
lstrcpynW
GlobalAlloc
lstrcpyW
FindFirstFileW
GlobalFree
user32
GetMessageW
TranslateMessage
PostMessageW
DispatchMessageW
GetDlgItem
GetWindowLongW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
DestroyWindow
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
SendMessageW
IsDlgButtonChecked
GetWindowTextW
CreateDialogParamW
SetWindowLongW
wsprintfW
ScreenToClient
IsDialogMessageW
CallWindowProcW
gdi32
GetTextMetricsW
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoTaskMemFree
Init
Select
Show
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=1, productName=Unmarked objects,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsis_tauri_utils.dll
- IMPHASH 17cb20871354b907f678c7c220e4ca60
- SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
- MD5 c5bd51b72a0de24a183585da36a160c7
- SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
- SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
- SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
6
Entry point
4348
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
nsis_tauri_utils.pdb
kernel32
OpenProcess
ExitProcess
HeapAlloc
CloseHandle
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapFree
TerminateProcess
GetProcessHeap
GlobalFree
InitializeProcThreadAttributeList
GetLastError
UpdateProcThreadAttribute
CreateProcessW
HeapReAlloc
GlobalAlloc
lstrcpyW
advapi32
GetTokenInformation
OpenProcessToken
EqualSid
user32
GetShellWindow
GetWindowThreadProcessId
DllMain
FindProcess
FindProcessCurrentUser
KillProcess
KillProcessCurrentUser
RunAsUser
SemverCompare
memcmp
memcpy
memset
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=1, productName=Unmarked objects,
count=9, productName=Unmarked objects (old),
count=1, id=256, version=33811,
count=1, id=258, version=33811,
ui.exe
- IMPHASH 8956b71588d06be4051215cfdfc2a705
- SHA256 495fa56ca85a4e68837f4d2b0628e903a254540b8cef14caeeb7500137e747a1
- MD5 7821f6e1ae3239e1f8250fd2e2b2272d
- SHA1 92d9aadd08d05b6c778b9f4ee628f315999b18e0
- SHA512 4410fdd83d2ade40d9fd92d4b33a40c59b291f29fa7a2f4c0b1eb912261b10ecde541651bf7c83b41aed8b686e91aa5488ecfd8f2c23968167d02cf4abb6744d
- SSDEEP 98304:aPPbD4xnuPaRJRx74o09lHXnUhKRe7IZSMhpFyV7cxPrwqQ2jJ6cefe2vtjlprk/:aPWRt49TiKgwFK0VjJe99IXWNdU3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
6
Entry point
8851876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ui.pdb
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
kernel32
SetFileTime
GetSystemTimeAsFileTime
lstrlenW
LoadLibraryA
SleepConditionVariableSRW
WakeAllConditionVariable
GetUserDefaultUILanguage
LCIDToLocaleName
InitializeSListHead
LoadLibraryW
GetTempPathW
CreateThread
WideCharToMultiByte
WriteConsoleW
MultiByteToWideChar
GetConsoleOutputCP
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
GetFullPathNameW
WaitForMultipleObjects
ReadFileEx
CreateNamedPipeW
ExitProcess
SetEnvironmentVariableW
GetFinalPathNameByHandleW
CreateHardLinkW
CreateSymbolicLinkW
DeleteFileW
FindFirstFileExW
CreateDirectoryW
GetFileInformationByHandleEx
FindClose
FindNextFileW
FormatMessageW
AcquireSRWLockExclusive
ReleaseMutex
HeapReAlloc
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
GetExitCodeProcess
SleepEx
WriteFileEx
GetCurrentProcessId
GetStdHandle
SetFilePointerEx
SetFileInformationByHandle
GetCommandLineW
GetEnvironmentStringsW
GetCurrentDirectoryW
SetLastError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemInfo
ReleaseSRWLockExclusive
QueryPerformanceCounter
SetWaitableTimer
CreateWaitableTimerExW
SwitchToThread
GetCurrentThread
SetThreadStackGuarantee
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
LoadLibraryExW
TlsSetValue
GetEnvironmentVariableW
AddVectoredExceptionHandler
IsDebuggerPresent
CloseHandle
GetModuleHandleW
GetLastError
RtlUnwindEx
WaitForSingleObject
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryExA
RtlPcToFileHeader
RaiseException
OpenProcess
TerminateProcess
CreateMutexA
WaitForSingleObjectEx
CancelIo
CreateFileW
CreateSemaphoreW
ReadDirectoryChangesW
ReleaseSemaphore
TlsFree
CompareStringOrdinal
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcessHeap
HeapAlloc
HeapFree
EncodePointer
GetCurrentThreadId
IsProcessorFeaturePresent
SetFileAttributesW
GetCurrentProcess
DuplicateHandle
GetConsoleMode
GetFileInformationByHandle
GetModuleHandleA
Sleep
SetFileCompletionNotificationModes
SetHandleInformation
GetQueuedCompletionStatusEx
GetOverlappedResult
ReadFile
CreateIoCompletionPort
PostQueuedCompletionStatus
ws2_32
getaddrinfo
freeaddrinfo
closesocket
WSACleanup
WSAStartup
getsockname
getpeername
accept
WSASocketW
bind
connect
ioctlsocket
listen
WSAGetLastError
socket
getsockopt
shutdown
recv
send
WSASend
WSAIoctl
setsockopt
user32
GetRawInputData
CreateWindowExW
SendInput
SetForegroundWindow
CreateMenu
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
CreateIcon
MonitorFromPoint
EnumDisplayMonitors
IsWindow
SystemParametersInfoA
IsWindowVisible
AdjustWindowRectEx
GetWindowRect
AppendMenuW
GetWindowLongPtrW
GetSystemMetrics
SetWindowDisplayAffinity
GetMenu
ShowCursor
ClipCursor
GetClipCursor
EnableMenuItem
GetSystemMenu
ShowWindow
SetWindowLongW
SendMessageW
DestroyIcon
DestroyAcceleratorTable
SetCapture
SetWindowLongPtrW
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterClassExW
RegisterWindowMessageA
PostQuitMessage
RegisterTouchWindow
SetCursorPos
GetKeyboardLayout
MapVirtualKeyExW
EnumChildWindows
GetKeyState
ToUnicodeEx
SetMenuItemInfoW
CreateAcceleratorTableW
GetClientRect
GetForegroundWindow
GetDC
IsProcessDPIAware
GetKeyboardState
GetAsyncKeyState
VkKeyScanW
GetMessageA
DispatchMessageA
SetCursor
LoadCursorW
InvalidateRgn
SetWindowPos
GetWindowPlacement
SetWindowPlacement
PeekMessageW
ChangeDisplaySettingsExW
ClientToScreen
ReleaseCapture
GetCursorPos
FlashWindowEx
DefWindowProcW
PostThreadMessageW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
MapVirtualKeyW
IsIconic
GetActiveWindow
SetMenu
RedrawWindow
PostMessageW
DestroyWindow
ScreenToClient
GetWindowLongW
MonitorFromRect
GetUpdateRect
ValidateRect
GetMonitorInfoW
MonitorFromWindow
CloseTouchInputHandle
GetTouchInputInfo
TrackMouseEvent
CheckMenuItem
comctl32
DefSubclassProc
RemoveWindowSubclass
TaskDialogIndirect
SetWindowSubclass
gdi32
GetDeviceCaps
DeleteObject
CreateRectRgn
dwmapi
DwmEnableBlurBehindWindow
ole32
OleInitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoTaskMemAlloc
RevokeDragDrop
CreateStreamOnHGlobal
RegisterDragDrop
CoUninitialize
CoTaskMemFree
CoSetProxyBlanket
advapi32
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
RegGetValueW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
RegSetValueExW
RegCloseKey
RegCreateKeyExW
shell32
SHCreateItemFromParsingName
SHGetKnownFolderPath
ShellExecuteW
SHAppBarMessage
DragFinish
DragQueryFileW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
secur32
AcquireCredentialsHandleA
FreeCredentialsHandle
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW
EncryptMessage
ApplyControlToken
FreeContextBuffer
DecryptMessage
DeleteSecurityContext
crypt32
CertFreeCertificateChain
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext
oleaut32
SetErrorInfo
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
SysAllocStringLen
SysStringLen
SysFreeString
VariantClear
uxtheme
SetWindowTheme
ntdll
NtReadFile
NtWriteFile
NtOpenFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
bcrypt
BCryptGenRandom
api-ms-win-crt-math-l1-1-0
trunc
floor
pow
round
__setusermatherr
api-ms-win-crt-string-l1-1-0
wcsncmp
wcslen
_wcsicmp
strcpy_s
api-ms-win-crt-convert-l1-1-0
_ultow_s
wcstol
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initterm
_initterm_e
_seh_filter_exe
_initialize_narrow_environment
_get_initial_narrow_environment
_c_exit
_cexit
_register_thread_local_exe_atexit_callback
_exit
__p___argv
abort
__p___argc
exit
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_set_app_type
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
calloc
_set_new_mode
Name
.text
Size
8.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
448KB
Virtual Size
447KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=259, version=34321,
count=13, id=260, version=34321,
count=47, id=261, version=34321,
count=472, id=1, productName=Unmarked objects,
count=877, productName=Unmarked objects (old),
count=1, id=255, version=34436,
count=1, id=258, version=34436,
uninstall.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 aa816082c18ca3a93f87af2a61b2ad85041fedc8ead0439735c8bc0e1856e5ec
- MD5 a8ebde28c00aecf243e97355ef1e6ca4
- SHA1 9a4ab77f60b163f6cc77b9a3ea4da27e277ec665
- SHA512 42b39e5df98ca4d944f2fbb03702c1f4007a007501f48c1121bfd1ff54728e6f6f21e23f73dbeeb7b103e7f38b2947863dd62f57c6da877cd2996f1983fc25af
- SSDEEP 1536:HmsAYBdTU9fEAIS2PEtuOgdLeAyNxhSlb28sUmhU2Ui0Rb:GfY/TU9fE9PEtuOceAUSl1XkUP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
roblox
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/LangDLL.dll
- IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5439
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW
user32
DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC
gdi32
GetDeviceCaps
CreateFontIndirectW
DeleteObject
LangDialog
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsis_tauri_utils.dll
- IMPHASH 17cb20871354b907f678c7c220e4ca60
- SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
- MD5 c5bd51b72a0de24a183585da36a160c7
- SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
- SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
- SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4348
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
nsis_tauri_utils.pdb
kernel32
OpenProcess
ExitProcess
HeapAlloc
CloseHandle
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapFree
TerminateProcess
GetProcessHeap
GlobalFree
InitializeProcThreadAttributeList
GetLastError
UpdateProcThreadAttribute
CreateProcessW
HeapReAlloc
GlobalAlloc
lstrcpyW
advapi32
GetTokenInformation
OpenProcessToken
EqualSid
user32
GetShellWindow
GetWindowThreadProcessId
DllMain
FindProcess
FindProcessCurrentUser
KillProcess
KillProcessCurrentUser
RunAsUser
SemverCompare
memcmp
memcpy
memset
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=1, productName=Unmarked objects,
count=9, productName=Unmarked objects (old),
count=1, id=256, version=33811,
count=1, id=258, version=33811,