4b57a093651880745bdd56b9a894bf5ef5c8579b41e23c1b70ca802a0334f452

resource
unpack002/App/Inpaint/Inpaint.exe
unpack002/InpaintPortable.exe
unpack003/$PLUGINSDIR/MoreInfo.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/execDos.dll
unpack003/$PLUGINSDIR/newadvsplash.dll
unpack003/$PLUGINSDIR/newtextreplace.dll
unpack003/$PLUGINSDIR/nsExec.dll
unpack003/$PLUGINSDIR/registry.dll

SHA256 4b57a093651880745bdd56b9a894bf5ef5c8579b41e23c1b70ca802a0334f452
MD5 12c753e5388acbf2e12a28594c6316f2
SHA1 28efc94496c0d5a72224bef54a03c9301d6da9aa
SHA512 588741743779fed498e0ed0071f08cbeb726dea1cc74acce630a836c8e7f282a48d16b9d79de41d5f0e26d474855824b4cfcfb308919cb171f1197b84bc1acf2
SSDEEP 196608:Xbq4QoL/hznVpDi7uqU9hTMX6mKLErOUDMquofphEtOFm4vPNIBQNOo3YlcCnP:hPLDi7BU3TMX3rOPaf8OUiVIbdP
TLSH
T1C7B633C103644EC3B618B1645DB15DEF158B8CB2FEB951F9C40C3B94ABA4BF95A0893E
MD5 SHA1 SHA512 SSDEEP TLSH

腾龙工作室 - TenlonStudio.Com.url

SHA256 e48fd29bebda80b29ccca94ff2dfab22ce1c99d3facac276a451d9e2a0c9a4d4
MD5 a9916cabbb855b9aad2cf6f86537e23b
SHA1 4227217ce5cf6d47c42038ee167f4b1e6ccddecd
SHA512 d912f7da39041beaafa1eeabcabae2ec5ce8a517099f85e9cd098cc6ad4133f4aba50ab9f1189a9652018f47bacda9d62ec3068b6192f8af645e452f2cdafdb7
TLSH
T158B092AE50098689D241940A6075F848982FBAA048D2D8AC6688DE8A0D480D2C888B26
MD5 SHA1 SHA512 TLSH

װ˵.txt

SHA256 b58c2f32d56e83cef5337a1a3afe783ea79987499b01937d6342c30127641741
MD5 88da121852c30159ddc77a17fd0fcd27
SHA1 e17724ccafb1ba0b1fc9574a00f5b282fb3805ec
SHA512 31a1252ae9c244f759ad25069d312caca3ad5c243b25734f6128dae85e90626c8f6a610efa8a72683b0733f102cc99f873e669062199b9fb9603d1e7334125cf
TLSH
T168B012A6632609C00FAC42C2322A8440E432451C26906BE0265440606604415670548C
MD5 SHA1 SHA512 TLSH

/Inpaint.zip

SHA256 564a804467a62d6006fe2dfe90888811186be2eb3d02e97f9f531e2c51318d91
MD5 d940c177ce0cd6b3bbc3ee6aa7bff29c
SHA1 b11298616de00de2fbea0968112056f15de39747
SHA512 e45344499794af741718a0659e7a0ae670a4b9764afb2558fef94a4717616dd9bf73692060c4e945c35380a8d4e327ce0f83f90b9b31d57a815ea83bc08f5d8a
SSDEEP 196608:Or4+iVo/1RRZJpB45SSenYPoaiQ8LsJ4+XGcvchZpU5yNFigRSXZABqyYZoS/L78:OM0pB45XeYPoabJ4Nvh+yz9+ywRD/LvA
TLSH
T1DEB6339107512EC3F968F42859E08DEF118BCC67EE2656F8C60C3A14FED97AA661047F
MD5 SHA1 SHA512 SSDEEP TLSH

App/AppInfo/AppIcon.ico

SHA256 17504dfa5b8b051a685ddd5ee2e0575f4f16351ca17c18459995202fbbe198f6
MD5 1f63f9e189bc228be7a5d846b003ccea
SHA1 cf07333068e004902bf92cb880a1f02ee237a8b6
SHA512 240ff919f156242b25612b5f5595261df86e1c57385b8f3878e53eabc5a760bb3becd435b43cccbb479ba5adc6b077f945c69480f37514129877e7a9b078ff6d
SSDEEP 384:j38JyaX+E8jYTK/vk1SGxFvh9OQqmpni8HNKcVBPY:TiRD8jAKHk1SGPh9om9i8vLPY
TLSH
T1B5628D495B614CF0D512097599ABADCDEE21EDB37E8303A30FAD32086C3538CF952CA6
MD5 SHA1 SHA512 SSDEEP TLSH

App/AppInfo/AppInfo.ini

SHA256 1b2959990c233a77873e0da915a91f3892011243e2a2c83512a869fe4f0b3dbc
MD5 913bac4271a6c6437506bb66d2a6892e
SHA1 ade31aedfc95e28affd2e5927e6ba0cf9b0e1239
SHA512 5115da0387eda14c2726dcb30183b8ce9d0782503507babb95bfac7b4ce4bc089670a13272d4fb9e81869ce2daa936592f2d570d0623dc63c2968b3293d9f218
TLSH
T1CDC022080F845B351288A38C3171CCD0F2DB7328149CA08D1881692C9F86C0E0C8403E
MD5 SHA1 SHA512 TLSH

App/AppInfo/Launcher/InpaintPortable.ini

SHA256 f90f4c36a9492366121213abd4c9568d8244cbad8e237895cc7813d4552ba2f4
MD5 75addda3cea9145d489ad7da8a93bc85
SHA1 656c4c913d6a9e0456c02b8ae0c4ff8f4e728766
SHA512 0581b8764b44e9c4ad6d85b3fe52b557c100438e3d05d6f711dd441f5988fe94d5fb9c26374c62d6d7582a4fb42dfad69f0d1401fd0f108050619622cb455bab
TLSH
T17FD0C2123B07F2251281E7FC752192D292834E81D8CEA8C27A03919DD026CC408780EB
MD5 SHA1 SHA512 TLSH

App/DefaultData/settings/Inpaint.reg

SHA256 158b18f8c9c6028006fdce58492c841e899c16ff4c61d452d4ae094989847760
MD5 3d1070b7be5e40d5d78da5646f15e771
SHA1 869e64ff832f2b61715610d5737a331d4fe3683d
SHA512 ebad6cbe9a5723890f37b4ba1619cda8c72f0fd5df3d74c38dd1d9158f1ae66b55aab1498872bdc70eb1fc272cff5ff2d5e0a478176e0bf4ad674635b33ffbd3
TLSH
T16FE086765513929F82D56319B426E6A223B3328DF4CF0AD4D69A025879A1CCA631A0B6
MD5 SHA1 SHA512 TLSH

App/Inpaint/Inpaint.exe

IMPHASH 3394d43a615bbc510ee58a0aac551da4
SHA256 9007e8388f15308520782fc204828928f5dda3e1b30e9df4b69d75d295eafecd
MD5 d68fc0277d0aafc356cca70882799580
SHA1 309cf1a5f88e8a15aa8938aa632d9ae85860161c
SHA512 6260e50dd72312abac6b7788f8b6b223e51b69b5e027f336670cde8dec9a5bb7f9a674dc9baeea418b5bcd647cbc0cce9ac1fac318c24941f2b19edf4dd5f44e
SSDEEP 393216:7eQ/9G7fuNDdlWGEzabAOYojKJeleY2ByJsv6tWKFdu9C6TzggiV9:MFLMlstzg
TLSH
T1C6379D47B2A105D4E076C038CAA7C507F7B1742A53B18BEB21A556EA2F37BE06D3B711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12102236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

DeleteDC CreateDCW CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps SetLayout SelectClipRgn OffsetRgn DeleteObject CreateRectRgn CombineRgn CreateBitmap ChoosePixelFormat DescribePixelFormat GetPixelFormat SetTextAlign SetGraphicsMode SetBkMode GetCharABCWidthsI GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsW GdiFlush GetTextFaceW GetTextMetricsW RemoveFontMemResourceEx AddFontMemResourceEx RemoveFontResourceExW AddFontResourceExW GetStockObject GetFontData EnumFontFamiliesExW CreateFontIndirectW CreateDIBSection GetDIBits SelectObject SetWorldTransform ExtTextOutW SetPixelFormat SwapBuffers GetBitmapBits SetTextColor GetObjectW BitBlt

oleaut32

SysAllocString SafeArrayCreateVector SafeArrayPutElement

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetVirtualKey ImmGetDefaultIMEWnd

winmm

PlaySoundW timeKillEvent timeSetEvent

ole32

CoCreateInstance OleIsCurrentClipboard OleFlushClipboard OleGetClipboard OleSetClipboard CoInitialize DoDragDrop CoUninitialize OleUninitialize OleInitialize RevokeDragDrop RegisterDragDrop CoLockObjectExternal CoTaskMemFree ReleaseStgMedium CoGetMalloc StringFromGUID2 CoCreateGuid CoInitializeEx

user32

SystemParametersInfoW UpdateLayeredWindowIndirect SendMessageW UnregisterDeviceNotification RegisterDeviceNotificationW GetUserObjectInformationW GetProcessWindowStation PostMessageW AttachThreadInput DefWindowProcW CreateWindowExW IsChild DestroyWindow ShowWindow UpdateLayeredWindow GetCaretBlinkTime FlashWindowEx MoveWindow SetWindowPos GetWindowPlacement SetWindowPlacement IsWindowVisible IsIconic SetFocus RegisterTouchWindow UnregisterTouchWindow IsTouchWindow GetCapture SetCapture ReleaseCapture GetSystemMetrics GetSystemMenu MessageBeep IsWindow GetDoubleClickTime EnableMenuItem GetForegroundWindow SetForegroundWindow GetDC ReleaseDC BeginPaint MessageBoxW GetDesktopWindow TranslateMessage DispatchMessageW GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx CharNextExA SetLayeredWindowAttributes DrawIconEx EndPaint ChangeWindowMessageFilterEx RealGetWindowClassW EnumWindows GetWindowTextW CloseTouchInputHandle GetTouchInputInfo GetAsyncKeyState GetMessageExtraInfo TrackMouseEvent GetClipboardFormatNameW EnumDisplayDevicesW RegisterClassW GetCursorInfo GetIconInfo CreateIconIndirect CreateCursor LoadCursorW GetCursor SetCursorPos TrackPopupMenuEx GetMenu MapVirtualKeyW ToUnicode ToAscii GetKeyboardState GetKeyState IsZoomed PeekMessageW FindWindowA SetCaretPos ShowCaret HideCaret DestroyCaret CreateCaret IsWindowEnabled RegisterWindowMessageW GetKeyboardLayout RegisterClipboardFormatW ChangeClipboardChain SetClipboardViewer IsHungAppWindow LoadIconW GetSysColor EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow SetMenuItemInfoW GetMenuItemInfoW TrackPopupMenu RemoveMenu ModifyMenuW AppendMenuW InsertMenuW DestroyMenu CreatePopupMenu CreateMenu DrawMenuBar SetMenu LoadImageW GetSysColorBrush ChildWindowFromPointEx WindowFromPoint GetCursorPos GetFocus RegisterClassExW GetClassInfoW UnregisterClassW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetKeyboardLayoutList GetAncestor MonitorFromPoint DestroyIcon DestroyCursor GetWindow GetWindowThreadProcessId SetParent GetParent SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW ScreenToClient ClientToScreen SetCursor AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW InvalidateRect SetWindowRgn GetUpdateRect

shell32

SHBrowseForFolderW Shell_NotifyIconW SHCreateItemFromIDList SHGetKnownFolderIDList SHCreateItemFromParsingName SHGetPathFromIDListW CommandLineToArgvW SHGetKnownFolderPath SHGetMalloc ShellExecuteW ord727 Shell_NotifyIconGetRect SHGetFileInfoW SHGetStockIconInfo

kernel32

LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount GetCPInfo CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock LCMapStringEx DecodePointer EncodePointer RaiseException RtlPcToFileHeader InitOnceExecuteOnce GetStringTypeW ExitProcess GetUserDefaultLangID SetHandleInformation GlobalFree LocalAlloc GetUserGeoID GetGeoInfoW GetTimeZoneInformation RegisterWaitForSingleObject UnregisterWaitEx GetExitCodeProcess GetModuleHandleExW FindNextFileW FindFirstFileExW SetFilePointerEx ReleaseSemaphore GetVolumeInformationW GetFileType GetDriveTypeW FlushFileBuffers GetFileInformationByHandleEx SystemTimeToFileTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime MoveFileExW MoveFileW CopyFileW DeviceIoControl SetErrorMode GetVolumePathNamesForVolumeNameW GetTempPathW SetFileTime GetCurrentProcess UnmapViewOfFile DuplicateHandle LoadLibraryA CloseHandle GetProcAddress FreeLibrary CreateFileMappingW MapViewOfFile MultiByteToWideChar WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetNativeSystemInfo GetLastError GetCurrentThreadId ChangeTimerQueueTimer LocalFree FormatMessageW WTSGetActiveConsoleSessionId ExpandEnvironmentStringsW CreateProcessW CheckRemoteDebuggerPresent OpenProcess GlobalAlloc GlobalUnlock GlobalLock GetLocaleInfoW GlobalSize GetCurrentProcessId CreateFileW ReadFile WriteFile RemoveDirectoryW InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList SetLastError SignalObjectAndWait GetLogicalProcessorInformation SetEndOfFile GetLongPathNameW GetLogicalDrives GetFullPathNameW GetFileInformationByHandle GetFileAttributesW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetCurrentDirectoryW GetLocalTime GetSystemTime GetUserPreferredUILanguages GetUserDefaultLCID RtlUnwindEx RtlUnwind SetStdHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime SetFileAttributesW GetCommandLineA ExitThread GetConsoleMode ReadConsoleW GetConsoleOutputCP GetStdHandle HeapAlloc HeapFree CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW HeapReAlloc GetFileSizeEx SetConsoleCtrlHandler SetEnvironmentVariableW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW HeapSize ReleaseMutex CreateMutexW InitializeCriticalSection GetCurrencyFormatW GetTimeFormatW GetDateFormatW ResetEvent LoadLibraryW GetSystemDirectoryW WaitForSingleObjectEx GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc ResumeThread TerminateThread GetThreadPriority SetThreadPriority GetCurrentThread CreateThread SwitchToThread WaitForMultipleObjects Sleep CreateEventW WaitForSingleObject SetEvent GetCommandLineW GetStartupInfoW GetTickCount64 GetConsoleWindow IsProcessorFeaturePresent TerminateProcess OutputDebugStringW GetFileAttributesExW CompareStringEx SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetTickCount GlobalMemoryStatus GetEnvironmentVariableW ReadConsoleA CreateTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait GetVersionExW VirtualAlloc VirtualProtect VirtualFree GetModuleHandleW SetConsoleMode FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification CreateTimerQueue GetModuleFileNameW

iphlpapi

ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidW GetAdaptersAddresses ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToIndex

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

dwmapi

DwmEnableBlurBehindWindow DwmIsCompositionEnabled

netapi32

NetShareEnum NetApiBufferFree

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

userenv

GetUserProfileDirectoryW

crypt32

CertCreateCertificateContext CertFreeCertificateContext CertOpenSystemStoreW CertCloseStore CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

ws2_32

WSASocketW WSAConnect WSASendTo gethostname WSAStartup WSACleanup WSAAsyncSelect htonl ntohl getaddrinfo freeaddrinfo getnameinfo getsockopt __WSAFDIsSet bind closesocket getpeername getsockname htons listen select recv send WSASetLastError WSASend setsockopt WSAGetLastError WSAAccept WSAHtonl WSAIoctl WSANtohl WSANtohs WSARecv WSARecvFrom

advapi32

LookupAccountSidW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW CryptGenRandom RegNotifyChangeKeyValue RegSetValueExW RegQueryInfoKeyW RegFlushKey MapGenericMask GetTokenInformation GetLengthSid FreeSid DuplicateToken CopySid AllocateAndInitializeSid AccessCheck OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey GetEffectiveRightsFromAclW GetNamedSecurityInfoW BuildTrusteeWithSidW SystemFunction036 RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW

Name

.text

Size

14.6MB

Virtual Size

14.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

454KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

675KB

Virtual Size

674KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

1024B

Virtual Size

693B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

117KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=30, id=259, version=27412,

count=207, id=261, version=27412,

count=8, id=253, version=28518,

count=20, id=260, version=30034,

count=12, id=259, version=30034,

count=154, id=261, version=30034,

count=526, id=260, version=25019,

count=1, id=263, version=27412,

count=46, id=260, version=27412,

count=1, id=262, version=27412,

count=35, id=257, version=27412,

count=602, id=1, productName=Unmarked objects,

count=234, id=260, productName=VS2019 v16.4.3 build 28315, version=28315,

count=840, id=261, productName=VS2019 v16.4.3 build 28315, version=28315,

count=12, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,

count=137, id=261, productName=VS2019 v16.6.2 build 28806, version=28806,

count=98, id=265, version=30136,

count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,

InpaintPortable.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 d022575fcb8103dbebfcf2a0ed330aabc568cfb7123631c08f8ea6e1347496fa
MD5 8cc1de86b0bee66589dbe8e63a6bf731
SHA1 63b1884a5ad9c0e7f171b170f3717b2d924bdf9e
SHA512 aaf288cd785c8365469ea433c4fa3f8439fa9bafccbe0aa96bfb0187faacd4ea9346d6fac200dc50dea3f865195fb20889751669ae3999f24e73785ddb77e32c
SSDEEP 6144:1QEUXDMqJxq++ql4gvkbamFX6w18Yhd2APvIdm8nZspx1uxXHe9VOHA18gdZi:uEKq++Wvxmkw1JhwOWZ/euHy8gG
TLSH
T169B4B09A2E3BD9E0F06B05F1DD359D05F9B13D22399B8AF93952378735341EAD20182B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

366KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/MoreInfo.dll

IMPHASH 149adf074d317fbf0d2f17314bd18969
SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
MD5 bd393029cc49b415b6c9aeb8a4936516
SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
TLSH
T1EEE1603263F441EDF9DB0B346C334B291D75BC21EA21957F2691098D3DB1A44EE227B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
TLSH
T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
TLSH
T1CC526C5421D84BBFD24156383ADB776346B9FB316C62818FC6A349CB6871693A93E302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError lstrcmpiW GetCurrentThreadId GetProcAddress GetCommandLineW UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent GetVersionExW SetCurrentDirectoryW MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingW CreateEventW lstrlenW GlobalAlloc CreateProcessW GetLastError FormatMessageW LocalFree GlobalFree CloseHandle GetModuleFileNameW lstrcatW GetPrivateProfileIntW GetPrivateProfileStringW DuplicateHandle LoadLibraryA

user32

SetWindowsHookExW DispatchMessageW TranslateMessage IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects DefWindowProcW PostMessageW SetForegroundWindow CreateWindowExW GetWindowThreadProcessId CallWindowProcW SetWindowPos GetWindowRect UnhookWindowsHookEx GetClassNameW CallNextHookEx CharNextW DialogBoxParamW MessageBoxW EndDialog SetWindowLongW LoadImageW GetWindowLongW EnableWindow ShowWindow wsprintfW LoadStringW GetDlgItem SendMessageW DestroyWindow

advapi32

GetUserNameW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

$PLUGINSDIR/execDos.dll

IMPHASH a5d239ed12c9442d63c73cb9ff7cad0e
SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
MD5 0deb397ca1e716bb7b15e1754e52b2ac
SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
TLSH
T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/newadvsplash.dll

IMPHASH 7efb019e000b6e0291c32d00fe622590
SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
MD5 55a723e125afbc9b3a41d46f41749068
SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
TLSH
T17702C73972C169F3D26B05F82D526B2E0FEEA035135650228B33A4DA3DA0353FD26747
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/newtextreplace.dll

IMPHASH 42624ab02b71999959eb0f4168f609bb
SHA256 156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734
MD5 b5358341df2cb171876a5f201e31a834
SHA1 df34750ea5504274be5ff8ddd306b49e302d04f9
SHA512 821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014
SSDEEP 192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X
TLSH
T11832965F729645F6EA2259B00FCFF67B8E90C005402B4F6CB79A896CB933E84710D195
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
TLSH
T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH f450890bf454de37198f435d5832e67d
SHA256 acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
MD5 2880bf3bbbc8dcaeb4367df8a30f01a8
SHA1 cb5c65eae4ae923514a67c95ada2d33b0c3f2118
SHA512 ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
SSDEEP 768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
TLSH
T117D20980D64091A5E4F678FEB7D2633B462D6BB00553A09713F33E57AD68704BB2392E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer