PowerISO9-x64[.]exe

resource
unpack001/$R0
unpack001/devcon.exe

resource
PowerISO9-x64.exe
unpack001/setup64.exe

PowerISO9-x64.exe

IMPHASH 24f4223e271413c25abad52fd456a9bc
SHA256 104fd55a9c9afe36eaa2f6dbbcd2de37b14c807d3d94abd53a0460a1ad31fe38
MD5 ada6e99deca259e00bb4aaf68bfa7281
SHA1 7cb951af9acad3652d1464d88d7caecd9a6be0d2
SHA512 67b68cffd3f174ee557c372c0ce4a9eee167733c9ccf60fbd30a4d91f0227dbdb51245abf6a8f648d9a3b93bfc0a0da5f69c09308c13507e3430f5b4f3e76bbb
SSDEEP 98304:/JnqxF3UCmd06aowGwmogGfJC7NDhHZnmNx4ro9sjARKLYUfJE2w5AnZC:/JnsUH09xqE45tEQro9ELYUfJE2wAZC
TLSH
T11C46334676888AB6C40D05B1DF7A4720E9F7EC60AAF2DF4363D17724D6A08D35E462CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

74:00:d4:d9:61:62:35:55:08:1b:d0:20:71:08:ea:c2:94:a5:90:55:36:b6:63:f4:c0:cc:39:e8:96:52:81:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Power Software Limited,O=Power Software Limited,L=Sheung Wan,C=HK

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=Power Software Limited,O=Power Software Limited,L=Sheung Wan,C=HK

Serial Number

7a:8e:68:d1:6b:ec:2b:37:75:57:2b:78:c1:db:39:10

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2026 - Feb 22, 2029

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

0

Major OS version

4

Entry point

13581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW MoveFileW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$0

IMPHASH 8cc86026769dacc3439639a1321b72f8
SHA256 d01a58e0a222e4d301b75ae80150d8cbc17f56b3f6458352d2c7c449be302eee
MD5 92eae8dec1f992db12aa23d9d55f264a
SHA1 add6697b8c1c71980e391619e81e0bada05e38ee
SHA512 443a12a1a49e388725ee347e650297ba5268d655acd08e623ea988cde07ae08ae861620b600fb223358339eeab926fee1c8377386501310c68a3eb9515649441
SSDEEP 3072:hl1VSgPra4TD5Yt2JVLuPIqEjOZN7mPARacgx:hl3DtYtm+Ij2aZ
TLSH
T1DDD37C93F18550B6C9A79178CAE69A23D6B7F4141325A3DB64A08A771E03FF42F3D324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

ce:2b:8e:70:8d:7d:3e:3c:43:a2:96:1f:ac:31:2b:c3:a1:e9:f1:53:d1:3a:00:ac:d8:20:5a:03:5e:55:36:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Power Software Limited,O=Power Software Limited,L=Hong Kong,ST=Hong Kong,C=HK

Chains

Jun 7, 2017

CN=Power Software Limited,O=Power Software Limited,L=Hong Kong,ST=Hong Kong,C=HK

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

5f:3b:82:84:ec:7f:8e:3e:1d:ce:7e:1d:dc:9e:3d:64:0e:45:32:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Power Software Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Power Software Limited,L=Hong Kong,ST=Hong Kong,C=HK

Chains

Jun 7, 2017

CN=Power Software Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Power Software Limited,L=Hong Kong,ST=Hong Kong,C=HK

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Power Software Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Power Software Limited,L=Hong Kong,ST=Hong Kong,C=HK

Serial Number

22:7e:fd:f2:28:25:ba:27:05:30:fb:09:d5:2b:32:f8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 27, 2014 - Jun 25, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Power Software Limited,O=Power Software Limited,L=Hong Kong,ST=Hong Kong,C=HK

Serial Number

2e:3b:3d:03:63:ac:ec:80:69:9f:4c:bf:1a:5f:09:dd

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2015 - Jun 25, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

2

Major OS version

5

Entry point

148304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\untitled-1\ddk\obj\amd64\scdemu.pdb

Name

.text

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-header.bmp

SHA256 4566dfcc153cba168a02eebc5ddd9d82832cf463ebb8ecb4ec2f269f9f85aeca
MD5 ca2542b0e66e48d7e3f361c8eef8f720
SHA1 368093fbcbf5dfe2cd58e77f2d6eee7ea5b808cb
SHA512 72296dd3d0a741caf051a326cd703b59132136bccbe43c000cf4e57e3d7955aa812501a59f4f62530b2a2b8a73bebf55d32aa428a869c4c840fc16bca1788a33
SSDEEP 384:tZfV37EjIopEmmR2vqTf73cynNOBD97H5x1QJOa5/LIsW4Jl7tJegwf0NY:rejIodmMiTDzNOBV/o5/jJl7DTNY
TLSH
T1B1636EA2D407F8D1EDADF2433FFA191C22775EBB7A7C754E290EF0650E31241A089869
MD5 SHA1 SHA512 SSDEEP TLSH

$R0

IMPHASH 24129f939da41cc56515e833be608d60
SHA256 8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42
MD5 9d199564b65a91a531b23844649459e9
SHA1 8d84359ced1c51d14e70cb5ed36a6083c8b914cf
SHA512 ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1
SSDEEP 768:Ubrbmi0iAETVvlXjkQnr65WTHBAtgYSofgevxHs4gZWk:ab70GdXoQr65WDBAtgYSoflxHeW
TLSH
T1AB63DB0263E94608F1F7BB306AB552619E767C849F38C6CE018485291FF3ED0DD79BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

30400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\devcon\objfre_wnet_AMD64\amd64\devcon.pdb

msvcrt

__set_app_type _fmode _commode __setusermatherr _initterm __wgetmainargs _wcmdln exit _cexit _exit _c_exit _XcptFilter __C_specific_handler memset wprintf __argc __wargv _itow wcsrchr _wcsicmp _wcsnicmp iswalpha towupper towlower wcschr ??2@YAPEAX_K@Z ??3@YAXPEAX@Z _iob fputs fputws

advapi32

RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW RegDeleteValueW CloseServiceHandle OpenServiceW OpenSCManagerW RegSetValueExW

kernel32

GetFullPathNameW GetFileAttributesW LoadLibraryW GetProcAddress FreeLibrary lstrcpynW FileTimeToSystemTime GetTickCount lstrcpyW lstrlenW GetLastError GetCurrentProcess CloseHandle FormatMessageW LocalFree GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter GetStartupInfoW GetDateFormatW

user32

LoadStringW CharNextW ExitWindowsEx CharPrevW

setupapi

CM_Get_Res_Des_Data_Size_Ex CM_Free_Res_Des_Handle CM_Get_Next_Res_Des_Ex CM_Free_Log_Conf_Handle CM_Get_First_Log_Conf_Ex SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW SetupDiOpenDevRegKey SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiSetDeviceInstallParamsW SetupDiGetDeviceInstallParamsW SetupCloseFileQueue SetupScanFileQueueW SetupDiCallClassInstaller SetupOpenFileQueue SetupDiSetSelectedDriverW SetupDiGetDriverInstallParamsW SetupDiOpenClassRegKeyExW SetupDiGetClassDescriptionExW SetupDiClassNameFromGuidExW SetupDiBuildClassInfoListExW SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiGetINFClassW CM_Disconnect_Machine CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW CM_Connect_MachineW CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex SetupDiClassGuidsFromNameExW SetupDiCreateDeviceInfoListExW SetupDiGetClassDevsExW SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList CM_Get_Device_ID_ExW SetupDiEnumDeviceInfo SetupDiGetDeviceInfoListDetailW

Lang/Arabic.ini

SHA256 b1607fb23f0ac4fe122ebea5721bfd5ad009a90c988ce55741e2c76b6b19896c
MD5 8422b0e085be3c6982183556247bd4ff
SHA1 7193e74615668cfa448d2ddb2da9848fcaad597f
SHA512 733ae5af6a4fd7fbb8c1fe021714f15de0cf4c8c5b14febf96d76ae2ed0f2757358d782d57554260ae1c9649eedac126524c422a07a78e5a68b75c4c3d55a19a
SSDEEP 3072:2mmttlM1viYJBR8q1L53C35E1lb1U1/gc4Pes:2pPlWaYPE5EHb1U1Yj
TLSH
T130C3F1265AECC238B2F37A10DAB5C62357357856ECFCE62C01D1094D09E1A5099A7BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Armenian.ini

SHA256 b359828800664e8f205d976434e273400f495c55c350d9d4086da7682d9e679d
MD5 222457a162afa8917c394eef2576fdd0
SHA1 ad0694360103e05056d2539cc558b0f67f1db0de
SHA512 9a89949d89e0ea40e8c7220b1ca9b7f269fa8309ec8f3fbc678a9a5a0e1f6ccda04164a5770b4f0ea458fc0964ee111d4ecbf70d8b830ebeea567b6c8f4fd9f8
SSDEEP 1536:SNDEx4QUdMsgehq1L7oWL1vs+UPU3QiecsPqBCPes:Lx4xdMr8q1L53UTiNxgPes
TLSH
T1CFD3F73712E8812AF1F37B10E9B516346F26FA56E87CF65D00C9444D16F2940D8ABBEB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Azerbaijani.ini

SHA256 2d7bf84c06e309c73aec122330f97d3718dd2dcdbb87713131aab7b9221fbf1e
MD5 2a8f2660def6319ae8bb820fe3470c92
SHA1 accf4e25bbc0951ff5c44952ab71a06db19bd016
SHA512 09cbdc79e1b5efe7ca50f0affc84de3e64131d92bbb27f02c6fb5004f74f9a603bf79ca9ab689bce5957058b7299ff114830f9fa90193cdd124c41bb58472cac
SSDEEP 3072:RjF8LN6zX8SCAl9Wj0ID09VWHLv8nKVj9NHB+PjCjlDdh8q1L53FRiXq34u2Pes:QBLvU
TLSH
T1C8C3002613EC4219F2F37F40EDB52A715B767CA2FD3CD55D11C1058D08F1A90A8A2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Belarusian.ini

SHA256 f73bf63d152e191d7fcc89c6de200d0cc313cf7a3d68a9fbdfb1ef3223b17dd8
MD5 27f34b52c82f8bb600044261ec01826e
SHA1 57a94c3d9aae1c97334654a8644e2945d19a4e8d
SHA512 d3e432142b82265356ef3223d12cba1eb2612633d9170a86b116423faa71c1edb9eec2f57648e7c06f298659dcacd2d28c0ea6fb20ebc2af93a337804491d27a
SSDEEP 3072:D3v/z0ouYhiD6aD/GkRNHQlEsF/H1ilan+stxAOz7Wi/JPI/y2Gk/:D3v/z0ouCiD6aD/GkRNHQlEsF/H1ilaI
TLSH
T12BD3581FBAB88225B2F5E24089A107E322F9B701B77D89C95EC7799804D827077527DF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Bosnian.ini

SHA256 49ed8ca4d9d157cea683653187960a92532b18a037dbca5f49a0a7ce9cfe53f2
MD5 7ac458e415fe2c6abcfd18697747356d
SHA1 89b066cc7a4330bd43466487e17b32dc398c56e4
SHA512 173e00f279b3b5143cecc35a00598be9e1b8842072272facc822b2131d450f67c97f02326d1fb4aa7b50eaa6c4a4d56a39129e95daf780a7231e7e9f81dd5247
SSDEEP 3072:WjgJrfTEqU3zTcDLDDsTtRmML53Hxe1IvQNwlQW4vm:O5
TLSH
T157C3AD2767FD125AF6F7BB10E9B413305B7A7CA6BD3CD51D10C1058D09F1A8098A2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Bulgarian.ini

SHA256 993d6ae2dcbdaf64422b2a7a06bc13351a87770a33939098b2608c33c48733b2
MD5 ca64060d2917ce36d8b323d24ae5f024
SHA1 6d1b5aaff7d38241397a29df6bea2962bf9c5b1f
SHA512 4bc25f7b93bd08d3cec3dc42909d44a75fb049a1018a3ea23a22780f9c73de210670978e8ce8872c23b3abfc7143c759fdb7c8a253d1aecf5709139c260cf4eb
SSDEEP 3072:HNnrxdDoUXbBuLZ2h2r1e1XN6+bix59P5fwSaG2g2HjYOOFJr:HNnrxdDoUXbBuLZ2h2r1e1XN6+bix59h
TLSH
T10BD3B81FB87D92157AA8D2409E9247E732FA7711772C1AC582CF3DA8A09D67133126CF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Burmese.ini

SHA256 8c8caa3decd140ff304267d80500550fc637afda5c88744b72728a812477ece0
MD5 f2f73929d8ff79defe69af3542489539
SHA1 7808c31416a6075d1730985aaaecee3c0a8ef0a1
SHA512 fe345eadd817901f689fc00b26d41f413e129eec60dd2e80d6bb6b98b0e66d355d93547fd34f300898129f6246498ee6223f2eef0595425e6df1266dd859626f
SSDEEP 1536:1DCMvLsHu4xk/NEY69DS/p8irX8VjyLIoAX5d8et5:5vLfHNEY69DpiMX5d8ez
TLSH
T1AFD314EC23980A25422759DCFB5CC934B3AA68D65C7CD8CC0FE14D9BE4D189058BB6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Dutch.ini

SHA256 1e9c1e32d12304cfaf9692a69d1ad822025cb83172ca3060b0198b9990079354
MD5 425badad1826bf64e2de59a0d9ac1daa
SHA1 007bbf8d1e490fc1564245fbe61464368edd175d
SHA512 104c387b8782b346d0a9cc77ad711515342e48dbfa27f682cbd25e1417304dfa43c4ae50e6f9b1dcd280a3461827ea1e6f914170317d32881dbd753e743931a3
SSDEEP 3072:BkKeEBSlOmEW03aAxh+IGHhDD9CzS7LTlYvB6Q5aeHNVngEZeTH07/Fw0ypLg952:VUlv
TLSH
T1BAD37E1627E88219F5F36B00A9B416715FB6BCD6BC79D60D02D1158D4CF1B80E8B2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/English.ini

SHA256 6b583e0744760bc2ce8453c3a5b4e170f553475eaee0743da737fb921fe31d9f
MD5 919460200e37a5a94d254dd940951c98
SHA1 f577db1eddadc6643317a6e91a335f7e71c57e7a
SHA512 659f025ebfa79122738fb54494fba5d7d490680ca03d4c8fcd80bfd83c75adcf19bc3ecd6f9dd5697cb95091f86fc8d2ed6fbeff31c1b22c79e6ea772c40eeb1
SSDEEP 1536:51gT4fsEUdMsgetq1X7oKLZLsHf0ijaPes:51gTAsEUdMD4q1Xtmf0ijaPes
TLSH
T123C37A2663ED4229F2F77F54EDB402315B7ABC56ED7CD65C01C1058E09F2E4098A2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Farsi.ini

SHA256 e4643806cb4318b0c8fadb7e80cecb9127990138297591fe5034825e9fabaf87
MD5 2e1f35c0ede43cdff4d8757c96f71ad9
SHA1 513c1c11cf53b22993f63756bd325e419ebbd810
SHA512 a840a147f514fb9c7414cd96d0438cb77e09879e818667ae35390fb448327a8519012200fa15435ed05bdbb1910a9898d2ab766a6c2a03632e8fb8c8f46451ab
SSDEEP 768:Ow7ur/oKxSLqrtZZ3KW9HTcFsEtW++xx+g7t2nAmGldPQ5+mnBiZkvFikNJ7G8My:RVlct2nUfoEmT7oWL1vs+P1VI6mx7cR
TLSH
T1D5C315164AE9C634B2F77A14DA72C63367317857BCFCD93C02C2085D09E1A609997BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Finnish.ini

SHA256 5549492217cc8b6e0efece18c65a1becc2f27774934a6c71044a00bca3c258ec
MD5 e254e709be28421685e5f52025d72d09
SHA1 d632815106ff2f7333f4bffd456bafd0372d329a
SHA512 894e28bb59f5bf70bd20e27051add22d3c261642b50a36f01cd85108d7454724386ec27aba4442f391a066db5ff55aabf5cf07ce32cb10540d5d502d212815cf
SSDEEP 3072:qsSVyEmB6MT0TO/0rqulRVm/GUn53l2xvkJPBWMb4:yDDX
TLSH
T1C1C3A06716FC4229F2F3BF00E9B412315B767D96ADBCD65C06D1054D09F1A80E8A2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/French.ini

SHA256 e094026b4b979ab54a580099dd8f899e5fc8a72159a326d9cf6210b8ed10f0a2
MD5 b3724d16edd5ea2d2e3344e5461fdc0f
SHA1 7d21b70068c728b391ee9e6ea5e1a69470f40c70
SHA512 fb470b93a955eb673459c75cd2bffd3531ba5d0fa93e36d599223f1e41d35a59ae7b5647399a426c317569b9effd117f3c31e0c156fdc7e55c3d096508ac49b9
SSDEEP 768:O7fKibF7e2FRauJwK+5r4pAIb2HktZWMv0lytyCgMXQVrkejJHwFhdTNo3Rj5gX3:HW65mJW9dZ3q4vq
TLSH
T1F3E3762663E94216F6F27F05E8B902255F77789BEC3CD61C0581458E1CF2F40D8A6BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/German.ini

SHA256 6c7decdd88e97f6673ff2aec34b362ce1bb54dec94b2d857f4cbfdc68405ac23
MD5 52b284d91af39cda3b26615c9959e32e
SHA1 af53b9a0612f1f84db919c0cea96c78f35f0efdf
SHA512 659cc84bf371d86cdcb1f69341dc0bcdc8df17185648473ea4b087b462634ebf7d3ccc725cf9a6676ec4441cd807ff918eabe2c1365537485a5088d6dcc15daf
SSDEEP 3072:EwSa/H/Pdfzqt2sBTsI7QQ3tTpFPTjyd2j7us9mYpwx7f0Icy57AJ8TuND13s5qI:oYH5
TLSH
T189E3CE2713E94628F2F36B14FEB412746B72BDE6BD7CD90D12C0458D08F1A409962BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Greek.ini

SHA256 ea72c65a7a82701f00459da8948993dc1e1f8d12a13f6ec16a6d0079603a5b8e
MD5 cf674aadff41f6ce8fa8bebc873aa60a
SHA1 ca0997f26987765e08f53459dcb0b662416511b3
SHA512 fc635c25967852bf9bef5a16b89727449860a4c33d02d7b9dc63ad1b1700e18303c5acc2046602ec656a81fe0043cd41284c741e5ecf3e25a5ce5fab6e4e15cc
SSDEEP 3072:5bqvswrRUdy4UIj/7QQKwIIejYz2F6FkHNMJdjP7iCf53/XqX:RM2Pk
TLSH
T12AD3565E0DAF0721AEA499F1D47242325B6EF592582CEE6EB1F13444C9ED8025CC3E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Hungarian.ini

SHA256 e0c9dcfed60ef3b17ac1c3704981936ff65b6ec6e9623b704c39cbca33cc06d4
MD5 f67a8e8a0cfc552da4f533cb2741863c
SHA1 62e0a1fd40ee1ebebec35bb2d41057b3d43fafad
SHA512 2d447c08ce82c7b4cdd019100bb441ed4f061cbe230251a2ce11fa6ac5f5505b37a5d12a9ef76ee41c773524c9b52679e50ec844012e214b53ac1c4e244f27d8
SSDEEP 3072:eAbJ7Zvs3jCwvgNnoWdujhT3tu9F2hRvSkTNVEW1UoHekfxkc3cz+5qH6zuL52na:eguQxSD2nMPk
TLSH
T1F1D3041B22EC0256F5B78F52FDF053A54B75B8A1BE3DD51C90C1168C0AF5680D8B2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Indonesian.ini

SHA256 4c4ee562773a6ac377ed8309e98b3455dff64b1c6ad632e4aeba1398ba8f474c
MD5 0e08485c624f02bcc531cf267e326335
SHA1 07ac39848ea6a8a020867ae54d1dd4312dcf2c71
SHA512 d162876a12366627c1e4475225703373479ebba4c15d16577c7e7ee7560c10dda96389ef33eda6e15594df2ea33cbfac8177cab79fee811c595ae9875a526a33
SSDEEP 768:OtwNhnLO+Doz/Ye6fRejlDJTH5eo6MgDO8huSPJ7Fr2NIUwU8vasVxqkAf7G8Mxz:uIho63KRYVK7bvs+xpV19KDj
TLSH
T1FDC38A2A63EC5259F6F76F00EAF412715B66BC92BD7CD61C12C1154D0CF1AC098A2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Italian.ini

SHA256 de911c4782246c6d6779ca340850b4fa9a13d5ab16af8912f332875d2ec2a596
MD5 21981b6f531dc522cf15475857fe3013
SHA1 b686b0a9755a551ed8eaf4744aed4047409dee6d
SHA512 5783b0565548c6bc43879f76b604e83a053a22eddecf6c856506d9d852b2c7fbde1b430cc862f0889661ed33e90de0ce172f471c4e46e7e73bcbd8661ff3a2df
SSDEEP 3072:Z3UaSchYiZC/CnW+DZytuEhk9JAHatQay6OPCqzu6hPOCXU3m2pEBso/0FF2duGp:14SYYDWD
TLSH
T16DD38B2667FC0219F2F3BB50FE7816255A7ABD56EC3CD51D01C2058D08F1E6198A2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Japanese.ini

SHA256 5e5f6424cf7ede5ba1652c5cf16568f706198466017fe9324609ba9ccef5b661
MD5 862d5b475e3e3e55137f106f7fd6a041
SHA1 5bab9762eb37ed0948b68c4891b7dbf804c17d57
SHA512 7372c883d1bcb088e7af2d59ec5c588798d294f2b1ea82d8fbd95ed6acabff765b9357eeb388228dc7e847d2039f4659858f955ba7fd15c0fdbfe537b506e06d
SSDEEP 768:O+PvoaipoYN7dJj1lMYPGjDsE+7acTqKS9oEBmnJ7G8M7kfwgXMpU7EKgJ2LlqcG:VYaKo8jPujwn9827oWL1+s+4rK/WGn
TLSH
T14EA3591E26EC0229F1F2BA50D9B023315BB5BC56EDBDD95C01CA498D04F2A41A5A37FF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Korean.ini

SHA256 a91cddab2212ea73f2b2835ef8096017ffe7424561f994f471e841dfe98ce075
MD5 ff3faf1d6b567e82d13c056d2ef54efb
SHA1 c6737fa5be04bacc51f7eeb8e8daeddc67b468bf
SHA512 63569ea3e3e73b6f9270a943a2ba10972b0862258c24bc26d8f25b2af000245f675e1b5ea46d7a14465ef78a9010004f2a403ed1c0928f44518aeaa2f8d41ff0
SSDEEP 768:Rk3lLeO5uckaLicJRtCnu+aOpjAYGYaUyFgvcsYXl2HTUqvpaOWcOSlHyJao9+09:K4j07JPgu+aOl/GPkrVWQlHFDVE
TLSH
T18A831E3F5059962662B0E349D3C20777E3656013B94E2C4982CB6EC916E2B52BEC37DF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Lithuanian.ini

SHA256 077927cfa0244385b6e7c005a469e17a5ea7289bc7ccc4371dbf49a3d4073480
MD5 ba8069690c7725ef5bff873cf7beef13
SHA1 a12cf7141df9085d730a9ea24b51e04885354720
SHA512 309ab27fceef531a3896bece3856641d035a61b25a393ef44163a1a72243a2b02c306b4359982b1f9abfba134806ce0a6d18a3ec8e4fbcfd7f35d3865b6a48e2
SSDEEP 1536:RbPzA805JQOcVdMsgehq1L7oWL1vs+ebhi52NgCPes:ZzA805JQO8dMr8q1L53ebhi5ggCPes
TLSH
T15ED3CF2B66EC0229F2F37F50EAB402315B76BC56BD7CD65D11C1058D48F1A90D8B2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Malay.ini

SHA256 ba9a1bf3cb6ddd31abab7908800109335bab3332069fd75e135ccdbaa84f923c
MD5 d25dfc47da29b817cade26ab12051247
SHA1 0414b3a50d70c11b118893923ac32138f4c549e8
SHA512 1f32d1107fffd0869a5c8431196851e0e77e4e9e9fc1d8f4a776e6bc68a111f994c2188c6cf5b4360194bfc0607fdb3479edc91d40f428b9befb11116947e78c
SSDEEP 3072:vFViq1QnBhc+bNlh/OTQpZKyT6sCcIgo4Te0QWFw1zFQ8zKFf8Zqv/Sds3zPkyJX:32
TLSH
T1AAC3CFAA62EC5119FAF35B00EAF412B15F67BC93BD3C851C12C119595CF4AC09C62BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Norsk.ini

SHA256 beaa1a667e56aefb3b7f865b505d07c5b4622d3e9a83bab8165ebe280a798cdb
MD5 5c68919361600debb71c13d9a974dea4
SHA1 28b008b6b12ff70e7ee3abd0856e9e9921094544
SHA512 b4ec0566184acca9b2d03431a32e97124aeb2ad411f60bd83d3cc13ac7d791810bf47414e272a1f5aa8a424263614e76a16a7c88e2c5c8834a285f0b54569168
SSDEEP 3072:J6dv8xhj/hRc3wyV/2t1dzP6pg3Fz+qhmqXwxeX+QhpP0hF4EGqPkOorukhPlYUk:E3
TLSH
T14DC3C02667E9521AF2F36B10FDB802715775BCA6BD3CD61C02C1058C09F1AA1D5B2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Polish.ini

SHA256 48800d9e337c0c75135eafda27dc42905ad25bf8800c39bf1e604af8761a2993
MD5 f19a039f9b432246be78b3c4dbb84ce8
SHA1 cdf962b0b4f347d5777b810c0eccee9daf027eec
SHA512 9329c9fb6c07aad11013b689a4cd278299362a2e0336b203ee225d97599e824926571d5f55d0d7f92387c89d5d0bc4b65d00c4cc0e781330dc39ca7f621223d7
SSDEEP 768:RssFcEfu65jGiSBPmacaXcBddTfuzDbjhnYAJf76thr6/P6eK4N0zCVC1pcuTgKh:xh1brTfuz/sL6m4UE9axnK+TFW1o
TLSH
T1A2D35B1622F81215F6F7AF41E9F526B59F7B7C23B93CC1DE20C002490AF1A919552BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Portuguese(Brazil).ini

SHA256 6ed56191d65ad8d6f60143056a8ad2b25115e870a7cb5c435210292179161320
MD5 8f1800344838f7473e7521c38c415fa7
SHA1 9ae31fe6b97ae5170aa151d3464e288001f12613
SHA512 e7f1267eb56d7e4cc50bd07c9c5523986ef5d04dd4f5c472bb9d8cbe6fed6df29644465f3ff4582d0d8d0e3e9cb4b61226f5af4f3fb1419b26e78baf930ee007
SSDEEP 768:OCJIRm3EgoA/hp+9PpHOobaciucUlxHcgv3hfqPZRNsRAuSe+JMUQ3oo16ajNjTS:QEciuj8gssn+JMUfFaAeRczm0OAwdap
TLSH
T16FD39A2A67FC0319F6F3BF05D6B826225A777C92AD7CD50C009116990DF1F40D8AA7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Portuguese(Portugal).ini

SHA256 1763bfd2c1f0aec3a438ffbd26bc5c453c4b021b37aa48a21d899d8bc34a8506
MD5 254d8058fec338208a9e595016e0c098
SHA1 b8831571f96a265c8339fe3cc34b491e630de872
SHA512 4ee2cf4b8d54cc642cfc034564d61a716bbee2e82cd0fc3be910997a50dc76ab8d3f66a0aaafeab2b8d721af030f980333e09fd2e3bffd842b274d29aa92b51b
SSDEEP 1536:xwsBhjtvUWGr98PAXXfda8cruvYMIf9U9KTgQp:rhjtvUZ81Ws
TLSH
T1D8E37A2657FD0319F6F3BF16D5B816325E3BB892AC3C861D0091169A0DF1F409C6A7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Romanian.ini

SHA256 de051fc245b5035fa3e1d3ed641eb10d3ad5609a8eb31b0f00860e117ae3db65
MD5 94b948389e4302e742536c189eedf850
SHA1 b5b93ed04600cd40e9b483d676cf49d1762064a0
SHA512 8f09ee633f6e24db751a11d8d7a5800339e3aeb1cd9206b3dc263fc3718165735e0b213dd65692457aac3cfb4ffd4137ab9fb2256332aa4993e581e5052b12d1
SSDEEP 768:OtsZMYIKvVJBc7Pq1uOQ6QxyNWYV4teT/06WGdILiT9IuWkbQ5qohNv3ZMZkvFil:tzRUPf2VrTxr9WjL7oWL1vs+5uToucoP
TLSH
T121D3BD6A67EC0229F2F37F10E97416355B767D67ED7CD60D01C1058D0AF2E8098A2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Russian.ini

SHA256 5cc70e045aff2bf86930d6600ffe833cafeb4055ebc81496ded0ed96fad39e13
MD5 216ffa5d0312c65e4435ca29b96e71a7
SHA1 58f70cc4432c9dc5ac63604e00fc56c1d23e4493
SHA512 c902185611fc9c09e4eb23cb4187589c950ed687b3f4be5069f6643847b5238ee9305318cab684b1a11efb2a3dc12d16cd51e7600304e1d895753863ceb59f04
SSDEEP 3072:lnrzxvCPUgryNNw9dY9FXUlFDTbt5cPKVjnOU1JJBbFtNIozr:lnrzxvCPUgryNNw9dY9FXUlFDTbt5cPI
TLSH
T1E2C3255FF97C922165A4D2508B428AE322F9B314372D59C996CF3EA8A0DC27533136DF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Serbian(cyrl).ini

SHA256 1cf01457900d50d97d82651a9aecc10362801f9e3aa2ebf84c08329165e59721
MD5 64af858d250eb924eeb582f654c92ef6
SHA1 542878e457a87d22b90adc5adafcc31655f88f6e
SHA512 f1b6590afca3d4ec835c26fa61a7c6851005f11e95351a1c86c766b5a9f491f43d0bdc6d9b88b4c70b66a557ba82bde6c5c3dabbd416422e4efd5c1cf51c2f82
SSDEEP 3072:PfT7E3SbKsCgXAOeD2wJ3XBYTJflNhCYolTBR2QkAxFhdMr8q1L53HXWiFN8Pes:PfT7E3SbKsCgXAOeD2wJ3XBYTJflNhCj
TLSH
T12EC3051FB6FC0214F2F2BB50DA7542B116B97D51BA3CD54D01CB288D04E5A70AAA27EF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/SimpChinese.ini

SHA256 60c5077c42a97791eac20be6589ace7e2043acfab4d31fea73bfeeef89bf87d6
MD5 4642a5f5b9c10d50c160d81b24dbc42c
SHA1 8e63cbceec6fcb965aaee7ddbc872c92f43c6ae6
SHA512 1dfbe23b0cdbb8f389fa958a9a166ff0b1d9cbc50962b0bdf489f5bc3dca98da21e77bb1f3af490d967d72799c06081412f82584d6d683629408765521e36192
SSDEEP 768:OW5eMtGsuMj5q6eK87SIQuDQtMh3NAuzw/bfBJGZ7jpvnXeRd+nj60KXppCg9R+U:tHy6eK87370Mh3+uCDU7jq+j6FXvJlB
TLSH
T1A753DB3E0B8942B643B4C664D1C00B27F7F4A55BB79C6D0698CF4EC545E5A8234CBAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Slovak.ini

SHA256 7a26f53b496c386413e34e233c42809f189ff0c4f37bcb0b8db088975eee4b6d
MD5 bf535fd0db0b063b594f2f1681902add
SHA1 bf02aa9621b2e46740a09c426cf131749bcfd331
SHA512 3723b2786c60b07e4b26aec3d29c2470d525c42b69a40b5764c39a72c34d38b01890707c6f815a514b296d0f1f7ac174f1cd25c28623f9a4945b655f4de19cf8
SSDEEP 3072:IPMeKLn7OZZUrdmj4ah60PBqHYAKN53Eo3xPheGlyiUtAqx:usTT
TLSH
T122C3B02722FD0255F2F7BF50E9B402715B7A7CA6BE3CD50D11C1468D09F1A8099A2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Slovenian.ini

SHA256 f93749ab02d8b7387453f69ce1b30116e73b91afa237c317d3680db7a4a899bd
MD5 7d1b09a511e11bfeb3f1f02f8fd2e0f1
SHA1 3a5b5c567efbbc0aef65c19c8554d0e77a8930cb
SHA512 e8fbadbe4ee06598318fe6323dfc619b4709b6f42bd3422075515c6f24e2e0bf26a1e2fe969260b27bb71b48bb7aa9d47712dd2b063b59b3664d6de63196a044
SSDEEP 3072:yXWtkR4aCIosvv73YBrBPSTnZRy6xV8ndCUNYrRmyuO9i+v3opTlukb5rEj:ey6DN
TLSH
T194D3B21B62F8135AF9F7BB00EAF406709B7A7DA1B93CC51D10D1068D09E26C195E27BB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Spanish.ini

SHA256 1e59c78ff3251ddfe461d51326709d45773e837cb57c7172667819ba9cfc5948
MD5 752a1caa11571f97e786a37a8563a129
SHA1 5e008ef272be2b2c311d33b2afbc6b37f556116b
SHA512 9c318683b9627e4b9c3b0e9e3c635a3242551c924485e20d0273b0b0a2f0bc6e9b518fcae86dba808e4bad59fce2c0ceb8bb08e0aaf20b314c0afaa20ee2b637
SSDEEP 768:OBnS9mtvKD4TaboeM06toTdCdpNOah7VNBpr3BtLWdDfkkG/jSSO1TtlzTenAK9h:Rk0MSCxlh7VNzuf155u80bbt
TLSH
T10FE39B1617FD521AF2F3BB04EA7816259E7ABC92EC3C950C0191159E0CF1F409DA6BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Swedish.ini

SHA256 b811837473e70cfd7240681ed322d53f341ea71901f81967f8950b47ec1cb534
MD5 044dcab2b039a598dc4ce018893f1f59
SHA1 19e8fea3054fe7c587532992c90b66872d44a6f7
SHA512 36dc9ff13bd5097bf2c2b945bc14aae091dd0c2ed166ec096fd2e6e6aa4fa312ae441ffc4190f4bcaab2c26b250c5c9a03ef697ed1fb98214f99f5cc92d5eabb
SSDEEP 3072:Yf1nmDSaq07rs9wJhh0nW4HrAbiwhymOATBv0OwKTStp2k6W8S+S55AmapYtayCq:w9
TLSH
T1EFC3AA2663EC4229F2F3BB54FDB406315A75BCA6BD7DD61C01C1058D09F1A9098E2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Thai.ini

SHA256 7d5edf912749570faad5eeca2681a501d318a185e3164423d56cecb6a59a2bcd
MD5 bb68e0e019e554569226e6f96be5a361
SHA1 75c17210f82abb335aa278cce2f4732a2babf090
SHA512 bb5386895735fd1eab5dd11aba2247d784920bd6f8cc5c1e9c114163aa1b3978d4979cedcb00e532dbd90a58dcbd84261a862fc8381465db6cef76f3d7c430da
SSDEEP 1536:84Pt+9fGcG1bsQnfC5CzQQtX1dMsgehq1L7oWL1vs+M8+6drijP62WuQPPes:MCfnHpdMr8q1L53ZhipWuQPPes
TLSH
T1B4C3132A52FC1215F2F67AD4FAB407356F39BC56EC7ED50C40C2864D09E1A5098B2BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/TradChinese.ini

SHA256 f75b078f02414f51835a51bed44791f59a2f9e85294c7e85a6ecf743f8c9a9c8
MD5 30f511943d009e8d042e79ef9d3ead1b
SHA1 c2d509f24682b730fb1f7f77c02ddf47637a1133
SHA512 c75e8804d4f62a1ce30a8a63a3b6fd039d474d3f797b9ef897ac1a2da93a4f6cb809cfc9503bdabdb42b31b9c4c27fe96093fade15e00e0899a95152d2c281cb
SSDEEP 768:RN4YT6fIir7aCvTTOG4YQ0s5CNzS0oHcYDzjDd6URTaXVIzCCUECZdIMf1JfOGSD:c44TOGynkoHLHM1p91fgD
TLSH
T15163443E1A89023787F5C548D2D00722B7B42557774C5E96A9CF4FC442EAAC234DBAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Turkish.ini

SHA256 7602c6ea234119e628873fb700fcf4e206108d0d15e3f192101f53a07d7d730f
MD5 5600a57abbe4ca7eceaaf3126455b00a
SHA1 c64abe9ee1d93d6eb72d6be27a8335aab72b8ebe
SHA512 5116e3828f0d67f8a19b19fd24045784b16a508d2cb8aa3d9c95864e28834ce0096bf92132b9672d4cd5ae651d444ece5a7c4a1f6873ae3dda6a5eba528f2091
SSDEEP 3072:JAFvluFOBDYme77KYTIUUipNngHr0Zkk+sz3DSLF5qtMokBtGbr/8JphWWMipdLQ:RBU0nwqt/+4yg
TLSH
T19CD3C31643EC0216FAF35F05FDF422625BB63DB2BD3C965E26C2059808F1690D466BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Ukrainian.ini

SHA256 1be4ad42a64fcd33286e2e1fe3d8dbecca51f9bce79ad73c9cbe700bfc6a7b91
MD5 f5cf9e092a18cfd855783fef427b325b
SHA1 7051e66c1b7f335f418fd7967d5d432a0f772d59
SHA512 56421a2d526166a0c319bcc5daed21d677c2282c32c0f7505e862fa745e1e1ea396b6794b213bad5d4b4d1417c80798f6c942f48be0338fb3d4201ad150da04c
SSDEEP 3072:dnENYjnuGnGCXQf4kqfdyZNmNjy2XALSzNvii8rVqTYZgd6mnd+1DWlIDK:dnENYjnjXQf4kqfdyZNmNjyuALSzNviE
TLSH
T142C3585FFD7C92255A94D250CB8146E722F8B304279D99C4A2CF3EA460E92793317ACF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Urdu(Pakistan).ini

SHA256 92bd110187280525f9b5ee5acea21dca6eecfb7c6b86fe804d890c1549aeca3c
MD5 73b85532c02fb3f54ae48cf1a0894550
SHA1 cec9b1d0e3cdbb266de84b6c4ddb409c6753e0a3
SHA512 4c6dd72603f91b690c987f5fe071ce9b20e14b628627deccd4e04b940d32ddcf7e7cba1ed108a5af0774e2b93ad67a9bb8987b61100bb5a3fa821ce5211f26b2
SSDEEP 768:OpBJGV8mgMSf8Ux4Tvs5cM7aedqKMZkvFikNJ7G8M7kfwgXMpU7EKgJ2Llqcm43V:+GBSfl4Q7PqKL7oWL1vs+wnOyP512
TLSH
T150C3361656E8C138F2F37B14DAB586335B357C92ACFCD92C05C2059D09E1A9098E7BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/Vietnamese.ini

SHA256 42fe370fbd64ab540809a96a78d1c97b6f0c33399f0177dcedc356ded1b8cca5
MD5 3ed2061769961be41774ea82a9b70b08
SHA1 9e7e0682ebda3177e2922923c4f10272401fdefc
SHA512 c9ebba7bfa32eab21ed4adaf704add255033334b6013e66238a40025aeeb56463f8e5b02c978bf94a8635d907f29cd0a779c883b0bf50b9b711ba5e6a5267ebf
SSDEEP 3072:CvpSXHvH39c+9bMr8q1L53DbGi1ShHsCOLGSpPes:vNbm
TLSH
T1DDC31826D6EF4119F2F37B10D97412315B79BC96F87EE60D41D2098D09E1A40ACA3BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/croatian.ini

SHA256 f579463b088b61e252f8fa1d03603fa4921a9269a976bf722944424885847c42
MD5 23068bc976848e564d8c7a234b8d2e80
SHA1 98c630d15df02de8286604d4bb28253c310985bf
SHA512 55eda9d3bd9c011439f967648cb394a3a8a17eb571ae194a8a1d8c2b10143bd7f36043340852d92e492b0929b37417652355f59290766123b323e341fc2be526
SSDEEP 1536:JbVhtsx4R+ullnuOW67oWL1vs+ARf+/R4:JbVhto4RNlG653ARfB
TLSH
T1FCC39E2763FD1219F6F7BB10EAB413315B7A7C66BD3CD51D10C1068D09F2A8099A27AB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/czech.ini

SHA256 c62004e4a5b9dcec799ef2d6be72bdf64deeb0cb01d3d8f4350fd1b3822cf5e0
MD5 6bf508ae1519a7c0c5250c7b5fffa0f7
SHA1 0f3d26f5633d4d2ff28d22cb855d3a5ff259b9a6
SHA512 c46f4a9df9fdc196a66495c96cdf58d6275b54cfd40e8fc456b32f8798c39d5038dfa64db4e973c6273b96fce6e29444fb62e075190a35887d68d25c7b22324f
SSDEEP 3072:yyrMC55awVYQnQTEJMfzoguzQ3WAHY8dstWy9AtyuyPx3lj:BIm
TLSH
T1CCD3A21612FC0255F2F7AF55E9B407729A773CA2BE3CD50E41C1468919F1AC0E4E2BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/danish.ini

SHA256 8681abfeeb13912a7179772f9d1a3e0c41d5e21e0b9514f72f28513845a6bdea
MD5 a65a764011dfeda1a44c54a0c4ff6dea
SHA1 06d85fc6adc3fdc734416a81333ce2eb62384e15
SHA512 9bf763dfa049f2c0da3615dfe6bb31f340dfc8035fa24ba364d6c6cd144d607d77c06a17a3309fb97ed5eb2ea31666894df477e9000405b50200a2955d3a04fe
SSDEEP 3072:lJI/hOWvuPw1vF4HuUDihOItIiGmbjAGQ7EoPRDBUYUdeJV+ICo72fVI5L53exxO:tYS
TLSH
T19BC38C2763EC4229F2F77B50EDB502715B76BC96ED7CD61C01C1058D09F2A9098A2BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Lang/kazakh.ini

SHA256 496d9a7e03dc27fd38b4d4fd6de49812cba710724af02895f565a5305e9181c3
MD5 45b60866efa859c5abc5a9fa1661503f
SHA1 feaa21ee6f26c56b888d1326baa288624c8dc919
SHA512 759f77911aa1a0fc4b18e3949cbc58d61a101faac0b335a5ed081becdd64e9f1d441860d76630371429304ece1122c5480359dafaa94509d6d3fccb3634ff103
SSDEEP 3072:vK9osnUPGKS9Q1qzQIfQGxtmURMjGWk7tHJyeHRGZYIwBrtGC0FB5FHo+QXw015Q:vK9osnUPGKS9Q1qzQIfQGxtmURMjGWkW
TLSH
T1D1C38A0FB6F84215F1F5FB40D9B002E21AF9BA05BB7C959C54C7294C04E5A30AA627EF
MD5 SHA1 SHA512 SSDEEP TLSH

devcon.exe

IMPHASH 24129f939da41cc56515e833be608d60
SHA256 8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42
MD5 9d199564b65a91a531b23844649459e9
SHA1 8d84359ced1c51d14e70cb5ed36a6083c8b914cf
SHA512 ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1
SSDEEP 768:Ubrbmi0iAETVvlXjkQnr65WTHBAtgYSofgevxHs4gZWk:ab70GdXoQr65WDBAtgYSoflxHeW
TLSH
T1AB63DB0263E94608F1F7BB306AB552619E767C849F38C6CE018485291FF3ED0DD79BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

30400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\devcon\objfre_wnet_AMD64\amd64\devcon.pdb

msvcrt

__set_app_type _fmode _commode __setusermatherr _initterm __wgetmainargs _wcmdln exit _cexit _exit _c_exit _XcptFilter __C_specific_handler memset wprintf __argc __wargv _itow wcsrchr _wcsicmp _wcsnicmp iswalpha towupper towlower wcschr ??2@YAPEAX_K@Z ??3@YAXPEAX@Z _iob fputs fputws

advapi32

RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW RegDeleteValueW CloseServiceHandle OpenServiceW OpenSCManagerW RegSetValueExW

kernel32

GetFullPathNameW GetFileAttributesW LoadLibraryW GetProcAddress FreeLibrary lstrcpynW FileTimeToSystemTime GetTickCount lstrcpyW lstrlenW GetLastError GetCurrentProcess CloseHandle FormatMessageW LocalFree GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter GetStartupInfoW GetDateFormatW

user32

LoadStringW CharNextW ExitWindowsEx CharPrevW

setupapi

CM_Get_Res_Des_Data_Size_Ex CM_Free_Res_Des_Handle CM_Get_Next_Res_Des_Ex CM_Free_Log_Conf_Handle CM_Get_First_Log_Conf_Ex SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW SetupDiOpenDevRegKey SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiSetDeviceInstallParamsW SetupDiGetDeviceInstallParamsW SetupCloseFileQueue SetupScanFileQueueW SetupDiCallClassInstaller SetupOpenFileQueue SetupDiSetSelectedDriverW SetupDiGetDriverInstallParamsW SetupDiOpenClassRegKeyExW SetupDiGetClassDescriptionExW SetupDiClassNameFromGuidExW SetupDiBuildClassInfoListExW SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiGetINFClassW CM_Disconnect_Machine CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW CM_Connect_MachineW CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex SetupDiClassGuidsFromNameExW SetupDiCreateDeviceInfoListExW SetupDiGetClassDevsExW SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList CM_Get_Device_ID_ExW SetupDiEnumDeviceInfo SetupDiGetDeviceInfoListDetailW

setup64.exe

IMPHASH f40095f40192b72a4724ee8f537ca1d9
SHA256 1f56046a9fa1417f6a0592bcba0e2a9699878461305caba93f04f14c9db8af60
MD5 7d48a676e9f414f0a3c78f8d4a30d3db
SHA1 58dc4271ca843325263c12b4cff7cb09a32a9fb3
SHA512 04e1955b0620daef04dd71db6a17529a7792d9ca0162f1c8d72f635cfdfc5b22b62d9d5b344db5d1ffa838ac0e78b7d3e08c7b342cf6b55d79417c3ba066953c
SSDEEP 192:qITwtvHiBYm2HW5wDV7YyxMiBNCzfMQZ0bI8KmMwUani64m/BX9n:zTwBHiBYcYV7GzkXhKmMwUaym/BX9n
TLSH
T16C322AD28E2C94E3E9868E30D1D66417BD7379C8179D60E7A160D0516AC63E07EBF13E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ea:05:53:36:f9:3f:2e:4a:dc:d0:c3:70:57:62:b3:cc:af:4f:c8:b8:8c:21:81:bc:9c:fe:de:0d:b5:b2:6a:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Power Software Limited,O=Power Software Limited,L=Sheung Wan,C=HK

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=Power Software Limited,O=Power Software Limited,L=Sheung Wan,C=HK

Serial Number

7a:8e:68:d1:6b:ec:2b:37:75:57:2b:78:c1:db:39:10

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 23, 2026 - Feb 22, 2029

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

2

Major OS version

5

Entry point

4400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\setup64\objfre_wnet_AMD64\amd64\setup64.pdb

Sharing

General

Malware Config

Signatures

File Explorer

PowerISO9-x64.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$0

PE Signature issue

ntoskrnl.exe

generic

$PLUGINSDIR/modern-header.bmp

$R0

msvcrt

advapi32

kernel32

user32

setupapi

generic

Lang/Arabic.ini

Lang/Armenian.ini

Lang/Azerbaijani.ini

Lang/Belarusian.ini

Lang/Bosnian.ini

Lang/Bulgarian.ini

Lang/Burmese.ini

Lang/Dutch.ini

Lang/English.ini

Lang/Farsi.ini

Lang/Finnish.ini

Lang/French.ini

Lang/German.ini

Lang/Greek.ini

Lang/Hungarian.ini

Lang/Indonesian.ini

Lang/Italian.ini

Lang/Japanese.ini

Lang/Korean.ini

Lang/Lithuanian.ini

Lang/Malay.ini

Lang/Norsk.ini

Lang/Polish.ini

Lang/Portuguese(Brazil).ini

Lang/Portuguese(Portugal).ini

Lang/Romanian.ini

Lang/Russian.ini

Lang/Serbian(cyrl).ini

Lang/SimpChinese.ini

Lang/Slovak.ini

Lang/Slovenian.ini

Lang/Spanish.ini

Lang/Swedish.ini

Lang/Thai.ini

Lang/TradChinese.ini

Lang/Turkish.ini

Lang/Ukrainian.ini

Lang/Urdu(Pakistan).ini

Lang/Vietnamese.ini

Lang/croatian.ini

Lang/czech.ini

Lang/danish.ini

Lang/kazakh.ini

devcon.exe

msvcrt

advapi32

kernel32

user32

setupapi

generic

setup64.exe

PE Signature issue

kernel32