Everything-1[.]4[.]1[.]1032[.]x64[.]en-US-Setup[.]exe

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

Everything-1.4.1.1032.x64.en-US-Setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 97b057cb3211192f0c821e0a7bf602c6b6a4173f7595a22d6174c03d2b4d301f
MD5 f0e09ccc72b854dcf49a0f03d4cb0085
SHA1 2fcf873062cb47d0007055682906e5f8857284d3
SHA512 c284fd781bda70129213c6cf476ba0027840b97a5845e3067d4618eaf0369b6f494ea0a4fef72b9c37aa6b01ef7a559d70fc58e8bb52511c5f0912f5130a4fac
SSDEEP 24576:/Y2e5c0MVsTSG9cAbeGvVrIQ0VEnqr98kAUU:A23s7X/90SnMWT
TLSH
T199052245D784C3ABD8195131E4EE5A968BA2AC3421525BC3364B7FBD7A33783EDC6302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

be:61:de:12:84:1f:6b:75:f9:90:13:fc:e3:f1:db:3c:d0:05:11:2e:3c:b7:79:d9:24:f4:97:a6:ec:33:83:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/Everything/Changes.txt

SHA256 8e279763ef89aae7073e29584e65ac05e410a45d2a8ea5ed1b3a160f70715924
MD5 53bc97c0960b27622ec771a23f49cf35
SHA1 ee80243449d17d3421d303cf7bd31b799839cd0b
SHA512 9068e7513aefa05c00b2f6debe20ceabe596b17bc7346bf39f4a4cb6bd9352afbe739719899678c06ce92270b77d5462fe6f31e2b159cbad9f46b9f1ceb17800
SSDEEP 384:coV2dVpOQCtRjkp+cF1W2WLg4xGJ4UytZpjMUFQQ5NverB35+:SVpO5FkocF5V48J4UytZpj1FPBkB35+
TLSH
T13992F05B792F72112AC3A1682D7AA151AAE9427C6303A24C097DC0EC320557EDFFF9DD
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/Everything/Uninstall.exe.nsis

SHA256 6b8ced4b7c7e49dd25fb87f726a01da0519128ad8dd8f86707fd1f046e349673
MD5 d783cb39634ed32ad7191ecfc3b4b89c
SHA1 2f34b2a7eba3cf6aa30542991655b6b7c9d358bc
SHA512 75331d35723c701efa33af1b80a6290980b8a26bb75576a962657724b82d069124c707c7407d05d003107602306e4499e0fc64da7208d447736bc81b2b7718c5
SSDEEP 384:m8CK/HN/Xua+/KjWJLtJfS6T2TIGVOZ0AMDr603TPvLcB:m8zVPjWJJrPGVQrer3LO
TLSH
T11982C046C40A7B47C9057C5858A74D174DC3AB06FAF9D9EE752BCE08648FCAA9E4013F
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/Everything/everything.exe

IMPHASH 66c76b088c44e7dc1b88a25f82913490
SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
MD5 464df9e59802fb4d6f4a0c743a5ded94
SHA1 2aaa17b0aceb7d017c47ea0110de97e29d920ace
SHA512 b95bba8a61f316d30d031ca2ad2307b2a42c89afb1f96edb03231a50120dd33700ee221e010b81242aee4427ac26c3d203c86562f0bdfa1b7662b9cd367768ec
SSDEEP 49152:/ota7/dTkNnVxSOEad3Gw6ffub5ro1FcyPiPRr4rAF:/oCGnF3l6uUmsW
TLSH
T15AB57E43933500E9E9ABC03689569623E7B1F4144732A7EF5690EEB12F237F15A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

10:65:82:b1:61:15:cd:98:9a:19:90:57:8d:7a:db:b4:8f:89:af:24:6a:d9:fd:18:a0:ec:ff:8e:97:29:cd:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

Jan 23, 2026

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=624 373 397,CN=voidtools PTY LTD,O=voidtools PTY LTD,L=Wilmington,ST=South Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Serial Number

04:4c:41:86:39:d4:52:74:47:0b:f1:a5:fa:de:a0:18

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 20, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1749728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\dev\Everything-1.4\x64\Release\Everything.pdb

comctl32

ImageList_GetIconSize ImageList_DrawEx _TrackMouseEvent InitCommonControlsEx

ws2_32

WSAGetLastError WSACleanup closesocket send recv connect WSAAsyncSelect setsockopt socket WSAStartup shutdown listen bind getpeername ntohs getsockname accept inet_addr gethostbyname htons

shlwapi

SHRegGetUSValueW PathIsRootW PathCombineW PathRemoveFileSpecW

kernel32

FileTimeToSystemTime GetSystemTime FreeResource LockResource LoadResource SizeofResource FindResourceW GetSystemDefaultLangID CopyFileW TerminateProcess OpenProcess CreateMutexW SetLastError GetStartupInfoW HeapAlloc GetProcessHeap HeapFree VirtualAlloc VirtualFree QueryDosDeviceW SetErrorMode DeleteFileW RemoveDirectoryW MoveFileW MoveFileExW CreateDirectoryW GetFileAttributesW GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetComputerNameW GetVolumeInformationW GetDiskFreeSpaceW GetFullPathNameW GetFileSize FindFirstFileW FindNextFileW GetDriveTypeW GetThreadPriority CreateEventW GetProcAddress FreeLibrary LoadLibraryExW SetFilePointer GetWindowsDirectoryW GetCurrentDirectoryW GetFileAttributesExW LocalFileTimeToFileTime SystemTimeToFileTime FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime __C_specific_handler WaitForMultipleObjects GetSystemDirectoryW ExpandEnvironmentStringsW GetSystemInfo GetVersionExA LocalFree LocalAlloc ConnectNamedPipe CreateNamedPipeW GetTimeZoneInformation MulDiv LoadLibraryA GetTimeFormatW GetNumberFormatW GetDateFormatW MultiByteToWideChar HeapCreate HeapSetInformation GetModuleFileNameA FlsAlloc TlsSetValue FlsFree TlsFree FlsSetValue FlsGetValue GetModuleHandleA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetStartupInfoA GetCommandLineA CreateThread ExitThread GetTempPathW CreateFileW FreeConsole AllocConsole SetStdHandle SetConsoleScreenBufferSize ExitProcess QueryPerformanceFrequency QueryPerformanceCounter WriteFile FlushFileBuffers GetStdHandle GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW GetLocaleInfoW GetCalendarInfoW DeviceIoControl GetOverlappedResult ResetEvent Sleep FindNextChangeNotification FindFirstChangeNotificationW GetFileInformationByHandle GetLocalTime FindCloseChangeNotification FindClose GetSystemTimeAsFileTime GetCurrentThread SetThreadPriority InitializeCriticalSection WaitForSingleObject DeleteCriticalSection EnterCriticalSection GetTickCount LeaveCriticalSection SetEvent GetCommandLineW GetCurrentThreadId GetModuleHandleW ReadFile GetLastError CloseHandle WideCharToMultiByte GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetCurrentProcessId HeapReAlloc LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize GetModuleFileNameW

user32

IsWindowVisible SetCursor SetCapture ChangeClipboardChain DrawEdge DrawFrameControl EqualRect GetSubMenu GetMenu SetClipboardViewer EnumWindows ActivateKeyboardLayout LoadIconW IsDlgButtonChecked SetScrollInfo UpdateWindow ScrollWindowEx SetDlgItemInt GetMenuState RemoveMenu GetMenuItemID GetMenuDefaultItem EnableMenuItem AdjustWindowRect GetSysColorBrush OffsetRect InvalidateRgn MessageBeep SetCursorPos GetDlgItemInt GetDlgCtrlID SendDlgItemMessageW GetDesktopWindow ValidateRect CharLowerW CharUpperW CreateIconIndirect PostQuitMessage GetLastActivePopup IsClipboardFormatAvailable GetForegroundWindow AttachThreadInput SetActiveWindow BringWindowToTop EnumChildWindows CheckDlgButton GetMenuItemInfoW GetKeyboardLayoutList LoadCursorW CreateDialogIndirectParamW InvalidateRect ClientToScreen ScreenToClient ShowWindow IsIconic GetWindowPlacement IsZoomed GetWindowTextLengthW GetWindowTextW GetParent CopyRect EmptyClipboard SetClipboardData GetWindowLongPtrW SetWindowLongPtrW SetFocus PtInRect FindWindowW InsertMenuW SetDlgItemTextW SetForegroundWindow BeginPaint EndPaint OpenClipboard GetClipboardData CloseClipboard FillRect CreateWindowExW GetClassInfoExW RegisterClassExW IsWindowEnabled GetAsyncKeyState GetClientRect GetCapture OpenIcon ReleaseCapture GetFocus GetNextDlgTabItem EnableWindow SetWindowPos SetWindowTextW SetWindowLongW MessageBoxW DialogBoxIndirectParamW DrawTextW GetMenuItemCount CreatePopupMenu AppendMenuW DeleteMenu SetMenuItemInfoW GetWindowLongW AdjustWindowRectEx CallWindowProcW GetDlgItem GetWindowRect MapWindowPoints IntersectRect GetMonitorInfoW SystemParametersInfoW GetDC ReleaseDC SetWindowsHookExW PeekMessageW WaitMessage SetMenu RegisterClipboardFormatW RedrawWindow GetMessagePos RegisterWindowMessageA ReplyMessage GetCursorPos CreateMenu SetMenuDefaultItem TrackPopupMenu DestroyMenu KillTimer GetDoubleClickTime RegisterHotKey GetKeyState UnregisterHotKey PostThreadMessageW GetSysColor EndDialog PostMessageW DestroyIcon SetTimer DestroyWindow DefWindowProcW SendMessageTimeoutW GetWindowThreadProcessId IsWindow GetKeyNameTextW MapVirtualKeyExW GetKeyboardLayout LoadImageW UnhookWindowsHookEx CallNextHookEx GetClassNameW SendMessageW GetMessageW TranslateMessage DispatchMessageW GetSystemMetrics GetScrollInfo

gdi32

SetStretchBltMode GetDeviceCaps GetDIBits SelectClipRgn TextOutW GetTextAlign SetTextAlign CreateCompatibleBitmap OffsetClipRgn OffsetRgn CombineRgn GetDCOrgEx GetRandomRgn EnumFontFamiliesExW CreateCompatibleDC BitBlt StretchDIBits GetRegionData ExtCreateRegion GetObjectW CreateFontIndirectW GetStockObject GetNearestColor CreateSolidBrush CreateRectRgn CreateDIBSection GetCurrentObject ExcludeClipRect RectVisible GetTextExtentExPointW GetTextExtentPoint32W DeleteDC SetBkMode CreateBitmapIndirect CreatePatternBrush SetBrushOrgEx SetBkColor SetTextColor PatBlt SelectObject GetTextMetricsW StretchBlt DeleteObject

comdlg32

GetOpenFileNameW GetSaveFileNameW ChooseColorW CommDlgExtendedError

advapi32

RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService CloseServiceHandle RegOpenKeyA RegQueryValueW InitializeSecurityDescriptor SetSecurityDescriptorDacl QueryServiceConfigW RegDeleteValueW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegEnumKeyW RegCloseKey RegDeleteKeyW GetUserNameW RegisterEventSourceW ReportEventW DeregisterEventSource CreateServiceW StartServiceW OpenSCManagerW OpenServiceW ControlService SetServiceStatus

shell32

DragFinish DragAcceptFiles Shell_NotifyIconW SHBrowseForFolderW SHGetFileInfoW DragQueryFileW SHGetSpecialFolderLocation ord16 SHFileOperationW ShellExecuteExW SHGetDesktopFolder SHGetPathFromIDListW SHChangeNotify DragQueryPoint

ole32

CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop DoDragDrop RegisterDragDrop ReleaseStgMedium CreateBindCtx

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
TLSH
T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/InstallOptions.ini

SHA256 b520532ce65105e5414423491084a05eec67add6ca5fef67b56bb9866c07bb95
MD5 f4b7ea54a35fe41eb4abb5f9e53cd9dd
SHA1 34f28f80c6c1d5d5656d42eaa5ad1fd7794eb939
SHA512 5734c29dc499935171bfe45d7d7b667d11ae1dbda97dd8d72dfd65320e8194eb8daadd085c34749c01aa27dd3010102b0b7dbb3f0503e0279510683ec8f0668d
TLSH
T1BB01DDC8504193799870D446287F2DDEBB51643C39423CD4F2A154C3DFC9DE63DAC289
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/InstallOptions2.ini

SHA256 6003368f4183b166539c96b734c01595a9d1b1494c11f16aedefe8ad68e9cfa8
MD5 2d388f85f070760e18ec39c0df0980db
SHA1 39428de0b440531f7544b4ea5e7e21df32317815
SHA512 04b02c6954b87852471c0e5fe5ec32fe2b5a228390c0b03604250c60aa1e7dcfa0d92775ddf1bd45ca17c2ddd62788d151ebdd9af884dac64031a97ed4a4b3c1
TLSH
T1DF11B4959502913DBD30910139BF7AC16BA029242F011864F5E218C3DBD9CE76CBE1D9
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH