bdcamsetup[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UserInfo.dll

resource
bdcamsetup.exe
unpack001/$SYSDIR/vcomp90.dll
unpack001/$TEMP/BDMPEG1SETUP.EXE
unpack002/$SYSDIR/bdmjpeg.dll
unpack002/$SYSDIR/bdmjpeg64.dll
unpack002/$SYSDIR/bdmpega.acm
unpack002/$SYSDIR/bdmpega64.acm
unpack002/$SYSDIR/bdmpegv.dll
unpack002/$SYSDIR/bdmpegv64.dll
unpack002/$TEMP/bdfilters.dll
unpack002/bdfilters.dll
unpack002/bdfilters64.dll
unpack001/bdcam.dll
unpack001/bdcam.exe
unpack001/bdcam64.bin
unpack001/bdcam64.dll
unpack001/bdcamih.dll
unpack001/bdcap32.dll
unpack001/bdcap64.dll
unpack001/bdfix.exe

bdcamsetup.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 d1fd4b2951d2f41c7ead3b8c72e6e4e632c89542c0e6d5b3d1f365be4d3b33fb
MD5 e52a5276e5fd8a42297713673baf65f2
SHA1 fd017acfc4d0d586fb5cab4167f7109596cff943
SHA512 96b8cb80bb4b3e85bee6748b7f4ddf686f04b860d62aed2b69f57f30776af52e1dc37fd803abb11ed02370c9655fe3d8dd767e801a298f75eb3f8d1ae3955906
SSDEEP 196608:vUgkGCntdCNSQnd/ZxSsXBtDRs75Q1TFy1UX/snjGhibQxP0NxJLw:vfkGaun/dRs7e1ThPeuiU10NU
TLSH
T181A63309E3F9046AFDB5C33062B2CAC6DE74BF1C9538115EA7C0251E6892E44FF2569B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a0:5b:ed:01:f8:f2:3c:65:50:01:a2:ce:32:26:54:84

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
MD5 67d8f4d5acdb722e9cb7a99570b3ded1
SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
TLSH
T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
TLSH
T113E09A5739E99424F49AE51CFFF4857A9728744A185EC90EC5E24A0F88E83814127BEF
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-header.bmp

SHA256 2dab37667279917b1c41a7e9a73fd35276f3d353c2458d4706474a3b4ed967f6
MD5 2dc465612d3ff98a606a33ac42d70307
SHA1 ebebe7e2684dfb8cbc8f4a4246c45238118c4feb
SHA512 1985371ce2158d8078d1c2ab5ab7faad5e94cad5f8c1b2495a0c08f4082fc1cf93b11add5716eff0b793cded35abf3feddca3f1a3b157f50c9426570d4dc38b4
SSDEEP 384:e3KfXP6RYCbZGLDWS21pEKQUrllibdIphfNsTh4+dhvJCY2oZCQu6VUA0XgaCF:OOebZAWNpEcMbdsl8jIYiwYwF
TLSH
T183C2D6F92D6815DDFD6D2FB0354502441ECC8CD4F9F86E9B1AB6B919AA30B2016DC2CE
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3b44537d4a5a48e260846aec5b05c5ba1a1c9709f6c61f4c5705e9624e24e89a
MD5 c600296882d4d5f4c01aa8a7bb41a293
SHA1 c573ad3868d239672d105bf9c065615c1ddcbb92
SHA512 aad9720b133bce00798fab8cf8423b0853e2ea92b593d7fe9e844c5c93cc6efc5f380693c626a05ae4881b561e6d5648f69cf315f896c49c8f6003ff852f02d7
SSDEEP 768:ot89eNu8NdNKo+gv4dlXyUPBnmyRkynJ4sB:ot89NAEgMpB
TLSH
T149E34FFFA1C102CEDFE95875D8004205E9ACFE16AF6B744C65A774C942BC9E801AEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

$SYSDIR/vcomp90.dll

IMPHASH 718f76580a1c6ed142d2ebb3755ae79c
SHA256 9140efe26252b6329da254201219fc2d17a3f651e1591e32ae04c86a27e35bb2
MD5 cbf730a59a71b906517ba7c97528342a
SHA1 52d6c2955075e244385c483c3f3a0656f5eb0364
SHA512 17b58dd8b120bc2d6bf3b8eb1e3773ee9986b1f82a54f0ded0e23e3a8d6d02eddeea6275df684c0914fb36240519bf91801e7e631e799c86fbbb6c76786215f0
SSDEEP 768:WPSfLA354st0Ha5FvLgUz/g0f47TsvyVkpJL2jmPG3Ly/zYgb6FjXHUElc:WqjAca5F1vOqLSdu/36FrHUE
TLSH
T11B335B5075868275FCE632F486BEBCB646FCEACD033081E7138845E98D607E2997529E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c3:14:f4:bd:60:d0:4e:92:25:21:0e:11:4e:b1:98:a1:d8:cf:8c:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 19, 2011

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:b2:9b:00:00:00:00:00:15

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2011 - May 21, 2012

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

0

Major OS version

5

Entry point

23154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

vcomp90.i386.pdb

_vcomp_atomic_add_i1 _vcomp_atomic_add_i2 _vcomp_atomic_add_i4 _vcomp_atomic_add_i8 _vcomp_atomic_add_r4 _vcomp_atomic_add_r8 _vcomp_atomic_and_i1 _vcomp_atomic_and_i2 _vcomp_atomic_and_i4 _vcomp_atomic_and_i8 _vcomp_atomic_div_i1 _vcomp_atomic_div_i2 _vcomp_atomic_div_i4 _vcomp_atomic_div_i8 _vcomp_atomic_div_r4 _vcomp_atomic_div_r8 _vcomp_atomic_div_ui1 _vcomp_atomic_div_ui2 _vcomp_atomic_div_ui4 _vcomp_atomic_div_ui8 _vcomp_atomic_mul_i1 _vcomp_atomic_mul_i2 _vcomp_atomic_mul_i4 _vcomp_atomic_mul_i8 _vcomp_atomic_mul_r4 _vcomp_atomic_mul_r8 _vcomp_atomic_or_i1 _vcomp_atomic_or_i2 _vcomp_atomic_or_i4 _vcomp_atomic_or_i8 _vcomp_atomic_shl_i1 _vcomp_atomic_shl_i2 _vcomp_atomic_shl_i4 _vcomp_atomic_shl_i8 _vcomp_atomic_shr_i1 _vcomp_atomic_shr_i2 _vcomp_atomic_shr_i4 _vcomp_atomic_shr_i8 _vcomp_atomic_shr_ui1 _vcomp_atomic_shr_ui2 _vcomp_atomic_shr_ui4 _vcomp_atomic_shr_ui8 _vcomp_atomic_sub_i1 _vcomp_atomic_sub_i2 _vcomp_atomic_sub_i4 _vcomp_atomic_sub_i8 _vcomp_atomic_sub_r4 _vcomp_atomic_sub_r8 _vcomp_atomic_xor_i1 _vcomp_atomic_xor_i2 _vcomp_atomic_xor_i4 _vcomp_atomic_xor_i8 _vcomp_barrier _vcomp_copyprivate_broadcast _vcomp_copyprivate_receive _vcomp_enter_critsect _vcomp_flush _vcomp_for_dynamic_init _vcomp_for_dynamic_init_i8 _vcomp_for_dynamic_next _vcomp_for_dynamic_next_i8 _vcomp_for_static_end _vcomp_for_static_init _vcomp_for_static_init_i8 _vcomp_for_static_simple_init _vcomp_for_static_simple_init_i8 _vcomp_fork _vcomp_get_thread_num _vcomp_leave_critsect _vcomp_master_barrier _vcomp_master_begin _vcomp_master_end _vcomp_ordered_begin _vcomp_ordered_end _vcomp_ordered_loop_end _vcomp_reduction_i1 _vcomp_reduction_i2 _vcomp_reduction_i4 _vcomp_reduction_i8 _vcomp_reduction_r4 _vcomp_reduction_r8 _vcomp_reduction_u1 _vcomp_reduction_u2 _vcomp_reduction_u4 _vcomp_reduction_u8 _vcomp_sections_init _vcomp_sections_next _vcomp_set_num_threads _vcomp_single_begin _vcomp_single_end omp_destroy_lock omp_destroy_nest_lock omp_get_dynamic omp_get_max_threads omp_get_nested omp_get_num_procs omp_get_num_threads omp_get_thread_num omp_get_wtick omp_get_wtime omp_in_parallel omp_init_lock omp_init_nest_lock omp_set_dynamic omp_set_lock omp_set_nest_lock omp_set_nested omp_set_num_threads omp_test_lock omp_test_nest_lock omp_unset_lock omp_unset_nest_lock

$TEMP/BDMPEG1SETUP.EXE

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 d6127b8e6a4dd1a028291378260e3c5a85b79bb45351cf8ab279d00317b3a963
MD5 916bfd2422bca5b78d61a640f87c6295
SHA1 a16f097cddcf9513ca81c124a40c0537291c30e1
SHA512 e6e47704183730207b8770f3b8dd1f66acab285f74e4001d370fb73ec8c8ecda61af9df189714529b2a3c3425290bd200bf4e209061a3042a917b88bf1b0ad29
SSDEEP 24576:smJWXdFFVnnafzcUw7ygmn0dlB/B6Y8rMO5sT7uVwjEOIdXK/rDjtrE35jUjBX4V:s5XtVnuw+gioZR8EIJs/rDj+qj272kP
TLSH
T18365331069B0E4B9FCF39A34CA21C75E6A37DB412D6D438F9BC02ACD68116A53D153BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d6:63:b4:72:cb:76:65:3c:88:16:a6:16:8b:89:6b:4d

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
MD5 67d8f4d5acdb722e9cb7a99570b3ded1
SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
TLSH
T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
MD5 d16e06c5de8fb8213a0464568ed9852f
SHA1 d063690dc0d2c824f714acb5c4bcede3aa193f03
SHA512 60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a
TLSH
T10281577B23F44473D09A4BBB01E60CD752A2D9309316442F498B4D6E14C1AA7FD6EB17
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
TLSH
T113E09A5739E99424F49AE51CFFF4857A9728744A185EC90EC5E24A0F88E83814127BEF
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$SYSDIR/bdmjpeg.dll

IMPHASH 8950e1a0317525f0385b9af601337740
SHA256 6c331c0a88ae15dccb2f463391e1d40d4b48a921f330776108c4c9b97253a260
MD5 2fbd5126c7eecbad70090a37693ea51d
SHA1 6b6c5036c99bf7d30d25548c989e35dd6e4defed
SHA512 7b57082852e6522f0443c7d8c0b614d76598cf9521613208332f02343168c2981a7d407202de55c1d42d2c9e230837a10b89feb5cb7e545cb421722ea1f62d02
SSDEEP 384:Jc7pqz4KQ6moXX3WaHQ2HbOtjoPzDnYPLk10eMpV8D:Jc7pqrtdX7OtkXrD
TLSH
T173A28D473B135072D6861D70A2A7F6375EBDA3421BD234DB7BB142950E927E02F7A00E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

09:fc:0d:9f:8a:ca:8c:aa:3a:6f:3d:2c:75:65:33:a9

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

10109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdmjpeg.pdb

kernel32

GetTickCount QueryPerformanceCounter FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW FreeLibrary DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetCurrentThreadId GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetCurrentProcessId GetSystemTimeAsFileTime

user32

MessageBoxW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

msvcr90

_onexit _except_handler4_common _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _lock __dllonexit _unlock __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt _encode_pointer memset free calloc memmove_s memcpy_s wcscpy_s ??2@YAPAXI@Z ??3@YAXPAX@Z _CxxThrowException memcpy _decode_pointer __CxxFrameHandler3

winmm

DefDriverProc

$SYSDIR/bdmjpeg64.dll

IMPHASH 04208dfcd9f4d104fd3657338692098d
SHA256 c8ae89bbe268c6aa50036da8ceab7bf9645cc71cec7d0b4ebd85dbc5cab00138
MD5 5adea79e8f723c361ec5139e9f57e2b6
SHA1 31d585657a1200959d62f18df475459730380691
SHA512 abeb498d0c774c6e1d4e8c299734ca2ae27a7c2a47221c0106e53d63232bf696f9abf29f807cb58dedb8df87cf88d0dcd184f3502f316efff8b91d566cd696a0
SSDEEP 384:kJdZG0KOr/dtPG+6/EbeTnf3B7ywentajfyOlCDynYPLk10eMiNHW:kvj5eTfVug2OlCWF2
TLSH
T1D8B26D8F662500AAF991C678D792CA1AF97172062F5652CFB5F042CE1FDBBD12338319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c7:56:86:57:b3:18:87:81:31:56:47:f5:28:ec:2b:00

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

11148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdmjpeg64.pdb

kernel32

GetTickCount QueryPerformanceCounter FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW FreeLibrary DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess Sleep DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentThreadId RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetCurrentProcessId GetSystemTimeAsFileTime

user32

MessageBoxW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

msvcr90

__crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __clean_type_info_names_internal _onexit _lock __dllonexit _unlock __CppXcptFilter _amsg_exit _decode_pointer _encoded_null _initterm_e _malloc_crt _encode_pointer __C_specific_handler memset free calloc memmove_s memcpy_s wcscpy_s ??2@YAPEAX_K@Z ??3@YAXPEAX@Z _CxxThrowException memcpy _initterm __CxxFrameHandler3

winmm

DefDriverProc

$SYSDIR/bdmpega.acm

IMPHASH a59629a50eafc3a20d9d62c5f0118409
SHA256 99d50c2864bdbb0f5fdacd03856ab4f0f4dc93b01fb1390aab3d70f315e07a21
MD5 4d2daf31a931480527531392e86ed0ae
SHA1 7fe7852b3da5c68986f843497adab1d95f8f68f0
SHA512 786f8489e37844dce3da5ab6835fd77703fded72eb1acf0d018e3801f61e2e850fdb8b341606c7cbc919f8fa8ca0696f0b0b01a1a9f393931eb532df84e98f3f
SSDEEP 768:59OnI49PYUY9gpi00laScPILN0M7AoA6Obh0vaTxDgzFMOjmzc8R8a3q0m:TOnI0PYUuguZ707dBDgGOatR8a3/m
TLSH
T1D5537C11B150C0B3C58A6A346456D7619E7FAA911BE990877FBA037D2F623E0673E30F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ed:d0:5d:99:83:3b:07:c9:13:8f:69:45:d4:b4:47:0b

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

10760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdmpega.pdb

kernel32

GetLastError WideCharToMultiByte lstrcpyW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW DisableThreadLibraryCalls LCMapStringW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree VirtualAlloc GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

MessageBoxW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

winmm

DefDriverProc

$SYSDIR/bdmpega64.acm

IMPHASH 3259065632343fd95fdf829cba05685c
SHA256 415ef586c238566dac1433002299fe3b0cb7c67321aea923c08ff6d0a17615e2
MD5 03bc1e31e802542632e029a402fb01bf
SHA1 ecf31ca913bf9ab8a8ccb4314f462ef557a79879
SHA512 80e99ab668fcda82d79e4d9a83e6548cbb06b44b60179b5f42b2aaeb1135bd8aea9cacaf7d70cc2843061def34a920290f62ba805b82158679b342f69431aaac
SSDEEP 1536:r2WopVs/uBbcwOTlZTd7wOtOofxrcaAvvEL:aWopC+bly7fOofxrcaAvS
TLSH
T123636B4A726400B6D15682B4C9E39F46FAB2F45617B1938F533982AF2F673C2673E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f4:04:f6:f5:af:00:77:4f:aa:1f:9e:b3:11:fd:e6:3f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

11508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdmpega64.pdb

kernel32

GetLastError WideCharToMultiByte lstrcpyW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW DisableThreadLibraryCalls LCMapStringW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId FlsSetValue GetCommandLineA RtlUnwindEx TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader HeapSetInformation HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

MessageBoxW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

winmm

DefDriverProc

$SYSDIR/bdmpegv.dll

IMPHASH bf6c7259ffaa7b3eb59b7d97edcbb647
SHA256 24f67e8b96b4590e42d1f63da734bbc0c8ab40011db1f37c083ec68bd9e26020
MD5 7a6ecdb70c6a9012506f800caf795dc3
SHA1 09b8ee9015351e5441334adaf913d0d3723f2d4c
SHA512 30587356f18e91e6ac78c80f54c12c50118c88273ff449944c99bb6f78744dd1d334b5074e2612232cf694192129210349024a48c11518562f53332474ec8e46
SSDEEP 768:Wb4aURgp+ksjhdgwxdlAdRpIPevJ9kIgKuAz9aEuG6dA+9uFMCtgc8RLRCvk:WQmp+kyjgKeemXkIh9FixvSaRLks
TLSH
T1BE537C117651D0B3C14A6A30A055E7619E7FAB411BE6908B7FBA07AE6F213D0A73D30F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e0:04:19:6b:f2:e8:6a:ce:6f:f4:db:25:f0:d0:ce:86

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

10695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdmpegv.pdb

kernel32

GetLastError WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW FreeLibrary DisableThreadLibraryCalls LCMapStringW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree VirtualAlloc GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

MessageBoxW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

winmm

DefDriverProc

$SYSDIR/bdmpegv64.dll

IMPHASH 1c3318cf9e21cee7c0d17aa9a319a3c6
SHA256 e9c9ff574e4ab8044050c0c9e6564288aa614531d61dab3d1a693863f2c942ab
MD5 509bfbb117e326bd4486b9d355a46c1f
SHA1 6c90419c9e3922480f9f64ea847943ca5f63eb9e
SHA512 6b01a42cc55dca857c214ba22b34c6fb541dd17267dd97097943eb28f6c3ea97da5e22e8169d2bf3d1dd43bcebcd40d8c9b8f0afcff83b7a91ef6d28319c52dd
SSDEEP 1536:yZzTbeX7e5dzSLO4ZXOx54a2OrQtg/ALvq:yNbCK5dzcQxKa2OrQtg/Ivq
TLSH
T1CC637C8A726400BAD5578278C9E38F46EA72F44A17B1438F5379839E2F237D2673E315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c6:35:e8:8e:16:ca:5b:1d:04:2c:a9:1b:96:89:79:c8

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

11608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdmpegv64.pdb

kernel32

GetLastError WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcAddress LoadLibraryW FreeLibrary DisableThreadLibraryCalls LCMapStringW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId FlsSetValue GetCommandLineA RtlUnwindEx TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader HeapSetInformation HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

MessageBoxW

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW

winmm

DefDriverProc

$TEMP/bdfilters.dll

IMPHASH 27f07fb2c76df7e3ac5b98f25b3ec3e4
SHA256 c637b7998918570850a2a9289eebf181943c597416ed09dcf222858e797bf050
MD5 bfe905119a31034044438bb2060a7d7f
SHA1 7c8f74da28666e15e32812d7288bf458815c46cd
SHA512 50e983d13d31a94492ba4df4833701d54dbae3e2141c0ba2bb7a1a831b1f53e31640f658f6110fcaa56f9cf55199f53fedc0fbb15823879f77d7b4f7d1841791
SSDEEP 98304:cl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KCnvvvvi/:cuqYuQxqYfHYosUiJoviVkvvvve
TLSH
T1DC167DC3E6FF52E0D4551874203FB92BA6346B0A810CE6A2F1D56F1AFC377825AA7345
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

37:59:a3:7d:ea:c3:4b:d7:06:9d:e9:4c:fc:6e:ba:82

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

260066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdfilters.pdb

comctl32

ord17

kernel32

lstrcmpW CreateEventA CloseHandle WaitForSingleObject CreateThread SetEvent GetProcAddress GetModuleHandleA WideCharToMultiByte GetACP InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection lstrlenW GetCurrentThreadId GetTickCount InterlockedIncrement FreeLibrary InterlockedDecrement GetLastError lstrcpynW GetVersionExA GetSystemInfo VirtualAlloc VirtualFree FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer MultiByteToWideChar lstrlenA DisableThreadLibraryCalls GetCurrentProcess GetModuleFileNameA LoadLibraryA VirtualQuery GetLocaleInfoA InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc IsValidCodePage GetOEMCP GetCPInfo TlsFree TlsSetValue TlsAlloc WriteFile GetCurrentProcessId HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess Sleep QueryPerformanceCounter GetSystemTimeAsFileTime GetCommandLineA RtlUnwind HeapAlloc HeapFree ExitThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetModuleHandleW TlsGetValue SetLastError

user32

DestroyWindow DefWindowProcA wsprintfA ShowWindow GetWindowLongA SetWindowLongA CreateDialogParamA MoveWindow LoadStringA GetDesktopWindow GetWindowRect LoadStringW InvalidateRect

advapi32

RegSetValueA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA RegCreateKeyA

shell32

ShellExecuteA

ole32

StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoInitialize CoTaskMemFree CoTaskMemAlloc

bdfilters.dll

IMPHASH 27f07fb2c76df7e3ac5b98f25b3ec3e4
SHA256 c637b7998918570850a2a9289eebf181943c597416ed09dcf222858e797bf050
MD5 bfe905119a31034044438bb2060a7d7f
SHA1 7c8f74da28666e15e32812d7288bf458815c46cd
SHA512 50e983d13d31a94492ba4df4833701d54dbae3e2141c0ba2bb7a1a831b1f53e31640f658f6110fcaa56f9cf55199f53fedc0fbb15823879f77d7b4f7d1841791
SSDEEP 98304:cl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KCnvvvvi/:cuqYuQxqYfHYosUiJoviVkvvvve
TLSH
T1DC167DC3E6FF52E0D4551874203FB92BA6346B0A810CE6A2F1D56F1AFC377825AA7345
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

37:59:a3:7d:ea:c3:4b:d7:06:9d:e9:4c:fc:6e:ba:82

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

260066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdfilters.pdb

comctl32

ord17

kernel32

lstrcmpW CreateEventA CloseHandle WaitForSingleObject CreateThread SetEvent GetProcAddress GetModuleHandleA WideCharToMultiByte GetACP InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection lstrlenW GetCurrentThreadId GetTickCount InterlockedIncrement FreeLibrary InterlockedDecrement GetLastError lstrcpynW GetVersionExA GetSystemInfo VirtualAlloc VirtualFree FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer MultiByteToWideChar lstrlenA DisableThreadLibraryCalls GetCurrentProcess GetModuleFileNameA LoadLibraryA VirtualQuery GetLocaleInfoA InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc IsValidCodePage GetOEMCP GetCPInfo TlsFree TlsSetValue TlsAlloc WriteFile GetCurrentProcessId HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess Sleep QueryPerformanceCounter GetSystemTimeAsFileTime GetCommandLineA RtlUnwind HeapAlloc HeapFree ExitThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetModuleHandleW TlsGetValue SetLastError

user32

DestroyWindow DefWindowProcA wsprintfA ShowWindow GetWindowLongA SetWindowLongA CreateDialogParamA MoveWindow LoadStringA GetDesktopWindow GetWindowRect LoadStringW InvalidateRect

advapi32

RegSetValueA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA RegCreateKeyA

shell32

ShellExecuteA

ole32

StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoInitialize CoTaskMemFree CoTaskMemAlloc

bdfilters64.dll

IMPHASH 03c1aad04c80a2e0fd5bd4c160a3d1d1
SHA256 61aa3f47c5fd773a7cfb9f850bc72d8d5677e2eeab6eb587586c6edd5efab1ae
MD5 35ff166b5e0add4e6563efc43fc403e0
SHA1 621cac74cd5d8001c62301002f735d6ee8e7d665
SHA512 21a684eefbd5097d6d90bdac7d8baef05afd21d82eee788edcd089fab8fd3e22e202063c9328df65a70717f047f406001ecaf3efcbe76d815d6a1784489219a4
SSDEEP 49152:RwQ/D3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdVDYPdxx:WQTjWDdLhiapD88SiQZbvvvvJ
TLSH
T1F4267D47E1EF81DDC0178C3086FDF223F921385A4108969667D1FA647A6EB809F3B75A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f3:88:23:b6:83:0d:8e:b2:1c:2d:f4:0e:92:07:a0:5e

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:33:3f:db:3f:66:aa:8e:3e:41:ee:9b:0d:9c:a3:90

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2012 - Nov 15, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

315100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP\bandifilters\bin\bdfilters64.pdb

comctl32

ord17

kernel32

lstrcmpW CreateEventA CloseHandle WaitForSingleObject CreateThread SetEvent GetProcAddress WideCharToMultiByte GetACP InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection lstrlenW GetCurrentThreadId GetTickCount FreeLibrary LoadLibraryA lstrcpynW GetLastError GetSystemInfo GetVersionExA GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA InitializeCriticalSectionAndSpinCount HeapReAlloc HeapSize IsValidCodePage GetOEMCP GetCPInfo WriteFile GetCurrentProcessId HeapDestroy HeapCreate HeapSetInformation GetEnvironmentStringsW FreeEnvironmentStringsW MultiByteToWideChar lstrlenA DisableThreadLibraryCalls GetModuleFileNameA GetStringTypeW GetCurrentProcess GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP GetStartupInfoA GetFileType GetStdHandle WriteConsoleA SetStdHandle SetHandleCount ExitProcess GetModuleHandleW FlsAlloc SetLastError FlsFree FlsGetValue Sleep QueryPerformanceCounter GetSystemTimeAsFileTime FlsSetValue GetCommandLineA RtlLookupFunctionEntry RtlUnwindEx HeapAlloc HeapFree ExitThread TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext RaiseException RtlPcToFileHeader EncodePointer DecodePointer

user32

wsprintfA GetDesktopWindow GetWindowRect LoadStringW LoadStringA DefWindowProcA GetWindowLongA SetWindowLongA DestroyWindow ShowWindow InvalidateRect MoveWindow CreateDialogParamA SetWindowLongPtrA GetWindowLongPtrA

advapi32

RegCreateKeyA RegSetValueA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA

shell32

ShellExecuteA

ole32

CoInitialize StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoTaskMemFree CoTaskMemAlloc

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

318KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninstall.exe.nsis

SHA256 ffbf5b1f8f5aed940e623968e20d44b22129edc8270eaeca652572bb56ee6be6
MD5 a1ae5b248aeabf901d6fca6c3cde55eb
SHA1 233fbff0477edd278270d151a6d46fe686fb8e2b
SHA512 7cc461a8e41df02149384af542e97981b40e5dc8cf26080f6e6ed001699e2500c6d00e9880ffa6323ea84a0ef7f6a3bd877740399c3115e70ae4185d87aa2aed
SSDEEP 192:HKJKpeqE6KAAB+3L3nzMeT1fSuyc7QM46ohyH7XQ+90bCdsXGHBLby:1E6KpB+rnAY6u+bhybQ/eyXQJG
TLSH
T13112C00D02F40E2D31C32DF6C9F2B626E557DAE5A7E3AD85573460DE83204A95AFB134
MD5 SHA1 SHA512 SSDEEP TLSH

bandicam.ini

SHA256 8b6437bf50caa7216fb46fa01b993365af51f19e40ba8ce74ccdadb3e0d58e2a
MD5 6e2942a496e0212e214161b9a4d2ad5c
SHA1 30f2416bd8ecb1b9ef8957e33d6e2e538ca338c1
SHA512 802817238dc92858fb7f53915d22a70ad5379a29fb8b6da85756423ea822f204e88106f1e50e066cfcc7bfb4692c2543f802b54ae99c3771851991e04d655878
MD5 SHA1 SHA512

bdcam.dll

IMPHASH fb73ff318744768efc034a7f75a768f4
SHA256 76f4a453d36228e04c9643fab4514d93187b5a9901a29cbf20ac1a5ca634096d
MD5 2e2eba4956f76b47fccf68d661d2e931
SHA1 40ea0483d1cf065457e3477e4be56d78fbbdad2a
SHA512 ef35db570d006dc36791bcc303880041a002f2db1668de8ce28492e2266979238692065a91c2a544e30ec7c7a276bff4f5a0593f05cbb4390a3cbb2e8c0a587e
SSDEEP 6144:hU9Z86hb7kBJbAkoSiseN9k47p8yKcUtJxETlb8h:hU9Z86hbAB5AkoSiseN917h2xETlb8h
TLSH
T1A764C0407BD2C077C64B613484778B1EFA78D6628759CDC3BBA85A696E207C1BD3C34A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

53:d3:10:03:10:53:c2:c8:b5:1e:6a:c7:50:8a:cb:99

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

91472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP2\bandicam\bin\bdcam.dll.pdb

kernel32

SetLastError GetCurrentProcess GetSystemDirectoryW GetFileAttributesW GetFileSize LocalFree CreateDirectoryW WaitForSingleObject TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency VirtualProtect InterlockedIncrement InterlockedDecrement WriteFile CreateEventW SetEvent VirtualAlloc VirtualFree FreeLibraryAndExitThread CreateThread OpenFileMappingW MapViewOfFile CreateFileMappingW DisableThreadLibraryCalls UnmapViewOfFile FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP LoadLibraryA GetLocaleInfoA LCMapStringA InitializeCriticalSectionAndSpinCount RtlUnwind GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount ExitProcess GetModuleFileNameA GetModuleHandleA GetStdHandle GetStringTypeW GetStringTypeA LCMapStringW TlsFree TlsSetValue TlsAlloc TlsGetValue GetSystemTimeAsFileTime ReadFile SetFilePointer CreateFileW CloseHandle lstrlenW GetLastError GetCurrentProcessId FindResourceExW WideCharToMultiByte Sleep GetTickCount MultiByteToWideChar OutputDebugStringA SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FreeLibrary GetProcAddress GetLocalTime LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA GetCurrentThreadId ExitThread RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

FindWindowW IsWindow WindowFromDC GetClientRect FillRect PostMessageW UnhookWindowsHookEx GetDesktopWindow SetWindowsHookExW CallNextHookEx wsprintfW SetForegroundWindow RegisterWindowMessageW GetForegroundWindow GetParent GetWindowLongW

gdi32

CreateSolidBrush DeleteObject

advapi32

InitializeSecurityDescriptor RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW SetNamedSecurityInfoW SetEntriesInAclW FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl

shlwapi

PathIsDirectoryW

winmm

PlaySoundW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDI0

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bdcam.exe

IMPHASH 65353905c035b7a16fa9fc11bce85e1a
SHA256 38eafcd61aaabee7a2fc45fd0df0605289f3658f2af44c17a47676a1dc25f9cd
MD5 f452da6785cb7e93da4d753c05e3d3d1
SHA1 79dd251546bf0ed9f5826dcacea520d63e1c468a
SHA512 7d1e4189761784973f00bc887acdf11ee9aff308188215e46f12c87edd83e2ca165f3fa40aec4f27aee3e3d6f3242830db24464152d2275b2e6e19170954bf76
SSDEEP 24576:0dyrErsMtqy2X7yWxMmac7synToQlvbJAG1eAcxYSPxx1peuEg:0mErsMtqy67/Pac7NTLdAWrnSH1px
TLSH
T11A6523629A2898B6C018037D663EFBBCE66DDC15426C9217F2D07CCFBD27653694D20B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b0:b9:0e:89:4d:f6:b9:34:17:0c:88:2e:5d:8b:a4:38

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

2484743

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeResource ResumeThread FileTimeToLocalFileTime GetModuleHandleA lstrcmpA lstrlenA CompareStringA LoadLibraryExW GetLocaleInfoW EnumResourceLanguagesW ConvertDefaultLocale GetThreadLocale LockFile UnlockFile SetEndOfFile GetFullPathNameW TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags WritePrivateProfileStringW GetStartupInfoW HeapFree HeapAlloc ExitThread UnhandledExceptionFilter IsDebuggerPresent HeapReAlloc RtlUnwind GlobalAddAtomW VirtualProtect VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode LCMapStringA GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA GetProcessHeap CreateFileA SetEnvironmentVariableA GlobalFindAtomW GlobalDeleteAtom IsProcessorFeaturePresent InterlockedCompareExchange GetVersionExA FormatMessageW LoadLibraryA LocalAlloc GetThreadPriority CreateThread WaitForMultipleObjects DuplicateHandle SetErrorMode SwitchToThread GetUserDefaultLangID SetUnhandledExceptionFilter FlushFileBuffers ExitProcess GlobalUnlock GlobalLock RaiseException GetCurrentThreadId FlushInstructionCache GetLocalTime GetSystemDefaultLangID CreateFileMappingW ReleaseMutex UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateMutexW VirtualFree VirtualAlloc InterlockedExchange ResetEvent GetWindowsDirectoryW FindResourceExW MulDiv QueryPerformanceFrequency GetTickCount QueryPerformanceCounter lstrcmpW InterlockedDecrement InterlockedIncrement SetThreadPriority Sleep GetSystemInfo TerminateProcess OpenProcess Process32NextW GetCurrentProcessId Process32FirstW CreateToolhelp32Snapshot CreateProcessW WideCharToMultiByte CreateDirectoryW LocalFree GetFileSizeEx GetFileAttributesW GetSystemDirectoryW GetModuleFileNameW GetDiskFreeSpaceW GlobalFree GlobalAlloc GetCurrentProcess GetCurrentThread GetModuleHandleW GetVersionExW GetVolumeInformationW SetLastError FindClose FindNextFileW lstrcpyW FindFirstFileW lstrcpynW GetTimeZoneInformation FileTimeToSystemTime GetSystemTimeAsFileTime GetFileTime lstrlenW GetLastError GetFileSize WriteFile SetFilePointer ReadFile DeleteCriticalSection InitializeCriticalSection WaitForSingleObject SetEvent CreateEventW SleepEx ReadDirectoryChangesW CreateFileW CloseHandle CompareStringW FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar DeleteFileW LeaveCriticalSection EnterCriticalSection FindResourceW LoadResource LockResource HeapSize SizeofResource GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

DrawTextExW TabbedTextOutW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetMessageW ValidateRect IsDialogMessageW GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetLastActivePopup SetActiveWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos TrackPopupMenu SetMenu AdjustWindowRectEx GetMenu SystemParametersInfoA GetMenuState MsgWaitForMultipleObjects GetQueueStatus PostThreadMessageW EnumDisplayDevicesW GetWindowTextW GetWindowTextLengthW GetFocus IsWindowEnabled TrackPopupMenuEx DestroyMenu TrackMouseEvent UnionRect GrayStringW RegisterClassExW InflateRect GetWindowDC SetScrollInfo SetScrollRange SetScrollPos CreateWindowExW EndPaint BeginPaint IntersectRect DestroyWindow GetSysColor UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx UpdateLayeredWindow SetLayeredWindowAttributes GetDesktopWindow SetParent FillRect GetWindow WindowFromPoint RegisterClassW DefWindowProcW SetWindowRgn DeleteMenu DrawIconEx LoadImageW SetClassLongW GetDoubleClickTime KillTimer SetFocus RegisterWindowMessageW UnregisterClassA GetClientRect DrawIcon IsIconic LoadIconW MessageBoxW GetClassInfoW GetKeyState ShowWindow CallWindowProcW RemovePropW GetPropW SetPropW GetMenuItemInfoW ModifyMenuW GetMenuItemID EnumChildWindows FindWindowExW MapWindowPoints SetWindowTextW GetDlgCtrlID InvalidateRect SetCursor LoadCursorW SetWindowLongW SetCapture RedrawWindow ReleaseCapture SetRect SetRectEmpty RegisterClipboardFormatW MessageBeep GetNextDlgGroupItem CopyAcceleratorTableW GetClassLongW GetClassNameW CharNextW UnregisterClassW CharUpperW SetWindowContextHelpId MapDialogRect PostQuitMessage GetClassInfoExW PostMessageW EnableWindow GetAsyncKeyState SendMessageW GetParent LoadAcceleratorsW LoadMenuW GetSubMenu GetCursorPos EnableMenuItem SetMenuDefaultItem SetTimer CreatePopupMenu AppendMenuW GetMenuItemCount GetMenuStringW CheckMenuItem IsWindowVisible GetWindowRect PtInRect TranslateAcceleratorW InvalidateRgn GetDC ReleaseDC GetSysColorBrush IsWindow GetSystemMetrics SystemParametersInfoW MonitorFromRect GetMonitorInfoW CopyRect MonitorFromPoint OffsetRect EqualRect MoveWindow GetWindowLongW SetWindowPos ScreenToClient ClientToScreen PeekMessageW TranslateMessage IsRectEmpty wsprintfW DrawTextW DestroyIcon SetForegroundWindow GetWindowThreadProcessId GetForegroundWindow GetWindowPlacement ExitWindowsEx DispatchMessageW UpdateWindow

gdi32

GetBkColor GetTextColor GetRgnBox GetMapMode SetRectRgn PatBlt CreatePatternBrush ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx SelectClipRgn SetMapMode SetROP2 RestoreDC SaveDC CreateBitmap GetClipBox CreateDIBSection ExtCreateRegion LineTo MoveToEx OffsetRgn ExcludeClipRect SetWindowOrgEx CreateCompatibleBitmap CreateDCW StretchBlt CreateSolidBrush BitBlt CreatePen CreateRectRgn GetDeviceCaps CreateFontIndirectW SelectObject SetTextColor SetBkMode CreateCompatibleDC DeleteDC CreateFontW DeleteObject ExtTextOutW SetBkColor GetObjectW GetStockObject GetTextMetricsW GetTextExtentPoint32W StretchDIBits CreateRectRgnIndirect SetStretchBltMode CombineRgn

comdlg32

GetFileTitleW GetOpenFileNameW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW AllocateAndInitializeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW SetNamedSecurityInfoW SetEntriesInAclW FreeSid

shell32

SHGetPathFromIDListW SHBrowseForFolderW ord190 SHOpenFolderAndSelectItems ord155 Shell_NotifyIconW ExtractIconExW ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

StrStrW PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW PathIsDirectoryW

oledlg

OleUIBusyW

ole32

CoInitialize CoTaskMemAlloc CoFreeUnusedLibraries OleSetContainedObject OleCreate CoUninitialize CoTaskMemFree CoCreateInstance PropVariantClear CoRegisterMessageFilter CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize OleInitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard

oleaut32

SafeArrayDestroy OleCreatePropertyFrame SysStringLen VariantChangeType SysAllocStringLen VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString VariantClear VariantInit SysFreeString

urlmon

CoInternetCombineUrl

gdiplus

GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenStartCap GdipSetPenEndCap GdipDrawLineI GdipDrawRectangleI GdiplusStartup GdiplusShutdown

msvfw32

ICGetInfo ICClose ICOpen ICInfo ICSendMessage

dsound

ord8

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetOpenUrlW InternetCanonicalizeUrlW InternetOpenW InternetSetCookieW HttpSendRequestW HttpOpenRequestW InternetConnectW InternetSetOptionW InternetCloseHandle InternetReadFile InternetQueryDataAvailable HttpQueryInfoW InternetCrackUrlW InternetQueryOptionW

winmm

timeEndPeriod PlaySoundW timeKillEvent timeGetTime timeSetEvent timeBeginPeriod

�o�＂%�ʏm*툅�Ѫ��å��Eʸڎ��쬐�a�U<q\��42��E�RE�i+B��y�[��,?�V��v�&Jl�f]W�[��,��['rG��$�qy)i��b��>Q�7R��c�K݈�.�-S��p�ٿ�0x�F�º`��nPF��\��7yD��"@O�}q=:�c��g;��6�3ɴ�)+��f��3#��ta�7M,'�g\~0=`��rz��Ŏ��G�tn] ��8�$�sw�_- �d lZ��SM!��R��@?�s��F��pN0`�8� ��`�s@�@�WJ��a*��u>V|S�f�h��$��5�K�4��O#|�8bv��HĞ��e�\�D��P({k��x��GR��u2G[8Qu� ��)s7�L�D��Oa��=v펂�s�F��jAYfd4s��%�^��'�a�qϔ.rm]T�7ƐxŤؘq��(aH)��=�)U�5�U�LY"T�#��y�Q�"Ğ�C��S�'�ָ��~MMF�uҢ��r��&]]epC�V��DTv�P��_ xc.7cj��(c)75��F�/n�*��j�� Į}Yٔ6�U�J�Xx3A3��s��M$r�~��&��!:.y˴�2��JD��N��6��A~m�{&g�z��s��a�&�$ ,?�]��|��\ɚ��x(��<�p�m��ء[8�.JLj�ږV��9�,��G��/��*�c�TD��t�˸>�"��(��C�M�ϵψ9L�9�t�5�9L<p�g��j�,q� IR�J�P�~�za\�,��Z��W�ZU��vRc��vf�� t�rKPGN��Ēnb^�^��v�t' [n��8��y9��n>`:�e�GN�"M��Œf��<K�J4,��c�!��a��j��eξZA��50��9�FLҼ8%�c:B93t%x��{n_�qtg��F�s3��]G� �H�XN,X��!��+w0@>EO�#��ԙ��j}��q@��O�T�(�@�xcY!�P�i^O�EP��*�� ޾E�ư�Ei�F[}��9��.p3��;�nK.��{�i�vn~�sC��/ �!��sU4�}�6;*�e��+�&B��e��o�4sT|��,�L�N��N8�јC�^$�Z@%n�o��H�, �C�д��v?8�)��%��j�WN�3t�X��S�0V��wo�½�}��BYdOsM;�h7��5ܖ��1�Jh߉4%5�+�J��X�^��y>*��[��w_M��1�D��Y�6�C�6�H �� S��>LR��b�V�N��o��]��$��徆#��d<�H�ư� U��<�L�yJ 1�ik��UpK.�ro/K��L�� o��}�^+(Z��ȹ��1��d)\aؾ"��*j��P��G:1��+��7?��=��bT8Z��!8vm�f�Ez5��%�2��ֿ*�4�hi_��1�*R `��=�/i��V��&��F_��E�*�-h7u3�#�� KJզ��T�tg�F��fD�7��5�D֣jݕ"6�e��m��H�9��_a��0��*�QV'��aJ��t��):�E�Uq@��SDc�D��To��l"F�E��יxGv\��j(N�I�+��I�ꃽL��! E\��2�x��~�S��F�L!��ɫU��5F�k::��k� C}fI��y+µ��Eɨ��Z�� ~g_��o��#�buǬ��4��)�{gf�c�0D3��1��]��a D�*by�>��ĴC��Lݰ�]�by�|lM==*��hSC��y��W��)�t��k/W6�߬I��S��G��#y�<��7�8��S� �v��Fl�UW�Zzm��NǈƫCҧ?!yE7=5C��K��Y�5�o��X�-љ�η�n�Px�� toEA*�?\O54/��M��6�q#��qy��?��ڝ��>J�=��2�=��to}��T>��M�� ьRG<��u�&h�)W��8��d��!{�7�RI`��7U�� ֱ0*�i��H*\�,��R��REH�� &�*z�T�?�_H�1O�l��>yC�T�ϘE��d1�+�\ �G��@)��bJ�z�棐�_��ܭ H�gTt�y ��s�WgG��w��Pۯ��ؚN�A�$| dA粁{�)��w~[�.� M��o��-�|�Ϸ�u�>w��-Mo��x�� M]x}u��t�Ԣ��z�OϤm7��N�ؖ��g�.��IHWSP��j�� V3��r�ה��H�6�U��u,a�x灩��S��X��"B�u�o9�8�_F砙�D�# h��/�$UKh(I0��ܹ4(��*�Nua�;�/8�i��Jg�\u��2��c��Uk�6�N�U��:��s��0�[YO��e�} BsXr�� qż��M��,��)�xu��2��~�� 46#9CG��*��ɾe(�jC��k��h��F��D,`�(� ZI�W��lvԅ��ջN�fz��bF��%�� &��jr"��h�WN ^�&��t]uhl�c��'f<E2\��j�+��CD7kAB.��D�g�t��i��/�v��ܴ8#�b�Hi�1K��`�#�l��K�P=�pF�G�v�e��B�p@��o�T��+�|�^�N�ԍY`][��6r�+i 7�e�;�T�B{��&!t ��..�)<>N#��(4>��b((�ӕ�խ��"��Nu.L�5�z��r5��7�el��+��貽�d��Nol�!�/��wY��϶λzS��

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDISH

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDI0

Size

Virtual Size

589KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDI1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

81KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bdcam64.bin

IMPHASH 2de66971129fbf12f77d00a30820b413
SHA256 07e8fb57dd73bfde6d222be6a64c2dbc3e465239029aba75e3d2aba363b6c9ab
MD5 7594e362b9853e91f99a0f7db8d03f86
SHA1 48c78a9d0bc29289b92ded5c5e190f467336938e
SHA512 aef0b4df8e00a876f54ebb90e03129dfe75467f95c5a89c8c75cbf3eedc5f5483a294f0d0e57be6c10c3732757e87ad2ceb0cc00e868ff004a8b369ab80406a5
SSDEEP 12288:3xDl5TCf9XjH+PALLQ7NIk49pGHNu4R2UT:3xDlARGAtuI47T
TLSH
T1B0941267894806D2C12848379C97CA711B34BAA79845C74BF4E4382FFD87BACE74A75C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4f:60:92:a3:e5:9c:a1:c0:7d:df:d5:02:d5:24:9d:0f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

652002

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bdcam64

Bdcam_Uninitialize Bdcam_Initialize Bdcam_SharedData

kernel32

lstrlenA GlobalFlags WriteFile FlushFileBuffers SetEndOfFile SetErrorMode GetStartupInfoW HeapAlloc HeapFree ExitProcess RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader HeapReAlloc HeapQueryInformation HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LCMapStringW GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap CreateFileA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue GlobalHandle GlobalReAlloc TlsAlloc InitializeCriticalSection EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFindAtomW LoadLibraryA GetVersionExA GlobalAddAtomW WritePrivateProfileStringW GlobalDeleteAtom GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW GlobalLock GlobalUnlock FormatMessageW Sleep GetUserDefaultLangID GetTickCount GetModuleHandleW lstrcmpW GetSystemInfo TerminateProcess GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte CreateDirectoryW LocalFree GetFileAttributesW GetSystemDirectoryW GetModuleFileNameW GlobalFree GlobalAlloc GetCurrentProcess GetCurrentThread FreeLibrary GetProcAddress LoadLibraryW GetVersionExW GetVolumeInformationW SetLastError GetSystemTimeAsFileTime FindResourceW LoadResource LockResource SizeofResource ReadFile SetFilePointer CreateFileW lstrlenW CloseHandle GetLastError GetCommandLineW GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

DestroyMenu GrayStringW DrawTextExW TabbedTextOutW UnregisterClassW GetSysColorBrush WinHelpW GetCapture GetClassLongPtrW SetPropW GetPropW RemovePropW GetWindowTextW GetDlgItem GetTopWindow DestroyWindow GetWindowLongPtrW SetWindowLongPtrW GetMessageTime GetMessagePos SetMenu GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW GetSysColor AdjustWindowRectEx CallWindowProcW PtInRect GetMenu SystemParametersInfoA IsIconic GetWindow IsWindowEnabled MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus EnableMenuItem CheckMenuItem PostQuitMessage UnhookWindowsHookEx GetMenuState EnableWindow PostMessageW RegisterClassW LoadCursorW LoadIconW DefWindowProcW ShowWindow ReleaseDC GetDC GetSubMenu ModifyMenuW GetMenuItemID GetMenuItemCount FindWindowExW GetClassNameW MapWindowPoints SetWindowTextW GetDlgCtrlID wsprintfW DrawTextW RegisterWindowMessageW SetForegroundWindow GetWindowThreadProcessId GetForegroundWindow GetWindowPlacement GetParent IsWindow DispatchMessageW TranslateMessage PeekMessageW ClientToScreen SetWindowPos GetWindowLongW CopyRect GetWindowRect GetSystemMetrics SendMessageW GetLastActivePopup

gdi32

DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible GetStockObject SetMapMode RestoreDC SaveDC SetTextColor GetClipBox CreateBitmap GetDeviceCaps DeleteObject ExtTextOutW SetBkColor PtVisible

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW SetNamedSecurityInfoW SetEntriesInAclW FreeSid AllocateAndInitializeSid

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW PathFindFileNameW PathFindExtensionW

ole32

CoUninitialize

oleaut32

VariantInit VariantClear VariantChangeType

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

?��ڟ�Z0i�VF��YǮUC��4r��G'E�U� FO|"�t&�ߝ�q�q�Gl�� p�@�:�� (��{��[I��{��=��Ԋ�!FY�;��\M��p��5Ɔ�,8 )b"��F��%S��S7�U�hf�Y��[��OΤ�Q��L��P��I��lk�џ�=f=4o�8��c�t��fL#��]�: j��I��N8��~��s��9YL*xk�J��^x�j#JTQE��۹Gρ��j)��tm��k�¶EwV�~!�Sd�>�F�\��/t��cE]e}�� xs�liѧG*be�� ]۷d��+��Q6%~rh�r��l��1d��Щn|9�0�(�g]��?1�b�m �qRr�p�@l� �Sw��9u��A�r>�OrѦ��r�j��6�-+W ��4j_"��N��uƏ��80߳m��a�L_9�Ly8�'��WL�� ʲe;@2&��c��ށ߸n��I�F�u��!r3n�"T�mۺ)%L�� P�/�� X7�h��j��r��Ѡ�+^��<x��R<&,�c��@8�bѷ�v��w� �"F��G�|n��R��i��M�Q+ߐR�FZ��e�(�E@u4��6L�H+�N��yw�4g>1��?V�\�d5�ĩθ�� o�泚��"W�̋Q]��?� x9,}�� s(��~6�L��<r�>��]��$ i!$K�y��XB��v��5��}��&ݠ_��{^��**��|K�LP�#Y5�GY��\ٞ�]u��k j�\��b��F�-�'�y�@+>��r��1+J�SZn �%I �-��V�אd.�g��@�/�]$��1E&c9��yժ�� cP�׭��ѾcN�ݞ�|*��¥\KO-�t"^%��K�񌌁��=?h��i�!�U� )>\��Յ�m��Khܭ��t�La��g��/_M�/=�J��t�(D�Ƣ�3"#~x��J��!Q��(<�U�ٜ]- ��n��G��H��l9S��ū�{��Y 9��D� ��=�f��'y��: �y��ߧ?�q��܃�za��P�5��;�O�6�楳�#��S9%H�C��{�1�� $�A��Į��E��C[Kw�pW�� E�*^��w��"��"p�|R[��3Ǥ�_��<1>��Z*޸շ�-�y��^��ˬ�A�H,��n��Cgf� E��s��ȩK��y��O��\q�7��BCR]&G��paj��"Q �1Acm��2$�a,s�>B��+�U -�j�PV��4� B'� F��<0V��P�-�$��`�6��c��/JX@�IH�� ?�ߛ{,k6�y��$�%��KER��Mw��J]Z�r5w�0�zaҵ��~�L�k��Z��@�ϛI��X��7��O��g�|�V;Wͷ��\�*U !;�e;�F�a��g�*@��fh��n�X��F�oYw��~�}�MLn%��m\�u�~�7��4Z0@�-�Q<�k1��K��T��zi��Z�(��@*�Gc�#��T3p��<��qlO�M�L� ��G%��Kњ��γYVJ)W�KZ�ןnv<�bC��G��E��Ii`�&��KL/�DE��)�b��BI\��GD�5A&�L�1;��?*��3ǿ�y�^$��7`�� Z��3l�l�2��.q��2�mX��;]��}bzl��/bY�v�l��\�k��lp��P�8��a�3>��b�(��N�a��̴��6�DE��%2��Y��z��B��.0t=q)UpV�Z�6�"�|\�FH;8!�2`�X�F;g�#�Կ�t�z$��z6D6�B��_>�B��q��z��z��G:R�󬸫"�icn�'��=3�!9)� a�F6�Ѽ�f��v��5É��o��*T7�H%%��7ttP��=P�0�o\�oɓ�S��?.�̪9��?��rӉ��j΁��c�e��P�|�e�9�v�Ҽ��*��l��v�U��9��nRL�ϻQ��|��@�!��8>�x~F�_�u&�9��G/��̊c�Pn텅.}eCo��S�~�3�,Q�h2��{Wĝ�e��9O�#ގ2MAr��_�N�PW�w�D�?��ؓ!��^&X"9lWx��³W<� ٙw}��"��S��sz~E��PI��&P�`ҡq��Y(s4��=S��\Lk`�TA��@Mg��5R��Q1��X��м`C��%��|)��H^�a��v�],?u�!��8��z3Uk�.��`p3Y�zF��{$n��#�M��an��g7+O3�V|h3��ќ�狆��M�_��L#��^\�� ?�.�+�A0�վ,V�a՟5ȓQFu��p��;��R��K_�c��i�E�-�;&�:��"��zj[��zXt\,^$��BH��t��)��̎M+Q�W�e�m�I�qB��Jt��CJ�Y��P)j��_� �W �*H��:U��-��)��^� �ۄ:�v�Ic@�Q(!��E��8��H��)OeGx_��AuX��bg&É��{�}��ҷ��E�g��8㷤��78��=}/�o��;�[)��B�3��B�,\�ⅈ.¢��[ykdδ��֍=$Dy��F/8��W��`��,��ȆU��*�(�)[��:��<�E�̋��9#�J��9��\��B��K��`ƹ�Q�x� �YU��U

Name

.text

Size

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.BANDISH

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDI0

Size

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDI1

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

71KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bdcam64.dll

IMPHASH a774058d38cc22b653c606e4eec5d1e3
SHA256 32b592af3ecf5b03357495dc67cd9968b6fb3dcd4e954622fd043998d2c11d45
MD5 548313e38bb853845129f164d1cc67ae
SHA1 1166490ed8fc8f1c4f364a92799c6aff563c3d01
SHA512 bde33146fa32051801437f562578a3e5a992ee50d0e62f2fd45dcdcce150e6bff6ec6efb5ae37d27fd9adc67bb463de4740e5655bd8c6931e7a4b7bdd2ce58fe
SSDEEP 6144:AZU7/4v4O8gfbgzYUaUcjWbWqXMK1IM8m7WkHuTuGEN+pLo4Yuu2CR5XQDV25W6Z:A67qzgzKTWSqlS5TuDNAo4YuOXw4
TLSH
T11894BF067BB00CA5D857C47E86839746E6B278420B64D7CB136087AF6F337E1AD3A725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d0:90:28:88:01:30:02:4f:7d:0a:af:59:a3:c8:bf:d8

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

105520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP2\bandicam\bin\bdcam64.dll.pdb

kernel32

SetLastError GetCurrentProcess GetSystemDirectoryW GetFileAttributesW GetFileSize LocalFree CreateDirectoryW WaitForSingleObject TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency VirtualProtect WriteProcessMemory WriteFile CreateEventW SetEvent VirtualAlloc VirtualFree GetLocalTime CreateThread OpenFileMappingW MapViewOfFile CreateFileMappingW DisableThreadLibraryCalls UnmapViewOfFile CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LoadLibraryA GetLocaleInfoA LCMapStringA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount ExitProcess GetModuleFileNameA GetStdHandle GetStringTypeW GetStringTypeA LCMapStringW FlsAlloc FlushFileBuffers FlsFree FlsGetValue DecodePointer EncodePointer GetSystemTimeAsFileTime ReadFile SetFilePointer CreateFileW CloseHandle lstrlenW GetLastError GetCurrentProcessId FindResourceExW WideCharToMultiByte Sleep GetTickCount MultiByteToWideChar OutputDebugStringA SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FreeLibrary GetProcAddress FreeLibraryAndExitThread LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate HeapSetInformation RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwindEx GetCommandLineA FlsSetValue GetCurrentThreadId ExitThread RaiseException GetProcessHeap HeapSize HeapDestroy HeapAlloc HeapFree HeapReAlloc

user32

FindWindowW IsWindow WindowFromDC GetClientRect FillRect PostMessageW UnhookWindowsHookEx GetDesktopWindow SetWindowsHookExW CallNextHookEx RegisterWindowMessageW SetForegroundWindow wsprintfW GetForegroundWindow GetParent GetWindowLongW

gdi32

CreateSolidBrush DeleteObject

advapi32

InitializeSecurityDescriptor RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW SetNamedSecurityInfoW SetEntriesInAclW FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl

shlwapi

PathIsDirectoryW

winmm

PlaySoundW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.BANDI0

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

876B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bdcamih.dll

IMPHASH cdf3c070c6bb93e55aeb972b8cfb63b2
SHA256 ed7d5c554792f977e5860e0020462177c0a2399ca50524bc6c454c0533abdc48
MD5 f21d67310f2a5f5c1fcd7e1121412ef3
SHA1 f9f7777cd4bb5276476aa6addb6fc3b73dfe4660
SHA512 8d821a78b08ec38b2325ecdae01b90a2bf63032e90fe73ba38dfe97a9a07bbc8ff111fcd2d2a51e57081bf11e012b4be7460c0288b1466ffd96aebdf62824e17
SSDEEP 768:jW5iWnxhudTWfqhV3xosqu4SPMbRz72ORVNMgz:i55eos1KddRVBz
TLSH
T126337D017950C473C94A557C5056CB629DBEBA512BE4908B3FFE07AEAF227D0673A30B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

16:b2:e3:70:b0:04:b2:42:4f:c9:3c:c9:d9:fd:a9:8b

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

5046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\w\devel\CAP2\bandicam\bin\bdcamih.pdb

Name

.text

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ihkshar

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bdcap32.dll

IMPHASH a7a81ffb2a62ce7118d9a7ef3dda6540
SHA256 d2ad6f77c0ec12f26218177837ff3bd811310677c15a00befc69146f55eae257
MD5 d2b9e92d794972cf8051e1a394edbcdd
SHA1 09b18945693d99f257c4a824487b8d8d87bd32df
SHA512 e0bd119861ebb3551487728d65a4ec01ae78fdd600b49b3c2b130e24c994428b5653c58aa819dd8c46a5d3edfb365902907b065b0dd4eb72d7dc69c3ceac6685
SSDEEP 196608:L979Ops3t6zGtfBz+lwsNwM1pRkjkzPhA6Xvvvvqi:pJt6zGtpz+lwsNwM1pRqm
TLSH
T171B68DC1F2D781A0C4460DB0543FB56FAA342F19821CD6F6FBD0BE1AE877751AAB1681
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9e:fa:4d:38:ca:e3:39:60:4f:41:ae:3d:bc:9e:4c:68

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

981870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\w\devel\CAP2\bandicam\bin\bdcap32.pdb

dsound

ord7 ord6

kernel32

VirtualProtect GetThreadPriority CreateSemaphoreA ReleaseSemaphore InterlockedIncrement InterlockedDecrement lstrlenA CreateFileA SetFilePointer ReadFile GetSystemTimeAsFileTime SetLastError GetVolumeInformationA GetVersionExA GetCurrentProcess GetSystemDirectoryA GetFileSize LocalFree DeleteFileA CreateProcessA GetCurrentProcessId TerminateProcess GetSystemInfo GetTickCount CreateFileW WriteFile VirtualAlloc GetModuleHandleW CreateMutexA OpenFileMappingA MapViewOfFile UnmapViewOfFile ReleaseMutex SwitchToThread LoadLibraryW SetErrorMode OutputDebugStringW lstrcmpA GetModuleFileNameW VerSetConditionMask VerifyVersionInfoW GetFullPathNameW ExpandEnvironmentStringsW lstrcmpW GetSystemDirectoryW CreateProcessW LoadLibraryExW SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeW GetStringTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA ExitProcess HeapCreate GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP WaitForMultipleObjectsEx ResetEvent QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleA GetLastError WaitForSingleObjectEx CreateThread GetProcAddress LoadLibraryA MulDiv SetEvent CreateEventA SetThreadPriority InterlockedExchange WaitForSingleObject VirtualFree CloseHandle FreeLibrary FindResourceExA FindResourceA LoadResource LockResource SizeofResource MultiByteToWideChar Sleep GetDiskFreeSpaceExA WideCharToMultiByte lstrlenW GetSystemTime LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection DisableThreadLibraryCalls GetModuleFileNameA GetCPInfo GetCommandLineA RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThreadId ExitThread GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy LocalAlloc GetFileAttributesExA FlushFileBuffers RaiseException VirtualQuery

user32

WindowFromDC IntersectRect OpenInputDesktop SetThreadDesktop CloseDesktop PeekMessageA TranslateMessage DispatchMessageA EnumDisplayDevicesA RegisterWindowMessageA OffsetRect GetSystemMetrics ReleaseDC ClientToScreen CopyRect GetClientRect SetRect GetAsyncKeyState PtInRect ScreenToClient GetForegroundWindow DrawIconEx FillRect GetIconInfo GetDC EqualRect GetWindowRect GetCursorInfo MsgWaitForMultipleObjects

gdi32

GetDIBits StretchBlt SetStretchBltMode CreateCompatibleBitmap DeleteDC SelectObject CreateSolidBrush CreateDIBSection CreateCompatibleDC CreateDCA GetObjectA DeleteObject

advapi32

RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoTaskMemAlloc PropVariantCopy PropVariantClear CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree

vcomp90

omp_destroy_lock omp_get_num_threads omp_set_dynamic omp_init_lock omp_set_lock omp_unset_lock _vcomp_master_end _vcomp_master_begin _vcomp_fork _vcomp_set_num_threads omp_get_thread_num

winmm

waveInReset waveInGetErrorTextA waveInMessage timeBeginPeriod waveInStop waveInGetNumDevs waveInGetDevCapsA waveInOpen waveInPrepareHeader waveInClose waveInUnprepareHeader waveInAddBuffer mmioWrite mmioCreateChunk mmioClose mmioSeek mmioAscend mixerGetID mmioOpenW mixerGetControlDetailsA mixerSetControlDetails mixerClose mixerGetLineControlsA mixerGetLineInfoA mixerGetDevCapsA mixerOpen waveInStart

msvfw32

ICCompress ICClose ICGetInfo ICOpen ICSendMessage

Name

.text

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

705KB

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

439KB

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

IPPDATA

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BANDI0

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=387, id=205, version=50522,

count=4606, productName=Unmarked objects (old),

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=52, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=175, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=73, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=132, productName=VS2008 build 21022, version=21022,

count=24, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=109, productName=VS2005 build 50727, version=50727,

count=8, id=110, productName=VS2005 build 50727, version=50727,

count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=364, id=1, productName=Unmarked objects,

count=205, id=138, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

bdcap64.dll

IMPHASH e52aaf44b77cfb74d56d6f9719b478f5
SHA256 fea38bf24d34003583e5dc4980573c93caeed0042ca34ca7a5a5d896b9aeb0aa
MD5 89bb13bedf72891d0ed00f3f6155f3d6
SHA1 2ee4ac8cfdb9e7362b496ac87651538fcb400559
SHA512 a9d3bd41f1c4e14639f3589ff6073729aacce0b2aab844322e2f034f80acd9aeb05b465ca70bbc99bfee4efc2424539bede24eb453da8f221c6c66e6fd12cee7
SSDEEP 98304:lKAF181uXfm7pyNYh39Hxv1KF8RT6kKQOy5BmkW88lhkavvvvvbcg:lKAFOJKFYKQOy5Mkx8vkavvvvvbcg
TLSH
T1DAD68E83F0E641DCD01B8C70867EF223F9213C1D521856A797D0FA647D6BB80AB75B6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fa:99:d1:4b:4a:d8:5e:0c:59:cf:05:38:a5:a3:79:7c

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

1181300

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\w\devel\CAP2\bandicam\bin\bdcap64.pdb

dsound

ord7 ord6

kernel32

GetThreadPriority CreateSemaphoreA ReleaseSemaphore lstrlenA CreateFileA SetFilePointer ReadFile GetSystemTimeAsFileTime SetLastError GetVolumeInformationA GetVersionExA GetCurrentProcess GetSystemDirectoryA GetFileSize LocalFree DeleteFileA CreateProcessA GetCurrentProcessId TerminateProcess GetSystemInfo GetTickCount CreateFileW WriteFile VirtualAlloc VirtualFree CreateMutexA VirtualProtect MapViewOfFile UnmapViewOfFile ReleaseMutex SwitchToThread LoadLibraryW SetErrorMode OutputDebugStringW lstrcmpA GetModuleFileNameW VerSetConditionMask VerifyVersionInfoW GetFullPathNameW GetSystemDirectoryW CreateProcessW LoadLibraryExW SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeW GetStringTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA HeapQueryInformation ExitProcess HeapCreate HeapSetInformation GetStdHandle RtlPcToFileHeader FlsAlloc FlsFree FlsGetValue DecodePointer EncodePointer GetModuleHandleW WaitForMultipleObjectsEx ResetEvent QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleA GetLastError WaitForSingleObjectEx CreateThread GetProcAddress LoadLibraryA MulDiv SetEvent CreateEventA SetThreadPriority WaitForSingleObject OpenFileMappingA CloseHandle FreeLibrary FindResourceExA FindResourceA LoadResource LockResource SizeofResource MultiByteToWideChar Sleep GetDiskFreeSpaceExA WideCharToMultiByte lstrlenW GetSystemTime LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection DisableThreadLibraryCalls GetModuleFileNameA IsValidCodePage GetOEMCP GetACP GetCPInfo GetCommandLineA FlsSetValue RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThreadId ExitThread GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy LocalAlloc GetFileAttributesExA FlushFileBuffers RaiseException

user32

GetSystemMetrics EnumDisplayDevicesA MsgWaitForMultipleObjects GetCursorInfo DispatchMessageA TranslateMessage PeekMessageA CloseDesktop SetThreadDesktop RegisterWindowMessageA OpenInputDesktop IntersectRect WindowFromDC ReleaseDC GetDC EqualRect SetRect GetWindowRect OffsetRect ClientToScreen GetIconInfo FillRect DrawIconEx CopyRect GetForegroundWindow ScreenToClient PtInRect GetAsyncKeyState GetClientRect

gdi32

GetDIBits StretchBlt SetStretchBltMode CreateCompatibleBitmap DeleteDC SelectObject CreateSolidBrush CreateDIBSection CreateCompatibleDC CreateDCA GetObjectA DeleteObject

advapi32

RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree PropVariantCopy CoTaskMemAlloc PropVariantClear

vcomp90

_vcomp_set_num_threads omp_destroy_lock omp_get_num_threads omp_set_dynamic omp_init_lock omp_set_lock omp_unset_lock omp_get_thread_num _vcomp_master_end _vcomp_fork _vcomp_master_begin

winmm

waveInGetDevCapsA waveInGetNumDevs timeBeginPeriod waveInAddBuffer waveInOpen mmioWrite mmioCreateChunk mmioClose mmioSeek mmioAscend mmioOpenW mixerGetControlDetailsA mixerSetControlDetails mixerClose mixerGetLineControlsA mixerGetLineInfoA mixerGetDevCapsA mixerOpen mixerGetID waveInMessage waveInGetErrorTextA waveInReset waveInStop waveInClose waveInUnprepareHeader waveInStart waveInPrepareHeader

msvfw32

ICOpen ICGetInfo ICClose ICCompress ICSendMessage

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

492KB

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

IPPDATA

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

text

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.BANDI0

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=4608, productName=Unmarked objects (old),

count=640, id=205, version=50522,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=173, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=75, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=132, productName=VS2008 build 21022, version=21022,

count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=24, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=109, productName=VS2005 build 50727, version=50727,

count=8, id=110, productName=VS2005 build 50727, version=50727,

count=3, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=367, id=1, productName=Unmarked objects,

count=205, id=138, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

bdfix.exe

IMPHASH 7369b0157f4ce1e2829722595790c5b2
SHA256 a880f78adfbf2b63cfccaed158ba66c13fd8092d89dfefb7b0cb62243ec6e46a
MD5 35777f658b73ec59db0712a07365a93d
SHA1 fdbd7ad7e85b25eded8d046034ed253b04659154
SHA512 6f39d7681fac363b8247195197c71abd6ea6d02d2bd9ff06189dc8634d82c57e9644728d021154a027f899ed5a8b8dad53868d3d5885a2004f130d46b469b11f
SSDEEP 6144:elIrsdOLIzAyTr4AcrOq1PTDfy7B94yOLGKY72XZrrDUVr95S4mOrOP86UhXu:QI2Tr4PT7yN94yOFY72prroMOr/9u
TLSH
T1EEA46B1177D0D03AC26236314A66D3756ABDAD219F25438B77903F7FBE303919A3872A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5f:b6:6b:5b:f1:95:8d:a8:59:d6:82:1d:34:d2:5f:b3

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Bandisoft,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Bandisoft,L=Yeongdeungpogu,ST=Seoul,C=KR

Serial Number

1a:08:e4:25:dd:db:b3:4e:1e:26:d6:e7:85:6e:9f:b8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2013 - Dec 26, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

156508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\w\devel\CAP2\bandicam\bin\bdfix.pdb

kernel32

FileTimeToSystemTime SetErrorMode GetTickCount FileTimeToLocalFileTime GetFileSizeEx GetStartupInfoW HeapFree HeapAlloc HeapReAlloc ExitThread CreateThread RtlUnwind ExitProcess RaiseException HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter UnhandledExceptionFilter IsDebuggerPresent GetTimeZoneInformation GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA GetFullPathNameW GetVolumeInformationW DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers GetThreadLocale lstrlenA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GlobalFlags GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA FormatMessageW LocalFree MulDiv GlobalAddAtomW GlobalUnlock WritePrivateProfileStringW FreeResource GlobalDeleteAtom GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA GlobalLock lstrcmpW InterlockedExchange ResetEvent SetEvent CreateEventW WriteFile TerminateProcess GetCurrentProcessId WaitForSingleObject MultiByteToWideChar GetFileAttributesW GetModuleFileNameW GlobalFree GlobalAlloc GetCurrentProcess GetCurrentThread GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryW GetVersionExW SetLastError FindClose FindFirstFileW GetSystemTimeAsFileTime GetFileTime CreateFileW lstrlenW WideCharToMultiByte GetFileSize GetLastError SetFilePointer ReadFile CloseHandle CreateFileA InterlockedDecrement InterlockedIncrement Sleep LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FindResourceW LoadResource LockResource GetFileType SizeofResource

user32

PostThreadMessageW GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW ShowWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW EndPaint BeginPaint GetWindowDC ReleaseDC GetDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW PtInRect GetMenu SetWindowLongW IntersectRect SystemParametersInfoA GetSysColor DestroyMenu UnhookWindowsHookEx GetMenuItemID GetMenuItemCount GetSubMenu GetLastActivePopup MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW IsWindowVisible GetKeyState GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog GetWindow SetWindowContextHelpId MapDialogRect PostQuitMessage RegisterClipboardFormatW UnregisterClassW CharUpperW LoadCursorW GetSysColorBrush MessageBeep RegisterWindowMessageW SetForegroundWindow GetWindowThreadProcessId GetForegroundWindow GetWindowPlacement GetParent IsWindow DispatchMessageW TranslateMessage PeekMessageW ClientToScreen SetWindowPos GetWindowLongW MoveWindow EqualRect GetWindowRect OffsetRect CopyRect EnableWindow PostMessageW DrawIcon GetClientRect GetSystemMetrics IsIconic SetTimer SendMessageW AppendMenuW GetSystemMenu LoadIconW GetDlgCtrlID

gdi32

GetWindowExtEx GetBkColor GetTextColor GetRgnBox ExtSelectClipRgn GetMapMode DeleteDC CreateRectRgnIndirect GetViewportExtEx ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible PtVisible DeleteObject SetMapMode RestoreDC SaveDC SetTextColor GetClipBox GetDeviceCaps CreateBitmap ExtTextOutW SetBkColor GetObjectW GetStockObject

comdlg32

GetOpenFileNameW GetFileTitleW GetSaveFileNameW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

DragFinish ShellExecuteW DragQueryFileW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleFlushClipboard CLSIDFromString CLSIDFromProgID CoUninitialize CoTaskMemAlloc CoTaskMemFree CoRegisterMessageFilter CoRevokeClassObject OleIsCurrentClipboard

oleaut32

VariantCopy SysAllocString SafeArrayDestroy SystemTimeToVariantTime VariantTimeToSystemTime OleCreateFontIndirect VariantInit VariantChangeType VariantClear SysStringLen SysAllocStringLen SysFreeString

data/camera.wav

SHA256 d856e3c9d20acc682b3a076180ebbcd560607159b910f4705c012fd4470acf85
MD5 ec6ecb71cc2fd90903119d21f4d444b2
SHA1 7c18713e23df3237475a1236a61625117132dd6a
SHA512 6c5f1439b0a0b9e1cd68e680264dad8fe412abe1760b21d894bc3b3a67121f158b0a41d7027a621df81b542729fb9a045cf1354293b91db21271b1debc728492
SSDEEP 1536:oMrTs6KLtrrjNeZ9osUtOKzUn2FtlBjyQYR:oyWtrrBQ90tOf2/DjyzR
TLSH
T14B63E1B7A161EB4898BA42440CC69C8D6FC5FA5B3C40CDEB3179DBD1F29B207AD62315
MD5 SHA1 SHA512 SSDEEP TLSH

data/effects.dat

SHA256 6a94947827cf2d12b8cc203bfc38633ab2bb46ce6bca3a365b5196f0cb922272
MD5 8125c864b0d52ff4b3230f7fc8c5d553
SHA1 eaac2156ffe764e5705eaf8f8c7b40118f82c933
SHA512 a5640fadb9e8bdfcdc3c8233da3815625b16bec0a4af83d543a46bd1c229db07fa9dc3807e1e91bc57cce403c2b6ec0f72a644782615af99741b76dc9be83406
SSDEEP 384:W0iffgELVx2QR87scMW3SmuwNUTtupjWbzG4QiJl6E:W0AVZOAYxe7bzN6E
TLSH
T1B443901EFF29E52BCC0D13338CA7C2A83B38AD8D6A0687573559B77D7C362584D26126
MD5 SHA1 SHA512 SSDEEP TLSH

data/language.dat

SHA256 e42bd3dce5a3995a6876a2e929153261cb0853bc497df53d80c7b4601d9e43d2
MD5 f89c0f1bcbda52aa6a01a103ecefd010
SHA1 c209430f2072c9e614ad94254bae4d9c41a5db7c
SHA512 4527adbc23e56788dc1c5e359e0453084aa03f009dedb55813aa5cf6e45b782e36c37bf5b88788ed611517a68925e00e82903740ad19ec2f85b1690fecf1b837
SSDEEP 768:paBdPLqHYa8vTo2ecMv/mSHA3HCiOGlExMpgdepWxPQBhK3EVwG1rBMC1U1PCRWF:0C4a8vTIfA3HCiOGlExMpgdepWxPQBhk
TLSH
T12003506E1CC71AEA5438F2982A6ED7520168ED331CB950ED721C5D8C5F216058AFB4FF
MD5 SHA1 SHA512 SSDEEP TLSH

data/sample.png

SHA256 2854cf8696cbd586ea031fc6f567f05edbb5a4c4a7a997a61c300ce58f3eb6c6
MD5 22829da7b56a707ab7fc6a1945db1f2e
SHA1 a43969546a9635f453bec01faf2ccec4f622ad1a
SHA512 c499967991e9a6a5c14b8ac59905a431192b55feb4843a9e6307381b029853442d096e917578af580952ba7f37d43762a430d635900ecb38098416f7d903484e
SSDEEP 192:aSHIIHUCD4wapwPMTFbynWUIsI0quPRk8cTazkDp9X5o:V50wCgMII5I7z8XC
TLSH
T11B22BE0DC8419C5A11C44B6C38B759AA972BC3E0839766548EB6920F4D30B027DB8AA7
MD5 SHA1 SHA512 SSDEEP TLSH

data/skin.dat

SHA256 8618c9d4f56f48a489ff18b4ea5361da1e72622c83ea282b3d17e5e6049c4cf0
MD5 a1eb5ef67d3fd64373a7695f8c5d0f32
SHA1 8d8d4b64939d2a6cd790e2b92fb6c28a98d2d899
SHA512 52c47f2c0bd9846ccb42fd7dcce91a07e6e7aea143d645efd5dce010eb9f49d0b95629a99268f51167b5353ba37f21eff38c425e8af8b1981d14f0490c7d3fef
SSDEEP 3072:xN/JIL4vZCdyuxOAoWqf5fcGLxQcnE2WeM/9I1O+LgyRZBZI0E5MiRK+j0EbBEDv:oyZ41zyfcGFjPM/9IDbRZIs7w4
TLSH
T1EF74E743AAED1408F096AB65ABF640221F23BD40613DDD2964AD5E0D87A7E913C13FF7
MD5 SHA1 SHA512 SSDEEP TLSH

bdcam_icon.png

SHA256 a1650f3597368d206b3b8a5d8eaa4c3b24a8b1e82cf01326035dc813b3c5e3bd
MD5 74292c68364e6204050bc08d17cc95d6
SHA1 90369a2ded47b1724d0bd545c0d93e6ecf35d2cd
SHA512 b85f1ff3e6d9efa3defae47e65c4af1ddcd1fdec6df51556016cfc54df3f9cc5eb37f830e78454805c82c653ec3187cebdf690f760bf64793aa9d1609bbd7091
SSDEEP 96:PY2qYK4Wrx5L4EgWz2TUrl8Kz3Ys5xiK7qDNu+y/w61kv0vqnR/TPxiem44gAgQn:Pybh3rl8KLYs5xiK7qDNu97lqnR/YeQZ
TLSH
T126B17D1FA7827C87857D158324A764326D1A00E3B1E0EC98A2FA901F6C7D2B05A0FDE6
MD5 SHA1 SHA512 SSDEEP TLSH

body_bg.png

SHA256 318fd89babe0ea9673f42e2912efe33a13ce70634a8a359ad5264cc76c991ed9
MD5 9e9f050635d63d361857f6f4da5fe0e7
SHA1 765abd918e0bdb57ef6914553bb3239e39810c70
SHA512 5147a880f3b019fa47e34b6aa76db391ed0c10dd8e0e0a540e217654327dc0133029fcbfe8aa619a79a0a4ac2e3c5e93304ece1cca29fa614a36d8527d3f0d49
SSDEEP 192:JSHIIHUCD4waQjNOAZz7krzFC6yHlnY5y4I0DJbIRW1sD:w50wnZOAZnsRvwYU4NNbUD
TLSH
T10022B0C9B6DCD82410998CD5383DE44B023646B0F32F4A54DC7A578EC6A1A92EE3CA67
MD5 SHA1 SHA512 SSDEEP TLSH

body_bg2.png

SHA256 49992a6e3da4e5e4e95a9791e5bfffcd92dbe35411c727d9dc7bd02436fd656d
MD5 df54209dddca5dbb130099cd30a873f0
SHA1 5d22f40d1603b96dad97f6527d3d602a13734c7f
SHA512 a87370b615fbadeb5755a18ad24e411e75b5846fe2e1416402850e4af28a9d8fe8b13518720cee51f14f7d19d9441b0f686bdff6122e66c7f86187fdaaa3f079
SSDEEP 192:JSHIIHUCD4wapaQJVF8qxKHNM4WMQzlw+e76OQzt8MxTOA+TYjFtRcT:w50w8aQJ/RKtjWMK+kp+TYjXRcT
TLSH
T16922AF48ECD6964F180B0DDB5D3E7E150B979644C3280EF2AA2B6303D374DB4A870DB6
MD5 SHA1 SHA512 SSDEEP TLSH

bottom_bg.png

SHA256 729c2ccd2bc401f9649064450267b708113f6a6940f4a23b5d2f4e6d1f75367a
MD5 1afff795873279b4775ba97a7435c50d
SHA1 90253a37e89ee263479673ebe834d1109276ef1c
SHA512 5d5dda768b69d3cb81a36f749ec052668b0e897ce6b538ec551f8030fe79286986ffefd55e4c8b0f1c729d8d0aef03f066cc24fbb20610d70740ea03dc9ada08
TLSH
T1BC515C899840491A100A0BAB28BFDE064A27E7C443896E189EFE820F8620C517C35B6F
MD5 SHA1 SHA512 TLSH

btn_capture.png

SHA256 315e9a6e3a966506360f80752fe717d1007057ca18393fbf79838193ad181a14
MD5 a7d5e3f39770abf2620d86e224b5de93
SHA1 3b66ff5417e5b1953918f0e8bf475e878c85758d
SHA512 864e90c09e51d8b400ff5b8f9dd098c3e077323b22e9f1b6c9c38a836ad0f6a1ffd94efe964154afc22a14a3d8f370a24014e5fea11bc2ea20ce1d97e6aa4e52
SSDEEP 96:oLY24jtlOMo5aB2Z7T7MQVNk5TSOIYHoGui5o/wMTrO4Bf4:u+DP29nfNkIrzFz4
TLSH
T156C18ECF76701D51A99BB80B6CF88807E91E48D5E4C1B84E374FD5F31E1007964AED46
MD5 SHA1 SHA512 SSDEEP TLSH

btn_capture_2.png

SHA256 5c4f2d260ae0d3221972655f2e32e3b54bea95e61d6fdab85410e04ed264ff03
MD5 7bf59ea91c1e49b0e3ebce156c40ca16
SHA1 6aec7acbe8f848517a72ed78489af24690dfefb9
SHA512 e68b31aec72e7fc6f7d4f118d05e9fba5dc268c4f81f89303bf02192354ed1f7b23b8cf29f94ec40e39b33161f943f36ccb0d91eef85f3a83bb8e3eba0fb1460
SSDEEP 96:oLY28V9VUywsomI82kEwIql3gZL59aJ60qgav2O2TJLEgR3UhK9yIWBP0YC:ueHMqH2+Iqlw59i6Lv72TJQgR1IlHC
TLSH
T168C18D93F1A4D90251F3F9D01866E4A5911672C0C6D0A9B74D48F0C529762F0BDBBCBA
MD5 SHA1 SHA512 SSDEEP TLSH

btn_check.png

SHA256 4cd4e78ef2b6ed6459633c898905cc69d69b387cacdf2f427a5b1b04f9aa74f2
MD5 0caaa56994c07d5da8c146ffbb482961
SHA1 4d6ad6e235d95aaf714ecc73f39a89178b47c773
SHA512 7c9c538b906fdee536899623e431409f1dc59e9ed925f22f797342899b32ed62aabeb2eea436d392e669786392a1f1adce01142545737a21c447dc1d5b3c740f
TLSH
T11A816EC98490404E04464EEE18BFE9494937AF90536A5F0CBDFC875E9920C52BC75B5D
MD5 SHA1 SHA512 TLSH

btn_click.png

SHA256 7b08afc2a6e1ed12b5ee1d3759cbcfa1e02072872dbe0f6df46bc7dccee860cf
MD5 ee5c7f89104e02b1dc32c3af38d295b2
SHA1 d36688b28e5f5102ab4d739e967689bbc5dbe5ff
SHA512 5fbbb53cbf0afb0885b0e546b2fbe64d535a5f2add4db04021c4a77973caaf7417c87f5fa1489462b362aea9c7c25df61987957b6378622f5be38a53fed98fcb
TLSH
T19B516D8C9804456A100F0ABD367BD901462AEB94939D6E0CDDFF834E8A24D517D72F55
MD5 SHA1 SHA512 TLSH

btn_close.png

SHA256 3fb2580d2a3f71253e3ca2a0e9bfa133affaa384b26eba47ea2d1e8e0caf10cb
MD5 c169fb7235be8675134a0d3adb59a0fc
SHA1 46b7020f2bbd6ade10a802347d69ed78dcd83ebb
SHA512 d04512fb67d5e952de0b7d31e0fb773f9f0d08e27c31152e99d931813da67006dae6e9391295acde7e1650de50fb40e5db9360cfee5e89f7d1e4374e8a6a9ccc
TLSH
T16F718D889510862E11490AAE267EEF05CF0FE7A063AD1F2CC9BD430FA024E607DB5683
MD5 SHA1 SHA512 TLSH

btn_directx.png

SHA256 f5b36de6d7ffba3f47bf8ab669c96d7a518fb3a4698371cfd664db232b0594de
MD5 0169a882845a50664791a9269f2b02ea
SHA1 5f5c3e635316863afdd4ba32e1749790eaf977c5
SHA512 857a534ec19a4b5c0ef7b0f981837c3d00e7d06bb0788c5c92336a453dd6150372039061e37e4b9aebbe8c5d3c10c5aa715d24abd1cc2309b77d6728ef291cd7
SSDEEP 192:rSHIIHUCD4waf2h2t7P+3DTXy0BP/sBgqDEHOTn9EffC:e50wI+9Z/szDKQ9EXC
TLSH
T1E502BF9E1B10040B264E0BA6397DAB865837C78991DB9C088DADC368CF11E817D72E6F
MD5 SHA1 SHA512 SSDEEP TLSH

btn_directx_2.png

SHA256 9c253780db559a93d6835d1eef064eb605e9f8896e57ffc91a5293eafd859379
MD5 8943d46f8fa27e30fa233ad2945be96b
SHA1 c0ff541472c2f742cc48409af10a18abc5f6ec63
SHA512 824f7c36c997f74029675f450bb7ecd39de1cee2007689c2b214d9033a99a830517c214e4bcad241d095f3a8477a1d50481743f43806c7de4b5194098e7b217d
SSDEEP 192:rSHIIHUCD4wahArOIACECVKkU8TAy/lfI:e50w9OINsDg/lfI
TLSH
T1DAE1AE8C185D86062A4649FB157FF888086A9B9987D83F84C9BDD09F690CC5168F2D16
MD5 SHA1 SHA512 SSDEEP TLSH

btn_fps_check.png

SHA256 025a5d0f4a2a1feaee4bdb66b26691ea61c623afafd95308e9b51fbc8b8678c1
MD5 2857c7a6cfd17d6a1923a0e2ad3b4d1b
SHA1 ae198eba47d80883ef062f329ab5a4b54fe7b4c9
SHA512 86eccb4118868ff2654e954f32db58e6d1b2bc56438972bfc368a99207675f963288b94af22692304a9de4564bd490c68f597cf50a03c25471c6becb24a4194b
TLSH
T130515D8DA440445A10CE0B6A396BD906466796C0538D6F1CADFDC34FCA21C613C75B5B
MD5 SHA1 SHA512 TLSH

btn_fps_uncheck.png

SHA256 6f3035f46fb271333dc9626d388da5c12dae37112921c3baa090d8f1c9147975
MD5 d7f8a378953af4135a8206829462fc3e
SHA1 91ee0e3da15dc8dba0f34cdf661c0145ab250a4e
SHA512 8d501b34a4b0b3b122df70c7510bc46809f3433e335eb0b0be8ae837600a96bd5dd46d053998523485cee87feba5cca46d1e35556503161b115767c4f630b9d4
TLSH
T191515C889481056A218A0BAD39BB9A068A67DFD4935C1E0C9DFE830F8621C917D71A6A
MD5 SHA1 SHA512 TLSH

btn_help.png

SHA256 043ba2930022c95228dd672aa3422180fa0fa058c5d85e0043275b108c1fa483
MD5 91a262c03608739494fe6a8158c75ea9
SHA1 c240d50efb2ba52dd5ea5706bb560636e9f8623d
SHA512 1f53a44aaefb9aa3e266c94b3972ce4d0b38df5f23f76308e7c26a5793b684197791deb3348362e5ba78495e409046c5f7b7acb8947cf44f0e79e9c8dd0f1392
TLSH
T161512B4FB982D852E2A5E08610FA8957BA760440D790F439E2FFD89F9891237C9AC0C7
MD5 SHA1 SHA512 TLSH

btn_key.png

SHA256 64c72627b7afeac97add9778ee1bd1f758bef8a3833579688308b8ac7a6142c8
MD5 b04489fc3551cca319cb7a6839bae4b0
SHA1 8f5b726d06688d90a41fd9703e05b4ad0a3f6861
SHA512 bba8836d27d1be317bbe15337072d9fc2a7ad0bdb84fca8cd5f865ba728175be5c95b28a15304e5a0db0fdfffbf6f4bf398c27f0953ab41d262c97dd0fcad5c2
SSDEEP 96:z4SMllcHitlIxv9vk7C1+I4wWHLihk/xM1GRjApjjDhc+Vrz/:z4SHIIHUCD4waWsqjDhc+Vrr
TLSH
T14BA18F4D8450844628CE56573AFADD068D57B7AE23491F18E38F425FC171D033E9875F
MD5 SHA1 SHA512 SSDEEP TLSH

btn_minimize.png

SHA256 f93b6b3815205de986d2a9b0d9df3b579428aec29144a1dc73a6a5134497e8b8
MD5 1a3d5c0fa1c9c45e0c9d598168cfe462
SHA1 e5813528b5931925fea822d241570a18b2286cec
SHA512 ce52b897f22df1bf36802a8647ebf79e22867d54a983d6692501aff0d0df274c1271e8d7bb3f62290420e9ce2125754ef88338847ca0c7d877c95cd4a5e33b65
TLSH
T148617DC95040491E510E0BBF3A7BCA010A27E7D0B25D2E0CAEED824F8B11C117D36BA7
MD5 SHA1 SHA512 TLSH

btn_open.png

SHA256 49bbc6ccb7e0d0042fbfc0cdedd82588e3414bd01c44d0abfe2f8ae9d6a10652
MD5 8ad242ef7147eb22a453ecc787a6047e
SHA1 f4c117edfdb5a56e0dbfb6401a70931c2585b487
SHA512 9e27b5c87215216ab22b78eb6108c0cb10337d5d5189fc2da06dd5fe0d5f928dda9c8efb9dc2f924d1bd50c6b09b206f6ec2a82548813c6ef95325b1b001fe8f
SSDEEP 96:+SMllcHitlIxv9vk7C1+I4wWHLihk/xukIx+e5d5ouqQ3SYFJqZS4/4VyMonB6Xx:+SHIIHUCD4waYkDgxqQHWSI4UMonB6B
TLSH
T189B1AF891945571E500C0B8D212B9E028A9BDF4C471A9E4CEBDCD1EFDE14CD434EDA5A
MD5 SHA1 SHA512 SSDEEP TLSH

btn_pause.png

SHA256 8faf4426ff6e50be37bc56306473c309d6615f7877ba9a4dd7f95950e90cd054
MD5 cb8da2fc5b3566c8a92a45055af6ccf6
SHA1 4e2bf0440f8b6c84b0cb591007ca3a230857f8b9
SHA512 52a14aa9c7b7933664114f6d59af80af2648120489798ea0a327c587c7c578798743fbb75e7f3dc91d93a296f623ebd860931031aa9f8b146cb2668a1975da08
TLSH
T1D2815BE8FB2A24023655B65A64D50032B9260E528498E423D18FEA7B3F3D3F6814B6C2
MD5 SHA1 SHA512 TLSH

btn_pause_2.png

SHA256 37d3a59cf114bddfa3835ba5dace24cb2c82c04b3da24832185f29ea57b3d69b
MD5 c4bc9c5b90602e60ba1ca35cff51ef01
SHA1 fee9a469ad095dcb7927a0b85198284872c2e971
SHA512 295d3f37ca628c64cd3e62904a18a967bb12fe5cb06593a50f7bde7ebc371b74547bed5805c3df7d1b8dcc35ddac4cbc1ac7d2e3a40c340a168fbd40e868eb6e
TLSH
T15C816D4AB76029E1D4D5441550F6D431223316022E347B1276DACC4607796BDA9EEBD6
MD5 SHA1 SHA512 TLSH

btn_record.png

SHA256 90716368f5f45d8420e373c3f78f2a6e16cc878aa870fbdcaa9ba9608a6ab9cf
MD5 523a37742bf221cd85fef0d6afe0df43
SHA1 9d99af4786b90faa25fa32f5ce126aff3379ca3f
SHA512 a002c137823d4100e8878600dc5a65f917645ad8f20ea6cb30e1bb690634ec22030a9a9def41b3eb8a55c8988297edaf9ac370a0852ef152a29f9a1be5211d1e
SSDEEP 384:4OkdvxOl0niL1xvxPQf/9JxmVszxlIJMGAb4DkW1squI5T:4OVl0n2vyfVSVgYVAbg1D5
TLSH
T13682D00FE2164890CB6CF8FFE8FA314B46519C61855DB32C762F6124D741832C82E6AC
MD5 SHA1 SHA512 SSDEEP TLSH

btn_record_2.png

SHA256 6acb63b6ff370a07b0ccdafb9c5173c1fe224012efa6aa683dbe1fb0bee83d03
MD5 5ea2608468e01c4b30aa4a2528e0c86c
SHA1 d0735d9fd74397ec6d0d3f9440b68f6c096f63ba
SHA512 71ea547b3d92606308c4b7e50311207b97f22141b122f37b5df67ee4df4a13de3dc992aa380f58b3aa63e5933ed80683215679c3d8a98a48decc1e84da3161d1
SSDEEP 384:4KJ5P+XGb2zh+gDpISidDR6gvPSeqJ1n+oZh7bTTXoSiL231aDf:4kr2zhU7FR6sPHan+oZhvTLsa31aDf
TLSH
T1E572CFACD8265C31694605E90FF108546CB2B2D070ECB203A94B9C7ADEA7DE5950F2FA
MD5 SHA1 SHA512 SSDEEP TLSH

btn_rectangle.png

SHA256 7b90acedeab5244c43832b09f8dfbbdde3a4fda27217f4134c941ad7049ae761
MD5 30e93a015e9d20a9990f8fbc0f38eff9
SHA1 83e12a56b6331fdf29bece3861c0f0a6c60e4874
SHA512 312268d8b1c377759e155d710b7bdc27adbf11e1ae3ada7644dba06dfbc6238c591544197749111ae4170b0cbc6d1cbf4c856225146ca41f8c0d92d808892d02
SSDEEP 96:rSMllcHitlIxv9vk7C1+I4wWHLihk/x1WwPe5immzouP8ye6Bf+SHUY81XpI4ay2:rSHIIHUCD4waee93o1ye2GS0Y85pI4at
TLSH
T11DC1AF46A4260309120F0B3DB65E59061B23F98487691E6CE6F8425DCB64CE56D37B9E
MD5 SHA1 SHA512 SSDEEP TLSH

btn_rectangle_2.png

SHA256 b735453ef1a7da36bb047ef9c23b7184683314db1f25a5eb4bb517ffc29e0d6a
MD5 af3aee41fe0486356a7b430e2ba63c7c
SHA1 b36002b76a766ebd67b2beddb7eb40e6f250c3e2
SHA512 f070dfaf8bd45e68a2ffb3e69369f851886240c99960084fe38141646a4b951ad1b2927acd29ea58665b19039922a73b4d638a1cf5a1ad12d7b8650b38b637ff
SSDEEP 96:rSMllcHitlIxv9vk7C1+I4wWHLihk/xHMIHYk2g0Q84ROY5m5x5iXUaz:rSHIIHUCD4waB3HF2bQ861z
TLSH
T1B2A18E498C14881E105F0FBB613B9E08C52753D5528C2E2D65FF911E9B18DD1BDB4F67
MD5 SHA1 SHA512 SSDEEP TLSH

btn_setting.png

SHA256 3dafe46ea31847d9343e1e8d6dba73222c7feb30c5a26d970bba1944c7b54c94
MD5 53b4fd2d129200a7b24b1d058ba0c1ff
SHA1 8d5914234b0bfefc35d10366f64e0f92d3d18a98
SHA512 80e32558ff4c67d1fde873a5f56a306700f6a3407990c5d4b1f05b473dee27f8ed3986063df1061e5fb7699b3be2d2827afea8f70613c8e0bc87e18c695d8579
TLSH
T1F541F709FD32C850478FDC4528E5592366136A8399F2E16ABE4BC00F0CB93B70AC95EF
MD5 SHA1 SHA512 TLSH

btn_setting_2.png

SHA256 f189d265c1bcb68a279b2f3ff3ae940c3125c23e4e71bc7c9b201f00faed5a5c
MD5 46bdbc984f30854de01117b052602b1d
SHA1 e0c33fc439634116a618610f72f33443f5bd6fc7
SHA512 7a84243a95aa8900723f5cf7f01a1136914fee190d63c46473f2da2db0be7a6269878c882ffd311ee9b8751e9503aa0606b78cb416c1c1a65ae9bc927d4de4ba
TLSH
T11941E883EE716E825347F4A589D8D063F2730542E8D4B2956496C83F28312724C7D3CF
MD5 SHA1 SHA512 TLSH

btn_settingmenu.png

SHA256 39613f9dcf1aedfe29b5bc2c84ecff8f10e88c3135165d75b5ede67af302e175
MD5 e3c0ec4d25d69aa572b59336016635a6
SHA1 7baa3b2767719ee0f5f91f3cc12e53896b1b5f5a
SHA512 698824a0e40197153e551cb15272bf94c1962b902493484602890182335f9633eee71b8a51c1ee36a1ff4389daa0f27029971002c9667f6b937fd5e79ff1e3da
TLSH
T123514CCD9982251A124F176B24679F02471AAA9153CA2F1CDFF9C38FC762C613C71657
MD5 SHA1 SHA512 TLSH

btn_sort.png

SHA256 52a930e60bf787aa06d26fd0e9b9484988e5cd1a15713f804ffb705dd8df89f1
MD5 8036a089c8f2911aaa8e7d8ed0ef784c
SHA1 aa7faf4144d9f1b1198c3a7bc30139a7deb03c26
SHA512 b1ad2ba28d3931997858a7300363f49aa799d4cb70800b394740782d5c51b849a469cbfa46b31281be0e69c8f9bf6bc6a9f0080f0e93e6b10067e6b03fbf56bb
TLSH
T13221C6DAE7443402E185D88168E30027DE528980D4D1E81268CFC45E0D7E3F29D4E2DB
MD5 SHA1 SHA512 TLSH

btn_tab.png

SHA256 6053cdee7d485c5469a65362cbcd94e20dd4fe8abf342d1ccface9bf5f0d4a09
MD5 30b0c353ca009bf5f73a999751e14250
SHA1 df3897d2f44c9848db0a9033f2a212ac46a03b7d
SHA512 21884d1f6e617262967e17474cc54935b9ffd7fa08ed87916355c4c94368fd14749a9ce7f085b37be74de304271c0307186df1c632dd83f6f0c201dbb4588e8e
TLSH
T180515B885840095E100A076B397BED064AA7D69443896E1CDDFE824F8620D603C75B6A
MD5 SHA1 SHA512 TLSH

btn_tips.png

SHA256 407c61434ea2fdff4e56d789c8f0a476225eff2068154203a2c52a597ac40d73
MD5 93873ffeb3e0423d95e0894cf84a66cf
SHA1 ebe1ff8f0de71239a565fef424d23ec9f3ea6109
SHA512 1c6391c9762212249edad40a31623af88087be045bad6465798bda2fb3a64ab6b6cfabeeb28cb3e828de7e294c3ea2fb152d77a021527952722618478908ebe7
TLSH
T106512D4BD712D70591C8F91078D5601F394159D0C5DFEA2666DDCD261C2E2DF854874F
MD5 SHA1 SHA512 TLSH

btn_tray.png

SHA256 b51cd8efe5f908afa9fedaffdc25340f192c091110b1a9e73e29144298d23d0c
MD5 0e68cb477d5597685ce791f30d47685c
SHA1 52aec7d0982ca65ccdb720ad26f8857037b5ae7b
SHA512 70c902a01d3f756a027ddc43d26fd55fd3a7b720c9978aaafa61393f155780b20fe061a6944c5fc35affbb2951c036e855a5fd6ab84e542d8b00fc51a2554522
TLSH
T13B615C88A4500829144F0AAA367BD8154A2BBBC4A3591D18EDFE830F9B20D413CB175A
MD5 SHA1 SHA512 TLSH

btn_uncheck.png

SHA256 8cd75375804d4222a2090e4459cc071100b49635b019a82f337d5a490e90c715
MD5 744d3c03195d8fb907915826311beae4
SHA1 5cf1b0d083df8e5c2fbea0425a128baa5cb65f62
SHA512 6f40eeac0d8f7712ced927f35bba261f4edacb848782d82c27df87ec29a197509b1f1bf8c9aef981364a87081ce15f29534fd396773d9fbcd4841f1bbcb6055b
TLSH
T174616E4C58440A1501C55B76357BD9468A2BF684C39D6F1CCAFDC26F8524C653C3467E
MD5 SHA1 SHA512 TLSH

folder.png

SHA256 d1394d4b2bdfa3d655e37067c6f1c84de0e3a1240ccaf1575c14e98592bf4daf
MD5 84e8da5849b4c00a980830663f287eaa
SHA1 9698eb2462abd1d95fb1aa7f9350ab20742f7500
SHA512 a2ab7cd20ea09b73c06cc1b78414f95503f7cbc249b22155ab4fdac831dc1d1af5e0bff95a3ac9076358c5edef30192e3abe3071f9a4bff81eb7d15c94bdab62
TLSH
T1A4518E8C5800555E114E076E35BBEE054A27DBA0434E2E1CDDEEC24FCA31C607C7575E
MD5 SHA1 SHA512 TLSH

fps_bg.png

SHA256 084302737d61ff58f5def46064024e64e819cd4ec6de7774e048092e509e4409
MD5 6c80e76604f1fe43dc64340f11275e1d
SHA1 d2dce6a506ceb8b7b3b6d5bea67680812e3483c2
SHA512 32c530dcbd474712f165f71d22ee3b7f30a3723304125c614aab4ba2b2bf06aede8a323a6cab88cc18dad26ef5ee9d91ad3012984d51cc60217508513e904f52
SSDEEP 96:EESMllcHitlIxv9vk7C1+I4wWHLihk/xXbafLRmBhd5kQfExgO8nxsD/YNmdJACb:bSHIIHUCD4watadU50uKDANeXvD
TLSH
T1AAB18ED698004C69308E52FD3A64CF2B4687F29812086D49AFBE444F4621EB4FE61F9B
MD5 SHA1 SHA512 SSDEEP TLSH

info_bg.png

SHA256 ad8aa59cf98875908fb16f33643a363a4bbb86cac478bfe584a63f30491a4354
MD5 c054a8714f84bb375024be9343d78cef
SHA1 3135af32905b8e95a98cec56c8554a0dea99893d
SHA512 adbc7695a4f84f12a3d6e25838b5818a90273050728577b32e4b7112e7cc6d95e03b5a52df5cee72e0677c0424c092a4a2d8ab057221e630784889c2dd64120c
TLSH
T138514A9DC4404D1E100E0AAB2D7FDE064A66E6C883E96D089BFFC34E8A20C613D79767
MD5 SHA1 SHA512 TLSH

leftside_bg.png

SHA256 ba3bff390a8daa37fc781ca251f917587bc31064c2495e737a07417c958bc7f4
MD5 3626212b175eec5a8cfc1b34fe07b2c1
SHA1 2d642ad39fbaf35757e3c7c2ae396a6e6afbd797
SHA512 42397e47f341be3d06f645f49f4e628f942ca9478140a66531bffeb57010ee60da15f1dd4a8d30184f24406b28aad0769800adbe365970aaac39d2c3858bbab6
TLSH
T18D11D4C9F6509840A28DD88524FD443B99334C80D6E0A1966BCFC80759EA2BB6D6D5D7
MD5 SHA1 SHA512 TLSH

logo.png

SHA256 a2b2671daa211995685922a5d5999b82e0e6553e371241c739e51380209d74b8
MD5 efeac36f642746e6080e6f50600b6e9e
SHA1 a99cf187dd1e1020ccb868b3bd88be99317af9b1
SHA512 58b869847c211ecf12dec0b574e8bc4809b4b9fca824bf12f65f7143a860e7ec34250389940bdd703bdccad1905d68d99dd536226a3fbe11c910e2c994f1d33a
TLSH
T10D512B8E7E425C5091AADA5280F35227BD335D82F9D1DFC5A099D0570F2515A87D48CF
MD5 SHA1 SHA512 TLSH

page_about.xml

SHA256 48baa4d5d2c7aa485b1002e574a022f66d47224a75920c770d1852132c12fd9e
MD5 4816df8396687d22aa335621838464d3
SHA1 f272f252992f93771fd5d307d23f4d432d1c7c30
SHA512 d73a53da6bb5748d8af5a533eb28c0409367736e5ff605506cb75b553758a31fe6ec072d2de994b8da3c274d437e5e8c3586fbb8929ff4d1d80c3a7a8ff5ef49
SSDEEP 192:Xl6qMPZbvVkNG/GP5WW0iRc1Hl6y9VPJNrq9VPJNrbvVkyG/GPbZvp9W/uqRKIC8:XSZI0E5v0iRKQyjrqjrj0EbZvpsMICfU
TLSH
T1F7223C536AFE2018F0E6AB55DBB640621F27BD50643EC459606C2E0D87B7E815823FF7
MD5 SHA1 SHA512 SSDEEP TLSH

page_fps.xml

SHA256 884b0a216bc1ee3e56b94117bfafc3629dff3082e32b7bfa328c86022f1b6b2c
MD5 d9fa977fa709a3d04e5968ccf9442870
SHA1 2b2856c4831aad0a457faa83c8571692e12846a5
SHA512 b1d20adcf50491bde441459bb1d22d53dc27f9c393077642e6de883c089aca5dedb0dd1bd00544a2956c11106f7c4c2495f29df2a9062646889544f23b76554e
SSDEEP 384:XSyjnE+4vuQvzQsR9EvuJlNo+uJhJADIIJHJmLinEn4vY/OzHsh9gvYuQowFv/+K:XSyjnE+4GGzXEGLm+o/CI+p4inEn4w2m
TLSH
T1D642F95366ED1119B0E2AB599BA244311F27BD54243ECD7924AC2E0D87A7E813C13FE7
MD5 SHA1 SHA512 SSDEEP TLSH

page_general.xml

SHA256 8b0e52593796cf80a022aabf996f151ad21c96effa047b6a513b07dbb78c53c2
MD5 b198e2bcb71e0ab6e8fe61638b356c71
SHA1 3046457e747ae21dcdce43f6611f363feb5962e3
SHA512 d0af0074726bc904e0b1456e2286d691f611abd422fbabb02c89be8c609d263e93a7065fe1e92162899259a01b6569df64dc0cd16c26fbef32fc007c8df6a00b
SSDEEP 192:Xy6qMU6bvVkPGUGkCryPdtWHVk0dnVmDsHnV2ZsVM9W/pqRuKktWBvonVe7/PaOR:Xy6en3C2VcHVk03mDs12ZsVMsLKkcBvP
TLSH
T14E224A531AEE2418B0E2BB55DBF641725B27BD51243ECC69206C1E0E87A7A817813FF7
MD5 SHA1 SHA512 SSDEEP TLSH

page_image.xml

SHA256 067638cb13bbaaefc3d68a3b8df4feceea848dde0627690cc3c7490f708abc48
MD5 575957cc637dee6be1a4e76affcb4273
SHA1 238d65829b2e871108ae3005205726e939cbce0d
SHA512 215e60da1c01853584d555129b125db3b23fa3602741420509b717356582b9ddbb423f4d08571278ae1ef5666838e6b5ccc22fa6ef7951d1311ad1a7348006ce
SSDEEP 192:Xl6qMPe5bvVkaGUG8+CWWYpWWP0zo9W/WqewA4WWYjw4WPZQWWCMHWw79W/rqWo5:XSe5jn/+CvY4PzoshA4vYjw4WQvCMHWq
TLSH
T17F12D85366EE1119B0A6AB45DBA640721F23BD50243EDD7920AC2E0D87A7E817C13FF7
MD5 SHA1 SHA512 SSDEEP TLSH

page_outputs.xml

SHA256 eb2f417adbf114c9447076a0f05ef2a2ca2bbcbcb9eb008bbf9acd2dec9e0595
MD5 ca99aa34511aee6cfa75b64e4acb398a
SHA1 56ded46f365822df4ed950a6fd4d27c1916b3a57
SHA512 d157a12f7fd9bf5aa7ebd9091ce19b9a78394280333adae6f0217ea4c9ff5e9c7b71c4415f605bf2e6cda17308d548bbc8989f673b8efeb546dba8a5108599f0
SSDEEP 192:Xl6qMPfrOAAyEPLaitVkLFPLa1G+5m3XPNioyaaGthWvWWkWWWXWvWWkWWuSkJ6g:XSfrOAAhaitVkNa1h5m1ioaqcvvkvWmD
TLSH
T1C3324A125BEE2108F0E6FB51EBB641721B26BE51243ECC3D60A51E0D85B7A817813FE7
MD5 SHA1 SHA512 SSDEEP TLSH

page_video.xml

SHA256 fad114475ea03e44b5e5355e294f704d06e4abb4f9e56b055f4c4a7de7ff2006
MD5 426c3171a43960cca65b831d9a5ae310
SHA1 1854229f744773254965ed466cc9eb3615cb77b8
SHA512 9b35895979ad0187ae61fd2d84520cfa0fc5f2e314799a07a2800a53355ed0d12abfdf437a4ce08179724a6afee35c725fbdce086e020bb43f56db54f02318fb
SSDEEP 384:XakIn3+CvcoczYshAIvcWBzmsFQlhdCWVR6vu8wQEv9H8n/b4vmzoybivFzopLop:XakIn3+C0Jz+I0OzwbjL6WLQEFcn/b4f
TLSH
T19D52DC535AEE1519B0E2BB459BB640721F27BD50243ECC7A64AC1E0D87A7E813813FE7
MD5 SHA1 SHA512 SSDEEP TLSH

prog_volume.png

SHA256 d20dba71601ef7a33332c22d6469e4b231b6507b7f740a75b31e7b0036d7b7f0
MD5 e8f9214e5f1002170e55ca66ad1cc853
SHA1 52434566e89f75c21d9092e5e655391c4b766387
SHA512 44836739287469362d91654be348353f053ce5b5b2a2d4c5ad1edfec817d7516c19567b768067ba4d417df464e93c1e5ec387f2af7f3076e4545c03478e5f8e3
TLSH
T19E515C89A840096E100E0BBA35ABDE064A27E784935D2E0CDDFE830F8620C513C75B5B
MD5 SHA1 SHA512 TLSH

prog_volume_bg.png

SHA256 4dba8d0661e39e05523bf440fa3da4838f3c3eb57b46ea8ed69a3d5390eb990a
MD5 3b6735ffa56c711a7071318fe06cf64e
SHA1 971e7a12b15e9ad460b2ddba084544c597c57e10
SHA512 df567ee31f8f2c27034765c621a84022474598f96b258b4ced70ad97f7a6d74ceb5a3127752cd93078ded5b0796448bc3f84f8d1f0cb00be02ae7d93091f4707
TLSH
T1E3513B899844455A100E0AAE35ABEE064A67E694935D2E0CDDFE824F8720D513C75B6B
MD5 SHA1 SHA512 TLSH

rightside_bg.png

SHA256 461492322902bd420a14555d76772039ca504aff3d5732e1f57597bf9e2fb1e8
MD5 e7983efe017bee5021ca647a47c820d1
SHA1 9733fe65721ad3e90f23a989f60b2159075af864
SHA512 8fedb68bad301a9287dbdea2c5919e541abb0aff155e3db2128e96a6139edb90a615ccbec265fc16db8ddfc322f30a565b19bc6b96b6b5be9279abd1caac1f60
TLSH
T1C11110CAFA507C83858FADD214EB50139A27C78087D0F36A69AAD41709701F1495A8E7
MD5 SHA1 SHA512 TLSH

setting_background.png

SHA256 cf9c6e8fa1f8ef431af37297864497c5f0e8534556d160e4e15d1201f95af92e
MD5 ce8911feda8b29401120a3d3a288bfc1
SHA1 8c25f54dc191f7cfb2d28b161f95f72b29dc44c4
SHA512 6f0ed747312dd0b062823788407581b8d2c857e314d5e0df3d8309dfa54a4fd909c4f2ccdd39cfb07977f0906fe99c0a9571fb9dbc79dff314fa7cb48ccba8c7
TLSH
T11621546EFBD12C105104E89234EE5C274E778D80E2C0F1E27BCAC421A9B53D258354DB
MD5 SHA1 SHA512 TLSH

setting_bg.png

SHA256 ec24476867b7c10908d1223b8f8c20c10cd068d2b18e29ff6a1c673df8249cec
MD5 157c1e58e62a3ef2a713ef6cf92f5d9d
SHA1 5f7149bdfaeb2ca365f61a76327a66a16c4318f4
SHA512 50bd101b8e88c1b03a50176fe8496136e61175dda0a12cc79d3c7a1bc14cf7025e0cf1fcc8597590f7171619d20e9911c6e117d9e5ca46bf4161625d558b9190
TLSH
T1BC11545DF76058405149F5A128F7C4339B125E5087D0E1177D8ED81766B00FA4A9C9FB
MD5 SHA1 SHA512 TLSH

setting_tab_bg.png

SHA256 f51f4eb7dc51d86eb6c1b52d5b9ca69af8b7ded13abf80effe6a51178ded256f
MD5 75ed668b15554ed1cac40e655fc1e333
SHA1 b330598c0d1dbec7ba7e0121452bc157efcea87e
SHA512 0f6b8026948235dc199dc9272b96043d0efe041835e7611b7d0c0a59e17032325fbcfc96c73d83b509bf6c829059561ab8f6832a93bc382fe5102767716e3982
TLSH
T17A513B899901491E100E4AAB357BDE054E6BEB80935D6E0CADFE834FC720D513C76F67
MD5 SHA1 SHA512 TLSH

skin.xml

SHA256 f0043d2cf6ce9ff0ce77124288a597694c61712b4e056347204125a7a7d7061c
MD5 eded86148b373daec915df32e7802fa7
SHA1 c27cbb3cb3d5e8f6511f38da7944c80bc58ad526
SHA512 a322b7fe0b169ff300eaa6ff6261578a66d6b4884343a06a83dc876319973ffcb3ec5df04a0f85951fc0b4b775eeb3a27bb93395bf05d9958b4290a31cfd5763
SSDEEP 384:XbOMCHC0cDBZYB8H+cYJDcYaDcw5ucK3wyv3nLLxvRF1xlD9con0zc5DdfnZZVMc:XbO/i0cDBZteTNTMDsBAyvLlZTxcI+A5
TLSH
T18E823E526AED1118B0A3BB45DBF681261B27BD45113ECC6D20AD2E0D87A7E806913FF7
MD5 SHA1 SHA512 SSDEEP TLSH

slider_bkgnd_tile.png

SHA256 b60faea514eb5af0ad1c6d3d3a77ee1bc7849f85e95b723d2fd4852575b17d03
MD5 7804ad5c9fbb317f932a23576d2ac3b0
SHA1 26a77d63a8e32d2c151bee829d7d273b173107e5
SHA512 282ba249ffec6a6b4f88bad4bf12a820ca79fd60c64748a001499ed4873e8fb8a88fc0abdebcb1de403b53a48d9e05b2c3588bd4ce26ec8cda7d331d32635ff1
TLSH
T1C9516DC99444051E100E06AA39BBED074A67EBD493596E1CEEFEC30F8620C113C31B6B
MD5 SHA1 SHA512 TLSH

slider_var_knob.png

SHA256 ab6e2a5460e5ea9e37ea0bb170b70e8e3d125e81b120beb9ca3c7516bcd2b07b
MD5 350b629e1b503ec46dcce6d6569901ed
SHA1 af75f032d698f73c9df37c61ae72a47b2f0fb15e
SHA512 b43dc45be1257d3382484ab44f1fce96fba96e9f5bd2436189e8bc0591cf99e2d37926cea8aed5fd23f9d0eec1b4d2c733189cd75081331cf9c2560777a2c147
TLSH
T19321948AFE904411A20DA4A436F6A2638A1704C4D5D0E06D6AC7C812C9732FA146BACF
MD5 SHA1 SHA512 TLSH

target/btn_findwindow.png

SHA256 38fee0c59177b4323b16011d74a80e7c98a60992c481960e41eb0b9036e8fec5
MD5 61fd2a11bbdbd783c505b0e54a5ae585
SHA1 26e634312e377086847fe507f9063c63920ae296
SHA512 50500bf4bf77c6e599cfec46507e769b9fb25b34b01281960168db82496fa2e33ab39bde07238511c327a973bb2900fc27f10c183ef7a2e67bc877dfe7d4ba1e
TLSH
T1A2515D899844552E004A0A6A396BDE058B17D69453996E0CEDEE824EC720C517D7175B
MD5 SHA1 SHA512 TLSH

target/btn_fullscreen.png

SHA256 e6e03513f53cdc59de475ff6925ba677bedd1e58fec87ec61359ded9f9aaff2d
MD5 eb15c767e4bd7703dd3f3b3616ba34e0
SHA1 7ab0850bcab1e6c699dd6afd0e0cc3fc31462199
SHA512 ed20910ed34297b56a1616528530c8cdac93d9244c4118facb7dbbc95bc8435cc47ff9c2fab7a78e01c411ca3b8cb0807f53c1fa1ebcc76bb1e2e5fef233756d
TLSH
T10D517DAFCD70B08E79CE78620DCE4102E768226C8A973678E4C255DF50A5E0BAFA1075
MD5 SHA1 SHA512 TLSH

target/btn_img_start.png

SHA256 e22f7842ca8ecfa51fe69dc724cd75ad9e91883db3641b947e101621a0f93120
MD5 65d7cbbccf2c4a8fb56c007da172d23b
SHA1 89115798b52de3b997831a2e3a7cab1edd548ad5
SHA512 11d350145bfda797238f93ac098f741698d5e3e44e881e21880cb91cb98392a5cf18ccfc555a8503b910eab4e611131f9c6019daf9de5d5e63965390a26ed4e2
TLSH
T148516CAF8D70B08E79EE79510DCD4242E7A8216CCE673A2894C169EE0456E475F66061
MD5 SHA1 SHA512 TLSH

target/btn_img_stop.png

SHA256 a8c1f30613b39ba31efdd3f578596c540ca7a69c49007fd908807497279b84cf
MD5 2cd202cf4c4ee30aae57c18bc68f2fe1
SHA1 90f1c601b514f8328e9fa6d0f3fda7f9becff1c7
SHA512 bb926158f787e2315aafb4e16ce3841f1a4890422f289b2b999e04c784c9a83e4ecc0a8a26c846f507dc6ebb18b3e7f5e24d257c5f8b12d50196377614c0b13d
TLSH
T102517E5FC970A0CEBC8E7A920DCD1246E769216CCB53373894C219DF8451E476BB5074
MD5 SHA1 SHA512 TLSH

target/btn_menu.png

SHA256 62444df8469662b9f03336522567b08b7dd9ddf5f0bd53eb5aee6eba23eee009
MD5 29ab1442b0a645d72459f5f972fd4082
SHA1 81c8e298dd4b98bf25a5eaff00130cc8ecdf2f28
SHA512 f7ec0855b20eedf68ff9ceb0369e212b58ab0bcb94ae1857b93fab688e441f309bbb4d64ab7fa9c7036e9975bd521c17ca37996ddfb88c434c334fb1c1112a09
TLSH
T115517B9FCCB0748EB8DE79520DCD0206E72932AC8B87362894C258CF4495D035B610B5
MD5 SHA1 SHA512 TLSH

target/btn_pen_start.png

SHA256 37f4f2241332bbea81e7d60e6de28724e1aa3cbb76258b2205e6f947910f1c7d
MD5 8deb05ee7fdc84f78bad0e9031f356a6
SHA1 df816eb2ac99405d16eb9e82a88ec40f4fa25f8b
SHA512 dd841b0eade7269e827eafc2811ac76c3407c5e30f9183f5df103f3f6460db25313b8e1aa0703e40dcdc4957241a6ef4e81496158d14baabebe7bfb58ee9566b
TLSH
T16621418AA48A1C02E6F8F6C234EB80375D1249C0D6E0F8657D8FCCDB4CA05F1146D6EB
MD5 SHA1 SHA512 TLSH

target/btn_pen_stop.png

SHA256 d7bed71e658b2a591279d155f8904b99bcbcedce2380c4d820f7f8ed6fecb317
MD5 f6d5a0437380fa7863177ec854b88cdc
SHA1 ca74e85a2d5a81a98c69a388c372fd3813520696
SHA512 9484945aea1e3704aa9bad341015ba920d797eeeffe1ae3e4843b86c3813e3e62fc7bb898221474f4aef1839ceef3380f78475a353cd0d40360caeee9f0fbfbc
TLSH
T18B2146CEFE5164024E99A99334E58037A9128940CBC4E025A99FCC5A0C651FE8F6D9CB
MD5 SHA1 SHA512 TLSH

target/btn_rec_pause.png

SHA256 cbb15f8b4595b06b24353ba9c0da0d00be46df25fe9d6503bb621463af8cee2d
MD5 67b49e5dce7e561b5125d89c6965a360
SHA1 ca0d6159f031a10397204317e407cb423cf2cb01
SHA512 32e22be49349ea224f11b5a17bca19c16891b8e7b64eb7a7d5c8d782d7d9975be5c170a26c66687654acc279151b62157bcfd34572001c53fc8e4ea9290a82b5
TLSH
T159517BAFC930E08EB9CD79820EDD0183E768226CCA57373890C169DE0099D079BA3079
MD5 SHA1 SHA512 TLSH

target/btn_rec_paused.png

SHA256 7d82e924a24e4ced0fc72c50a566cfe74bd4933331878d45b4fc0600e1bb734a
MD5 efabbbdf373f699ae35c39d6d3158573
SHA1 3de6dc43b7f6f88e7b8ac9872ec2d4c9c74606d0
SHA512 f9fd189b40c4c1f736f350078e283b9bb4c70c8d8fd377dc5ad30f54bae307ecd8e2956b81e56c9a7a91b350f9d45d3f002a29fee15dcc21528d794d7cb9a05d
TLSH
T13F515C8C9444891E144E0BBB3A7FE9468E17EA90835A2E0CDDFE830F8620D617C7579B
MD5 SHA1 SHA512 TLSH

target/btn_rec_start.png

SHA256 9364385853d964ea1107ca7721a9673ce42cebb05b718e83838921e9fda76fe1
MD5 c3b5780e6bb5734cc2b4b84201b8b660
SHA1 489a25469ed8123caf3480cb1376d78839867585
SHA512 5de68bd98b5b049fc7add54635924b7df41d743de2aba64ba0b14cbb0f8bb0fc48df1e85cd86ba3fbfbcc7c42ee55579464e52024a5bf56fe273592abfd68f07
TLSH
T1C9518EABC970748F789F75010DCD1243D73422EC9B9736BCA4C156EF4450D076BA9075
MD5 SHA1 SHA512 TLSH

target/btn_rec_stop.png

SHA256 b4d095ac9f903f1836d2d9b6dc305b82aad9e69b1bc48e86620ce960295e5012
MD5 7feaa395a06233290d10ffb485994263
SHA1 cff138fdcab4b0ad6fe2d73c52d3364cee164e18
SHA512 7ea82e6f5f0854213afad5c6f6905d4e67f5343f7f3e4fc29631fe3b49165e753758726c7475aa79377e9a48f7eddca9954abc8c1838ccfbb24fefd86cf64805
TLSH
T179517BAFD970F0CE7DDAB5510CCC0202E769226C8A9B3A3890D255CF0065D0BAFB7076
MD5 SHA1 SHA512 TLSH

target/btn_restore.png

SHA256 88e8381afb4239c02e438129517bea43a848c6bd4114e2022ea934363b51fdfb
MD5 8706e8fbea87c382d91e62650f0c8a02
SHA1 9a62e94faf9caf4ad01358f09ca6a95d23988870
SHA512 546e88ca84a34f90b31e7f17087016499aa378f9c73b5e9893ccd5f5a44f0fd1cc2e93d75bb8f381e9b1585d5678dde46e68633620f682f3e900af950a643186
TLSH
T11C516DAF9860B18EB9DEB9410DDE1146D3A8327C8BAB367CA0C265DF0090D076F26075
MD5 SHA1 SHA512 TLSH

target/btn_sel_color.png

SHA256 862dc50522b0829267142f24c556c2f27ca21262d3c967e6a989915dc46faa61
MD5 da55f3a27d2005be4aa9a770013902ce
SHA1 bb6d0b6a59518c80c068e301af252d9ee572574a
SHA512 b7f7b1f2f31dff6f5cd1cf4da540c4dbc0b0a4ba364003b75362e63c610c55153d925041ea5db918cd11004d557d77a4ab58ea74e9bb4141135e99cbbc3659a8
TLSH
T1E121844BEC007C8962889B8324E79062979A45A0DDC0F4293DDBC4AE4D712F805AC9CB
MD5 SHA1 SHA512 TLSH

target/btn_sel_line.png

SHA256 9c8b07b87a19d59f596d4fb75707fcfc56d49c1b516ddac5c16292481921285e
MD5 32dca9671b79f5490843952fa54dcda8
SHA1 a6794eec9b57e1afa56a5f55676d6f0652405438
SHA512 d02d8de9f60b809759384b9f9838ab66231ad6a5d96d068a2fbd2c7a7f4259a39cc44a37352ea43de7aa999c66026e208f42d69013382989786e45e50e934394
TLSH
T13211868EE900A84541CCA68324F65123DA930940D6D1F1B7B8CFD85F8C312F8426D9EF
MD5 SHA1 SHA512 TLSH

target/btn_tools_box.png

SHA256 0d1e7ad8958ae15d41ce70ff94d6c3505290157bf7f511b5885f612a385f850e
MD5 34484d1bcfbe2fa1b03e3e220284e1a5
SHA1 132eb801314ada01e87d3ce75bcf2ce8b96ff93e
SHA512 4ce8f0e4862c574f45f67a08feed819f87158e125892ab3410cc2b9a00dbd1390a1bd2df9bdd66826f70790e2367af8a201fad33b0503bbb60f716104487de3d
TLSH
T1E621634FF8416C4D6288DAC220F25022D9931AD0CA90F8A66CCFC04F4D701F5469DED7
MD5 SHA1 SHA512 TLSH

target/btn_tools_eraser.png

SHA256 2cf73488e4f6d99493dce494ccd4cfc4d3561f48d81bd7f04ef3669823b5de7d
MD5 114331c1cc52b82df57c9afb9857a076
SHA1 8bc64f48a6aa559b64c220ed4ada905d152d4b63
SHA512 1c2adbfb570c3672ab23964f73da704033b034f34335f8d2cf4e0f7a8d652ba2b1257a14accbae92b17f09c331fa2ba7e6f6d571f7eec0f78e69c70b56572a99
TLSH
T164215E8EAA10790851CD96C120FA9223A9424640C5D0E5B5F9DFC84E8DB82F5429D6FB
MD5 SHA1 SHA512 TLSH

target/btn_tools_eraser_2.png

SHA256 1f2d7e90d8fb22bce7c13dff2bf962db8b151b522c2308198f072f550fb267bd
MD5 3b0a716802a2543a3b1d664fc46865e8
SHA1 cf71da6f8d7cdd65472c8c2e97cd4836f5b905c0
SHA512 093660639b4e355fd42fc60485219700f4a3e8517258168dece21fc2ca6a6ce57deee8468f9cf69e2ae74d8a8c75f540c5f757bf11069d40a3969ddad00cd1d6
TLSH
T15E2167AEF9806804518CCA8214F2D132AA5306C0EE91F4757E9FD49B4D312F986D8DD7
MD5 SHA1 SHA512 TLSH

target/btn_tools_exit.png

SHA256 ac6e96a969a77ba01c375911fb78beb056c648d131a254147a59989b65dcdaeb
MD5 16cae800896ca4b18e3cdd840273e44f
SHA1 7c2b75474468b19d3bc9df44c4e98118d8b42410
SHA512 5fad32bcd3e3b8aac9c788bc762a57c09984968c5656ff99bf5481d60266e6e6f884d7ec32c9ef08dee15955d4fdf9a8d559c418952b8bc1e423502852437366
TLSH
T140216315F4C92802A26DD8C214F68517DDB20881ACA4F55EA88ECC661E602F29A1F4E7
MD5 SHA1 SHA512 TLSH

target/btn_tools_pen.png

SHA256 8b21a3f94a0459954f271eece1ebc29ca9f6e3a6132a8f9d896286bdd3a6a8e2
MD5 7a109897288aa9574bff7f8f906df027
SHA1 f03a2b2d028bb22151c1e195840345af16366af2
SHA512 0465dbf5595ca2bde7e9bfa5f9c153c911427aa7123fa6aa890e81498884ee77e4d141c400f04b65790fb117adaf0eaa79f5891bbf2d40b473b526aca6adab59
TLSH
T19F21A80DF840A811A0CCD9C234E2F126AA9705409AD0E466988FC45F8C711FD05AE9DF
MD5 SHA1 SHA512 TLSH

target/btn_tools_pen_hl.png

SHA256 5bef4a76d38c4aca2aa92e2c2c4392519d186f5e73f70829e6f61809de2bf2aa
MD5 1156c94c856f2c11bbfee62c5f817a87
SHA1 677bf48047533076e6bbd1d3720680977cf26587
SHA512 865c240c81d246d4bd975c9f3c0b5b235f23cfe324720f281b0592964f44b3f697da211e33fe0927f1d3da83226172893fd70a9631245eb2fd5f0d859ae70ab9
TLSH
T14421838BF951BA00A299DAD110F6A127CE530640DBD0E4A5B8CFC0DA1E716F80A5CAD7
MD5 SHA1 SHA512 TLSH

target/btn_tools_redo.png

SHA256 eef93b06a925abba96bb38cdc6117af696ed0ef1df29cadda7306653a7300752
MD5 57215b9736ad558e85421516b1a80f12
SHA1 3f49bd6b25f2c11b357d2465c3fabf8d9a1a1270
SHA512 ba17d4cd36c08a19345dee091498c1abe1a02dc2863cfc66afa275b6ea239c4f3ddd3f1dbc84a6137b5373f362d12d3fd072b09dcad9faaa4f120326f1886356
TLSH
T11B21608EFE411C01A109995128F2802B49278E809990F1DABDCFD82749A22F61A9A5EB
MD5 SHA1 SHA512 TLSH

target/btn_tools_undo.png

SHA256 8306aa5ca844dbb6479a1de9bcf80c52e32b96b1e89862849ad4927d2a1117e4
MD5 ec67855594c41da1155f4a9b2278b216
SHA1 21458bd110de777d4a9d32ab17caa48e06813f8d
SHA512 11827dfe740a20747619b7ad236f150feee6ad2d3a46a255416b743a07a7c1fe3973e9b289b89765a3b1c1fcd15337589b512c750b2477d1b060a278df9b2246
TLSH
T12D11824DF6001983A60ADED519F6C05BC6D745A095F4F8A56ECBC80B1D601FD089E5EF
MD5 SHA1 SHA512 TLSH

target/client.png

SHA256 820e9e3537ab359a38484f083b1e539ddc82f6bea063764d3a2dcc7224e21e43
MD5 24d74a5d99ba50e77ce8f2dca1068fab
SHA1 760d51beec84579a9a1eb9f2f6373bcb001fb15b
SHA512 05f8292337e20c39cd69102be89955b2f77496323088906fdde5369fc4a85aefd261e75f1fdaca749b35c40d6e3806c59c2faa8b317d74b76cc4a24bad46676c
TLSH
T1F1217489F7A07800C289E5E020E3612FEA665C50E9D0A7357E89E86B79A01F2C41A5C3
MD5 SHA1 SHA512 TLSH

target/client2.png

SHA256 feac6a8eba9b50344ede6cba2ced54993bc4d5878d91600f5f2e9fa4084f8b2e
MD5 8ae6c23687c0ae97a8490a9d5e84b451
SHA1 b4997581b5f612960299f9a82fbccbf2935051e9
SHA512 da5b2219e4db970045975989bbf054c14c57ce13c7d78a78524eb7b0f165090e34e2a72ab5fce21607ec9e4677c23ace77d9dbce001bcb73fd0485534692ac33
TLSH
T1DD21824EEED13805C20ED4C270FB426BD4179C60BAF1E8A3E8C9D8034A605F948AA1DF
MD5 SHA1 SHA512 TLSH

target/drawing_tools.xml

SHA256 74409352427ce27912a84019b49a98b7eedea658f6da75c0754c137d17f28d3b
MD5 22216d96d3bc4a3c1263355b205e9693
SHA1 24162257ce57386492d1196743c18ee9389d3040
SHA512 8e7f42512a2f3554699cc9c0217aba91c8e571ec78bd7258b2de13301af7b505b4cb2d97a2d4541c2e1aaa387619bb22d3adad9c9a24bbcd9a1812f3b0dea4b5
SSDEEP 192:Xk6qMnXGcWlG3WlGcGYGppGWSGiG4GyGnC9XgC9EwC9pACv+BGuzC9pbgXRCvKbP:X3XMlHl3bWpfSF7VEGXgGEwGpAU+B1GK
TLSH
T10DE14B536AED2118B0E67B459BF641222F23BE45243FC91D20AC2E4D97B7D815913FE3
MD5 SHA1 SHA512 SSDEEP TLSH

target/rect.xml

SHA256 bdb2985d19a846d40eae16a77ce0b3e5615fc9f78ad2c8a7e65537549c1f9aec
MD5 501e4a0dad1129f14dca837269a92dc5
SHA1 836013e1a13fe0a8fe1d6e5dbead3bf30c26df19
SHA512 f2d01f7e9220cd6a8819ff2fbfb7eb8c7a0dcc8a88676512144406c9d3828ef9aa4c2e1ccf1d34a7f9575b445e84a0e1de1f087ddf19d840bd420f55d0c93e1c
SSDEEP 96:XaXqDGDWD4DbG6RWlG60l7WlG6zG6I4AfzgHrlqVlbgkylbg5lbgNlbgJpNZRlbI:XJ6qMvGcWlG3WlGcGWAfzgHMjg1g/gr7
TLSH
T147A170036BDD121CB1A2AB48ABF241261A63BC85543DCD5E209D2E0D97ABE805913FF7
MD5 SHA1 SHA512 SSDEEP TLSH

target/tool_bg.png

SHA256 62ee60c68278b5e86635e6b692347d8794097e07087fee38ea4c1614201074b3
MD5 94dae83eb42dbbe81d097daf8f81c1c4
SHA1 f7193a03997c012759ffe76ddf46f7f643e68280
SHA512 3d3b48f35d59623305faa34ed954d1f55cbf10df64b68b03966a331bc612f52679ec8c0dca19520eb837f0bceddaefb796adc65721180200d2a2a2814bc21e42
TLSH
T1D041E8CAFF816105C32EE81230D5D113A6262EC0E9A4D45B99CDC495BAB73FDC4A46FB
MD5 SHA1 SHA512 TLSH

target/tool_bg2.png

SHA256 d20b5887960b21239230cc155386c5943feb0bd266e6b203340fa29c9875337e
MD5 398828fd239f691b934c48d900ff48ba
SHA1 60f0bd0419620560d5e80bfe8d6b8bc920f8b3b4
SHA512 9ae1878c8c27d05b0bc6fecd00250458cd59dae6712620381f0eda955ef1f6da9491402662902b34ad877c381d83f15d3a8a44069a94e11c64c4880519c701ca
TLSH
T17041B546F8211483E68AADC148F62813671B0550D2B4F2B6AEDBC91F0D34AF7584AADB
MD5 SHA1 SHA512 TLSH

tips_bg.png

SHA256 8b4780c64ea3636da1ab0cf68a405a3dce91fe29acf913664350d95f386d6709
MD5 0a1c30c2fe7f6b93e9aead51bb845f80
SHA1 24ba59d65960eb4dfc7f5686fecd3497750fad88
SHA512 4535055350802b09960f5eef16a58f36ac1ebe1665221cb08b3463114c85753e7c3efa43e0c40290aaf3c37e840a1dc9b5266951f1291abe802f93c20b6953a7
TLSH
T16B216356F65158C29B5EE48934F65173DAA2A440E6D0F035FACFC0068B753F9485E2CB
MD5 SHA1 SHA512 TLSH

lang/Arabic.ini

SHA256 b63dc00d7807fc13f806d78085fbfcf72d2e8636e71c86b8e2121d6d545bc0cd
MD5 bb943d8992571bc533cca1e514bb0a4b
SHA1 d5f9d7f56bded7f35ea4e0898bcff701cfb73e28
SHA512 2fb984b8c7a8c90fcd5c4cc0395ea5b7f476e4efb4e603db4f4afb92febab96aa01c1d9568863dda60513b191e37ec4c6fd37cd2a786d8ec75dac049d74b9172
SSDEEP 768:LcLIT/gklSXRtX6lZ4MqBQ2eG96mRBOj97N12+ecXXSTbgqOUq6RRbrfKrAB92Go:SIT/g7RtUemEq6Rsuwtge6i
TLSH
T1C533BE117DDC903A306676A5CBCFC367872AB1E78ADA9F3A11EC450627D18207A1B7F1
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Azerbaijani.ini

SHA256 df6f1f45431eb34cd4a8fdbea2abc4fffd4889d67e7ab3c05f947cefdf5fcdde
MD5 bff8b53d97b7cab2f4244a64130e09ac
SHA1 3765349ae09ad1e8ceda32bbc22255a57815a51f
SHA512 d2dc361b1b04c69dfb7750c333b3661bb134143b20cd348759624cf47796876b2adef8b4c251761441c47139e7289f0f13b398af1c9897784ba7538005e54fcc
SSDEEP 768:ZImuJcSA9o/ndPQ0sxg6G1Iav5jTnFQcffHEINrZJu3gOvjZGpS4hkIzbBWE6CQQ:ZImuJK9ryV9Z4eBWE6CQs0M/L
TLSH
T17343E21139DC1026B5B37B929F9FFB758B66B5E3967A8F2A10CC000A17E185176237F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Bosnian.ini

SHA256 483e63fd3e6654cefdc5dc0d0436de36e1663f609ae9392613ed145f1d58f7b9
MD5 88840f154a0d859eab0a5e3067c264c7
SHA1 dc0084711c6892bf98f51640f108851b166decc0
SHA512 014a4de5c8af4b70680fb1cf8125608139138a0f4f5c3c5f1b63f32ed79aab2e5b8faf8bf0f9d29d31df4f727e9c7a6041fe521241ace38f0bafd7593f37fb37
SSDEEP 768:LIt9OUHS2CM9Z38ldaRyiThJGJwRM4ctOpifLcZTnb9O7FR+M0R3DURxr6OFUDpb:LIt9OUy2Bh7nbdMCpOGpOEZVN
TLSH
T1404307127AEC1025B1B777918FEFD3754B6BB9E7967ACA1E10CC010A17E18506A633B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Bulgarian.ini

SHA256 085e6f7b37b8c67fb27937df61d86401286182e34243bbbef7b6c375cc584f28
MD5 018729dc115cb5d7773625d1b273e53e
SHA1 9975d78da0a453f511323a5c9c56361d0b6122f8
SHA512 cee30df1bffc8171801c61dcb065bbcfc315765eb7d7f56607a9c179003139def7cccfb9c1fa461af17a8d7126b2e022defd238c52d6d95f6f342a5d517005a3
SSDEEP 768:7INlPiloaTIQfRlNdM6ouYrYnxdqNMcee9ueEbpmP7BrCgbKx3ZgyRBLTlH54jyZ:7I7Pilom/TO7UdH54jeL
TLSH
T1D2437A0BB8FC60257115F2958F8FC3E657BAB6E3536A4B66118F291622C987137133F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Croatian.ini

SHA256 596faa4373c27fce45ae09365936fee092333718372f4d532fb649638a84625c
MD5 e9ede71dbf4b0161e9e5f246ff5891e1
SHA1 d79329820921c83ec60474b011a5558d3a049f19
SHA512 f73bafa8eac2fa74536aa74c018730800b53a6a5d63b6b88d92ac9b8bdb662366ea8fa15c0fbf1a7703289577d9ae0d2c2cc26032f050602411fb8e5004eba21
SSDEEP 768:/I4A2sE1IV9ZBqBoPaxyifTLiJwRw4ctO7iHjZ5+b+OXFRd4cRFDURxrgUeUJBm+:/I4A2sE1IH0T3bJ4w7Uvow2Mt
TLSH
T1D34306127AEC1025B1B777918FEFD3754B6BB9E7967AC61E10CC010A17E289066633B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Czech.ini

SHA256 80f23bca225bdd5c689f9a6f86ff3c2b26379700d5c6f0901ac585bf6ccdbc83
MD5 6e6bb5c8903a072df8b506bbf3219d39
SHA1 aaf7d0696b27797c9b5aeeae300c5e1a98f38ad9
SHA512 a38c95c99d45b59febd3b07c6a9ddcb7164b383b2f53d1dbaddd386d4fe65fcb794c6fadaddf6af4a096a10cc5153e22484b7c79ce03a03aefbb383304494318
SSDEEP 768:fwI1ic8OHhACgU5AEUY5I601royCX7VB/c44PsESdD3ZRMCBpeyFriqTk37vWwIf:4I1ic8OHh9cJmZuWws8GtG2D5D
TLSH
T18343921239EC1066B1777B919FAFC3754B77B9E3967ACB2A108C024A17D1850B9633B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Danish.ini

SHA256 6def045c101243172d192ef07f17001366b819801aea5b0d60d2fb9bc6b12d61
MD5 73268e65e00fb058d8869387f9b6ba0e
SHA1 edc6b043f00fba358bde36e3207a17deec49ada9
SHA512 fb27b0c771f52421cdca945f810119ab8db3eca39019a818512fef4e2175cdb3830368818453f195af1018d6cf22958be40868c965fa58053dd2129c77f93f17
SSDEEP 768:PIXQgxu5wVKOqIe6AOgxzFpBNJ0c++x20qhK4HbrfKrPuQFJMckPYobX/rK2V:PIXQgxuqvSt4XvbX/rtV
TLSH
T1EF43A4123AEC102AB1B677919FFFC3754B66B9E7957ACB2D108C010A17E295076237F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Dutch.ini

SHA256 a20bfac0836262251f6fe6074e92df0f3e321036b8769057153200f2ec11bd40
MD5 3f1645ff5eee9c71f691ff9f608f9ff3
SHA1 8e8a88054057ee174e2b31a6d66eaafe32edb81f
SHA512 bf1a61dddf9c16adb1c3fb2a36d440ede69d40569993576ee008e67723650804b69c1e5d04046631a970f14a3f9855fd7982dfe2084c2aaba6a6e787cbd75b59
SSDEEP 1536:nI7Q1MOu2U6IWd/fUu1FnYsQ5hQmSXPI5Qz5qj1cy:KOE6IWd/fUu1FnYscI/8qQJcy
TLSH
T10A4391123AED1029B1B677919FBFD3744B36B9E3957ACB2E118C110A17E19507A233B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/English.ini

SHA256 d9f92487852228436b6c1699d72500ac7572354bbfe90d43636efe6061a5c9b9
MD5 bd659905269cf8a0c9aba6bfe1916aed
SHA1 a26d251e8ba0b8a54e79e6483f71c8a777eac0de
SHA512 c18f3ce669e341edd9c6116f88e3a9db652aeca4b281b1646361ff84e97a7f1fb2ddc159ea535f880f31d4c03f456f66b891ea02aa7cc954a8ead37110a5cb5e
SSDEEP 768:PoKIBfNU5729KxIovtsp6fGhjf7UCi+Nc99zs/qOZkrZbrfKrUCT59o5uvKRpfu7:vIHU5729EONmrGApfergS
TLSH
T10E336F127AED1029B1B677959FBFD3744B36B9E3957ACB2D108C000A17E1D50AA237B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Farsi.ini

SHA256 2b1e2d5c4e197eafae83f8fbcfac7ffacc8c1fd301975d80e9fbaab4bb65c80f
MD5 86306b2f8e458c287c516edbaadbfeb7
SHA1 42faba9a32ece6017f14114fe943108723349488
SHA512 05b3ffc9acef96b557a4a1ecda8c0173dd198d1046d2e75637c68e97e7c64f7ac89bd50109166cbfee0216c612b4c7fcf26f50a1f9d80686016b144d02e0f820
SSDEEP 1536:SqIILw/LYGy5VAabio0fgn3tT8KCVBt90Q7PTLHCy5htlKd:SqpwNy5rbitfgn3tT8KiBt90Qv2QKd
TLSH
T15C33F101BCD9D03935277295CB8FD3679726A1EB92CA8F3605DE012B13C28A97A177F1
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Finnish.ini

SHA256 c0a9478d8d9e3a6406f6890271444e4310c3df3335d01de11f9dc137cb151468
MD5 e7d28031a0e18da59d8c1a42805a5a6a
SHA1 99fe5cbaf40f0654aae0b419f16d50f66ebf9ec8
SHA512 5c00a71148ff0b60bc2b6f162707171ecd03847797af56a19cfb35b25da202b1039778e965fffd17a02790cd79ea484e2408e047b7409f9be38858c5e53b78b5
SSDEEP 1536:rZhD0IV0K4Y1oMmZ2A3A81Gfj2ljdLbHrM:rZhDT4MmZ2AQ8Ij2zM
TLSH
T1FA43821239ED1035B2B77A919FEFD3644B77B9E39ABACB29118C010A17D1850B5237B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/French.ini

SHA256 07a816c648ebb7b5d9652237a82ff356e6ae57a1d7b42d41aae791ea744f83e6
MD5 8f6cb9290f8449c01805652a06da2f3b
SHA1 022645eab871ea83cf84fb3c9b6b35a593a956b9
SHA512 a01a7b605dc5a4aa9c4a2ee367076d6c782060f677d4ab8b48195720b2626bc9883339948b93f70e00e4b4d9355f102e95171917266b56f6b56211352e027773
SSDEEP 768:ywI/hYd6VLtzZQgmu6lUh6XQ9m35HF3yPW5cooT72pq7Y0hFYsoRDJQOko6DBbWt:LIpYdWL3X0gE5mhCZBVRrLB
TLSH
T1E94395117AED1026B1B27B919FBFC3744B36B9D7857ACB2D118C414A1BE2D50A9233B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Georgian.ini

SHA256 44e1689387af31f7f8cfa7af9cf66c10ee90201b2481ecf228ae82eaf973735b
MD5 a37ec72b156ae49397f03c3ed4549fb5
SHA1 2bda582acd951e95daa1a05390a2da26298db2b2
SHA512 6872ca1e8da24d17f47f184331b720e2eb008f29c3f9c3041be394e3c34b522719008c3e50631a8d2173885155368f1e313fa391de29fd1d7327cb33ae29e579
SSDEEP 768:CIEFbhUk39JNe8245v6AHIqD3JPML0cttfuDqOe+dbrfKr8YJHSG3XLd93xPSEzK:CIEFbhUM9C+JW+qP3xPSuK
TLSH
T10A4308113FDA5036716A77A19FAFC7AC873AF7D3516A8F2A12DC094653C1C8265233B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/German.ini

SHA256 42e2eab7aeae7ea31d4d924e826ee6155adbbcb711d446610e19328017c463c2
MD5 21b46ee9a5a3ca83161873c07c1afee2
SHA1 72569f0c8c634137be565d05c88c6fdb37f620d6
SHA512 b7f844d7012450e71d42ab883f229f6f4db2f965b6c2357e085975664b606a99658931ef41ff274961b7efb73d8857eaecb43f13be882485c6545394ad5776a8
SSDEEP 1536:xkIh3xhC625eodtx2k68omyejEG91C+Kj/LF8EvblRw/:xXi6xodSk68omyC94FzRVjlRw/
TLSH
T16143B5113AD91029B1B27B959FBFD3744B26BDE3967ACF2E118C404A17E1850B6237B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Greek.ini

SHA256 4fbed1977f859a6f0d25d9566b06c2db81953d3a4fd0a4ec0504cd7f62f7ad57
MD5 41efe9249aac945dcb91ee1156ce6a48
SHA1 1074ec669b610ac3096982be6b86af266992c7f2
SHA512 4dfd3c023cc7bc4ba90df0e36d718449a6ee4ffb2b0ebd41c2c1e8b9f9dd00a94a83176896f51fd238a8b6bae02230e732aa2986c0df8d6c1facb57c882ec69e
SSDEEP 1536:NjyIeXNA8cDhZ3YDqqi58cSaVVbygucqP5:NjeXhqj59qB
TLSH
T112439F093CEF1126795176F29B9FC3658B2EF1E3415ECF2A60EC210696CD8116AD3BB1
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Hebrew.ini

SHA256 a9444f87f8c42f88e8305363918e720855af6a5510b1c73592c683f43771907d
MD5 d78c85847c7e5a1bea817ae3755ac19c
SHA1 ec9fe4e1ccba13103170f92abd514d57bc35687e
SHA512 3cb374f26014443338006d85a842282c7cf5e35344c4f4dc81d7bb8b486d1dd17429f63358c89037c44ba9e4c7c2d153963774dc96c3b869b09fbfd961d0f9b1
SSDEEP 1536:FIA92C77ZpWKKbQZvqxdXOYjtlf71wXFm:B9ZvU+m
TLSH
T13733DF113DD8907A7125FB938B9FC72D8765E6E382AEBF2710CC015227CA8516A1B3F5
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Hungarian.ini

SHA256 4b196edfcaf43e3d4406016f4ba75711ed85796650462f3c8bf5fd9805f2917b
MD5 dc7f3870ebe5c99fe52a45f8940a5493
SHA1 1ef9023525756c4ec850eae8e6cf984bcc255a60
SHA512 dcf481d8c4668e0cb0952f50ccb84c35a1dfcbf17987600d61f424a3d226c03e4a3a93d62d5072c8dbc0ea183a0d2da96335dc0def7b46b187f67f356d5ac513
SSDEEP 1536:39aIb6IPE3rZP10DNQVScjSf0Okr08/dyOVwi3j5Os8DNIeJgUYs5gJ6RZhGJopI:39j67rZPnScef0Okr08/dyOVwi3j5Op6
TLSH
T14E43B31179ED102AB1767B91AFFFD3754B26B9E3957ACB2E10CC010A17D1850BA237B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Indonesian.ini

SHA256 084e449146f85fae89d2c1ea2b910350c91ec0376f497ece95624a610446753b
MD5 f6daccb0765a97129bffaeb7a7c2df11
SHA1 3265446fd6cd24969f7e1abab4ee75dfc37e8ac6
SHA512 60fd7ecb0aaa7197553761cd8a9bb348147fa4e3acc78910d29e9e9e457f65280f7914b9866fcc3be3fd8adf463a81622ea3b2648142d20940284aefc626d24b
SSDEEP 768:AIy3GSI2tQwUaDi9YtJEb62kbzcPkY8Guxc++LEIaj4nl7xfR+7Ft/7jtjY8aE1o:AIWtQwUE3Eu4CPDdcW3s
TLSH
T10E43C3127ADD102AB5B777919FEFD3744B27FDE3953A8B29118C010A1BE189079237B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Italian.ini

SHA256 5f6b8ce936450992f3149903a6e98fbcdebabd064b0fb1389973fc64de2a7b1a
MD5 bbaa397292114eea0c5e21bdad5a7ff9
SHA1 3f767979f4c4f05b0911a2e1f1b42c22a4b7ba09
SHA512 5174acc1452c4363b86cd00182481fd823a1f1238f765b793c68e9178adc422b54bb62062c571abf2cd79699b2dfab74270e903b6a0e36cdfa96d109418750e1
SSDEEP 768:bIfuK2G4zK13CMwEGI+1YY6B41ZsUqI4O27/crroEoF5hMA7cv9LIBSdtvp6l8Ox:bIT2GiKo0qU12Wz9jaKWo
TLSH
T1BC4360127AEC1029F1F37B959FBFD3744B3AB9E3957ACA29118D000A16E185479237B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Latvian.ini

SHA256 e0acd00fc9707d3923f807edfc333f0c9553eebf261244cfdbfebab1b9a1bd0e
MD5 d85f6691f54b2cc36ab8f51502d2d360
SHA1 7a89a4e180b0922bdb876241a1eeebdce404f49a
SHA512 b5e81adb8e802dff50a8a293286d91eb9f944d70238de4caad8ed38b10a99baeabf4a379501026395c37667fa41a1b27f84752565c56a1d27715a4eec0e39c54
SSDEEP 768:LIhVeG9iAVA6XRkDc6GIwdqtUCiGpc1183+zqOrr8brfKrpFPjlgTUx/j4pfuJrw:LIhVeG9knbrwrPWpferLc
TLSH
T12643935239ED1026B1B77A919FFFD3754B3AB5E3967ACF2A108C010A17D1850B9237B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Lithuanian.ini

SHA256 3ec9580fffbf6a1474fba824893ce9e6516e1e9936a673f03b3942b2777bc494
MD5 6f1aa1ac038cba8a1bc5ac5ad8d6c65a
SHA1 b80efdf232d1bf4f4c0f2dceb6339088f3dd1a3d
SHA512 326dff227c507678ce8c0d6598a91d2739b5182b03db09e9ff3e34f06355d280356dc9bde1aa77c4158b71dafab921595ac079feeb0005b168c08924a536fae7
SSDEEP 768:PIXu/4Nk9Iq8rQZEFhv6/XUlOrnflOzictt+7gqOErq0brfKrWfwqq/Kc6UnhpfB:PIe/4m9dvUQJr16pfHrhj
TLSH
T18143B41279ED102AB1F77A919FAFD3754B36B5E3967ACF2A108C010A17D1950B6233B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Malay.ini

SHA256 0fcbd855bb2b9c3def4d82ebcb1b811b35a1241cee645fc60180f783a60f93ca
MD5 a71575bb008b068bfb5181bee4f22cc1
SHA1 8bde3546d098a7e9a40d6339fc057d5cf8b5ff8d
SHA512 67f733213192946fcd99f136bf50d7f1c3774d3d918866b80b4a4720892fcdb919ea9ef579f1be3f3e8e44f34411b11beb51570b6a58e6b6d702f921fc683e54
SSDEEP 768:aIjWVIru+vdEnrit9ZIvNjZNQaEuenE6Spbl8tsTSchIcc11knaqOsrsbrfKrHFE:bjWVIhEna92FQX6CIJrW6r0FXuC
TLSH
T1D343B41239EC1026B5B777919FEFD3744B26BDE3967A8F2911CC010A1BD19907A237B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Norwegian.ini

SHA256 2a22f618cf0671f4a06b1c4aebb049f728b6192812b4ac84af2a07034047d416
MD5 7bfbf93f720a41f98b893a1ce63af069
SHA1 1b600e39ce3b05ccba8afdd532d740aa5c26d0c9
SHA512 7e7743c05280b925240f07052394da0a3284c1a4711b82c35a1d7cceddb549426c1753a7902f7a9f747880df0fbd15dcf71194a04f4cf550ec1ff712539057ad
SSDEEP 768:UIrvcIiyhIRl7Drlp46QliMrMDwlW0cOeuIhvLziF6EshJu942/DDQYRQuPxE19:UIrvcIivRlzvIVVEilBQuPxM9
TLSH
T1DB43B7113AEC102AB1B677919FFFD3758766B9E3957ACF2D108C000A17E2851B6637B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Polish.ini

SHA256 9e7225a09f6f0cecaade1deddea1c1c55d8036cf3b35305b02a78d61e16d254d
MD5 7a8444380aac8fc2d399adff99ed40ae
SHA1 f47ccec0ea671e5cbc32cad2cd87f97d5011fd14
SHA512 efa9a6601c60ff8c58942a773bf7b005a0771566b228a3329071d20b19f8ed4965520f68040578c15672b4852e06ffa8ee1d584fc0020b842d4be67280e7d7fc
SSDEEP 768:xpxI5/9tr3eS1Z+TTxYz/djRe9b6pgi7hSwBqulAKGcww/VpL99zDqt5XOa4hl5O:ZIl9d3bp250zD66Wk0xc2hYoz
TLSH
T1CF43A6113AFC1025B1B77B919BEFD3758B3AB9E3967A8B6A10CC110613D1851B6237B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Portuguese.ini

SHA256 7b83e2a61421f6e9f8d240c6b1ebb2a2e1d34750f567bb1d496e57939b3592b8
MD5 25bd42340a9671d89aa07180ebeb1090
SHA1 0057f55191c0c9988a989fac9610881420324923
SHA512 2950e0ea247f777280664371193cd311bb156e7da7e58f93e338d6179fb7ea5d393b946929b13ebb6b0045456f0c490665b721bdce509f03457e038d798fa5f0
SSDEEP 768:YIA+Hv21xa+yDRRUtgig6H+b5OKGGkzPcss9DGreIcWvPAE6zkNN7RC0xQWK/SHk:YIA+Hv21xaRR2Zes+IBTQWK/4k
TLSH
T1C04393127AFD1126B1B37B928BAFD3754B37B5E3957E8B29008C11061BE1D506A273B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Romanian.ini

SHA256 028e49e07954a99c5943747172a774ff17145049c780c3afdb20a37d2c164bff
MD5 36dcc6101262f5b41ab66fbaee474cd7
SHA1 d7cf4537089ab0c84ba0d27d8aff2c714da93b1e
SHA512 64cf340a50869a99c84b8233e60ebedb151fd67a3239663024d0b6f90f4ede34e9738a8868a7584dfd6e95e80002e9ae007aee5618aca44d7449a17a45c2637d
SSDEEP 768:1IBYvmCbWiWmLpw2AJ0O37mn36AMilolW64/uwh9nBYpyDXcllgWe/6+n4Jm2YGw:1IubWiWqlO3//ns3J40fkAwzAAbc
TLSH
T1554383117AEC102AB1B777959FBFD3654B37B5E3967ACB2E108C014A17E2C5069233B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Russian.ini

SHA256 838bf6c5073df6d586d5ab0b8f24ed18d7bddd458e5d4b983e34dd49540fad19
MD5 09b2e70896d3293a8b427ddaf2316062
SHA1 47b3d3e0db95f168fe3c81b2c2288ab44c4e88f5
SHA512 de36bc5d1ec4a0c076fb45afa02d1d2dc068d980fa9d89fda3eeff66341e5137968603110c8f36ecae6f437ab82097156ec6e3aa5656e93014f843c8864207a0
SSDEEP 768:hfIJCK/C50tbLKD8u6An+Wc22gvaUc55GRUu2sRczlw3Tex93q1h1Z++4S80ilcX:BIkK/C5GVe88c6QS80i6X
TLSH
T15B439F0BB9EC50257065F2A14F8FC7E547AAB2E3535A8F6651CF281622D987137233F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Serbian(Cyrillic).ini

SHA256 9fb8b11daa50896fb1f917e7da41dd5ed7c4d1875a699de1bb14c0fbf9c97b42
MD5 dc8af72dd60f21588e7d0f151ac5eeb8
SHA1 26aa970503f90a4fd4c66be1c08e08888a1cbbff
SHA512 d53e4ec74e687c22f64f37ff0f9eceb8f5763b44bdad869fff91fc6f0b7d49c44d90cbc3e738c2b8473cb9ecb915c1f25cf6d03f155c870386c9bf0b8a6ecc99
SSDEEP 768:gIt5vu5uwcXmeVazbMSWCb0njzIqcbb4zwjdQLDrzaAsrWAAKKDpU8+Lh/YX0fU:gIvvu8wZHmzZY/YX0M
TLSH
T172438E0BB8FC51247122F2958F8FC3E546ABB6E7937A8646108F280623D797167137F6
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Serbian.ini

SHA256 d7908e87c6ae2fcaf888e6317fdacc6df4c45300c15c4ff6a6210157e80bbe57
MD5 869cc1d9f1b743b9c19f6c0fc9467d62
SHA1 c369c184ac32ec7636e03a6b353d4ed4543d689e
SHA512 51223e765f138fb650d145993ef15277e1bbccaba81714e396e9121ce4251a9aa9f9615438410c776c2f7155b42053bffefecda4032f671a98084e0f7334848b
SSDEEP 768:FIaZ9imSMt2DbYuk6qaTJOAKynCjzc99nExw0NEJOXwRpWMg4Tocd3j2Vv2TVkn7:FIaZ9LSNNMdNE7WucV0knWm7n3
TLSH
T13643E7127AEC1026B1B777919FEFD3754B3BB9E3967A8B2E108C014617E185066633B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Simplified_Chinese.ini

SHA256 598f13e4e72bbc9223220f9cefe055be3f84c98692bd2f838c92ad44e0594708
MD5 0b7b3f83ee5acbdc65e52efd54e180ae
SHA1 380382a703fc4f49dcbaec2d36cb8a11a8abdde4
SHA512 df2dcba7bb6a53b77a7ba35ea046202c58c66927e93a6e4fcf7612c7d0bbeb8d32cdbdec3c44ff2d4e37950eddcd3137712496e2fb4a73bef7cc3ca132cd7bb6
SSDEEP 768:3IOoinX0z4r4FdsFeAUHXND68EwvfO5Obt8z6qbFkcFZFZk+Ljnv5OeahuYVlRai:3I00z4rYuFMOote9rL5OrrHZo6Ddfdq8
TLSH
T15713DE1179ED2039756276D68FCFD3698B2BB6EB82BACB2620DD450723C4C515A233F1
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Slovak.ini

SHA256 fd41319c49cb7f176abfd8bf62f0be235b15bc69ce3b07ac69461137e60c86e1
MD5 332cc1abca6dddd4fe4abb5a20e0492c
SHA1 4948a085d9163e6af38ef0519900c71bdcb6de13
SHA512 0cffe3ec5601b187ed260b58021c9043bee6e2be12bd3925474609ed7ef4d6c78ab5f5a21038b4c1cb96a40a3b998ed588fb5448dfe5e00d68eee63ebadb7333
SSDEEP 1536:FIzhv8ACYlgs1wfzTQH3MGxtr3dMDWPuqQ:ShCG1wfzT+8cPpQ
TLSH
T16D43A31239FC1026B1B777959BBFC3748B7678E3967ACB2A118C414617E1850BA633B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Slovenian.ini

SHA256 63e2616832dae646dbc5b09fe75a40c85c56b1009f35276d46829eba3977c032
MD5 af308dc97be14024219e5ad08bf5df9b
SHA1 39b6f14108a29cea878581d3d554d203a00a2c10
SHA512 4277e2ccc7a7edfbdd4ae02c3c7482e8f726ebe48d32ac7970d8d731d20cad07d2a0c4decf285a636b8f8f92bf5e1f27561d067b983a8655037c42675d626c94
SSDEEP 768:kTI088C2CvhC1yOg1OX3q6xb6aqFcshDQch5/pDywcdWOXFcO9QDYc53+zD3cysU:kTI08f9pC1Mcxd2xcd/qIDpsHJiffV
TLSH
T14453841275FC1029B1B777919BEF83744B77B9E7567ACA2A108C010A27D3891B5A33B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Spanish.ini

SHA256 e93a363f5a5dce5cc4a49a05aaccf6c6ecb161e7ce8b3b57a9c1c1a57612f1f2
MD5 113624739a1c28438d485d1f9b5143ff
SHA1 60910f2404a3a14f117953f96fe74fe27a34e959
SHA512 22cb21336e9c5fcc05d07f5bc0d2aea59330b78325484513e1afb1ee428209da2a18bcb6b91eff2737f38e3403c6820437b17cea769e7fb1b1b3311594269698
SSDEEP 768:tIiYmdFaI6GPEe4Nw16q8KGe7uqvw9wXjcppsouqOKrobrfKr3nCFio3yqpthCTv:tInmdFaILSDC7sr5wCTBZJZ
TLSH
T15943A3113AED1126B1B37B959FBFD3744F3AB9E3957A8A2D108C010A17E1D506A237B3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Swedish.ini

SHA256 ef6b65a58a8d8704e6f413bf91e57738f11355ab232fe73c20267d765d2ae45a
MD5 3b4055d0d8347bd8dfed48637ca420a2
SHA1 5022a3d02d06dbe5ab44179a6b0e68db3226bbe5
SHA512 5d639a24480fa5580ca139ca2458dd75886d371a984004efd9ed58a2cad7e72bea598d7dd775f010c9636a894c2ac2714252bc2bf282a680968fa0439e918c09
SSDEEP 768:QIrCAgHYM9lmeT7+w16Y6ZkYI+hg8Te1JcccrwIsqOBFrVbrfKrQuO1KBJnvxYps:QIrCAgHYM9ldyWAHarcipfer5F
TLSH
T13E43A5123AED1029B1B37795AFBFD3744B76B9E3957ACF29118C000A17E1850B9637B2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Thai.ini

SHA256 462c5a95626f75d5944d3e36335121c167b72798c52a5c561339915f3bb0aac7
MD5 0045703c8c75c70d7a391812e5761a67
SHA1 7d1f27e75406f2ebb79883be00f7c8d18c038882
SHA512 2efdf6569fa6d34ac56d79a5dee9d676872459177d96140841260289a74dc01eef3a77e50a8add9e0ca7621aef896096fb1abd49a19338029b8cd83f001dfde9
SSDEEP 768:vFIHn4POw9asMdGtJUxPGjbX6HjeJPfuWeSQkcSSptOuldPpTBMe2IKhhj+s4Z4W:vFIHn4POw9asRt5vKD0UP8AEUHW+j9
TLSH
T12533DE2079FD21267116B2E9CBCFC7759F2AB1E3C15B8B2600DE861623C18617663BF5
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Traditional_Chinese.ini

SHA256 d63d58a7141aa14ec0bcb28a9b8355e1188fe98d67b3f0afde007081c14bc0e6
MD5 8dfe6357d3c1a5031a00f947d51db462
SHA1 238fe1c35f05ddacc49c5dc2e9578cffa1c38ace
SHA512 9e88e1fb3d2ac574857199dbf5157ed94d499e8f64cfa6328235538c4621974c04fd73e096fdee767f082996afbdb58982d82aa7f7f06196c9a1db95e699d050
SSDEEP 768:ddiIB7Vh4o4eqPKgNArip+UI6u6ZvXSSBmqOlcTTfu2j3/tbE7v5HhMtmp8Y9HdW:eIB7VeVeqPKk90G/IvqmsoFc
TLSH
T14913BB113DDD203A712676A69FCFD3798B6AB2E7826A8F2610DD550723C2C517A233F1
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Turkish.ini

SHA256 2b2cd577fecb2cf4569c9433d2d97482ea3ea1a7f2a1639ec7f6f35818f6b0c6
MD5 474681617694eb71fdbe7a940cbefae3
SHA1 0ec1e202d815d888d01d324603f558d38f126afa
SHA512 f6893c25f4163a83ecf01cc92377d5e4524b71f90e622cb7cf735631dba028357b3ebba15abfef850a847dde0e4aa0e6e1d8a09f6a6a5607c45bde3cb16aadd3
SSDEEP 1536:ccFFcIxq47tqxhklqZpuDH1Hd3fX/LW+WW0SHypp4u:3vZWhklqZpuDVHd3nLZWqqSu
TLSH
T18F43D2113ADC1026B5B37B929FEFD3754B66B9F3967A8F2A108C110617E18507A237F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Ukrainian.ini

SHA256 b37e7f95c08118a4ebd2fb48bd0a55726b843b15e2786639778de539481603b7
MD5 690449592acd1963b934062872f53110
SHA1 00470c59da56dc6c302628ed12bb1efab5830cd4
SHA512 d0497a4aa517900381e535e50a9b2019cfbcf9ad3359730d7b2e7ba7f29a4dc928ad9eba890421a6d4d0c0061390250e108b879de14e6bc6d3b4a9f8823caa49
SSDEEP 768:BIxRlWIwrY4RLkbKsT660mLm5rq4veYcQQ4/TxjDGmFKUmpfuhh6Erddh18WFtz0:BIzlWjYqr15/FhrtzzLpm
TLSH
T1CD43BC07BDFC50257525B2918F8FC3E647AAB6E3439A8BA611CF280222D597577133F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Urdu.ini

SHA256 9404e8fcd3c2c5cc5d99a38a2148acc0dfe1a423a8567c62917ec9c6a1c6ec40
MD5 603d2fcfbb63692a58019fc7a94c6a65
SHA1 3663f4e79119f9ecb05438a06ad883ee6f27ba08
SHA512 70b8e15ddb214c8bdc864c554dae1ce988ea98b5210194e1c8567f9ca24f437a6cb0c024e437e0feb6914752d146630866d2ec3e4d5343896369e3a2f821fd51
SSDEEP 768:TIgpO5U9bfZFuPmqMAW5KB1dV7U/cDDVd4qOLrmbrfKreyVxscZVIPuRam2I6TZb:TIgpO5U99FI4r9miam2I6TF
TLSH
T1C443011179E8D03971737695CF9FC3635B27B5EB81FA8A3615DD002A17C08A0AA277F2
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Uzbek.ini

SHA256 8f412ba57d38090dfd1bf01f13f6fd25adfa5d06fe4bb5b4acac3c31efae224f
MD5 8e9af85650c5daaf6b25119eb253661c
SHA1 b4b889be7d7bfbac1692a422714b2baef6ee6675
SHA512 e750bb002395837a5a17b245ceb0b0ba2d7c34ef5294407effa097009b33c7e3e74003a2dcfd4220d860a596f6107b174854c08779762c75053476974c0acd8b
SSDEEP 768:LImIqjbV86H9CqWSLMhEHiDqW4+J5wSJt+ZVPLn1pE9Hne6Q7SgjEMZny9xBvMq+:cmIWbV86H9QaEUu8YNP3I1r9H
TLSH
T1DF43F31279ED502AB1F37B919FAFD3754B76B9E3563A8B29108C000A17E1950B9237F3
MD5 SHA1 SHA512 SSDEEP TLSH

lang/Vietnamese.ini

SHA256 1e9f437615118e3e79897a278625945ced964e372935d0da60e20fec06f9761b
MD5 7a88fb2eb3e9e4eadfc3ce02948aea3c
SHA1 0f144022b34aec0f3714ef5ef5575a23a2409a71
SHA512 fd52f48979e070a9b7d19852890d40a4678975469cc80d256ab61650d1dd19640183632609349fb519799e8d8fe76aa513897899a0c93a20cd11b3bb26da577d
SSDEEP 768:TIlTcrPE5uLujTvafJw9k2iFOJ7JEbMmhmHAUs68YUGiXKQN+m2fcNNsNns1KIz3:TIh5uLujLahGhUX8GJ0E646Rwt
TLSH
T1A343CF21B9EF602A71B637928B9FD3754B6AF9E3927B9F2651CD150613C18103E133B2
MD5 SHA1 SHA512 SSDEEP TLSH

translators.txt

SHA256 dd0a584cc2a74192a637ab71143c57d83cc00f359921157f3c9891c0f8c25e7c
MD5 e22ab7ab496d229073d511df7e77a6f3
SHA1 4966fa9ed31e0a0d1c81853072e6d2d19113384b
SHA512 c48d8bdd9ee4674ba9097e0838b35ebf221a99671d7213e54f3d14ce51b7bcf0973d7cc7fad6834a5d92b701f84a1580a0b685b426de65f904734bf7fc5e7407
TLSH
T1EE61261E52F88345FAF75B01AAF984640B767DA2F9F8831D12C9040949F0A859B6CFF3
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

bdcamsetup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$SYSDIR/vcomp90.dll

PE Signature issue

kernel32

user32

generic

$TEMP/BDMPEG1SETUP.EXE

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$SYSDIR/bdmjpeg.dll

PE Signature issue

kernel32

user32

advapi32

msvcr90

winmm

generic

$SYSDIR/bdmjpeg64.dll

PE Signature issue

kernel32

user32

advapi32