PFA-1[.]1[.]0-setup[.]exe

resource
PFA-1.1.0-setup.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack002/infinst.exe
unpack001/PFA-1.1.0-x86.exe
unpack001/PFA-1.1.0-x86_64.exe
unpack001/Uninstall.exe
unpack004/$PLUGINSDIR/System.dll
unpack005/dxdllreg.exe
unpack006/dxupdate.dll

resource
unpack001/DSETUP.dll
unpack001/DXSETUP.exe
unpack002/d3dx9_43.dll
unpack003/d3dx9_43.dll
unpack001/dsetup32.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

PFA-1.1.0-setup.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 e9c57280eb3a7a76b769ca7b99f610f7fe1d0600e514798689a003cf0c11e5de
MD5 06a4effb1982aa8f604516040025450f
SHA1 7d345824daa2f8e8e4aaabf91dfa2bd63be40c99
SHA512 051d0f63577263705254195214ceb30b1460f8b715b969c0aa5450c78887d941450f5a22fa0d9ac0bde299d5fcb27f335fd5347bdc374e794c0ed25b7db5a814
SSDEEP 49152:ojYDYpCPgmHLrLrVF5FaheCjpWY88SOYgCZtpdiAG5OerwFPS3L1u:ojC3Fah1n/igASUf
TLSH
T162C5338B73818896C245A7F96E5B5A7181726E9DB5C38C074F253BC7EB7C213C35A20B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in B-flat Major.mid

SHA256 6b4c28b80a5a4ce6119468a75a020ad94ea4de227f62d175bd626b4e32307f07
MD5 24283d76c9cd786b6de7fc3ae969a10f
SHA1 4535fb96f805ea9fb2a4aa6b6d993ff72746c1fc
SHA512 9120e20b624c1633718b329bc1cfd4c9f6894ae04b9e3adca745d5869b4f1d80355aab3f99c0c8d805f9efc620d740862b96e21a2199834d59b5bbb0953e1b74
TLSH
T1AE41D598E2A91433CA51CBDE07BD83ACA4D338949073A82677F32BD545194B53ED21DC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in F Major.mid

SHA256 66664dce24fdf95ad7602ecffda3c5f8462dc3be97b6ce3a63301f89391d0354
MD5 716fa78d728b69b09f8917a524077af5
SHA1 e2d05f939e7da36f4ae8dd7b12211ecce998802f
SHA512 cc99fcccf35a7bc961ef70da51bd6c7fb5a36919a6a5747b1443cbed6cbbc8809d483a43b38410f50352c2854d90181b39fb57fc70506193a2a856e45d07dfb6
TLSH
T1335115BA71A51031DD21AED7037CAB6D75C370D4A0727842BEAABBC49C209F47AD24DD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in G Major.mid

SHA256 fa49852ae9a657842313e23b84a42a3399a3ca2c1b289de93bd466b1a1d85331
MD5 13643a3fc7c843e446d5d14ad035fb02
SHA1 e489f8b5eb6d30b71d3c7c56b1e3994b9609e885
SHA512 e3b8b5e2a2124c73996b377f6a27ea5883af412c56e41d92862d058960a484271359f2163ab79047d82b382a25ca99f5187bc2ddce10d01ce6d1bd44856e1f64
TLSH
T1294123E136DA1470CD6EFFD583AC5B1C7983B1D1D0763926BA6C5BC8A1210B5E0E28DE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in G Minor.mid

SHA256 2a993b933f92f6adf317ce8d4da8592e20cf01195b92143595fee734b206ff5f
MD5 a32e987752c3081b6e152ed8af9070f7
SHA1 b29858aafc9f1302dd795dec3cd157ffc248c050
SHA512 f7f96066414189bb5ccfbb1f792ac8fdeceb879ca424de30b472e1f1b3ce7f23f8db25d9450cb342e07218fc41e57fc88d7cce2824089950b14c9d37bf4d3cd4
TLSH
T16041E0E671F25034EE56AFC2432D87ACB68371C0E07179697DA19BC4A4209F1BDC18EE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Musette in D Major.mid

SHA256 8813af8a9305e9f2264d130bd4bd4e69d550c05e51bb56c429dc76a64d829603
MD5 4ad89a0ab293a4021644acf8f4541891
SHA1 e66730a84c82a54b93fb44fff9d677eb8bbc69de
SHA512 45a33ddecbd655b02b1a067f1e752ea014c6a59d9b0ee31d076328eb02d5da4c8cdbb80f20b6dc474b8588e441c333044999c69e0d0bb92faac5c54996e2c34d
TLSH
T1BD31F9DAF1512534DA129AC04BEC356AD0C3357040B7A61BBBF51B8DD1A0E786DE24F9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Chopin - Prelude in C Minor.mid

SHA256 59c15525b27d3a2c400ca81cb8dc75b05685c0b929eb78268756b013e8d39986
MD5 939f4a4ce36106b0d804ee1b9f19604f
SHA1 5a0f9587bbaf97a1fc416eacaf881550e23ec1e8
SHA512 f2c5b16e0abe8f60d096e6de181f5c64ab531cd7a055302e9f8c30fc902420839e4ff4dc8caf82734ed69eb328f1b130ba65991d97f0916b3ba65b76a3c3484c
TLSH
T1E151715B1B484D82DB2E1E7890068B1567F927A04201F4EF200DED0AFDD36BC81C1ECD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Clementie - Sonatina Op. 36, No. 1 1st Movement.mid

SHA256 9696c57417f40c66e9a74d3ba56e9b43905b798262c7ba7843f00205536e2265
MD5 23d89aa9326ec90f7e2366a6804e5670
SHA1 1b9c22c3a13ab9b4c68f026fb5d8fcc0aa8252e9
SHA512 ba3da38d715cc3d0ba43c50e89bab6669b92d9d80b42c29a8bf491c2318629b4be1e1f63106776deb92e444de6b67f5016e51d296e2972e8a5ca54e5f2781004
TLSH
T1FD617DB329A65511D012EEEFB39E086E5617914DD7F2362EB02DA78C07C50E068D2DDF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - First Sorrow.mid

SHA256 55156715e3a34eeebb8cc6e8066b6c77c703ecd6f2a76de2d98928efdc619a9c
MD5 8b9e7c798c5ab2f3b7af2ca5d5ad15ea
SHA1 9c25f257e7fed2cf6475b66c09a8d397740232af
SHA512 a6d4a34b8300187bf73cc9c496fae5b2182f730ceeff2242d198bfa813fb990da5d6cae93500460cf2be2f4698148cfebadbd9bbff017f946a9d929d57f93f46
TLSH
T18151D612A69C5431DA28BBDA036D4B97B1E361462177715CB7FE3B90DAA00F9B0C50DB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Humming Song.mid

SHA256 f747f9b5275d249f77f5b7c39ac1db3e2a1a26e850b3ef370859ec1af3e37cb3
MD5 8d1cc11793d5e31fdc39645f3d6d6bea
SHA1 07320a402aceaeae78ef2925e89f0140ac64b782
SHA512 cabf5802e22cdc158454aef05bfa394258efb682b0f97e3cd96ca7d06f8f46922804c38d3a01c8dfdf207e0ead740ae1f73eb7d7a426fb1f2d420abbde5b8fe8
TLSH
T1E351290D9721140BFF2A9EEE838E7842B6CF51956931154FB24D1B8E83D387039CA8E7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Melody.mid

SHA256 e58e708afe8b31c634a0e9f3354a4ed94670e929d82926f7ff49dea3ebe146c2
MD5 cd7b18eec38ab6ff4e08465813263a6d
SHA1 59dda8165dc847f44a8ca2e407ea6b9d6d261193
SHA512 b9ae76d5fad102cb60f03a830fb8e636e44a9ef322a72fc5210f4d6cda261a53cd87803def23affef47b4b4da8d3e5476c657f2d1edf053d3bf1464ea741306f
TLSH
T18B419E12C6A9D55EC71EE63EC79E6C4B4384BA532670138FB85C079D13E66E018D4CEB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Sicilienne.mid

SHA256 faa91b513ff620d2f6a07d75b36240f67787dbdf5492fae4b1895a5e716c0ee2
MD5 eb558de19a79db9c640740e2cf772950
SHA1 f052ab715f1fe74d589fa6395a912ff0e4f973cb
SHA512 c24529ae60d6693da268e8cb78955fc097d8da314f7b285bc43ba5ab6d32cf31da87f35599abbf51639086e83dc9230917393daa898c88f4f238025aa2e2d941
SSDEEP 96:4Rrt/85CQ8QrJg69Yq/8Qp5Jg6cu2gV/nv2yPQR9iSdDiSQ2gV/nPryNY5azrJPp:4t4I2grkFQDiSdDiSeeBf4krSKdV
TLSH
T187E1EFA3C2CC9131E828EBD9630E6F0E69C724D1617664EE71F47BC098A50B6D0E55CF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Soldiers' March.mid

SHA256 d4d2665d25a105aba22ba08a02293c58b7853421075ad29c36ab378f9db6c52a
MD5 36e75deb1146eec5c44262c6e7fcb8e5
SHA1 02966788ba4f4d1c0a25a5d88e83f661b084773c
SHA512 48b0d98d97862985f4f8ec57da0393237225df4f1d94842aa439b2a17a71a988669fe8d00fa5cdf9141bb6b531aaa7950f922962479884916a7e73cddd3c32c5
SSDEEP 96:DS2PRfYX92PRfYXtCiA2PRB9bFCiA2PRB9bmQpoPwjwQp5sQpoPwjwQp5OTQpoPx:BpxpspPpdo8fto8fboM0oMj
TLSH
T171C1F7575E961548DB13EEAED74D715BF603B28853F2222EB9485B4C83C22F468D18CF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - The Happy Farmer.mid

SHA256 6c42561efae9ca63fbac7dbf72bbb0cf48c88d36553e6be73ed26341b668b411
MD5 7b179923f4b8f574e647c4f81d99a388
SHA1 8c755227e12f6222950d04ce8b196f1b4f66e2af
SHA512 29362056f788306c63e1590b1c6865cf20b7386b7d85f1eb85714fe5406801dc5c61ed958b2f5d8fe79ffd67461c79fbe445d47014c07a142d64d2f7b15c8e78
SSDEEP 96:KQBkB/BFBG6BOVjAqAq05d65BsBn05d65BsBiSJGDSJGOSOS+rOLFZt3D:3AqAqysanysaiSJGDSJGOSOSVFj
TLSH
T1CC91DE2790863DE8E4BB1D768D138125B6D39B6D1D68D6CCD049630F7D0E4841EE8ECB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 01.mid

SHA256 9b9a6213941932d5171d9102d85912c3c1c61f8176ce02005cd2198881823c2d
MD5 a39cca053378c9ec0db9f156fcf8ceef
SHA1 0b31bb8861ae47fa41c0d362db611eb887a7cf3e
SHA512 c8dcb73295fcf0f6a1c1dbf902145faa58522a908ced9614760d3f177e1cda0fc89c0a2f0fd5e853b5a76a44be6a9ba7d4961cb9ed2c91e9c62656287dd2ee57
TLSH
T199814859F16B1475AC69FFCA430E761564CB7CC06072A84F7BF42BD884908F8AAC14E6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 04.mid

SHA256 5ecc06eb04d56ea40bd4db64bfd49ac9bff523e46d134912fa5bd07aea1db1c7
MD5 79ecf03c119376acb2fc5bde673b57aa
SHA1 31c22a7d094b541236e887112d40fbd5cb330939
SHA512 a1961afdae357535cb63738382878a428f02c3f655a163060b60f0f93ff95ff2e4613ea807ebf8f2310414e6d5db5acca8561c634fa80adecc79f03be91d7dd4
TLSH
T10C71F229F67F1432ED25EEC6832D756898DB3CC01076F84B7EE81B844490AF8B9D25E1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 09.mid

SHA256 fcba8eaa630cec1e4207eb024ffe25e9ad03c4382a68c415b7162b6baa58b0b0
MD5 1982a954fc9ecdd3ff64dcc8580fcd93
SHA1 34b84beadbcd13bfc64ec0f04cac30c256d8be39
SHA512 9ee2dac6e810c3f476d743b55f130c8d6fc064e5831b7671ffee452b521db160dc466692bfd1e4af75ec3b6f69d1f1822bb85f2e1dc0e0f00c2a5de78df414d4
SSDEEP 96:cqnv+7QUn3ntNJe3tMazOtLazrWKgzGtzntNJtNSVFLPLufXNSa56KijjzHSuHSr:cqnv+7QUn3ntCtZStm3WKgKtzntnt8VW
TLSH
T178A1462DF629053399AAFAC24B1EBD8E24C72CC1703178977AE817D41845DFCA8C39E4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 15.mid

SHA256 4b629b29d815d9f253600836a2801444780f20718b74892c502a044da6f85a88
MD5 a9028e8694813c696f9dda07c06fd624
SHA1 89c7d188cfc9c9a757bf4efd9a3b8cda02c9dc19
SHA512 eb278afa392be60271db16df430fb12bf7d03307f5487ae7da0498f1e33504c2af7ecf3d1054aa9dc7c1d245cf1ee7d3ed1d876937c47ee28158466a55462023
SSDEEP 96:csB584rJ5R8/YB58s4hl1Hv1XtP+Pz+PVRBH/+qL7eBZjSTxTXZnOVVQyPzVQVVA:cR5hl1Hv1X5CzCVRBH/jL2jSVXZnOVVN
TLSH
T1C3816C19D0F62478A839FFC90BCC359616DB1CE0017ABA5BF6F10BC8998457859E34E5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Beethoven - Fur Elise.mid

SHA256 f26dee755a2eb52c993784fef76bd1a1038c2b9f9c3a5b5e3f28566dd837cc73
MD5 1ed905c591d616dbaad0aba1dc7804e1
SHA1 e7bd1e414dc0fb1a0935c175bd636475d47644e6
SHA512 2258d196198688de15b2c087218c1f3df595d56742c168a4d18131a828948ee4a00507c43787d15e0e5170ae6e13468eb52721348b397c45e4e18a0496b3a39a
SSDEEP 384:tiBEL1SdAJ+HWXRuCAJGd//3l50Y+jcTJbawpE:XL1SdAJ+HWX9AJmOx
TLSH
T1F352DECC2EE93D7BCAB556798A73569E05E3AC195E4227BC33D9B983350244B0C0326F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Beethoven - Moonlight Sonata 1st Movement.mid

SHA256 e1924bdfc12a26afd80fcf2485463a76bd750632998d24c732080be069205755
MD5 edd78c2cfac2ed6401cafb8071b09023
SHA1 5f3973b1516f833cdd53c2116afbee3eb0dc3b83
SHA512 9ff95bc5df4ab6d44038cb197454a1a436ea21c69700591795ea0df7de7ae73a93f83482f6f817cb1a0df69f47cac5c1b319e14c274b4825fba0348780c0f99a
SSDEEP 384:4NDOLbY+Be8j8Qof04yNdO47XxQz0uSvNTyM1nV:44LbY+BOQof0JXxQz0u+j1V
TLSH
T1646296C86EA610B2D2EDC57812FDCD99B1E65AE89807BCEE9B155807770535FB040C8D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Beethoven - Pathetique 2nd Movement.mid

SHA256 d1e30060013f68cb153b71b05a149df15b5f2781bf94b23fe0163c4800a285cb
MD5 60429fd4ae21e02b5fbb33f299adb569
SHA1 fd35ee25933fe318bad09c3f22b82b34a9067bbf
SHA512 9cf978c71aab0ca4ad926a95eacb03728c4b5430c4bcc62529c186a439a1296ef306b04cdb30ad517a5d7b9259c23bef7dc4d21e300ab9fda88068ad23b80346
SSDEEP 384:jHG/dsHQsuU9gs40RH2vnuo2BYWxB9ZRcF:jmFK5jgN0V2/uo4ZRcF
TLSH
T12762641559A9406FF2C5CE790CB49E41A39715250FC3E7EAC2832A17FCAA02EE75198F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Chopin - Prelude in A Major.mid

SHA256 38e458909adb31067d118f011e525883bbf8b93014c03b94bf9b3a2565f19d19
MD5 63275169ebbe5d1850c1d6b74f49d6cc
SHA1 aac14f81b52b148449af65dc633d81da38e1d9bc
SHA512 30e74098d2818faccef272c42a532417e1f67735acd4c111b900532262d2541b4d3147c8383522ef5dc01601c846c6648222f5f94ee837ad2fb5ac2ac67b920d
TLSH
T14B41669B7B8FFD52C5894C7770F0D309759619B362A8948F2C882905F73A5DC5480F85
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Chopin - Prelude in E Minor.mid

SHA256 8b8984ae232642ff1979b84af642d5d5db60f7f7f20b3745f2d4b4f17cdaf908
MD5 271ffdfd5d51fdbf54c593111b7a4482
SHA1 dc0ed84c063f22ce965f4117b56c9c5833ab8dc5
SHA512 c49ee6f462b2c1d62388bf273cdbc1adc10eeda82ed15365f27a40035fbcbcf3289b093a96ae98bdab72abb95992771059241dd25855b9439b8f4aadfd8af0ad
SSDEEP 192:ycbJHT92KT5Qz79bJjTlWVLF3ViCO44KDWKCDn3EWE/zHIRUxXCKRNxvN:ycFHx2Kaz5FjBWVLF3ViCJfCjUWE/zoC
TLSH
T14FF1426F3D07A94ED3C849BDB834450A42EACDE45D66ECC8C59E85633BF244B4D81B8B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Mozart - Sonata Facile 1st Movement.mid

SHA256 4eaf2669dcf4a5d9810c482c32696677227a9f7b42dbfc7356bce1d5d0940f90
MD5 157c315c5cb77d57d3e5b669e30cbafd
SHA1 da29c5456d82a5a41b56f479ca2969dcf93a517e
SHA512 e945b4ae845ff75277d5170010ddb370565d7555bdfeed3fe245617204c9536ece8e547057aeab7d7867b3c98036ae5cb4573f48869a864118754a1be4a5b0cc
SSDEEP 768:vsnk2HkBcmyGD/Y/YHKXKkCR6CRl+QmnZlZS:vCkckB5pDNKXKkCgCp
TLSH
T109E29906D28029E6D37AE527BC228781F0FA7FFB17184DF9C1F019D279838AB905548E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Mozart - Turkish March.mid

SHA256 f5a481a90b10e7cd5a2d80bc298229dcf6b41e711baa2922de5d769933bef393
MD5 b097c4ef553269a8ff45717bfc92d26e
SHA1 f8ff735361a0a96298810758439c6f103d689a4b
SHA512 dea542011570eb39a2ca0a73bd8ff9c6b383bb9c289f6cca127b351ba0138e366ec0d6ca3868b2791e697c197652512c3bbce8efb86b11305094d28c5184ff12
SSDEEP 384:nbmCobm0guT5FRwnlnSnSnaY6s6xrDCXrrDCXm6s6cY:bqNDYa1DCDi
TLSH
T180C234BD8F51467BE957862E1ABEDA0121CB5CFECE106AF9E92D98537C074424C362CC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - Dreaming.mid

SHA256 45d6428ad618385d45da53ce3021dd60044373149ce23d86e34aa647175b6edd
MD5 83eb2bee8045a50c0737b5bc05a93505
SHA1 f570dc4a0c944e154f8bf96dc5176a1f2d380947
SHA512 2325dfbdd56578f38e5ec75f356144004bdda60bb57d6ff0b9a4a3e0046eccb1bc0a16cf9f616f550c08dad20c0469ec76d26f4cb1162534ffcab7765ca92fa9
SSDEEP 96:cjbq0EC1NIEv8SFJkHWJ3l5k3lU/DX8U0M+YR8AASRiYteNmlM+dAOT:N0EC1NB0iJksMMDXF+W0VmjT
TLSH
T16AB1842B49008EF5C2D94E7C6C77530972C6B6226D56EAFEC2C9C54B78A311A2E04EC7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - Farmhand Rupert.mid

SHA256 2ca396587cc463e3d5b96317f041ee3c4fd67a36582b6f27fb1f62f1423377a4
MD5 8634762356bba12f7b17ea21298cec4e
SHA1 c9f9fad54a91c60ead3be5fffd793dd8ec8937f0
SHA512 d0cb6e709f664d8a91c36319b4e410bb40238f34f3bc915459abab02ee791bf204a0609d9437e86527f304c7951cc82575bc6b0747ce96d288f6a1fb650539ad
SSDEEP 384:J84aB7B/6uF6f5i4/5i4/J1z/XBuVBuxi4/t6g:J840lCusfR1z/XBuVBuV
TLSH
T13E6201D7AB8955B5EB990A354933DA6A95D22A360F94EFCDC0883C3F3D8701318B1987
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - Hunting Song.mid

SHA256 18e7ae891edeafdc39d46f61864a88d3a52d2604cd213c2bae8cb3d32e523a46
MD5 e6358ca7919629f3e2e11fc0ba870ee1
SHA1 cdd3ac5e572ba5bc7e0081e4874005bbff152597
SHA512 a5a4650d9bf0de1b9dfa09654c350eaa351406c6504c51e1fd561369f91cd20d29f3bf27106b1ce3e1e33daf4d135b57a9311c1e81233327ca36e33b89ca49b6
SSDEEP 96:fP66ts1x1d66W1t12M7Eb7SYyODw4Tp66fHXp872DS6fHXp6OfASpF:fP66tsb766W/oM727XyWL5z54cF
TLSH
T10EC18163B554246CCEE3EEAB039E812EB4373548A0B2376F750D578094911B475CA6EF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - The Wild Horseman.mid

SHA256 197f870dea372a09c7905b9b02c6ed3b4c6b10b18a3b79c421ca01947dc45991
MD5 c4c5649084a0323f23b9e6f192950685
SHA1 82a479143fbe4cf9d05f28da742a9e5e583071d2
SHA512 184ef5ca9db64c6f9fb4ad5020a936fd3c9d54038b28599faae118f8cf56b77cf866a4ae26cd4df423ab596bab349e21f8ba3ce3671533bcf466e481f6be3d56
TLSH
T151811223E050216DD9E7ECAA078E491BFA73788480FA356F705CEFD458652B075C68EE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Bach - Prelude and Fugue in C Major.mid

SHA256 107f2b6a298f283f8d26d4e8359669e7780f7ea64011b7844f2ed066d874a37e
MD5 f7ab9716a5e6f1ee971d0e788c58c5cb
SHA1 7759b99a471715ba00d5d68f72c7b83d47a25d29
SHA512 90a7045902692069baa70867e7bd2e7776ea924a71e8e8288362f469fbc2cb1ad4a6e34cef0e6c92ae6c98cd174a661a79fd6e6d46f52b0a8626af261d2dc74a
SSDEEP 384:eyeRbc2H1ACD1tVawMF8oIgf9fEq2GSquooweqo:5Abc2b1tYw5o3fdEMgx
TLSH
T15B42326F94E405CAE3974D3E8CFB990AA3B7AE641AD193CAC2F828273D53757150045F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Bach - Prelude and Fugue in C Minor.mid

SHA256 6a5a582455fee99765fd3c920810b36f1a4d7a991d7e93e74f072fc060faf0bf
MD5 2c5f68ac4e0935411ebef405da3b5ef5
SHA1 a1d4ce1ae02ce2babb91254757b627e55502eea6
SHA512 e4823e59f08448e1c833a70db19352ebdc4eae214ced46c9142ee345b9b6ab94c5db3fd24a711f3986a8edc061c71484d575c631813d72d072ad66dc8754509c
SSDEEP 384:wmmmrmUmi2m8mImHmjmGmXmjmCmxmlmFmNmHmQm8LezjxLB0K4eCJm/RlsBwZGcV:w54rh2nny6F6YfOiCKy3MjxLGeCU/RGm
TLSH
T18C620962D98057FDE7824B4F486F9144A5E366B76E09CFB1F8C9B41B3CB40444B5A82F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Chopin - Black Key Etude.mid

SHA256 feb3bec0606917a92aba0344a4a601f4239a920714cbefd39a8981d6d0b607f5
MD5 b54e4fb4eae81edaf0021c70920301cf
SHA1 859a175c58f12268000925614e93bf93d40c7d58
SHA512 056c676204ec8dbf872a46874ceb2cc9982f3bf290c0f7dabc4933be860c2774e6f536dd9cbd617859bde66de42fe8524b6c1ab0f3e9cba2a94a6d00f9b241a0
SSDEEP 192:eX3S4zCYz8NIGKvFxsqwAmPrugdm022anb+pu3O:gi6CYCfKjeNPrzdm0On5e
TLSH
T13342525469814FA0DDF484768E302AD85398C8EE8A9AECB48544F5323FB46CF5DCCAD7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Chopin - Etude Op. 10, No. 1.mid

SHA256 6ebe4878b153e8f5b3761dcca36ff33a0bab286e213b74bc24a69862010af4b3
MD5 5ee768c78598d94a8e3d7e30017d60bc
SHA1 0ffccf4dd8e343c70fde5594379c0421c0f4270c
SHA512 638a7fc686ed682bd99c835fffb4d246f0fcf6d6b6aebabecc9e9e3a550dbc3db0554ada28673a2c29d3afee526eded9ce44f306a8f6b4d114c75227b2b4ebe8
SSDEEP 192:aEoTXZzj2xB+QvhDw4sOGy3hQsdARH7WilzvtBFsp596oi:axtzjwBKOGyTARbWGzxsti
TLSH
T1D02274B9C9C04FC6F49A8D7FD763B90D5A63AEFF8E5181B95D88981E387258B050048D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Chopin - Fantaisie-Impromptu.mid

SHA256 8f5df5f08a9f0615878ec344d445668e7af12da9d84d9f04136c0b458ed9ad8c
MD5 f25769ca3f3bf0def9cda6462e92cc26
SHA1 97d16c0e7f199d7ce1d4983103b2aebe9b44986a
SHA512 cde0f30f3ad72ffce152f88c7723d9b9386f40e5047c7377ee4dcd274f3cc33c74f0f243244618ec095b078c28e5fd28fb0390bf3ea1cf73b8c4cd83afb5051c
SSDEEP 384:zcGn5lR55m6NYNEefra/aaaaaQmiXJpoLtoLEcMZufME/3O2h/qiGGNTOiWEsyWE:0Y9MLSLXMJcqiG2TOiWELN
TLSH
T1D5F288DD1EDE33FBC7AC99EF8DF337648977ABF34850A8490D12A006352625BD048999
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Chopin - Funeral March.mid

SHA256 ab29708f68016ec6db0f7d9b3f64a187ef5bae9e1e53c59a4fdce0ba29f34f28
MD5 6f1619bc25cbfcd482838bee2e2f08ea
SHA1 6d4a3f1830f42dd9362ee91016acf1da89912009
SHA512 2d2215728bfff7bf9df0766875628ea90b91b59d86ec497439784834441c5c659586d111183c67416c4f6c750914eb7aee222b02d93255c1b51ae913a7349f51
SSDEEP 384:+6lVeWKJhRWGF9mjmow+SvDmBm2bpT9jZ5AtOAt1cxqZ:+6lV0JhdXmjmhmBm2bF9juZaqZ
TLSH
T1B3B294915D4209B9F7D48CB58971AA0A63A5E2463E10E6CFC506A923FF21C9F1C8DDCF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Chopin - Revolutionary Etude.mid

SHA256 a376584d5b8c7fb3983c46e4ddef3e5866c2c7ec11a3dd7b59fdecea9ba3914f
MD5 b17d5d487511e25bbd3e15aa2c517c6c
SHA1 af54f06d33e0f07196c21e68125e6bfee39d510c
SHA512 fb9bb3e15ee630d18c9af17e55c0f77404997faa5b8fba4e65791872f4c1167188487b1da3ccc319ed18a7b570effae9cbf373b4ff366d4724d4d4a3bd856d6f
SSDEEP 384:98m7c0U+fL86B1CgXr6RYnkAb+1zpv7y91SsJLovA5UGU17wKKSb/5s:98m7c0U+D86BogXr6RYrsQ7/5ovAWDtw
TLSH
T19BA2192E2DC32BFBE505297580745C5C20EAFE7A8D0079FE5CB55867399088F826DDE8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Debussy - Clair de Lune.mid

SHA256 10f58bc6fc50fe2eb5ac2e850ab0606338039ab90442e46ee62c2885ef626a4e
MD5 dfc3079ef01c4f9cfe80312d7f71edfb
SHA1 1273162051a1d06c2dbd4d4117ec24c53a5a63f0
SHA512 5adfe04de3a3894e5510ce2d45fe3c5c51e39301f377b65ebc582e63c93a3f63de930b8c34ef6e9878cc905f5e0ce5cfd6157cb9f486dc90205d2fd7d95f9bae
SSDEEP 384:MZUUdJTkWrRHRdz7xd0B3ikDCyCAwlD0PnMOsBO6:MljgWNxdzNd0B3ikDCH/lD0/MOsBr
TLSH
T1AC72B69E5E1822EEF59C4F764AF17A4E20C4B5222F10A6FDC48D181B7DB610B5C85BCB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Godowsky - Study of Chopin Etude Op. 10, No. 1.mid

SHA256 b8968719db9f92a09f15a46a111a35ab7407dee6780923bb206c4b14ad98b0b6
MD5 b5c2ab89558e36f7db56ecaa30ecd048
SHA1 926f9eee111ae47aee584b8ff0011b1ed864383b
SHA512 9d8aa68a2970bbd30214028b21c202a61c2e8ff2eeb3ffb38266a2e6c08f5bb227ed9596b781342f6942278108acf4877e54c0726ed4ea3c621076409ee7f74a
SSDEEP 384:d+1HlAG78zOPTHOCEFLwp4wL0SwTZfoQnkeSFfvmXxu+51:HsxH6k4w09Vkr1mhu+L
TLSH
T152A2A74F66810B7EF32A9A3CC867F5094BE3AFF68F1156ED1D1898273C42857815A78C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Grieg - March of the Trolls.mid

SHA256 f44bde38cbb0d73ebb8dc283a3a3ae8e7c0cb954202def1761864081fed2b1e8
MD5 7dd1200a0626e2c265e00ba82b1c558b
SHA1 a8a709410d8a5dcc244a5d5d73162c92031e9a6d
SHA512 7fb7fc7b5daaa3473ff950b344aeb82e9696c8e194d7be39a960ce03411610cb32a62da501d92a56a8277156957aa78ee6091388f51e3227cfdfe9c6a45f2340
SSDEEP 384:bhF6WozdJ6U38SDIRQMx/DXRaNOCXXXXXXXVzY:bhFQn6u8GIV/DXRkOCXXXXXXXVzY
TLSH
T1009272E7BD10CAA7E1A5C93DAD32BA4868E09E798F14C5E89E4C49077E239474C1CCDD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Joplin - Maple Leaf Rag.mid

SHA256 89d2a6bfa077ddb161d960dd371d913753a5317eeec8f99c9a3a591514df74c0
MD5 262db1d05dc1e026b0c8414bffd407b7
SHA1 b5240a9c0cdffd11dd656686170389c92c22a566
SHA512 f1ee746ff285bc9abf1efdf2ac917b36dd210ab6eb415e8d75ccb1dc7f5fc04339ff563db0a7514460c29ff12ff01cfbef7b283d2271172cecedabaa583d2107
SSDEEP 384:6jBv94jBv9IfzUfzGjBv9C76So76SMdlN:6jBl4jBlIfzUfzGjBlCeSoeSMdlN
TLSH
T10AA2A36F2D595A03EFA1AD8D135D9C27BB53A685A530500EB25CF7AE03CB4F098C18DB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Joplin - The Entertainer.mid

SHA256 80f94141dff97aabb3cf37e1ccc3f6ac41563dd4421d0a648786a8f8e36efc68
MD5 2927cd1580c18837bca6b32736b3ca14
SHA1 44bde5e636eb931328f080a2d70850a155559eba
SHA512 b5a8bd04ec1940a3c27287fa9414d96f9d2f5af7cd86cd7867202ac103580ff751311c922afc59d6b65dea6cb2a94b53e70a75f06f7086689ab224500ed08e72
SSDEEP 192:c//5h4lel6TOU2ebLzOU2ebV47TvXXuUPTDbawhKTeckvAKsKrpx5cZQePydBsR7:hOiODTvX+UPTKww3kYIxK3
TLSH
T1D1A2F753E2194472DB2A9DDA231E370670C722D0607AB9CFB9F1AE808471DF87AD18D7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Liszt - Hungarian Rhapsody No. 2.mid

SHA256 e924b212d7eff49855cf3fe374e67cd509fd76d9ed6f23043d28f235ee81c5c5
MD5 82bcd9f7b7f5d29d344b727354117b9b
SHA1 445bfb153ba58d266790b446ef20aa1e97dd2feb
SHA512 6d256598c03a2c746277f8074b1c67e95beb0d64cc8a4477c463278d15a26f01f55b8a76f0f3df01a78758c797c613f835d93ed29c77e0fc67f9e7a86d7bb2b0
SSDEEP 1536:7gWD13Koi+jElJefDjQcHbkViyQhaOrmGzRq0WK1:H27CDjPbkri
TLSH
T18663F8E79E4804B2C6764A338661BA08B2DB7E762F01ABDD9DE464677D238410CCD5CF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/3 Advanced/Liszt - Love Dreams No. 3.mid

SHA256 1590cfbbe2337cce3deb06f6a5a38e576fa8e031dab3fcab3319a0a382b2ae27
MD5 16138a3bc34ebf09bc28b9a1140ece9d
SHA1 b8aa5ae548022d0a6d81243e2d585586d58bf68f
SHA512 4907e964767c3fe26f33b3738610582d68721fe5ba1f59f22aad721674ceb8a5fc23615cc00eef542803c86228c8e1f63873365d920446943a10a53c1fa932f5
SSDEEP 384:XE4qIDUFmGu/9YZTjiYCB92F56cuA0XPXuNn4G107w0T/3k:DDCmGu/9b9i6cZ0XmNkc0z3k
TLSH
T1D6A2D8E548555AFAD3AD0E340877070171D12AB78E26DF4DCD08F86BBA979821E88DCF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$MUSIC/Piano From Above/Credits.txt

SHA256 d0a89529ebfd61ad88f656447203494008dc2963869e7c23454a0bc5300b9693
MD5 20f7c2320b5f446ac4ce99f4ada70fc2
SHA1 13c779b8d5545711720171e1bddc99fe9519d801
SHA512 d4b09f95a8289fe5ac643990cb3bd3992b43237a6c44a67e627e17a6c4d016854cfd0085da03893d2fc0d9736b8a96c059f7c5db17a9c6b709ca48398063b897
SSDEEP 192:tQlcasFs1flrlMHfJe3rsUrsECnM3b3YgHot:2okrlqYrsUrsESezYgu
TLSH
T1C8E1652FF280BF6707B24A41A752F5E1F108F46DD72B2829345EF2282B7D8B951B4281
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 423bc65055da3aa46049e78886c28440c010562552d4fe808fa9b4f0f33b708c
MD5 5304c45bc146a05b5b3e76cf74fdb3f0
SHA1 18c8599b2808aca5fde9ab2cba7962ff14d0a943
SHA512 d4706f4ed209ad0b7dcc88e9d9ba65b0360f431dd9628be38bd600ed48af4249cd766643c06acbae6d3797aa84541af277493a4fd4b0349418c19c2950137124
SSDEEP 96:ernLnLnLnLnLnLnrKvbAvbAvbAvbAvbAvbAvbAvbA13o3o3o3o3o3o3oEJTX8X8Y:e/akkkkkkkGEQQQQQQQQT9QQ9
TLSH
T172C29B2348335E63EE9A2F36829E7DAAF04E1D75A4C37F99B0EB1721D0745DE0125D0A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 d4ce03601812c3e03b8fefd7c9ad6234215e7e73a540a02b8a1da19a4e3320a4
MD5 6029ff437c743037ba8b6bd755ebaf9c
SHA1 71d782ac0b38a586cf0636125349fa9b62663164
SHA512 b03ccb1f01174c3beef050d6bcc57852bde1ba033afb9e65c63dd36456bc82d9d161efba983830a1e8c0551b768a4904c9a552e736102c57b1b5c14750b06e3b
SSDEEP 768:478e/b0ZkKTb+ZsCwzY/r3CCCCpMCMCMCM:Qhz013YRKECCCCqnnn
TLSH
T10DE307DD8C6A6062DC2E623D6CF706903739AAEEF5AC67F32438B4745E075874E7104A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Credits.txt

SHA256 d0a89529ebfd61ad88f656447203494008dc2963869e7c23454a0bc5300b9693
MD5 20f7c2320b5f446ac4ce99f4ada70fc2
SHA1 13c779b8d5545711720171e1bddc99fe9519d801
SHA512 d4b09f95a8289fe5ac643990cb3bd3992b43237a6c44a67e627e17a6c4d016854cfd0085da03893d2fc0d9736b8a96c059f7c5db17a9c6b709ca48398063b897
SSDEEP 192:tQlcasFs1flrlMHfJe3rsUrsECnM3b3YgHot:2okrlqYrsUrsESezYgu
TLSH
T1C8E1652FF280BF6707B24A41A752F5E1F108F46DD72B2829345EF2282B7D8B951B4281
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

DSETUP.dll

IMPHASH 5ee93a27b334994f92812e79a2fb75bd
SHA256 def6f245762be36cf18b435ba8b7ebc224b9c21d1a1db606a8e8fafdaa97bba0
MD5 9e0711bed229b60a853bcc5d10deaafc
SHA1 2bea53988bd35c5df5c9edcef0bc234c37289477
SHA512 c0b31872e52c8f4270d991c70d1a1c9ef9a4bbee4807c54c05a449cd1607506ab16ff1e74b378651b36e3276322c86cd843565c8a1aa33a49c47322ef4df0185
SSDEEP 1536:OtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCH:OtAvG5mOEll4Roi2pVVFKJuTVtXVpS9a
TLSH
T1CE937E2176A0C176D4D7207875ACA37216BEB5B10BB880CBBB4617E9DC713C1BE3931A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

e7:2c:0e:bb:86:1f:cb:57:4e:97:97:44:28:c3:0a:2d:07:1d:2d:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

0

Major OS version

6

Entry point

28846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DSETUP.pdb

kernel32

LocalFree LocalAlloc lstrcmpA WideCharToMultiByte GetSystemDefaultLCID GetModuleFileNameA SetLastError MultiByteToWideChar lstrlenA lstrlenW CompareStringA CreateDirectoryA GetWindowsDirectoryA FormatMessageA GetCurrentThreadId DecodePointer GetCommandLineA HeapFree HeapAlloc HeapReAlloc GetLocalTime EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW InterlockedDecrement Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentDirectoryA HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent WriteFile GetModuleFileNameW EnterCriticalSection LeaveCriticalSection RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers CreateFileA LCMapStringW GetStringTypeW HeapSize WriteConsoleW SetEndOfFile GetProcessHeap ReadFile CreateFileW GetSystemDirectoryA SetCurrentDirectoryA GetVersionExA LoadLibraryA GetProcAddress OutputDebugStringA CreateMutexA GetLastError CloseHandle HeapCreate FreeLibrary

user32

GetKeyboardType DestroyWindow SetFocus CreateDialogParamA SetDlgItemTextA MessageBoxA PeekMessageA GetMessageA TranslateMessage DispatchMessageA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA RegSetValueExW RegCreateKeyExW RegQueryValueExA

winmm

mmioRead mmioDescend mmioClose mmioOpenA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

ole32

StringFromGUID2

DXSETUP.exe

IMPHASH 9f601d1261adacd540476661fd007bc3
SHA256 046041aba6ba77534c36bb0c2496408d23c6a09f930c46b392f1edc70dfd66de
MD5 ddce338bb173b32024679d61fb4f2ba6
SHA1 50e51f7c8802559dd9787b0aebc85f192b7e2563
SHA512 7a63925278332c8e7949555383b410d8848a7834b85f34d659e351ba78cbe4d2ec09caccb2178d801b9b68725c9cbae48a6a1f07f0804a0c41eb51df79b7eca4
SSDEEP 3072:ti6LKecn5W6VOX6dRJar+GHs6Hl56MA6rKmMH2/5Mjt4zT1mFDYkCIEVNUrlfw0I:3F0JarNX6hWs4VRKs
TLSH
T169B49F5077F8D925F2F32B743AB9E26549BA7E80A934C60D2601525D1BF3B00E968F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

b1:da:04:49:85:85:98:e8:94:a8:22:25:b7:5b:70:bb:f9:f9:02:96

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

0

Major OS version

6

Entry point

32238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DXSETUP.pdb

advapi32

RegCloseKey RegDeleteValueA RegSetValueExA RegCreateKeyExA RegOpenKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

kernel32

FindClose FindFirstFileA lstrlenA ReadFile GetFileSize CreateFileA GetCurrentDirectoryA GetCurrentProcess GetModuleFileNameA SetErrorMode CreateMutexA GetModuleHandleA CreateThread GetSystemDirectoryA CloseHandle GetVersionExA LoadLibraryA GetProcAddress GetWindowsDirectoryA FreeLibrary CompareStringA FormatMessageA lstrcmpiA GetProcessHeap SetEndOfFile WriteConsoleW HeapReAlloc GetStringTypeW HeapSize FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer Sleep LoadLibraryW MultiByteToWideChar LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent RaiseException HeapAlloc RtlUnwind CreateFileW LeaveCriticalSection EnterCriticalSection OutputDebugStringA CreateDirectoryA GetLastError LocalFree GetCommandLineA HeapSetInformation GetStartupInfoW GetLocalTime SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess HeapFree

gdi32

CreateCompatibleDC GetObjectA StretchBlt DeleteDC SelectObject CreateFontIndirectA DeleteObject GetDeviceCaps

user32

ReleaseDC GetDC LoadImageA SystemParametersInfoA SendDlgItemMessageA SetWindowTextA GetWindowLongA SetWindowLongA PostMessageA GetParent SetDlgItemTextA GetDlgItem SendMessageA ShowWindow GetAsyncKeyState ExitWindowsEx EnumWindows CharLowerA LoadStringA MessageBoxA GetWindowTextA GetClassNameA SetForegroundWindow SetFocus

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

comctl32

CreatePropertySheetPageA PropertySheetA ord17

Jun2010_d3dx9_43_x64.cab

SHA256 9b98a1269af7f3a0007bfdc73206a47a6ee158d34ba8a87009396c18186bb06a
MD5 063fa6f7061324eac1c4de0350c20e80
SHA1 daccf01b4b7493b88f04f9e50fe37c03846335ad
SHA512 3ad31100cbca4da52e46518e577dca94b595f9d47a3e9552cd764905ffc2876f9127b69a97bac44dbd754021e14ddec65480b7628a3768f03e53de8fbb08c547
SSDEEP 24576:mneqhPULh1ksCctVV+WOwy/vW09rabgcZhBeYCrrPe:1hOJY3+Lwy/vjkgcZaXO
TLSH
T1C21533859AADF8D55ABF0B0510912763267F33EB62F4F08BD5E126C05C30795438E7AE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

File Signature issue

Digest

b327c3422449de2da54dcaafefdc1c94577c97ad

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

JUN2010_d3dx9_43_x64.inf

SHA256 272650a2d9b1cfea17021f4bf941b21f2206791e279070d4e906ce0ce56ac16f
MD5 ce097963fc345e9baa1c3b42f4bfa449
SHA1 e7624afc3a7718b02533b44edfe4f90d1afda62a
SHA512 f3c4f00eebd9d465bc2415d59c417bca0f5a07c8e13880b28704f770763609a653d4b06f53d98325b66c2c7094895190900c47980f81463215e919f00966ee7b
TLSH
T19A016B99CC02D43677DAE9B27B8B274A2767050AFA127198799A01C4AF63240116C6EC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

d3dx9_43.dll

IMPHASH 336d8057d1db03e5a3ac3b62e8902f4b
SHA256 84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
MD5 7160fc226391c0b50c85571fa1a546e5
SHA1 2bf450850a522a09e8d1ce0f1e443d86d934f4ad
SHA512 dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
SSDEEP 49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
TLSH
T17CB5486172F4C1E4E32A9039B597B20BFAB1304907188BC793E04D9A5FE6BD46CFA355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

bd:1c:4f:ec:4a:e7:0c:11:ef:6d:b7:89:8e:6a:4a:de:c2:22:ed:47

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 22, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

1

Major OS version

6

Entry point

2186524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3dx9_43.pdb

msvcrt

malloc _vsnprintf _finite memmove _purecall qsort _stricmp modff iswpunct _clearfp iswdigit iswalpha iswspace ??2@YAPEAX_K@Z ??3@YAXPEAX@Z _strdup setlocale free calloc realloc sscanf _strtime _isatty _write _lseeki64 __pioinfo __badioinfo wctomb _itoa _snprintf _iob _fileno isleadbyte ?terminate@@YAXXZ _onexit _lock __dllonexit _unlock memset memcpy __C_specific_handler _amsg_exit _initterm _XcptFilter srand strtod fread fwrite fflush abort _tempnam _ultoa isalpha atol atof isxdigit wcstombs _isnan rand atoi isalnum _vsnwprintf isdigit isspace longjmp ldexp frexp __CxxFrameHandler _errno _strdate sqrt powf sqrtf floor fmodf memcmp log cos exp sinf cosf floorf ceilf atan2 atan acos asin sin pow atan2f logf acosf fmod asinf _setjmp ceil

gdi32

GetObjectW GetGlyphOutlineW GetCurrentObject GetOutlineTextMetricsA TranslateCharsetInfo ExtTextOutA MoveToEx ExtTextOutW CreateDIBSection GetGlyphOutlineA GetObjectA GetCharacterPlacementA GetCharacterPlacementW SetTextColor SetBkColor SetBkMode GetTextMetricsA GetTextMetricsW GetFontLanguageInfo CreateFontIndirectA CreateFontIndirectW SetTextAlign SetMapMode CreateCompatibleDC DeleteDC DeleteObject SelectObject

kernel32

FindResourceW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetProcessHeap HeapFree HeapAlloc ReleaseMutex WaitForSingleObject CreateMutexA IsBadWritePtr IsBadReadPtr IsBadCodePtr ExpandEnvironmentStringsA GlobalMemoryStatus GetSystemInfo SetEndOfFile MoveFileW GetTempFileNameW MoveFileA CompareStringA SetFilePointer DeleteFileW FindResourceA LoadResource LockResource SizeofResource GetFileSize CreateFileMappingA MapViewOfFile FreeResource UnmapViewOfFile LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection LocalFree FormatMessageA GetFullPathNameW CreateFileW GetFileSizeEx GetLastError IsDBCSLeadByte WriteFile DeleteFileA CloseHandle ReadFile CreateFileA GetTempFileNameA GetTempPathA IsProcessorFeaturePresent VirtualFree VirtualAlloc GetACP MultiByteToWideChar WideCharToMultiByte OutputDebugStringA GetModuleHandleA FreeLibrary GetProcAddress LoadLibraryA GetVersionExA Sleep VirtualProtect DisableThreadLibraryCalls

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyA

D3DXAssembleShader D3DXAssembleShaderFromFileA D3DXAssembleShaderFromFileW D3DXAssembleShaderFromResourceA D3DXAssembleShaderFromResourceW D3DXBoxBoundProbe D3DXCheckCubeTextureRequirements D3DXCheckTextureRequirements D3DXCheckVersion D3DXCheckVolumeTextureRequirements D3DXCleanMesh D3DXColorAdjustContrast D3DXColorAdjustSaturation D3DXCompileShader D3DXCompileShaderFromFileA D3DXCompileShaderFromFileW D3DXCompileShaderFromResourceA D3DXCompileShaderFromResourceW D3DXComputeBoundingBox D3DXComputeBoundingSphere D3DXComputeIMTFromPerTexelSignal D3DXComputeIMTFromPerVertexSignal D3DXComputeIMTFromSignal D3DXComputeIMTFromTexture D3DXComputeNormalMap D3DXComputeNormals D3DXComputeTangent D3DXComputeTangentFrame D3DXComputeTangentFrameEx D3DXConcatenateMeshes D3DXConvertMeshSubsetToSingleStrip D3DXConvertMeshSubsetToStrips D3DXCreateAnimationController D3DXCreateBox D3DXCreateBuffer D3DXCreateCompressedAnimationSet D3DXCreateCubeTexture D3DXCreateCubeTextureFromFileA D3DXCreateCubeTextureFromFileExA D3DXCreateCubeTextureFromFileExW D3DXCreateCubeTextureFromFileInMemory D3DXCreateCubeTextureFromFileInMemoryEx D3DXCreateCubeTextureFromFileW D3DXCreateCubeTextureFromResourceA D3DXCreateCubeTextureFromResourceExA D3DXCreateCubeTextureFromResourceExW D3DXCreateCubeTextureFromResourceW D3DXCreateCylinder D3DXCreateEffect D3DXCreateEffectCompiler D3DXCreateEffectCompilerFromFileA D3DXCreateEffectCompilerFromFileW D3DXCreateEffectCompilerFromResourceA D3DXCreateEffectCompilerFromResourceW D3DXCreateEffectEx D3DXCreateEffectFromFileA D3DXCreateEffectFromFileExA D3DXCreateEffectFromFileExW D3DXCreateEffectFromFileW D3DXCreateEffectFromResourceA D3DXCreateEffectFromResourceExA D3DXCreateEffectFromResourceExW D3DXCreateEffectFromResourceW D3DXCreateEffectPool D3DXCreateFontA D3DXCreateFontIndirectA D3DXCreateFontIndirectW D3DXCreateFontW D3DXCreateKeyframedAnimationSet D3DXCreateLine D3DXCreateMatrixStack D3DXCreateMesh D3DXCreateMeshFVF D3DXCreateNPatchMesh D3DXCreatePMeshFromStream D3DXCreatePRTBuffer D3DXCreatePRTBufferTex D3DXCreatePRTCompBuffer D3DXCreatePRTEngine D3DXCreatePatchMesh D3DXCreatePolygon D3DXCreateRenderToEnvMap D3DXCreateRenderToSurface D3DXCreateSPMesh D3DXCreateSkinInfo D3DXCreateSkinInfoFVF D3DXCreateSkinInfoFromBlendedMesh D3DXCreateSphere D3DXCreateSprite D3DXCreateTeapot D3DXCreateTextA D3DXCreateTextW D3DXCreateTexture D3DXCreateTextureFromFileA D3DXCreateTextureFromFileExA D3DXCreateTextureFromFileExW D3DXCreateTextureFromFileInMemory D3DXCreateTextureFromFileInMemoryEx D3DXCreateTextureFromFileW D3DXCreateTextureFromResourceA D3DXCreateTextureFromResourceExA D3DXCreateTextureFromResourceExW D3DXCreateTextureFromResourceW D3DXCreateTextureGutterHelper D3DXCreateTextureShader D3DXCreateTorus D3DXCreateVolumeTexture D3DXCreateVolumeTextureFromFileA D3DXCreateVolumeTextureFromFileExA D3DXCreateVolumeTextureFromFileExW D3DXCreateVolumeTextureFromFileInMemory D3DXCreateVolumeTextureFromFileInMemoryEx D3DXCreateVolumeTextureFromFileW D3DXCreateVolumeTextureFromResourceA D3DXCreateVolumeTextureFromResourceExA D3DXCreateVolumeTextureFromResourceExW D3DXCreateVolumeTextureFromResourceW D3DXDebugMute D3DXDeclaratorFromFVF D3DXDisassembleEffect D3DXDisassembleShader D3DXFVFFromDeclarator D3DXFileCreate D3DXFillCubeTexture D3DXFillCubeTextureTX D3DXFillTexture D3DXFillTextureTX D3DXFillVolumeTexture D3DXFillVolumeTextureTX D3DXFilterTexture D3DXFindShaderComment D3DXFloat16To32Array D3DXFloat32To16Array D3DXFrameAppendChild D3DXFrameCalculateBoundingSphere D3DXFrameDestroy D3DXFrameFind D3DXFrameNumNamedMatrices D3DXFrameRegisterNamedMatrices D3DXFresnelTerm D3DXGenerateOutputDecl D3DXGeneratePMesh D3DXGetDeclLength D3DXGetDeclVertexSize D3DXGetDriverLevel D3DXGetFVFVertexSize D3DXGetImageInfoFromFileA D3DXGetImageInfoFromFileInMemory D3DXGetImageInfoFromFileW D3DXGetImageInfoFromResourceA D3DXGetImageInfoFromResourceW D3DXGetPixelShaderProfile D3DXGetShaderConstantTable D3DXGetShaderConstantTableEx D3DXGetShaderInputSemantics D3DXGetShaderOutputSemantics D3DXGetShaderSamplers D3DXGetShaderSize D3DXGetShaderVersion D3DXGetVertexShaderProfile D3DXIntersect D3DXIntersectSubset D3DXIntersectTri D3DXLoadMeshFromXA D3DXLoadMeshFromXInMemory D3DXLoadMeshFromXResource D3DXLoadMeshFromXW D3DXLoadMeshFromXof D3DXLoadMeshHierarchyFromXA D3DXLoadMeshHierarchyFromXInMemory D3DXLoadMeshHierarchyFromXW D3DXLoadPRTBufferFromFileA D3DXLoadPRTBufferFromFileW D3DXLoadPRTCompBufferFromFileA D3DXLoadPRTCompBufferFromFileW D3DXLoadPatchMeshFromXof D3DXLoadSkinMeshFromXof D3DXLoadSurfaceFromFileA D3DXLoadSurfaceFromFileInMemory D3DXLoadSurfaceFromFileW D3DXLoadSurfaceFromMemory D3DXLoadSurfaceFromResourceA D3DXLoadSurfaceFromResourceW D3DXLoadSurfaceFromSurface D3DXLoadVolumeFromFileA D3DXLoadVolumeFromFileInMemory D3DXLoadVolumeFromFileW D3DXLoadVolumeFromMemory D3DXLoadVolumeFromResourceA D3DXLoadVolumeFromResourceW D3DXLoadVolumeFromVolume D3DXMatrixAffineTransformation D3DXMatrixAffineTransformation2D D3DXMatrixDecompose D3DXMatrixDeterminant D3DXMatrixInverse D3DXMatrixLookAtLH D3DXMatrixLookAtRH D3DXMatrixMultiply D3DXMatrixMultiplyTranspose D3DXMatrixOrthoLH D3DXMatrixOrthoOffCenterLH D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovLH D3DXMatrixPerspectiveFovRH D3DXMatrixPerspectiveLH D3DXMatrixPerspectiveOffCenterLH D3DXMatrixPerspectiveOffCenterRH D3DXMatrixPerspectiveRH D3DXMatrixReflect D3DXMatrixRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixRotationX D3DXMatrixRotationY D3DXMatrixRotationYawPitchRoll D3DXMatrixRotationZ D3DXMatrixScaling D3DXMatrixShadow D3DXMatrixTransformation D3DXMatrixTransformation2D D3DXMatrixTranslation D3DXMatrixTranspose D3DXOptimizeFaces D3DXOptimizeVertices D3DXPlaneFromPointNormal D3DXPlaneFromPoints D3DXPlaneIntersectLine D3DXPlaneNormalize D3DXPlaneTransform D3DXPlaneTransformArray D3DXPreprocessShader D3DXPreprocessShaderFromFileA D3DXPreprocessShaderFromFileW D3DXPreprocessShaderFromResourceA D3DXPreprocessShaderFromResourceW D3DXQuaternionBaryCentric D3DXQuaternionExp D3DXQuaternionInverse D3DXQuaternionLn D3DXQuaternionMultiply D3DXQuaternionNormalize D3DXQuaternionRotationAxis D3DXQuaternionRotationMatrix D3DXQuaternionRotationYawPitchRoll D3DXQuaternionSlerp D3DXQuaternionSquad D3DXQuaternionSquadSetup D3DXQuaternionToAxisAngle D3DXRectPatchSize D3DXSHAdd D3DXSHDot D3DXSHEvalConeLight D3DXSHEvalDirection D3DXSHEvalDirectionalLight D3DXSHEvalHemisphereLight D3DXSHEvalSphericalLight D3DXSHMultiply2 D3DXSHMultiply3 D3DXSHMultiply4 D3DXSHMultiply5 D3DXSHMultiply6 D3DXSHPRTCompSplitMeshSC D3DXSHPRTCompSuperCluster D3DXSHProjectCubeMap D3DXSHRotate D3DXSHRotateZ D3DXSHScale D3DXSaveMeshHierarchyToFileA D3DXSaveMeshHierarchyToFileW D3DXSaveMeshToXA D3DXSaveMeshToXW D3DXSavePRTBufferToFileA D3DXSavePRTBufferToFileW D3DXSavePRTCompBufferToFileA D3DXSavePRTCompBufferToFileW D3DXSaveSurfaceToFileA D3DXSaveSurfaceToFileInMemory D3DXSaveSurfaceToFileW D3DXSaveTextureToFileA D3DXSaveTextureToFileInMemory D3DXSaveTextureToFileW D3DXSaveVolumeToFileA D3DXSaveVolumeToFileInMemory D3DXSaveVolumeToFileW D3DXSimplifyMesh D3DXSphereBoundProbe D3DXSplitMesh D3DXTessellateNPatches D3DXTessellateRectPatch D3DXTessellateTriPatch D3DXTriPatchSize D3DXUVAtlasCreate D3DXUVAtlasPack D3DXUVAtlasPartition D3DXValidMesh D3DXValidPatchMesh D3DXVec2BaryCentric D3DXVec2CatmullRom D3DXVec2Hermite D3DXVec2Normalize D3DXVec2Transform D3DXVec2TransformArray D3DXVec2TransformCoord D3DXVec2TransformCoordArray D3DXVec2TransformNormal D3DXVec2TransformNormalArray D3DXVec3BaryCentric D3DXVec3CatmullRom D3DXVec3Hermite D3DXVec3Normalize D3DXVec3Project D3DXVec3ProjectArray D3DXVec3Transform D3DXVec3TransformArray D3DXVec3TransformCoord D3DXVec3TransformCoordArray D3DXVec3TransformNormal D3DXVec3TransformNormalArray D3DXVec3Unproject D3DXVec3UnprojectArray D3DXVec4BaryCentric D3DXVec4CatmullRom D3DXVec4Cross D3DXVec4Hermite D3DXVec4Normalize D3DXVec4Transform D3DXVec4TransformArray D3DXWeldVertices

d3dx9_43_x64.cat

SHA256 10241b98d145da870e153a3776250ad6ea3207111ce43e0f21bf4cc82c51cf08
MD5 2fee464e300bffb0138d09ed065afd3d
SHA1 920276b1f8111ec5b4557c45db5027180f8ff447
SHA512 4557ee847ebf34dc6665dedfdaa132d6ad7007585d7f14d5f1b9849781641e4b4a9131e342a3bc185931ebcbe926de7268acd6186c546dff6591743627d3c64b
SSDEEP 96:XSxmenkVDPDaD9D743Ss/kPnE8UADPDaMm/D743bM5DODs+5cxzRWolNDPDaZD7w:CwFEQKPnEtObMacxc8hjXHUz1Tr2MSP
TLSH
T1F0E1E9DA8D6CD143ED5A9D9197E8EDA77C38C7C34810942E10ABF7D809837D16719C2C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

d3dx9_43_x64.inf

SHA256 71bd128262424567380c63c9c23eb819212222317026ad44e965ecac2224b848
MD5 654ec3755dd6ff76c3e200c445ee4956
SHA1 916a8a1419bf59c19913b74e053e9bd8ffd9197d
SHA512 65eebb20e9fb3cca1bdce2041f306fd9ae53727b298fba202722217c49c58682871513f0a0714a246f1f9e75870c8c7ccf9a77b7b1d33314ea168bcc747d5f58
TLSH
T14B012D2CAA257BC8F1D3794025018583687A2284A38270CB78ED8685FBE2704D3BC1FB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

d3dx9_43_x64_xp.inf

SHA256 9092f1deea3c1b5b440a1dacf1e908b844749870c7f7d96d851bba972d431e2f
MD5 e7affe3af8199fd7af239d5348954c2b
SHA1 dc231e5ccbb5087d43e3d714e9e447f33d820e30
SHA512 4d0ba06ca67c4c943ea1f8e925df5a748cfd8ff29182d248ad1ea1c139fb54a8e9035b52e3d50d9ea06ddd1df7ac80e4fb45ff07bfb17c501e410b8cfcdf9c1f
TLSH
T174F0555DEA11BA08F2AA3E0016028A8268782680531570CE78ED8A84F7A1201C3B96FA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

infinst.exe

IMPHASH b54d51a922d4328f78447962adb9d1a5
SHA256 8c62fe8466d9a24a0f1924de37b05d672a826454804086cddc7ed87c020e67ff
MD5 a7ba8b723b327985ded1152113970819
SHA1 50be557a29f3d2d7300b71ab0ed4831669edd848
SHA512 60702f08fb621bf256b1032e572a842a141cf4219b22f98b27cb1da058b19b44cc37fb8386019463a7469961ca71f48a3347aaf1c74c3636e38d2aea3bca9967
SSDEEP 1536:uOPXfyLm7r2P25504T+kGvNcD9QeZu/FOfNlpaJrxO1wh:usXfyLm7rGo504TzucD9HoIfND8xO1wh
TLSH
T182836B9933A410B9D1AB927CC8E24B05E7B2B496473693CF0368469A5F23BC55D3E733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

26260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

infinst.pdb

kernel32

FormatMessageA GetWindowsDirectoryA CreateDirectoryA GetLastError OutputDebugStringA LocalFree CreateFileA lstrlenA MoveFileExA FindFirstFileA CopyFileA FindClose GetPrivateProfileStringA GetModuleFileNameA GetCurrentDirectoryA CompareStringA CloseHandle CreateFileW ReadFile GetProcessHeap SetEndOfFile WriteConsoleW HeapReAlloc GetStringTypeW MultiByteToWideChar LCMapStringW HeapSize FlushFileBuffers SetStdHandle SetFilePointer GetConsoleMode GetConsoleCP Sleep GetCommandLineA GetStartupInfoW GetLocalTime SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW RtlUnwindEx FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc HeapSetInformation GetVersion HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc RaiseException RtlPcToFileHeader LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

setupapi

SetupDiGetDeviceRegistryPropertyA SetupInstallFromInfSectionA SetupDefaultQueueCallbackA SetupOpenInfFileA SetupCloseFileQueue SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupCopyOEMInfA SetupCloseInfFile SetupOpenFileQueue SetupDiSetDeviceRegistryPropertyA SetupDiGetClassDevsA

Jun2010_d3dx9_43_x86.cab

SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
MD5 7749862c307e527366b6868326db8198
SHA1 bce9f21cdb1e101c7223c9e62eca61ec22d6bb81
SHA512 b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b
SSDEEP 12288:w0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYu:Z51NVO+XVLs3VztQHmYjBJb931I1NYIZ
TLSH
T10AF423432AA5348E8C523043E3669A2724B83557CEBDE77562A44B2D0CFD76F113ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

File Signature issue

Digest

1a8ae50b66f7de9899369329e9f0a444409bf2c6

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

JUN2010_d3dx9_43_x86.inf

SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
TLSH
T1A73146DD8C02E4307B94B6B27B9F364F2727450BEA61314D77C90990ABB3341115D2F8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

d3dx9_43.dll

IMPHASH 5fb75b2a87c1fa7cc3d7904a0b97084a
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9b:28:ef:17:5d:cd:b3:d3:ec:10:d1:6d:64:92:d2:24:02:c3:2b:3e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 22, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

1

Major OS version

6

Entry point

1829901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dx9_43.pdb

msvcrt

_isatty _write _lseeki64 __pioinfo __badioinfo wctomb _itoa _snprintf _fileno isleadbyte ?terminate@@YAXXZ _onexit _lock __dllonexit _unlock _amsg_exit _initterm _XcptFilter srand strtod fread fflush fwrite abort _tempnam exit isalpha atof atol isxdigit _ultoa wcstombs _CIexp _isnan rand atoi isalnum floor _strtime _strdate sscanf isspace isdigit _setjmp3 longjmp ldexp frexp calloc realloc _CIlog setlocale _strdup free _clearfp ceil _controlfp malloc _CIatan _CIcos _CIasin _finite _CIsin _CIatan2 _CIacos memmove qsort _CIfmod _purecall _stricmp modf iswspace iswalpha iswdigit iswpunct _CIsqrt memcpy memset _CIpow ??2@YAPAXI@Z ??3@YAXPAX@Z _iob _vsnprintf _vsnwprintf _errno __CxxFrameHandler

gdi32

GetTextMetricsA GetObjectA GetGlyphOutlineA CreateDIBSection DeleteDC DeleteObject SelectObject GetCharacterPlacementW GetCharacterPlacementA SetTextColor SetBkColor SetBkMode GetTextMetricsW GetFontLanguageInfo CreateFontIndirectA CreateFontIndirectW SetTextAlign SetMapMode CreateCompatibleDC ExtTextOutA MoveToEx ExtTextOutW TranslateCharsetInfo GetCurrentObject GetOutlineTextMetricsA GetGlyphOutlineW GetObjectW

kernel32

DeleteFileW SetFilePointer GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile FindResourceA LoadResource LockResource SizeofResource FreeResource CompareStringA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FormatMessageA LocalFree CreateFileW GetFileSizeEx GetFullPathNameW GetLastError IsDBCSLeadByte WriteFile GetTempPathA MoveFileA CreateFileA ReadFile CloseHandle DeleteFileA InterlockedDecrement InterlockedIncrement IsProcessorFeaturePresent VirtualFree GetACP WideCharToMultiByte MultiByteToWideChar OutputDebugStringA GetModuleHandleA FreeLibrary LoadLibraryA GetVersionExA GetSystemInfo GetProcAddress VirtualAlloc GetProcessHeap HeapFree HeapAlloc DisableThreadLibraryCalls MoveFileW GetTempFileNameW GlobalMemoryStatus SetEndOfFile ExpandEnvironmentStringsA IsBadCodePtr IsBadReadPtr IsBadWritePtr WaitForSingleObject ReleaseMutex CreateMutexA Sleep InterlockedExchange InterlockedCompareExchange RtlUnwind QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetVersion GetTempFileNameA FindResourceW

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey

D3DXAssembleShader D3DXAssembleShaderFromFileA D3DXAssembleShaderFromFileW D3DXAssembleShaderFromResourceA D3DXAssembleShaderFromResourceW D3DXBoxBoundProbe D3DXCheckCubeTextureRequirements D3DXCheckTextureRequirements D3DXCheckVersion D3DXCheckVolumeTextureRequirements D3DXCleanMesh D3DXColorAdjustContrast D3DXColorAdjustSaturation D3DXCompileShader D3DXCompileShaderFromFileA D3DXCompileShaderFromFileW D3DXCompileShaderFromResourceA D3DXCompileShaderFromResourceW D3DXComputeBoundingBox D3DXComputeBoundingSphere D3DXComputeIMTFromPerTexelSignal D3DXComputeIMTFromPerVertexSignal D3DXComputeIMTFromSignal D3DXComputeIMTFromTexture D3DXComputeNormalMap D3DXComputeNormals D3DXComputeTangent D3DXComputeTangentFrame D3DXComputeTangentFrameEx D3DXConcatenateMeshes D3DXConvertMeshSubsetToSingleStrip D3DXConvertMeshSubsetToStrips D3DXCreateAnimationController D3DXCreateBox D3DXCreateBuffer D3DXCreateCompressedAnimationSet D3DXCreateCubeTexture D3DXCreateCubeTextureFromFileA D3DXCreateCubeTextureFromFileExA D3DXCreateCubeTextureFromFileExW D3DXCreateCubeTextureFromFileInMemory D3DXCreateCubeTextureFromFileInMemoryEx D3DXCreateCubeTextureFromFileW D3DXCreateCubeTextureFromResourceA D3DXCreateCubeTextureFromResourceExA D3DXCreateCubeTextureFromResourceExW D3DXCreateCubeTextureFromResourceW D3DXCreateCylinder D3DXCreateEffect D3DXCreateEffectCompiler D3DXCreateEffectCompilerFromFileA D3DXCreateEffectCompilerFromFileW D3DXCreateEffectCompilerFromResourceA D3DXCreateEffectCompilerFromResourceW D3DXCreateEffectEx D3DXCreateEffectFromFileA D3DXCreateEffectFromFileExA D3DXCreateEffectFromFileExW D3DXCreateEffectFromFileW D3DXCreateEffectFromResourceA D3DXCreateEffectFromResourceExA D3DXCreateEffectFromResourceExW D3DXCreateEffectFromResourceW D3DXCreateEffectPool D3DXCreateFontA D3DXCreateFontIndirectA D3DXCreateFontIndirectW D3DXCreateFontW D3DXCreateKeyframedAnimationSet D3DXCreateLine D3DXCreateMatrixStack D3DXCreateMesh D3DXCreateMeshFVF D3DXCreateNPatchMesh D3DXCreatePMeshFromStream D3DXCreatePRTBuffer D3DXCreatePRTBufferTex D3DXCreatePRTCompBuffer D3DXCreatePRTEngine D3DXCreatePatchMesh D3DXCreatePolygon D3DXCreateRenderToEnvMap D3DXCreateRenderToSurface D3DXCreateSPMesh D3DXCreateSkinInfo D3DXCreateSkinInfoFVF D3DXCreateSkinInfoFromBlendedMesh D3DXCreateSphere D3DXCreateSprite D3DXCreateTeapot D3DXCreateTextA D3DXCreateTextW D3DXCreateTexture D3DXCreateTextureFromFileA D3DXCreateTextureFromFileExA D3DXCreateTextureFromFileExW D3DXCreateTextureFromFileInMemory D3DXCreateTextureFromFileInMemoryEx D3DXCreateTextureFromFileW D3DXCreateTextureFromResourceA D3DXCreateTextureFromResourceExA D3DXCreateTextureFromResourceExW D3DXCreateTextureFromResourceW D3DXCreateTextureGutterHelper D3DXCreateTextureShader D3DXCreateTorus D3DXCreateVolumeTexture D3DXCreateVolumeTextureFromFileA D3DXCreateVolumeTextureFromFileExA D3DXCreateVolumeTextureFromFileExW D3DXCreateVolumeTextureFromFileInMemory D3DXCreateVolumeTextureFromFileInMemoryEx D3DXCreateVolumeTextureFromFileW D3DXCreateVolumeTextureFromResourceA D3DXCreateVolumeTextureFromResourceExA D3DXCreateVolumeTextureFromResourceExW D3DXCreateVolumeTextureFromResourceW D3DXDebugMute D3DXDeclaratorFromFVF D3DXDisassembleEffect D3DXDisassembleShader D3DXFVFFromDeclarator D3DXFileCreate D3DXFillCubeTexture D3DXFillCubeTextureTX D3DXFillTexture D3DXFillTextureTX D3DXFillVolumeTexture D3DXFillVolumeTextureTX D3DXFilterTexture D3DXFindShaderComment D3DXFloat16To32Array D3DXFloat32To16Array D3DXFrameAppendChild D3DXFrameCalculateBoundingSphere D3DXFrameDestroy D3DXFrameFind D3DXFrameNumNamedMatrices D3DXFrameRegisterNamedMatrices D3DXFresnelTerm D3DXGenerateOutputDecl D3DXGeneratePMesh D3DXGetDeclLength D3DXGetDeclVertexSize D3DXGetDriverLevel D3DXGetFVFVertexSize D3DXGetImageInfoFromFileA D3DXGetImageInfoFromFileInMemory D3DXGetImageInfoFromFileW D3DXGetImageInfoFromResourceA D3DXGetImageInfoFromResourceW D3DXGetPixelShaderProfile D3DXGetShaderConstantTable D3DXGetShaderConstantTableEx D3DXGetShaderInputSemantics D3DXGetShaderOutputSemantics D3DXGetShaderSamplers D3DXGetShaderSize D3DXGetShaderVersion D3DXGetVertexShaderProfile D3DXIntersect D3DXIntersectSubset D3DXIntersectTri D3DXLoadMeshFromXA D3DXLoadMeshFromXInMemory D3DXLoadMeshFromXResource D3DXLoadMeshFromXW D3DXLoadMeshFromXof D3DXLoadMeshHierarchyFromXA D3DXLoadMeshHierarchyFromXInMemory D3DXLoadMeshHierarchyFromXW D3DXLoadPRTBufferFromFileA D3DXLoadPRTBufferFromFileW D3DXLoadPRTCompBufferFromFileA D3DXLoadPRTCompBufferFromFileW D3DXLoadPatchMeshFromXof D3DXLoadSkinMeshFromXof D3DXLoadSurfaceFromFileA D3DXLoadSurfaceFromFileInMemory D3DXLoadSurfaceFromFileW D3DXLoadSurfaceFromMemory D3DXLoadSurfaceFromResourceA D3DXLoadSurfaceFromResourceW D3DXLoadSurfaceFromSurface D3DXLoadVolumeFromFileA D3DXLoadVolumeFromFileInMemory D3DXLoadVolumeFromFileW D3DXLoadVolumeFromMemory D3DXLoadVolumeFromResourceA D3DXLoadVolumeFromResourceW D3DXLoadVolumeFromVolume D3DXMatrixAffineTransformation D3DXMatrixAffineTransformation2D D3DXMatrixDecompose D3DXMatrixDeterminant D3DXMatrixInverse D3DXMatrixLookAtLH D3DXMatrixLookAtRH D3DXMatrixMultiply D3DXMatrixMultiplyTranspose D3DXMatrixOrthoLH D3DXMatrixOrthoOffCenterLH D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovLH D3DXMatrixPerspectiveFovRH D3DXMatrixPerspectiveLH D3DXMatrixPerspectiveOffCenterLH D3DXMatrixPerspectiveOffCenterRH D3DXMatrixPerspectiveRH D3DXMatrixReflect D3DXMatrixRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixRotationX D3DXMatrixRotationY D3DXMatrixRotationYawPitchRoll D3DXMatrixRotationZ D3DXMatrixScaling D3DXMatrixShadow D3DXMatrixTransformation D3DXMatrixTransformation2D D3DXMatrixTranslation D3DXMatrixTranspose D3DXOptimizeFaces D3DXOptimizeVertices D3DXPlaneFromPointNormal D3DXPlaneFromPoints D3DXPlaneIntersectLine D3DXPlaneNormalize D3DXPlaneTransform D3DXPlaneTransformArray D3DXPreprocessShader D3DXPreprocessShaderFromFileA D3DXPreprocessShaderFromFileW D3DXPreprocessShaderFromResourceA D3DXPreprocessShaderFromResourceW D3DXQuaternionBaryCentric D3DXQuaternionExp D3DXQuaternionInverse D3DXQuaternionLn D3DXQuaternionMultiply D3DXQuaternionNormalize D3DXQuaternionRotationAxis D3DXQuaternionRotationMatrix D3DXQuaternionRotationYawPitchRoll D3DXQuaternionSlerp D3DXQuaternionSquad D3DXQuaternionSquadSetup D3DXQuaternionToAxisAngle D3DXRectPatchSize D3DXSHAdd D3DXSHDot D3DXSHEvalConeLight D3DXSHEvalDirection D3DXSHEvalDirectionalLight D3DXSHEvalHemisphereLight D3DXSHEvalSphericalLight D3DXSHMultiply2 D3DXSHMultiply3 D3DXSHMultiply4 D3DXSHMultiply5 D3DXSHMultiply6 D3DXSHPRTCompSplitMeshSC D3DXSHPRTCompSuperCluster D3DXSHProjectCubeMap D3DXSHRotate D3DXSHRotateZ D3DXSHScale D3DXSaveMeshHierarchyToFileA D3DXSaveMeshHierarchyToFileW D3DXSaveMeshToXA D3DXSaveMeshToXW D3DXSavePRTBufferToFileA D3DXSavePRTBufferToFileW D3DXSavePRTCompBufferToFileA D3DXSavePRTCompBufferToFileW D3DXSaveSurfaceToFileA D3DXSaveSurfaceToFileInMemory D3DXSaveSurfaceToFileW D3DXSaveTextureToFileA D3DXSaveTextureToFileInMemory D3DXSaveTextureToFileW D3DXSaveVolumeToFileA D3DXSaveVolumeToFileInMemory D3DXSaveVolumeToFileW D3DXSimplifyMesh D3DXSphereBoundProbe D3DXSplitMesh D3DXTessellateNPatches D3DXTessellateRectPatch D3DXTessellateTriPatch D3DXTriPatchSize D3DXUVAtlasCreate D3DXUVAtlasPack D3DXUVAtlasPartition D3DXValidMesh D3DXValidPatchMesh D3DXVec2BaryCentric D3DXVec2CatmullRom D3DXVec2Hermite D3DXVec2Normalize D3DXVec2Transform D3DXVec2TransformArray D3DXVec2TransformCoord D3DXVec2TransformCoordArray D3DXVec2TransformNormal D3DXVec2TransformNormalArray D3DXVec3BaryCentric D3DXVec3CatmullRom D3DXVec3Hermite D3DXVec3Normalize D3DXVec3Project D3DXVec3ProjectArray D3DXVec3Transform D3DXVec3TransformArray D3DXVec3TransformCoord D3DXVec3TransformCoordArray D3DXVec3TransformNormal D3DXVec3TransformNormalArray D3DXVec3Unproject D3DXVec3UnprojectArray D3DXVec4BaryCentric D3DXVec4CatmullRom D3DXVec4Cross D3DXVec4Hermite D3DXVec4Normalize D3DXVec4Transform D3DXVec4TransformArray D3DXWeldVertices

d3dx9_43_x86.cat

SHA256 70dcb8f80d45d878003ce58c438ead8c97bb5c5d93b94f6dbd0116b8b8a73ce4
MD5 21e12a2c0d4955795caf30e93aaef9c5
SHA1 0f0de021f3a28d781c408baf94a197299c79e466
SHA512 9b4b8fa1e98a060bdaa543dfbabee0da60a9122cb99893101b574e53e85adb8eda35b6f49ca044742b00bdc4b20637ab1c20f6a58a6d9a28cee0dd934b2986f8
SSDEEP 192:ykpWQVEQKPnEtObMacxc8hjXHUz1Tr2Mp2Mm:gcELXci2jXHUK5
TLSH
T1CDE1E8D68D2CD143EE5AADD163E8EDA77C38C7C34411942E11EBF79809837D1671A82C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

d3dx9_43_x86.inf

SHA256 d125f988976274cbbe55a4c5933dd78346654d91066dd97eced75aa4be53a85e
MD5 9141fa8db790807373411ee033a9129e
SHA1 9dc55e8c8f65f136d930b10f09247789b6719bf7
SHA512 9f2b2603e8e9eac8f5479c005367981c8728ee715c376ebdef7e535d39a1ef830218465234294e588f81e608c2cfc85304e6c4cafb11c8472bc09b9be6e88618
TLSH
T16501D06CFA757644F08279002515C6C3296C2240936A30DF39DD4780FBA2605C3A94FF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

d3dx9_43_x86_xp.inf

SHA256 673c70ac772c9d0a9aec86efca3c761c1b082295ac1df07a3507d8ac819657f7
MD5 f369960b66f8967c4a0ba15fe0a8122a
SHA1 b41d9d06d372a0f0180c83bc0b4a6dc573645fe6
SHA512 7872af2e9588f1fc45528119999037d2ef70afd7f8f68524bc02818017615b71ed3d042588683b1e7b9df7f5901b062317614fd6a938c86159a20de8da1048db
TLSH
T138F08B2DFA617508F1557D002252868729AC2140532570DF38DC8780B76120183A95FF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

PFA-1.1.0-x86.exe

IMPHASH 51f3291764ace5860f2996d6012f8e1e
SHA256 a8bfc3cbd0076c2a0a8e26b06d52b4593831cc1f3e0b31bfb9cb5db6ecf4b6b5
MD5 b2fbea052907a4403c62c3581ea76c9c
SHA1 52ee82cda514ab1a2f96b2c2e3ffbc39ea7f3375
SHA512 9ab177b0520e1950c800620fbfc542c3571992f78d4432fca5dbfefbe7f05c3b47e624e27bb76b6afb329ca9aa21bd5208152cccbe338399ca18762a452f5777
SSDEEP 12288:w0BFdT+S9wJy4LkuJdC3Ulp5e0C1la9GSyIo6GmztPvvw8WytIII//tAwsv:X6pJFrRtPHwutIII//tAw
TLSH
T1B5D47A25B6A1C172D4A20274CD7BABED593ABD600F3545CBBBC43A2E3DB06D16B35306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

231157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Pantano\Dev\PianoFromAbove\Release\PFA-1.1.0-x86.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateSprite D3DXCreateFontW

winmm

midiInOpen midiOutGetDevCapsW midiInGetNumDevs midiInGetDevCapsW timeBeginPeriod timeGetTime timeEndPeriod midiInStop midiInClose midiOutSetVolume midiInReset midiInStart midiOutReset midiOutClose midiOutShortMsg midiOutOpen midiOutGetNumDevs

comctl32

PropertySheetW ImageList_Destroy ImageList_LoadImageW ImageList_DrawEx InitCommonControlsEx

advapi32

CryptReleaseContext CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextW CryptGetHashParam

kernel32

SetLastError GetCurrentThreadId GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount FindFirstFileW GetFileAttributesA CreateDirectoryA FindClose FindNextFileW GetFileAttributesExW Sleep FindResourceW LoadResource SizeofResource LockResource GetSystemTime MulDiv QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar WaitForSingleObject CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange GetCurrentProcessId GetACP CloseHandle GetLocaleInfoW GetModuleFileNameW HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile SetFilePointer ReadFile ExitProcess GetModuleHandleW GetProcAddress HeapCreate IsProcessorFeaturePresent GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCPInfo LCMapStringW HeapAlloc RtlUnwind RaiseException GetStartupInfoW HeapSetInformation GetCommandLineA GetSystemTimeAsFileTime HeapFree GetLastError DecodePointer EncodePointer InterlockedDecrement InterlockedIncrement TlsAlloc TlsGetValue TlsSetValue TlsFree IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW CreateFileA CreateFileW SetEndOfFile GetOEMCP GetProcessHeap

user32

ScreenToClient SetTimer SetCursor ClientToScreen EndPaint DispatchMessageW UpdateWindow CreateDialogParamW LoadIconW RegisterClassExW IsDialogMessageW LoadAcceleratorsW TranslateMessage UnregisterClassW GetMessageW TranslateAcceleratorW PostQuitMessage TrackMouseEvent LoadCursorW SetFocus GetMenuItemInfoW BeginPaint PtInRect GetDC DrawFocusRect ShowCursor GetMenu TrackPopupMenuEx UnionRect LoadMenuW PeekMessageW ReleaseDC EnableMenuItem LoadImageW SetCapture KillTimer GetSubMenu GetFocus GetDesktopWindow GetCursorPos ShowWindow SetMenu GetMenuItemCount CreateWindowExW SetMenuDefaultItem DeferWindowPos ReleaseCapture BeginDeferWindowPos IsWindowVisible DestroyMenu GetDlgCtrlID EndDeferWindowPos SetMenuItemInfoW CallWindowProcW DefWindowProcW CheckMenuItem SendInput GetKeyState GetWindowRect FillRect PostMessageW DrawTextW DialogBoxParamW GetParent GetClientRect DrawEdge InflateRect OffsetRect InvalidateRect GetWindowLongW GetWindowTextW GetDlgItem SetWindowLongW EndDialog SendDlgItemMessageW GetSysColor SetWindowPos CheckDlgButton IsDlgButtonChecked CheckRadioButton MessageBoxW SendMessageW EnableWindow SetWindowTextW DrawFrameControl RedrawWindow

gdi32

SetBkMode BitBlt DeleteDC GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap CreateFontW SetTextColor SetDCBrushColor GetStockObject

comdlg32

ChooseColorW GetOpenFileNameW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFolderPathA SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoInitialize CoTaskMemFree

PFA-1.1.0-x86_64.exe

IMPHASH 6d87964cdf76a282b05d0099f9072a28
SHA256 8bdb156e3f7ca0e1a9bb684ad95069084da498a9c8f676821049d97a08b968ce
MD5 16ee9babd6410552f4c7da3b1f612cbc
SHA1 d0172916ace5fb381b060ed92945a8974c9ee92e
SHA512 69fd0ba1e99781f9dbc24b8fb082c3d3de596b8bb39abf30b04fe33ae791dcbda1d922006fd41997d5963cbe0d0add008216f21b972fec548daf9d0c57f524f3
SSDEEP 12288:dwE/Uoah+RBkgA9n+YduJuJj7319Gg2Sw8WytIII//tAw:18ok+RBkBUYduJij73ig2SwutIII//tj
TLSH
T1B5E45B59B3A806F5D067813CCEA796CAE7B17C150F219BCF4650B66E2F33AD1493A321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

260496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Pantano\Dev\PianoFromAbove\Release\PFA-1.1.0-x86_64.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateSprite D3DXCreateFontW

comctl32

ImageList_LoadImageW ImageList_DrawEx InitCommonControlsEx PropertySheetW ImageList_Destroy

winmm

midiInOpen midiOutGetDevCapsW midiInGetNumDevs midiInGetDevCapsW timeBeginPeriod timeGetTime timeEndPeriod midiInStop midiInClose midiOutSetVolume midiInReset midiInStart midiOutReset midiOutClose midiOutShortMsg midiOutOpen midiOutGetNumDevs

advapi32

CryptGetHashParam CryptReleaseContext CryptCreateHash CryptDestroyHash CryptHashData CryptAcquireContextW

kernel32

GetCurrentThreadId FlsAlloc GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount FindFirstFileW GetFileAttributesA CreateDirectoryA FindClose FindNextFileW GetFileAttributesExW Sleep FindResourceW LoadResource SizeofResource LockResource GetSystemTime MulDiv QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar WaitForSingleObject CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetOEMCP GetACP CloseHandle GetCurrentProcessId GetModuleFileNameW HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile SetFilePointer ReadFile ExitProcess GetModuleHandleW GetProcAddress HeapCreate GetVersion HeapSetInformation GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCPInfo LCMapStringW HeapAlloc RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException GetStartupInfoW GetCommandLineA GetSystemTimeAsFileTime HeapFree GetLastError DecodePointer EncodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetUserDefaultLCID IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW CreateFileA CreateFileW SetEndOfFile GetLocaleInfoW GetProcessHeap

user32

SetCursor ClientToScreen EndPaint DispatchMessageW UpdateWindow CreateDialogParamW LoadIconW RegisterClassExW IsDialogMessageW LoadAcceleratorsW TranslateMessage UnregisterClassW GetMessageW TranslateAcceleratorW SetTimer GetFocus TrackMouseEvent LoadCursorW SetFocus GetMenuItemInfoW BeginPaint PtInRect GetDC DrawFocusRect ShowCursor GetMenu TrackPopupMenuEx UnionRect LoadMenuW ReleaseDC ScreenToClient PostQuitMessage LoadImageW SetCapture GetSubMenu KillTimer EnableMenuItem RedrawWindow GetDesktopWindow GetCursorPos ShowWindow SetMenu GetMenuItemCount CreateWindowExW SetMenuDefaultItem DeferWindowPos ReleaseCapture BeginDeferWindowPos IsWindowVisible DestroyMenu GetDlgCtrlID EndDeferWindowPos SetMenuItemInfoW CallWindowProcW DefWindowProcW CheckMenuItem SendInput GetKeyState GetWindowRect FillRect PostMessageW DrawTextW DialogBoxParamW GetParent GetWindowLongPtrW GetClientRect DrawEdge InflateRect OffsetRect InvalidateRect GetWindowTextW GetDlgItem EndDialog SendDlgItemMessageW GetSysColor SetWindowPos CheckDlgButton IsDlgButtonChecked CheckRadioButton MessageBoxW SetWindowLongPtrW SendMessageW EnableWindow SetWindowTextW DrawFrameControl PeekMessageW

gdi32

DeleteObject BitBlt CreateCompatibleDC SelectObject SetBkMode DeleteDC CreateCompatibleBitmap CreateFontW SetTextColor SetDCBrushColor GetDeviceCaps GetStockObject

comdlg32

ChooseColorW GetOpenFileNameW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFolderPathA SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoInitialize CoTaskMemFree

Name

.text

Size

369KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Readme.txt

SHA256 ce76de746bcb45447f9579b9b338ba85dc9489f860524266944ed8354ae11e85
MD5 2312e63500115193bd17587af6f203ca
SHA1 79608c9b361cdd7938c47f72cce03a7f8bb06836
SHA512 c9fb754c1ef16a11b978ced2fc24bc4c183f87031976637badfe0bfa741f889a8ee6c09413eb019af57fae907b0cbfc2fdb4f3b04931d84455165b99a725d2ff
TLSH
T13811C08B79569EABA221994050F0A2C6F15575D8D6DF38FC6C4FF4A8232CF10B6F550C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Uninstall.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 598e6e1e5c3d07e42df41432bc7ab41456a7e90a69871cd85a447fc8da5dfcc5
MD5 a23c6c0e996d0b1f00b7dbf13eb995b6
SHA1 a1f501838d67a59cf7dbe7238931ef5edc0e6247
SHA512 a095c91454adeeae887b7923a1b3555c90784197e9b73ab2f4b4cf4d6b9d68720f1a7490c1bd75f16ba8c1961a6c1be6403d76daabd7f0759cb870578fa3cc47
SSDEEP 1536:xQpQ5EP0ijnRTXJegUlHBLeAa9gr/x4e+i:xQIURTXJeplReAaCGev
TLSH
T19F53BE2A32C1C4ABDA26023209F7D77AE3B2FFA5171206675B503F7F5975286EE01187
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 423bc65055da3aa46049e78886c28440c010562552d4fe808fa9b4f0f33b708c
MD5 5304c45bc146a05b5b3e76cf74fdb3f0
SHA1 18c8599b2808aca5fde9ab2cba7962ff14d0a943
SHA512 d4706f4ed209ad0b7dcc88e9d9ba65b0360f431dd9628be38bd600ed48af4249cd766643c06acbae6d3797aa84541af277493a4fd4b0349418c19c2950137124
SSDEEP 96:ernLnLnLnLnLnLnrKvbAvbAvbAvbAvbAvbAvbAvbA13o3o3o3o3o3o3oEJTX8X8Y:e/akkkkkkkGEQQQQQQQQT9QQ9
TLSH
T172C29B2348335E63EE9A2F36829E7DAAF04E1D75A4C37F99B0EB1721D0745DE0125D0A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dsetup32.dll

IMPHASH d1671a2cd7c955bf9903489363b7585c
SHA256 642d9e7db6d4fc15129f011dce2ea087bf7f7fb015aececf82bf84ff6634a6fb
MD5 0f58ccd58a29827b5d406874360e4c08
SHA1 ba804292580be6186774e7f92e6dfb104e46bf25
SHA512 3e3d4f2de5dc5addc86765a2f888487ea0c9ee0208fac60187ddaa9a2bfd73cfd7734836d32805fa43222470c8f6cb9a10e2a099aef72c67ad7c789096e57ce4
SSDEEP 49152:MjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWq:YIjma
TLSH
T145859E31B1D40332EA7203B177118AB7F63EEB9DE119D565B9AE825920C2B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

22:9d:3f:6c:9f:d6:3c:85:3d:d2:28:5b:3e:7b:4f:07:0b:5d:a1:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

0

Major OS version

6

Entry point

109955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dsetup32.pdb

kernel32

FindClose FindFirstFileA GetSystemDirectoryA CopyFileA DeleteFileA SetFileAttributesA WideCharToMultiByte LoadResource FindResourceA GetSystemDefaultLCID GetModuleFileNameA lstrcmpA LockResource SizeofResource SetLastError GetPrivateProfileStringA MultiByteToWideChar CloseHandle GetFileSize CreateFileA GetPrivateProfileSectionA lstrcmpiA lstrlenA FindNextFileA GetShortPathNameA GetExitCodeProcess WaitForSingleObject CreateProcessA LoadLibraryExA GetFileAttributesA GetPrivateProfileSectionNamesA GetSystemInfo GetDiskFreeSpaceA GetModuleHandleA ReadFile SystemTimeToTzSpecificLocalTime FileTimeToSystemTime LocalFileTimeToFileTime SystemTimeToFileTime GetTempFileNameA GetDriveTypeA GetCurrentDirectoryA ExpandEnvironmentStringsA GetTempPathA MoveFileExA SetFileTime GetFileTime Sleep CreateMutexA GetCurrentThreadId DecodePointer GetCommandLineA GetLocalTime HeapFree HeapReAlloc EncodePointer TlsAlloc TlsGetValue GetVersionExA TlsFree InterlockedIncrement GetModuleHandleW InterlockedDecrement ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess EnterCriticalSection LeaveCriticalSection RtlUnwind HeapAlloc RaiseException IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW WriteFile GetConsoleCP GetConsoleMode LoadLibraryW GetModuleFileNameW SetFilePointer SetStdHandle FlushFileBuffers HeapSize GetStringTypeW WriteConsoleW SetEndOfFile GetProcessHeap CreateFileW GetProcAddress LoadLibraryA GetCurrentProcess FreeLibrary CompareStringA FormatMessageA LocalFree GetWindowsDirectoryA OutputDebugStringA CreateDirectoryA TlsSetValue GetLastError

gdi32

GetDeviceCaps

user32

PeekMessageA ShowWindow GetDlgItem SendMessageA CharLowerA MessageBoxA CreateDialogParamA SetFocus DestroyWindow DialogBoxParamA GetMessageA CharNextA EndDialog SetDlgItemTextA SendDlgItemMessageA GetDesktopWindow GetWindowRect GetDC ReleaseDC SetWindowPos LoadStringA DispatchMessageA TranslateMessage GetKeyboardType

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegQueryInfoKeyA RegEnumKeyExA RegDeleteValueA RegQueryValueExA

shlwapi

SHDeleteKeyA

winmm

mmioDescend mmioOpenA mmioClose mmioRead

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

shell32

SHFileOperationA

ole32

StringFromGUID2

dxdllreg_x86.cab

SHA256 8ad77a4d9c76f65cd62337588f847cc1e0ca6ca9735937f3a781f7395e9566a1
MD5 a025c67403dc2c2bcd709aa9435faeb1
SHA1 0433ee289e96a0d83a0c66ec35cf906a3e063884
SHA512 56bced81de59d413238b01396fafa6442ef6db0afaf237a699966df4753ed1a0b555450fa308f6965689a67f9fb5efb5d377d5f602a8d453ecceddca41072b45
SSDEEP 768:iEsyaJmSW1YcVQ4iEX5EicqzKlrla3TsgsuRwjbW+O1xIhMbDbw/n+Mi2jXHUp7J:RjaJmSW1Ycl5X5EqKlR8sgsuRwjbtOwk
TLSH
T1A113E0C5087C81A7DD6A5DA126EFFF373D309AEB0115E7A8124FF36501857E20A6AC2C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

File Signature issue

Digest

d60c76f3a3a762bb5b173fa79ddb20e69ed165ec

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

dxdllreg.exe

IMPHASH 108ac59b8f148e70d53bb06226a5266e
SHA256 b6f134915bac6d630adb04d69f6944462bf5adfce2182f2908c2fb1bdd2da2fb
MD5 967240f77a123434ce212ed77276dea1
SHA1 ac1ff591a5ba91b382578fb9f9b38d2de6379bf6
SHA512 30efe2e1e3e8221a0b368eec5a7e030efb04fd3f4f9d3f678d0eb2f7af1c5d5484d8bd7c8bcfd0bf349b87a34e6d779e7966fe004c7defa12eee4a33bc51af07
SSDEEP 1536:c3yqLKmzPYxsbQwTu9pS7OOC8c4aEuW/jGboizXyz36WBAOMhowYkrgHB3DSSSS7:wyqLKmzPYxt9PJh4aEuWKbx7WmDhDgHF
TLSH
T157735C11B794D036D892617849ACAB314B6E7DA1077883CBB78407EEADB16D05B3C3DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

27129

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dxdllreg.pdb

advapi32

RegCloseKey RegDeleteValueA RegQueryValueExA RegOpenKeyExA RegSetValueExA SetServiceStatus ControlService CloseServiceHandle OpenServiceA OpenSCManagerA DeleteService CreateServiceA RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA

kernel32

GetLastError CreateDirectoryA OutputDebugStringA GetWindowsDirectoryA LocalFree FormatMessageA CompareStringA GetVersionExA GetPrivateProfileSectionA FindClose FindFirstFileA FreeLibrary GetProcAddress LoadLibraryExA GetPrivateProfileStringA GetSystemDirectoryA lstrlenA CloseHandle CreateMutexA WaitForSingleObject CreateProcessA CopyFileA GetModuleFileNameA Sleep CreateFileW ReadFile GetProcessHeap SetEndOfFile WriteConsoleW GetStringTypeW MultiByteToWideChar LCMapStringW HeapSize CreateFileA GetCommandLineA HeapSetInformation GetStartupInfoW GetLocalTime HeapFree HeapReAlloc SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection RtlUnwind HeapAlloc RaiseException IsProcessorFeaturePresent LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers

setupapi

SetupCloseInfFile SetupFindNextLine SetupGetLineTextA SetupFindFirstLineA SetupOpenInfFileA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

ole32

OleInitialize OleUninitialize

dxdllreg_x86.inf

SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
TLSH
T15A014094CC039474B689F1B2B76B774F3AEB0917E9112308B3CD04499F6361021AD1BD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dxupdate.cab

SHA256 13393a91201e69e70a9f68d21428453fff3951535dec88f879270269cfe54d6f
MD5 8adf5a3c4bd187052bfa92b34220f4e7
SHA1 b52be74c4489159bd343d3c647f28da1fd13d9b9
SHA512 3e2f2fe4b5742a4cf6ee2f6b8c0ca734fd0b3c5431dff112c907231846dd3eebee7b9b8117f0256119614282cc7a4896474a199563078481d48a1204ca96f92d
SSDEEP 1536:6chonoSUr43zmBkraJ8jchLdjH0UyrJ/7BmHA1N2mmoQwjn4mHuWr50woo/lKB9Z:6UonoMaWEd7y1Ds4N2XoNb4mOWr5xn4J
TLSH
T1A19302F7282D660389366AB49330E850BCBDC4536909AD1E097FFB600AC67D25D5B8DF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

File Signature issue

Digest

e085b9a5405338f3b0a7ec5030997c130158ee8a

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 2, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

dxupdate.cif

SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
MD5 b36d3f105d18e55534ad605cbf061a92
SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62
SSDEEP 768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
TLSH
T147633209734ED9FE900FF9A70EA66D4D686E81AB344D680E78FF52C50B3B4DD628D091
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dxupdate.dll

IMPHASH 35283944b3f16c78c7befbefbb177694
SHA256 6dcad858cc3ff78d58c1dae5e93caf7d8bacb4f2fcf9e71bccb250bf32c7f564
MD5 94202f25810812f72953938552255fb8
SHA1 c1e88f196935d8affc1783ccf8b8954d7f2bfb62
SHA512 65b66d07ef68e0d1e79f236a4800c857e991ee3ff80ece4cfdd0b5f6083ea16f8a52d351c3af721cb05c06394ec91b4b5e3cfa4b0f0879f7549f3e3ed035e79e
SSDEEP 3072:By6LKSOwGi/9S7BLfsdg3/Vhxo4yYbfBu20jPzwRFvxdGF4EdRDWXGTHzh/KV8ce:4wGaI5W4/Vhxo4BJV0jLwTGF4IDdPEe
TLSH
T148F36A15B740E472D5D20178711C26235AFDA8B117B980CBE74B2BCAE9E53C0E67E36B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

110520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dxupdate.pdb

kernel32

LoadLibraryA FindClose FindFirstFileA GetSystemDirectoryA GetVersionExA CopyFileA DeleteFileA SetFileAttributesA WideCharToMultiByte CloseHandle CreateFileA FindResourceExA CreateMutexA DisableThreadLibraryCalls lstrlenA GetPrivateProfileStringA GetExitCodeProcess WaitForSingleObject CreateProcessA GetFileAttributesA GetPrivateProfileSectionA GetPrivateProfileSectionNamesA lstrcmpA MoveFileExA SetFileTime LocalFileTimeToFileTime GetFileTime GetModuleHandleA GetDiskFreeSpaceA FindNextFileA LoadLibraryExA Sleep GetTempFileNameA GetPrivateProfileIntA GetModuleFileNameA MultiByteToWideChar GetCurrentDirectoryA ResetEvent SetEvent CreateEventA GetCurrentThreadId DecodePointer GetCommandLineA GetLocalTime HeapFree HeapReAlloc HeapAlloc EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetProcAddress ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection RtlUnwind RaiseException IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetModuleFileNameW LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers HeapSize GetStringTypeW LCMapStringW ReadFile WriteConsoleW SetEndOfFile GetProcessHeap CreateFileW FreeLibrary CompareStringA FormatMessageA LocalFree GetWindowsDirectoryA OutputDebugStringA CreateDirectoryA InterlockedDecrement GetLastError

user32

SetWindowPos EndDialog GetDlgItem DialogBoxParamA CharLowerA CharNextA SetDlgItemTextA SendMessageA

advapi32

RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegCloseKey

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

shell32

SHFileOperationA

ole32

CoInitialize StringFromGUID2 CoCreateInstance CoUninitialize

comctl32

ord17

dxupdate.inf

SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
TLSH
T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

PFA-1.1.0-setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in B-flat Major.mid

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in F Major.mid

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in G Major.mid

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Minuet in G Minor.mid

$MUSIC/Piano From Above/1 Intermediate 1/Bach - Musette in D Major.mid

$MUSIC/Piano From Above/1 Intermediate 1/Chopin - Prelude in C Minor.mid

$MUSIC/Piano From Above/1 Intermediate 1/Clementie - Sonatina Op. 36, No. 1 1st Movement.mid

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - First Sorrow.mid

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Humming Song.mid

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Melody.mid

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Sicilienne.mid

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - Soldiers' March.mid

$MUSIC/Piano From Above/1 Intermediate 1/Schumann - The Happy Farmer.mid

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 01.mid

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 04.mid

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 09.mid

$MUSIC/Piano From Above/2 Intermediate 2/Bach - Invention 15.mid

$MUSIC/Piano From Above/2 Intermediate 2/Beethoven - Fur Elise.mid

$MUSIC/Piano From Above/2 Intermediate 2/Beethoven - Moonlight Sonata 1st Movement.mid

$MUSIC/Piano From Above/2 Intermediate 2/Beethoven - Pathetique 2nd Movement.mid

$MUSIC/Piano From Above/2 Intermediate 2/Chopin - Prelude in A Major.mid

$MUSIC/Piano From Above/2 Intermediate 2/Chopin - Prelude in E Minor.mid

$MUSIC/Piano From Above/2 Intermediate 2/Mozart - Sonata Facile 1st Movement.mid

$MUSIC/Piano From Above/2 Intermediate 2/Mozart - Turkish March.mid

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - Dreaming.mid

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - Farmhand Rupert.mid

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - Hunting Song.mid

$MUSIC/Piano From Above/2 Intermediate 2/Schumann - The Wild Horseman.mid

$MUSIC/Piano From Above/3 Advanced/Bach - Prelude and Fugue in C Major.mid

$MUSIC/Piano From Above/3 Advanced/Bach - Prelude and Fugue in C Minor.mid

$MUSIC/Piano From Above/3 Advanced/Chopin - Black Key Etude.mid

$MUSIC/Piano From Above/3 Advanced/Chopin - Etude Op. 10, No. 1.mid

$MUSIC/Piano From Above/3 Advanced/Chopin - Fantaisie-Impromptu.mid

$MUSIC/Piano From Above/3 Advanced/Chopin - Funeral March.mid

$MUSIC/Piano From Above/3 Advanced/Chopin - Revolutionary Etude.mid

$MUSIC/Piano From Above/3 Advanced/Debussy - Clair de Lune.mid

$MUSIC/Piano From Above/3 Advanced/Godowsky - Study of Chopin Etude Op. 10, No. 1.mid

$MUSIC/Piano From Above/3 Advanced/Grieg - March of the Trolls.mid

$MUSIC/Piano From Above/3 Advanced/Joplin - Maple Leaf Rag.mid

$MUSIC/Piano From Above/3 Advanced/Joplin - The Entertainer.mid

$MUSIC/Piano From Above/3 Advanced/Liszt - Hungarian Rhapsody No. 2.mid

$MUSIC/Piano From Above/3 Advanced/Liszt - Love Dreams No. 3.mid

$MUSIC/Piano From Above/Credits.txt

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Credits.txt

DSETUP.dll

PE Signature issue

kernel32

user32

advapi32

winmm