4b5bfe94f4b7f025e0356d472d2100322d24923e7908c92b0e412768ab274045

resource
4b5bfe94f4b7f025e0356d472d2100322d24923e7908c92b0e412768ab274045
unpack001/$PLUGINSDIR/DialogEx.dll
unpack001/$PLUGINSDIR/Process.dll
unpack001/$PLUGINSDIR/System.dll

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 4b5bfe94f4b7f025e0356d472d2100322d24923e7908c92b0e412768ab274045
MD5 aba44cc2ca1def17c3d3265157267a80
SHA1 38453863a583496064d501ab4caa2fb43c08b106
SHA512 27e5e3fda43739b740d6bdded835a34ff94e757bb659e735c692a1b9a10fa61919272527cf600201e9932841faa397e5548a1133c19b4884784bc19927d392db
SSDEEP 6144:TlnhrwtcNptEjIBTT0w70qW618bQQawdl3:Tlnhf7B18bB1
TLSH
T116A448112A40E5E1D6FD39F85E3B639957663C191062A66E82703F0B3A36583CC3BE7D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/AnNiu2.png

SHA256 3c360dffb5ed955e21fc0042b0889d34884d06d2a90dd033d1d1b4103369c4e9
MD5 0a40bb230ea5a8803bc6e30a20a489bf
SHA1 c44a7c3921fbfba56a49703cc277597a7e91853a
SHA512 39981e2e6e2f3e67a0a68036059559c348d6f9d9ad236caca238908ddc726d53ccf379cbc0d02e8418034f2a14d93f39ee26aed7c04bdc69668e8d8c06568c95
TLSH
T1B9418A49FD706C50458DBF876BE4625B0B3306B49F82A884ADE9941B08711FBC40EAC3
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/Anniu.png

SHA256 07f7f0ec23e11093f4984bdf301dfe44770c8fcaeb9d22ffd9506101291438c4
MD5 d29ae48346382213891b504340ef876b
SHA1 0dec7f92b6daa677e184896758ad5f79cd62e5f9
SHA512 0efdb1ea7217d1df1b22d73f79b442b08583e69c6ca9727e77154f88cea5416fdce384a6a92dd6e8f24e737fbffe0d7727b67c2e5a5673912b010d79cdee6f18
TLSH
T14A419657EC52BC40078CF2953FE1E25F16335E8496C1A084FCFB889308A02FC992D8C2
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/DialogEx.dll

IMPHASH f83241b6d0c743161a484320511b9ad6
SHA256 2f53638b4a369cb03b27d0b83e8ce558fdb4988b8b3f947570c5aa7ca8ba890a
MD5 fafee34d85e384b446a2e9f3ca40897e
SHA1 3051eaf604e6014f2ad6f2f630202d9347758cda
SHA512 0832bf851cd6d1a7c769f06a27fb565f599b596a90bfe9b2161fbb1481a420fd61a3732bdf73dcf725342345c6826ba9810e924d8538d0ed56da4671f2ab3389
SSDEEP 384:pwhrDZsmEW0VdMOIgG2QzeSJ0ewJxSemwsn3EO6DD2Rsl:pOt0XMx/BzeSXwJUJxnUz
TLSH
T150B26B8A72F446FBC3FE227015263B4B66FF5E1058F1840E4FA707941897A8B5D3422B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess HeapCreate FlushInstructionCache Sleep InterlockedExchange HeapFree GetProcessHeap HeapAlloc UnmapViewOfFile CloseHandle CreateFileW GetFileSize CreateFileMappingW MapViewOfFile lstrlenW GetModuleFileNameW GlobalAlloc GlobalLock GlobalUnlock IsBadWritePtr MulDiv LoadLibraryW lstrcpyW lstrcmpiW GetModuleHandleW VirtualProtect GetProcAddress

user32

IsWindow GetCapture PostMessageW IsIconic LoadCursorW UpdateWindow ShowWindow EnableWindow SetActiveWindow CreateWindowExW GetWindow GetDlgItem IsDialogMessageW FillRect MapWindowPoints GetSysColor GetAncestor IsWindowVisible DestroyWindow DispatchMessageW TranslateMessage GetMessageW SystemParametersInfoW EnumChildWindows AdjustWindowRectEx wsprintfW DefDlgProcW SetClassLongW GetDC ReleaseDC ValidateRgn DrawTextW SetCursor PtInRect GetNextDlgGroupItem ReleaseCapture DrawStateW TrackMouseEvent SetWindowLongW DefWindowProcW CallWindowProcW GetDlgCtrlID GetParent SetFocus SetCapture KillTimer SetTimer InvalidateRect EndPaint BeginPaint GetClientRect SetWindowPos GetWindowLongW DrawFocusRect SendMessageW GetWindowRect

gdi32

SelectObject CreateFontIndirectW GetObjectW GetTextColor CreateSolidBrush SetBkColor GetObjectType SetBrushOrgEx GetWindowOrgEx SetBkMode GetStockObject ExtSelectClipRgn CreateFontIndirectA GetObjectA CreateDIBSection BitBlt DeleteDC GetDeviceCaps CreateCompatibleDC SetTextColor DeleteObject

ole32

CoTaskMemAlloc CreateStreamOnHGlobal CoCreateInstance

msimg32

AlphaBlend

$PLUGINSDIR/FuXuanKuang.png

SHA256 38396e4e2a4c42f305f3c4cdfd5c416af44c3abb5dbba2f1e9aae2af2add5b80
MD5 2ae26755ed381d177a91e26f6a4331bc
SHA1 8b5b65b89c647548b5168a14a91d60c408fb252e
SHA512 ddd2d479068a002667edaa7abda12525049bd56c38fb572d078384bd6258db0119ae5bf00efeee85a56768648c18128196549a40b4d0886cfd57fc41528de70c
TLSH
T17B0160F1A9200826A04A01378844883CCF30559E46AED68802212E23A4F5E1BAA0278A
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/Gou.png

SHA256 a34e38148b1a89c566665b2acc57ea232aca79e635963e358f3e5deb565c3325
MD5 d20d2b379419d254ec8ec91cc801e759
SHA1 49c9ff8ee21281d9fd53b373f024087457b46f89
SHA512 4d1022f440f23b13a337c7397e3dceb570f6efd8f634eaf407105fa2f0dbd68aef05950012f0f8d489d1f95d2fb9667645cc50b7756248ec749aadb90afdceef
TLSH
T17A51088DF910EA0057589C8088D684034D63CCC1E9D1F42AA68EC5F7ADB7286486A6EB
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/GuanBi.png

SHA256 c147a4b1392521c3c09985c683c3dbcab36c6a9919dd5c2e564624c16d720db4
MD5 27318f3f1be9bd93b1dd19d70957757c
SHA1 69ece149ef458bc1b11b4752be306fbea81b9c15
SHA512 2a480d57fedfdf0e71204c127181e9dd8be708330cf4349d1357911ef8ea69661752dc455871530bf64cc8b8928377ba5c986eb48c6735f985d78f36be877fa4
TLSH
T14941C81EFAE259016A5EEB42AEDA60FB7F278AC456819595BCCCCC0745500F79C4CDC2
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/JinDuTiao.png

SHA256 b84dbf6a868e526d0cc362705d48131b920b5b7ec6dfcdc05f68e79280454d7c
MD5 24768b42204b9844b34ac4cf4d9045c1
SHA1 c6d5b0f5418b24ee35b56c1280c91294c3b3ae96
SHA512 a5c4dd554ec148c510c5b593703ad26425053699c52f2ceb65d3f4ae1a5668098894fe2c124d6e647c3adc95043fc5446d048515d00e8977d272b6e0d54d7998
TLSH
T12231539BEE907C00498AE6077ED422DB6A3716916992A092FCCEC5035C200F9FD0CDD3
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/Process.dll

IMPHASH 42553fe3ef6b310e062cb904290a7030
SHA256 217c763c4f2a929df1493906d5dd3f9ad99a999efc407de9b6f4a6025fae3037
MD5 efe4d08d619b03e91cc41c7165c4290e
SHA1 d4a03bc89eaddff44850c2cd0b5bf2b7063d1bae
SHA512 57809a6ffc6a650b61af299f6817637bf132ce8316e57d6393fbc2f781635a43a2111f6e1c2e997b6ac9b035967ac8d623f71d1cd03102fb4746036e6d7ec065
TLSH
T10E81A47F3BEA49F2CD6613389E6F88A33669243A036616434707A9ED1E14D91F828712
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/XieZaiBeiJing.png

SHA256 990ff0ed848bf8805523eec6822919df246b51d5b7617374483eddc3276593ee
MD5 ee85adac8a9a985790d23dc6ef22df13
SHA1 9af5296879dd5a7012bd420229cf0c1ef5c3fa7d
SHA512 cb83762c6afd0747b61f90b81d00731e255698e660285a5b7c698df6aa603fc0118fff1470ce56881b1bea91dcefbb56b6125d92381a86d4230d65b945f86d14
SSDEEP 96:wSVYkknmWq2YR/DmkTHnpVvHT0H7gQvHiTSBgidTgSezWWx:wSukkn+HbvoZtBlM6Wx
TLSH
T10DB1FD89A530CE732DA4577E58A18A8117A3C36E73D0C1FA6AA72F2A345B476C64D4F0
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/XieZaiBiaoZhi.png

SHA256 252f09921d4863b74fe21a420e16272712c6d0e9a79accfaaf6a5788d5cea8e3
MD5 6039d61059fc20879aeb71a7d8431a39
SHA1 b328fdb8951c2bd22e144fedb3f45b9568cfab6a
SHA512 f42b825026334123a85a5b10216a4b7cc504169b27dd1d6a64deffd62fc4d999a5399efda49831a8ef9744bda44232f0c8a839f69899a36986a28fc083fa6c18
SSDEEP 384:TenaCCSM/CMbUKY0g2kU/DYTPEXCWqWSP6164ng2mvqj/miFlLmQWJ6:CvCTqMfYmkUba0Tq56Eug2mymar1
TLSH
T138629F0C45481A79E64C603004CB29FEC57A48D0A8F0D747E9FF8A298DB14DAB9AF6C7
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/XieZaiChengGong.png

SHA256 29d605ac5cc46745c3c14e82ae5dff93b05a3372b926f42bd4f73951afa065c2
MD5 1bb6f8bebcd91cff9c05470a879fd620
SHA1 54b471fc744e3c9ff04f24756533b82246f3f7ef
SHA512 32045e9dbfe7e1b2b53667fda09a7d43c10750b81decee8bc4723b11c1ecf9ccdb4bad6e66aab5595d9a7d1777841f8970802bee15d6b2feb88d34b6815a0419
TLSH
T1E2813AF0E947489F9CCDD3BC08B425B269476FD907B01CE17429242BA5866186D33356
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/XieZaiZhong.png

SHA256 cb4a92258b91aa518c7b7ccd2b64cd7f6ef25e41a389f92a7d50850e4c849799
MD5 3989e759e8450b90367d93dd1dbc2e20
SHA1 ce7b6f7c89b142bd337f85d75baa33effd3066ac
SHA512 805a2b1250d950b57629712718e32cad3c01bc991ed45bcc343d560c12563c830051f91bab3397c0f17c6881afbd23ddcedf2fc90147156b3673a863f4f675d8
SSDEEP 384:ToneSdm5V96c39AkJFCz0t88t4GLo0JlbUgslVXruk59X:0m4c39jJsz09tTmxV7BX
TLSH
T1D56290549B804B98F41F5E0960D78F932B700CDE4EC3CD94BEE61A4318E06E6AC279CB
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/ZuiXiaoHua.png

SHA256 34c78547902f4361f4f68280f19fd706b656b61abaae4f0ff96676fda8da2c6c
MD5 fdc3273bbcbc67dbecba8a61617323b6
SHA1 8c6b254a633d8db1aa23561ecbd58c49ff207e14
SHA512 78b7754d415a717c9a47c0b102c59340d197db1b4ee49d5cdbdac5e257e9ace17361859df6dab3e1a153c3b077c269eab8c8a169cab2ba45590ee1db8bd333df
TLSH
T12F31A516EAB15C90C95DF7A399EE22537B374BC04742A585ECDD8C439D700BDC81C6C2
MD5 SHA1 SHA512 TLSH