PC_Faster_Setup_GL[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/Cloud Security/BsrScan/symsrv.dll

resource
PC_Faster_Setup_GL.exe
unpack001/$PLUGINSDIR/BHips.dll
unpack001/$PLUGINSDIR/Communication.dll
unpack001/$PLUGINSDIR/DataReport.dll
unpack001/$PLUGINSDIR/InstallCheck.dll
unpack001/$PLUGINSDIR/InstallUtility.dll
unpack001/$PLUGINSDIR/LogReporter.exe
unpack001/$PLUGINSDIR/PC_Faster_Setup_Mini.exe
unpack001/$PLUGINSDIR/log.dll
unpack001/$PLUGINSDIR/log2.dll
unpack001/BHips.dll
unpack001/BProtectEx.sys
unpack001/BProtectEx64.sys
unpack001/BaiduStore.dll
unpack001/BavData.dll
unpack001/BdApiUtil.dll
unpack001/Bhbase.sys
unpack001/Cloud Security/BCloudScan.exe
unpack001/Cloud Security/BavAs.dll
unpack001/Cloud Security/BavBase.dll
unpack001/Cloud Security/BavClean.dll
unpack001/Cloud Security/BavCns.dll
unpack001/Cloud Security/BavCommon.dll
unpack001/Cloud Security/BavFi.dll
unpack001/Cloud Security/BavPe.dll
unpack001/Cloud Security/BavQv.dll
unpack001/Cloud Security/BavScan.dll
unpack001/Cloud Security/BavSig.dll
unpack001/Cloud Security/BavUa.dll
unpack001/Cloud Security/BavVt.dll
unpack001/Cloud Security/BavWl.dll
unpack001/Cloud Security/BsrScan/BavBsr.dll
unpack001/Cloud Security/BsrScan/BsrScript.dll
unpack001/Cloud Security/BsrScan/bsrbc.sys
unpack001/Cloud Security/BsrScan/bsrbc64.sys
unpack001/Cloud Security/Communication.dll
unpack001/Cloud Security/ReportComm.dll
unpack001/Cloud Security/ReportCommRetry.exe
unpack001/Cloud Security/log.dll
unpack001/Cloud Security/sqlite.dll
unpack001/CloudOPTClient.exe
unpack001/Communication.dll
unpack001/CrashReport.exe
unpack001/CrashUL.exe
unpack001/DataReport.dll
unpack001/DeepClean.exe
unpack001/DeepOptimization.exe
unpack001/DirectUI.dll
unpack001/EnumModules.exe
unpack001/FasterNow.exe
unpack001/Feedback.dll
unpack001/LogReporter.exe
unpack001/NSISInstall.exe
unpack001/NewUpdater.exe
unpack001/PCFApiUtil.sys
unpack001/PCFApiUtil64.sys
unpack001/PCFHelper.exe
unpack001/PCFPopups.exe
unpack001/PCFTray.exe
unpack001/PCFaster.exe
unpack001/PCFasterFeedback.exe
unpack001/PCFasterSvc.exe
unpack001/Plugins/Plugin.Antivirus/Plugin_Antivirus.dll
unpack001/Plugins/Plugin.Cleaner/CleanerEngine.dll
unpack001/Plugins/Plugin.Cleaner/Plugin_Cleaner.dll
unpack001/Plugins/Plugin.Facebook/Plugin_Facebook.dll
unpack001/Plugins/Plugin.HomeEx/Plugin_HomeEx.dll
unpack001/Plugins/Plugin.Optimizer/Plugin_OptimizerEx.dll
unpack001/Plugins/Plugin.Optimizer/SysOptEngine.dll
unpack001/PopupTip.exe
unpack001/ReportCommPCF.dll
unpack001/ReportCommRetryPCF.exe
unpack001/USBDeskBandHelper64.exe
unpack001/Uninstall.exe
unpack001/Updater.exe
unpack001/WeatherMini.exe
unpack001/WebClient.dll
unpack001/WiFiDeskBand.dll
unpack001/WiFiDeskBand64.dll
unpack001/WifiDrv/LWFDrv/Win7/amd64/ndisrd.sys
unpack001/WifiDrv/LWFDrv/Win7/i386/ndisrd.sys
unpack001/WifiDrv/LWFDrv/Win8/i386/ndisrd.sys
unpack001/WifiDrv/Setup/amd64/certinst.exe
unpack001/WifiDrv/Setup/amd64/snetcfg.exe
unpack001/WifiDrv/Setup/i386/certinst.exe
unpack001/WifiDrv/Setup/i386/snetcfg.exe
unpack001/WifiHotspot.exe
unpack001/liveupdate.exe
unpack001/log.dll
unpack001/log2.dll
unpack001/log64.dll
unpack001/sqlite.dll
unpack001/update.dll

PC_Faster_Setup_GL.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 0a734e7a121e820a06492320c95f48f27e583ab8d023811834b8eb38847110f2
MD5 bc4bd700eb90af556bea36a621309b93
SHA1 68747762d7fe93d5a6e7216ea7cc4fe2b4f3f252
SHA512 8d0221d25080bf2fb93ef4a24b60b7b7458a24109d1edbff52bf53d03c2da454d166dd96e19adf872cd81dcfb362ed0aa9ccb2c4a92ccabaffeddff76cc3eab1
SSDEEP 786432:V7Zcbp+3OIxbcsGnQRgFDNlolJFoijf/tHKB6BUxiq94CV:V7ZcbsbxbcsaFJNKlcE/tH7UxSC
TLSH
T15E47338ED427F387D8735EBE669C4A84D94A4DEA20D62ED6C36C321F5072A8D04769F0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

88:2e:44:e8:4d:5c:8e:9b:f5:e1:6d:2f:e5:18:68:84:76:e9:42:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/BHips.dll

IMPHASH 37f7fa6427379a6253a091175f81dc84
SHA256 b7bafd0d2d857f61d77ac9286953cc9ab0e2b3302efb8cf49b676cf784164457
MD5 031566cf76996288870bee265cdc7f4c
SHA1 5677068ba99c16ac9372942a4fc49099f003e331
SHA512 aa33803e6cbf6f59cab140ce6287111b0b8fe0617e7319532d5249db141cd0ad9cef375066899bd34ceb6d0c05174f8259c982c65369e65d9a5cdbf376364d3b
SSDEEP 12288:RrSLSgqSED9fxU/HVLQRXFSKNGQn87qlPhAnRhZthoO3sgO5aeN:UjLpgpAnRhZPo1pUeN
TLSH
T17ED47C00B781C236F9BF05B6AE7DD57D423D79610B1062E7A3C81DAA0E717E6B931287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

342935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

t:\i18nBavDefense\defense\output\pdb\BHips.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

fltlib

FilterConnectCommunicationPort FilterSendMessage

kernel32

GetCurrentProcess Sleep MultiByteToWideChar QueryDosDeviceW GetWindowsDirectoryW CreateFileA GetFileSize MapViewOfFile UnmapViewOfFile OpenProcess WideCharToMultiByte CopyFileW GetExitCodeProcess TerminateProcess ReadFile CreateFileW Process32FirstW CreateFileMappingW DeviceIoControl GetSystemInfo GetModuleFileNameA Process32NextW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot LocalFree CreateProcessW SetEvent HeapDestroy HeapCreate GetFileAttributesW lstrlenW GetStartupInfoW CreateEventW WaitForMultipleObjects DeleteFileW SetFileAttributesW SetEndOfFile GetTickCount WriteFile GlobalAlloc GlobalFree GetLocalTime OpenThread GetVersionExW CloseHandle GetCurrentProcessId DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult GetModuleHandleExW WaitNamedPipeW InterlockedDecrement GetCurrentThreadId InterlockedCompareExchange ResetEvent SwitchToThread VirtualAlloc VirtualFree CreateEventA CreateSemaphoreA InitializeCriticalSection WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RaiseException IsValidCodePage GetOEMCP IsValidLocale EnumSystemLocalesA GetACP GetCPInfo GetStdHandle ExitProcess HeapSize SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue ResumeThread ExitThread GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc LCMapStringW LCMapStringA SetHandleCount GetFileType LockResource CreateSemaphoreW GetProcAddress InterlockedExchange GetPrivateProfileIntW WritePrivateProfileStringW ReleaseSemaphore SizeofResource TerminateThread LoadLibraryW IsBadReadPtr GetProcessHeap GetModuleHandleW WaitForSingleObject HeapFree HeapAlloc LoadResource FreeLibrary FindResourceW FindResourceExW CreateMutexW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection GetLastError GetModuleFileNameW LeaveCriticalSection InitializeCriticalSectionAndSpinCount InterlockedIncrement SetNamedPipeHandleState CreateThread GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers GetUserDefaultLCID GetStringTypeW SetFilePointer FreeEnvironmentStringsA InterlockedExchangeAdd GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleA GetStringTypeA GetLocaleInfoA GetLocaleInfoW LoadLibraryA

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

psapi

GetProcessImageFileNameW GetModuleBaseNameW GetModuleFileNameExW

user32

GetMessageW DispatchMessageW KillTimer PeekMessageW MsgWaitForMultipleObjectsEx SetWindowLongW CreateWindowExW RegisterClassW GetClassInfoW PostMessageW DefWindowProcW PostQuitMessage SendMessageW SendMessageTimeoutW GetWindowLongW IsWindow GetWindowThreadProcessId FindWindowExW SetTimer DestroyWindow TranslateMessage

advapi32

AdjustTokenPrivileges SetSecurityDescriptorSacl GetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW RegSetValueExW QueryServiceStatus StartServiceW RegCreateKeyExW OpenServiceW OpenSCManagerW CloseServiceHandle CreateServiceW GetSecurityDescriptorDacl RegQueryValueExW FreeSid RevertToSelf SetEntriesInAclW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorOwner RegOpenCurrentUser AllocateAndInitializeSid GetNamedSecurityInfoW ImpersonateLoggedOnUser LookupPrivilegeValueW SetNamedSecurityInfoW OpenProcessToken RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW ord165 CommandLineToArgvW

ole32

CoInitialize CoTaskMemFree CoCreateInstance

oleaut32

SysFreeString

shlwapi

PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW PathAppendW StrRChrW

ntdll

RtlUnwind

generic

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=149, productName=VS2008 build 21022, version=21022,

count=3, id=131, productName=VS2008 build 21022, version=21022,

count=1, id=105, version=2067,

count=23, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=267, id=1, productName=Unmarked objects,

count=185, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=83, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=28, id=138, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

$PLUGINSDIR/Communication.dll

IMPHASH 3497585ce6db5df6a70ba374e8670819
SHA256 26fa072bf2cab2b57940e332bff2c29f7017c00272a708d104d1a5ade88fc77c
MD5 817b91fca0b9914e82078e903d6a198b
SHA1 283d572f524de4f966c16ec1dbca189364a18642
SHA512 ec5bc104fea5a6499e01127401d7d71d87c026327432bb301cba78d083c5501de8bde319ec1c184733890ce5509656bbf77b7317847bf0b368b864bb76e95c4d
SSDEEP 6144:af3U/hi2CY9G0Z41MzTatkJ34QiljhXYFcU:af3U/hFdlZ41iatkJ3hiRhIW
TLSH
T12F645B10B592D039E9FB1AB28D7E85AD567DBD600B74D0CBE3C809AD4F31AD1AA31317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

127272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Communication.pdb

kernel32

FindResourceW FindResourceExW InterlockedIncrement InterlockedDecrement CloseHandle CreateThread SetEvent WaitForSingleObject GetModuleHandleW GetModuleFileNameW CreateFileW GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetTickCount Sleep WaitForMultipleObjects CreateEventW SetFilePointer WriteFile CreateToolhelp32Snapshot Process32FirstW SizeofResource Process32NextW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW InterlockedCompareExchange TerminateThread ResetEvent SwitchToThread WideCharToMultiByte GetLastError GetProcessHeap HeapFree GetFileSize ReadFile SetLastError HeapAlloc LockResource LoadResource DeleteCriticalSection LeaveCriticalSection EnterCriticalSection MultiByteToWideChar InterlockedExchange GlobalFree OpenProcess GlobalAlloc SetEndOfFile InitializeCriticalSection SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA GetDriveTypeA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetTimeZoneInformation IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetModuleHandleA GetStringTypeW GetStringTypeA LCMapStringA RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW GetCommandLineA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc RaiseException GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetFullPathNameW GetCurrentDirectoryA HeapSize ExitProcess GetConsoleCP GetConsoleMode FlushFileBuffers GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

advapi32

RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser OpenProcessToken RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegCloseKey RegQueryValueExA

shell32

ord165 SHGetFolderPathW

ole32

CoCreateGuid

log

WriteLog

shlwapi

PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW PathFileExistsW PathFindExtensionW PathAppendW

winhttp

WinHttpSetOption WinHttpCloseHandle WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpSetCredentials WinHttpOpen WinHttpOpenRequest

$PLUGINSDIR/DataReport.dll

IMPHASH 5de1f52184fd63af9a883aeced58adad
SHA256 896fb200f29f2df7f4bc389a1e5a30ba92b13dbd9684b32649d4d91d7d16ad0d
MD5 a58238b0590f7b9bec405e90d334ba33
SHA1 cc5683167a0832e38de30f105d0d14bc5dc1ed05
SHA512 1eab12bb545053d9521feaa94815aa1528bd98b3e563b7b4658896947416384cf651c748361a8bc3a1509077d1717ecd878b88958e237dc5b6480314a9457386
SSDEEP 6144:7ezY27HmD7kwVIywl66zA031WFhEiGeWH/WZGkgiKqaGszLhz2ed:7MY2TmnB8CtGvH/WZrgz+idz
TLSH
T1A2A45C01B7E1C035E9BB1BF19E7D95AD8539BD600B6080CB93C81D7E5E71AD1AA31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

249904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DataReport.pdb

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

GetCurrentProcess HeapFree GetProcessHeap OpenProcess GetVersionExW VerifyVersionInfoW GetLastError MoveFileW GetLocalTime Process32FirstW ProcessIdToSessionId Process32NextW CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId CreateMutexW CreateFileA GlobalAlloc WideCharToMultiByte GlobalFree DeviceIoControl CreateProcessW InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection OpenMutexW EnterCriticalSection DeleteCriticalSection WriteFile WaitForSingleObject SetEvent GetModuleHandleW ResetEvent CreateEventW VirtualFree VirtualAlloc SetFilePointer FlushFileBuffers GetConsoleCP VerSetConditionMask CreateDirectoryW HeapAlloc GetPrivateProfileSectionW DeleteFileW CloseHandle LockResource GetPrivateProfileIntW GetTempPathW MultiByteToWideChar CreateFileW GetTimeZoneInformation GetModuleFileNameW ReadFile SizeofResource CopyFileW GetPrivateProfileStringW LoadResource FindResourceW FindResourceExW GetFileSize GetTempFileNameW GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WritePrivateProfileStringW GetPrivateProfileSectionNamesW InitializeCriticalSection GetEnvironmentStrings GetConsoleMode FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapSize ExitProcess HeapReAlloc HeapDestroy HeapCreate LCMapStringW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedExchange LCMapStringA RaiseException GetModuleFileNameA GetStdHandle SetLastError TlsFree TlsSetValue LoadLibraryA RtlUnwind GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc

user32

CallWindowProcW GetMessageW SetTimer KillTimer GetWindowLongW SetWindowLongW SendMessageTimeoutW IsWindow CreateWindowExW PostMessageW DispatchMessageW

advapi32

AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegQueryValueExA RegCloseKey RevertToSelf RegEnumValueW RegOpenCurrentUser ImpersonateLoggedOnUser LookupPrivilegeValueW RegQueryInfoKeyW RegSetValueExW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyExW GetUserNameW OpenProcessToken RegEnumKeyExW

shell32

SHGetFolderPathW ord165 SHGetSpecialFolderPathW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateGuid

shlwapi

PathRenameExtensionW PathFindExtensionW SHDeleteValueW PathRemoveExtensionW PathAppendW PathFileExistsW PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW SHSetValueW SHGetValueW PathFindFileNameW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

psapi

GetModuleBaseNameW

winhttp

WinHttpConnect WinHttpWriteData WinHttpSendRequest WinHttpSetOption WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpOpenRequest WinHttpSetCredentials WinHttpAddRequestHeaders WinHttpReceiveResponse

$PLUGINSDIR/InstallCheck.dll

IMPHASH e14a5d609009c08180e782ff86941f8c
SHA256 32252b067353f187bcbbf59f3a13936c34cb3a390dc1a5f5d0774e17b11c4a32
MD5 0113b5401128d49b6b0df587a389eb1e
SHA1 aaac7843f7f7bcc54eaf1b9e975098a17ef90ec4
SHA512 25942c660d9a7814ed6452c5a4376d2a300812736a689c9c835b2062cda9e1d19536a14d4062dbe6ecddbd8589f30ef765531181dd8fa04f75065dba822f0b8e
SSDEEP 768:toLZtBk8WguppPi9bQs5kriCQpG0+KTt0YUp:todb6Di9bQsC0D+00YW
TLSH
T127337D013A90C0B3C556497492A5D3A14EBEB9122BF560977FB643AE5F317D0773E30A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c7:9f:a6:a3:f1:c7:07:a6:ab:7c:70:72:7d:4a:42:ac:de:f9:7d:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

5955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\InstallCheck.pdb

$PLUGINSDIR/InstallUtility.dll

IMPHASH 889cc30b80162ad7afe793023e7ba129
SHA256 a7ab08473c896bed35f3363040ad34d8603f593f104c1aeae1d99e00a79ae53f
MD5 367aec63bc106e94d64fe253d8baed68
SHA1 46170df537dec84b2295e5d415d16715f8f3a1f8
SHA512 2366cd00753bc5438778a42097edca591a3f94992f668d1db16b0102ccfe5deb76daf471fdcc4fa2101464d6ba0c38e264836c21a2e5048470f1ce9080b6a6a2
SSDEEP 12288:24cMxiW+PdyGO0bsSJ4y765A7tKeG+4t2nbRjVrDRl+CJH4rnZ/nfP8M1j+yL0U7:dwxkyrM+4t2lqrlM2j+W0U3m4
TLSH
T1C6354900B790C039F9FB15F18A7D91BD9679BA31171450CB93C85DAEAB709E2BA31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

14:48:7e:05:d5:53:a2:c0:f1:db:6d:94:87:82:d0:ce:a1:8a:18:8b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

656684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\InstallUtility.pdb

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

psapi

GetProcessImageFileNameW EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

log

WriteLog

kernel32

CreateMutexW TerminateProcess ReleaseMutex Sleep CreateFileA GlobalAlloc WideCharToMultiByte GlobalFree DeviceIoControl GetTickCount WriteFile GetVersionExW GetLocalTime GetWindowsDirectoryW FindClose LocalFree QueryDosDeviceW GetCurrentProcess FindFirstFileW FindNextFileW GetTimeZoneInformation GetPrivateProfileSectionW GetCurrentThreadId GetFileSize OpenFileMappingW MapViewOfFile UnmapViewOfFile WinExec lstrlenW InterlockedIncrement InterlockedDecrement LocalAlloc GetTempFileNameW IsBadReadPtr HeapAlloc GetProcessHeap HeapFree SetDllDirectoryW CreateDirectoryW WritePrivateProfileStringW GetSystemDirectoryW GetFullPathNameW GetUserDefaultLangID GetPrivateProfileSectionNamesW GetSystemTime CreateFileMappingW Module32FirstW Module32NextW GetFileTime FileTimeToSystemTime GetLogicalDriveStringsW RemoveDirectoryW OpenEventW SetEvent GetCurrentDirectoryW SetCurrentDirectoryW ProcessIdToSessionId GetVersion SetFilePointer LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection ResetEvent CreateEventW InitializeCriticalSectionAndSpinCount OpenMutexW FlushFileBuffers MoveFileW InterlockedExchangeAdd InterlockedExchange OpenThread DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult GetModuleHandleExW CreateThread WaitNamedPipeW SetNamedPipeHandleState InterlockedCompareExchange TerminateThread SwitchToThread GetVersionExA SetLastError PeekNamedPipe GetStdHandle lstrlenA SetEndOfFile SetEnvironmentVariableA CompareStringW CompareStringA GetModuleHandleA GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetFullPathNameA SetStdHandle QueryPerformanceCounter GetCommandLineW GetTempPathW MultiByteToWideChar MoveFileExW CopyFileW GetPrivateProfileIntW CreateProcessW OutputDebugStringW GetCurrentProcessId GetPrivateProfileStringW Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenProcess VerifyVersionInfoW VerSetConditionMask FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW VirtualFree GetSystemInfo FreeLibrary ReadFile VirtualAlloc GetExitCodeProcess WaitForSingleObject GetModuleHandleW DeleteFileW GetProcAddress LoadLibraryW CreateFileW CloseHandle GetLastError GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount HeapSize GetModuleFileNameA ExitProcess HeapDestroy HeapCreate RaiseException LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo GetCurrentDirectoryA GetConsoleMode LoadLibraryA GetFileType WaitForMultipleObjects FormatMessageA FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime UnhandledExceptionFilter GetConsoleCP TlsFree TlsSetValue TlsAlloc TlsGetValue RtlUnwind FindFirstFileA GetDriveTypeA GetFileInformationByHandle HeapReAlloc ResumeThread GetCommandLineA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter SleepEx

user32

SetWindowPos SetForegroundWindow PostMessageW AttachThreadInput DestroyWindow TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx RegisterClassW GetClassInfoW DefWindowProcW PostQuitMessage FindWindowExW SetTimer wsprintfW GetMessageW KillTimer GetWindowLongW SetWindowLongW SendMessageTimeoutW IsWindow CreateWindowExW CallWindowProcW DispatchMessageW SendMessageW GetForegroundWindow GetWindowThreadProcessId ShowWindow

advapi32

RevertToSelf CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext CryptGetHashParam RegCloseKey SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegQueryInfoKeyW OpenProcessToken DeleteService ControlService QueryServiceConfigW ChangeServiceConfig2W CreateServiceW RegDeleteKeyW RegEnumValueW EnumServicesStatusW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegOpenCurrentUser RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW StartServiceW RegEnumKeyW OpenServiceW GetUserNameW OpenSCManagerW CloseServiceHandle RegDeleteValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW ImpersonateLoggedOnUser

shell32

SHGetSpecialFolderPathW ShellExecuteW CommandLineToArgvW SHFileOperationW ShellExecuteExW ord165 SHGetFolderPathW

ole32

CoCreateInstance CoUninitialize CoCreateGuid CoInitializeSecurity CoInitialize

oleaut32

VarBstrCmp SysAllocStringLen VariantInit SysStringLen SysAllocStringByteLen SysFreeString VariantClear SysAllocString

shlwapi

PathAppendW PathIsDirectoryW PathRemoveBackslashW SHGetValueW SHSetValueW PathAddBackslashW PathIsRelativeW PathUnquoteSpacesW PathIsUNCW PathIsRootW PathRemoveExtensionW PathFindExtensionW SHCopyKeyW SHDeleteValueW PathRemoveFileSpecW PathFileExistsW PathRenameExtensionW PathFindFileNameW StrStrIW

wldap32

ord33 ord30 ord60 ord26 ord41 ord79 ord143 ord50 ord22 ord35 ord32 ord200 ord46 ord211 ord27 ord301

ws2_32

WSACleanup WSAStartup gethostname getsockopt closesocket WSASetLastError socket getaddrinfo freeaddrinfo ioctlsocket listen accept recvfrom bind recv setsockopt getsockname ntohs htons WSAGetLastError connect WSAIoctl getpeername send __WSAFDIsSet select sendto

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

winhttp

WinHttpSetCredentials WinHttpReceiveResponse WinHttpSetOption WinHttpSendRequest WinHttpWriteData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpCreateUrl WinHttpAddRequestHeaders

AddWaitExe CheckArgv CheckAutoParam CheckInstallPath CheckPathEverInstalled CleanPreviousDataRemains CleanRegRemains ClearInstallDir CloseAllComponentSubProcess CompareVersion ConvertOld2NewChannel CreateUserProcess DelayPromotion DeleteEveryUserFile DeleteHistoryDir DeleteRunRegKey DeleteSubRegKey DeleteSvc EnablePlugin Exec GetAVInstallDir GetAllAndroidStoreInstalledVersion GetAllAppStoreInstalledVersion GetAndConvOldInstallChannel GetAndSaveClientAddrInfo GetAndroidStoreNextInstalledVersion GetAppStoreNextInstalledVersion GetAppStoreVersionCloseToCurrentInstall GetArgv GetChannelName GetChannelStatisticUrl GetCommonDocumentsDir GetCurrentLangID GetFR GetFileCreatedTime GetFileVersion GetFormatPath GetFullVersion GetInstallCostedTime GetInstallDir GetInstalledVersion GetInstalledVersionBySvc GetLPDirect GetModule GetNewFeatures GetNextInstalledVersion GetNextNewerVersion GetParentProcessInfo GetRebootCommandLine GetSelectLangID GetString GetTimeStr GetTrackCode GetUniqueUserID GetUrl GetUrlDefault GetUseTime GetVersionCloseToCurrentInstall GetVersionValue Init InitAndroidStoreInstalledVersion InitAppStoreInstalledVersion InitInstalledVersion InitReportData Install InstallDuplicateRecordTask InstallRecallTask InstallSvc IsEnableReport IsEverInstalled IsIBDChannel IsNewUpdate IsNewerVersionInstalled IsOfficialChannel IsRepeatedPromotion IsSamePath IsUpdate IsWin64 KillExe KillExe2 KillInstall KillProc KillRundll32 Log ModifyLink MyLockFile MyUnlockFile NotifyAppStoreUIExit NotifyUIExit OpenBrowser OpenURL OpenURLWithRun PostErrorInfo PostUpdate PreUpdate ReleaseMemory RemoveInstallDir RemoveOutOfDateReportTask RemoveWifiDrv ReplaceString ReportIncCount ReportValue ReportValueEx RevertDelayPromotion RunSetupW SaveDirIniFile SendReportData SetTaskDescription SetTopWindow SetUpdateFileMapping StartInstall StartProtectDrv StopProtectDrv StopProtectSvc StopSvc TimeStr2Num TransferRegData TransferRegData2 UTF8Base64Encode UUReport UninstallProtectDrv UnloadHook UnregisterSecurityCenter UpdateBugReportConfig UpdateString WaitAllExe WaitExe WriteAnsiFile WriteFR _OpenUrlW _SendReportDataW co_ebocy regsvr64

$PLUGINSDIR/LogReporter.exe

IMPHASH e346f319aee147d32246b4b31d5e61b5
SHA256 93768a2786d1532b55da703617b444b855f117d19d0ba796b942ae6a9d8eb966
MD5 7a82c67b1392b227a21d3d12438f04a2
SHA1 fc9b784e1f2c586519eafe14574ec914e22c4919
SHA512 cae28d209dd845690de7e315a2506467bb56ce60e7fa254c72b8db210256b1b79284347bf21aa5a42ec09116d279c24372b89b83322144caa3d784f6777c9746
SSDEEP 12288:u9hR0vGN0K0Z4O50ls/a5zCMpls9yUMmS:0hR0vGNfRO50lAEpm9xS
TLSH
T154F42A00B3818036FAB719F19A7D5679A539BD320B2590CBA3C43D5E4EB56F1AE31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

27:82:81:ab:d1:a6:89:79:66:17:61:23:bb:2e:75:4e:b9:d1:9a:9c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

399150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\LogReporter.pdb

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

CreateToolhelp32Snapshot GetPrivateProfileIntW GetPrivateProfileStringW GetModuleFileNameW lstrlenW ReadFile GetTempFileNameW GetTempPathW GetPrivateProfileSectionW GetTimeZoneInformation WriteFile Sleep GetLocalTime GetWindowsDirectoryW GetVersionExW WTSGetActiveConsoleSessionId OutputDebugStringW GlobalMemoryStatusEx ProcessIdToSessionId GetSystemInfo CreateMutexW SystemTimeToTzSpecificLocalTime GetCommandLineW SetLastError DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW InitializeCriticalSection DeleteCriticalSection GetModuleHandleA LeaveCriticalSection EnterCriticalSection FlushInstructionCache VirtualFree CreateFileMappingA LocalFree LocalAlloc InterlockedExchange InterlockedCompareExchange WritePrivateProfileStringW SystemTimeToFileTime GetFileSizeEx CreateProcessW ReadProcessMemory VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA HeapCreate HeapAlloc CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler GetCurrentThreadId TerminateProcess VirtualQuery GetModuleFileNameA ReleaseMutex lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenFileMappingW OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory GetProcessHeap HeapFree CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer GetPrivateProfileSectionNamesW SetEnvironmentVariableA CompareStringW CompareStringA GetDriveTypeA WriteConsoleW GetConsoleOutputCP Process32FirstW OpenProcess Process32NextW SetDllDirectoryW InterlockedIncrement GetCurrentProcess GetExitCodeProcess WaitForSingleObject DeleteFileW GetLastError CopyFileW GetCurrentProcessId GetTickCount VerifyVersionInfoW VerSetConditionMask FreeLibrary LoadLibraryW GetProcAddress GetModuleHandleW DeviceIoControl LockResource GlobalFree MultiByteToWideChar SizeofResource WideCharToMultiByte GlobalAlloc LoadResource FindResourceW FindResourceExW CreateFileA FindClose FindNextFileW FindFirstFileW ExpandEnvironmentStringsW UnmapViewOfFile CloseHandle MoveFileW FlushFileBuffers ResetEvent SetEvent WriteConsoleA IsDebuggerPresent SetStdHandle FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime LoadLibraryA GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetCurrentDirectoryA GetFullPathNameW GetStdHandle ExitProcess MapViewOfFile CreateFileMappingW GetFileSize CreateFileW HeapDestroy HeapReAlloc RtlUnwind RaiseException LCMapStringW LCMapStringA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement GetCPInfo CreateThread UnhandledExceptionFilter

user32

GetThreadDesktop CloseDesktop OpenInputDesktop wsprintfW DispatchMessageW CallWindowProcW CreateWindowExW IsWindow SetTimer SendMessageTimeoutW SetWindowLongW GetWindowLongW KillTimer PostMessageW GetMessageW GetUserObjectInformationA

advapi32

GetUserNameW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExA RegQueryInfoKeyW GetTokenInformation AllocateAndInitializeSid EqualSid RevertToSelf RegCloseKey GetLengthSid GetKernelObjectSecurity InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid CreateProcessAsUserW DuplicateTokenEx SetTokenInformation RegEnumValueW RegEnumKeyExW RegSetValueExW QueryServiceStatus RegOpenUserClassesRoot StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateLoggedOnUser RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegCreateKeyExW OpenProcessToken

shell32

SHFileOperationW ord165 ShellExecuteExW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoUninitialize CoCreateGuid CoInitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear

log

WriteLog

shlwapi

SHSetValueW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW PathFindFileNameW PathAddBackslashW SHGetValueW PathUnquoteSpacesW PathRemoveArgsW StrTrimW SHDeleteValueW PathFindExtensionW PathRemoveExtensionW PathRenameExtensionW PathAppendW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

winhttp

WinHttpCreateUrl WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpSetOption WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpAddRequestHeaders

ws2_32

htonl WSAStartup WSACleanup

psapi

GetModuleInformation GetModuleFileNameExW GetModuleBaseNameW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

$PLUGINSDIR/NewFeatures.txt

SHA256 e6b31e606248a4baf22ca4621beda7517822accc9d5d29b1cca98fd78d63eece
MD5 364821c6d3099ea189408efbd480708c
SHA1 fad127f57c3331e5521c6c657c04683d29d9798b
SHA512 b6c3637968d2a6c24c518548bb84d6a69639d0a9ed116af935513d25be87df21d1dd2b23309912a020e66eba7612b2ebc665d5ff399eb1881e95d63767ecd71d
TLSH
T192619C3323FD1209F9F36B84EAB50A706F6ABCA5AA7DD05C10A4455D4DF0F449960BB3
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/PC_Faster_Setup_Mini.exe

IMPHASH 4a3b8f64b1e58fb549287a1fcc9d77d1
SHA256 7f3ba1018778487b1c14e83e6476f657f6d59710402fcb2545d19f487268fe0a
MD5 df62c6ec7f2bfde5e86f9a4d4f5fefce
SHA1 61a22f6c8f9a279e64ba106e00a7dce2785bea83
SHA512 da5728b11c7c12ab1fccfd3fedf98f925ee52143e07c4fab9b371abc2f09ac19fe819942e7988baa3cba84c7a4bd6875236a2d323c94e723155404c510d080cb
SSDEEP 24576:Yvx9D8Etp/qkDaBYeZvofADhAs5M/I77+RbdGKCfxCjdboAZqpUizI:Qx9D8EtRnDOv6ADms5M/4SJ6fsdUJC
TLSH
T1403523003991D173C1525C3A8860C9664E2EFE379B68A897BFF47E661F363F0EA60553
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

73:f6:4e:ea:07:64:07:69:fb:46:e8:d2:f5:3f:a8:06:4c:3e:0e:d1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 30, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

24692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\app\gensoft\security-client\pc-faster-minisetup\public\output\pdb\MiniSetup.pdb

kernel32

GetTempFileNameW FindResourceExW FindResourceW LoadResource CreateProcessW WaitForSingleObject GetModuleHandleW VirtualFree Sleep SizeofResource GetModuleFileNameW WritePrivateProfileStringW GetTempPathW VirtualAlloc LockResource CloseHandle DeleteFileW CreateFileA ReadFile SetEndOfFile LoadLibraryA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetStartupInfoW GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW InitializeCriticalSectionAndSpinCount SetFilePointer MultiByteToWideChar WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

shell32

ord165

shlwapi

PathRenameExtensionW PathFindFileNameW PathRemoveExtensionW PathRemoveBackslashW StrStrIW PathFileExistsW

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/config.ini

SHA256 409d1e773bfb9ed4e62b111041924fb5499acd9edb672c3f78eae80309f17bc3
MD5 e03b4002bb779b45284c359d0f41e958
SHA1 75be4810aaadd1970ef11121c806a06a5a748606
SHA512 74ac2c3418fa3474848b0645f43198964bc8dfd4522b75d4aa86cef099ab664ae11473f12b789a196129de14b0443292e7b00f1aeb6d62703443906da0c39de2
SSDEEP 96:rG4udfx4V4Mzi2YK3QFfn9D9vQRJoZ9evOnSw9vQRJoZaVreLWzflfUNWLfsD+Sq:64udM4MzzYKgfjvQRJoDemDvQRJoKeL4
TLSH
T163C1B04367F91124F2F36E88EAF454B25B37BC56782CC59C50E1120E99F5E409923BEB
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/log.dll

IMPHASH 1f1b4a93890829f1d8956b91e3836d9d
SHA256 1c034dffdcc09558951a3c8710314a5b73258750b4389849e8344ce99e9b8e29
MD5 6335136a732bf3f36f961b30c0bf2006
SHA1 4b4bbc9e626860e9df74fb0f356e8d4b59c8c4ad
SHA512 dd26ad1360f3e41a148444bbd79c70fc426881a660e25a01620ebd2a9ba0c88597b1347c5fa0608b89c81ecd1a18c365d52f02b55b4a15ba15a0d713e6036f47
SSDEEP 1536:noD0NZDi0xiCz/RWQN2nUg1dWiQNt1vgkKhDIcdg+nI6qN:HXi0xErvykDIQg+nU
TLSH
T1F0937C21B650D033D4D69479826AC3B29B7F79316BE894C7BF9407785F603D0EB3A60A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fa:32:4e:fd:2f:c1:07:fb:7f:1d:25:78:6c:07:8f:29:fd:c2:71:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

12677

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection FileTimeToSystemTime CreateFileW MultiByteToWideChar FlushFileBuffers GetLastError MoveFileW WideCharToMultiByte GetLocalTime GetFileAttributesExW QueryPerformanceFrequency DeleteCriticalSection GetCurrentThreadId CloseHandle DeleteFileW LocalFree WriteFile OutputDebugStringW SystemTimeToTzSpecificLocalTime SetFilePointer EnterCriticalSection GetFileSize GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess GetStdHandle GetModuleFileNameA HeapFree HeapAlloc RaiseException SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc VirtualAlloc LoadLibraryA RtlUnwind GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA

advapi32

GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorSacl

$PLUGINSDIR/log2.dll

IMPHASH 169553d9c0e80575142f16084137d7ac
SHA256 1980bff5d376f07c7f01a6301f60d2012a90e84c2f9095ef4c1def3cbfcbe25b
MD5 175ea664f62cdc31949d29a9a3ecd4f2
SHA1 3b8904f28c0e36b9aab2cfeacf2516d47dd3beae
SHA512 8a16e53afe3a086140887df18e7df220856935c3941bc7e4f51066898764887d1b574ee7944e3d4f71c4382b1fccdee969704a5ead0061eac603f6d8fa02e09b
SSDEEP 6144:Cc5AZ/WzdF4TqGr4/DHA1a5JQ3is0nUuEziKd:Cc5AZmRG0/Dg1aTQ32nUuy
TLSH
T1E6745B00FB91C135E8BB16B59A7E96BD863979610B25C0DBE3C80E5E8F316D1AD31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

68:4a:01:7a:5c:ee:96:cf:8e:b8:45:16:da:e6:ca:5d:8e:b5:ba:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Minor OS version

0

Major OS version

5

Entry point

199315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log2.pdb

kernel32

GetPrivateProfileStringW CreateFileW GetFileSize GetPrivateProfileIntW ReadFile GetTempPathW GetTempFileNameW CopyFileW VirtualAlloc VirtualFree Sleep SetFilePointer FlushFileBuffers LocalFree UnmapViewOfFile ReleaseMutex CreateFileMappingW MapViewOfFile CreateSemaphoreW CreateEventW CreateMutexW WaitForMultipleObjects ReleaseSemaphore ResetEvent SetEvent GetCurrentThreadId GetCurrentProcessId SleepEx QueueUserAPC OpenFileMappingW OpenMutexW OpenSemaphoreW Process32NextW SetEndOfFile GetStdHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess GetTickCount GetLastError OpenProcess VerifyVersionInfoW VerSetConditionMask WriteFile MoveFileExW HeapFree GetProcessHeap HeapAlloc DeleteFileW SystemTimeToFileTime GetSystemTime TerminateThread WaitForSingleObject OutputDebugStringW FindNextFileW FindFirstFileW GetLocalTime FindClose GetModuleFileNameW CloseHandle DeviceIoControl LockResource GlobalFree MultiByteToWideChar SizeofResource WideCharToMultiByte GlobalAlloc LoadResource FindResourceW CreateFileA CreateDirectoryW GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileSectionNamesW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount LoadLibraryA InterlockedExchange FindResourceExW OpenEventW GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA RaiseException HeapDestroy HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetSystemTimeAsFileTime GetCommandLineA RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringA LCMapStringW ExitProcess GetModuleFileNameA HeapCreate SetHandleCount GetFileType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegEnumKeyExW FreeSid SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AllocateAndInitializeSid RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorSacl GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

ord165 SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathIsDirectoryW PathFileExistsW PathAppendW PathAddBackslashW PathRenameExtensionW StrCpyW PathRemoveExtensionW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

$PLUGINSDIR/string.ini

SHA256 d3d39d4cdcf3b5bef7af7028faf971ba0e7459234d4a40a940fa7d2d8ba8c9ae
MD5 b78dda1542ecb8d8514db2d933d22a2a
SHA1 20e4267c5af98c9a3bedeb457331e055562403ad
SHA512 971326c6792bc484df51701d6e29cc9669e18094441be0da89059616ea79e6281e94cedfc434286dc9d26139e5e245b5ba4fb4b6eee0e5903d45f610fa381a13
SSDEEP 192:gzPBZzuerVptVH7C38DgDfQCbZHka4y4TU9:+jFV5GQ6X
TLSH
T19422D45353F80215B5F3AA90F9F406366F267866E83DE52C01C15A9E19F1A20CDB1BEF
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/sysconfig.ini

SHA256 0cf07ed0679d0902c0a2dccec8ed8bfde7a2a05ee40c195e02b9a08272fe7756
MD5 dce99fcfe3584af15d92560c164b2c86
SHA1 b6a3423f9e80fa0d8dd58bcc121abb6cd10358b2
SHA512 5ef7840d71c68f43802ef5b7555efa6810b64e2d7dedad10c60fd41f44a0e6d3823c28800180c2cc31ab41d596ffbdb3dce93047c9b81876e1069f82fa4f3d62
TLSH
T125F00E38E717F45E531CA6B4302881F7B318018D80385A9635056F38180ED4C6AEC0AC
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/url.ini

SHA256 49e211cf1ae2adf4ef7d7a245b869875c1e968c8dd7ce7798116afefda628ea2
MD5 8d703c9d972b33adf458d11b4b1b40ae
SHA1 99150f0c08ea0a69e0b1ca8db3b7496b883b0ba0
SHA512 c9fbb8fc086c9a5aa64956e7a267fefd4fd0a20ae0a64a58c535721dd8be947bb2f18dc5bed82766f3e76a84106b420ad6b2605a262534f675697e5645eaf728
SSDEEP 192:udJWeP6lbZVsVUr9i0une/PSHABEUjf/MorsNZKcoNoTc8jdOIkgjdQOU:SJWeClbZVsV49iUPSHABEUjs6sNZKco7
TLSH
T14522040336F92208F6B36B5D95F980B09F3EBEE5A915C66E21F0410E65E4F901812B7B
MD5 SHA1 SHA512 SSDEEP TLSH

$_41_/PC Faster/5.1.0.0/Dump/BugReportConfig.ini

SHA256 9c430d374c63d890322d5735d24e6c63378ab22984a07f13ed869df5809ebf36
MD5 cc751a4478624287b8ef9d01be0cfbab
SHA1 26e8da6118471591d6921f23714d3714ad68d8cc
SHA512 7bfaa44fdc09ba6de1fc004b0d6db819a56945e27f000278f25350202ec2c59b1460522b365ff3cfa601e077e037d9d83f0108b846bfd4238a40ba1f6511b7f7
TLSH
T106F096877776010472BB9543C8E380B3023EB952B32FC2A610D003964BD66924062BE7
MD5 SHA1 SHA512 TLSH

$_41_/PC Faster/5.1.0.0/Dump/CrashReportModuleConf.ini

SHA256 8f52dc81f684279723c3cdee85a035e5b3a1630dc6952b5eadfbc7686901f490
MD5 1db27fb5bf463536afc23455b956a26c
SHA1 f33daca934542f56d8f0f72822d8f7ba64aa0ca0
SHA512 652fa37519692b2ebbb7be7b229bfcb5b46f5d4ef78b9ca98d28af6fae1c6c0ee653e6d804f3887c84ced338903a0da62604a3fa501660fc6be57eee1b470e2f
SSDEEP 384:q77jSLHgLYpTwSjYTlj775SSJ1Pej4ZnzKVM9LDZHyqWzCcH2pfTa1/AvOoi80UX:07jSLHgLYRwSjYTlj775SSJ1Pej4Znz5
TLSH
T136A21E5A42FBCAC7A05C6279F0266BD7ECF90CCA4654C0851A5D6EF3D24E0C923D768E
MD5 SHA1 SHA512 SSDEEP TLSH

$_41_/PC Faster/5.1.0.0/config.ini

SHA256 409d1e773bfb9ed4e62b111041924fb5499acd9edb672c3f78eae80309f17bc3
MD5 e03b4002bb779b45284c359d0f41e958
SHA1 75be4810aaadd1970ef11121c806a06a5a748606
SHA512 74ac2c3418fa3474848b0645f43198964bc8dfd4522b75d4aa86cef099ab664ae11473f12b789a196129de14b0443292e7b00f1aeb6d62703443906da0c39de2
SSDEEP 96:rG4udfx4V4Mzi2YK3QFfn9D9vQRJoZ9evOnSw9vQRJoZaVreLWzflfUNWLfsD+Sq:64udM4MzzYKgfjvQRJoDemDvQRJoKeL4
TLSH
T163C1B04367F91124F2F36E88EAF454B25B37BC56782CC59C50E1120E99F5E409923BEB
MD5 SHA1 SHA512 SSDEEP TLSH

BHips.dll

IMPHASH 37f7fa6427379a6253a091175f81dc84
SHA256 b7bafd0d2d857f61d77ac9286953cc9ab0e2b3302efb8cf49b676cf784164457
MD5 031566cf76996288870bee265cdc7f4c
SHA1 5677068ba99c16ac9372942a4fc49099f003e331
SHA512 aa33803e6cbf6f59cab140ce6287111b0b8fe0617e7319532d5249db141cd0ad9cef375066899bd34ceb6d0c05174f8259c982c65369e65d9a5cdbf376364d3b
SSDEEP 12288:RrSLSgqSED9fxU/HVLQRXFSKNGQn87qlPhAnRhZthoO3sgO5aeN:UjLpgpAnRhZPo1pUeN
TLSH
T17ED47C00B781C236F9BF05B6AE7DD57D423D79610B1062E7A3C81DAA0E717E6B931287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d2:32:fd:06:b7:6a:a3:4a:be:27:1b:f5:b0:f7:50:65:a4:76:a1:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

342935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

t:\i18nBavDefense\defense\output\pdb\BHips.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

fltlib

FilterConnectCommunicationPort FilterSendMessage

kernel32

GetCurrentProcess Sleep MultiByteToWideChar QueryDosDeviceW GetWindowsDirectoryW CreateFileA GetFileSize MapViewOfFile UnmapViewOfFile OpenProcess WideCharToMultiByte CopyFileW GetExitCodeProcess TerminateProcess ReadFile CreateFileW Process32FirstW CreateFileMappingW DeviceIoControl GetSystemInfo GetModuleFileNameA Process32NextW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot LocalFree CreateProcessW SetEvent HeapDestroy HeapCreate GetFileAttributesW lstrlenW GetStartupInfoW CreateEventW WaitForMultipleObjects DeleteFileW SetFileAttributesW SetEndOfFile GetTickCount WriteFile GlobalAlloc GlobalFree GetLocalTime OpenThread GetVersionExW CloseHandle GetCurrentProcessId DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult GetModuleHandleExW WaitNamedPipeW InterlockedDecrement GetCurrentThreadId InterlockedCompareExchange ResetEvent SwitchToThread VirtualAlloc VirtualFree CreateEventA CreateSemaphoreA InitializeCriticalSection WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RaiseException IsValidCodePage GetOEMCP IsValidLocale EnumSystemLocalesA GetACP GetCPInfo GetStdHandle ExitProcess HeapSize SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue ResumeThread ExitThread GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc LCMapStringW LCMapStringA SetHandleCount GetFileType LockResource CreateSemaphoreW GetProcAddress InterlockedExchange GetPrivateProfileIntW WritePrivateProfileStringW ReleaseSemaphore SizeofResource TerminateThread LoadLibraryW IsBadReadPtr GetProcessHeap GetModuleHandleW WaitForSingleObject HeapFree HeapAlloc LoadResource FreeLibrary FindResourceW FindResourceExW CreateMutexW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection GetLastError GetModuleFileNameW LeaveCriticalSection InitializeCriticalSectionAndSpinCount InterlockedIncrement SetNamedPipeHandleState CreateThread GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers GetUserDefaultLCID GetStringTypeW SetFilePointer FreeEnvironmentStringsA InterlockedExchangeAdd GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleA GetStringTypeA GetLocaleInfoA GetLocaleInfoW LoadLibraryA

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

psapi

GetProcessImageFileNameW GetModuleBaseNameW GetModuleFileNameExW

user32

GetMessageW DispatchMessageW KillTimer PeekMessageW MsgWaitForMultipleObjectsEx SetWindowLongW CreateWindowExW RegisterClassW GetClassInfoW PostMessageW DefWindowProcW PostQuitMessage SendMessageW SendMessageTimeoutW GetWindowLongW IsWindow GetWindowThreadProcessId FindWindowExW SetTimer DestroyWindow TranslateMessage

advapi32

AdjustTokenPrivileges SetSecurityDescriptorSacl GetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW RegSetValueExW QueryServiceStatus StartServiceW RegCreateKeyExW OpenServiceW OpenSCManagerW CloseServiceHandle CreateServiceW GetSecurityDescriptorDacl RegQueryValueExW FreeSid RevertToSelf SetEntriesInAclW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorOwner RegOpenCurrentUser AllocateAndInitializeSid GetNamedSecurityInfoW ImpersonateLoggedOnUser LookupPrivilegeValueW SetNamedSecurityInfoW OpenProcessToken RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW ord165 CommandLineToArgvW

ole32

CoInitialize CoTaskMemFree CoCreateInstance

oleaut32

SysFreeString

shlwapi

PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW PathAppendW StrRChrW

ntdll

RtlUnwind

generic

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=149, productName=VS2008 build 21022, version=21022,

count=3, id=131, productName=VS2008 build 21022, version=21022,

count=1, id=105, version=2067,

count=23, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=267, id=1, productName=Unmarked objects,

count=185, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=83, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=28, id=138, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

BHipsConfig.ini

SHA256 88cc3e67fdcf9ca45c94b6ef8b69aaea7a9eab16bfa4e845eff1f7bdfd3b3240
MD5 363f089628a422b6e37b40018a49f4b8
SHA1 a43990dfd2693dbfc52cf85ccb45c331aa968fc2
SHA512 e462ad9e2c65c9cff0c38acfd4b22872d3a6e89820e3d88d275511bf28e40e7d6705ac149b95158e235cabb29673273a77a6c236b2c67e08f06fb8df2b4adf01
TLSH
T1A3013C1323FA0B11B1B71684D2F098B79326F8A5AA9DCB1D44C11E1F0AF291099B7FD3
MD5 SHA1 SHA512 TLSH

BProtectEx.sys

IMPHASH 9d5bc1128c2a09b831a5054cc7f5f033
SHA256 3c1f5a691311f1f78bd68c71b0cd0d22e2db995d0804a074859b30eec2a4b280
MD5 e0936457d5a2a7625bb0e9d43764a8a2
SHA1 d830420e4f94eeb0069a73b0f91548a978621a3f
SHA512 a1538446af1adf95fea0b688348e4a9f7ea4d240d01086996544f6ed6bece41204fa017a798d58747c896915d8a756a46cf7cb90eed9a07d5e962cd9070bb47f
SSDEEP 1536:ngTyJ3nFpQJwRTGjqpszeqCGNOzzTNyO0XkNz2mX:B9wmGOszv1M1p
TLSH
T154B33B00E241817ED6FB02F2C97FEA59B92CAE210F5861CFD2D46CD91B75AC26D305A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

83:dc:52:97:f6:29:5d:a9:66:ce:72:8b:b9:a3:71:35:fa:d7:b1:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

s:\i18nBavDefense\defense\output\pdb\BProtectEx.pdb

ntoskrnl.exe

ObfDereferenceObject ExInitializeResourceLite PsGetCurrentProcessId _wcsupr RtlUpcaseUnicodeChar IoGetStackLimits ExGetPreviousMode ExDeletePagedLookasideList PsGetVersion ExInitializePagedLookasideList IoGetTopLevelIrp PsGetCurrentThreadId DbgPrintEx RtlCopyUnicodeString ProbeForRead RtlDowncaseUnicodeString wcsncpy wcsncat RtlEqualUnicodeString ObQueryNameString IoFileObjectType wcsstr IoDeleteSymbolicLink PsLookupProcessByProcessId IoDeleteDevice IoCreateFile IofCompleteRequest RtlCompareUnicodeString ZwQueryInformationProcess IoCreateSymbolicLink IoCreateDevice ObOpenObjectByPointer KeClearEvent ZwQuerySystemInformation MmMapLockedPagesSpecifyCache KeWaitForMultipleObjects ExQueueWorkItem IoThreadToProcess RtlVolumeDeviceToDosName _wcsnicmp ZwReadFile PsReferencePrimaryToken MmGetSystemRoutineAddress RtlAppendUnicodeToString ZwQueryObject KeUnstackDetachProcess ZwSetInformationFile KeReleaseSemaphore ExAllocatePool KeGetCurrentThread IoGetCurrentProcess KeQueryTimeIncrement RtlAppendUnicodeStringToString ZwQueryVolumeInformationFile ZwDuplicateObject ZwOpenProcess KeTickCount ObfReferenceObject MmIsAddressValid ZwTerminateProcess ZwQueryInformationFile KeStackAttachProcess PsLookupThreadByThreadId ZwOpenKey _wcsicmp RtlWalkFrameChain ZwCreateKey RtlGetVersion ZwSetValueKey PsProcessType ProbeForWrite wcsrchr NtClose ZwQueryInformationToken PsThreadType PsGetThreadProcessId MmHighestUserAddress IoDriverObjectType IoUnregisterShutdownNotification ObReferenceObjectByName wcschr _vsnwprintf IoGetDeviceObjectPointer ExUnregisterCallback ExRegisterCallback ExCreateCallback IoRegisterShutdownNotification KeWaitForSingleObject ObReferenceObjectByHandle ExfInterlockedRemoveHeadList KeInitializeEvent ExfInterlockedInsertTailList KeSetEvent ExAcquireResourceExclusiveLite InterlockedPushEntrySList ZwClose ZwCreateFile InterlockedPopEntrySList ExFreePoolWithTag ExAllocatePoolWithTag ExDeleteResourceLite ExReleaseResourceLite ExAcquireResourceSharedLite KeEnterCriticalRegion FsRtlIsNameInExpression RtlInitUnicodeString ZwQueryValueKey KeLeaveCriticalRegion memset _aullrem _allmul _except_handler3 memcpy _alldiv _aullshr

hal

KfReleaseSpinLock ExReleaseFastMutex KfAcquireSpinLock KeGetCurrentIrql ExAcquireFastMutex

fltmgr.sys

FltGetStreamContext FltSetInformationFile FltGetDestinationFileNameInformation FltCancelFileOpen FltGetVolumeContext FltSetVolumeContext FltStartFiltering FltRegisterFilter FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltUnregisterFilter FltAllocateContext FltReleaseContext FltFreeSecurityDescriptor FltGetVolumeProperties FltGetDiskDeviceObject FltCreateCommunicationPort FltCloseClientPort FltAllocateCallbackData FltParseFileNameInformation FltReleaseFileNameInformation FltPerformSynchronousIo FltGetFileNameInformation FltFreeCallbackData FltSetStreamContext

Name

.text

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

BProtectEx64.sys

IMPHASH f5469fd8a4f0f793227a9eca17e457c4
SHA256 6dbb722321c7d65557af8303fe2691a352f1d1e56a744391e5da55a9a41c977b
MD5 e110cb96837caf3a731bde2428e8062d
SHA1 f8917e82696b5986802d36699add63d17a83e8fb
SHA512 92bee2c8f823ae4f4715b33ada1d1b4a0230efb8a93968a215cca4d2afcfc3e56eb1ed4855fc9d5cd099f144f6db90e1988cf95351ebd42e9052809d6ed48733
SSDEEP 1536:fUG4n3RMq5cyu3bdueRw2BWQ56iQUjZ57zdWM6c4LRABgwNlB2mp:2n2bZbqliXN57zdWM6chDd
TLSH
T136936D96B25500E9E7B6C2BAC6769627E7B070512B11A3CF07A0C6D51F23FE4ED3A305
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0e:6b:00:a1:9f:9b:58:3b:9d:46:69:78:19:6d:a5:ef:44:fa:1d:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

s:\i18nBavDefense\defense\output\pdb\BProtectEx64.pdb

ntoskrnl.exe

ObReferenceObjectByHandle KeWaitForSingleObject KeReleaseSemaphore ExInterlockedRemoveHeadList ObfDereferenceObject ExInitializeResourceLite PsGetCurrentProcessId _wcsupr RtlUpcaseUnicodeChar IoGetStackLimits ExGetPreviousMode ExDeletePagedLookasideList PsGetVersion ExInitializePagedLookasideList IoGetTopLevelIrp PsGetCurrentThreadId DbgPrintEx RtlCopyUnicodeString ProbeForRead RtlDowncaseUnicodeString wcsncpy ObQueryNameString IoFileObjectType wcsstr IoDeleteSymbolicLink PsLookupProcessByProcessId IoDeleteDevice IoCreateFile IofCompleteRequest RtlCompareUnicodeString ZwQueryInformationProcess IoCreateSymbolicLink IoCreateDevice ObOpenObjectByPointer KeClearEvent ZwQuerySystemInformation MmMapLockedPagesSpecifyCache KeWaitForMultipleObjects ExQueueWorkItem IoThreadToProcess RtlVolumeDeviceToDosName _wcsnicmp ZwReadFile IoGetRelatedDeviceObject PsReferencePrimaryToken MmGetSystemRoutineAddress RtlAppendUnicodeToString ZwQueryObject KeUnstackDetachProcess ZwSetInformationFile ZwQueryValueKey ExAllocatePool IoGetCurrentProcess KeQueryTimeIncrement RtlAppendUnicodeStringToString ZwQueryVolumeInformationFile ZwDuplicateObject IoFreeIrp IoAllocateIrp ZwOpenProcess ObfReferenceObject MmIsAddressValid ZwTerminateProcess ZwQueryInformationFile KeStackAttachProcess IofCallDriver ZwOpenKey _wcsicmp RtlWalkFrameChain ZwCreateKey ZwSetValueKey PsProcessType wcsrchr NtClose ZwQueryInformationToken ObRegisterCallbacks ObUnRegisterCallbacks PsSetCreateProcessNotifyRoutine PsThreadType ExReleaseFastMutex ExAcquireFastMutex KeReleaseSpinLock KeAcquireSpinLockRaiseToDpc VerSetConditionMask CmRegisterCallbackEx RtlVerifyVersionInfo CmUnRegisterCallback IoDriverObjectType IoUnregisterShutdownNotification ObReferenceObjectByName _vsnwprintf ExUnregisterCallback ExRegisterCallback ExCreateCallback IoRegisterShutdownNotification ExInterlockedInsertTailList KeInitializeEvent KeSetEvent ExAcquireResourceExclusiveLite ExQueryDepthSList ZwClose ZwCreateFile ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExFreePoolWithTag ExAllocatePoolWithTag ExDeleteResourceLite ExReleaseResourceLite ExAcquireResourceSharedLite KeEnterCriticalRegion FsRtlIsNameInExpression RtlInitUnicodeString KeLeaveCriticalRegion __C_specific_handler

fltmgr.sys

FltGetStreamContext FltSetInformationFile FltGetDestinationFileNameInformation FltCancelFileOpen FltGetVolumeContext FltSetVolumeContext FltStartFiltering FltRegisterFilter FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltUnregisterFilter FltAllocateContext FltReleaseContext FltFreeSecurityDescriptor FltGetVolumeProperties FltGetDiskDeviceObject FltCreateCommunicationPort FltCloseClientPort FltAllocateCallbackData FltParseFileNameInformation FltReleaseFileNameInformation FltPerformSynchronousIo FltGetFileNameInformation FltFreeCallbackData FltSetStreamContext

Name

.text

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

398B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

BaiduStore.dll

IMPHASH b060bce1d1ef2f5a159eafa419bbd1ee
SHA256 ed6e854ad6c02040aee21a445610ae6966d0c18dbd4f4dd1808314256170b9b8
MD5 b3dfca823cbbf25522d3ea0dc4eff2b5
SHA1 7f9008bd1dc3b7fd504bef3aeabda5e09369f55e
SHA512 cca48989db6d601dcdaf9032aa9beb46c56899cca2956a2001850be96683c3e716e038de051a569e113b0cf0994ec72a232ec30461be8f3fd01a9151e7f99299
SSDEEP 24576:6xvtRegnFsKvEnEu5k2uTQqSbd85avz7Zfnn0BddeXLUMATQuJeA:JgFsKMEuK27bd8wvz7Zfnn0BddeXLUMM
TLSH
T185552A01AB52D13EF8BB01F2DFFE546E556CAA10070450C7A2CC9C9E5AB69F27E32257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ad:48:e5:2f:1a:54:ef:d9:72:4c:29:ca:15:7c:1c:0d:50:b4:1e:7d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

389995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\BaiduStore.pdb

datareport

RD_WS RD_W RD_WW

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

LockResource DeleteCriticalSection InterlockedIncrement GetTickCount Sleep GetTempFileNameW GetFileSize HeapAlloc HeapFree GetModuleHandleExW GetModuleHandleW GetProcessHeap IsBadReadPtr GetPrivateProfileStringW InitializeCriticalSectionAndSpinCount CopyFileW GetVersionExW ReadFile GetModuleFileNameW CreateFileW MultiByteToWideChar WritePrivateProfileStringW GetTempPathW GetPrivateProfileIntW OpenMutexW GetLastError GetLongPathNameW CloseHandle DeleteFileW GetCurrentProcessId WideCharToMultiByte FormatMessageW GetACP InitializeCriticalSection WaitForSingleObject InterlockedExchangeAdd InterlockedDecrement InterlockedExchange OpenThread DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe SetEvent ReadFileEx CreateEventW GetOverlappedResult CreateThread WaitNamedPipeW SetNamedPipeHandleState GetCurrentThreadId InterlockedCompareExchange TerminateThread ResetEvent SwitchToThread CreateFileA GetModuleHandleA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW LoadLibraryA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID EnterCriticalSection LeaveCriticalSection SizeofResource LoadResource FindResourceW FindResourceExW VirtualAlloc GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetStartupInfoA GetFileType SetHandleCount FlushFileBuffers GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP ExitProcess GetModuleFileNameA GetStdHandle WriteFile SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue RaiseException HeapDestroy HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA ExitThread ResumeThread RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetProcAddress

user32

PostMessageW FindWindowExW GetWindowThreadProcessId PostQuitMessage GetWindowLongW SendMessageTimeoutW IsWindow DefWindowProcW SendMessageW GetClassInfoW RegisterClassW DestroyWindow SetTimer KillTimer GetMessageW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx SetWindowLongW CreateWindowExW

advapi32

InitializeSecurityDescriptor RegOpenKeyExW RegCloseKey SetSecurityDescriptorSacl GetSecurityDescriptorSacl SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

shell32

ShellExecuteW ord165 SHGetFolderPathW

ole32

CoInitializeSecurity CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysAllocStringLen SysFreeString VarBstrCmp SysAllocString VariantClear VariantInit

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW PathAppendW PathIsDirectoryW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

??0Baidu_ListenData@@QAE@ABV0@@Z ??0Baidu_ListenData@@QAE@PB_W@Z ??0BdConfig@@QAE@ABV0@@Z ??0BdConfig@@QAE@XZ ??0CBaiduStoreMgr@@AAE@XZ ??0CBaiduStoreMgr@@QAE@ABV0@@Z ??1Baidu_ListenData@@UAE@XZ ??1BdConfig@@QAE@XZ ??1CBaiduStoreMgr@@QAE@XZ ??4Baidu_ListenData@@QAEAAV0@ABV0@@Z ??4BdConfig@@QAEAAV0@ABV0@@Z ??4CBaiduStoreMgr@@QAEAAV0@ABV0@@Z ??_7Baidu_ListenData@@6B@ ?AddListenDataItem@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PAVBaidu_ListenData@@@Z ?CheckComponentExist@CBaiduStoreMgr@@QAEHPA_W@Z ?ClearPluginConfig@CBaiduStoreMgr@@IAEXXZ ?ClearTools@BdConfig@@QAEXXZ ?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ ?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z ?CopyConfig2UserDIR@BdConfig@@QAEHXZ ?DeleteListenDataItem@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?DestroyInstance@CBaiduStoreMgr@@SAXXZ ?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z ?DoCleanPreScan@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanFixUp@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanFixupStop@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanScan@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanScanStop@CBaiduStoreMgr@@QAEXXZ ?DoExamOptFixUp@CBaiduStoreMgr@@QAEXXZ ?DoExamOptFixUpStop@CBaiduStoreMgr@@QAEXXZ ?DoExamOptScan@CBaiduStoreMgr@@QAEXXZ ?DoExamOptScanStop@CBaiduStoreMgr@@QAEXXZ ?DoExamSysRepairFixUp@CBaiduStoreMgr@@QAEXXZ ?DoExamSysRepairScan@CBaiduStoreMgr@@QAEXXZ ?DoExitWindow@CBaiduStoreMgr@@QAEXXZ ?DoGetBootTime@CBaiduStoreMgr@@QAEXXZ ?DoGetDynamicSystemInfo@CBaiduStoreMgr@@QAEXXZ ?DoGetNetFlowInfo@CBaiduStoreMgr@@QAEXXZ ?DoGetStaticSystemInfo@CBaiduStoreMgr@@QAEXXZ ?DoGetWindowUpdateStatus@CBaiduStoreMgr@@QAEHXZ ?DoInitBootTime@CBaiduStoreMgr@@QAEXXZ ?DoKernelMessage@Baidu_ListenData@@UAEHIIJ@Z ?DoMonitorDevSize@CBaiduStoreMgr@@QAEXXZ ?DoMonitorDevTarySize@CBaiduStoreMgr@@QAEXXZ ?DoMonitorJunkClean@CBaiduStoreMgr@@QAEXXZ ?DoMonitorJunkScan@CBaiduStoreMgr@@QAEXXZ ?DoMonitorStartupItem@CBaiduStoreMgr@@QAEXXZ ?DoRestartWindow@CBaiduStoreMgr@@QAEXXZ ?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?EnableBdKernel2@CBaiduStoreMgr@@QAEXXZ ?EnableBdKernel@CBaiduStoreMgr@@QAEXXZ ?FindSubKrnHandle@CBaiduStoreMgr@@QAEHPB_WAAPAXAAH@Z ?GetBdConfig@CBaiduStoreMgr@@QAEPAVBdConfig@@XZ ?GetConfigPath@BdConfig@@AAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?GetKernelSafeHandle@CBaiduStoreMgr@@QAEPAXXZ ?GetPluginItemEnableStatus@CBaiduStoreMgr@@QAEHI@Z ?GetPluginItemFilePath@CBaiduStoreMgr@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@I@Z ?GetShowBrowserJunkPopup@BdConfig@@QAEHXZ ?GetShowBundleSoftPopup@BdConfig@@QAEHXZ ?GetShowNewwarePopup@BdConfig@@QAEHXZ ?GetShowmalwarePopup@BdConfig@@QAEHXZ ?GetUpdateState@BdConfig@@QAEIXZ ?HandleKrnResponse@CBaiduStoreMgr@@IAEXPAUiarchive@@@Z ?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z ?InitResponseHandle@CBaiduStoreMgr@@IAEXPAX@Z ?InitSubKrnlHandle@CBaiduStoreMgr@@QAEHPB_W@Z ?InitSubResponseHandle@CBaiduStoreMgr@@IAEXPAX@Z ?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?LoadConfig@BdConfig@@QAEXXZ ?OnChannelDown@CBaiduStoreMgr@@IAEXPA_W@Z ?OnKernelHandle@Baidu_ListenData@@UAEHPAX@Z ?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z ?OnSubChannelDown@CBaiduStoreMgr@@IAEXPA_W@Z ?OnWndMsg@Baidu_ListenData@@UAEHIIJ@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?PushTools@BdConfig@@QAEHV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z ?ReadPluginConfig@CBaiduStoreMgr@@IAEXXZ ?RecursiveStartNT6@CBaiduStoreMgr@@QAE_NPAUITaskFolder@@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z ?ReportState@CBaiduStoreMgr@@QAEHKK@Z ?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?ReportValue@CBaiduStoreMgr@@QAEHKK@Z ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?RestoreToDefault@BdConfig@@QAEXXZ ?SaveActivitys@BdConfig@@QAEXXZ ?SaveAutoRunConfig@BdConfig@@QAEXH@Z ?SaveBootTimeHelperPopup@BdConfig@@QAEXH@Z ?SaveBrowserJunkPopupTime@BdConfig@@QAEXK@Z ?SaveConfig@BdConfig@@QAEXXZ ?SaveHomeAutoScan@BdConfig@@QAEXK@Z ?SavePluginWarningTime@BdConfig@@QAEXK@Z ?SavePrivacyCleanTime@BdConfig@@QAEXK@Z ?SaveShowBigFilePopup@BdConfig@@QAEXH@Z ?SaveShowPlugPopup@BdConfig@@QAEXH@Z ?SaveShowmalwarePopup@BdConfig@@QAEXH@Z ?SaveSound@BdConfig@@QAEXH@Z ?SaveSparkClick@BdConfig@@QAEXH@Z ?SaveWeatherConfig@BdConfig@@QAEXXZ ?SendKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXKAAVCMsg@@@Z ?SetMainFrame@CBaiduStoreMgr@@QAEXPAUHWND__@@@Z ?StartNT6SchTasks@CBaiduStoreMgr@@QAE_NV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAH@Z ?UnloadComponent@CBaiduStoreMgr@@QAEXPA_W@Z ?UpdateConfig@BdConfig@@QAEXXZ ?UpdateSystemConfig@Baidu_ListenData@@UAEXXZ ?UpdateSystemConfig@CBaiduStoreMgr@@QAEXXZ ?m_pInstance@CBaiduStoreMgr@@2PAV1@A ?strDefaultTool@BdConfig@@0PAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@A

BavConfig.ini

SHA256 af61b3bfd1353c8a8955c0688efd023941be9a51890ebe7282c5116e83ae6aa9
MD5 56bc3f95fadecb3dd423330a52b0f9e2
SHA1 5edf91b3bf621fc311d20f9734f6f208eed385e4
SHA512 5d3eaf035d883cdde197502a3f78525a3a0f3f389974dd56619235ae41b357665bcef255297e74150381716631120dbe3c60bde64517e38c7b10cddb048349a3
SSDEEP 96:rh+AcefP+AiefMv+AeefA9+AAefy+AcefOn:ffvfMzf8fOfOn
TLSH
T19612674677BE5B14B3B31A4D98B650E08A3B7AD7E824C3AD41B0144F1DE7B108DA2F67
MD5 SHA1 SHA512 SSDEEP TLSH

BavData.dll

IMPHASH f11d4807fb5dbc0666070953ae8f658d
SHA256 4995763d1e5ceb5ec42fb26fdc9bc0434c15e8dbab0b8e96687737b1996e9230
MD5 57d630bf995bbe791df90bf3fcebf043
SHA1 e86188c03148f0f97304db601fb6fded97e02eff
SHA512 47c8130f60411e79b4a33ccaeaafb006de8d4e7ec31fe6be3d5f6d77e247aa4705903204166589be78e678faf0f7e2c4f4925c9b983585750df27565fb3cc48c
SSDEEP 3072:R1fmO4uyt8cuxUPVEcUEPnb0YADt5fE7:TUuyWcuu9Ef2nb0xD/E7
TLSH
T115C39D22B550C0B3C4DA25394466D7399B7EA5B08BA849C7FBB40B7E5E207D09F3634B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

59:cf:40:03:3b:09:68:01:f4:d1:bd:a5:4a:c0:3d:7a:b4:c6:39:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

39896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\SVNCode\YaoJun\BavData\BavData\Release\BavData.pdb

kernel32

GetLastError SystemTimeToFileTime WriteFile CloseHandle MultiByteToWideChar SetFilePointer ReadFile CreateFileW DeviceIoControl GetVolumeInformationW FileTimeToLocalFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetFileAttributesW HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess GetStdHandle GetModuleFileNameA HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers GetModuleHandleA

user32

SendMessageW

BdApiUtil.dll

IMPHASH 9e6ad255aaf843d3e420a71eb089bd5d
SHA256 3ffb3011693836b8dd8074b7c994c81889f5c51853d1e853e52e89d2caf90042
MD5 05b9c44858108a9731439bfeb07b3fdb
SHA1 723d26ee013612e634b8596ce267934e8b20a2be
SHA512 7febc78b90c875ee6dd1bb7815ed859985f338e4caeffdda22136476720ae0216dbbd7a86cf16b2081668e91513caff0549d970ee07c8f60e6845eafdc57d209
SSDEEP 3072:A/78TDjiCeYMDjcHr/i92wxKIT5r1n45RCDkSgtU/:xiNjmr/i92wxXHnYCDkSg
TLSH
T166B38D117690C033D4AB147D8979A675A62E7D715BA888C7B7E81E6D0FB17E0AF30307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

62:59:a5:5b:ad:1f:5b:50:90:e2:a3:8c:d0:7c:3b:f4:db:27:36:8b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

30082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

r:\i18nBavDefense\defense\output\pdb\BdApiUtil.pdb

kernel32

GetProcAddress FreeLibrary LoadLibraryW GetSystemInfo lstrlenA OutputDebugStringA GetFullPathNameA LoadLibraryA SetLastError WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA DeviceIoControl CreateFileA CloseHandle GetCurrentProcess GetLastError FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount SetStdHandle

advapi32

RegCloseKey RegSetValueExA RegOpenKeyExA RegCreateKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegDeleteKeyA

shlwapi

PathRemoveFileSpecA PathAppendA PathFileExistsA

ntdll

RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

Bhbase.sys

IMPHASH 970f386b3876e7bd50b93b92760b7152
SHA256 29145bfcc3746159f9b96c19d19c0c79c96f30396b1543ccc91f1654e2272f6f
MD5 40fd20be56d81e8fdf572b1cdecea5e8
SHA1 a68356e471725e9c821987bc6734794ff455bc1c
SHA512 984ef22f4c235b19d4d9dbf41dec4031175ca8af238533ac19d073c238580157d38099df3251000f45a8dfcc1251890a66991e4bdcd2bd48676aa3a9bcceb649
SSDEEP 768:3xRu1OEv0IDrxvfO/EJh92JSe4NlfrIqOU065+xSJJBwdLy3atQn5gQhuW+/HvQk:3xRu1OEv9DrxvfO/EJh92Me4NlfrIqO5
TLSH
T12623A652F3AE4917EDA3053669ABB0175EB0DD029B386DC3FA0076A41B393F3DA72541
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fa:21:f4:2d:1a:81:c5:5e:0d:83:fa:31:3c:8f:c5:f6:ab:2e:fb:b0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

35296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\i18nBavDefense\defense\output\bin\Bhbase.pdb

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

832B

Virtual Size

804B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

64B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

864B

Virtual Size

848B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

896B

Virtual Size

878B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

BigFileCleaner.dat

SHA256 a82026d8c76403791a8be3f9b6108e98e1777470d170400a6c0fa6088bd190e8
MD5 eb2a521683dccef51b76628ad9784de6
SHA1 7c734ecff68ff513870442fb186e9c577e05c674
SHA512 15724259c0603cc2eb2d0f922fa97cf298fd3d201f6dd8c9186010de99a7f6973d7c6a0b47eb9f730d5b4d78e5f864fef5b8bfebc45267b7643220caa9b52884
TLSH
T10C816465B6C0CF5817394AE254DBC535492C608B574986CDBF9E059B4BB9E830FB3C70
MD5 SHA1 SHA512 TLSH

Cloud Security/BCloudScan.exe

IMPHASH 758b7a30df28923fec857ddb6e61444f
SHA256 4fb4403ea7185f6d8a2caeb54868d6da7e98110e2341167949978282110840a8
MD5 cec0177ed84e2089762a34f2a9bf70a6
SHA1 c73a328065da831bc1baf805fdb3a00e3596cc31
SHA512 3e4909148107cb2722c0c73e0a998b39560f25cdbe03f7bbc170c2b7eee1bd4b6415930f7493b669fcfd05ce113c465f15d8239cb0d056a599a52f64afa33c1d
SSDEEP 49152:pXSQmIRyKKosxixyBDojcopebBKdkS2YJUPtXbHHhaIIIIIIII5T2IIII:VSQ0HMxyBDojNpuQkHIIIIIIIII5qII/
TLSH
T1A8A52810A7D28129F5F30AB19EBD446E9538BE21171094CFD3C86C6E4EB5EE26D32727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5c:7d:c2:58:22:95:df:89:67:db:c3:c7:73:4b:ea:83:49:0f:c2:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

643555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\bavOutput\Pdb\Release\BCloudScan.pdb

shlwapi

PathAppendW PathIsDirectoryW PathFileExistsW StrRChrW StrStrIW PathRenameExtensionW PathAddBackslashW PathFindFileNameW PathAddExtensionW SHDeleteKeyW StrRetToStrW PathRemoveFileSpecW PathIsFileSpecW

log

CreateLog WriteLog CloseLog

psapi

EnumProcessModules GetProcessImageFileNameW GetModuleInformation GetModuleFileNameExW

wtsapi32

WTSQueryUserToken WTSOpenServerW WTSEnumerateProcessesW WTSCloseServer WTSFreeMemory WTSEnumerateSessionsW

userenv

ExpandEnvironmentStringsForUserW CreateEnvironmentBlock DestroyEnvironmentBlock

bavqv

?Bd_ReadFilePayloadInfo@@YAKPB_WPAKQA_WPAPAU_QUARANTINE_HEADER@@@Z ?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z ?Bd_ReadFileBlock@@YAKPB_WKPAKPAX@Z

pdh

PdhAddCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryW

imm32

ImmDisableIME

kernel32

Sleep SizeofResource GetModuleFileNameW GetTimeZoneInformation MultiByteToWideChar ResetEvent LockResource CreateEventW GetCurrentThreadId CloseHandle GetFileSize SetFilePointer MapViewOfFile UnmapViewOfFile GetDriveTypeW SetEndOfFile CreateFileW WritePrivateProfileStringW GetPrivateProfileIntW CreateFileMappingW DeviceIoControl GetVolumeInformationW lstrlenA GetPrivateProfileStringW WideCharToMultiByte lstrlenW InterlockedExchange GetModuleHandleW GetWindowsDirectoryW FindFirstFileW TryEnterCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThread OpenProcess SetThreadPriority FindClose Process32FirstW Process32NextW GetThreadPriority CreateToolhelp32Snapshot QueryPerformanceFrequency ResumeThread CreateThread GetLogicalDrives GlobalAlloc GlobalFree CreateDirectoryW InitializeCriticalSection CreateProcessW HeapAlloc GetCurrentProcess HeapFree GetProcessHeap IsBadReadPtr GetExitCodeProcess LocalAlloc LocalFree CreateMutexW SetDllDirectoryW HeapSetInformation GetVersionExW TerminateProcess RaiseException WaitForMultipleObjects DeleteFileW FindNextFileW FreeLibrary CopyFileW ReadFile GetFileSizeEx GetLocalTime GetFileAttributesExW GetShortPathNameW GetDiskFreeSpaceExW MoveFileExW QueryDosDeviceW SetEvent SetErrorMode CreateRemoteThread WaitNamedPipeW WaitForMultipleObjectsEx GetFileAttributesW GetDiskFreeSpaceW GetSystemInfo DuplicateHandle Module32NextW InterlockedIncrement GetCurrentProcessId ProcessIdToSessionId GetCommandLineW SystemTimeToFileTime WTSGetActiveConsoleSessionId InterlockedCompareExchange VirtualQueryEx VirtualProtect HeapCreate AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler InterlockedExchangeAdd OpenThread DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult GetModuleHandleExW SetNamedPipeHandleState GetUserDefaultLCID GetStringTypeExW LCMapStringA LCMapStringW LoadLibraryA GlobalMemoryStatusEx GetEnvironmentVariableW GetSystemDirectoryW SetLastError SwitchToThread TerminateThread SetStdHandle GetModuleHandleA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA SetHandleCount HeapSize IsValidCodePage GetOEMCP IsDebuggerPresent GetACP ExitProcess VirtualAlloc GetModuleFileNameA GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue GetStringTypeW GetCPInfo GetFileType HeapReAlloc RtlUnwind GetCommandLineA WaitForSingleObject Module32FirstW InterlockedDecrement GetStringTypeA GetLocaleInfoA EnumSystemLocalesA SystemTimeToTzSpecificLocalTime LoadResource FindResourceW FindResourceExW IsValidLocale GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA CompareStringA CompareStringW UnhandledExceptionFilter SetEnvironmentVariableA GetSystemTimeAsFileTime ExitThread HeapDestroy VirtualFree DeleteCriticalSection EnterCriticalSection GetProcAddress GetLastError LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetVersion LoadLibraryW WriteFile ReadProcessMemory MoveFileW

user32

DispatchMessageW DefWindowProcW UnregisterDeviceNotification RegisterClassW PostThreadMessageW CreateWindowExW RegisterDeviceNotificationW LoadIconW TranslateMessage LoadCursorW KillTimer UnregisterClassW PostQuitMessage GetMessageW DestroyWindow FindWindowExW GetWindowThreadProcessId IsWindow GetWindowLongW SendMessageTimeoutW SendMessageW PostMessageW GetClassInfoW SetWindowLongW MsgWaitForMultipleObjectsEx PeekMessageW SetTimer GetSystemMetrics

gdi32

GetStockObject

advapi32

GetSecurityDescriptorSacl GetSidSubAuthorityCount GetSidSubAuthority SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegEnumValueW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW RegOpenKeyW ConvertSidToStringSidW IsValidSid ImpersonateNamedPipeClient DuplicateTokenEx SetTokenInformation CreateProcessAsUserW GetTokenInformation OpenThreadToken OpenProcessToken GetSidIdentifierAuthority RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser SetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetSpecialFolderPathW ShellExecuteW ord165 SHGetDesktopFolder SHGetFolderPathW

ole32

CoSetProxyBlanket CoUninitialize CoTaskMemFree StringFromGUID2 CoInitializeSecurity CoCreateInstance CoInitialize

oleaut32

SysAllocString SysStringLen VariantClear VariantInit SysAllocStringLen SysFreeString

ws2_32

gethostbyname closesocket inet_ntoa socket WSAStartup WSACleanup WSCEnumProtocols WSCDeinstallProvider WSCGetProviderPath sendto select htonl

setupapi

CM_Get_Device_IDW SetupDiEnumDeviceInterfaces CM_Get_Parent CM_Get_DevNode_Registry_PropertyW SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW CM_Enumerate_Classes SetupDiSetClassInstallParamsW CM_Get_Child SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Request_Device_EjectW CM_Get_DevNode_Status SetupDiCallClassInstaller

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

msi

ord217 ord173

crypt32

CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgClose CertCloseStore CryptQueryObject CryptMsgGetParam

Cloud Security/BavAs.dll

IMPHASH d6260771d51fd6e850b6582e92b04bc7
SHA256 b5ed725c2e85123193dbebf9de09644a6c1d9810b6f91d37a59ddff9bc94ea62
MD5 3d112827da9b097e91f34eda56472404
SHA1 5efd2d01371123850501103363ebe33f1f01156a
SHA512 37ebb6a5c13360edec238a970c01c79153c5d3513a33c0a6acc7a310c7a8b4a1c543807fd9c6ff842dfdeba058d53c297e9cec20dcf07ee32f32903a52720c59
SSDEEP 6144:F/xdFOR7vg50TRiSylxA6ctwSpffOifmWjXl4tzgZaB/LiOA8EAG9qpk+/cSF4Yf:tDvpmbpzfmQE6aR+pAv0SF4wS/FS
TLSH
T1EDF43B00E741D13BE8BB04B18ABD65BD623D9A311B1915C3E3CC9C695BB77D12E3226B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

63:74:0a:34:18:ab:21:92:84:f2:92:22:dc:12:a1:36:73:9b:bf:e7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

507879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavAs.pdb

log

WriteLog

kernel32

GetProcAddress CloseHandle CreateFileW GetLastError GetFileSizeEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesW SetFileAttributesW ReadFile SetFilePointer WriteFile SetEndOfFile MoveFileW CopyFileW MoveFileExW lstrcmpA lstrcpyA DisableThreadLibraryCalls GetModuleFileNameW LoadLibraryW GetModuleHandleW lstrlenW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection DeleteFileW GetStdHandle VirtualAlloc VirtualFree InterlockedCompareExchange Sleep InterlockedExchange MultiByteToWideChar FreeLibrary GetCurrentThreadId CreateFileA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree GetCommandLineA RaiseException RtlUnwind HeapReAlloc GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize ExitProcess HeapCreate HeapDestroy SetHandleCount GetFileType GetStartupInfoA LCMapStringA WideCharToMultiByte LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA GetLocaleInfoA GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW

shlwapi

PathRemoveFileSpecW

Cloud Security/BavBase.dll

IMPHASH 57ffb09fd77b0c7b110f3e588d860658
SHA256 08cfde841fab64768ba307263947ce633a9ad0021bcd6cdd81a6c135f1541b37
MD5 f779fcc26d2b49733b9d0de189c23677
SHA1 0ba66d51f88e6ba46c55b8e0790711520d92ce74
SHA512 4992b572a9230d2d8e456e2809cfa834959cb813748f035bf0852b823526c9b73e0b2c04ea4eb5cb5147eefd5adb2d6cf4b581a9ce82404a969083a88a3d124f
SSDEEP 3072:M1H0RsWLQKAMh6OPc2hT3779CYXc+HHj45/YODCnJvEc2IweifAyuvht7t1hetwx:3sWYG91LMoBD45vDCnJccGAXKPbrCZ
TLSH
T1AD544910A2D1C039F5FB16B1DEFD86B99679BD21074590CFA3C419AD8F22AE1AE31317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cd:a5:52:69:6f:8f:b1:a7:2f:dd:57:4e:34:25:e5:a4:02:0c:29:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

135415

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavBase.pdb

kernel32

GetPrivateProfileIntW InterlockedCompareExchange GetTimeZoneInformation QueryPerformanceFrequency QueryPerformanceCounter InitializeCriticalSectionAndSpinCount SetEvent WaitForSingleObject CloseHandle GlobalFree CreateFileW DeviceIoControl SetLastError GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile GetThreadPriority GetCurrentThread SetThreadPriority GetTickCount GetShortPathNameW ReadFile GetPrivateProfileStringW GetCurrentProcess TerminateProcess IsBadReadPtr Sleep LoadLibraryW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW InterlockedDecrement InterlockedIncrement lstrlenA FindResourceExW FindResourceW SizeofResource LockResource LoadResource DeleteCriticalSection InitializeCriticalSection CreateFileA GetProcessHeap SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA GetLocaleInfoW LoadLibraryA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId GetEnvironmentStringsW LeaveCriticalSection EnterCriticalSection GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar InterlockedExchange FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers SetFilePointer LCMapStringW HeapFree ExitThread GetCurrentThreadId CreateThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetCommandLineA GetFileAttributesW HeapReAlloc HeapCreate HeapDestroy VirtualFree VirtualAlloc RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA RtlUnwind GetConsoleCP GetConsoleMode LCMapStringA

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey

log

WriteLog

shlwapi

PathAddBackslashW StrRChrW PathAddExtensionW PathFileExistsW PathRemoveFileSpecW

Cloud Security/BavClean.dll

IMPHASH dda27be3716324adaaeae29da8e9c164
SHA256 f25f4f14f8ab60b3b073ffe2b79d66595f736a004af954e7236ecf942aae004b
MD5 11f1f85a5b543e9bc00ac02df23b5c8b
SHA1 2181b3547c42776e6c72b9b54dc21901b20a8b18
SHA512 5ef3e83d072b196b35ec7bd18a541f499f5479ff5315e11074bf833c7d08f48147555aa6e55ef7180ce4129f18aa921a13c8a41414eaef62926fcde941bf36ab
SSDEEP 3072:W2OCjaMHzs67cEKCEbmuXp2MpNTjttet2tButN0dWWRm:bnjxT/cEKFNpxtm
TLSH
T1D3142810A7E0C039F5F71AB1DEFA95A9963ABC211755D0CFA3C41D6E4E22AD1AD30327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

92:7d:51:74:39:aa:4d:bf:7a:24:1b:7b:80:50:07:65:fe:25:51:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

78904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavClean.pdb

log

WriteLog

bavqv

?Bd_Quarantine@@YAKPAU_QUARANTINE_HEADER@@PB_W@Z ?Bd_ReadQHeader@@YAKPAPAU_QUARANTINE_HEADER@@PB_W@Z ?Bd_Restore@@YAKPAPAU_QUARANTINE_HEADER@@PB_W@Z ?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection TerminateProcess GetLongPathNameW EnterCriticalSection Process32FirstW QueryDosDeviceW Process32NextW CreateToolhelp32Snapshot DeleteCriticalSection GetWindowsDirectoryW FreeLibrary GetCurrentProcess GetVersionExW DuplicateHandle GetCurrentProcessId MoveFileExW GetFileAttributesW SetFileAttributesW OpenProcess LoadResource LockResource SizeofResource FindResourceW FindResourceExW LoadLibraryA GetTickCount DeleteFileW FindNextFileW FindClose GetProcAddress InterlockedExchange GetPrivateProfileIntW lstrlenW MultiByteToWideChar GetTimeZoneInformation GetModuleFileNameW Sleep LoadLibraryW WideCharToMultiByte GetPrivateProfileStringW GetModuleHandleW InterlockedCompareExchange CreateDirectoryW lstrlenA GetStringTypeA GetLocaleInfoA FlushFileBuffers FindFirstFileW CloseHandle DeviceIoControl GetLastError CreateFileW SetStdHandle ReadFile QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA ExitProcess GetStartupInfoA InterlockedIncrement InterlockedDecrement InitializeCriticalSection RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent MoveFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetStringTypeW HeapCreate VirtualFree VirtualAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError WriteFile GetStdHandle GetModuleFileNameA GetACP GetOEMCP IsValidCodePage SetFilePointer SetHandleCount GetFileType

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExW RegCreateKeyExW OpenProcessToken

shlwapi

StrRChrW PathFileExistsW

psapi

GetProcessImageFileNameW

Cloud Security/BavCns.dll

IMPHASH 9bf58e46251001533959120da4740032
SHA256 57a973fde5be5b92776bbd5491cef86fa07f050ad735529c1ce699daf1ab1eab
MD5 e31b058df393f95ed14d0f9c2d1fde5d
SHA1 87cfc08d309e9c08bd99230d470806192a2a185d
SHA512 b5ce44f2d9fd01987404eb48d1b3ef4c4fd7e52c8c3e3419842f136d23c2d2689ef6c496fe2cc0c9155e261599fa1a6682da8060083749f15d32947f3cfa152e
SSDEEP 6144:ZlXuW7R6CSl/qY2cAxTkgy+N2vCqhOzFCsLythkWRtA:ZNuW7gll/qYYTkgyDv/hOzFCsWRW
TLSH
T10EC44B206791C53AF5FB1AB09EB9856F553CFC610B58A0CFA3C8295E4E31AD26E31317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

30:b0:8e:c0:93:54:42:5e:aa:bc:1e:10:1c:56:71:bd:09:e9:1c:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

243740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavCns.pdb

kernel32

InterlockedExchangeAdd WaitForMultipleObjects InitializeCriticalSection ResetEvent GetTickCount ReadFile GetModuleHandleW GetVersionExW GetSystemInfo Sleep GetCurrentProcess TerminateProcess GetLocalTime GetConsoleCP InterlockedCompareExchange WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW SetEvent lstrlenA GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar InterlockedExchange InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetStringTypeA IsValidLocale GetProcessHeap CreateFileA SetStdHandle WriteConsoleW EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetTimeZoneInformation GetConsoleOutputCP WriteConsoleA GetLocaleInfoW FreeLibrary GetProcAddress LoadLibraryW GetModuleFileNameW CreateEventW WaitForSingleObject CloseHandle GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings SetFilePointer LoadLibraryA GetModuleHandleA CreateEventA CreateThread GetSystemTimeAsFileTime HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc ExitThread GetCurrentThreadId GetCommandLineA GetFileAttributesW HeapReAlloc RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetStringTypeW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapCreate HeapDestroy VirtualFree VirtualAlloc GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA FlushFileBuffers

user32

GetSystemMetrics

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey

log

WriteLog

shlwapi

StrRChrW PathFileExistsW

ws2_32

getpeername ioctlsocket connect recvfrom getsockname shutdown setsockopt sendto recv bind socket closesocket __WSAFDIsSet htons WSAGetLastError select inet_addr ntohs gethostbyname WSACleanup WSAStartup ntohl accept listen getsockopt send

Cloud Security/BavCommon.dll

IMPHASH 383347fe7694ad259fedd571470ddb47
SHA256 19f1067f5432ea9c26c50813d06691b413113c7d424fb802023f9f6d098c16b8
MD5 81494354769509b3ac2ce3d372ffe1a7
SHA1 a3fc99054ba1201d09f30f2cbef853c004b57803
SHA512 d10578f167b350d1f9a483742d0aaf8621298df9c2cd3e946a3742412a509244eca681d52b5c30c4be3baeecd973e15e92e5e9ca0f6c0a5c02558a51200e7db9
SSDEEP 12288:oIURqIAaG+/7I961eow00m84bDl/ogfXvW:draG8ak/flw6X+
TLSH
T1AA947E10F6C2C037D8BF01B58ABA86799968BE71071D54D797C81EAF5F316E2BA30247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

20:a3:ba:95:8b:b7:7d:96:a4:7c:1f:d7:69:03:18:db:d0:5f:0f:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

222995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavCommon.pdb

iphlpapi

GetIpForwardTable GetAdaptersAddresses

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId CopyFileW MoveFileExW DeleteFileW GetExitCodeProcess SetEndOfFile GetProcessHeap CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess QueryDosDeviceW CreateFileMappingA GetSystemDirectoryW ExpandEnvironmentStringsW EnumResourceNamesW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW lstrcmpA GetFullPathNameW CreateMutexW ReleaseMutex GetFileAttributesW FindClose RemoveDirectoryW ProcessIdToSessionId GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileSectionNamesW InitializeCriticalSection SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA InitializeCriticalSectionAndSpinCount IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CreateDirectoryW HeapFree HeapAlloc GetCurrentThreadId WaitForSingleObject LocalAlloc IsWow64Process GetNativeSystemInfo GetFileAttributesExW SetLastError GetTickCount UnmapViewOfFile WriteFile MapViewOfFile CreateFileMappingW SetFilePointer GetFileInformationByHandle FileTimeToSystemTime ReadFile GetFileSize CreateFileW DeviceIoControl CreateFileA GlobalFree GlobalAlloc Sleep InterlockedCompareExchange CloseHandle lstrlenA FindResourceExW FindResourceW SizeofResource LockResource LoadResource GetLastError WideCharToMultiByte MultiByteToWideChar LocalFree SetProcessWorkingSetSize GetCurrentProcess GetProcessWorkingSetSize GetVersionExW GetSystemInfo WTSGetActiveConsoleSessionId SystemTimeToFileTime GetLocalTime GetTimeFormatW GetDateFormatW GetTimeFormatA GetDateFormatA GetStringTypeW GetStringTypeA RtlUnwind QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA HeapSize GetModuleFileNameA GetStdHandle ExitProcess RaiseException GetModuleHandleA VirtualAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualFree HeapDestroy HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetTimeZoneInformation GetCommandLineA HeapReAlloc GetFileAttributesA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime InterlockedExchange DisableThreadLibraryCalls LoadLibraryW FreeLibrary GetModuleFileNameW GetProcAddress GetModuleHandleW

user32

SetWindowPos GetIconInfo CloseDesktop GetDC CreateIconIndirect OpenWindowStationW OpenDesktopW FindWindowW ReleaseDC GetSystemMetrics GetWindowRect IsWindow BringWindowToTop AttachThreadInput GetWindowThreadProcessId GetForegroundWindow CloseWindowStation ShowWindow UpdateWindow EnableWindow IsWindowEnabled SetForegroundWindow GetDesktopWindow DestroyIcon PrivateExtractIconsW

gdi32

CreateCompatibleDC DeleteDC GetObjectW DeleteObject SetPixel GetPixel BitBlt SelectObject CreateBitmap

advapi32

EqualSid RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW GetUserNameW LookupAccountNameW ConvertSidToStringSidW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges SetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateLoggedOnUser GetTokenInformation RegOpenUserClassesRoot FreeSid SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AllocateAndInitializeSid QueryServiceStatus DeleteService ControlService StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW RevertToSelf RegOpenCurrentUser

shell32

ExtractAssociatedIconW ExtractIconExW SHGetFileInfoW ShellExecuteW SHGetDesktopFolder SHOpenFolderAndSelectItems ord155 SHCreateDirectoryExW ShellExecuteExW SHGetSpecialFolderPathW SHFileOperationW SHGetFolderPathW

ole32

CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl

psapi

GetProcessImageFileNameW GetModuleFileNameExW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

shlwapi

PathUnquoteSpacesW PathRemoveArgsW PathFindFileNameW PathRemoveFileSpecW PathIsDirectoryW PathFileExistsW PathFileExistsA StrFormatByteSizeW StrFormatByteSize64A PathFindExtensionW PathIsRootW PathIsNetworkPathW PathAppendW

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore CryptDecodeObject CertFreeCertificateContext CryptQueryObject CryptMsgGetParam CertGetNameStringW CertCloseStore CryptMsgClose

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

AES_cbc_encrypt AES_decrypt AES_encrypt AES_set_decrypt_key AES_set_encrypt_key AddFile AdjustPriveleges AtomCopyFileA AtomCopyFileW BavCommonInit BavCommonUnInit BdSignTimeToSystemTime BinaryData2HexStr BitmapFromIcon BitmapFromIconEx ByteToGBA ByteToGBExA ByteToGBExW ByteToGBW CLSIDToStringA CLSIDToStringW CalcElapsedTimeA CalcElapsedTimeW CalcFileMD5A CalcFileMD5W CalcStrMd5 CallSHGetImageList ChangeWindowMessageFilter CloseZip CompareVersionExA CompareVersionExW ContinueService ControlServiceInt CreateGrayIcon CreateNamedShareMemA CreateNamedShareMemW CreateShortCutA CreateShortCutW CreateZip CreateZipBuf CreateZipHandle DecodeFromFileA DecodeFromFileB DecodeFromFileW DeleteServiceInt EnableFileEveryoneRWPrivilege EncodeToFileA EncodeToFileB EncodeToFileW ExtractFile FindFileAndSelectA FindFileAndSelectW ForceBringWindowToTop GetActiveDesktopToken GetActiveUserSessionToken GetAuthSignIssuerNameA GetAuthSignIssuerNameW GetAuthSignOwnerNameA GetAuthSignOwnerNameW GetAuthSignTimeA GetAuthSignTimeW GetBasePathA GetBasePathW GetBavInstallDirA GetBavInstallDirW GetCommonAppDataFolderA GetCommonAppDataFolderW GetCurrentDateTimeA GetCurrentDateTimeW GetCurrentLocaleNetTimeA GetCurrentLocaleNetTimeW GetCurrentUserSidA GetCurrentUserSidW GetDateTimeA GetDateTimeW GetDefaultBrowserInfo GetDefaultBrowserInfoEx GetFileCompanyNameA GetFileCompanyNameW GetFileIconA GetFileIconW GetFileLastWriteTimeStringA GetFileLastWriteTimeStringW GetFileLastWriteTimeTime64A GetFileLastWriteTimeTime64W GetFileProductDescA GetFileProductDescW GetFileProductNameA GetFileProductNameExA GetFileProductNameExW GetFileProductNameW GetFileProductVersionA GetFileProductVersionW GetFileSizeByNameA GetFileSizeByNameExA GetFileSizeByNameExW GetFileSizeByNameW GetFileVersionA GetFileVersionW GetGUIDForDllMainPatchA GetGUIDForDllMainPatchW GetInstallChannel GetInstallChannelEx GetInternetTime GetLocalAppDataDirA GetLocalAppDataDirW GetLocalDateTimeA GetLocalDateTimeW GetLocaleDateTimeA GetLocaleDateTimeW GetNormalUniqueUserIDA GetNormalUniqueUserIDW GetNormalUniqueUserIDWOld GetNumberOfProcessors GetOSVer GetOSVerStrA GetOSVerStrW GetParentPid GetParentProcess GetPathAppNameA GetPathAppNameW GetProcessPathByPid GetProcessorNameString GetServiceStatus GetTaskbarEdge GetUniqueUserIDA GetUniqueUserIDOld GetUniqueUserIDW GetUserDataPathA GetUserDataPathW GetUserType GetVersionInfo GetVersionInfoEx GetWindowRightBottom HexStr2BinaryData InstallService IsAuthSignValidA IsAuthSignValidW IsFileExistA IsFileExistW IsFileRWAbleA IsFileRWAbleW IsFileReadAbleA IsFileReadAbleW IsFileWriteAbleA IsFileWriteAbleW IsNetWorkOKTried IsReservedDevName IsServiceInstall IsSvcCanBeStop IsUserLoggedOn IsVistaOrAbove IsWin64Os MD5Final MD5Init MD5Transform MD5Update MinimizeMemory MultiByte2WideChar NoCardGetFileIconA NoCardGetFileIconNoExceptA NoCardGetFileIconNoExceptW NoCardGetFileIconW PathIsFile PauseService QueryServiceStatusInt RegisterPowerSettingNotificationEx ReleasePriveleges RunExeA RunExeW SafeDelFileA SafeDelFileW SetObjectToLowIntegrity SetRegKeySecurityA SetRegKeySecurityW SetTopWindow ShellExecuteBDA ShellExecuteBDW ShowWindowAtRightBot ShowWindowAtRightBotXY ShowWindowAtRightBottom ShowWindowAtRightSlide SimpleXorEncrypt StartAppActiveUser_Safe_Ex StartAppForUser_Safe StartServiceInt StartUserAppInSrv StopService StringToTimetA StringToTimetW SystemTimeToStringA SystemTimeToStringW TimetToSystemTime UnregisterPowerSettingNotificationEx WTSQueryUserToken_Safe WideChar2MultiByte ZipAddBuf ZipAddFile ZipAddFolder ZipAddHandle ZipAddHandleLen crc32 crypt_md5

Cloud Security/BavFi.dll

IMPHASH 39e9fccf933f9cc1793ed58cf4a9937f
SHA256 dfe5422d1472bb6df7e24ba4cdb972fee35ff03f724dc54da2156c99aed15726
MD5 502f6fb2f44b2e7408d70cd01ebdceba
SHA1 6d5b5b00d389b912b65ddb5acb749df749c8133a
SHA512 32cc653e7b15ce104f58ea580087df24ab4fdf41b6b9cafc75ff569417c330cc73057085520b43540eff0595c9df561a2a679ac7fc9b517b1af1a5d20a1803a7
SSDEEP 768:lu55k64R5nOVrUJM/LMxFuFbF8mNOFcmiJqcG3/QaKQ5g7e5mr8wXMxq:luo6EOVretmBm8k/Qa156fmq
TLSH
T1518349007751C033D09E157881A6C7A29A3DFA926FF2D2C72F95526DAE313C16F362A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

78:9d:51:1c:5f:ef:71:94:1f:81:00:ba:2f:5a:85:f0:f4:6d:f7:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

15953

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavFi.pdb

Cloud Security/BavPe.dll

IMPHASH b9dbb474e56712beb61c6179c24b61fa
SHA256 3d9e39dacb72055ce5f0a89f5ce4ca23c772ee68b7c35e534dfb667b1db02a25
MD5 13a8a5c9f3c34fcfa8447e038509fe93
SHA1 0cb86db8bafed4e751f1b3320f5bc1bce2a397c5
SHA512 e649cc43d7f0829b31ed998c7581818a9db78296c50d5e4ff7ac06469c4a523bbe26b93b3025d957f0bf316090814b79f2523318c54fe0ac9704859072fdc904
SSDEEP 1536:qhKx/jhQArsdNx1f1NcmYVn0mJNNhPjsloRhQnJox:qUx/V/YtiRF0mJNNhPjsloRhwY
TLSH
T1D3932922BBD1C13AF8F38A71CAB183771B24B9A297B4C1DF99CA021D6B317D14631716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

57:b9:2e:c1:ac:aa:63:04:13:d4:77:d2:c8:42:7a:d3:d6:fa:4c:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

30011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavPe.pdb

?CheckPeInfo@CBavPe@@UAEJW4_BAVPE_CHECK_INFO_TYPE@@PAU_BAVPE_DATA_INFO@@@Z ?FilePosToRVA@CBavPe@@UAEJIPAI@Z ?GetCloudSign@CBavPe@@UAEJQAI@Z ?GetDosHeader@CBavPe@@UAEJPAU_BAV_IMAGE_DOS_HEADER@@I@Z ?GetDosHeaderPtr@CBavPe@@UAEJAAPAU_BAV_IMAGE_DOS_HEADER@@@Z ?GetEntryPoint@CBavPe@@UAEIXZ ?GetFileMap@CBavPe@@UAEPAEXZ ?GetFileSize@CBavPe@@UAEIXZ ?GetFullPathNameW@CBavPe@@UAEPAGXZ ?GetHeapSize@CBavPe@@UAEIXZ ?GetImageBase@CBavPe@@UAEIXZ ?GetMD5@CBavPe@@UAEHPAE@Z ?GetMap@CBavPe@@UAEPAEXZ ?GetOverlayInfo@CBavPe@@UAEJAAPAEPAI@Z ?GetPeHeader@CBavPe@@UAEJPAU_BAV_IMAGE_NT_HEADERS32@@I@Z ?GetPeHeaderPtr@CBavPe@@UAEJAAPAU_BAV_IMAGE_NT_HEADERS32@@@Z ?GetPeInfo@CBavPe@@UAEJW4_BAVPE_GET_INFO_TYPE@@PAU_BAVPE_DATA_INFO@@@Z ?GetReservedHeapSize@CBavPe@@UAEIXZ ?GetReservedStackSize@CBavPe@@UAEIXZ ?GetSecIndexByOffset@CBavPe@@UAEJIAAH@Z ?GetSecIndexByRVA@CBavPe@@UAEJIAAH@Z ?GetSectionHeaderPtr@CBavPe@@UAEJAAPAU_BAV_IMAGE_SECTION_HEADER@@@Z ?GetSectionHeaderPtrSafe@CBavPe@@UAEJAAPAU_BAV_IMAGE_SECTION_HEADER@@@Z ?GetSectionHeaderSafe@CBavPe@@UAEJPAU_BAV_IMAGE_SECTION_HEADER@@I@Z ?GetSectionNum@CBavPe@@UAEHXZ ?GetSizeOfImage@CBavPe@@UAEIXZ ?GetStackSize@CBavPe@@UAEIXZ ?Init@CBavPe@@UAEJPAEIPAGH@Z ?IsSecurityDataOK@CBavPe@@UAEHXZ ?IsX64@CBavPe@@UAEHXZ ?LoadPE@CBavPe@@UAEJPAEI@Z ?RVAToFilePos@CBavPe@@UAEJIPAI@Z ?Read@CBavPe@@UAEJHPAEPAH@Z ?ReadByOffset@CBavPe@@UAEJHPAEHHPAH@Z ?RemoveLastSection@CBavPe@@UAEJXZ ?RestoreDosHdr@CBavPe@@UAEJPAU_BAV_IMAGE_DOS_HEADER@@I@Z ?RestorePeHeader@CBavPe@@UAEJPAU_BAV_IMAGE_NT_HEADERS32@@I@Z ?RestoreSectionHdr@CBavPe@@UAEJPAU_BAV_IMAGE_SECTION_HEADER@@I@Z ?Seek@CBavPe@@UAEJHHPAH@Z ?SetFileSize@CBavPe@@UAEJIH@Z ?SetImageBase@CBavPe@@UAEXI@Z ?SetPeInfo@CBavPe@@UAEJW4_BAVPE_SET_INFO_TYPE@@PAU_BAVPE_DATA_INFO@@@Z ?UnInit@CBavPe@@UAEXXZ ?Write@CBavPe@@UAEJHPAEPAH@Z ?WriteByOffset@CBavPe@@UAEJHPAEHHPAH@Z DllGetClassObject DllReleaseClassObject

Cloud Security/BavQv.dll

IMPHASH 137c2f21e38482ac76bafdcbdb74b740
SHA256 2e7cccc370f405947505192a3ea7598b5c7b6a2cd2cf2606b3bab8cde804acb8
MD5 a790d197e5772dafa165d09d4082cad9
SHA1 5987736c022147a3d6ca96011b345012ec95edd3
SHA512 b86bad17454b8c47c0d753c1efe631c6a82d88999dcaaac31b195052119b9502127fa6c75a80e0ce7debc9962a0e407e81bdaa536c615f38f754bc085320c15a
SSDEEP 3072:fGAWInqT3FRaygLHwrworrQV5+YdTBfG9iCtQte695ir:FvQrDMjhTBe9F
TLSH
T103046D1176D0C536E1FB5E3989F48620993BBE215BB5C0DF76C81AAE1E30BE19B30356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4b:dc:3f:b9:cc:52:e0:64:b7:81:5d:68:f2:0d:b9:81:8a:77:18:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

51973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavQv.pdb

log

WriteLog

kernel32

CreateDirectoryW CreateFileW DeviceIoControl ReadFile CreateFileMappingW MapViewOfFile GetLastError InterlockedCompareExchange Sleep InterlockedExchange LoadLibraryW GetProcAddress CloseHandle CompareStringW UnmapViewOfFile GetCPInfo CompareStringA GetProcessHeap GetSystemTimeAsFileTime GetFileAttributesW MoveFileW GetCurrentThreadId GetCommandLineA HeapAlloc HeapFree HeapReAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException WideCharToMultiByte GetTimeZoneInformation EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection MultiByteToWideChar WriteFile GetConsoleCP GetConsoleMode RtlUnwind SetEnvironmentVariableA InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetTimeFormatA GetDateFormatA ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId VirtualAlloc HeapSize SetStdHandle InitializeCriticalSectionAndSpinCount FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA CreateFileA SetEndOfFile

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW

shlwapi

PathIsDirectoryW PathRemoveFileSpecW

Cloud Security/BavScan.dll

IMPHASH 5388e674421a4bc22be9f19884b4f565
SHA256 37a2ccb951b4088c0dc9595d0825ccd54435761472f9e589855fd0a33f715f78
MD5 45dabac81cf0d4a349ce126e64ffa153
SHA1 95548e2e3e8843dc45d45f2d3973d7ddc03993e4
SHA512 ed981df575c5acc7311c470d62231ea87213e374e3a16dfd58f7a923ad1be1cacfcc49676edec967b1fb0ba7c503e27173e4c3279fc15a31045ef8365828da35
SSDEEP 6144:QVogOCfKdBABC28bd1tttttttttttiVq:QVgCQeBCnbd1ttttttttttti
TLSH
T14F74E41067E68039F2F72B74AEB985958A39FC616B61D0CF93C0649E5A32ED19D30733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4d:ba:a7:22:26:5a:1f:f4:b4:83:37:52:9d:ee:f6:c2:70:49:c6:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

121745

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavScan.pdb

shlwapi

StrRChrW PathRemoveFileSpecW PathAppendW PathFileExistsW

log

WriteLog

kernel32

GetPrivateProfileStringW WideCharToMultiByte Sleep GetModuleFileNameW GetTimeZoneInformation MultiByteToWideChar lstrlenW ReleaseSemaphore WritePrivateProfileStringW GetPrivateProfileIntW InterlockedExchange FindClose ResetEvent CreateSemaphoreW GetExitCodeThread CreateEventW FindNextFileW CloseHandle DeleteFileW CreateThread GetModuleHandleW IsBadReadPtr GetLocalTime CreateFileW DeviceIoControl SetLastError GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile SetEvent GetCurrentProcess TerminateProcess InitializeCriticalSection GetTickCount SetStdHandle WriteConsoleW InterlockedCompareExchange WaitForSingleObject CreateDirectoryW MoveFileExW lstrlenA FindFirstFileW DeleteCriticalSection EnterCriticalSection GetProcAddress GetLastError LeaveCriticalSection InitializeCriticalSectionAndSpinCount LoadLibraryW InterlockedDecrement GetModuleHandleA InterlockedIncrement FreeLibrary GetConsoleOutputCP WriteConsoleA GetLocaleInfoW LoadLibraryA GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID IsBadCodePtr CreateFileA GetProcessHeap GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer FlushFileBuffers HeapFree HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetFileAttributesW HeapReAlloc RtlUnwind RaiseException LCMapStringA LCMapStringW GetCPInfo GetStringTypeW WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree HeapCreate HeapDestroy VirtualFree VirtualAlloc ExitProcess HeapSize GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode

advapi32

RegQueryValueExW RegCreateKeyExW RegCloseKey

Cloud Security/BavSig.dll

IMPHASH e2fc45e7536d85fb92c37cbc3a9a9cdc
SHA256 6bf72c441367e5f3963baebb8ac5cd45ed654bf9f4db531113855c026232918a
MD5 788c271da9cd29dc6b1183a7fce28e95
SHA1 a74c602bd4e28fa8da4da7c8c4509697b5e1e0aa
SHA512 4b4203b59264e5f1fcbf14f35328dc09ae417347c581fc292e330663ad011cdc8d52c9e4fc82a89fd719e169a28285ec8c0da6b4659cecdddcbc79dca6df7826
SSDEEP 3072:qxTK3BJ5Aav48rZVA9wN4Jdkf3Ov8vuch5+4:X75x7WvTT4
TLSH
T12C041B106781893AF4F76BBA5DF68654963AFCA0477590CF7388991D0E32AD3B930723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

85:5b:b2:44:2f:d0:2c:4f:f8:ca:2e:66:c2:27:d3:4f:f3:61:84:42

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

63986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavSig.pdb

log

WriteLog

kernel32

EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement GetThreadPriority GetCurrentThread SetThreadPriority Sleep SetFilePointerEx GetLastError DeleteCriticalSection CreateFileW CloseHandle GetFileSizeEx GetPrivateProfileStringW MoveFileExW CopyFileW DeleteFileW InterlockedCompareExchange InterlockedExchange LoadLibraryW GetProcAddress InitializeCriticalSection ReadFile WriteFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA HeapFree GetFileAttributesW HeapReAlloc HeapAlloc RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW

Cloud Security/BavUa.dll

IMPHASH 0894ffa293e5d3bd37c3432a4268f9cc
SHA256 9ae6f9cc430fff56c1e40e6c64ff11795ee227a11761a1e918a666a14c0a1556
MD5 aff0a921b0572f295b836690ca1d7c93
SHA1 efe900c6e723ecbc18f01ad69ff61f5345d716f9
SHA512 af148694ba774a0dff770437610729c7a5c5251590e054802427db564093fdc8695b1214394044397602bf980463e50e1d858a2c449c188ff9927ecbd55292db
SSDEEP 12288:gAA0Pkzxf6j4HpPgjSlio+Qg+TFiMHjNYtOKyCqpAy0c74U1dBWfZ3/qJbnJg6cH:w0Yf6j4HpPgjSXUGCtOZBMhUFg6N2
TLSH
T152554B72A76AC23DD5CE22B1DE3CBF9E112DE6A2071405C7B2D82DE95E209D37A34147
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

99:31:bb:82:ff:93:75:15:c3:e6:12:60:d6:98:d4:72:d5:27:84:c3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

932392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavUa.pdb

kernel32

AreFileApisANSI GetFullPathNameW GetFullPathNameA GetTempFileNameW SearchPathW lstrlenA CreateDirectoryW SetFileTime GetWindowsDirectoryA CreateFileW GetTempPathW CreateDirectoryA SetCurrentDirectoryA GetLastError GetCurrentDirectoryW SetLastError MoveFileW RemoveDirectoryA SearchPathA SetFileAttributesA GetTempFileNameA MoveFileA SetCurrentDirectoryW RemoveDirectoryW GetCurrentDirectoryA CloseHandle GetWindowsDirectoryW DeleteFileW GetTempPathA SetFileAttributesW DeleteFileA FindFirstFileW FindFirstFileA FindClose FindNextFileA FindNextFileW GetFileSize SetFilePointer SetEndOfFile WriteFile ReadFile GetCurrentProcess GetProcAddress CompareFileTime GetSystemInfo FileTimeToDosDateTime DosDateTimeToFileTime SystemTimeToFileTime GetSystemTime WideCharToMultiByte MultiByteToWideChar GetTickCount FileTimeToLocalFileTime GetStdHandle WaitForMultipleObjects VirtualFree VirtualAlloc GetVersionExA WaitForSingleObject SetEvent CreateEventA CreateSemaphoreA ReleaseSemaphore ResetEvent LocalFileTimeToFileTime QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetModuleFileNameA LoadLibraryA FreeLibrary DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateFileA DisableThreadLibraryCalls WriteConsoleW GetConsoleOutputCP WriteConsoleA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapAlloc HeapReAlloc ExitThread CreateThread GetCommandLineA RaiseException RtlUnwind GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement Sleep HeapSize ExitProcess HeapCreate HeapDestroy SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetLocaleInfoA SetStdHandle

user32

CharUpperA CharLowerW CharLowerA CharUpperW CharNextA CharPrevExA

oleaut32

SysStringByteLen SysFreeString SysAllocStringByteLen VariantCopy VariantClear SysAllocString

Cloud Security/BavVt.dll

IMPHASH 1109ebb2a0d7eac8ffba8ac432c8308c
SHA256 c00772c77d2b9d50b94787ade3b034e06eadd3738dec8b2bd774b9f76684c04a
MD5 3e9f8aabbd8b86bdc3d1e3ba0ab1d9f9
SHA1 7b5ddf0af1c9b62f37dc099abaa52e1fd75b1aac
SHA512 fe147aa431a1c4d2c9ec66641248bd0060dff3eba74a1b91a36b7fec1c4420e9191a402ed0418276284ae9a8857e449ca740bc9aaef9c7449e5467b47a6e280a
SSDEEP 1536:2HY5M/bxN5vin7Kai5VJrn6HLwo7RQI82v5lkGL8Iltt3tfGAOr1Iay5gKiGNpq:0Q7KpsT605LVtt3tfR15gKiG
TLSH
T170C339107AE0C03AE4F71A769EB986559A3EBD314B55D0CFB384166E4E60FD0AE31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a5:88:99:67:24:de:74:f6:e2:a1:ad:43:53:92:fb:05:4f:93:a0:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

37294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavVt.pdb

wintrust

CryptCATAdminAcquireContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData CryptCATCatalogInfoFromContext CryptCATAdminEnumCatalogFromHash WinVerifyTrustEx

crypt32

CertGetNameStringW

log

WriteLog

kernel32

WriteConsoleA SetStdHandle GetConsoleOutputCP WriteConsoleW CreateFileA GetConsoleMode GetConsoleCP GetLastError LoadResource LockResource SizeofResource FindResourceW FindResourceExW FlushFileBuffers FreeLibrary LoadLibraryW GetSystemDirectoryW LocalAlloc LocalFree CloseHandle CreateFileW GetWindowsDirectoryW FileTimeToLocalFileTime FileTimeToSystemTime InterlockedCompareExchange Sleep InterlockedExchange SetFilePointer GetProcAddress GetModuleHandleW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetFileAttributesW RtlUnwind TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc LoadLibraryA InitializeCriticalSectionAndSpinCount GetLocaleInfoA LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW

user32

wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW

Cloud Security/BavWl.dll

IMPHASH ee7c07cd5d86c5c802ad82bf1ec8d431
SHA256 4562279f7a1d617b4b0680a10c3a1c1e7e76e62b964a2adbf24450843ae08a6e
MD5 4550721dfe38da7d6a43848ac36b5908
SHA1 03b02ec52e8a6005bd74af27561b437bd9f179b1
SHA512 2e18074ef4ac5c4a8b1180f8214d4ae1b3866c6fd511da933a1b91e660401b1cd4dd4594b025e6d0acbc4a78436c1c6488b4db9cb1db08facf89b7884d860c12
SSDEEP 6144:wKUPmCOPS7gqhpksApIaAbF/jvgJIPB7v35:wb/OPS7giksAC95/jvdB7v
TLSH
T15594E8506EE29539F4F71FB27E7D81940938FEE01B60E1DFD28458DD1A22AD39931B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7a:6d:28:ee:21:cb:14:89:55:5a:7d:8a:34:0c:7f:ad:88:a3:af:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

188414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\BavWl.pdb

log

WriteLog

kernel32

HeapCreate WideCharToMultiByte lstrlenW GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CloseHandle CreateThread SetEvent WaitForSingleObject GetModuleFileNameW CreateFileW CreateEventW ResumeThread FindFirstFileW FindClose DeleteFileW DeleteFileA GetPrivateProfileStringW WriteFile InterlockedExchange MultiByteToWideChar lstrlenA GetPrivateProfileIntW InterlockedCompareExchange Sleep GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetTickCount GetLocalTime SetFilePointerEx ReadFile GetFileSizeEx LoadLibraryW GetProcAddress HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA HeapDestroy VirtualFree VirtualAlloc HeapReAlloc RaiseException GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapSize ExitProcess GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId RtlUnwind LoadLibraryA GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

shlwapi

PathFileExistsW

Cloud Security/BsrScan/BavBsr.dll

IMPHASH 65607c094d99c9054d687112abbabcac
SHA256 8e7a6a37a7e11339c29cd8ad8a074fd279b989f0580819bf6bab30f90f000885
MD5 6be2b8d5f3705fe29cff6e88911c2c2e
SHA1 38d629b8397af0c3bf1ffd7b0dc138a9eef85470
SHA512 88e31b4c6c5367dc5bb7e702492d3e2b5f4322d1ea2405410333ea0b0c4db88df27462bfea414e04eb23ab846aade43e725efabc16f79dad786ef67f8b3461e2
SSDEEP 49152:gi9TXMCKd/CgOTU+IPCOe7c8jvXpfE96/iJtjfqYQyrTkYBE7wyImtC/pF9eO67:dtgr+IwwmXpfo6/injfnQkyImbOE
TLSH
T1D6D57D11EBC2C17AE96B25B5497DCA2E892CAA90436085D3D3CC2D5B5A761D33E3334F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8e:c1:69:ee:55:41:aa:b5:ca:82:33:27:4f:81:b6:ba:3d:8c:b1:98

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1843684

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\jenkins\workspace\av-green_5-1-1_workspace\btbsrscan\output\pdb\release\BavBsr.pdb

sfc

SfcIsFileProtected

iphlpapi

GetAdaptersAddresses

shlwapi

PathFileExistsW PathIsFileSpecW PathIsDirectoryW PathRenameExtensionW PathFindFileNameW PathAppendW PathRemoveFileSpecW

wtsapi32

WTSQueryUserToken

bavqv

?Bd_ReleaseQHeader@@YAXPAPAU_QUARANTINE_HEADER@@@Z ?Bd_RestoreEx@@YAKPAPAU_QUARANTINE_HEADER@@PB_W1@Z ?Bd_Quarantine@@YAKPAU_QUARANTINE_HEADER@@PB_W@Z

kernel32

CopyFileW RemoveDirectoryW GetFileAttributesW SetFileAttributesW OpenProcess TerminateProcess GetFileSize ExpandEnvironmentStringsW GetSystemDirectoryW GetEnvironmentVariableW GetSystemInfo CreateToolhelp32Snapshot Module32FirstW Module32NextW DeviceIoControl GlobalAlloc GlobalFree GetLogicalDrives GetDriveTypeW GetVolumeInformationW QueryDosDeviceW GetLongPathNameW InterlockedCompareExchange GetCurrentProcess SetFilePointerEx CreateFileMappingW MapViewOfFileEx UnmapViewOfFile GetSystemTime lstrcpyW lstrcatW GetFileSizeEx SetFilePointer SetLastError FileTimeToSystemTime LocalFree GetDiskFreeSpaceExW VirtualAlloc VirtualFree MapViewOfFile GetLocalTime IsBadReadPtr GetModuleHandleA GetFileInformationByHandle SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime SetFileTime InterlockedExchangeAdd GetCurrentProcessId OpenThread HeapAlloc GetProcessHeap HeapFree DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult InitializeCriticalSectionAndSpinCount GetModuleHandleExW WaitNamedPipeW SetNamedPipeHandleState GetCurrentThreadId SwitchToThread OutputDebugStringW WriteFile FlushFileBuffers QueryPerformanceFrequency OutputDebugStringA CreateEventA GetSystemTimeAsFileTime GetTimeFormatA GetDateFormatA WTSGetActiveConsoleSessionId SizeofResource LockResource LoadResource FindResourceW FindResourceExW SetEndOfFile Process32NextW Process32FirstW ProcessIdToSessionId CreateFileA GetFullPathNameW GetFullPathNameA TlsGetValue UnlockFile LockFile TlsSetValue GetTempPathW LockFileEx TlsAlloc GetTempPathA DeleteFileA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapCreate GetModuleFileNameA GetStdHandle ExitProcess TlsFree GetCPInfo LCMapStringW LCMapStringA MoveFileW LoadLibraryA GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ReadFile CreateFileW FindNextFileW FindClose FindFirstFileW DeleteFileW CreateDirectoryW GetPrivateProfileIntW GetTimeZoneInformation GetSystemDefaultLangID GetVersionExW VerifyVersionInfoW VerSetConditionMask GetNativeSystemInfo GetWindowsDirectoryW GetPrivateProfileStringW GetModuleHandleW lstrlenW WideCharToMultiByte Sleep GetTickCount LoadLibraryW FreeLibrary GetModuleFileNameW GetProcAddress TerminateThread ResetEvent CreateEventW SetEvent CreateThread InterlockedExchange lstrlenA GetLastError MultiByteToWideChar ResumeThread WaitForSingleObject CloseHandle DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileSectionW CreateMutexW HeapDestroy HeapReAlloc GetFileAttributesA MoveFileExW ExitThread RaiseException HeapSize GetACP

user32

PostMessageW GetClassInfoW RegisterClassW CreateWindowExW SetWindowLongW MsgWaitForMultipleObjectsEx PeekMessageW TranslateMessage DispatchMessageW GetMessageW KillTimer SetTimer DestroyWindow DefWindowProcW GetDesktopWindow ExitWindowsEx PostQuitMessage SendMessageW SendMessageTimeoutW IsWindow GetWindowLongW wsprintfW GetSystemMetrics FindWindowExW GetWindowThreadProcessId

advapi32

RegEnumKeyExW RevertToSelf CryptHashData CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDuplicateKey CryptDeriveKey CryptAcquireContextW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ImpersonateLoggedOnUser RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetAce GetAclInformation AddAce InitializeAcl EqualSid IsValidSid GetLengthSid CopySid AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken FreeSid SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AllocateAndInitializeSid DeleteService CreateServiceW QueryServiceStatusEx CloseServiceHandle OpenServiceW OpenSCManagerW RegRestoreKeyW RegSetValueExW RegSaveKeyW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegCloseKey

shell32

SHGetPathFromIDListW ShellExecuteW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateGuid

oleaut32

SystemTimeToVariantTime VariantClear VariantInit SysStringLen SysAllocString SysFreeString

ntdll

RtlSetLastWin32Error RtlNtStatusToDosError RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlUnwind ZwReadVirtualMemory ZwQueryInformationProcess ZwQuerySystemInformation ZwTerminateProcess

userenv

ExpandEnvironmentStringsForUserW

imm32

ImmDisableIME

psapi

GetModuleBaseNameW GetProcessImageFileNameW

wintrust

WinVerifyTrust

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

htons __WSAFDIsSet select sendto inet_ntoa closesocket WSAGetLastError socket WSCDeinstallProvider WSCGetProviderPath WSCEnumProtocols WSACleanup WSAStartup getpeername ioctlsocket connect getsockname shutdown setsockopt recv bind inet_addr getsockopt listen accept ntohl ntohs gethostbyname recvfrom send

generic

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=4, id=132, productName=VS2008 build 21022, version=21022,

count=8, id=150, version=20413,

count=32, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=109, productName=VS2005 build 50727, version=50727,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=128, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 build 21022, version=21022,

count=1, id=149, productName=VS2008 build 21022, version=21022,

count=191, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=422, id=1, productName=Unmarked objects,

count=39, id=123, productName=VS2005 build 50727, version=50727,

count=285, id=138, version=30729,

count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

Cloud Security/BsrScan/BsrScript.dll

IMPHASH 62157640b96a689e386572362099b24f
SHA256 8e04d83722a240ce94e6380587beecba3bbd72f3422ef869c6d25704dcd5ad0b
MD5 02b8cf19761c3317f60f1167c77cac5a
SHA1 9bbfd9a73918b5e24a5c90c4d616047264ea0662
SHA512 6b04f4aac4e57d8c2180bdafa96d39e628c01430efe70d85d484a5e2f49038145675e385fb44967c164ac52d820a4495237cf114b65d8dd47e454f83a98b2539
SSDEEP 24576:STXwxnbZC0eU0Xw9yycUxdAqNC9TzgWin+v:+wxnb80WA8ycUxdA5TzgWi+v
TLSH
T13D05C010F786C072F6AF11F548B9A73D5A3AE6A1077406E7E3D45E5E8D202E17A3620F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2c:ad:9b:ae:35:e4:2c:81:4a:17:af:fd:cc:b2:d9:60:00:35:9f:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

471008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\jenkins\workspace\av-green_5-1-1_workspace\btbsrscan\output\pdb\Release\BsrScript.pdb

ntdll

RtlUnwind ZwQuerySystemInformation ZwQueryInformationThread ZwQueryInformationProcess ZwReadVirtualMemory

kernel32

GetModuleHandleA LoadLibraryA InterlockedIncrement CreateThread WaitForSingleObject TlsAlloc TlsFree TlsSetValue CreateFileMappingW MapViewOfFile UnmapViewOfFile GetPrivateProfileStringW OpenThread Module32FirstW Module32NextW QueryDosDeviceW GetSystemDirectoryW GetTimeFormatA GetDateFormatA FreeLibrary WTSGetActiveConsoleSessionId LocalFree FileTimeToSystemTime VerSetConditionMask GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess HeapFree HeapAlloc GetProcessHeap SetEndOfFile ProcessIdToSessionId SetLastError SetFilePointer OutputDebugStringW InitializeCriticalSectionAndSpinCount GetACP FlushFileBuffers QueryPerformanceFrequency OutputDebugStringA FormatMessageA GetModuleFileNameA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID CreatePipe FileTimeToLocalFileTime SystemTimeToFileTime VirtualQuery GetVersionExW TlsGetValue GetFileSize TerminateProcess GetFileAttributesW RemoveDirectoryW DeleteFileW WriteFile ReadFile FindNextFileW FindFirstFileW FindClose CreateFileW SetEnvironmentVariableA lstrlenA MultiByteToWideChar LoadLibraryW lstrlenW WideCharToMultiByte OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetTickCount Sleep CloseHandle GetLastError ExpandEnvironmentStringsW GetCurrentProcess GetModuleHandleW GetProcAddress InterlockedCompareExchange CreateDirectoryW GetPrivateProfileIntW GetModuleFileNameW DisableThreadLibraryCalls InterlockedExchange DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW VerifyVersionInfoW CreateFileA GetFileAttributesA CompareStringW CompareStringA GetTimeZoneInformation QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount VirtualAlloc VirtualFree HeapCreate GetStdHandle IsValidCodePage GetOEMCP GetCPInfo LCMapStringW LCMapStringA DeleteFileA MoveFileA DuplicateHandle CreateProcessA ExitProcess MoveFileW RaiseException GetSystemTimeAsFileTime GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSize HeapReAlloc HeapDestroy InterlockedDecrement

user32

wsprintfW

advapi32

GetSecurityDescriptorSacl GetAce GetAclInformation AddAce InitializeAcl EqualSid IsValidSid GetLengthSid CopySid SetSecurityDescriptorSacl LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid GetNamedSecurityInfoW SetEntriesInAclW FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW CloseServiceHandle EnumServicesStatusW OpenSCManagerW RegSetValueExW RegDeleteKeyW RegQueryValueExW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueW ImpersonateLoggedOnUser RevertToSelf RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW PathAppendW PathFindFileNameW PathRenameExtensionW PathIsDirectoryW PathFileExistsW

userenv

ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

GetMappedFileNameW GetProcessImageFileNameW

wtsapi32

WTSQueryUserToken

Cloud Security/BsrScan/bl.dat

SHA256 208d7738360eb5448454fc48ecff9723ca4c74fc6f7156853ccf7b369609dc4a
MD5 3a0f33484d66ff7e69f2c8e5753ef786
SHA1 0190b76452877b46d218ed642356190a8a194980
SHA512 61465f4d48497417b58f78257b2cad4e476eaa31234bd756590677ab9cc585b95a1ff4acf2072521df9d394914b715874b3ae7bb2a12ac4f6100be5c8b65751c
SSDEEP 384:ZB4gDQmy8DZkRfwQ+8sZ/X6fIjSA55BruyOilt9L3DxpESC0BagyX6OOPFxB:zSmy8DmRTkZ/XOy55B6yOilL7NKSC0Uw
TLSH
T13AA2F1EED8018418A25946359EFB37FB45A7597F09B6B05D34A464A2FD377C0C04AF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/BsrScan/bsr_info.ini

SHA256 0c4dc717e4e358eb1c7f4d8f51eb82ff01520871c8f440e74a3e98a91d3cda88
MD5 227c645edf72799c3f8c6a0ed3032c3b
SHA1 75d6c113db623eb6dd4b1fa2e90b60f723c512d6
SHA512 164422efc5f7b8be317f84ea53ca1b7cd732ce7cc372f356c599d493f364877b5cfe30c50a3b4a4cd044b7bdfb4b1db5b9614883d451008eb041f33fc475f75f
TLSH
T193B012700211B028584F879804B68CC0E3F0420A9D0CA07DDB9A600C5F1FD3F34DF8B2
MD5 SHA1 SHA512 TLSH

Cloud Security/BsrScan/bsrbc.sys

IMPHASH d42f69f12164fefb8225c424717a150a
SHA256 7021ba58a139653111f2bf827826b4973b4844f3da87bdb2b7eda0e994c4bc1f
MD5 b1077c230de4f1787c404e351d6e414e
SHA1 74fd6cdb194772b00d6364b1889059874e3695d1
SHA512 369ee19a2877d4c55c907842e5daa168e103d5bff6d89f1d6bd922d29f6a7f4f916ee53246d50d444ab17b23521dee03e6fae117405f799e2c3b0f54cd556f07
SSDEEP 768:D3AZCp2qjkVYShsayOfnahoICS4AIX12/J27ymoj:O1alayCICS4AWaJcoj
TLSH
T11E137E617510D032E57B4EB4EFAEF529AA35B2500F15F09762880BCE4E2DBD17B3508B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4c:9e:d7:9b:af:00:5e:fd:af:cc:69:33:1b:28:da:5b:09:7d:62:6d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Sep 3, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

31678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\code\btbsrscan\src\bsrbc\objfre_wxp_x86\i386\bsrbc.pdb

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

896B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud Security/BsrScan/bsrbc64.sys

IMPHASH 45ef71b12c7c24d2cc8917845028a98e
SHA256 f41f964eac421c398f3730fa7bef6ef80b45d61c197150e4a05671c9f71ce859
MD5 e78b4a2513d5a3791f96fb51df56a210
SHA1 d306817c6a0a0f5ab67adbcaa71f8e7c983969ba
SHA512 70187ca0a8b80a83d0ce9d04a6e9989839f31086655ec730f99f1f701b781b573cc44f0d36998257a2729658da4c324fa3fabb1da1effe19e315290ccde6112e
SSDEEP 768:e5EuyNqlmL/9VgpCU3RlSRUfB9xC5LahoICS4AIWL4gBhVxymo9FB8:eeuyFVYZcZICS4AFUgnVPofB8
TLSH
T11E336C40D22111D6F9E7CEBAE25BEA2BED70F8505718A5FF85A045851E13FF06B3A205
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

04:0c:a8:cb:23:a6:63:90:4a:62:7d:5e:00:25:20:db:26:70:65:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Sep 3, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

49252

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\code\btbsrscan\src\bsrbc\objfre_win7_amd64\amd64\bsrbc.pdb

Name

.text

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud Security/BsrScan/bsrconfig.ini

SHA256 11a8af73f287b73e1b28ff68377cf1554bce66b2c97654e875922104b792232c
MD5 16bdb61e1784af232bbef7bef2ca7972
SHA1 168ec28dc3aa521b33be7c98b99f3643c6b6e7bd
SHA512 ba9b2c29575adc7d72859f64496a0977bac6e568798dca656cb3f899302445640d8f44ce6b5e2b20ca73af61cfefb2075ccd9756d7ce52b46e5330278d6bb6bb
TLSH
T1E7C02B759B1E894F54A2314058F2220C02D00C04000040401FDC083C6F7E04A36AF02B
MD5 SHA1 SHA512 TLSH

Cloud Security/BsrScan/cl.dat

SHA256 677dbda2340ddca242f90bda3ce89b82e4860ce5c4ad8c2eee8cf744c038af38
MD5 0b97e40510b3e47ff909aae3ffebadc8
SHA1 b2c82585ff129534dfea94942863ca6d1d6855a9
SHA512 5e86efc649f857b6b4c8fdde61365b1fbad8be439c4a082ee67ab622a8b9939e1ef7833976e38ee91e018eb41a073fcb275e9ab3ebfe45fd7f33a1e1bc018759
SSDEEP 3072:Q/mWdzBkNYbZ0YZEXrOTzaJnkyCidMe+gmD3LJenOOHmvjWtv8Kr9:Q/mWlBkNYddgAOkyCE5mDLJ3vbWRDh
TLSH
T16EF312733CD6390A78950538C9F15729BD534614A491AEE8FAB357712EA8E2BC0C327B
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/BsrScan/qy.dat

SHA256 1107ac03c36e3da94eb08e3e50375963f21f794b7b96724523342b410bd9ac9a
MD5 5043cb7ec169d33777309d4b0275bf2f
SHA1 499da28665f4daf3f4877bb80b8d24a63ba1f912
SHA512 9ee6c0fd735fe8e2998896d4889e7675366c1c1816c7ed30923d54a8d4fbc202f852e500a4ec3a7516727d1d4a4b221450357f030d9749e0db4e4b126c876bed
SSDEEP 384:5eIEIWoiKks7UQvJPSstMwUZR+/L5OBnFrLLPXbfIj+0jJSzM1JcC+OaRRVjuK2s:DLrkAU4PrqZC6RLS+K8w1bj0RVjuKH
TLSH
T15BA2E13F2A8B183BCA161CB8CF6AB9EEE1D318140186465FEF9E1BD774D70C022585D5
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/BsrScan/sc.dat

SHA256 fd61c6fc155ff0eb143b2bb92bebd9dd9991744ca6bf13adcd1a7d51eb183492
MD5 74e0fd0a36710351ba3c0c2b83e8e39a
SHA1 1f082ee8bb20a0b9aa2846e68cb5a2799e873ea3
SHA512 fccabd1943b38b7160a9c6500a6b76c301e3376b027b1b4086c0a8c960b64bdf480a45fea71f9f6c0341794e8dacee08ee7ae87687f8cc66470d5e9e2da157f2
TLSH
T116818D40194DBB3DF5D29AA1094514E94A474DFF434BE20E081443EDBAB2154856FF3B
MD5 SHA1 SHA512 TLSH

Cloud Security/BsrScan/script_info.ini

SHA256 cb8e3fda2f8df1c65196aa85d5bddb5cfafb332d711143d40d5b4e49029ca94e
MD5 d5ec07ca62d64ceca705c12263299a56
SHA1 b8b0eddfdcc6b66015032b894232e6a4b5fea11e
SHA512 e3324b5ff47d4663bf2b3baf6257162a0f1a64376a55ce649329e96c80c1b8ee12cde7b61f87c8e937163d2e9d033cdd2cf17abfb8b1b2d3e015e9764e81412e
MD5 SHA1 SHA512

Cloud Security/BsrScan/symsrv.dll

IMPHASH 66026dd065c0fdaacc7a099606dc55c0
SHA256 34e46fc31ede747b75212a5a9e2e15815d2253c38eb0936b0e7daedf2554881f
MD5 e6f6d42b84b512fb6f607010a8ef8d1e
SHA1 65af06a124c24d609778c83d1a61477ac7a9a7e3
SHA512 501112bbd42935cfe5bbe74fd7b68bbe655a1ad21c35263a0179dd1bc039882049d75d99f8e4b1db2bb093f8db46b84dd042c8e1a1ced98deae5e045051f740e
SSDEEP 6144:Sk01MXxO9QpJvBiiampvjJCVx6Ck9QiNu1DU4XuMDnBYJs:j1FpJvvvuORMJVXueas
TLSH
T19F7449213392C23AD4D252FA82BD775922BCED46072716C763981AEEA9353D46F743C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

129497

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

symsrv.pdb

msvcrt

_onexit __dllonexit _adjust_fdiv towlower _purecall wcsncmp __unDName isdigit wcstol bsearch qsort strchr strncmp ??_V@YAXPAX@Z _amsg_exit _initterm _XcptFilter _fileno _iob _isatty _write __pioinfo __badioinfo _lseek wctomb _itoa _snprintf isleadbyte __mb_cur_max mbtowc malloc free _errno _wtoi64 _wcslwr memcpy strrchr wcsstr ??3@YAXPAX@Z ??2@YAPAXI@Z _stricmp getenv isspace _wcsicmp _wcsnicmp wcschr memset

kernel32

InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement GetVersion GetSystemInfo SetLastError GetLastError LocalAlloc LocalReAlloc LocalFree CloseHandle WriteFile GetCurrentProcess DebugBreak LoadLibraryA WaitForSingleObject SetWaitableTimer GetSystemTime CreateThread ReadFile GetFileTime GetFileSize LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA SetFilePointer DeleteFileA FileTimeToDosDateTime FileTimeToLocalFileTime GetFileInformationByHandle ReleaseMutex GlobalFree QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter InterlockedExchange Sleep InterlockedCompareExchange OutputDebugStringA RtlUnwind FreeLibrary CompareStringA GetModuleHandleA GetModuleFileNameA GetWindowsDirectoryA GetSystemDirectoryA RaiseException GetSystemTimeAsFileTime

advapi32

EqualSid AllocateAndInitializeSid FreeSid GetTokenInformation OpenProcessToken RegCloseKey

Cloud Security/BsrScan/symsrv.yes

SHA256 f9171164593756e56fb197327b529a4955590566560dbe62d586bff41be9d297
MD5 7469a286259799e5b37e5db9296f00b3
SHA1 8fff039853f5c2bbb8a28d056b579c7dcb7d137f
SHA512 8239b1dbdb91857bbbc335efbe2c10e607ff2bd8509eccc7cae1a73c488ab26fc92f87e858c64d38850191c19f0189363567aca24a335ca223d72840364aa027
MD5 SHA1 SHA512

Cloud Security/Communication.dll

IMPHASH 521c639f5d0b3fb45403294f52ae9ebf
SHA256 7c4606979fcafe40509759e2aba7d57204bf60c0f4ad0f823f0e0adc77388ac8
MD5 d7fb871e5f10e22f5895a0cbd97fc8de
SHA1 7a32b2f77ae914eabdc4326a7968ffb1bac92c6e
SHA512 7cf6d427b2743fccc80083d9edf9187cb40face4f4c446311011cd64eea5fb1352389aaf865b7874cebcf51ad84a759253076390f0e89b86117cc8020b21e310
SSDEEP 6144:YJU/hjrTB2pqm+oAdwShPsqYnuKJnVr5bnVY:YJU/hjrT8Z+9dwShPsTnuoVrtm
TLSH
T135743C11A6D1C039E9FB1AB59D7E866C6639BC211B25D0CFE3C4185E4F71AD1AE31323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1e:21:ee:52:b2:33:52:8c:de:06:3e:26:a1:8e:7c:eb:b1:a8:03:3e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

168179

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\Communication.pdb

log

WriteLog

kernel32

LeaveCriticalSection DeleteCriticalSection LoadResource LockResource SizeofResource FindResourceW FindResourceExW lstrlenA InterlockedIncrement InterlockedDecrement CloseHandle CreateThread SetEvent WaitForSingleObject GetModuleHandleW GetModuleFileNameW CreateFileW GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetTickCount Sleep GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetTimeZoneInformation WaitForMultipleObjects EnterCriticalSection SetFilePointer WriteFile TlsGetValue TlsSetValue CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW DisableThreadLibraryCalls TlsAlloc TlsFree GetProcessHeap HeapFree GetFileSize ReadFile SetLastError HeapAlloc ResetEvent SwitchToThread TerminateThread LoadLibraryW GetProcAddress GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar InterlockedExchange GlobalFree GlobalAlloc InterlockedCompareExchange SetEnvironmentVariableA CreateEventW GetModuleHandleA CompareStringW CompareStringA EnumSystemLocalesA IsValidLocale GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW SetEndOfFile CreateFileA GetDriveTypeA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetStringTypeW GetStringTypeA RaiseException InitializeCriticalSection HeapDestroy HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW GetCommandLineA GetFileAttributesW RtlUnwind LCMapStringA LCMapStringW GetCPInfo HeapCreate VirtualFree VirtualAlloc GetACP GetOEMCP IsValidCodePage ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetFullPathNameW GetCurrentDirectoryA GetConsoleCP GetConsoleMode FlushFileBuffers GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

advapi32

RegQueryValueExA RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser OpenProcessToken RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegCloseKey RegCreateKeyExW

ole32

CoCreateGuid

shlwapi

PathAddBackslashW PathAppendW PathFindExtensionW PathFileExistsW PathRemoveFileSpecW

winhttp

WinHttpSetCredentials WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpSetOption WinHttpOpen

Cloud Security/Data/ac.dat

SHA256 87091c6eb1d6799f534423355685ec3cef5a53b0e9012f6ae74531672efb0f59
MD5 c4b2992b6bee4b2c2f44fc0d2a6c538d
SHA1 d2d41190630e28d530f03cd3edccc9ca61838ef5
SHA512 312271ac405ed3c0c17673fa0e0e3e6723997de589f769e04a6bce064641c3d5ff350d6c5eeef0f48d2e14e35421c85fd9d9456d950f45acfd71887c9307422a
SSDEEP 384:AzcfCECLDEqEJEZ5sabiRYDLNEJFrz4AdDvlwpd8Ubn0RIk7qJB37sp4cQ3h8din:8nEqEJEZ5sabiRYKJFrz4AAn0RfKRfuC
TLSH
T1BE03A12EA002BE57E352C32E1C558EFEDE8571841B025DBC65397A27AC29736E3C1B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/Data/ag.dat

SHA256 1d122a466ed5d5d1c88a4c8ff42451a5f9cc42abe791f340845e97fba8e056c9
MD5 c9a064ccd842b1f5f6512fe95e97bdb9
SHA1 0b1a4737ab4f0392bb754c4c444bf6271add2942
SHA512 2ebae67b08b8ca8d78e0f1fb3f180fc82c9c35d931004f296977afde2695a89d92079591738be43d094ef56835480785b7bf5da5d7136683884eedacf08a6643
SSDEEP 768:4RVPF4SbNw1Ci1CSu4hxacSMyop+jbRNRohxhFFVcxmlqQj1CTXOJ7fmBuNtacQX:4Vi1Naj
TLSH
T1B1D2340283FA45D9E7FB5E7628B91A1896B2BDE22D36DB4D1124480D6833B25CDB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/Data/bh.dat

SHA256 67a8225d7b028db292140e4243aa3d299a89369e71420f0b86d7df90f3081675
MD5 6db6aa7a445909346acc9805c77db5b1
SHA1 feeb2f42f8e4c729bd00488d8beeeff778b72e44
SHA512 ddcdbea465c895bf6ed80ba279c0566b0daf44f9b6e364d7df1e89ea18191ace803eeb2ce9034ee427e7b12b381aafa97a25f111513c9277e58cfe940816444e
SSDEEP 1536:el8rre2U+n2mr3pA5jGq4EaWlj8d0gazWpRkU1CXDLQ:xw+2i6r6aC/kzDc
TLSH
T1DE63127D33EAAF397094E39564A24F3EA684B2CB507D846095F3761E31D0A93E5C203B
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/Data/bhr.dat

SHA256 500e379ff7677bc497bb4818cdd6d2f20595b7aa874216b90d3a9d97d682e76c
MD5 970a240f17088ceecfdd71c8803b7ec3
SHA1 6b6f7a815fef2a98f3cec5e8f6772bc0fffbf02a
SHA512 551e1645ab2fd3082e2585c8c1daabb71dac619de36ba24024ad1d06d2af71eaa168fa1e42774813fd40b534ae13971fe90af67cd12cc35b228a6a9f3a0926de
SSDEEP 192:MIg1dRSw82N02MBuXryFvu7X4QldaICeH00U:M5Mw826/Bu7aKX4QlQqbU
TLSH
T155D18D1BAE22B695D92A8FBB510D90004CC5C145B2E843E71DD6E9DB5968C3CD2F48FE
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/Data/bhw.dat

SHA256 84c0443b3eaed7c8d0f5a9f6b22e52c29518627d04f8cbdfacf16a584bd237e8
MD5 044f1f8aea56e663de65f664b8fc90e9
SHA1 1584ba9bf814809ae72a5cacd3823222c0069d90
SHA512 f32d37e47c39799e04830d6d840288c1fb66fccb39b86b6f4c5a276912e5d282c34684a212a110f378b1ac049f7c729a9c2870082506704a81a6e7f160192eaa
SSDEEP 192:MP/RJ2SSBUOkAMNEyvu34RENSsRoShXhMMYI36RTt:M5OkAMNduoRgSsRdhhS7f
TLSH
T132E19E66FD196510F8F0D277F454E72BA82E472EB9F26BD2DBB873842413C22608F408
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/Data/fs.dat

SHA256 b6a2e7b9882ed4ee31d97805e6e422c06eed3f2633189a1b4e68d483d3654405
MD5 e38ae69b024a9d93110db5af58ed9eae
SHA1 3538d335013dffc4a01a9d2ba1f8ff3fa7b93221
SHA512 20005d14de0cb5f67a218157c53645978647fe3080b2be0a40380d064000b3f05a0acd74ff5ed97ef470d33fb381cbf0852a2c636ac1f6a496eb0a639c1b77a6
TLSH
T1A351228209C0E813EE8A9AB060D58554CA6027234913F6936980E0A0FE935825FBDB02
MD5 SHA1 SHA512 TLSH

Cloud Security/Data/qs.dat

SHA256 342900f4f61c2be0cbf4097ef53cba05f0d037fc4f197e7bc9ff749475466a47
MD5 61b02774cca96a32df180aa0764cba37
SHA1 23cd24beef1ccf0f876da1495c5aa28a5e371861
SHA512 2ef79554f611093b42feecabe3de205489203567c4133063f92ad059a682484f38dd073023496607f4f70c9fbfb1ca39bca063c7f592e62debbcf589d03527d9
SSDEEP 96:HuZ3hZygMZ3goOZaXO/poAuCTZ3hZygMZ3goOZaXOQvY/2vlUXGH31QljhZyrCnQ:WXZaEhXZawIx
TLSH
T172C18A47C7F15388FF6D47B3ACFD4C9146BBBEE27925D38D1024024C1662E5A98643A7
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/Data/tg.dat

SHA256 f219c18bc12120efbaa9a5a04839dcdc7c43b45ef28ddd2245c0a224cdfce840
MD5 8b17a8d215313350f00eb799e2c36067
SHA1 de78e31b796f62420b907aa74f8a7caad788f337
SHA512 f799d36cc516fa3f6f9f4ae4ce5aa7a05157546c91470dad942c50175da15ce5b4603e6e33ab3280622e0cfc64486265ea7466f41258a063855699d5fe9aa7de
SSDEEP 192:WZLrV1ZLrVMLNhb7GMWkyFp9Y7nIFIRIIuI7:WZLrV1ZLrVMLNhb7GMWPT9Y7nIFIRIIZ
TLSH
T17412E30A57F2949EFBAA9A769C786D04D9BB79B17E26C7CF0024000D1572E64C974B33
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/ReportComm.dll

IMPHASH b23ce2f098153fafe9a2f08f045c3611
SHA256 ea1543db0695c684187d306b642c121044f03e684a9c2935523db2cd5131a717
MD5 c2086c3b1f8f692df687396527dcc967
SHA1 d84142189af50f424bb0b734547f3ce8aaea39de
SHA512 2e9211f4ef5c1aa492ebd2ca08b2620ba3d54aaeeb926069945fd26bbcd81167d47a55b9efb8c16ecd51155322ce1804fdf3d80e6cc61478e61a4015b9b9219d
SSDEEP 12288:NBbdYzIApXpwpMwHY1U8AGyFjU09TUZZqsujGR:NBbKLpXpMMwL8byFp9TUZLr
TLSH
T1C2948C10BB82C036ECBF05B589FE876D9669BA51071850C7A3C81DBF5F65AE27E30247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3e:c1:a4:b6:21:92:4f:8c:47:8f:05:a7:9b:b3:17:43:1f:b9:d6:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

216594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\ReportComm.pdb

iphlpapi

GetAdaptersAddresses

log

WriteLog

kernel32

FindResourceW FindResourceExW ReadFile GetModuleHandleW DeleteFileW GetCurrentProcessId GetTickCount HeapFree HeapAlloc GetProcessHeap SetEndOfFile CreateFileA DeviceIoControl InitializeCriticalSection LoadResource LockResource SizeofResource GetCurrentProcess GlobalFree TerminateThread ReleaseSemaphore CreateSemaphoreW SetEvent SetFilePointer WriteFile CreateDirectoryW ReleaseMutex CreateMutexW GetCurrentThreadId CreateFileW WaitForSingleObject CloseHandle LocalFree InterlockedDecrement GetModuleHandleA GetProcAddress GetLocalTime GetTimeZoneInformation Sleep InterlockedCompareExchange GetPrivateProfileIntW GetPrivateProfileStringW InitializeCriticalSectionAndSpinCount SetLastError GetModuleFileNameW InterlockedIncrement lstrlenA GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar InterlockedExchange DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetModuleFileNameA GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileSectionNamesW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW LoadLibraryA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA FlushFileBuffers GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle VirtualAlloc VirtualFree HeapDestroy HeapCreate ExitProcess GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime ExitThread CreateThread GetCommandLineA RaiseException RtlUnwind HeapReAlloc LCMapStringA LCMapStringW GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree

advapi32

RegEnumValueW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW GetSecurityDescriptorOwner SetNamedSecurityInfoW GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegEnumKeyExW

shell32

SHFileOperationW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathIsDirectoryW PathFileExistsW PathAppendW PathFindFileNameW

winhttp

WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpCrackUrl WinHttpSendRequest WinHttpAddRequestHeaders WinHttpGetIEProxyConfigForCurrentUser WinHttpOpenRequest WinHttpOpen WinHttpSetTimeouts WinHttpCloseHandle WinHttpConnect WinHttpReadData

Cloud Security/ReportCommRetry.exe

IMPHASH d62b762a1257213f52d6bdfc588068e2
SHA256 00969c3f8c2d1781a4b949afa6e8a42c4c4367e5833bc9eece3bf18c3c7c751a
MD5 86db07afd6e075c8b36aceb35ca41cf1
SHA1 cd98bca19994e1454e7e63847a1ca2789009e9e5
SHA512 787f7e6c04bea734c30b9662c10ba088752b31abef0934e47abf41cbedd1608e099e74115fe625b1788b5fce146bad85418bfd88e32ba3f938a06ab3acaaacf4
SSDEEP 1536:lpv3NjUiSgdJJyTT2Syv44TsdEV4k5qdUT9GNt1UMMt5S5300/r:n3xKT3k2EFINt1UN5S5304
TLSH
T12BB34A1076D0C436E4A3193B8DB9CA64DA3DFD311B6594DFB3884A6E1F61AD0AE31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fc:1a:ab:85:e3:b3:68:d4:b2:9d:5a:be:be:04:62:4d:78:7a:77:84

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Dec 16, 2014

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing)Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing)Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

3b:db:19:94:b9:8b:bb:19:ab:55:a4:23:37:fa:4f:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2012 - Apr 24, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

36331

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\bavOutput\Pdb\Release\ReportCommRetry.pdb

kernel32

CopyFileW ReadFile CreateFileW GetProcAddress CreateEventW LoadLibraryW SetLastError GetCurrentProcess FreeLibrary SetEndOfFile SetFilePointer GetFileSize LocalFree CloseHandle ReleaseMutex GetLastError InterlockedExchange GetPrivateProfileIntW lstrlenW MultiByteToWideChar GetTimeZoneInformation GetModuleFileNameW Sleep WideCharToMultiByte GetPrivateProfileStringW InterlockedCompareExchange WaitForSingleObject lstrlenA DeleteFileW CreateMutexW FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RaiseException RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount LoadLibraryA GetConsoleCP GetConsoleMode

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW

shell32

SHGetFolderPathW

log

WriteLog CreateLog

shlwapi

PathFileExistsW PathAppendW

Cloud Security/log.dll

IMPHASH b06b122df694eca4827596adc838ca43
SHA256 2bd1d0854f8c9922ff6bb1072878e39daacb7072f24bb82269d85324e3ed4aef
MD5 889d686cf839145d5bc7d200797a0872
SHA1 3d234119d52620ef7e710c91c87ef45e4332e20a
SHA512 d8a629ef8f79585355cecb586abeab417a65e9a0fa1603a868f7a07163faab145b49fa4ea2b7c0dfba1566798b13369553274b63a545c4f147f759861c456c6f
SSDEEP 1536:JYRtBH1PW++2YABYNpjNtcXIcRysIn2JRnAPt7DpkgmNOt35M63Ajq0:J4LBYTj7tsfpAPwNOt35M63A/
TLSH
T1CDA37D217690D033C4D518398659D7719A7F79729BA89CC3BBA40B791F603D0FB3A34A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7f:22:3d:f1:0f:cd:08:ec:fa:e5:71:ec:e1:88:e7:6c:db:4f:53:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

20804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\log.pdb

kernel32

LeaveCriticalSection CreateFileW GetACP MultiByteToWideChar FlushFileBuffers GetLastError EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId OutputDebugStringA CloseHandle DeleteFileW LocalFree WideCharToMultiByte WriteFile OutputDebugStringW SetFilePointer QueryPerformanceFrequency GetFileSize HeapFree HeapAlloc GetTimeFormatA GetDateFormatA MoveFileW GetSystemTimeAsFileTime GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc GetTimeZoneInformation GetModuleHandleW Sleep GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapSize GetCPInfo GetOEMCP IsValidCodePage RaiseException SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId RtlUnwind LoadLibraryA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA CreateFileA

advapi32

GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorSacl

Cloud Security/mm.dat

SHA256 1a2f3c2d2303e0f8c62171304bb1e04e99f7fc012e77e1150a8a07bfdb3b826e
MD5 530b254d17df660049375c1206de5912
SHA1 136f6ae9b806c9f6beae8d98e9ad557674e020c6
SHA512 5b02be674fa4cbd2eedd7a26649fdfca787050d5b754c62a760541865ddb36c392e399ad78c59a4ea9714ab3aab7bc7e52288d416c45ca990206c865d1d073a8
TLSH
T177318664704ACEC0C7ADA17E8F32B35C9FA520448D61E28D7B2975268BF320F5653E14
MD5 SHA1 SHA512 TLSH

Cloud Security/nsc.ini

SHA256 94f19e1de878e6d80c8cc0612c165cb76448b8772bc7b322360a84a387c8909a
MD5 72b9290de923ab180bac4db6c701bd46
SHA1 20c0afae7dbeecdc9163f0b94ed9903dbf2ed7da
SHA512 5fc91cff631a429a1a0e43b8ca26503d68ed3750727de34fdd5dce6eb196a2fc63f53c11bb40027ec095d46d23f5bfb4bb0c2d6989521af21a556d9500c34340
TLSH
T19EE01A2B0AF8512BE5E7C740CDB450766720BC12945C904C81D4A20905F690068972EB
MD5 SHA1 SHA512 TLSH

Cloud Security/nwi.dat

SHA256 74a82e34e578003fc7e6ad1c7347028ba4e883c7a948d9447455a80d199c52c4
MD5 ba2c17ac65cb030b35722a9a95b12f08
SHA1 0ab8bebc2d6b84d535fd484a78b768aca24b6e01
SHA512 48c807d95b6026ff753a0b3b0af309a564fa2a340c7b62946308b3b62043cf11d93849e7bd6b413e7505607f7c4c2d73e7830e43e1445816de0f6977798330c8
SSDEEP 6:WflmvS1Qy4ftWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWn:WfcvS1D4fX6
TLSH
T10B4401A7BB4618A6C209A572A49F6BA6A20AEE15409B920A1254CB52BE10660A8469D4
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/sc.ini

SHA256 e7758ce714b19ecbdbf68960e28671f55a2f48da39b637070d24681240e3f9a4
MD5 6221b3ca9aeb2c7f005eb32c0c4bea20
SHA1 81b072b21faf3e81f8933b998adc8baee1fa64eb
SHA512 87aa791ff6784410b56dd674af5e03e100f8c961728ab882f16e48bb4cefd3adb839c9bfe6135b8f1df4ef6f8363fa08e677583ff802c6618d5a3bb865f360b7
TLSH
T1DBD0A72F06F81417E5E7E544DDB05432BB107C69B55C940CD0C1120D05F7D11351B1DF
MD5 SHA1 SHA512 TLSH

Cloud Security/sl.dat

SHA256 524351b8edbe6d052775f5696a9634747431b6e69ff9219a66b06d865f774d6d
MD5 a1af92536adb1de8c0d8746c23a88828
SHA1 188303f908290b910685b0d55b6a6cf5079512be
SHA512 b9ff8b03d22d3326c8fe2be2de18fb0a70375ee4e763ed50dbfecfed092ba3a0f8a83dd3414a4fb6b47256052bc3453eed93d343078174eac04191572dc6f9b8
SSDEEP 192:5rXFiEHXWSFDMv3S3jPJSW9T+/+IquaU8o4ZNSm9L6VDf0m:5r1iE3dVmSYYm+Iquaw4ZNSm90om
TLSH
T15D527082097C055B13E33D462CE2DDE9C0636F197DBEB2166D79F2921E337C92A5109B
MD5 SHA1 SHA512 SSDEEP TLSH

Cloud Security/sqlite.dll

IMPHASH dda36a7c934f3550f7f33bb648da1215
SHA256 57e26dd44177a221948787ca36d29efda04315ab46046a12c006dbd830957bda
MD5 862c4a363ca98b3cef170bad89d5e1e0
SHA1 9114171dd1d1f032e0dc56ad1e1f439d7b887f22
SHA512 7608b7d155754a5c7531254e91f07a141b78bbaa93ea0098e86a6f786681398c73a9d1fd4d77144108511e17a442d7e71c53bf5e2525fe786d36457a6dd3a0e9
SSDEEP 12288:Tzm0zKh34esvLpcMvp7uy5tyVnPL3qACutOhTmjO9jBWddwOR:U34ec9cMB7uCtyZPOluchTmyxBW
TLSH
T12EB48E63E982C176F8D511B5D3FE1B7A6C2D9626432690C7BAC428C58FB04E2763E347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

80:7f:4a:59:14:cf:6f:fe:82:fd:2a:9d:8b:d4:88:ef:bc:5c:25:ad

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

422602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\BavOutput\Pdb\Release\sqlite.pdb

kernel32

GetFullPathNameW GetFullPathNameA HeapReAlloc CreateFileA GetFileSize CreateMutexW SetFilePointer MapViewOfFile UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject InterlockedCompareExchange UnlockFile LockFile OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameA GetTimeZoneInformation TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA GetModuleHandleA

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strnicmp sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8 sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_utf8_to_mbcs sqlite3_win32_write_debug

Cloud Security/version.xml

SHA256 050115c05af137ec4a41a4ec70ee6d96ddc23b37763024b648090e7c7c2e994b
MD5 6e9e21f1579af75d93295a4113f24826
SHA1 13a9147ca667915dd7825e0610c621ab253d9f27
SHA512 0f4c65330b7b40c2a612865b5f783138a3cf8be4d912fcab90ff235607661288cd7a01ea04c7a6dff55c2073527f374d1a29d63aa1747cdfbf236fd18b1021d5
TLSH
T187E0C24E4A0A1D34E2830B58075EF904B7F9535A21CE501C6AC3464B7386ABD42C8779
MD5 SHA1 SHA512 TLSH

Cloud Security/vn.dat

SHA256 11cfbff945d4f7d70cabac83386689bb97e75433dd04310919e4e29ecac814e0
MD5 93292cda5d7356770b5f3898095a0dbc
SHA1 a5bb077aacb7973cb78fb30297c87bc8475edc04
SHA512 602d2cd84e765ddc1364e6d9ac6da785ad770cf13f326586b5b68b8d14b444e44a87d0b6a6d33e612f4ca529321e505997851746dc5e001c1e8d2473cfdee153
TLSH
T127413D784E613CD0B60B193C30550A870C67592D4565359F3679FED88A99832526F35D
MD5 SHA1 SHA512 TLSH

Cloud Security/vr.dat

SHA256 7252e65c712f907653e0b09a62cd6ed88e51c48d171e877db9f9031e0aea6e95
MD5 5df4fdbe9a674be497f087ccb937572b
SHA1 e06d5c9e59d92ef6322297b32552b2495e84d8b5
SHA512 93cb8bf1956559c32308e3b46c3e208ee29c51d6b4e499c56660f1ba922bce76655664385737d131cb4b94dfe87bc91197ae7de2a1bd407d0488ef5f0b87ec6f
SSDEEP 96:ZIj+X+45Y/yg25A3z5DqFwSO+ZGM1Va7dXaGzh1JhRIga/Og8W7C4ahfmfJnew6Z:ZOjM56Fo17ZW7V0FLTeK6Z
TLSH
T1F3F1AFD94245252EE83006EE9962315CC38C121848FDF9C64BD796E8D2FA9C7335D62F
MD5 SHA1 SHA512 SSDEEP TLSH

CloudOPTClient.exe

IMPHASH 2d52a9bdf17cc1fb77b5e8a9049059c3
SHA256 e11d787309c52e6fc424e1bd564bef9cf20968e79a0fec6b0478838cbff961b6
MD5 a905b4844ba415ba35b9375d03d8c210
SHA1 363c6a118ba6089a284075d55c7a4667daa1c7cb
SHA512 d5b1c4b609fcd3dc3dcd0c481320959ac61d6f127b0065328dbb1a1a1eeb5cb6de3b8188997af6cdb42723bcbeded9e495c1c835ad083abc679d73b42bf2d5ff
SSDEEP 12288:YmboYxaAX6xnMfoXZaHqwNZpaRk88ndq8f1UGVrqUoioEs33c:PcYxaRneo3aXEBX8fOQGXiRq3c
TLSH
T164E41800B6918035F6B71AB18E7996AD9539BD310761A0CFE3C43D7E1A716E27D3222B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

15:ef:0f:ac:dc:f1:72:46:8b:3c:b5:ff:40:f7:cd:c2:32:10:40:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Apr 29, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

383308

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\devdata\pcf\trunk\public\output\pdb\CloudOPTClient.pdb

kernel32

SystemTimeToFileTime FindFirstFileW FindNextFileW FindClose lstrlenW WideCharToMultiByte GetSystemTimeAsFileTime GetTickCount QueryDosDeviceW DeviceIoControl GlobalAlloc GlobalFree VirtualAllocEx ReadProcessMemory VirtualFreeEx InterlockedIncrement InterlockedDecrement HeapDestroy HeapFree HeapCreate HeapAlloc LocalFree CreateFileA SetLastError GetVersion GetCurrentProcessId ProcessIdToSessionId DebugBreak VirtualProtect IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW GetCommandLineW InitializeCriticalSection DeleteCriticalSection GetModuleHandleA LeaveCriticalSection EnterCriticalSection UnmapViewOfFile MapViewOfFile FlushInstructionCache CreateFileMappingA GetWindowsDirectoryW LocalAlloc InterlockedExchange InterlockedCompareExchange GetFileSizeEx CreateProcessW WTSGetActiveConsoleSessionId WaitForSingleObject VirtualQueryEx InitializeCriticalSectionAndSpinCount CreateFileMappingW CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler GetCurrentThreadId TerminateProcess VirtualQuery GetProcAddress ReleaseMutex CreateMutexW lstrcatA GetThreadContext OpenMutexW DuplicateHandle OpenFileMappingW OpenEventW lstrcpyA GetCurrentThread VirtualProtectEx WriteProcessMemory GetProcessHeap CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile GetStdHandle FlushFileBuffers SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetLocaleInfoA GetStringTypeW GetStringTypeA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue LCMapStringW GetModuleFileNameW LCMapStringA GetCPInfo RtlUnwind GetStartupInfoW LoadLibraryW GetModuleHandleW lstrlenA FindResourceExW FindResourceW LoadResource LockResource SizeofResource Sleep WritePrivateProfileStringW GetLocalTime DeleteFileW CopyFileW GetTempFileNameW GetTempPathW MultiByteToWideChar GetPrivateProfileIntW GetPrivateProfileStringW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetLastError GetCurrentProcess OpenProcess GetSystemDirectoryW VerifyVersionInfoW VerSetConditionMask GetVersionExW VirtualFree VirtualAlloc GetFileSize SetFilePointer WriteFile ReadFile IsDebuggerPresent UnhandledExceptionFilter GetPrivateProfileSectionW GetPrivateProfileSectionNamesW RaiseException HeapSize HeapReAlloc CreateFileW CloseHandle GetModuleFileNameA

user32

TranslateAcceleratorW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW UpdateWindow DialogBoxParamW DestroyWindow DefWindowProcW SetTimer KillTimer BeginPaint EndPaint PostQuitMessage EndDialog GetWindowThreadProcessId EnumWindows GetTopWindow GetMessageW LoadStringW ShowWindow TranslateMessage LoadAcceleratorsW OpenInputDesktop GetUserObjectInformationA CloseDesktop GetThreadDesktop

advapi32

RegEnumValueW OpenProcessToken LookupPrivilegeValueW GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid CreateProcessAsUserW DuplicateTokenEx SetTokenInformation GetTokenInformation GetUserNameW RegQueryValueExA RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser RegOpenKeyExW AdjustTokenPrivileges

shell32

ord165 SHFileOperationW SHGetFolderPathW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoCreateGuid

oleaut32

VariantClear

shlwapi

PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW SHSetValueW SHGetValueW PathFindExtensionW PathFindFileNameW PathAddBackslashW PathAppendW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

psapi

GetModuleInformation GetProcessImageFileNameW GetModuleFileNameExW

winhttp

WinHttpOpen WinHttpSetCredentials WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpSetOption

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Communication.dll

IMPHASH 3497585ce6db5df6a70ba374e8670819
SHA256 26fa072bf2cab2b57940e332bff2c29f7017c00272a708d104d1a5ade88fc77c
MD5 817b91fca0b9914e82078e903d6a198b
SHA1 283d572f524de4f966c16ec1dbca189364a18642
SHA512 ec5bc104fea5a6499e01127401d7d71d87c026327432bb301cba78d083c5501de8bde319ec1c184733890ce5509656bbf77b7317847bf0b368b864bb76e95c4d
SSDEEP 6144:af3U/hi2CY9G0Z41MzTatkJ34QiljhXYFcU:af3U/hFdlZ41iatkJ3hiRhIW
TLSH
T12F645B10B592D039E9FB1AB28D7E85AD567DBD600B74D0CBE3C809AD4F31AD1AA31317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5e:9c:fa:bb:b4:a7:01:c3:71:c8:32:35:e3:9c:5d:c5:0a:c6:0c:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

127272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Communication.pdb

kernel32

FindResourceW FindResourceExW InterlockedIncrement InterlockedDecrement CloseHandle CreateThread SetEvent WaitForSingleObject GetModuleHandleW GetModuleFileNameW CreateFileW GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetTickCount Sleep WaitForMultipleObjects CreateEventW SetFilePointer WriteFile CreateToolhelp32Snapshot Process32FirstW SizeofResource Process32NextW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW InterlockedCompareExchange TerminateThread ResetEvent SwitchToThread WideCharToMultiByte GetLastError GetProcessHeap HeapFree GetFileSize ReadFile SetLastError HeapAlloc LockResource LoadResource DeleteCriticalSection LeaveCriticalSection EnterCriticalSection MultiByteToWideChar InterlockedExchange GlobalFree OpenProcess GlobalAlloc SetEndOfFile InitializeCriticalSection SetEnvironmentVariableA CompareStringW CompareStringA CreateFileA GetDriveTypeA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetTimeZoneInformation IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetModuleHandleA GetStringTypeW GetStringTypeA LCMapStringA RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW GetCommandLineA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc RaiseException GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetFullPathNameW GetCurrentDirectoryA HeapSize ExitProcess GetConsoleCP GetConsoleMode FlushFileBuffers GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW

advapi32

RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser OpenProcessToken RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegCloseKey RegQueryValueExA

shell32

ord165 SHGetFolderPathW

ole32

CoCreateGuid

log

WriteLog

shlwapi

PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW PathFileExistsW PathFindExtensionW PathAppendW

winhttp

WinHttpSetOption WinHttpCloseHandle WinHttpConnect WinHttpAddRequestHeaders WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpSetCredentials WinHttpOpen WinHttpOpenRequest

CrashReport.exe

IMPHASH 3cdbd323b5afb0e05c8e80099e3b150a
SHA256 115c776b5ab64665aea32ed792ea9bf0d55fcc3cc535ef8019bd73938c90c78e
MD5 d09c3f2d20e2718734a93a704632dd95
SHA1 4899ab4e387c7da1b57e1cb26f5ae7c6fc34a742
SHA512 d4e672436a89621b12d526b315af5447da17a907c518efe6ebeb7952cea466cd462e38b1166af21aec6f8a3302072c3a79c0e85f4d3d5b8409748967c68801e8
SSDEEP 12288:eUZyP3y/u81hwyayMUx9XZ0rajhHCYdzym1WjTA1Ax9ZQTxLH:eUZgyuwLayTor+NyLjk1MCTxb
TLSH
T115057C10B781C036E5B305B68ABE97BE9539B571072560C7E3C80E7E5F646E2BE3124B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

37:33:c5:43:26:d0:50:88:04:78:c7:63:90:4c:d4:2b:88:88:91:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

410018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\workspace\CrashTool_workspace\bavOutput\Pdb\Release\CrashReport.pdb

psapi

GetProcessMemoryInfo QueryWorkingSet GetModuleInformation GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

FindNextFileW FindFirstFileW ReadProcessMemory VirtualQueryEx OpenThread GetLocalTime Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalMemoryStatus Sleep WideCharToMultiByte ExpandEnvironmentStringsW InterlockedExchange GetPrivateProfileSectionNamesW GetPrivateProfileSectionW WritePrivateProfileStringW GetTempPathW GetTempFileNameW CreateDirectoryW ReadFile MoveFileExW GetFileSize GetVolumeInformationW GetDiskFreeSpaceExW RemoveDirectoryW SetFilePointer GetLogicalDrives GetDriveTypeW DeviceIoControl MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetCurrentProcessId CreateMutexW InterlockedCompareExchange SystemTimeToFileTime GetPrivateProfileStringW GetFileSizeEx WTSGetActiveConsoleSessionId ProcessIdToSessionId GetPrivateProfileIntW InitializeCriticalSectionAndSpinCount Module32NextW VirtualProtect Module32FirstW HeapCreate HeapAlloc CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler LeaveCriticalSection SetEndOfFile CreateFileA GetTimeZoneInformation WriteFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW EnterCriticalSection IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA SetConsoleCtrlHandler GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetStartupInfoA GetFileType SetHandleCount GetConsoleMode GetConsoleCP GetModuleHandleA GetModuleFileNameA GetStdHandle ExitProcess FatalAppExitA IsValidCodePage GetOEMCP GetACP GetCurrentThread SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetCPInfo LCMapStringW LCMapStringA GetFileAttributesW GetSystemTimeAsFileTime GetStartupInfoW CreateThread ExitThread IsDebuggerPresent UnhandledExceptionFilter RtlUnwind VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapDestroy lstrlenA CreateFileW SetEvent GetLastError DeleteFileW CreateProcessW GetCommandLineW LocalFree GetNativeSystemInfo IsWow64Process lstrcmpiW LoadLibraryExW InitializeCriticalSection GetModuleFileNameW InterlockedDecrement InterlockedIncrement GetCurrentProcess GetLocaleInfoW RaiseException DeleteCriticalSection OpenProcess LoadLibraryW WaitForSingleObject CloseHandle FreeLibrary GetCurrentThreadId GetProcAddress FindResourceExW GetVersionExW MultiByteToWideChar lstrlenW GetModuleHandleW FindResourceW SizeofResource LoadResource LockResource CompareStringA CompareStringW SetEnvironmentVariableA FlushInstructionCache TerminateProcess GetStringTypeA

user32

TrackMouseEvent GetFocus PostMessageW PostQuitMessage SetCursor ScreenToClient GetCursorPos LoadCursorW UnregisterClassA DispatchMessageW EnumWindows GetWindowThreadProcessId UpdateLayeredWindow GetWindowDC GetWindowRect DrawTextW DestroyCursor TranslateAcceleratorW DefWindowProcW SetWindowPos MessageBeep LoadStringW SendMessageW IsWindow PtInRect PeekMessageW EnumChildWindows GetClassNameW GetWindowTextW CharNextW CreateWindowExW GetClassInfoExW LoadImageW RegisterClassExW LoadMenuW LoadAcceleratorsW DestroyWindow ShowWindow GetMessageW TranslateMessage SetTimer CallWindowProcW SetWindowLongW LoadStringA GetParent GetWindow MonitorFromWindow MonitorFromPoint GetMonitorInfoW SetFocus KillTimer GetMenuItemInfoW RemoveMenu GetMenuItemCount AppendMenuW TrackPopupMenuEx DestroyMenu ReleaseDC CreatePopupMenu MapWindowPoints GetClientRect SetWindowTextW GetWindowLongW InvalidateRect

gdi32

CreateDIBSection CreateCompatibleDC SelectObject SetTextColor SetBkMode CreateCompatibleBitmap SaveDC GetBitmapBits SetBitmapBits RestoreDC DeleteObject DeleteDC CreateFontW

advapi32

LookupPrivilegeValueW RegQueryValueExW AdjustTokenPrivileges RevertToSelf CreateProcessAsUserW DuplicateTokenEx SetTokenInformation AllocateAndInitializeSid GetNamedSecurityInfoW SetEntriesInAclW SetNamedSecurityInfoW FreeSid QueryServiceStatus DeleteService ControlService OpenServiceW StartServiceW OpenSCManagerW CreateServiceW CloseServiceHandle RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW OpenProcessToken RegEnumValueW

shell32

SHFileOperationW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoUninitialize CoTaskMemRealloc CoCreateGuid CoTaskMemAlloc CoCreateInstance CoSetProxyBlanket CoTaskMemFree CoInitialize

oleaut32

VariantChangeType GetErrorInfo SysAllocStringByteLen SysAllocString CreateErrorInfo SysStringLen SetErrorInfo VariantClear SysFreeString VariantInit VarUI4FromStr

shlwapi

SHDeleteKeyW PathFindFileNameW PathRemoveExtensionW PathAppendW StrStrIW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW PathFindExtensionW PathGetDriveNumberW PathStripPathW

comctl32

InitCommonControlsEx

msimg32

GradientFill AlphaBlend

iphlpapi

GetAdaptersAddresses GetIpForwardTable

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpSetOption WinHttpOpen WinHttpReadData

CrashReportConfig.ini

SHA256 56ed18a6fe272c7ca5766407eb2ced060e2ddba8b85b48aee845fa14e2a2460e
MD5 00e5db5e1775c5372af3d2eacd6cd205
SHA1 ef968f4238aae752f93ceb6e1a0ea61da546f540
SHA512 fd4173e035f38988d83a546a31085804195f72cf655a8d200c9570f8f52ab803f7cbb12fb73a0ea674ea3084a9f19a5d11524e2cc730f114b09f05027040a68a
TLSH
T178E0E242BFFA0446F2C2A084BDBA4475696B78752618E6AEC888058F4BBA66545037B3
MD5 SHA1 SHA512 TLSH

CrashUL.exe

IMPHASH 2bcad15580bacfaf8df8afc1d1acd471
SHA256 2ca4feb357ce3adc40c5f59ccf409fc46858d684d9ba392538abc5723ff24adf
MD5 c348e5616fcd69f8eb0fe871f5a6f9d1
SHA1 5c60d1b5b25074a01af590a1c8a818a15db9174c
SHA512 cef6a3a2f952b2c3b1070860fb4420dbf181c07b1e9c55cd8adad182076c8ab13f6b51b90511a3575423e5f4bf038cbd9b212f511d9e3cf2114c16aaf97702ca
SSDEEP 6144:Aq8Tmvq5zrZMpvbpExYy3LNENTXRjTXR/cZySphBj/:WTC+/ZM5b6Yy3elLcj/
TLSH
T1CA644A50BB518436E72707359866E3A9986E6D380B94A5CFF3647F3A6D302C3663720F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

39:fa:9a:13:c3:e8:74:ac:b1:3c:fb:bd:41:4a:db:58:9d:3e:75:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

137178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\workspace\CrashTool_workspace\bavOutput\Pdb\Release\CrashUL.pdb

winhttp

WinHttpOpen WinHttpSetOption WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest

kernel32

LockResource LoadResource FindResourceW FindResourceExW CreateDirectoryA FindFirstFileW FindNextFileW FindClose DeleteFileA InterlockedCompareExchange ExpandEnvironmentStringsA GetModuleFileNameA InterlockedExchange CopyFileW CreateFileA WriteFile SetFilePointer GetNativeSystemInfo IsWow64Process GetCurrentProcess GetVersionExW FileTimeToSystemTime GetFileInformationByHandle GetFileSize ReadFile GetLocalTime SystemTimeToFileTime GetTickCount WritePrivateProfileStringW GetPrivateProfileStringW InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetPrivateProfileSectionNamesW GetPrivateProfileSectionW CreateDirectoryW SizeofResource DeviceIoControl GetCurrentProcessId GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle LCMapStringA WideCharToMultiByte lstrlenW lstrlenA MultiByteToWideChar GetCommandLineW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSizeEx CreateFileW DeleteFileW CreateEventW GetLastError CreateMutexW CloseHandle GetModuleFileNameW Sleep WaitForSingleObject SetEvent GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo VirtualAlloc VirtualFree HeapCreate ExitProcess InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime RtlUnwind GetStartupInfoW CreateThread GetCurrentThreadId ExitThread GetFileAttributesW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InitializeCriticalSection RaiseException GetProcessHeap HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize

user32

RegisterClassExW CreateWindowExW LoadStringW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW LoadIconW PostMessageW DestroyWindow PostQuitMessage EndPaint BeginPaint DefWindowProcW LoadCursorW

advapi32

RegOpenKeyExW RegQueryValueExW RegEnumKeyExW RegCreateKeyExW RegEnumValueW RegQueryInfoKeyW RegOpenKeyExA RegSetValueExW RegCloseKey

shell32

SHFileOperationA SHGetFolderPathA SHGetSpecialFolderPathW SHFileOperationW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW PathIsDirectoryA PathAppendW PathFindFileNameW PathIsDirectoryW SHDeleteKeyW PathFileExistsW PathAppendA PathRemoveFileSpecA PathFileExistsA

iphlpapi

GetAdaptersAddresses

DataFileList.xml

SHA256 6768808100a37b51d71afed68096edab7c42359b48fe21358930070265bca1a0
MD5 95571006997e69de0da074dfb5f0decb
SHA1 b422683f5d8e70ee7ee54a0cfca61f69d5539a9c
SHA512 7ac2f18fc95afd42ced7cc3d1adac50c19df624d8462994c069cd639ddd4129b48aa0af005a18f9a240537120faf4647078bebb6260cf27a1d04e272a2f64b6d
SSDEEP 1536:PH0OCCA487Y6xb4TsPphWkC9wmYnJ3KhGzYsAuE:PH0TX4wIsPHWkCWn0UE
TLSH
T1AFF3BB5213A6EC7502B5D0EAEDBD3CE47EC94AF5299AD420E53EB1DB6E01D61C27F002
MD5 SHA1 SHA512 SSDEEP TLSH

DataFileVer.xml

SHA256 ca0f124a087880d8ac48772d4af0e0634cb873957dcaf89401c52bf66b2a6701
MD5 b4526cc3f9b72aed942c98beaf71422f
SHA1 090f1382faad8104c789976e598b580e97af1784
SHA512 edd42daef8e4e61cbd80fda995505b7b85f78ee1942378a4ccb9448e36a75b2069810e2abc202e67ccff5558cdff4c04fd8666312f9376d36a1ef78aa6c7c8b5
TLSH
T19DE0720E128908B8E6530B082B2AB808F3FCE30A20CD402C6AC2848763855BC02CB734
MD5 SHA1 SHA512 TLSH

DataReport.dll

IMPHASH 5de1f52184fd63af9a883aeced58adad
SHA256 896fb200f29f2df7f4bc389a1e5a30ba92b13dbd9684b32649d4d91d7d16ad0d
MD5 a58238b0590f7b9bec405e90d334ba33
SHA1 cc5683167a0832e38de30f105d0d14bc5dc1ed05
SHA512 1eab12bb545053d9521feaa94815aa1528bd98b3e563b7b4658896947416384cf651c748361a8bc3a1509077d1717ecd878b88958e237dc5b6480314a9457386
SSDEEP 6144:7ezY27HmD7kwVIywl66zA031WFhEiGeWH/WZGkgiKqaGszLhz2ed:7MY2TmnB8CtGvH/WZrgz+idz
TLSH
T1A2A45C01B7E1C035E9BB1BF19E7D95AD8539BD600B6080CB93C81D7E5E71AD1AA31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:ca:3b:16:40:2b:98:2f:3f:d1:4f:7e:18:91:d4:21:92:73:10:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

249904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DataReport.pdb

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

GetCurrentProcess HeapFree GetProcessHeap OpenProcess GetVersionExW VerifyVersionInfoW GetLastError MoveFileW GetLocalTime Process32FirstW ProcessIdToSessionId Process32NextW CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId CreateMutexW CreateFileA GlobalAlloc WideCharToMultiByte GlobalFree DeviceIoControl CreateProcessW InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection OpenMutexW EnterCriticalSection DeleteCriticalSection WriteFile WaitForSingleObject SetEvent GetModuleHandleW ResetEvent CreateEventW VirtualFree VirtualAlloc SetFilePointer FlushFileBuffers GetConsoleCP VerSetConditionMask CreateDirectoryW HeapAlloc GetPrivateProfileSectionW DeleteFileW CloseHandle LockResource GetPrivateProfileIntW GetTempPathW MultiByteToWideChar CreateFileW GetTimeZoneInformation GetModuleFileNameW ReadFile SizeofResource CopyFileW GetPrivateProfileStringW LoadResource FindResourceW FindResourceExW GetFileSize GetTempFileNameW GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WritePrivateProfileStringW GetPrivateProfileSectionNamesW InitializeCriticalSection GetEnvironmentStrings GetConsoleMode FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapSize ExitProcess HeapReAlloc HeapDestroy HeapCreate LCMapStringW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedExchange LCMapStringA RaiseException GetModuleFileNameA GetStdHandle SetLastError TlsFree TlsSetValue LoadLibraryA RtlUnwind GetLocaleInfoA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc

user32

CallWindowProcW GetMessageW SetTimer KillTimer GetWindowLongW SetWindowLongW SendMessageTimeoutW IsWindow CreateWindowExW PostMessageW DispatchMessageW

advapi32

AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegQueryValueExA RegCloseKey RevertToSelf RegEnumValueW RegOpenCurrentUser ImpersonateLoggedOnUser LookupPrivilegeValueW RegQueryInfoKeyW RegSetValueExW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyExW GetUserNameW OpenProcessToken RegEnumKeyExW

shell32

SHGetFolderPathW ord165 SHGetSpecialFolderPathW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateGuid

shlwapi

PathRenameExtensionW PathFindExtensionW SHDeleteValueW PathRemoveExtensionW PathAppendW PathFileExistsW PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW SHSetValueW SHGetValueW PathFindFileNameW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

psapi

GetModuleBaseNameW

winhttp

WinHttpConnect WinHttpWriteData WinHttpSendRequest WinHttpSetOption WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpOpenRequest WinHttpSetCredentials WinHttpAddRequestHeaders WinHttpReceiveResponse

DeepClean.exe

IMPHASH e198149d26187c5bf0ba6736ef5a92ed
SHA256 197e6d7f17490beaeea5c3f5b4cceda1d55a94d7a0da4bf507d37f016fd30045
MD5 776179e93346d1f338cc92717aa324f0
SHA1 2bedf9b90b8c12649af690f33b339592b6d69f2d
SHA512 c4b586106d9d75eaedad3e5b5bf464b36890f38a34d37ef14b6e9738043da23b1f90ee63dcbf7d70ef4d7d345e46dbb2ab2a13343319291b677784c802784634
SSDEEP 49152:m5mXOF/l3TRd1rmf7vz7Zfnn0BddjX5gE7phLHjxEkXOSrj4bYbmnGKPB2PNPb0w:mUATRd1Qjn
TLSH
T1D1756D00B782C23FF6B700B689BE565D562DBA21170461C3E2C85D5F49B66E3BE3235B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d4:94:de:0f:d6:ba:f7:72:5b:5a:cf:ea:51:b8:1a:ba:ae:a8:eb:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

842964

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DeepClean.pdb

directui

DirectUI_TreeEx_SetControlText DirectUI_TreeEx_SetStaticLogo DirectUI_GetControlRect DirectUI_Static_SetLogoIcon DirectUI_Button_GetCheck DirectUI_Button_SetUnknown DirectUI_TreeEx_EnableAnimate DirectUI_TreeEx_SetControlTextEx DirectUI_TreeEx_SetTooltipString DirectUI_TreeEx_GetButtonCheck DirectUI_TreeEx_SetButtonCheck DirectUI_TreeEx_SetButtonUnknown DirectUI_TreeEx_Select DirectUI_TreeEx_InsertItem DirectUI_TreeEx_SetFirstVisible uiUpdateWindow DirectUI_SubclassLayeredWindow DirectUI_TreeEx_ChangeStyle DirectUI_TreeEx_Expand DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_EnableChildControl DirectUI_EnableAnimate DirectUI_TreeEx_SetProgressPos DirectUI_TreeEx_CreateControl DirectUI_ListCtrl_SetStaticLogo DirectUI_ListCtrl_ChangeStyle DirectUI_TreeEx_DeleteItem DirectUI_ListCtrl_GetItemCount DirectUI_ListCtrl_DeleteItem DirectUI_ListCtrl_SetItemSrcData DirectUI_ListCtrl_DeleteAllItems DirectUI_ListCtrl_GetItemSrcData DirectUI_ListCtrl_GetButtonCheck DirectUI_ListCtrl_SetButtonCheck DirectUI_ListCtrl_EnableControl DirectUI_Progress_EnableMoving DirectUI_SetControlFocus DirectUI_GetLanguageStyle DirectUI_IsControlVisible DirectUI_Progress_SetPos DirectUI_AutoText_SetControlText DirectUI_TreeEx_SetAutoTextItemTextEx DirectUI_TreeEx_ShowControl DirectUI_TreeEx_IsExpand DirectUI_TreeEx_SetAutoTextItemText DirectUI_EnableControl DirectUI_SetControlText DirectUI_SetControlPos DirectUI_SetControlTextEx DirectUI_CreateControl DirectUI_DestroyControl DirectUI_GetStringItem DirectUI_ListCtrl_GetHeadCtrlId DirectUI_ListCtrl_InsertColumn DirectUI_ListCtrl_SetDrawItem DirectUI_ListCtrl_SetTooltipString DirectUI_ListCtrl_SetControlText DirectUI_ListCtrl_ShowControl DirectUI_HeaderCtrl_SetControlTextEx DirectUI_GetSafeHwnd DirectUI_SetLanguageStyle DirectUI_SubclassWindow DirectUI_UpdateSkin DirectUI_LoadSkinResourceFromZIP DirectUI_I18N_AddLanguageStyle DirectUI_Button_SetCheck DirectUI_GetVersion DirectUI_ChangeStyle DirectUI_TreeEx_DeleteAllItems DirectUI_ShowControl

datareport

RD_W Stop Start RD_WS

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?DelInstance@CAPCDispatcher@@SAXXZ ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

baidustore

?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z ?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ??1Baidu_ListenData@@UAE@XZ ??0Baidu_ListenData@@QAE@PB_W@Z ?ReportState@CBaiduStoreMgr@@QAEHKK@Z ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z

kernel32

LoadLibraryExW FlushInstructionCache LoadLibraryW GetPrivateProfileIntW OpenFileMappingW GetTickCount ExpandEnvironmentStringsW GetVersionExW GetProcessHeap HeapFree MulDiv HeapAlloc IsBadReadPtr WideCharToMultiByte WaitForSingleObject Process32NextW Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW VerSetConditionMask WinExec CreateProcessW WaitForSingleObjectEx WritePrivateProfileStringW QueueUserAPC DeviceIoControl OpenEventW SetEvent FindFirstFileW FindNextFileW FindClose RaiseException CreateEventW ResetEvent TerminateThread OpenJobObjectW QueryInformationJobObject GetLongPathNameW GetSystemDirectoryW Sleep ReleaseMutex CreateMutexW lstrlenA CreateDirectoryW OpenProcess QueueUserWorkItem GetFileAttributesExW GetVolumeInformationW InitializeCriticalSectionAndSpinCount GetDiskFreeSpaceExW GetDriveTypeW SystemTimeToFileTime GetLogicalDriveStringsW GetFileAttributesW GetEnvironmentVariableW GetSystemWindowsDirectoryW WTSGetActiveConsoleSessionId LocalFree ProcessIdToSessionId DebugBreak VirtualProtect GetVersion IsBadCodePtr GetModuleHandleExW ExitThread GetCommandLineW GetModuleHandleA VirtualFree CreateFileMappingA GetLocalTime GetWindowsDirectoryW LocalAlloc InterlockedExchange InterlockedCompareExchange WriteFile GetFileSizeEx ReadProcessMemory VirtualQueryEx HeapCreate AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler TerminateProcess VirtualQuery GetModuleFileNameA lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer UnhandledExceptionFilter IsDebuggerPresent CreateThread GetStartupInfoW HeapReAlloc RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree HeapDestroy ExitProcess GetStdHandle HeapSize LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryA lstrcmpiW InitializeCriticalSection GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentThreadId UnmapViewOfFile MapViewOfFile CreateFileMappingW SetLastError FreeLibrary GetTimeZoneInformation GetPrivateProfileSectionW lstrlenW GetModuleHandleW GetProcAddress GetPrivateProfileStringW GetCurrentProcess GetCurrentProcessId GetLastError DeleteFileW CopyFileW GetTempFileNameW GetTempPathW GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar ReadFile GetFileSize CloseHandle CreateFileW IsProcessorFeaturePresent GetProcessTimes RemoveDirectoryW

user32

MonitorFromPoint GetMenuItemInfoW RemoveMenu GetMenuItemCount AppendMenuW TrackPopupMenuEx CreatePopupMenu InvalidateRect MessageBeep CallWindowProcW GetPropW SetPropW GetSystemMenu EnableMenuItem DeleteMenu GetMenuState DrawTextW GetSystemMetrics SetRect GetDialogBaseUnits DialogBoxIndirectParamW GetDlgItem DestroyMenu PostQuitMessage LoadStringA TranslateAcceleratorW SetWindowPlacement GetWindowPlacement RedrawWindow GetCursor GetAsyncKeyState GetCursorPos ClientToScreen IsIconic SystemParametersInfoW GetActiveWindow DialogBoxParamW PrivateExtractIconsW EnableWindow CreateIconFromResource CopyIcon TrackPopupMenu EnumWindows DestroyIcon EndDialog PostMessageW UpdateWindow GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowTextW KillTimer SetTimer UpdateLayeredWindow GetWindowLongW GetWindowRect IsWindow OffsetRect PtInRect SetFocus LoadImageW LoadAcceleratorsW LoadMenuW LoadStringW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PeekMessageW TranslateMessage DispatchMessageW CharNextW DefWindowProcW DestroyWindow GetMessageW GetForegroundWindow SetWindowPos AttachThreadInput SetForegroundWindow ShowWindow IsWindowVisible SendMessageW SetWindowLongW GetWindowThreadProcessId FindWindowW OpenInputDesktop GetUserObjectInformationA CloseDesktop GetThreadDesktop UnregisterClassA

gdi32

BitBlt CreateFontW CreateICW DeleteObject DeleteDC SelectObject CreateCompatibleBitmap CreateCompatibleDC

advapi32

SetTokenInformation AdjustTokenPrivileges RevertToSelf LookupPrivilegeValueW GetUserNameW CheckTokenMembership FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegOpenKeyW RegQueryValueW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW DuplicateTokenEx CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetLengthSid GetKernelObjectSecurity

shell32

ord165 CommandLineToArgvW SHGetDesktopFolder SHOpenFolderAndSelectItems ShellExecuteW ExtractIconExW ShellExecuteExW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderPathW SHGetFolderPathW

ole32

CoInitialize CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW PathIsRelativeW SHGetValueW SHSetValueW StrCmpW StrCmpIW StrCpyNW PathFindExtensionW PathAddBackslashW PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

winhttp

WinHttpCreateUrl

gdiplus

GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipLoadImageFromFile GdipCloneImage GdipDeleteGraphics GdipGetImageHeight GdipCreatePen1 GdipDeletePen GdipGetImageGraphicsContext GdipGetDC GdipReleaseDC GdipSetSmoothingMode GdipDrawArcI GdipGraphicsClear GdipDrawImageRectRectI GdipGetImageWidth GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipGetImageEncoders

psapi

GetModuleInformation GetModuleFileNameExW

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

DeepOptimization.exe

IMPHASH 4cf014951d4c1bca1880698e04132357
SHA256 42fea9c9d4e216686422d94e96938de3ec09faac40bf8e218b127af99e1d7807
MD5 2e92989a3ee6be581fcc211bb46fd38b
SHA1 61ada07567d1f1c22e6a5ea4b0fd3110c0b9898c
SHA512 cfd1c141e865a226cbdd189cea76df3b6ed440b2ceac3e6c8bc78fcf1b4efe761acd889d2307adc38c6f2b2048666d582b62f2645bb6d56f11a95c189dd9c7c0
SSDEEP 49152:WFUVrenwymoESy8rpAqVvz7Zfnn0BddVXsZXOviM:NVrenVESy4T
TLSH
T121952900A742D13AF9F704B7CEFE556D922CBA61070960D7A3C85C9E9B669F27E31207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

96:a9:13:ef:c6:85:e8:fe:b9:23:ae:76:32:b6:63:98:61:88:14:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 11, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1002255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\DeepOptimization.pdb

directui

DirectUI_CreateControl DirectUI_EnableAnimate DirectUI_GetStringLength DirectUI_TreeCtrl_ChangeStyle DirectUI_TreeCtrl_SetControlPos DirectUI_TreeCtrl_GetControlRect DirectUI_TreeCtrl_SetControlText DirectUI_TreeCtrl_SetStaticLogo DirectUI_ListCtrl_GetItemSrcDataEx DirectUI_SetControlTextEx DirectUI_TrackPopupMenu DirectUI_ListCtrl_DeleteItem DirectUI_ListCtrl_GetItemCount DirectUI_GetControlRect DirectUI_GetLanguageStyle DirectUI_GetControlPos DirectUI_HeaderCtrl_SetControlTextEx DirectUI_ListCtrl_InsertColumn DirectUI_SubclassLayeredWindow DirectUI_SetControlPos DirectUI_AutoText_SetControlTextEx DirectUI_DestroyControl DirectUI_TreeCtrl_IsExpand DirectUI_TreeCtrl_ShowControl DirectUI_TreeCtrl_DeleteItem DirectUI_Progress_EnableMoving DirectUI_TreeCtrl_DeleteAllItems DirectUI_TreeCtrl_Expand DirectUI_TreeCtrl_SetAutoTextItemTextEx DirectUI_TreeCtrl_SetAutoTextItemText DirectUI_TreeEx_SetItemHeight DirectUI_TreeCtrl_InsertItem DirectUI_ListCtrl_GetHeadCtrlId DirectUI_ListCtrl_DeleteAllItems DirectUI_ListCtrl_SetItemSrcData DirectUI_ListCtrl_SetDrawItem DirectUI_ListCtrl_SetStaticLogo DirectUI_ListCtrl_SetButtonCheck DirectUI_ListCtrl_ChangeStyle DirectUI_ListCtrl_SetTooltipString DirectUI_ListCtrl_SetControlTextEx DirectUI_ListCtrl_SetControlText DirectUI_ListCtrl_ShowControl DirectUI_HeaderCtrl_SetItemWidth DirectUI_HeaderCtrl_ShowControl DirectUI_ListCtrl_GetItemSrcData DirectUI_ListCtrl_GetButtonCheck DirectUI_TreeCtrl_SetButtonCheck DirectUI_TreeCtrl_GetButtonCheck DirectUI_SetControlFocus DirectUI_GetSafeHwnd DirectUI_SetLanguageStyle DirectUI_UpdateSkin DirectUI_LoadSkinResourceFromZIP DirectUI_GetVersion DirectUI_I18N_AddLanguageStyle DirectUI_Button_SetCheck DirectUI_Static_SetLogoIcon DirectUI_ShowControl DirectUI_AutoText_SetControlText DirectUI_SetControlText DirectUI_GetStringItem DirectUI_ListCtrl_SortItems DirectUI_SubclassWindow

datareport

Start Stop

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?DelInstance@CAPCDispatcher@@SAXXZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

baidustore

??0Baidu_ListenData@@QAE@PB_W@Z ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z ?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z ?SaveConfig@BdConfig@@QAEXXZ ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ??1Baidu_ListenData@@UAE@XZ

kernel32

InterlockedIncrement InterlockedDecrement lstrlenW InitializeCriticalSection FreeLibrary LoadLibraryExW lstrcmpiW GetPrivateProfileIntW ExpandEnvironmentStringsW LoadLibraryW MulDiv Sleep GetSystemDirectoryW GetVersionExW HeapFree GetProcessHeap IsBadReadPtr HeapAlloc GetSystemWindowsDirectoryW GetEnvironmentVariableW GetLongPathNameW ProcessIdToSessionId DebugBreak VirtualProtect IsWow64Process GetVersion IsBadCodePtr GetModuleHandleExW ExitThread GetCurrentProcess GetCommandLineW GetModuleHandleA VirtualFree CreateFileMappingA lstrcmpiA WideCharToMultiByte GetLocalTime GetWindowsDirectoryW GetDateFormatW GetTimeFormatW FormatMessageW LocalFree LocalAlloc InterlockedExchange InterlockedCompareExchange WritePrivateProfileStringW SystemTimeToFileTime WriteFile GetFileSizeEx CreateProcessW WTSGetActiveConsoleSessionId OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot WaitForSingleObject ReadProcessMemory VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA Module32NextW Module32FirstW HeapCreate CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler TerminateProcess VirtualQuery GetModuleFileNameA ReleaseMutex CreateMutexW lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenFileMappingW OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent LoadLibraryA IsDebuggerPresent RtlUnwind GetStartupInfoW GetFileAttributesW FatalAppExitA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale FlushInstructionCache SetLastError SetConsoleCtrlHandler GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetPrivateProfileStringW GetTimeZoneInformation GetPrivateProfileSectionW CreateFileW GetFileSize ReadFile GetModuleFileNameW GetTempPathW GetTempFileNameW CopyFileW DeleteFileW DeleteCriticalSection GetModuleHandleW GetProcAddress GetCurrentProcessId CreateFileMappingW GetLastError MapViewOfFile UnmapViewOfFile CloseHandle LeaveCriticalSection EnterCriticalSection GetCurrentThreadId RaiseException CompareStringA CompareStringW SetEnvironmentVariableA GetProcessTimes CreateDirectoryW UnhandledExceptionFilter

user32

CreatePopupMenu TranslateAcceleratorW SystemParametersInfoW GetActiveWindow ClientToScreen PrivateExtractIconsW DestroyIcon MoveWindow GetCursorPos GetSystemMenu EnableMenuItem DeleteMenu GetMenuState SetPropW GetPropW DrawTextW GetSystemMetrics AppendMenuW CreateDialogParamW PostQuitMessage LoadStringA DialogBoxParamW DestroyMenu MessageBeep PtInRect SetRect InvalidateRect DialogBoxIndirectParamW SetFocus SetWindowPlacement GetWindowPlacement RedrawWindow GetThreadDesktop CharLowerBuffW CharUpperBuffW CloseDesktop TrackPopupMenuEx GetMenuItemCount RemoveMenu GetMenuItemInfoW MonitorFromPoint CharNextA CharPrevA CharUpperBuffA CharLowerBuffA UpdateLayeredWindow GetParent GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints KillTimer SetTimer OffsetRect CallWindowProcW GetWindowLongW EndDialog GetWindowRect CharNextW CreateWindowExW GetClassInfoExW LoadCursorW LoadImageW RegisterClassExW LoadStringW LoadMenuW LoadAcceleratorsW DestroyWindow DefWindowProcW OpenInputDesktop GetUserObjectInformationA GetDialogBaseUnits GetForegroundWindow GetWindowThreadProcessId AttachThreadInput SetWindowPos IsWindowVisible SetForegroundWindow PeekMessageW GetMessageW TranslateMessage DispatchMessageW FindWindowW PostMessageW SetWindowLongW GetDlgItem SendMessageW IsWindow ShowWindow SetWindowTextW CharPrevW UnregisterClassA

gdi32

CreateICW CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteDC CreateFontW DeleteObject

advapi32

FreeSid RevertToSelf CreateProcessAsUserW DuplicateTokenEx SetTokenInformation OpenProcessToken GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueW GetUserNameW RegOpenKeyW RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid GetKernelObjectSecurity

shell32

ord165 ExtractIconExW SHGetFileInfoW SHOpenFolderAndSelectItems SHGetDesktopFolder SHGetSpecialFolderPathW SHGetFolderPathW

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoInitialize CoCreateInstance

oleaut32

VarUI4FromStr SysFreeString

shlwapi

PathFileExistsW PathAddBackslashW PathFindFileNameW PathAppendW PathIsDirectoryW PathIsRelativeW StrStrIW SHGetValueW SHDeleteKeyW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipDisposeImage GdipFree GdipLoadImageFromFileICM GdipLoadImageFromFile GdipAlloc GdipDrawImageRectRectI GdipGraphicsClear GdipDeleteGraphics GdipCreateFromHDC GdiplusShutdown GdiplusStartup GdipCloneImage

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

psapi

GetModuleFileNameExW GetModuleInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winhttp

WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpSetOption WinHttpOpen WinHttpCloseHandle

DirectUI.dll

IMPHASH 3f49a59faf0407786a1064e7fbd81a19
SHA256 8223b5ebf8e4c84dd9ad70dc363ed070de1ea103967bc9c5a44f7dbde48e789e
MD5 604f747bd63421bded37933773968490
SHA1 1c0f15145c2a8547042ccd6932f34bae7f15367c
SHA512 0604cb1fdf353301fb580fc859089dc3c4415b12cde49f32932536a8f2e61795c76761fb3c075a247f817331970ff6db398434dd714b5f310f06e30959bb8575
SSDEEP 24576:s60+HVYLJwONYux5i/nBUPGcD1NTS5pzm/otTfShFsSYWFoLRfW2Re0U+N6uIcsq:7JijvSIMReQOrCrnAVrpTK0Vs
TLSH
T1CAB58D41B7E691B2D78F0279107A732F5636538907358AE3F5A42F1B5E30AE17C392CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

91:81:3c:3d:59:1e:5a:15:d9:a4:ea:ac:65:e0:b4:f5:8d:f9:5b:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1693408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\app\gensoft\security-client\bdui\DirectUI_skia\bin\skia_unicode_release\DirectUI.pdb

comctl32

ImageList_Create ImageList_Destroy ord17

riched20

ord4

kernel32

GlobalMemoryStatusEx GetSystemInfo VirtualProtect LoadLibraryA VirtualQuery GetModuleHandleA OutputDebugStringA GetFileInformationByHandle UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSizeEx TlsGetValue TlsAlloc TlsSetValue GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetCurrentDirectoryA GetFullPathNameA InitializeCriticalSectionAndSpinCount InterlockedExchange QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers GetConsoleMode GetConsoleCP GetTimeZoneInformation GetLocalTime SetHandleCount GetPriorityClass HeapDestroy HeapCreate IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize TlsFree GetFileType SetStdHandle CreateDirectoryA GetFileAttributesA FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime ExitProcess RtlUnwind GetCommandLineA HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange WriteConsoleA GetConsoleOutputCP GetStartupInfoA OpenProcess WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile OpenFileMappingW GetProcessTimes GetSystemTimeAsFileTime GetTickCount DeleteCriticalSection InitializeCriticalSection CreateFileA LocalFileTimeToFileTime GetCurrentDirectoryW ReadFile GetFileAttributesW CreateDirectoryW SystemTimeToFileTime SetFilePointer GetVersion CloseHandle GetStdHandle CreateFileW Sleep WriteFile GetModuleHandleW IsBadCodePtr LocalFree LocalAlloc LockResource GetLongPathNameW GetModuleFileNameW SizeofResource LoadResource FindResourceW FreeResource GetVersionExW EnterCriticalSection SetLastError RaiseException FlushInstructionCache LeaveCriticalSection GetCurrentProcess GlobalReAlloc GlobalFree GlobalUnlock GlobalAlloc GlobalLock GetModuleFileNameA MulDiv WideCharToMultiByte GetCurrentThreadId GetLastError MultiByteToWideChar DebugBreak GetCurrentProcessId FindNextFileW FindClose OutputDebugStringW lstrlenA FindFirstFileW GetProcAddress lstrlenW InterlockedDecrement InterlockedIncrement GetLocaleInfoA

user32

DrawIcon GetClassLongW GetMenu GetMenuState GetDlgItem SetMenu BeginDeferWindowPos EndDeferWindowPos GetWindow GetMessageW IsWindowEnabled DispatchMessageW GetMessagePos GetKeyState CreateCaret SetCaretPos CharUpperW SetWindowRgn IsMenu MenuItemFromPoint GetMenuItemRect SystemParametersInfoW GetMenuItemCount UpdateWindow UpdateLayeredWindow IsIconic IsZoomed MonitorFromWindow GetMonitorInfoW LoadCursorFromFileW DestroyCursor GetWindowTextLengthW GetFocus TrackMouseEvent FrameRect EnableWindow GetWindowDC GetUpdateRect SetScrollRange GetScrollRange GetScrollInfo SetScrollPos EnableScrollBar ShowScrollBar SetScrollInfo GetScrollPos GetMenuItemInfoW GetSystemMetrics GetClassInfoExW RegisterClassExW GetWindowTextW InvalidateRgn GetSystemMenu UnhookWindowsHookEx SetWindowsHookExW RedrawWindow CallNextHookEx SetWindowTextW EndPaint BeginPaint GetClassNameW RegisterWindowMessageW DeferWindowPos DrawIconEx GetIconInfo CallWindowProcW RegisterClassW ClientToScreen HideCaret ShowCaret GetDesktopWindow GetSysColor EqualRect GetWindowRect GetParent DefWindowProcW MoveWindow SetWindowLongW SetWindowPos LoadCursorW GetCursorPos ScreenToClient WindowFromPoint InflateRect SetRect GetWindowLongW MessageBeep SetTimer RemovePropW KillTimer SetPropW ShowWindow DestroyIcon DestroyWindow SetCursor SetCapture GetClientRect SetFocus SetRectEmpty GetCapture UnionRect InvalidateRect IsWindow CreateWindowExW ReleaseCapture SendMessageW CopyRect IsRectEmpty PtInRect IsWindowVisible CharNextW TrackPopupMenu PostMessageW IsDialogMessageA IsDialogMessageW GetPropW DrawTextW GetDC OffsetRect IntersectRect ReleaseDC LoadStringW SystemParametersInfoA GetWindowInfo SetMenuItemInfoW UnregisterClassA

gdi32

SetTextColor GetTextMetricsW GetTextExtentPoint32W GetObjectW AddFontResourceExW GetDeviceCaps RestoreDC SaveDC CreateFontIndirectW ExtCreateRegion CombineRgn CreateCompatibleDC CreateDIBSection DeleteDC SetDIBitsToDevice BitBlt GetTextExtentPointW CreateSolidBrush CreatePen CreateRectRgn SetStretchBltMode Rectangle CreateCompatibleBitmap StretchBlt CreateRectRgnIndirect CreateFontW ExcludeClipRect GetStockObject ExtTextOutW SetBkColor OffsetRgn GetGlyphOutlineW GetFontData GetTextMetricsA GetOutlineTextMetricsA CreateFontIndirectA RemoveFontMemResourceEx GetGlyphIndicesW GetGlyphOutlineA GdiFlush SetWorldTransform SetTextAlign SetGraphicsMode GetTextExtentPointI GetTextFaceA GetFontUnicodeRanges EnumFontFamiliesExA AddFontMemResourceEx GetCharABCWidthsA SelectClipRgn SelectObject DeleteObject SetBkMode

advapi32

RegQueryValueExA RegOpenKeyExW RegCloseKey

ole32

CoCreateGuid

oleaut32

SysStringLen

shlwapi

PathFileExistsW PathAppendW

imm32

ImmReleaseContext

psapi

GetProcessMemoryInfo

usp10

ScriptItemize ScriptShape ScriptFreeCache

??0?$UIGuard@VUILock@@@@QAE@ABV0@@Z ??0?$UIGuard@VUILock@@@@QAE@ABVUILock@@@Z ??1?$UIGuard@VUILock@@@@UAE@XZ ??_7?$UIGuard@VUILock@@@@6B@ ?Release@?$UIGuard@VUILock@@@@QBEXXZ DirectUI_AddFontsResource DirectUI_AddImageItem DirectUI_AutoText_GetControlText DirectUI_AutoText_SetControlText DirectUI_AutoText_SetControlTextEx DirectUI_Button_GetCheck DirectUI_Button_SetCheck DirectUI_Button_SetUnknown DirectUI_ChangeStyle DirectUI_ComboBox_AddString DirectUI_ComboBox_GetCurSel DirectUI_ComboBox_GetItemText DirectUI_ComboBox_ResetContent DirectUI_ComboBox_SetCurSel DirectUI_ComboBox_SetStaticLogo DirectUI_CreateControl DirectUI_DeleteImageItem DirectUI_DestroyControl DirectUI_Edit_GetSrcText DirectUI_Edit_SetMarkText DirectUI_Edit_SetMarkTextColor DirectUI_Edit_SetSrcText DirectUI_Edit_SetSrcTextColor DirectUI_EnableAero DirectUI_EnableAnimate DirectUI_EnableControl DirectUI_GetControlPos DirectUI_GetControlRect DirectUI_GetControlStyle DirectUI_GetControlText DirectUI_GetItemImage DirectUI_GetItemText DirectUI_GetLanguageStyle DirectUI_GetLastErrorCode DirectUI_GetSafeHwnd DirectUI_GetStringItem DirectUI_GetStringLength DirectUI_GetStringRect DirectUI_GetVersion DirectUI_HeaderCtrl_InsertItem DirectUI_HeaderCtrl_SetControlText DirectUI_HeaderCtrl_SetControlTextEx DirectUI_HeaderCtrl_SetItemWidth DirectUI_HeaderCtrl_ShowControl DirectUI_I18N_AddLanguageStyle DirectUI_I18N_FindCloseResItem DirectUI_I18N_FindFirstResItem DirectUI_I18N_FindNextResItem DirectUI_I18N_SetCurrentI18NResItem DirectUI_I18N_SetResConfig DirectUI_Invalidate DirectUI_IsControlEnabled DirectUI_IsControlVisible DirectUI_Layout_AnimateShow DirectUI_ListCtrl_ChangeStyle DirectUI_ListCtrl_DeleteAllItems DirectUI_ListCtrl_DeleteItem DirectUI_ListCtrl_EnableAnimate DirectUI_ListCtrl_EnableControl DirectUI_ListCtrl_EnsureVisible DirectUI_ListCtrl_GetButtonCheck DirectUI_ListCtrl_GetButtonUnknown DirectUI_ListCtrl_GetControlRect DirectUI_ListCtrl_GetHeadCtrlHwnd DirectUI_ListCtrl_GetHeadCtrlId DirectUI_ListCtrl_GetItemCount DirectUI_ListCtrl_GetItemSrcData DirectUI_ListCtrl_GetItemSrcDataEx DirectUI_ListCtrl_GetItemStyle DirectUI_ListCtrl_InsertColumn DirectUI_ListCtrl_InsertDrawItem DirectUI_ListCtrl_SetAutoTextItemText DirectUI_ListCtrl_SetAutoTextItemTextEx DirectUI_ListCtrl_SetButtonCheck DirectUI_ListCtrl_SetButtonLogo DirectUI_ListCtrl_SetButtonLogoImage DirectUI_ListCtrl_SetButtonLogoImageBuffer DirectUI_ListCtrl_SetButtonUnknown DirectUI_ListCtrl_SetControlText DirectUI_ListCtrl_SetControlTextEx DirectUI_ListCtrl_SetDrawItem DirectUI_ListCtrl_SetItemCount DirectUI_ListCtrl_SetItemSrcData DirectUI_ListCtrl_SetStaticLogo DirectUI_ListCtrl_SetStaticLogoImage DirectUI_ListCtrl_SetStaticLogoImageBuffer DirectUI_ListCtrl_SetTooltipString DirectUI_ListCtrl_SetTooltipStringEx DirectUI_ListCtrl_ShowControl DirectUI_ListCtrl_SortItems DirectUI_LoadBackupXml DirectUI_LoadSkinResourceFromFolder DirectUI_LoadSkinResourceFromRes DirectUI_LoadSkinResourceFromZIP DirectUI_LoadSkinResourceFromZipEx DirectUI_MoveEx DirectUI_Progress_EnableMoving DirectUI_Progress_GetPos DirectUI_Progress_SetPos DirectUI_Progress_SetRange DirectUI_RichEdit_Clear DirectUI_RichEdit_InsertText DirectUI_RichEdit_SetLayeredWindow DirectUI_RichEdit_SetReadOnly DirectUI_ScrollBar_GetPageSize DirectUI_ScrollBar_GetPos DirectUI_ScrollBar_GetRange DirectUI_ScrollBar_SetPageSize DirectUI_ScrollBar_SetPos DirectUI_ScrollBar_SetRange DirectUI_SetAeroAttribute DirectUI_SetAnimateCurFrameIndex DirectUI_SetClipRgn DirectUI_SetControlAlpha DirectUI_SetControlFocus DirectUI_SetControlPos DirectUI_SetControlText DirectUI_SetControlTextEx DirectUI_SetErrorCallbackFunction DirectUI_SetLanguageStyle DirectUI_SetLayeredWindowAlpha DirectUI_SetMenuItemLogo DirectUI_SetScrollBarSkin DirectUI_SetTooltipString DirectUI_SetTooltipStringEx DirectUI_SetWindowTitleHeight DirectUI_ShowControl DirectUI_Slider_GetPage DirectUI_Slider_GetPos DirectUI_Slider_GetSize DirectUI_Slider_SetPage DirectUI_Slider_SetPos DirectUI_Slider_SetRange DirectUI_Slider_SetSize DirectUI_SrcollText_EnableScroll DirectUI_Static_SetLogoIcon DirectUI_Static_SetLogoImage DirectUI_Static_SetLogoImageBuffer DirectUI_Static_SetLogoImageId DirectUI_SubclassLayeredWindow DirectUI_SubclassWindow DirectUI_TrackPopupMenu DirectUI_TreeCtrl_ChangeStyle DirectUI_TreeCtrl_DeleteAllItems DirectUI_TreeCtrl_DeleteItem DirectUI_TreeCtrl_EnableAnimate DirectUI_TreeCtrl_EnableChildControl DirectUI_TreeCtrl_EnableControl DirectUI_TreeCtrl_Expand DirectUI_TreeCtrl_GetAutoTextItemText DirectUI_TreeCtrl_GetButtonCheck DirectUI_TreeCtrl_GetButtonUnknown DirectUI_TreeCtrl_GetControlRect DirectUI_TreeCtrl_GetControlText DirectUI_TreeCtrl_GetItemStyle DirectUI_TreeCtrl_GetProgressPos DirectUI_TreeCtrl_InsertItem DirectUI_TreeCtrl_IsExpand DirectUI_TreeCtrl_Select DirectUI_TreeCtrl_SetAutoTextItemText DirectUI_TreeCtrl_SetAutoTextItemTextEx DirectUI_TreeCtrl_SetButtonCheck DirectUI_TreeCtrl_SetButtonUnknown DirectUI_TreeCtrl_SetControlPos DirectUI_TreeCtrl_SetControlText DirectUI_TreeCtrl_SetControlTextEx DirectUI_TreeCtrl_SetItemState DirectUI_TreeCtrl_SetProgressPos DirectUI_TreeCtrl_SetStaticLogo DirectUI_TreeCtrl_SetTooltipString DirectUI_TreeCtrl_ShowControl DirectUI_TreeEx_ChangeStyle DirectUI_TreeEx_CreateControl DirectUI_TreeEx_DeleteAllItems DirectUI_TreeEx_DeleteItem DirectUI_TreeEx_DestroyControl DirectUI_TreeEx_EnableAnimate DirectUI_TreeEx_EnableChildControl DirectUI_TreeEx_EnableControl DirectUI_TreeEx_EnableSrcollTextScroll DirectUI_TreeEx_Expand DirectUI_TreeEx_GetAutoTextItemText DirectUI_TreeEx_GetButtonCheck DirectUI_TreeEx_GetButtonUnknown DirectUI_TreeEx_GetControlRect DirectUI_TreeEx_GetControlText DirectUI_TreeEx_GetItemStyle DirectUI_TreeEx_GetProgressPos DirectUI_TreeEx_InsertItem DirectUI_TreeEx_IsControlVisible DirectUI_TreeEx_IsExpand DirectUI_TreeEx_Select DirectUI_TreeEx_SetAutoTextItemShow DirectUI_TreeEx_SetAutoTextItemText DirectUI_TreeEx_SetAutoTextItemTextEx DirectUI_TreeEx_SetButtonCheck DirectUI_TreeEx_SetButtonLogo DirectUI_TreeEx_SetButtonLogoImage DirectUI_TreeEx_SetButtonLogoImageBuffer DirectUI_TreeEx_SetButtonSelectMode DirectUI_TreeEx_SetButtonUnknown DirectUI_TreeEx_SetControlPos DirectUI_TreeEx_SetControlText DirectUI_TreeEx_SetControlTextEx DirectUI_TreeEx_SetFirstVisible DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_SetProgressPos DirectUI_TreeEx_SetStaticLogo DirectUI_TreeEx_SetStaticLogoImage DirectUI_TreeEx_SetStaticLogoImageBuffer DirectUI_TreeEx_SetTooltipString DirectUI_TreeEx_SetTopItem DirectUI_TreeEx_ShowControl DirectUI_UnclassWindow DirectUI_Uninstall DirectUI_UpdateSkin UICtrlIdInItem UIFindItemcInfoByText UIFindItemsControl UIFinishRecordPerformance UIFreeHITEMC UIFreeItemcInfo UIGetButtonCheck UIGetComboItemButtonCheck UIGetComboItemCount UIGetComboItemText UIGetControlText UIGetControlType UIGetItemHITEMC UIGetItemHandle UIGetListColumnCount UIGetListItemButtonCheck UIGetListItemText UIGetListRowCount UIGetMaxScrollPos UIGetRecordPerformance UIGetScrollPos UIGetTreeItemButtonCheck UIGetTreeItemText UIHasNextItem UIHitTestListCtrlItem UIHitTestTreeItem UIInitAniRunInfo UIIsComboBox UIIsElementEnable UIIsElementFocus UIIsElementVisible UIIsListCtrl UIIsTreeCtrl UIIsTreeItem UIPauseAnimate UIResetHITEMC UIResumeAnimate UIScrollToBegin UIScrollToEnd UISetButtonCheck UISetComboItemButtonCheck UISetElementEnable UISetElementFocus UISetElementVisible UISetListItemButtonCheck UISetScrollPos UISetTreeItemButtonCheck UIStartAnimate UIStartAnimateFromList UIStartAnimateFromTree UIStartRecordPerformance UIStopAnimate UIStopAnimateByControl uiChangeElemStyle uiCloseHwnd uiComboBoxAddString uiComboBoxClear uiComboBoxGetCurSel uiComboBoxGetItemText uiComboBoxSetCurSel uiComboBoxSetStaticLogo uiDeleteElem uiDeleteElemById uiEditSetMarkText uiElemIsEnable uiElemIsFocus uiElemIsVisible uiFindChildElem uiFindElem uiFindElemInTreeItem uiFindRenderElem uiFreeElem uiGetButtonCheck uiGetChildCount uiGetChildElem uiGetColumn uiGetColumnInElem uiGetElemAttri uiGetElemPosition uiGetElemRenderRect uiGetElemText uiGetElemTypeName uiGetHwndHostHwnd uiGetMaxScrollPos uiGetResId uiGetRichText uiGetScrollPos uiHElemToReal uiInsertElem uiInsertElemDirectly uiInvalidateRect uiIsLogicalElem uiIsValidHElem uiMoveElemTo uiMoveElemToById uiRemoveElem uiRenderToMemory uiRootElem uiScrollToBegin uiScrollToEnd uiSetButtonCheck uiSetElemAttri uiSetElemEnable uiSetElemFocus uiSetElemLogo uiSetElemLogoByData uiSetElemLogoByImage uiSetElemPosition uiSetElemText uiSetElemVisible uiSetHwndHostHwnd uiSetRichMarkColor uiSetRichMarkText uiSetRichText uiSetRichTextColor uiSetScrollPos uiSetVListCtrlCb uiSubClassWindow uiUpdateVListCtrl uiUpdateWindow

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

EnumModules.exe

IMPHASH f78cbdd577c5625a8fab0469bb25225c
SHA256 9a325f86ab943c43adbcb6f8375e68a9334f8ad76c4122c98c10729bad83e4a8
MD5 854ca26d5b795d6b848f62ff601785fc
SHA1 d0afea846fef4b581ea02da354e7afe1b47cf83f
SHA512 607470383a172f68065c554d70a0af66ee919d3163c0b7c9318eafdb9a6800afff2e1eb7feef0d3b0222923fc767a0f75258e08b719a67c4a241a41b6960fb40
SSDEEP 1536:LePam4bV9q9mdEva6wvXgTMatmyjapEbURTC9TdouQXakyoE5NlXCYByq:LePa/bV9q9a0a6KXO9tm60k4aFD5NlXC
TLSH
T1D3937B9B775410F6C1528139C9D28B86EB72B4664BB653CF1B7483AA1F233D16E3B321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d1:f0:c8:36:35:00:7b:18:b8:12:25:14:2f:fd:5d:e5:fb:61:5d:08

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

17168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

u:\app\gensoft\security-client\pc-faster\public\output\pdb\EnumModules.pdb

kernel32

Process32FirstW Process32NextW Module32FirstW Module32NextW WideCharToMultiByte MultiByteToWideChar CreateToolhelp32Snapshot CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetModuleFileNameW CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx GetLastError HeapFree HeapAlloc EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSectionAndSpinCount HeapReAlloc FlushFileBuffers

FasterNow.exe

IMPHASH f34a0656a70c0628754a00443dd1c351
SHA256 9da6ba6fd1a041c436317b928dfede44df7527e761c624ea2fa6a23fc4102e6d
MD5 ace71337cc46e5ac49c19c3d2d15a92a
SHA1 c7f15ac5a2e7c3a6b536f5c2f3485b6606f13c85
SHA512 9487e5d20f2e091a59397bd8725ceef16fc8977c8a5ccde6b4c51fb1c4097ca00fd957c531b5ae12352a1664d1c423ae22ce95a7f6b581dac1e3d44ae91b3041
SSDEEP 12288:SYnEWdZzMeOPd/tl6HfqUkyB2go6v78Gn1a+3OKFQD7p66n0ii7CYBQn+2pp4wKR:SfPmkyB1v78+UV7n0d78nLp3KAUV
TLSH
T18A153A00B6928136F5B309F19E7E46AD9539BE310715A0CFA3C41D6E1EB1AE27E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

51:bf:b6:7d:ed:5c:37:64:43:a8:59:c9:8d:8e:b1:59:3c:10:c8:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

550529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\FasterNow.pdb

directui

DirectUI_Static_SetLogoIcon DirectUI_Button_SetCheck uiUpdateWindow UIScrollToBegin DirectUI_GetStringItem DirectUI_SubclassWindow DirectUI_TreeEx_DeleteAllItems DirectUI_TreeEx_DeleteItem DirectUI_TreeEx_InsertItem DirectUI_TreeEx_CreateControl DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_IsExpand DirectUI_TreeEx_Expand DirectUI_TreeEx_SetStaticLogo DirectUI_TreeEx_SetButtonUnknown DirectUI_TreeEx_SetButtonCheck DirectUI_TreeEx_GetButtonUnknown DirectUI_LoadSkinResourceFromZIP DirectUI_TreeEx_SetTooltipString DirectUI_TreeEx_SetControlTextEx DirectUI_TreeEx_GetControlText DirectUI_TreeEx_SetControlText DirectUI_TreeEx_ShowControl DirectUI_TreeEx_ChangeStyle DirectUI_AutoText_SetControlText DirectUI_TrackPopupMenu DirectUI_EnableControl DirectUI_SetLayeredWindowAlpha DirectUI_SetLanguageStyle DirectUI_SubclassLayeredWindow DirectUI_EnableAnimate DirectUI_SetControlTextEx DirectUI_SetControlText DirectUI_SetControlPos DirectUI_GetControlRect DirectUI_ChangeStyle DirectUI_IsControlVisible DirectUI_ShowControl DirectUI_I18N_AddLanguageStyle DirectUI_GetVersion DirectUI_UpdateSkin DirectUI_TreeEx_GetButtonCheck

datareport

RD_WW RD_WS RD_W Stop Start

gdiplus

GdipCreateMatrix GdiplusShutdown GdiplusStartup GdipDeleteMatrix GdipTranslateMatrix GdipFree GdipAlloc GdipRotateMatrix GdipCreateFromHDC GdipDeleteGraphics GdipDisposeImage GdipSetWorldTransform GdipGetWorldTransform GdipDrawImageRectI GdipLoadImageFromFileICM GdipLoadImageFromFile GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipCreatePath GdipDeletePath GdipAddPathPieI GdipDeleteRegion GdipCreateRegion GdipGetClip GdipSetClipRegion GdipSetClipPath GdipDrawImageRectRectI GdipGraphicsClear

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?DelInstance@CAPCDispatcher@@SAXXZ ?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

UnmapViewOfFile FreeLibrary GetCurrentThreadId GetCurrentProcessId GetLastError GetTickCount GetCurrentProcess GetPrivateProfileStringW GetTimeZoneInformation GetPrivateProfileSectionW CreateFileW GetFileSize OpenFileMappingW MapViewOfFile lstrlenW SetLastError CreateFileMappingW InterlockedIncrement InterlockedDecrement MultiByteToWideChar ReadFile GetTempFileNameW CopyFileW DeleteFileW lstrcmpiW RaiseException LoadLibraryExW GetCommandLineW FlushInstructionCache CreateProcessW GetPrivateProfileIntW GlobalMemoryStatusEx GetSystemTime WritePrivateProfileStringW GetShortPathNameW TerminateThread InitializeCriticalSectionAndSpinCount CreateEventW SetEvent SetThreadPriority GetCurrentThread WaitForSingleObject GetLogicalDrives WideCharToMultiByte VerSetConditionMask VerifyVersionInfoW OpenProcess LoadLibraryW WinExec SetPriorityClass QueryDosDeviceW Sleep Process32FirstW Process32NextW InterlockedExchange TerminateProcess DeviceIoControl SetProcessWorkingSetSize VirtualAllocEx ReadProcessMemory VirtualFreeEx InterlockedExchangeAdd SystemTimeToFileTime CreateDirectoryW CloseHandle HeapAlloc HeapFree GetProcessHeap LocalAlloc LocalFree WTSGetActiveConsoleSessionId GlobalAlloc GlobalFree ResetEvent WriteFile lstrlenA OutputDebugStringW ProcessIdToSessionId DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread GetModuleHandleA VirtualFree CreateFileMappingA GetLocalTime GetWindowsDirectoryW InterlockedCompareExchange GetFileSizeEx VirtualQueryEx HeapCreate AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler VirtualQuery GetModuleFileNameA ReleaseMutex CreateMutexW lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenEventW lstrcpyA VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer HeapDestroy HeapReAlloc HeapSize LoadLibraryA IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetModuleFileNameW CreateThread GetStartupInfoW RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc GetModuleHandleW DeleteCriticalSection InitializeCriticalSection GetProcAddress GetVersionExW LeaveCriticalSection EnterCriticalSection ExpandEnvironmentStringsW LockResource GetLongPathNameW GetCurrentDirectoryW GetTempPathW GetFileAttributesW SizeofResource GetSystemDirectoryW GetSystemWindowsDirectoryW LoadResource FindResourceW SetErrorMode FindResourceExW GetEnvironmentVariableW TlsSetValue TlsFree ExitProcess GetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode CreateFileA SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA GetProcessTimes CreateToolhelp32Snapshot

user32

SetCapture SystemParametersInfoW InvalidateRect RedrawWindow UpdateWindow PostQuitMessage SetWindowTextW GetParent DefWindowProcW OffsetRect KillTimer SetTimer SetFocus SendMessageW GetWindowLongW WindowFromPoint GetShellWindow GetDesktopWindow MoveWindow GetSystemMetrics EmptyClipboard IsWindow CreateWindowExW MonitorFromPoint GetMonitorInfoW BringWindowToTop GetTopWindow OpenClipboard ReleaseCapture FindWindowExW IsHungAppWindow LoadCursorW GetClassInfoExW RegisterClassExW PeekMessageW GetMessageW TranslateMessage DispatchMessageW PostMessageW CharNextW CloseClipboard OpenInputDesktop GetUserObjectInformationA CloseDesktop RegisterWindowMessageW IsWindowVisible DestroyWindow SetWindowLongW SetForegroundWindow SetWindowPos PtInRect ClientToScreen GetCursorPos IntersectRect EqualRect EnumDisplayMonitors CallWindowProcW PrivateExtractIconsW UpdateLayeredWindow EnumWindows GetCapture CopyRect UnionRect ScreenToClient CreatePopupMenu AppendMenuW FindWindowW DestroyMenu ShowWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow GetThreadDesktop GetWindowRect UnregisterClassA

gdi32

CreateICW DeleteDC SelectObject CreateCompatibleBitmap DeleteObject CreateCompatibleDC

advapi32

SetTokenInformation GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl EnumServicesStatusExW RegEnumKeyW RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser GetUserNameW QueryServiceConfigW ControlService QueryServiceStatusEx StartServiceW QueryServiceConfig2W OpenServiceW EnumDependentServicesW OpenSCManagerW CloseServiceHandle RegQueryValueW RegOpenKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteValueW RegQueryInfoKeyW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegEnumKeyExW RegOpenKeyExW RegCloseKey CreateProcessAsUserW FreeSid AllocateAndInitializeSid GetKernelObjectSecurity GetLengthSid DuplicateTokenEx

shell32

ShellExecuteW ShellExecuteExW SHOpenFolderAndSelectItems SHGetDesktopFolder SHGetFolderPathW ord165 CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc IIDFromString CoInitialize

oleaut32

VarUI4FromStr

psapi

GetModuleInformation GetModuleFileNameExW EmptyWorkingSet GetProcessMemoryInfo GetProcessImageFileNameW

iphlpapi

GetIfTable

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

shlwapi

PathQuoteSpacesW SHDeleteValueW SHSetValueW PathRemoveArgsW SHGetValueW StrFormatByteSizeW PathIsDirectoryW StrToIntW PathIsRelativeW PathAddBackslashW PathRemoveFileSpecW PathFileExistsW PathAppendW PathFindFileNameW PathRemoveExtensionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

pdh

PdhOpenQueryW PdhLookupPerfNameByIndexW PdhAddCounterW PdhCollectQueryData PdhEnumObjectItemsW PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue

rpcrt4

RpcStringFreeW UuidFromStringW UuidToStringW

winhttp

WinHttpCreateUrl

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Feedback.dll

IMPHASH 3ec398029b8e998bc9df72b3bf775c77
SHA256 4512b0594ed53328de081aad2a31dac4fe098e6ae945a4eaddbba1013af631a4
MD5 2066875f312cd796b47ac644ce9ae1db
SHA1 66fa20a0d2b80966893d6a7dc244d2ee93b9b830
SHA512 19be433d3749b64186c1cc0b5dab55ed8427d53965613cbc3e528c6b747caa61c39f2c79f7e2f5455c113b154f9b20103aa8c2f62932851e4abc1d1ea4911057
SSDEEP 6144:E52McO1ZxleXYw5EGn5m/yAUiD/fHh7926ssDFKSpkR5tlK8G:q2McO1leXnI/bUiD/fB7926sjC
TLSH
T111949D00F381C136E99F1175897A876E52AEB9A0171941D3F7C82E6F8F317D2AE3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

de:80:12:f2:ca:34:36:78:b3:16:1f:fe:bf:3d:69:77:da:db:f3:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

214716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Feedback.pdb

kernel32

Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW VerSetConditionMask GetPrivateProfileStringW GetStdHandle WinExec OutputDebugStringW GetPrivateProfileIntW GetTickCount ReadFile GetFileSize GetSystemTimeAsFileTime ExpandEnvironmentStringsW GetTempPathW GetLocalTime FileTimeToSystemTime SetFilePointer GetFileInformationByHandle MapViewOfFile CreateFileMappingW SystemTimeToFileTime UnmapViewOfFile FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetUserDefaultLCID Process32NextW GetStringTypeW GetStringTypeA GetLocaleInfoA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetModuleHandleA TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA ExitProcess HeapCreate GetCPInfo LCMapStringW LCMapStringA GetCommandLineA CreateThread ResumeThread ExitThread RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy CreateFileW WriteFile WideCharToMultiByte CloseHandle GlobalHandle GlobalFree LoadLibraryExW FreeLibrary GlobalLock GlobalUnlock MulDiv lstrcmpW SetLastError lstrlenA MultiByteToWideChar InterlockedDecrement InterlockedIncrement GetCurrentThreadId GlobalAlloc GetCurrentProcess FlushInstructionCache SizeofResource lstrcmpiW GetModuleHandleW GetProcAddress GetLastError DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW Sleep CreateDirectoryW GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource

user32

GetDC GetSystemMetrics InflateRect PtInRect GetWindowLongW SetWindowLongW SetWindowPos GetParent SetCapture ShowWindow ReleaseDC GetActiveWindow MessageBoxW DialogBoxParamW WindowFromPoint GetForegroundWindow keybd_event EnableWindow EnumWindows MoveWindow SendMessageW GetCapture EndDialog SetCursor LoadCursorW GetMessagePos GetWindowRect IsWindowVisible ReleaseCapture GetDesktopWindow GetWindow GetTopWindow CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW DefWindowProcW UnregisterClassA GetSysColor GetWindowThreadProcessId FindWindowExW SetForegroundWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints BringWindowToTop CreateDialogIndirectParamW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW CreateAcceleratorTableW RegisterClassExW GetClassInfoExW IsWindow SetFocus GetFocus DestroyAcceleratorTable BeginPaint EndPaint CallWindowProcW FillRect GetClassNameW IsChild RedrawWindow InvalidateRgn InvalidateRect ScreenToClient ClientToScreen GetClientRect PostQuitMessage MapDialogRect DestroyWindow SetWindowContextHelpId GetDlgItem SendDlgItemMessageW CreateWindowExW

gdi32

BitBlt SelectObject CreateCompatibleBitmap DeleteDC GetDIBits GetDeviceCaps CreateSolidBrush GetObjectW GetStockObject CreateCompatibleDC DeleteObject

comdlg32

CommDlgExtendedError GetOpenFileNameW

advapi32

RegQueryValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegCreateKeyW RegSetValueW

shell32

ShellExecuteW ord165 SHGetFolderPathW

ole32

OleUninitialize CreateStreamOnHGlobal CoCreateInstance CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc OleInitialize

oleaut32

LoadRegTypeLi SysFreeString SysStringLen SysAllocString VarUI4FromStr LoadTypeLi VariantInit VariantClear DispCallFunc OleCreateFontIndirect SysAllocStringByteLen SysStringByteLen SysAllocStringLen

directui

DirectUI_I18N_AddLanguageStyle DirectUI_GetControlRect DirectUI_GetVersion DirectUI_SetControlPos DirectUI_LoadSkinResourceFromZIP DirectUI_UpdateSkin DirectUI_SetControlText DirectUI_ShowControl DirectUI_SubclassWindow DirectUI_Static_SetLogoImageBuffer

shlwapi

PathAppendW PathRemoveFileSpecW PathIsRelativeW PathFindExtensionW PathIsDirectoryW StrStrIW

gdiplus

GdipCloneImage GdiplusShutdown GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdipFree GdipAlloc

wininet

InternetConnectW HttpOpenRequestW HttpSendRequestW HttpQueryInfoA InternetReadFile InternetCloseHandle InternetOpenW

Fonts/HelveticaNeueLTPro-Th.otf

SHA256 59aa289b9f487210f28da70b6b60320a73f820a2583cc05f9c9a0cbe893eee8e
MD5 91df32bcef8f28c809633b1f9b91c4cb
SHA1 c9367d9de1885bf9a366ddf9a7377d08d5969bc2
SHA512 1a00b79691aa54ab0c6134a28343b82499f62edc06aeca90d0d1fce4b3a9eeb8b9c1cc93bd0decb422bafcda7c0b4e4db854dc9dbdb46a0d80c4a00dad883f71
SSDEEP 768:kWdKc6KX6SENzpsCqQUCLHg3vCknACC/ID55+2L3FbZKS:k9KX6nSQ/s3gg55PxZKS
TLSH
T176235A46A7E86710F6F32F30287AA3551E32BC459EBAD25F714C814D0F71B908DA1B6B
MD5 SHA1 SHA512 SSDEEP TLSH

HomeRank.dat

SHA256 05a4e0f6c638c17891e9e69886f9d7c2ffb883c3cdd20c8516ff34a237dfaff4
MD5 0f12444d37ce1efdb461764aa9c5a74f
SHA1 08f6a0d149d614c1d3e850db2eecf99aa788b058
SHA512 546a30c0805ba7804dacf1eb85cc8b7e128dd5ed6c3bfdaff1c4c429d360f947b335526ae23008ab13b620f9eb0babdbdd39f182edc259aaa88f4620126efe58
TLSH
T19B517304A2168E4F9BAD80F542E499009B8EF13143E61635713B76620B936E7FD6EF78
MD5 SHA1 SHA512 TLSH

I18N/1028/BCloud/BCloud.bskin

SHA256 ab6da67fa6d30465521edf9de9cc8264b1935eb1befdc990306d44cf9743d581
MD5 71be02ad05ecfc052e2b4a0c93b6e691
SHA1 e0d951f0a9a4559c182350b8d899d5cb601718bf
SHA512 490b590d7a3eb520b1761e3d105bc49a84e5b826d10df17153d99b449d0a8af3006313ac6fbbc8eeaad474f0c8711a0fa903393a7e6aed108d8f5115264dd68f
SSDEEP 1536:7wpA35VUGKgdFOA68IRJJ2E6I1Ncaw406vGB:z5mEgLjIVI/Na
TLSH
T1D243028E3972952679D9983819C35712B4F5181A830F637F1EA93CF4E3D529E2330A77
MD5 SHA1 SHA512 SSDEEP TLSH

skin.xml

SHA256 48d0f64d2358f11a0c815221760b83aaaa6aa2a781a72defc7575780220c6ddf
MD5 40ceaf560fc4d7720db3e0343f48f207
SHA1 34ba06bc852c5938a1684c9b3d19226941142d11
SHA512 7043f93e2bfa5f4903e22bf50473aef679b9afe9017b5348a04ca92783125fe0a58ee272e5ac5602f74ae7287d7c860d634f4a60e91ae34e571a21a4ff698007
SSDEEP 192:v/WV60k/qQgr6KKAbQlPRttt4lrAPMtYYdVRwgPQyuStsUDWyf0Q5vT50:TZt4lrKMzRwgPNuStsAWytxy
TLSH
T1CF920F353CFDCB948A617B207FDB120E988950EB8A5215DCBE2C45AB1F73F295473262
MD5 SHA1 SHA512 SSDEEP TLSH

skin/fastantivirus/cloudscan_down.png

SHA256 c4b15fb6d751524ee31d902970f4867b1e3a6568d335ec5ba7f66c444bfde8e5
MD5 10bc50157ba3d580728bb160742a57ce
SHA1 d86a588b2a815e4fad2c9736cd17ff9763f98c6b
SHA512 00d2be3a7d7959b57abdcc042ca117602e8c8d429c7d90eb212d70fc7b9b27535f29e0bfcff7010dc00cfaec2edec3d51a577fd024a60d0259110fd540ac0a59
SSDEEP 192:MSDS0tKg9E05T9DrI9PeYX9t4NfWXnD9wjt/6VZEnE3jhYJU2IFG+1CmahpvZKHR:LJXE05mdnX3XhwjtYZQEQtZGahpvZZa
TLSH
T1EF32BFCEA294658FDC08AF72DDDFA5099390AB58C743753C72D8A6D0E042F032ACB5B1
MD5 SHA1 SHA512 SSDEEP TLSH

skin/fastantivirus/cloudscan_hover.png

SHA256 f37e82a32ec453776b5f4c1a69010d87869bc9f55e69aa877ef0f36df51691a3
MD5 9ec4bae6fc69aedbc05e3584260d630b
SHA1 0f0736c094550bf82dd6221ae64496e3e4e7ca80
SHA512 4e49fac9a135e4d6f378a78138d9ea291f3dbaacaea33fdeac3ad489c8ceee920525f56f40f324c5d3741bb6ef92057ceb1a5355b44f67922d893bf9fb5ece45
SSDEEP 192:MSDS0tKg9E05TzbbT/otsWeVLdbwYEvimFvVO/gruyf1Ngesim8Q/AzwNtrRh5l/:LJXE05DfYsFVLxE6oNJuy9a8+Azst1/N
TLSH
T12D32C07CD38CB89BA1D428A43E095385DBE57629C31157386EF227CC960AC6E0EA60F4
MD5 SHA1 SHA512 SSDEEP TLSH

skin/fastantivirus/cloudscan_normal.png

SHA256 e11982beb01179b8bcf7a03797cad8c07dd7ac3ff8434160d32d48c9a290a8e9
MD5 71c7adba58842a709c46858480fc1e7a
SHA1 eee6d47119a8f69e22fbce79e982b8b164c95328
SHA512 d93f7d7c795ed11d0d51e8baeb88762905ac459f4fc7645e2948825fb5814eebee3a9083631321295a816e085f9cef2cc02d1634fa5cda7f348e8e763f967ca6
SSDEEP 192:MSDS0tKg9E05TDureopmxeC/lqT7Zj3p8NApAlFivrz0Q+awd+rW7aMAYRm:LJXE05/ureoglKpafiDz0Q+aXmjhm
TLSH
T1B732BF7991A4019FAEAA7940099D6963C63D23A472757B30F70F69DBB010F030BFA8B4
MD5 SHA1 SHA512 SSDEEP TLSH

skin/fastantivirus/reportBg.png

SHA256 b5df481426592e556b1310977bdc967e72bcbd8ace361af4fa8992c5c694bd50
MD5 c55b4d8933be5eea60b39403dcae9055
SHA1 4a83380aed7e843834f09e16aef8aa6fd14a1873
SHA512 ac12a9f9a4b8feb56599a05e855e05cef0501071f90e9210a2fbab2fc91f63066918abd87ab55dd877de96a3061d461b8347fe1ea8227570313d3cda5aef203a
SSDEEP 768:PdjLbBFNACF3jcr1Xf4bjL8Lo7XhAgE/YXUN:PdjLbZAC9jcr1w78Lo7XY9N
TLSH
T1F1C2147E88A6F76FD17D94D369B0F83DC5228B14C8B6989481D39EBF0ED8DB09306416
MD5 SHA1 SHA512 SSDEEP TLSH

skin/fastantivirus/res_total_million.png

SHA256 35bfdcf3be4cdcd4bcc4edbabab8054dbf352d435f12128cec60b8fd32b5670c
MD5 1fac16d7be29dbf6230b76bc824cc3da
SHA1 1d0825bf3783845f89b1f012e0b3ea33e8bcade8
SHA512 fbbf57a3b7d5d3457948c866e5cfe8db0fc7d45417d79c00f7e154b29f593eab7a9803911c12b6e6035fb9a2a59ecdfea50315fefa01e48f69d937214b686bc6
TLSH
T1CB517BAF9D20A49F399D3A010CCF0102E76D22ACCA033738A0C254EF1866E0B7B614B6
MD5 SHA1 SHA512 TLSH

I18N/1028/BaiduSafe/BaiduSafe.bskin

SHA256 d19992d749175e5bf476879f40b421879ad12f38d67b3e12d00d0a4ad0ea2ad9
MD5 ab7e942f9452fc94d68df9bdb3f8ca0c
SHA1 6d41b3ddf27e5e4445310a7fb137e11dd3ab56c2
SHA512 b7a5e3e058e1466114a6ff7618dffb1d540c7317d11d397402a31f1f8085af8f2d818e3b10b5ee1e37a88af8af1cd888ee45c83310dfba19dc1d8c6cb147ab5c
SSDEEP 3072:n/l/Af1FP+asrUVnkO0yoi+dc4BpqvwqX1brJD1SdlNDuT34:aflnkvri+cvwqhrN1S3hW4
TLSH
T131F32200E31912F7EBD758AD22B4F18586F75986438CCB6B82ED41C5C9A4DA5FD42B0F
MD5 SHA1 SHA512 SSDEEP TLSH

skin.xml

SHA256 bc7226291d3f04c07e9beee4516a58b516a2b11248ea84df3b4fecf6452dcb3c
MD5 3bd2b0a6448093b4d393fe433c0547bf
SHA1 318450eb68a322ea7dfa7cc81e092943865b2d2f
SHA512 637232173b67f419c5bdfc0f57dbb0bca56f392d43dda023db21d4811584d7b5dc4519ae469f2eac48f73df7e176fe130c1cbe044dc94cbeba7ed0ff9f8bb0f5
SSDEEP 1536:yFxTbw8l2RAOe0hbtLuKBTRhwvyBdmmtD3W1J2C2/f8r0qqxVo1xftmZ/RQFCtsW:17yKc2/f8r0OGX
TLSH
T17DE34F393DFDCFE998516B343B8A10512D9815CBC71324ECBD2D819E4FABFA542B2291
MD5 SHA1 SHA512 SSDEEP TLSH

skin/cleaner/guide_text.png

SHA256 3d166b9fc515aa65da77231738c807968a2d9b945e84e311e1e05afd5a54ad72
MD5 b6dac2853c774dad1e4dc408c4033683
SHA1 56e20b388b6bf683de0708cd86c37ba2b3a47b0b
SHA512 186e8d4b864c4f12710f758b8efa045203ec4f346886e8570948dc55b9e1154f9e4ff3ef7c83c1e6d5a97f4b4d80292688a5e07d6a5a619c94ea71b4f3a48dae
SSDEEP 96:ISK2iuhuFLSLmWbXrYxhxZbHSHr5CBf7MOGKWhOqI7x5eROrW8B:vXhu4HbXY3bHSHMl7McrW8B
TLSH
T1C7C17DAC29446AD0D4F9ED4280EF502E52BE00509DD1F9DAA5DFBB144CA3CAF5125ACF
MD5 SHA1 SHA512 SSDEEP TLSH

skin/home/result_atRisk.png

SHA256 066e22b5eb3441011c6ca230806f2a9dcb11b1bb6f9dc0643fc5327906e3fb62
MD5 284d2c67e2c612766e9c6cb55ebab217
SHA1 adea9cac6bf6d2f4d57962772a4613013d8a58b7
SHA512 32b5a71346e68aed835b9631d12da3aa2e89472e6f87d377e1620910c80eafb22dfb9d7308e54507a937abb353e0ff33936b8f412428c3970a3cf4b463e76400
SSDEEP 384:RJXE059MWGZEn/gVe4+0UNT+meHz1j/VCGjCYYaEARW7/xDPvsn9:z359MfbI8HhBDevlsn9
TLSH
T15882E08ED92184DCF98CE2239A85D5C32B1B132D729EC97CB5A650DD609462E3F5B086
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/bc_update.bmp

SHA256 94c90175f3ea76415dae8bbe1a93f79fdf79916bba710a22ee9aea8ac10849f1
MD5 78adaedd8a58ea8709b36b5a6186d5c5
SHA1 ef4fd4a758a67e77714b9478a8253fcee3cdf9c5
SHA512 b3b9cbdb128ed997f9d4ba9c9af2afdcc8756b0421d8b398aeff8bec20331344cbe26a5d71aa011e91e2410c5f0e853f9449f787e2119ff9f7b0afd6542fe1a5
SSDEEP 768:+5OQg7L+U2fmW3Gjccbn+ZJRnIrM4nvbnZGaX6MYdQT4P2TCv1+ULxbqCJo:+jg7L+wj4mnQvKvbnj6pJ+ULxbfJo
TLSH
T16B141F203202E75EB4689AFD191DBCEEDBA93CF81C9810282327F95BDCF2D554A1D9C5
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/btn_NF_down.png

SHA256 e0ca459e4fee65dcbeb59c18e74357ce779106ce180e5dbf3530b4abd8ad6fc8
MD5 3ddde15a11d8d5fa40aea7640c1700cc
SHA1 a1a8721ae730cba343110ef80bf50941f45ccaeb
SHA512 89e0169c2213eebb4cef0f11385a406f9d686a9136c2e258c772f729aa8c5b7c7faf33fc38f0b5aa3b3298790c9c053177a71fb76138638c9488c217a41f5dbf
SSDEEP 96:uSDZ/I09Da01l+gmkyTt6Hk8nT3e9iFzVaghsa3NzotKQ9Iz:uSDS0tKg9E05T3e4FzjhsyaKQGz
TLSH
T180A19FEAC6B078A7B58EF5B20EEBA6816B94216C45113E3C95C158CF5030DC767681B5
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/btn_NF_hover.png

SHA256 3e571783aa34d86312ab758e71692f86405897455f756bd1ecbece16698a188a
MD5 a049f6505e0e4b54b1be26b8aa850609
SHA1 a9a65911f217be085fc2609059cb0e4d7ab4435d
SHA512 a900e85cddbb0fc47207eac6c3ef4a78786c560206b61bcefbc4bebf5e963f081731b721e239c7774fc6db6e043eb7816744ac199c28d7e199efab65ee8fb7a7
SSDEEP 96:uSDZ/I09Da01l+gmkyTt6Hk8nTAeWSjfKTGWLCV9g4f7GkY+xxYr:uSDS0tKg9E05TAeWSjf4dC//Hx+
TLSH
T1DCA1AEADD439E8FDB8BDBD508DEF89429B5A107EB894050094C718CF7E6DC022B36662
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/btn_NF_normal.png

SHA256 e88a827f200ffa1f6f1a7875164c3dc9614c0b5860b4aff65ebffe16487c6699
MD5 4ba66fd388bc850f04a7a72ede9e4751
SHA1 30d442cc22c7ebd7b03393f231bc34fb96d2f07f
SHA512 63c2bd0d32343b75b04504408dd4f1225937dd9b2e12e54d5534e8866a2426fb660fa93bc914314360c9e512ca5ffb3905dc27c9abd1157c6d2f0a2d06099215
SSDEEP 96:uSDZ/I09Da01l+gmkyTt6Hk8nTpexv3ti73R+xpUDii9c:uSDS0tKg9E05TpeR3a33LC
TLSH
T10DA16BEFE604A88BB9493E500D9F1243C3B5036483DA3A74B5E220EE9425D072F134D6
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/feedback_bear.png

SHA256 21424ac53ed4164d9b1ce7bb97b32296b2dd5abf761eabf7487e18290834f379
MD5 de3b6680f4dfc98149af66406639fae7
SHA1 e233f90d0b8b718479a8cadbe8aaa7b37ef9010a
SHA512 e8805ba5fe86d6b3014962fcbcffd495b95a526846bd25f17be97522c71e99777594e56ba80c13c9bb002ca01125393469d71ff55cddde046322e54c7a59c5c5
SSDEEP 768:w35rnbunLXR67dtH6wdPGwhYqmdYcCslKjfOnNRw/0k:ounLh673/dPC3YcCKNg
TLSH
T1ECE2E13D462A434243A567C0AECDE253D73CD1FE6D52FB06CA86E9F2E15280255CA83F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/junk_text_compelete.png

SHA256 caa702e6286a9d626d03834a018e068b64b1e66d60b5dc66456e5366233ec5ef
MD5 d3c36b8facf1be5d34a05e0edbc5a4b5
SHA1 9d04bcf7639685c29b0f9c3a54f2005edc3792b8
SHA512 55a3983198441c8336ab57a88dba85f83183aeb2620136f78a37fe87f04c5c5e0da2a88c9f389e818cf1435ab4f38264d710bbba3f479273f370daab916cc4f2
TLSH
T1CC616BAEC86094CEA8DE36900DCD5A05E76D52BCAA62363C90C1B9DF40F9E075BA9471
MD5 SHA1 SHA512 TLSH

skin/mainframe/set_usb_wnd.png

SHA256 f919c59890dbf23e81e63d604d9ca0f6920ff8156a4b45ea2e9f3edf716203d1
MD5 51e4503ded451b1407018101ee0c8b44
SHA1 d04c883d34b8212a06c1e368996b335c5b4a78db
SHA512 545e5123bbdd48af9a3773dd6c9d32957f1dff42153d0037b1c883d84512120f8dabbbbf1b2225dba830e6909965e22af6a6dc04132a0b112b3028b50650acdd
SSDEEP 384:3O5BcfJH0g6vXmELW+K04rJcku6+b4/umOf3W9pZF0icKeWkVlWdnaxqeXWIkKA2:3Ofg0m4GNmHepZFv3eWY4dnaMeVAbDO
TLSH
T145D2D094CA724D7143B6642707C48CD1F92D60E24590EE6FBC88A64F16D9EBA069BCF2
MD5 SHA1 SHA512 SSDEEP TLSH

skin/optimizer/btn_fb_down.png

SHA256 210437dfa04e42a5bd1d260ecca14f15337bfe60b27ff8e09241b9a600dce741
MD5 4a58bc9114572dddf8a87dd471fa9f42
SHA1 c9839b9ed202305c66e6dedd24c7ba60167237e9
SHA512 d55f592a6d9462ed223abae2f0e603b5cb4c83860d13ee88e094a2fceb1257be6ee6f68224280cb9f7e6bf675fda57eb47e93b7099dcace33b36e11144b464d9
TLSH
T1625109CE9B40F80361086F806CF65067DE2B4580DBE4FEB1A98E9C8D44196E812ED9CB
MD5 SHA1 SHA512 TLSH

skin/optimizer/btn_fb_hover.png

SHA256 ee25fcb31c452c2f9eb9fe546ecca1408220706ae4a199c4fd02758575a7c937
MD5 271487dce605be20c49f5a70294fb9e8
SHA1 5448730e610487f17917195415cd00466c48c49c
SHA512 f362aedfe5c75ef007f74f6f328bd4a7036f70778a25d96b02850e95f21f1b0b7afc80b2fa40ff30ccac5add8dbd93ec4840dc999a6afe0f3994a06d96049dd5
TLSH
T1DC511DDCAD8158034289D90338D545278D5B46C0FED0C3566DDD9593CC515BD0D4F5CF
MD5 SHA1 SHA512 TLSH

skin/optimizer/btn_fb_normal.png

SHA256 caa8c964d13e9982104641491bac272ed24acbdd6201dd5a1793a48c25e0b75c
MD5 612d1c361b92e0412d97d0476f57ed7c
SHA1 0d2a20da9f34dc534e5c0829824decd82497151b
SHA512 103e15050e848c2b8ad41f0ba3652022a08727c5c7386022f776c3a6ffa5ddce4b4bc149d8cb6fc4e38151d691ed77133ec3621134c22012dad839922a07ec87
TLSH
T1D7512C4DA92095804444EF833AC69437AE234A4497E8A376ACDEC0BA0DC10FE769D1DF
MD5 SHA1 SHA512 TLSH

skin/optimizer/btn_tw_down.png

SHA256 a126d28e5f67f3e41ee1219055aa756224ca128b55f87883f85f493f84763290
MD5 b73d81c1c2265090cbf155963fff772e
SHA1 d3590457a4e9b1ef097fdd1103dde9e47dc5e584
SHA512 f965088894fe235280993cf2147e28493bb7cf44188cde16fd76e4ad89a6ba962093b95890b6251003594d824a8821c8c9913b024b07a5259428cb743ab8f0c7
TLSH
T1BF515BCEEA039450B04285C3B4E6E0339B976F884A75E0D85C4EDC9B48250E3487E4D7
MD5 SHA1 SHA512 TLSH

skin/optimizer/btn_tw_hover.png

SHA256 b680bd496e12019fc70123c070433268964a24248e8f9c0db91aaa18f37cd29a
MD5 b57a0b36f9cf6a1e079fb0ff17a96c64
SHA1 1d898d19f92b2fbc39513b4e91e38972cc9c145e
SHA512 8b0833de40f3ec4fbb439ec4556b77f5f9430d24ca95a7eb1e82b6e51b57a9372848f09b206bc24707e78d5067c27d0f78265a5f65095971e4e2154d7493dc2b
TLSH
T1D7511A83ED956500F6D885523AD7822B873381904995F9733D8EDC9718980EADAAF0CB
MD5 SHA1 SHA512 TLSH

skin/optimizer/btn_tw_normal.png

SHA256 b6a5b5cac0f0389d806d7b5030bbd98a1233e7b8f03a8522f4e348194d0795c6
MD5 075a1137ddfd625b061091d2bcf3ba25
SHA1 7ce757c7bd5ecd74262526d52f2347f99cd1b84d
SHA512 5886df72b622870ea009c34bf1a92822e1b6e75040a3115e022719c5f796adac6635af7986d5e743efb1b38d78ee7853173b18bf3601497bfbe9e6df4c927824
TLSH
T1DB510B477D501685708CA08236D76D938D224280C5D7E4376ECEFD9754EA2B255684CB
MD5 SHA1 SHA512 TLSH

skin/optimizer/item_bad_hover.png

SHA256 a8974faf0f5f43a6829b70a64ec582374351a47468dcd7c1224847c85309a50b
MD5 a9d3afd3ecd443b74da62cfdd1d4e244
SHA1 1c9e4744cfbed8c3b5152f5c4a1d0482ae6a5d4b
SHA512 4e2294a962c02c5a5c5903b8c226a4d3972427bdda9cdc41b02971d83165bd66d56280ff035c2b000779c74910a46c1b7cb9cda9e551f91a60ef9c329002547d
TLSH
T1F551F9A8E980F50191DE84E46CE77902893B1D30CCD2E48D256AE8D36D1B3F24C5BACE
MD5 SHA1 SHA512 TLSH

skin/optimizer/item_perfect_hover.png

SHA256 07908a5adb5520828c3e6df0b209392ebba3040a99795a3fc4180991974a90fb
MD5 31522e0e22cc012c79f49183e84901a4
SHA1 39ee443a617ba1741efb8805c41997fea6e2e9ab
SHA512 64e877f6ca76ec223a7cef904e491baa1fffa199f4a5e92a113f60dd672da8e0789618c0cfc5468b550b5d9ff4924734f0e64aee4d8428502ccb0cf9d8dda015
TLSH
T11B51095CEA80950275C52C6608DE346BA94345D06BF4FC37FF654C0F17288BC4D2E0EA
MD5 SHA1 SHA512 TLSH

skin/tools/Internet-faster.png

SHA256 613a9cc0764d42dfca23d0e05f61d473d998db9fcd833311c8e20ac2ec6f1026
MD5 594b3387e24990a9243332bce20f8eb1
SHA1 963e5553b8efbec53047c3d68d3e002f6b05e45b
SHA512 deb96f18ffb8801a7c346e91efb6fcd6a583d46a76631565fed2b6e05a729e4347ddb692499ade900f696e6108f28c26cad508c2126943a864a209c582f4eb07
TLSH
T1C631C50DE890B411E21AE94228F14697A6134EC1CEF1B83398CBC4891A680B9D57EDCF
MD5 SHA1 SHA512 TLSH

skin/tools/Windows-faster.png

SHA256 3a94ea154d9770d36007e5a0192e812fdeb7f57833dc97d5c7e263ae4ef56bd3
MD5 9eaa47eb56af8889d5a9e31cf681cc48
SHA1 c60613589d8cd7aa58090e87c165d7f6bc310395
SHA512 bb0b2fd30878af3a98c922685429df0aab61b6eaa57ede906279895427dfb74f2f2503596aedb134b7540f46aa1f32a3f8ac3b3a4866645bf784afe50e5b9001
TLSH
T17E715B8E58A0053F114A07AB75BF8E0A0D2B5684139C2C1CADED925FC520D223C3937B
MD5 SHA1 SHA512 TLSH

I18N/1028/BugReporter/BugReporter.bskin

SHA256 c44ef2373b93b8fed16c42f33f9c296ac91304e28b04602848e481ad2349d1bc
MD5 e3a3bd12ed84348cdc942f5eebf3ec97
SHA1 5ad6497c1511c571a009107e6b97b810242766bb
SHA512 d7242353da12d6a148ceb7225ceed79f719fff0368c85472828c436a4a3023cfd36a235c2abe1c9965cdf4d7e2c05098e312d65a40a81f5fed44116eeba84001
TLSH
T12611C8162DCAC073C4038279F234010AD799CEBBC0CF06474A449869E05D9FEBA91016
MD5 SHA1 SHA512 TLSH

skin.xml

SHA256 37eb78d9717c40a4e140ee1fc2a5818582c2bc2d8c8a81bb215eeec2c89f7301
MD5 0efadb525cc721b57ba41916fde1f946
SHA1 c9749f9e0265b923dfa95b57b77b1e7b89f16cfe
SHA512 423c48e2777f618a3b5fa26ad1cfee9492035ae97782ba336738fcd7159403c7f672cbaa6a56d3f94ad706788e8c7a344155c468b41c9b8c5348772551b9d441
TLSH
T15B512B38FDF8CE919E632750BF9A4089D8AC118FD60759987D2D86DE1F77D618833212
MD5 SHA1 SHA512 TLSH

I18N/1028/PcfTray/PcfTray.bskin

SHA256 dd95595a1d914b33df26a852a65359037ed472b1d3aa5f9c4c840832316778df
MD5 20fb16b6ef0102fdc6d14bd8fd1a56e9
SHA1 61f2824b570183f219a46148614b3e11d2c6dced
SHA512 e9603c08ee2824528f214a03d13d3934409b2f7bce087be897c35793ff9f1288f351e9fd77fd5e24d02490c5515a6b5107c57fa25f42defe02f799cade4cd0cc
SSDEEP 1536:vAM+L0Zsk0tPkTQzDvI9BWSuDWhv8eOa4:v+L02ZlGQngEay9
TLSH
T1005312C61D5B4EF34332576E65F3811A33241A13C2B686CEEB7064E14EDE3A679988D3
MD5 SHA1 SHA512 SSDEEP TLSH

skin.xml

SHA256 e231f840c3f121fdb9098c7727b1da95647e61c82e023404c775d0789e99a4a7
MD5 dd27489f14c6a3378d86b164e9e16f90
SHA1 bda290efcc70cdc904cf6fdb5c31dd158ebb5861
SHA512 7f42e43f6d2db9d14cb75f1893ed98acdc588093744fec1969379179e2c96f894b16131556d5c2d41a8f84d3e8a499a43b34b7bceb6fbd2a34dccbb42f65fb85
SSDEEP 192:JZZuX1OQVeOLaBdBq97kcRdC9M+QAfFKMgW8DqH294LERfV7HeYr:3ZIOQVLL77RRdC9MufFK9W8Dq4V7HeG
TLSH
T1199255363DF8CFC58C162B343B9915665CD810CBD70A19ECBCAC55AC1FABB2447722A9
MD5 SHA1 SHA512 SSDEEP TLSH

skin/bc_update.bmp

SHA256 f32b92927d57f3c15a89b39d56e33cefa37fa40e615622229c33b84dc543fd94
MD5 aa0d6447d31efb037758c1aba9e64d2c
SHA1 2829aba7ba8fadc1ea6cf58830fa2b1609b65bb1
SHA512 1923a6b83e4fada09caf16f64fd571f05317b6d58a824cbf60d001f1462b12ab9783e72a0af89f84ea5b6539e7bd2842dfe2d840f881b0dfdf9fa0e48279e9bd
SSDEEP 192:zvta6mlUVEAs+J/AlN4TueNTcWSfqfTOTKVqMfNhfN8vHBORyO7IOVFple4VNtt6:95zp1M1doptMt1J27q1tvb
TLSH
T1A404A04DC3563C4FD4B70EB46C2A3FA84556390119AFE2365295B0B6342C7FA8E8A7CD
MD5 SHA1 SHA512 SSDEEP TLSH

skin/btn_NF_down.png

SHA256 e0ca459e4fee65dcbeb59c18e74357ce779106ce180e5dbf3530b4abd8ad6fc8
MD5 3ddde15a11d8d5fa40aea7640c1700cc
SHA1 a1a8721ae730cba343110ef80bf50941f45ccaeb
SHA512 89e0169c2213eebb4cef0f11385a406f9d686a9136c2e258c772f729aa8c5b7c7faf33fc38f0b5aa3b3298790c9c053177a71fb76138638c9488c217a41f5dbf
SSDEEP 96:uSDZ/I09Da01l+gmkyTt6Hk8nT3e9iFzVaghsa3NzotKQ9Iz:uSDS0tKg9E05T3e4FzjhsyaKQGz
TLSH
T180A19FEAC6B078A7B58EF5B20EEBA6816B94216C45113E3C95C158CF5030DC767681B5
MD5 SHA1 SHA512 SSDEEP TLSH

skin/btn_NF_hover.png

SHA256 3e571783aa34d86312ab758e71692f86405897455f756bd1ecbece16698a188a
MD5 a049f6505e0e4b54b1be26b8aa850609
SHA1 a9a65911f217be085fc2609059cb0e4d7ab4435d
SHA512 a900e85cddbb0fc47207eac6c3ef4a78786c560206b61bcefbc4bebf5e963f081731b721e239c7774fc6db6e043eb7816744ac199c28d7e199efab65ee8fb7a7
SSDEEP 96:uSDZ/I09Da01l+gmkyTt6Hk8nTAeWSjfKTGWLCV9g4f7GkY+xxYr:uSDS0tKg9E05TAeWSjf4dC//Hx+
TLSH
T1DCA1AEADD439E8FDB8BDBD508DEF89429B5A107EB894050094C718CF7E6DC022B36662
MD5 SHA1 SHA512 SSDEEP TLSH

skin/btn_NF_normal.png

SHA256 e88a827f200ffa1f6f1a7875164c3dc9614c0b5860b4aff65ebffe16487c6699
MD5 4ba66fd388bc850f04a7a72ede9e4751
SHA1 30d442cc22c7ebd7b03393f231bc34fb96d2f07f
SHA512 63c2bd0d32343b75b04504408dd4f1225937dd9b2e12e54d5534e8866a2426fb660fa93bc914314360c9e512ca5ffb3905dc27c9abd1157c6d2f0a2d06099215
SSDEEP 96:uSDZ/I09Da01l+gmkyTt6Hk8nTpexv3ti73R+xpUDii9c:uSDS0tKg9E05TpeR3a33LC
TLSH
T10DA16BEFE604A88BB9493E500D9F1243C3B5036483DA3A74B5E220EE9425D072F134D6
MD5 SHA1 SHA512 SSDEEP TLSH

skin/feedback_bear.png

SHA256 21424ac53ed4164d9b1ce7bb97b32296b2dd5abf761eabf7487e18290834f379
MD5 de3b6680f4dfc98149af66406639fae7
SHA1 e233f90d0b8b718479a8cadbe8aaa7b37ef9010a
SHA512 e8805ba5fe86d6b3014962fcbcffd495b95a526846bd25f17be97522c71e99777594e56ba80c13c9bb002ca01125393469d71ff55cddde046322e54c7a59c5c5
SSDEEP 768:w35rnbunLXR67dtH6wdPGwhYqmdYcCslKjfOnNRw/0k:ounLh673/dPC3YcCKNg
TLSH
T1ECE2E13D462A434243A567C0AECDE253D73CD1FE6D52FB06CA86E9F2E15280255CA83F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/junk_text_compelete.png

SHA256 caa702e6286a9d626d03834a018e068b64b1e66d60b5dc66456e5366233ec5ef
MD5 d3c36b8facf1be5d34a05e0edbc5a4b5
SHA1 9d04bcf7639685c29b0f9c3a54f2005edc3792b8
SHA512 55a3983198441c8336ab57a88dba85f83183aeb2620136f78a37fe87f04c5c5e0da2a88c9f389e818cf1435ab4f38264d710bbba3f479273f370daab916cc4f2
TLSH
T1CC616BAEC86094CEA8DE36900DCD5A05E76D52BCAA62363C90C1B9DF40F9E075BA9471
MD5 SHA1 SHA512 TLSH

skin/pic.png

SHA256 8af6df92769428cfae963f50a0483f41cc258c0b4418301c027dabd0389352d5
MD5 947a03c03ac494d730ad6ec6392f4b4b
SHA1 64d2ec454cd54b1cdee9edb830ef468d508caa87
SHA512 4a29b90e3aea5378f3b79dd17295b0098f048e44d1d122be6082149c4170175cc161da46262d18b29763c0b29d888375e22a945e61a512a586a7443a81b6101e
SSDEEP 192:sps1bK2jCb9384kBZESaYtDquFHZLjRkJhevAXg2SUa0QwcUlyYISBV:6sZ8h38JBZE0tFFHZKreAg2+UlyzA
TLSH
T14422CF38536E9FB831BEDE9341C0429136A34EFB2C63B31BD218992B523212B6D4A465
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1028/common/common.bskin

SHA256 0868cbf5b82936110fc8024cd5edafaa7dabd6318b33f62d213e8a01c68f46fc
MD5 abf77184d1efcd787073dce69b3342cc
SHA1 bb2a3bd765906282b4296a072d1c2bc382ed1f3c
SHA512 4d4d79526939d2da4547d2bd18134e31299cbdbf2b3dfb63bddb303665c3969d5460cfb032dc2b600e7102ee4a08f2287b52d1430ad8bfccb0dd3c2b23e9a213
TLSH
T1B5E0F15618768425F984047A9860128B4050EE39063A217F155414D3C86489808B63CE
MD5 SHA1 SHA512 TLSH

skin.xml

SHA256 fdf9645c4956ae75497cc229b7c0a6d5635b4e272e07017a079691494f21327a
MD5 e838d6b7cd95ac185923a55a31cff9d3
SHA1 48cc0b2e914bc4ccd72fbec7ad58f7af82b07eb2
SHA512 46d158055cc896f2b0d8309777065ed6192a3c5802f53a3dd2eeb2f6809121aa556375e1a94ce274efaa460a5634b7ec09a6a8d9b8b8fc28a7dbfc2f062e5984
TLSH
T16E018B743DEFDF588EA11B74778699188BC415C78216028C7A7E016F4F73C9E0033646
MD5 SHA1 SHA512 TLSH

I18N/1028/feedback/feedback.bskin

SHA256 9b043feaf28b8bc38cf112f340531ba0120601f1c4a482e6608d2bf9a6e5feaf
MD5 fe4594114acc6f35a14702109f44a271
SHA1 ea81d4e4218cc80cbdad191e1c7d999748d1277d
SHA512 cd8f2346eb900508f6a2d8bfa7f2734622c0d676748cb73e6d5be36e9554d9e307b77146bc9bd4abfa9a3e94c734b009fe152bef00056c4dfef6c122510be349
SSDEEP 3072:kimC3Av6krDjETp459AYZI7GFrdxQMkGZgsD0qR:kimC3Av6kbETq5uUI7GFrWGZrR
TLSH
T195E31295B1F82E708013E40E5C6D93B043A5E65869288DC65AB0FCF8DF7960ACA475EF
MD5 SHA1 SHA512 SSDEEP TLSH

skin.xml

SHA256 a186f98025d38ebf99c9967e453a52d6ddaa39a15cc8112f26a62c775fae3064
MD5 573525ce432e3a0d82b266c233db2519
SHA1 c4841f2bb811a21d66dc3d172ecb2f387c3789f3
SHA512 5a4e8bb8e50464dcc639cbda1f6a34a42ffd503cc6f5e4e1c9ef6806e4dce048645c0cf8e765e6670b8356a7eb379145d66d403e5ad2381f651e39c9ab7d81de
SSDEEP 96:Wer/bFiBGXDV86ymeYpISTOyovTdJWrlEfuehKJzSdZwjYuvhAu6ezxCxxITIMnR:pfABAa6BzbOXduehKJvSBeaIT8w
TLSH
T17832C734EDFCEF988851AF703B99422408AC258F934657EC7D6F88989B2FE1407722D5
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/feedback_bear.png

SHA256 21424ac53ed4164d9b1ce7bb97b32296b2dd5abf761eabf7487e18290834f379
MD5 de3b6680f4dfc98149af66406639fae7
SHA1 e233f90d0b8b718479a8cadbe8aaa7b37ef9010a
SHA512 e8805ba5fe86d6b3014962fcbcffd495b95a526846bd25f17be97522c71e99777594e56ba80c13c9bb002ca01125393469d71ff55cddde046322e54c7a59c5c5
SSDEEP 768:w35rnbunLXR67dtH6wdPGwhYqmdYcCslKjfOnNRw/0k:ounLh673/dPC3YcCKNg
TLSH
T1ECE2E13D462A434243A567C0AECDE253D73CD1FE6D52FB06CA86E9F2E15280255CA83F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/feedback_ok.png

SHA256 b3eaa232d2819c0351d5a06e9822ab90d5f056d71869e62365d697fa7d25c647
MD5 d6ed0de52d4adb6d43bd9be419193e0b
SHA1 a1b046069d114805eb323d2916616b1671645c17
SHA512 15e991f5141e0acea2b6cfde673b86391e9806c4bd93be8a2309cefd6500275b56d18ec3ef7b4c8699c244950a65350a15ceafb3a95c261dd7548083d07c2abb
SSDEEP 1536:HRwZ9eNux+HJNKx3yOR3nCqfWnXa+z/FY1nzqBvBOyFagTnf8zZW2Ryrsg:xtNux+H6X5BfMX1zkzIOzcfwKrsg
TLSH
T1539312722400C8798A7F7F50BC77C68E9F16A666C6D4872EEBCB5F0B18C48188793791
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/feedback_welcome.png

SHA256 f9965d5b3aeb470cb83d6aaa31785262acfed15a3bbb89b0c1ba2688f47d8e3d
MD5 b3a0592672a0f5eae5e2eb4c3b7449f6
SHA1 aa6ef05fd4352c7b70ed43e3fc4a20ae9d3f4e9c
SHA512 e32f7d1eaf5d13c1189246e6e32fafed0cb7a01992faf7048cbb7401a03f3159776fda38b1dc89e84eb7b38f2d5f90f053f0c8ab19311c1bad593e900f41d3f9
SSDEEP 192:6VcNf8g8E0bu8z6AigaI1W9SAmALVIQ6eMmvXqb4AEtmDHyDk6CVSuzoZaG9d+co:PNf8g8U06A1atSbsMmvXqcAqDk6CVroy
TLSH
T1DB32BFEDF10C3DD8D2668DBA7FC60D8CA47478274050FA28F869B1E8AA20537E612225
MD5 SHA1 SHA512 SSDEEP TLSH

skin/mainframe/tips_bg_taiwan.png

SHA256 e260e2c755b64d70150343ca82d3e5312538f1ee74aeecf4b68c00df7c1e0b4c
MD5 462f7d77b848bcce80fb3249a4e6b8e2
SHA1 1757a38550e7a3e80b12b8b6aeb6e1663ad5ee89
SHA512 01106c325196af3cde417c5dce2e9c69d8648ddbf31d65016f2a123ad0733b2c464c36f9f78c27b30f6534edd1125a7c491fbfd4da424787f66a6f7f10284941
SSDEEP 192:kWH82ZOqoalmIQP4rfaH14BK+KNo4ZpMFNLRyy4bWUqo3svDEhUotvBI:HH8HdPgCHaooAMzwyyqP2l2
TLSH
T1A322AF12FFD81715A3CD4079257BD377CE0686868A18F2117DFA939E7EA28064D8A05D
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1028/lang.ini

SHA256 0cfebcdd7ec2a68b96eb205946195a8fbc7f304c9e3ad26a8fc40d7b760f5bd8
MD5 0507694bcfb506b279941a5d8b287d01
SHA1 36b27934aeb9b1663b6a3f1c8c0336e043579218
SHA512 0d3d213bca2b289c9b24935daee6ecab7a83d1e8989d4b0211e309e9068d214c5a9cbf13186f2f119932bd5a4e595f0849e8aaabc2a002b3536939b89dc85e2e
TLSH
T1B0C04C06A3E9104CF5B35D44FD76E8941AF5FC65240ED11D9581110E09B1500CD57A73
MD5 SHA1 SHA512 TLSH

I18N/1028/nsis_install/nsis_install.bskin

SHA256 baa869e799743358089604d2f896084d786e7711bc1b81f426cdc5dc18cc4b5f
MD5 fdec06ee07623954a9f9251f0e743346
SHA1 3f829dee699903967d915ba51fee41c764a17581
SHA512 4b7c0d8083806914f48d089dba5607fdfd13d64666dd49a62db3c1b390623a105c52234554a3d69279ee911ebe67bc753350b66328b1e5897585b4f56fc29d70
SSDEEP 1536:LaNQPKSitEKnZvrXOvOwcEvz0sy1qfK19Qo39bPfF:LDJitEKXaYN1h9ZFfF
TLSH
T14E33F1FD323D89266F08283D307E2DF89D6B54688799CEA0F70EB9D9D902E49900D335
MD5 SHA1 SHA512 SSDEEP TLSH

skin.xml

SHA256 7a46e9661c4ac0c74e39cf7c285470988a66b75239d686d9c79295d6443f9006
MD5 09b52202d1ade4a9513fc07b36080c87
SHA1 46e006d045f926b765d600ddacc5b3a8b7b32bd5
SHA512 8d8af3aba77f07f87648b89f0227f4a3837c4bb69dfcae3450f6b51ed56426b58e98d8c20bbcf4d4ed019ef23336e59e5f9c4c256eb057f9cf9109b83e3f0c67
SSDEEP 96:S+nVkB2eEdPRd1w9JD54y01AAj/wov+jGKnttLhd1sDoK+8MwjJ:9nC2h+LEAQ/ChtLd1sDoT8jJ
TLSH
T14F2246352EFCCB804EB53620BBE6519898DC55CBE25B65E87C2C749F9B33C08167721A
MD5 SHA1 SHA512 SSDEEP TLSH

skin/K1.png

SHA256 00ed08d843e92f69327fce4f2a550db72ee23859ec56f24a85f8f9bf635c7862
MD5 8d97c5698f01289ff2565bebc6dbafc4
SHA1 980795804e20516ad06b21c69d51ba9013656464
SHA512 5ff91a62f8141b3b6443d098545a290dfdbc87b0ea4be328e73312338aa8eb58cd9c9118f53a58c703e485a21083e5f9972152fae6a7f0ca4625ac336d6e91f6
SSDEEP 384:b50wP0fplF8WYwltL58qHZoQalyw5yAXALYQ:tB0rPYYZoQ7w5g
TLSH
T1B952C087DD484951B9465FEBA8C52C084838C77050EDF919EEEF9246F73E270A120B6A
MD5 SHA1 SHA512 SSDEEP TLSH

skin/K2.png

SHA256 4a2214e5ebd3e2dba5125961c9064d1d60ca6a8d4e60cb67ae57bfeed8bf69ec
MD5 b540404d5d7c0018bb3964bd6ae1e59e
SHA1 fe1010cff984f732c882073ffcbd543519f339cc
SHA512 eee5e64139a03a67b265f4fcb4f79bba63a8b73d31664be3a4ad882036cea5c9a7f611057d37de123f3687574b2961d5c3951ed2e92cb619bb8659843c352b0d
SSDEEP 384:b50wWWKM3WxzUrXnOzaoJzj3yG0bMXZmlg+9BJ:tIWKMGZ8eJNjSg+XJ
TLSH
T1D652D18461E0485E1A2D4DE8B68B518E45E3464491DC8B7CFAF901DBCEE3D913858E4F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/T1.png

SHA256 16d71bb923b1e1f407c9e277cdd5b5bfaf57e150d63bde860a5f51c8b86a33f2
MD5 cea9ef768a6a5611ed7c5bed07bc144c
SHA1 8f40c193b745345d83b0a60d31c917486d2e9356
SHA512 dc29bd759058d908b67e0ab89b36ea7f9605f9912d8e9f7a13539b7bc539924bbf1df0551249bbc204066f052dcc52106499e39029ff660b4b87c7f24ad5456c
SSDEEP 384:x50wxk331Aw4gIVu5OEJZ/mD1Le+yxSs6lariexaoW:zkHW36OyK5ZxOW
TLSH
T1EC72D095CCA5C0214B1D02A43D1E3715C33F1FA1AA762C98BE6BA45D07BCE56EA1538F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/T2.png

SHA256 4d0acee551ab7621aa26d1bf5ac15067fbaef913667091bbc372b4be9bf27997
MD5 c8384e2341a48b6eb86ea84f00e14b6e
SHA1 3919911110074503bd62e309353c226358abe48f
SHA512 75008c68520cf2d9df591c960b663ee65f1c0b5eb8eab212fa256852949b054bb457b79f65191b4c237a017eeea87e0ce6ddace489ffa8aa0a502bee546bd025
SSDEEP 384:m50wnJun9bWWR7rqvCSczNmwgAjs6/T/QXtLV6X76:86bLdrqqS88wg8sq/I6L6
TLSH
T16272D19EA683610715091F6D2F1ADD134A2B8861C68B14ACDE28410BBE86D215BADC5B
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1028/popups/popups.bskin

SHA256 82ca64bff201f86296adca1b1206580af0b129d4acc6074f0c3609d48c3629d7
MD5 8ac25cab26434980c32bfea54d065117
SHA1 94d1c9dd9f2c7112995825c0d43bd9bd2df65a0e
SHA512 cec593955ed7216e4d9048360abf17ddc263c0e33d27f0ff923696a955418ffde710b3442876b10c7a9fbb3f3745c0de6db80b899bcc82dbd56036c0abc10fe3
SSDEEP 1536:ZUR6Lh+yuDY9naZ08bp9KyyYGJSkdGceoU58wgMod2b8DkxqjJ8J/8:KYLoyxRH8zKyydSkwOU58wXfIjF
TLSH
T112A3120DB1B865D3C214B94967FE6764D317A26A30D7AE82CB1985DD8EC21FB410F2CB
MD5 SHA1 SHA512 SSDEEP TLSH

skin.xml

SHA256 417e71872cc13ef646ebd4577a8b47e549005fca55132d21e1e00551e446b351
MD5 8fd37facf6392c3f0c6fc5631c27ccd9
SHA1 f2baa1df6fccea79d738f0ccdae2ec32c40a9ea0
SHA512 7cb6a4fbe8ad53949767cfd917881ddf33c2c921d1dea076f9bea83dc220d2b3775be12dad2feaf27353416a97f95998a23aa35890f6bd34b95ed26971b99944
TLSH
T10C01F7347AF8D7E258459F303BA928405F9692CB522A05DCFD2D80DE1F538490A727E8
MD5 SHA1 SHA512 TLSH

skin/lottery_bk.png

SHA256 4bf4995fa348c35439f176b2d5cfbbbd286d8dae9ef3389389882e03192a2982
MD5 4986ae9ef8168eff19da4aab7ec63861
SHA1 9c4a78e8cb89c49df8dd7e84ce32575c63c4d093
SHA512 e72b5ec1c655dfa3694cb18037f476a08d9f675927becd682ca6e7f25102bff483690f17ff4336907bbda9bf22e26fdafa52f114ce404ba9f4cb940e148877fd
SSDEEP 1536:6eWuLlBCrG3rGb4lj7A9Ja9702f3t6ntpNeOvMMLImjDnOHHa1ad:6eWKlBE4JyJa9AS8ntpZM6n0HyG
TLSH
T1749302D804ED15398C4307E472EF285153D583F40A1C6D4A9B73BB93AE584AA13BFCAE
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1028/screensnpashot/screensnpashot.bskin

SHA256 41d4879a0b73fdca33bf4f9c837f36e1f023d93c0f04f13d3818a2fc31d04a61
MD5 1472be776026edf0a8b1abf9b54d12db
SHA1 3c7faa8cb56df8e887053aafe2abdb5a38341137
SHA512 3d47b4ab4bff911397aedac570e0e5a04711d276d34265026b14e822717d2dc916e74628d1ad827c0696d5b320bf52a36a6c7328ae416e8d7168310f1a1c7bb6
TLSH
T14B11C80597986607FF4DCDB48295AADE0A676F1CC230F611598C49A5B4090C5AD7E18D
MD5 SHA1 SHA512 TLSH

I18N/1028/tools/BigFileCleaner/BigFileCleaner.bskin

SHA256 0affc163aaee724dd58fe68e5096dc5caf5c5a694a7dc67418c4187674550aa7
MD5 7a5942c46c49102c8281621d75d99b5e
SHA1 5eaa3220b45301b687ba9457d86fdd09d00866d3
SHA512 95894df51ab6954d2502aad0c080d1c488043ae21d920e420c7c37b4db7095d109dcb8380e92a6e023dddd6961af7e6ab2c2ae91cc8e7287e911a78443a3368e
TLSH
T1DA210A571CA47947D855883DE87423B0C74FC9324102FF9DF1D47C572CC196041E1EA9
MD5 SHA1 SHA512 TLSH

I18N/1028/tools/FasterNow/FasterNow.bskin

SHA256 b604b170fc48d2df5e97d5b26ee6a2db30af663a8ae2c230bc24bc4aa518abef
MD5 58edf1921da116f545a7a1d4dff09de0
SHA1 a9f5475b1e5f69fb8a5b514047fd4f9fb3fe0d92
SHA512 9738e83e3ee3381756cb29f5f7502fb72277d5428d9e1672df1103305999153304ba3210eb9b134f3986460c3dee91a067526ad29cbff5fbc547f41714516a17
TLSH
T144312D695181A1A3CC4033F2EF761712884B98966200FCF2F3D4BFE9927642277725D8
MD5 SHA1 SHA512 TLSH

I18N/1028/tools/WifiSharing/WifiSharing.bskin

SHA256 c8539ee993c157b66ebea665fb866589ae912c308a21a74ccaf788c1d32acacb
MD5 553331044d7960673dfb4f09aa9cb24f
SHA1 02ec8f94e07b670b2baac231ca28330d6b2da352
SHA512 815bbbcfebfa411c50d44ed06ab6defb1202f7d6a4f3caa0f231fb0ad056fc1392d0154ce7bd33d0c36192b1b6e13dc442aa1960a641aef4f6d0c67485039bf0
TLSH
T1A6615CA710ACF686A0FC99B03D6B50F265488ED4A980527CE4538CC34DE97E847FDBE5
MD5 SHA1 SHA512 TLSH

I18N/1028/update/update.bskin

SHA256 4e0151e871c8e874836afc9599e142b8ebf5cbc08fe22fc8ce0d5302db14143b
MD5 5fa801c1b0dcc46edf071ef79ede5a7d
SHA1 97af46febb42599a0f8300751599d1703d0f5889
SHA512 c7679be8985aedbbaf0f53329df1d0995dfc3adcb95f0d7fa44d6c82832f059d337dcde3dd37354006c21c54b81679fd794c55f222a07279a9d549112c269abd
SSDEEP 384:QTE8G4C66Qw8U1FLCygV5vMIRJDYvissb+MrmUMT7:Qi4C66Qw89y65UIdJblrmX
TLSH
T17962CF19D2A557364BA8B1627188B009F89FC2B364D303DEC15390B7DC4BFF859258B8
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/BCloud/BCloud.bskin

SHA256 41adf2546f9200a754c47b3ba3fbc1dbe55697cb2feda5f65b1666b037ca777c
MD5 c7a8fd1fa299824c2f40816ba968a024
SHA1 4d017766400e91a80e4fe89734d90d7013d23ef6
SHA512 d6b9be4887fe2ada000d63ca070d909e0481f05479fe2881e1ab325719fa2aa11c9964d9a0cebf44fdf11fef6d4daffde7c90a19d30e727bfb1e08b8ffc6576b
SSDEEP 768:2ZOA7K/3y4ktmj27edSEFw6qnc29v5ZNIBODFcQ+eg1C98aGl2:24IK/i6jNFytHNIQp21o8aGo
TLSH
T1FF23F21E7C9B561A9B9337E171ACE9B3D457086FB50993F881FD534A00186CC1E41AFE
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/BaiduSafe/BaiduSafe.bskin

SHA256 98a2def611983602bfe55bd03857168c17ea877e4c1897f35c65f6c24304fcd3
MD5 d5aa6733d8933ae2b2db792d93defd76
SHA1 1d6bc521d09899ca305c86a9eea3442c70631472
SHA512 ff9670d02f79da63cb274432d8154801c6f87ae587cb44aa028b6cf60d5035ec3bc645f5df31a2d70c71d44a5ddac1bb9b91db56259f38ebd186511bad6760bd
SSDEEP 1536:U9cOgPObUDWOIFHe7Pq7EBaKQsfn6hP0PHnlTV1Jgd7U/viLIvOXPaS2lniB7SAr:XLYwPmluPdVo5UiL2q7zEEUK9Bd/
TLSH
T1ACE312F2019CFA2BADD0CDDCE7C7E61023E78D5AD35A13E6F0689F755C4880BA251896
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/BugReporter/BugReporter.bskin

SHA256 f5ae8458503dd296f7757dbd52ac0561251c8a6e99fa4910cd7401bf7057676f
MD5 550ae613d396e6f57461483763505cfa
SHA1 e3d06b7393cb84abef5b06dca8d95e0f38d2bba0
SHA512 f9e935c2969766ab98bb0e0819fe8f343fe91224a82a33abc13764d575f7de46a0b4d09590458c60fcbc48c61fd1b7e969e666003db130c6de509d8ba8e224c2
TLSH
T13C11B7F50CC4EFADE5DC89F914E65A4AE1DB483D4E40571C5C8E4C83EC868739859C5C
MD5 SHA1 SHA512 TLSH

I18N/1033/PcfTray/PcfTray.bskin

SHA256 c306fc3063143d408aed90602af89c662747c46187ff900f26bcd0f28b91c47e
MD5 5d0bba91a361965a119ff5162d52421c
SHA1 ec19fbbcc9f4d54d6d31174c7faed98184f661e0
SHA512 52199976494ae06bd4c965137bb544e392253cecafe3750c4d94fba2bc6eca6310ac2a785aab8129abcd5047fde21e54a0cb852669e5a71e4187b674c1ce44c2
SSDEEP 1536:WlBR4cZlXYLtUJDFqH0GJzlf9fg4zVvkLjobuI:tcZSLtUxFqpJDaXzI
TLSH
T18B430279918595E2308976C6B533C9ECB40D7CA054C2B66AF0DE51ACD1C77ECA4CA0FB
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/common/common.bskin

SHA256 9c43780088d77d21c9bc8b7a6f0afae2caa53a286aa52b16b000207cdfd240df
MD5 8a2b711329dc53ede424fc6dd27e775b
SHA1 ee24c2911381c5e2f7124a2dc7ca58c46ca9f5b5
SHA512 88691914120c064fac7b589a2f701a0a6d99e5daeb646f13b8907bb86f0787b4f9bf6356f46db66ea3a30c9ff8de502359fe1040520942ba1427b24f9426e754
TLSH
T18BE02805114E890FF95898F5B14D1E0257593DD77035CF7BC5C52943DCD00E4847D947
MD5 SHA1 SHA512 TLSH

I18N/1033/feedback/feedback.bskin

SHA256 e47d5e14c4f9a936e2108fc5eb0499c4a474ef2fb38017cfb4f7a88a8d8f41c7
MD5 eb8b9d7c6916667b6b62e0026da08385
SHA1 1e8ee6a198a3b105dd50cd96a1a4c66d0a79f8d8
SHA512 842f2e7ebd38e93a636687f24163a00d66559b9813add1cf55c2ebbc38221e6684ce4bf2059fb5c321b5d0b5ea5363691489939857f6ffb26d7f34e7e7688be8
SSDEEP 3072:Tq9Tmf149cqRLlaOjt3HPQBC72WN2+MoY2bj:cmf1A1B3v12Ww+MoYcj
TLSH
T1ABD3124D37C6E7D93D9C5879A5F09818F84DDFC2A85AF343BE13E38A262089734BA140
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/lang.ini

SHA256 17ca5c781f450410543ae581f38203d7f6ae9f7c3cb6c9ef8b9cbd64afd926d1
MD5 e818c3310ba738c93a2b298d874ea1e6
SHA1 5fe18cfc20bbc26208c964ca4d9f74d174a61c82
SHA512 059fa394505176b997d9c15d7c04f2e351114a9322c235a7ffc07402cc6855a2442c0efd8bec5dd36464da78380ac4d7cc63d169374b38d471928c3563b6183f
TLSH
T1B8B002119094520CB5B3DE40FD26D5D46DF5FD655816D1182545510944F1604CE165F3
MD5 SHA1 SHA512 TLSH

I18N/1033/nsis_install/nsis_install.bskin

SHA256 57216386d29dc8f03626b89c9c9cae52baa1f5e9a9cfda5ea30bcf37fa11125b
MD5 291a4345164036245693d4fa59ad9342
SHA1 f7680987dd3269d393603aeeaecfadd3c1824875
SHA512 4bec48a437d47d8a3250193cf94bb1d94c6511f5dffd9898ae2908626f3708a16b03602c9a7259c211045d3fcc38b371427aad0a799fd6b175afb6961e21269d
SSDEEP 1536:caNQPKSitEKnZvrXOvOwcEvz0sy1qfK19Qo39b3aN:cDJitEKXaYN1h9ZQ
TLSH
T1B53302FD223C582A2E08283D207E59F8DD2B51688359CEA4F70EFDD9D902D4D600D739
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/popups/popups.bskin

SHA256 4241a5c704d79d30dc91ec2eb7dd362fcd11918a7378a440818a73f4bdb5ebd8
MD5 674c17b1c465367417873c4d4b62d4a0
SHA1 d1a3d9b3693e32870953f3974249144985627744
SHA512 5811fbd9ade731ed5a8d21a334a0ce73d53d3b1d90c42fd70843dc18918f767b71c7b10be675199298152b881d2553f5fdd39405dd9234bce84bbf67e2559f83
SSDEEP 1536:4UR6Lh+yuDY9naZ08bp9KyyYGJSkdGceoU58wgMod2b8DkxqjJ8J/Kp:hYLoyxRH8zKyydSkwOU58wXfIjTp
TLSH
T17EA3120DB1B865D3C214A94967FE6764D317626A30D7BE82CB1A85DD8EC21FB410F2CB
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1033/screensnpashot/screensnpashot.bskin

SHA256 b1ac739a998419eb5a9e53d06ced3a929bcda8b9aca38289f766efb2dc856bbc
MD5 28b23d8332c8fb0528875a33dd6be384
SHA1 224d48d42d32972d5aad380c03f4fa4b8df37303
SHA512 a4c1bd43f11c230e93f4c664baac721040b938b5a71bd81d536209bc6a3e9ae153fcbbec4fc1e793cf0e4622f2ccc4dc5d73d885b17c5b7eea1499e057d9d6dd
TLSH
T1E91194A365248F52D840F1F016C1431243423A7232B88DBE8E352F7E2D4B1D5BC796A1
MD5 SHA1 SHA512 TLSH

I18N/1033/tools/BigFileCleaner/BigFileCleaner.bskin

SHA256 a7638ae7ccb6de7db574e2c76c81c2c69da1f66937c195d8f20c92833ed4a7f5
MD5 e43c8c3a9b94d276b44ea507a65da135
SHA1 46af40c9a9e42dbb634a66a98014b4ee8fb606d0
SHA512 91f03cdb5ee183ca3ad44f8a7d734edeff3a1f75f986abf0d524bf1ff511d0082f52f4bcd1d7edcd51b6e1d76fa10abb785057fcd2b5e6583da11d493906c209
TLSH
T12E21C68900DEF113CED41F7340B2A0960319B9A38831A72A532C556B28087729CF1D9E
MD5 SHA1 SHA512 TLSH

I18N/1033/tools/FasterNow/FasterNow.bskin

SHA256 bbdc0ff6de1e03af998cb25a657e9b0c43eb6d319daa9b94e9973ffd95d03206
MD5 4d7c610e964a3a65576ee8dbdbd21815
SHA1 bdd024952b7228b5d91480f4a5a8bc7dd3365763
SHA512 ed9c68aff51a418eb4569a3b2a55ac77598d7489d47106da48292c2c191b3bb1d5a5856ef8a0e7b0b4a4b46911a18670ff9baad3c0d2a6eb44079144d767356f
TLSH
T1E331F89647D7CDA7FF2A12B65F161C20B3A6868AD5538A3BE44678C23003110577339C
MD5 SHA1 SHA512 TLSH

I18N/1033/tools/WifiSharing/WifiSharing.bskin

SHA256 5f5beb739962128dc647782b03f8d0601ddf64b25dc634677733b7f803ea4fd2
MD5 a6ad958227d5d187ff342fd220c1197d
SHA1 9ed6407781238f169894badd9dff1981639a74e8
SHA512 6a16368ddc0a805c4bd155e9695b8895a270834c33d3e83b8a14c483499f5cd85262f648ddf0409cfc297ee66b4e9be020e85b2ebda8a7ae7b4923ae7c00311a
TLSH
T114514C4BD90B4DA6E9E0826170D3D6421464D804CE1FCA6FB373EC4758D1D2E9233A8B
MD5 SHA1 SHA512 TLSH

I18N/1033/update/update.bskin

SHA256 317a121ccdb25a11e6e1c83468a45c10e39af86230dedca2d9844fb791211889
MD5 f8ce9da20410e350b5d39bd46202e216
SHA1 aa544fb3f5875f844a0935c71fcc101716da557e
SHA512 a25a5e0b2803b6c8a7a1f25befdaa08caa8d8959f74558e7caf8e0d3c5785ef6445f56ed9e43bfbbd9b4497ca33a193e260ee83d5e670014da7daee1690603d4
SSDEEP 384:ttHYbb9YqDYb472sn1iL9dDXeV0esjmqmuNGXfvKY+:txGrD247J7Gjmgei
TLSH
T1A652C0029217ABA4D9F78D1173E1A173C85D18A092CB5CA970B86343A2BC4EB6E418E6
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/BCloud/BCloud.bskin

SHA256 864067aaac99b165e357199dd88ea22f5f9a02f4e96786202695d1bdb0921d09
MD5 3f449c810a3860f1b0afe184efc407d6
SHA1 c77dc6249aa9407fc567c8258a51426533b22ad8
SHA512 edaa5ae73356906e7246b829bfa34cdb00537ee0d713c2fc7c91c2dde5b44fac19b94fa671bd980edc2a723d2ea9379145beee6e7fddcbbf629517f93a7cdc63
SSDEEP 1536:l9puwEFN/1mjETAWijyc9B/Ug3EgJPnGed:NAN/1EE1ijv13EeOed
TLSH
T1AB33F22C886DB5B0AD66428F5E63FCDE2A56EB3254EF19E51300F394146DDEF0A080F6
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/BaiduSafe/BaiduSafe.bskin

SHA256 e386734a6d647169d8b2e69f34b08844860aa0aaa6f85ab2942c5c8ac9637d6e
MD5 b06acce1b3e2cac34f380c3257714deb
SHA1 abef45429a4896ba3b7272ac9cf8b637c29d4fa6
SHA512 cab666ddad956567f6cd363123c5d10ffbd4e102ef8e33089a0a51221b0bdd0bfcbb7f6a6ae58268f5091a714bfd3c1ccd826211ccdb09d4c359d53d8d2ee493
SSDEEP 3072:XoyyJd5HArVlU9ND1JX8b2/Q3lzGqxTA91:l6Qrg1JMbaOgD91
TLSH
T13AE323F431DDC283256D149367FB378316A20C099763A86E59CE60C5E56E27F8B20EF8
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/BugReporter/BugReporter.bskin

SHA256 bed16c047a9491bacbace856ec1d2502ff98f7ce99f1bf23c7463afcf1f52fcb
MD5 f97feb8fdb13c143c829fc94670627b2
SHA1 83c3d07139a280005a37498327050a3d9a643fc5
SHA512 f98137a6d704192134a2b8eb7a2c3fe8ecfc8b7580ae0e4376cce0d479234cc38bf5c057542699f4f6225d1d6d41dd9633c629a91bc60fda2ea29269af80dc4d
TLSH
T11D11C812204A5A0CAD25097B7A656AB3CA07F2F913209367E5033D636DC3286C0FDEDB
MD5 SHA1 SHA512 TLSH

I18N/1046/PcfTray/PcfTray.bskin

SHA256 505f9cc90d451bbb5ab717b2a43f583a4e23068f474821636b6bf6861b0e6d58
MD5 f240c7b645b03aa79da3408d37fcedad
SHA1 a9f012252ad6aee1a59f836637d922f484618cc7
SHA512 ea094001a3313768fe262c0fb7bf9be76ae4d6bb14ff65f7eac28f2483f75cbb2a489f360b08684a8918e2205305eb5f3ff5d689a9f7c52185c4cd9abb2933fc
SSDEEP 1536:9vIbDNpT2nm7934n0S07b+wuBcX/PaE9MkuZEfM3y7:92H2IF4nF0h7/SDDEUO
TLSH
T1EC5301CAA2BA74591A709C9E2F527447E13E2287C63B59FF953C973DB4C0B4CCA21E11
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/common/common.bskin

SHA256 f6b50c2d3e68978b9d244ccfe930e65385c9f5473c34ea2ef4b5dfc54274878c
MD5 3bf0fcd7611dae6d753b26e17123dc5c
SHA1 a0ff35ce2e4a5ab8a00388c1e0bba9c7351ee775
SHA512 f4d7f17d7214b0f8f1e19ab9fa9625d91611883fc8c330c82ee3dc59d0b5d409e48746f0b4b9ca22cdeb677d0c4556893163e6d193a6cbda699c83585e038689
TLSH
T12DE0C05C645DA506FD40C5F9B15B2F032747FC3A2018DB2761A13E638C4049184F798D
MD5 SHA1 SHA512 TLSH

I18N/1046/feedback/feedback.bskin

SHA256 1fcf51e80433af24d7ec8369c86314ad2f698d664796595ac6f425343fa612c6
MD5 f9dd2d881df01ae4084fd26f37e874ce
SHA1 9e0a5228eebc87eba567102ef15aba09dd8c6834
SHA512 222bf488831e889458425e6b4453a8f98ff5ac5e157a1a47a39d6a09a9f5151f370b1eed3f074c93b878a077fdaf2f19f098754b44b8abb0f7ecfe8115a067d5
SSDEEP 3072:fRqIZ/iyoJXauNMMc7cu6lW5MYjDXY4pWvx931EfWx:fRqIdiySXauNMMc7Y+Xsx9lEfWx
TLSH
T15BD312163724DABCAB989F0DA388A339CE79018F4BD1036D3E20655B6DA73717B115CB
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/lang.ini

SHA256 910c8f0771141733164ab060d756f4c4ce71805b692f782aab85858fcf05a2bd
MD5 a9e53e81c582265dd8c87cbc30f1dc5d
SHA1 cd239aff2640f3d47e4926be2907483150afcc91
SHA512 80c61dd50589336db48b385e8d1dd40ea563955b0f0ee4346d572d66008adc708d0dd3eff94b9d94b78960da107f8672d417ee6e1aed9616a253eac638d356ba
TLSH
T18DB09201A1A6000DB33B8811EE32C4D421B3FA233D0AD42C1042115900F00008A12663
MD5 SHA1 SHA512 TLSH

I18N/1046/nsis_install/nsis_install.bskin

SHA256 89717011a709aa5a8d6eda71a4f11c66bab084aa505c7adf323dcc9f2e963cd0
MD5 8a8af262ebfffee7896b4dc70769c796
SHA1 32d597528bf4f9d05d5591b022ad7be2e13457f0
SHA512 dc9781964593b43acceeec50dd1831ccbb576283133cc5f0e503e9d79c0ee395d38e784f63ee63d1bd6c15a2e03aba00e4aab040a11fe0b29c7336ada7df03b4
SSDEEP 1536:jaNQPKSitEKnZvrX+ZtVBpYXmVkuSaaEAfz:jDJitEK0uOtY
TLSH
T19933027C102D331D7F2A291E6A9F28F8B16666E5C72D4E3C77A8E63D9E1290DD00D1B4
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/popups/popups.bskin

SHA256 ec45a707ae0118bc99f36e967ce0fad7f9c0b74edaed2ecf15ab6145580a0528
MD5 03a6816176bbb771e96dde1781fad3c4
SHA1 d0a8c1dd1acaac6e6c9b73e6a0495e3e84b48c88
SHA512 5b4f81b37ef2f07b2167e995fe4016f862c45e1324d86b7f036c178ea1d21ab5422b64dae8de65bca261a5e5e7865d29f65adf87c5a6e4041b03ec3f8fe86daa
SSDEEP 3072:SyP7XSZl3PzbFa8u0VBslnzRVBRLw/jV0:zDSDfzJal0VBQzRV4V0
TLSH
T1A6A3127CCF36D702CAAA6B4A861F27401E55C979CA3526EAC01F703A7D3BF02B947814
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/screensnpashot/screensnpashot.bskin

SHA256 0182c69d03f8f81617b60bd519dce0287765e72be1ffc52f78dff12cf2956290
MD5 a519043feb3be7f78923224b9d291584
SHA1 b53d17c8bf1db6e5c3fc3265f5760cb58eea3ea4
SHA512 6c041fd8c1cc31b3f1a56665791f07a3011025feb7c64c977ba627cb6cc8bb636ff65f4f6718a8d099ac85744de78381e5d469926203323cc1b940c8b63109b3
TLSH
T17A21C9D62529AE52E445B2F05ED2439487422D6363A99CBA8B605F7D184F0A4FCB8182
MD5 SHA1 SHA512 TLSH

I18N/1046/sound/clean.wav

SHA256 65936080b5e0aaa2a7c84fc93d0b729f0fd57b020fbf70843f837f726eae6cbf
MD5 85cdf18b4d1a380103ada33711294f7e
SHA1 982c10e34e428a4fad960a29b7441a23ddb1379f
SHA512 8e860331d0c32d90e9bc84e6631e68d9e482e481c43587f15174b88c7b2239ac226ecc8b9921b2ef6e182ee11af6b8c88a8cb567d1c35345aef4ee6b11953746
SSDEEP 3072:hqkB/kpOdAXM2JKylAA/TQyAt1gcF9CeSrAY9YdYs:UuA7M2wjAbQyAt1GeIYd9
TLSH
T1C5A3CF13F1478241D47B4536CDA2915187ABFB5EBF06062F30AAEF0874A3406EE17A7C
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/sound/startup.wav

SHA256 e2cba4c2e05b79b9785c9f2701907e98fda2c2130ab3466d4499ea3e283303f0
MD5 5c67a1b9f76a15ec47bfd4cc11ea3d90
SHA1 ab7e856a9d383761aa051c3ea779dd913b52893c
SHA512 312e360d355c4968e90f7298411020d8bd46dc69fa9bbae84e16d19a4b3fc9b51cb8e278b70bee79a00cef82b7ce86ee60f2768f525922d12503a149d099fa20
SSDEEP 3072:DX1w9oYpwRYrjv74uBVPbGSoeuwrxLcy5tq2LHPnm0R:LmuYpcKJRusxLx5tfHdR
TLSH
T170E3CF43F2428290D9778536CE93C4504B8ABA6EFF421A2F755ADF8476D3006DA23B7D
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/sound/update.wav

SHA256 fdb842e686188b0a2deedb4f748154aefc0df53e6514e3e4f3cba4f70b45637a
MD5 e77898da52a5774343565158c1c4c691
SHA1 28f3507c38f41440d9da0594a89171dedcd0607a
SHA512 459d8bebcc13da583112f836c1576fd6f06844c3f26e70288b43303561af4330a363612359d64701d73b2e0fc8035cbd83804c2d4f3ddcc34abea9cbb51835a9
SSDEEP 1536:LxcAYUlaqFCUoqInhfI5/nceW4ExEKYqtSHOoDOveqNkuQBvnWUjMH2rEWmc5gc:CDfFgc1dxVoOojqNWvjjM+EWl5F
TLSH
T13883D022F2524525D13687339ED798A00F5B7A5DBE0B095F306E9F447AA3022DF27B6C
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1046/tools/BigFileCleaner/BigFileCleaner.bskin

SHA256 d5cd0b03165a2acada2ff394ecca8e2ea55f3544179f9d8d8056a039d461fc2f
MD5 c7d8dcf35c7b691b693ef6f4faa82302
SHA1 8521698d0b9ad8fea40221e270774a457223c7cc
SHA512 306be195ff10ab7ed2945372c7707495546d4be6de35d21da5b4e9368dbd91730701904f0607875557c71663cb87ec909d6f3b04cf4678172fe2f6e3cfb90ef5
TLSH
T10D21CAB6051FE14EE29A113B04A916510FA78CC07DD0315FB6C2322399728D69936E9F
MD5 SHA1 SHA512 TLSH

I18N/1046/tools/FasterNow/FasterNow.bskin

SHA256 d7d929a9f3018be51f6fbe2320bf1bccebececab801ace93316c1da1607505d6
MD5 9971c848f65ba97be6650c1204f8eda9
SHA1 e98f465837614469a6db24271feac0eb92168061
SHA512 00a062ad3a50cb5c66391b22fbf564b537bb3e2e9885e8a41c89f22ee08d762c62182349b6d09b6ee91fe141472b060f3681f219065451fe27fbbdc49c46bb8e
TLSH
T12D3129C886FCEF12F546B8B9B8D19B971F8902B24C8DD9118C9170A784A9296C0F1E0C
MD5 SHA1 SHA512 TLSH

I18N/1046/tools/WifiSharing/WifiSharing.bskin

SHA256 e7d8566ca4921b69104ba0cc565a4834438bbf8ffe4f0de691f7a4591f42b9e4
MD5 747efc20ac3802cd93d12f5dc35f498f
SHA1 948bc201d90ed84eb26c50643cd38a8236ed6f90
SHA512 1b3d6176934d8b3ccd8c75cdeca09246f28167042c005ed57275b0f55ddc63a492d2073017633e4b647be7360f201e3655e85b900d1c07d99b4b27235fb65386
TLSH
T112618F21DA5C942ADF644BB48ED77928FA30FC835169C1FECA94BBE238E4B2E014040C
MD5 SHA1 SHA512 TLSH

I18N/1046/update/update.bskin

SHA256 e284536fe36fd8c37b1905ba05b03e94c959afcfcc37abf776b3d21c50fae184
MD5 de52f624312ed1f6e96d9971af080f70
SHA1 59696d655be43af9e3cfc39dd5a852fa792eb41a
SHA512 eb758b954ab3c357079acdcf3cc82e8ebb25bfc515132fb831026cf4645cec0dd506956c4d001fbca01b8cb02a354d5a6100ada19ce8e04169a421ecc8ad2f18
SSDEEP 384:+34swGGWKJXd/xCmFlYIh4oA+hcuxMFgfJBu:+bUWed5CmMIrA+muxQgRBu
TLSH
T17452DF563E6C4E526520A9B485FF9E1ACD6AC75CDB1408813FE1CA1870ECF7398889FD
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/BCloud/BCloud.bskin

SHA256 631900e7db7ae55243514db121916a589597cee6638da38372613f05c193fa79
MD5 09fb4bbde915a66a6f5a4111e8d53d9a
SHA1 2fbb12ccbb46d5601fb68cdcca21a8728191467a
SHA512 a6fadf9c8613f2b62c321b37af3fed8748922d7340957de957ffd31f3d19d836cc0501296bc867ebb5c62154a94d601308db800bd350d512c05323b21b17d2bf
SSDEEP 1536:ko4z8OgyxsSWIPGfjO8m818OldnZhRJKcVI:ko4YpyxsSWIcjOundTOcVI
TLSH
T1A833011779D601264D64289D27D692BB2CF98F6535D2B848EA123EFE374CC43173E263
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/BaiduSafe/BaiduSafe.bskin

SHA256 df1d37a82c74d1be29a69cadd9401abdf0d7d0d49c0c118555ac7f44f5628809
MD5 1b3379429630e1f827edcc6c9f91dcf1
SHA1 4f81c602ed8c1b3ca4ff7b9cb3f9bba925d77bda
SHA512 5f1dd1014fee310527598bc20ae06e1f9418c4d466bd1a2186e21ac267d46b9fb2c43710d28fcbdba45b65105a7489d574c2362d411cb37776d0ef6ba91e5d1c
SSDEEP 6144:tKlFUFD5GI01SXesHkOw1MbkhsirBO9iqBpyWePa6t:tGFk0sXesH7waIhXVO93p5ePaM
TLSH
T18F3423B285E6036E6D51ED1102DCB7F03C8E80A554EF870ACF945E7AF79EF9A151A038
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/BugReporter/BugReporter.bskin

SHA256 b368cef40c26d8110084a89b1346ab5346b58109935567939238176a3000bc71
MD5 1dc5ddea7e28b2648f79cbc37c3c9f2f
SHA1 4d732274c49e4030517ed521b35a4ed3aa3a0eca
SHA512 b4d9e9cbe54aa7fd47d36dddf8bbf9e8b0abeec023b0ff26a4debcd7368ea890d1b360fc855f817d46df225fc125b8309a749b3091347c1cff6beed3425af163
TLSH
T1A121C616BA04C90ECBD71EB2EB4F205617F6246765D87E0BCB5571085E8EED88278B00
MD5 SHA1 SHA512 TLSH

I18N/1054/PcfTray/PcfTray.bskin

SHA256 5d9c067e116318e608d0cc521f4f98f6e4598f613a1e3f0a06461c0cbce6fd55
MD5 5511b487cd73a9fe93f11dea7e7a2537
SHA1 87885e0c33428f3252cdf644e9a12cd56e20b5dc
SHA512 da1fdcfe4b02863b6447683884e9bab28667d6803ed76d24033d16d5525af6fa34d75f3b10efaa70c65de120bf1ce8e4fb6c39d0ba4d903e94b09166cfbd3e32
SSDEEP 1536:YO/+Fhjwv+vBEMdreSGeQNIo+wveehT2FHuPltawKIY6:rKev+vBEANQNIoWehRl/M6
TLSH
T11D630289041EAEC5ABB6DC74EF0418D5EF3AB8F2517E84ECB482BBA5258CD50D14178F
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/common/common.bskin

SHA256 b48302c26a6d07b9b755e881231a44777e05cb22f96cb63e0aa0e6d084b132bf
MD5 45fb6aebed01ecb09172914c9b83feef
SHA1 dc7265baee98bbf14b4a383a4ae135b0112d8e1b
SHA512 0ce556045c610bd933e9a9354a86c9f6949550c94f6f3245c277fa95719168e362a04663847a6ca78ad4bd7b646f6dda2867957739901b36d24789e4747411f3
TLSH
T1B3E0F12D108D8387D99089B9FCA12D443702A5195118C35B4422BC12AC81085C5F5746
MD5 SHA1 SHA512 TLSH

I18N/1054/feedback/feedback.bskin

SHA256 6c4a9fac4598f992ca3608d32162f6c4626b2a09c7ea4c5287ae53c5f22b19d4
MD5 91b80c9fdccbef6a416dfe63c335e6e4
SHA1 ac4418a62ea8631ed8ac99035eb85e331322dc18
SHA512 58db2424a8763ffad50f317ad0cbe2b5f336fe4c5e9c5446299141c525e54ab2e069fa02f78735812047e522b3024880a140c69b6bd24c2739d3e4706ce30ca2
SSDEEP 3072:+TEv1PyrNUv4AHfFz34p2Cd6ui70WrRkjuphnKSh9BYjiJYMBe:+TEhypyFb4AA+75rRkqBViwe
TLSH
T196E312D85515C2C05F629953B6788093ACBF8D9EAEC568EE5486EF4A2710AFC5C0CCE2
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/lang.ini

SHA256 d1ec9588e37a2da072d58b5f1a54c819deab47c74c3451902a535fb24e059eaf
MD5 76f8f8ec47b4da5de26ae2fb4880e8bf
SHA1 bdad14e6e65f59e9e69f9ada41655daa34b73778
SHA512 494f68ac81fb9cffd8507ce840f552dc614b33856d41241a3b97db5a67a8b01aeeb2a3e7f44423128da172e9ef709120bef45cece6be8e1f2b660217bc5e1aef
TLSH
T152B0110280A8000CB8B3A880FE3AA0EC3AF0BA30200BE02C0882220200B82008E03AA3
MD5 SHA1 SHA512 TLSH

I18N/1054/nsis_install/nsis_install.bskin

SHA256 c45a1bfdc80f6ee3b34604fff56ececbda0c2f5147b1053734abebc8a6d9d569
MD5 46cdd9961b495087ce0ac16ef06f3d80
SHA1 5ef5616854917d5afa489a279101ee8d2f034bfd
SHA512 acc975208879974717f83ee16c89cb767ef4488c084bf722f7c18636102fccc4093b240171df7012a8315ada5ec2d575e6fffd734f1bf443b2e4b72e8f30e30b
SSDEEP 768:rK/oJdRNQPmN87aK/iZjjuxK3X3JvrySkwxSqz7qVcgEJNTfI+ah7s5vLeGQ:OaNQPKSitEKnZvrXk6Snczc+alp9
TLSH
T13E3302D8743DB92F1E9619BB399A28F941B25EC0C33CDB7D67E4E678FD019DA9004502
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/popups/popups.bskin

SHA256 28253541e5af1b237331f3adb275f7c2499196324d8aa53a2e7c6282055a7590
MD5 b9705aa7c92db8f36e3d549ec14eee5e
SHA1 e0624c742f721927b1663971b31ef65a322a54dd
SHA512 b64933d49570872e8f940ade92fc87eaf770a11644de9e1f3b70c48a5042e8cd61a0bf1f71aaf20deb95e05f583df7641df9edee42534fabd0b34fe42edc03d4
SSDEEP 3072:LyP7XSZl3PzbFa8u0VBslnzRVBRLw/jV8:WDSDfzJal0VBQzRV4V8
TLSH
T180A3126CCF35D702CAAA6B4E861F27401E55C979CA3516EAD01F643A7D3BF02F947814
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1054/screensnpashot/screensnpashot.bskin

SHA256 0182c69d03f8f81617b60bd519dce0287765e72be1ffc52f78dff12cf2956290
MD5 a519043feb3be7f78923224b9d291584
SHA1 b53d17c8bf1db6e5c3fc3265f5760cb58eea3ea4
SHA512 6c041fd8c1cc31b3f1a56665791f07a3011025feb7c64c977ba627cb6cc8bb636ff65f4f6718a8d099ac85744de78381e5d469926203323cc1b940c8b63109b3
TLSH
T17A21C9D62529AE52E445B2F05ED2439487422D6363A99CBA8B605F7D184F0A4FCB8182
MD5 SHA1 SHA512 TLSH

I18N/1054/tools/BigFileCleaner/BigFileCleaner.bskin

SHA256 e4034668a0d2273dc9cdeffc4e9eb088b5f81f974f9bd72f3724c0ba4bce5ab0
MD5 2ef8b89b9658521b70d0b4f7131e3065
SHA1 f76057d81f62a829b93cb4c157493fb5570e5d3d
SHA512 6667c5de63da8ece9a9193967fa8a5c8ce1e1371c5393a68c67b8d221aaf3b54d7aec9321e31e8be43a2eb8ae0c19ec95ffa8b0743e2f52d65932108dd45db6d
TLSH
T1C321D88D0077E6A2D59DB93D403653949301EBDFA132D9EA0862A5C74CF00B195EAAC4
MD5 SHA1 SHA512 TLSH

I18N/1054/tools/FasterNow/FasterNow.bskin

SHA256 105bba7a536564aeca05952957645a1ac435cc5f8acd805ef759e3bc7a091a18
MD5 ec90a601bc3cbf6e6791c4b753070d11
SHA1 522b13b8557fd8f87ed2da023db2f82e78530d62
SHA512 69d62e6fdc9b4cc26d34cd2514ee970e68e0c22c3c48b57edea2902dfd53fe006578924f39548da72aab3e11f097b06aa900d15174634335376629aa278aa6d3
TLSH
T147413C76840C9B27FFA7D230105B5851360EF95AA40302F54D183872C9D68C6723A5D1
MD5 SHA1 SHA512 TLSH

I18N/1054/tools/WifiSharing/WifiSharing.bskin

SHA256 a4dd745b9e954f75ddb7da938e14c406379b1c532206e1f77c09e904a08968a3
MD5 295be3a83cd7169e4e2a31c275ee82d0
SHA1 ce2b40d45607cec41f48ff0b6fa45f294c481873
SHA512 ada50f89483d3c621aa2b0fd8f6cc7e4f9e2d0aae4c06af75f6de7c1a46de593e414b7f9ebf3e0cc346b5800492bb51dade31d940ec4e98ba474d523a75de169
TLSH
T11B714D4F394B250342BB1AF2DC554413DB856D548509F1040AF0EF63888FAAFD0BE576
MD5 SHA1 SHA512 TLSH

I18N/1054/update/update.bskin

SHA256 fa59bdf05559a40a618960251415a6d2ecbded8efc4fc6605d1a41cecd59940e
MD5 8f31996093b84135e498d3c1fe36b877
SHA1 b38c7ad4cf43ab670ee93cb41cef6f46cf25f111
SHA512 0667864c8cf4511ff4f705ea441c2f2ad14d897ce94fd2729e4a7d68a8b55d3db52678270dda6d138a6adc9f0d346e986a4c647771066f3680228a5b0dd1ae82
SSDEEP 192:Ldzu4swF+3/d2b5zZD2ILo9/9/Bjlcjw/QPdZv+SWsunGmq9eVcX2K:c4swEv0FQILwtBlc5DWsunGmq9Mut
TLSH
T1FA32CF421A084C596E18B761A1138E92CB249B0D63BCD2DECB97B4B98DD663328124B8
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/BCloud/BCloud.bskin

SHA256 74636a413bf0ae47d4045c5f974361a43c7e8dc8832982b92e86be9346cd3189
MD5 514fa17c7a24aa802db66f080c0dcf0d
SHA1 f73b1142e0ccd5999e7e199b27ab43a64158d39a
SHA512 dea6ef9d2138fd83b1805bcb40b4718a39536c8509327294b1e691169432c84732e43719c873d4c796ca20020d1b38a81025708101cb96efd3d4a1aebaacdb30
SSDEEP 768:lZOA7K/3y4ktmj27edSEFw6qncbxyfkEuh0dFnt10VQbaqHn:l4IK/i6jNFymxw8Ctt2VQbjH
TLSH
T17D23F25D6CC3380E0BE34F5522AE9C65C6AC182F381953DD20EC9B6E4C106CD1745AF8
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/BaiduSafe/BaiduSafe.bskin

SHA256 5cc0981bfcfc55b56722cc8b4c1387a37603e2eab595d90edaa43b72ebc622e4
MD5 fa6ffec5494d1a211dc31a208b44dbbc
SHA1 1ae89094f8253c8f2e1c2a1f53770abb121d0ccf
SHA512 4a2a28d0440ce87cf6c8f1a3211b118724fec13f028f709783878d4b0bf2880ceeff0fe63f2c2623acfe6d05fb4966ec49a89b8bc8b05eb8b5b05d4b32593c0e
SSDEEP 3072:z9gezM++hOolPEG5DMoqVZZqFVVYFGR4VF1HsMBZhWeSA0gib6bbSqCKXVQ10NDk:x1L+xPbYoK2V6F1Moh0XgbnL624
TLSH
T1264423C244831BBD9997EDBD1F9E2320990D7C999342C47A2D65583DECB0CFC781E98A
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/BugReporter/BugReporter.bskin

SHA256 8caaaf97be66673eb2071a0fad2cdf9d5166916930bea81d90e569b350b52773
MD5 2e504b6a60a0b8aa5983889fe694f9eb
SHA1 8c41287f500a98f18b1a89d7d71c776868c46858
SHA512 5a3bd32daf82b1fdc29ce8f3faf25f40f6715b6cd3a696f019bfb44b3a570cb5963e237c5f97d64d4a8ee7db0223b957a8b45ba972c0031d0b349838e9993032
TLSH
T1221121CC088EDD4BF09289BA91559945756ECD634C08860FD294FB84B812EA64275977
MD5 SHA1 SHA512 TLSH

I18N/1057/PcfTray/PcfTray.bskin

SHA256 6a175d3b45c75a2cb1933516c3106a2c100117b5ff157a8c0242aab5771ad792
MD5 3f5fb87ac747f7af011e3d55d3f0c782
SHA1 b764ff8d2dd9816cbc847225d5d0ec4459896b09
SHA512 e746ac48cc885bb87f11ed80cd38ccb44edd2d28d054473a9bac8c9f44cdf529dd26dae9f3fd03f3bbac0d1c0edb14f02f93f68584d12693515114cc0033638b
SSDEEP 768:c7Dn6DRW+duqm88DUIMI3PhOFiKSYHTK5iQHuZVmT49YkmFKsJgbFnBqzjYXBro3:yD69W8XIMUahSYzUHuLmTsGcUgHaTrr
TLSH
T1375301B5BD622F7EA70069584F33C851F505B98AF8AA8265C65B3C78059C3DC53209CE
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/common/common.bskin

SHA256 1e6c6d6b6fb981c80fb61bb3f2e452ce3da6adf583a392c69a4ef28ba275d38b
MD5 f2e2ba56739187668e907f6c9f93c525
SHA1 1147237ed7c3b25b2f27bed1c469420e2cec0bd7
SHA512 4ec3109f8700a6732344508799a0ba82126482b6a826abee2ba66e1fda80269d086bfd16bb1155b6052e4cae312dcfcca8fd6c75afaaa411e03c8e95088c1063
TLSH
T112E0600B321DA44FF820C6F4740B1F050343B03BB0008B0780422A814C846C0887FAC1
MD5 SHA1 SHA512 TLSH

I18N/1057/feedback/feedback.bskin

SHA256 63b27a57d72d5843ccb6c24547d945ba0ce3c1866dc643706e253101106d66b9
MD5 67f776207f2657cbdad1ee25deaf31fe
SHA1 7c5bf2d8f2dae2d848d9b87b94aaa8287b172089
SHA512 42905b18e37bedb42ac23388e0b8ea5e0f88d142b45740acc281400538af0968fca6713cf57f3182d5d438634da237e2ded2b644f17b916847f35bb70fab8983
SSDEEP 3072:5ksLyd7ID4aWg7yQBdKYbtkFb/5ifBxxQh9f5dWzaDO8hK5s:XLwEt5y4Xtkt/YfBxahTdWYF
TLSH
T1FCD3125B576D80D567AE7A6E8C27A19FD443A9E3B4088BC93C737F79A18401B54F0CD0
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/lang.ini

SHA256 2e1fd9213e8ecf3e538f6e85f838c691e17a2a591a9b8430c52fa7aa8d342c50
MD5 08b13cea808c4a985617ac65a637a1b6
SHA1 031d1fb6ff69a5471a6a83caf2df44708c319a55
SHA512 82ef25b927e74f69c3be649e1f4ca2ab5363a1110cffb2d2b46ab66641f09723c0b60fcb9a45669254c8a35d8064a8b362e20e240a6154610b678b08e0dd8bbd
TLSH
T107B00211A0F4014DF5B7AF40FD3A95D535F1BD651916D01C1546910508F1650CF36F73
MD5 SHA1 SHA512 TLSH

I18N/1057/nsis_install/nsis_install.bskin

SHA256 ec402884aab989405a5ecdcb876ec9251088c3c80ca140086a3fadd2e43347d8
MD5 32ab4ddaa8899e3edfc5c6b67677da8b
SHA1 202c0989ed5e1c2cad67b22ca7262c1bbc7686cb
SHA512 4999b6805704adeb5f8dd2adf38c0ae2713afc4a1a24f9cf0884d40eea9ed49e2b6ba5a25247f645491c45df94e41f3d8ffc11df1ac0175ff6975db55fc90c29
SSDEEP 1536:EaNQPKSitEKnZvrXPqP/40fWbZpYGsVE1EojudTeX:EDJitEKMPEFpYGUE56A
TLSH
T1E13302FEC01A38680CC9596EF69ADDBD26F3D0954A35CA742318EB7CED175DCD00A126
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/popups/popups.bskin

SHA256 e6723b858c7d5bb7f7677ce8179779b27b301709bb74e5531525b40b85b19b00
MD5 5b3c6c3ba775e3234af612609a38d246
SHA1 e055ce2b7818dbc9bed8edfaea9a316dd495f8d2
SHA512 62313f549788286026971dd1c3f3db5f7716822d60d6e9e0958494ba0b7fe09e79d31569c5c9bf73ec61170025d720c49a7bf1044eff6898b24a207e51947122
SSDEEP 3072:5HK1OZWenHT2sE5t8QhMjepn7EEYpNKn/h:s1+i75MjWnoEYXK/h
TLSH
T127A302828AD71885B38EF746B5BDB08D170958E0131EFC9348A3492C9EDE53CBF6E519
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/1057/screensnpashot/screensnpashot.bskin

SHA256 b4c1c2987633dd72de60544cab641c65685ae229117ae4627992e6549556d3a3
MD5 9a4b07ae3cd5846eb6243ae492a9e568
SHA1 29c9cd97fe3fa1ba2da993910abc23f182726bd6
SHA512 f9a639fa07369a6f67291ea918f781c6e075863175db2eb07b19cd47696ba0e99afffdd0dff16d773c0bf2e4f236cd0188f47f51d2e2e30d16b7f561195e75d6
TLSH
T1FF21C9E625299E52E445B2F01ED2439487432D6363B59CBA8B606E7D184E0A4FCB8682
MD5 SHA1 SHA512 TLSH

I18N/1057/tools/BigFileCleaner/BigFileCleaner.bskin

SHA256 f7c25039602896cbba5962780ebb9aed2a023aebf3492d7bcae1d1415f392204
MD5 cf9b684da285eacf120b88e4a455475f
SHA1 ecc4297120b366c489b54d96eb81bc8de881e559
SHA512 cbd5c448b70a91c9654c2944a995646169aad3edd51e142179312722123d265a8cd2bcf8ef0739f804e23752a8002305237015cb5b1e54ee8f7b6aa8905bf61b
TLSH
T17421B94D549A2243C5CFE26CD115729B56B0A151D121F9A9F9EB12131C503F3FD4BB47
MD5 SHA1 SHA512 TLSH

I18N/1057/tools/FasterNow/FasterNow.bskin

SHA256 ef2e68ad4002838241e1f91c7cf45a6dd4b37b4581d8c5dcb24efe25bd6be624
MD5 fcf611918dd4ab476d88c69a5d0a284c
SHA1 b659de82f56390b2270cdd814691f37aa8ff7d09
SHA512 a690e1c0a634cd70f1f5c4bbaab2fd4226072db3d631f952a3923c6efc5bffc4b094824d32dcc90d585ec19251ac20148259c5e92d9cfac1f860c4cbfc9a83e7
TLSH
T13731D6E30A4DC585C0247CA25B2A27E23F07670B9A20193D4509F257FAC51F52ABF9EA
MD5 SHA1 SHA512 TLSH

I18N/1057/tools/WifiSharing/WifiSharing.bskin

SHA256 173f86983f52840f1c60cadbfd2fcf57f5498624ccf90c2d33c398e45bf358f8
MD5 566d581f684c1fc3c5dd58e982a0e33d
SHA1 3d69edc6b7544ac0f8a463a8d3a4b78174d67488
SHA512 3a70cf66ad97e14932a6e31293d66e5571f2b020d32d9c61689345f4dd5f32c56a1b31eafa784b540a421d6d5b390b68aad2d1f27142d7fca2e500c9582bd2b6
TLSH
T174516C06D588A3F1DB86C6F56C60687CA876A81A40B48DDD45BD048EC2E336D24B35FD
MD5 SHA1 SHA512 TLSH

I18N/1057/update/update.bskin

SHA256 7e9786c116f37da9514f13b08ddaa92f5f196bddc3a1d5b726c342def723641e
MD5 2220e6393f06f6e9ca351a889963bf55
SHA1 806b0ef672f3a8c97ba3f1e34ae50487d62ba1d2
SHA512 84a90af9180d3225c2444d19bba0e00be25822b29b24ff41d580f6d66dd4e3b5f8b425409cbb3e02d07199c539cecbab934b74a036e781d7c98dca283ee04788
SSDEEP 384:q4swEXKwdh6bOQmDQy6VN6fRBg3v90jwt:qPHj6bOjMog33
TLSH
T19B42D0C35F27DAC8FF84E57C2B3E654284048A047B5D27432DEB4AB11364C37288B567
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/BCloud/BCloud.bskin

SHA256 2e4ed542e933bed11433bc1386086d5e627aeb1b1d62b1213d8ec80c3b1c7888
MD5 f51b6e9ce018b9cd01937cfd200efe44
SHA1 724c9aa094c7457009d84bde1f2949052be814b2
SHA512 744dc2d7cf0aeb647dee4306e59d90cc2672de33ab54308a999990d4fd2cabc96d92435c2b4933155c1632e8f9a3fcd1e14014df3f2c42f0e35ce470fe176ce0
SSDEEP 768:jw6KlgR5K3YTSgLDj39ft2vJlp9ZlM+k3VdigAvDCuwktUBCla9cNOUGJ0J8NF9f:jaYegbh4RFDfAP+DCfCs9gAUcJPZ
TLSH
T1BA3302C4FF12DFA375A18F91275F5249B27B059CAD62F2623928C7B0E0C7256C0B8794
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/BaiduSafe/BaiduSafe.bskin

SHA256 4f27394f4bf8275bbae2c5e6c844b47910bff21e6548666847bd6d1a16abd8c5
MD5 19c4c9312ff54e478320452b005a8345
SHA1 b03b07a2ff19b218aeeb03706da4d3f46e1eb244
SHA512 541834385230229a8f3ea8187333824e06d8f04228059cc92f55d0ef3da463ca3d006842162d05a79d32cf3ca3d165cb3eafb107041aaae743199e861b1b1884
SSDEEP 6144:dL/GX6dZJMOv7V3bxhy+bLmsYviis9PtE:JGXOyOvtbxhy4L66isRi
TLSH
T168142276A393E83BDD9EFA3504C543ED56D03F9096F0811946F8FEE29DD402D2278A29
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/BugReporter/BugReporter.bskin

SHA256 54b80d46ab40ac04cd400b820a826e28a0a439c3848bd079ef97e7acccf68d02
MD5 54476df3a729f7c4b2d375405b12e4cf
SHA1 f8e62393f4d7ea159d017db2edecf22cf0a9aab2
SHA512 73559b1bf6fa247c7c0d633a476416fbaed1e155bcbfc9be01eb0df1036c623ccc94a9a09202d3afbf6ff0849c27063ef1b109a0a2c0c7018d3cade09cf90ee3
TLSH
T1A011C8190410AC72D4FC053926905CB4A3A97DBB6A5C91A790801F2FFEE3A1A4578EC6
MD5 SHA1 SHA512 TLSH

I18N/3082/PcfTray/PcfTray.bskin

SHA256 3ff7886cbb2d312825742814b39891826bf1d0fc3df69fdca5bf6807dd2660b0
MD5 f417433ec99261384a92be352067c301
SHA1 6b1a070b55ad8d0ab833003c23a13385c0cc717e
SHA512 84c0a640f39f7b3dc70d11c9993f734a2fe0f0065870f4e32ceeb6cec97d0f0f05b248af1083b48cc75d3ec5a4acd05d773e67c85c1343ce40b2e66c84759295
SSDEEP 1536:BhJSmxqB/y77LhqI2nNGY2Uuuqn1Fr2sP2o5XD9fB+eOw:BBq4fgYYERzrCMTJB+E
TLSH
T19043021810C325D5EE3C563428ADD2A8EF476E93EE902B8148BE577C8B4D1A2D64D2BC
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/common/common.bskin

SHA256 5657e2df99fbbb00679f76d671f912add7bf241374e9e87728318f2920252f78
MD5 b567324792b31dac4a5df237cb15f0c4
SHA1 f7dc48681e5f6272b3ae0c2629972692e60bf9bb
SHA512 20a6f8e07b2e8c419286f2eaa1e24205fb3c1cea4a74de95ca1f3f1f39b29ee972c842d3953ae2d1970e69f5e164ecf8b548834335f52b3cdba8421f91170511
TLSH
T1F7E0F1660D29D572F9806CFF207151C921403B298520911B10890963C4E613815B37DE
MD5 SHA1 SHA512 TLSH

I18N/3082/feedback/feedback.bskin

SHA256 b1c984dacfe5969e173950d68e43405313f90ce00bfd1277f877e6014a4c6aba
MD5 3cee7c56cbc821aaae29f4f4bfc35107
SHA1 ab4d7bbb3cd103e25fc9d1fd2ee380e1bc6d92a2
SHA512 66f22840b287b94db11d83789a85d6f2e046c50ce28a9092753b847b66b52df398d1b3a9405ba885c976ad6aa209cd4eb86d96d4789c87953f1391263271cd6f
SSDEEP 3072:pvmek0ZwXvqQKfYqgpQc7D4a3kjsimsWh2KufqhfNd:UeJZohqoQW4a3kgzsWdhNd
TLSH
T112E312E6F7C85DCD782F09CC18847BE68BD20C108C65BED38481BA596E7112BF265679
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/lang.ini

SHA256 c4de9890096541d8948c3b0e79bedaf974c1f29cd222aea63c76be660011615d
MD5 a26c20b8bb328b27520b92f2d1469797
SHA1 8e3866aeb7a448be37df58cc828f4607646640b0
SHA512 50bb5112abfabbea59232f59e30219472f5b5b18d055c117bf9966ed620c83f8124ecd1ce0377d5b9c5ad48f09d2aa56f32b81a9b9f22359e2912fe00edf5569
TLSH
T134B01201A0A8821CB5735D00FC22C0D421F8BE20180AD0180151100340F0500CF32F73
MD5 SHA1 SHA512 TLSH

I18N/3082/nsis_install/nsis_install.bskin

SHA256 e95814f32d858ecaccf3098c188967def58d1a3a0bbeb92ec77ad2a1fa7b0339
MD5 96cb79c56e274aa1e6f25084829baa5f
SHA1 a2f10e0188877e80184460362da925edafedcec5
SHA512 89e0ca40cf34d704c1a4317656e30c24cad61f22155d7df83e5d9e0436481e431c0f0662a762b995dcf9082c1873c6c7a6318752bb2073fdbad21cf59ef11b1f
SSDEEP 3072:ZDJitEKXaYN1h9Zoc8a1/sW5rG5zaX1r4F/:dJc5Xz1LZo/aCErG5zG1ro/
TLSH
T1A2A312F66128AF742A053E36217F9CF4A92B15B48AD93EE0972C6EE1D12C87DC00577D
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/popups/popups.bskin

SHA256 bebb91a526ba94bea06803ecf1a2b0d8f45f8e8e607614e457df771932d4c0a6
MD5 1e018aeec9788cc80d7753309f57d4ae
SHA1 597801725cb6462d6e1b0c7442fe0eea66a02262
SHA512 6c97352f0342662973f77ab68452a0c2f71c64a26476314e84e263745998b01407d2fbc11bdbe8068f2b9659a43298267de5cf1b14ea219b6684dcead155a694
SSDEEP 3072:9yP7XSZl3PzbFa8u0VBslnzRVBRLw/jVI:sDSDfzJal0VBQzRV4VI
TLSH
T127A3126CCF36D702CAAA6B4E862F27401E55C979CA3525EAC01F742A7D3BF02F947814
MD5 SHA1 SHA512 SSDEEP TLSH

I18N/3082/screensnpashot/screensnpashot.bskin

SHA256 535d3bae692bd40d71d0b3fae101561c03c3214639b941ed8ec99b282161133c
MD5 0dac3bbf54e1cf2be53f034dac7dd9a3
SHA1 c3c6fb3b2033f2f271a59dc4013682ae28e34914
SHA512 58400ba6e89e60ba0956209d569377771b1d782f191a716ac5612a2968f8d967a1acb14598d45bf25818058c235a1f16a29c297081ff3ebe7b60d3a251ee60e1
TLSH
T1DE11A5061FA16803F213ADFAC100A1F6DF113CA2B3C066489A216D1375CF04267920DF
MD5 SHA1 SHA512 TLSH

I18N/3082/tools/BigFileCleaner/BigFileCleaner.bskin

SHA256 a552796ad55778b52866af012dfd2f1f31ef44e93280b89a3cfc5fea3d7954ba
MD5 b8b1bf1c7a50ffd9d1367a3c4a4c02d2
SHA1 48aae17dbeadf5b7cd45494cd3151602b87e79e8
SHA512 00bb126ae5a7180c0ca3fe3f2fc6d46a47061f99663a47e7ffd48ad601b5a2dcd62cdd55ee0087d5e0c23cdf014196a35c9a5a932244914c7d0a6ba983305711
TLSH
T18E21A75D080B2301C664263442D626B043F3BB25A111CABE9AA9D33F6C7A1B674D6544
MD5 SHA1 SHA512 TLSH

I18N/3082/tools/FasterNow/FasterNow.bskin

SHA256 e307170e2a2987b510a4cd8f5f6f21c4bf89b4b856744ff908113b3eddef4be8
MD5 52e9161753524a0d07dcaf80d4a2abf4
SHA1 24ce0b134a0bfc881eebbfbc196e316c7ca0e900
SHA512 869a3f088bbba7314662a2ef98e05efc5c61f491a0bed9fc18bdad753cebcf2ea4cee2f5cdf270eccd7b39291a51958bfd7e3f81a99e6fafe099202f539a9388
TLSH
T1D6312622C98413C0F5464BB878DB02665BAC9B089F3E52A18FC6D6EB1433077863AD00
MD5 SHA1 SHA512 TLSH

I18N/3082/tools/WifiSharing/WifiSharing.bskin

SHA256 d8ed68b349721ddd347c9e9fbce08831b2c0d882a685b3daf7b8ee6ceebb9fd1
MD5 d76611824d47a21e58e8b676afb5746c
SHA1 331d86fec5d0c3af20592f5877292619f0eef4d1
SHA512 eee1316dc83e1e7cf25a8dc470469fe639ac162dc63bde5e1b0c78e8948995642002194755ffa37851546d3f241d7ef15adb0a6c05cc2f0fed41673ede995062
TLSH
T1BB616D2BA18E7021E7EE48FD242677434E458A2DD8C204DF7FEB2A86D00969017A31FD
MD5 SHA1 SHA512 TLSH

I18N/3082/update/update.bskin

SHA256 dc22247410d3efdc54f9fbeac45855a7553c52e3969e6d9246529fa59c438e0d
MD5 4bf9ced39b481aaaadd78e9776b4cb35
SHA1 e0f889d161fb2cc2844ad0d0457702effef6023b
SHA512 fb82f6cf93220527b5c77179bd5a15c55f6e3cc2ccd81c227e6510d6fa3523233f764acd2636f3d84338b25514e93a7f6ca75e82b952d3918f93287e4c4ef591
SSDEEP 384:xmL7irgFndLFBY0JWV0+dKT7JR1utMpTmB6Qnvcz9n9ueV8He6PqbLwa+glWU0tc:xmf0g3M1V0gUtRBTmUjF9dKHGWU0N4l
TLSH
T1B292D06B84B953E4B407AA8423B9D40C55D0C943A4A0DF0F0E67F4756E627ADA50FFCD
MD5 SHA1 SHA512 SSDEEP TLSH

LogReporter.exe

IMPHASH e346f319aee147d32246b4b31d5e61b5
SHA256 93768a2786d1532b55da703617b444b855f117d19d0ba796b942ae6a9d8eb966
MD5 7a82c67b1392b227a21d3d12438f04a2
SHA1 fc9b784e1f2c586519eafe14574ec914e22c4919
SHA512 cae28d209dd845690de7e315a2506467bb56ce60e7fa254c72b8db210256b1b79284347bf21aa5a42ec09116d279c24372b89b83322144caa3d784f6777c9746
SSDEEP 12288:u9hR0vGN0K0Z4O50ls/a5zCMpls9yUMmS:0hR0vGNfRO50lAEpm9xS
TLSH
T154F42A00B3818036FAB719F19A7D5679A539BD320B2590CBA3C43D5E4EB56F1AE31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

27:82:81:ab:d1:a6:89:79:66:17:61:23:bb:2e:75:4e:b9:d1:9a:9c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

399150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\LogReporter.pdb

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

CreateToolhelp32Snapshot GetPrivateProfileIntW GetPrivateProfileStringW GetModuleFileNameW lstrlenW ReadFile GetTempFileNameW GetTempPathW GetPrivateProfileSectionW GetTimeZoneInformation WriteFile Sleep GetLocalTime GetWindowsDirectoryW GetVersionExW WTSGetActiveConsoleSessionId OutputDebugStringW GlobalMemoryStatusEx ProcessIdToSessionId GetSystemInfo CreateMutexW SystemTimeToTzSpecificLocalTime GetCommandLineW SetLastError DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW InitializeCriticalSection DeleteCriticalSection GetModuleHandleA LeaveCriticalSection EnterCriticalSection FlushInstructionCache VirtualFree CreateFileMappingA LocalFree LocalAlloc InterlockedExchange InterlockedCompareExchange WritePrivateProfileStringW SystemTimeToFileTime GetFileSizeEx CreateProcessW ReadProcessMemory VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA HeapCreate HeapAlloc CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler GetCurrentThreadId TerminateProcess VirtualQuery GetModuleFileNameA ReleaseMutex lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenFileMappingW OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory GetProcessHeap HeapFree CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer GetPrivateProfileSectionNamesW SetEnvironmentVariableA CompareStringW CompareStringA GetDriveTypeA WriteConsoleW GetConsoleOutputCP Process32FirstW OpenProcess Process32NextW SetDllDirectoryW InterlockedIncrement GetCurrentProcess GetExitCodeProcess WaitForSingleObject DeleteFileW GetLastError CopyFileW GetCurrentProcessId GetTickCount VerifyVersionInfoW VerSetConditionMask FreeLibrary LoadLibraryW GetProcAddress GetModuleHandleW DeviceIoControl LockResource GlobalFree MultiByteToWideChar SizeofResource WideCharToMultiByte GlobalAlloc LoadResource FindResourceW FindResourceExW CreateFileA FindClose FindNextFileW FindFirstFileW ExpandEnvironmentStringsW UnmapViewOfFile CloseHandle MoveFileW FlushFileBuffers ResetEvent SetEvent WriteConsoleA IsDebuggerPresent SetStdHandle FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW GetSystemTimeAsFileTime LoadLibraryA GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetCurrentDirectoryA GetFullPathNameW GetStdHandle ExitProcess MapViewOfFile CreateFileMappingW GetFileSize CreateFileW HeapDestroy HeapReAlloc RtlUnwind RaiseException LCMapStringW LCMapStringA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement GetCPInfo CreateThread UnhandledExceptionFilter

user32

GetThreadDesktop CloseDesktop OpenInputDesktop wsprintfW DispatchMessageW CallWindowProcW CreateWindowExW IsWindow SetTimer SendMessageTimeoutW SetWindowLongW GetWindowLongW KillTimer PostMessageW GetMessageW GetUserObjectInformationA

advapi32

GetUserNameW SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExA RegQueryInfoKeyW GetTokenInformation AllocateAndInitializeSid EqualSid RevertToSelf RegCloseKey GetLengthSid GetKernelObjectSecurity InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid CreateProcessAsUserW DuplicateTokenEx SetTokenInformation RegEnumValueW RegEnumKeyExW RegSetValueExW QueryServiceStatus RegOpenUserClassesRoot StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateLoggedOnUser RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegCreateKeyExW OpenProcessToken

shell32

SHFileOperationW ord165 ShellExecuteExW SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoUninitialize CoCreateGuid CoInitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear

log

WriteLog

shlwapi

SHSetValueW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW PathFindFileNameW PathAddBackslashW SHGetValueW PathUnquoteSpacesW PathRemoveArgsW StrTrimW SHDeleteValueW PathFindExtensionW PathRemoveExtensionW PathRenameExtensionW PathAppendW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

winhttp

WinHttpCreateUrl WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpSetOption WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpAddRequestHeaders

ws2_32

htonl WSAStartup WSACleanup

psapi

GetModuleInformation GetModuleFileNameExW GetModuleBaseNameW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

NSISInstall.exe

IMPHASH 122ff507bb5b8f3540db5492d9f3dc2c
SHA256 98431b8c385eb6730e958c216f9e3620b9386444ac8e2bc6ee011e3741fe1818
MD5 c3b84a2e5e5c319a9f17a4f816da38bc
SHA1 4f674e449f61c90d13212f26418e18e532bef6b1
SHA512 34161c93a08769bc5ffe7cf74c52d048a3d6850e8a962bf816a03c09bbd615c489b002e9fe9813094d893b77ce6e1705ee333e1a88ce8faf0567f37624b427d4
SSDEEP 49152:qd8jumeUVBKFOhTPS0cvz7Zfnn0BddjXGTtb2vjNNN:kWHeUVBjhbSy
TLSH
T13D754C01A642913EF9F710F2CFFE556D8668BE20070860C7A2C85D5F5B76AE27E32257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a8:93:eb:ff:c7:94:ed:22:a4:21:13:ff:29:c7:64:7c:ca:94:d5:33

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

535842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\NSISInstall.pdb

installutility

GetString CheckPathEverInstalled GetCurrentLangID CheckInstallPath

directui

DirectUI_SubclassWindow DirectUI_Progress_EnableMoving DirectUI_SetLanguageStyle DirectUI_AutoText_SetControlText DirectUI_UpdateSkin DirectUI_LoadSkinResourceFromZIP DirectUI_I18N_AddLanguageStyle DirectUI_Edit_SetSrcText DirectUI_GetVersion DirectUI_ShowControl DirectUI_SetControlText DirectUI_SetControlPos DirectUI_SetControlTextEx DirectUI_CreateControl DirectUI_DestroyControl DirectUI_GetStringItem DirectUI_SubclassLayeredWindow DirectUI_Progress_SetPos DirectUI_Button_GetCheck DirectUI_Button_SetCheck

log

WriteLog

kernel32

GetDiskFreeSpaceExW CreateProcessW GetVersionExW GetCurrentProcess FlushInstructionCache InitializeCriticalSection FreeLibrary lstrcmpiW LoadLibraryExW InterlockedDecrement InterlockedIncrement GetCommandLineW CreateFileMappingW MapViewOfFile LocalFree OpenFileMappingW UnmapViewOfFile ExitProcess lstrlenA GetTimeZoneInformation WriteFile SetEvent ResetEvent CreateEventW SetFilePointer FlushFileBuffers InterlockedExchangeAdd InterlockedExchange OpenThread DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult GetModuleHandleExW CreateThread WaitNamedPipeW SetNamedPipeHandleState GetTickCount InterlockedCompareExchange TerminateThread SwitchToThread SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetDriveTypeA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetModuleHandleA GetLocaleInfoW SetStdHandle GetStringTypeW GetStringTypeA EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA HeapCreate GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCurrentDirectoryA GetFullPathNameW TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA ResumeThread ExitThread GetSystemTimeAsFileTime GetStartupInfoW RtlUnwind FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindClose IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetDriveTypeW HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent LoadLibraryA GetProcAddress RaiseException GetCurrentThreadId CreateFileA FindResourceExW FindResourceW LoadResource WideCharToMultiByte SizeofResource MultiByteToWideChar VerSetConditionMask VerifyVersionInfoW WinExec OpenMutexW IsBadReadPtr GetCurrentProcessId HeapAlloc lstrlenW InitializeCriticalSectionAndSpinCount HeapFree GetProcessHeap Sleep OpenProcess ExpandEnvironmentStringsW OutputDebugStringW SetLastError GetPrivateProfileIntW GetPrivateProfileStringW GetModuleHandleW MulDiv WaitForSingleObject LeaveCriticalSection EnterCriticalSection DeleteCriticalSection VirtualFree GetModuleFileNameW ReadFile VirtualAlloc GetLastError CreateFileW IsValidLocale CloseHandle LockResource

user32

GetWindowLongW SetWindowLongW SetWindowPos SetWindowTextW UnregisterClassA GetAsyncKeyState ScreenToClient SetCursor SendMessageTimeoutW GetClientRect DefWindowProcW CreateWindowExW SendMessageW IsWindow GetWindowTextLengthW GetWindowTextW EnableWindow CallWindowProcW ShowWindow FindWindowExW GetWindowThreadProcessId GetClassInfoW RegisterClassW BeginPaint EndPaint DrawTextW TrackMouseEvent InvalidateRect MapWindowPoints GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindow BringWindowToTop SetActiveWindow DestroyWindow KillTimer SetTimer EndDialog GetPropW SetPropW IsWindowEnabled MsgWaitForMultipleObjectsEx LoadImageW GetMessageW TranslateMessage DispatchMessageW CharNextW MonitorFromPoint GetMenuItemInfoW RemoveMenu GetMenuItemCount AppendMenuW TrackPopupMenuEx DestroyMenu CreatePopupMenu PeekMessageW MessageBeep SetFocus PostQuitMessage LoadStringA LoadStringW DialogBoxParamW LoadCursorW GetClassInfoExW RegisterClassExW TranslateAcceleratorW IsWindowVisible GetActiveWindow ClientToScreen PtInRect PostMessageW UpdateLayeredWindow GetDesktopWindow DialogBoxIndirectParamW GetDialogBaseUnits SetRect OffsetRect GetSystemMetrics GetMenuState DeleteMenu EnableMenuItem GetSystemMenu

gdi32

SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteObject CreateSolidBrush DeleteDC CreateFontW GetObjectW CreateDIBSection RoundRect CreatePen SetBkMode SetTextColor BitBlt

advapi32

RegQueryValueExW RegOpenKeyW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl RegQueryValueW

shell32

SHGetSpecialFolderLocation SHBrowseForFolderW SHGetPathFromIDListW SHGetFolderPathW CommandLineToArgvW SHGetSpecialFolderPathW ord165 ShellExecuteW

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoUninitialize CoInitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathAppendW PathFileExistsW PathIsDirectoryW PathIsRelativeW PathStripToRootW SHGetValueW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

winhttp

WinHttpCreateUrl

winmm

timeBeginPeriod timeKillEvent timeEndPeriod timeSetEvent timeGetDevCaps

NewUpdater.exe

IMPHASH ce8cf05e10ab022d7afa6ba8a1d5e43c
SHA256 6db51a9b3142a7055baa4fb6e144f3fca641a3271a6ca13b4e9f7476219c2338
MD5 ec78d5f5580ef5f87086ee61d6b5777b
SHA1 7fcfe4533c1c872fe46e207d6ecd702576015e34
SHA512 c86e031947bf82d77d7240d50f27ba5a6bdae8243553ec9541f05f63ce4a8da1b5644510166cee12c1e70cd833c288299ad8f7bf038a852de25991dd2ed1b426
SSDEEP 6144:eMhGUu3UUcjvvpwzI4EhpiyKxsPJOLWKxK50TtFtTXRJTXR8YHqQaY7C0FLS:0Uu3Zc6EhMdyPJOaidTtZ9RS
TLSH
T119A44B00F691D036F4B308B29EB98679943DBE710B5590CB73C46E5E1AB5AE2BE31713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a0:34:7c:9c:cb:72:93:a3:35:74:6f:c6:89:9c:09:ff:f5:8e:ca:31

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

186539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\NewUpdater.pdb

directui

DirectUI_GetStringItem DirectUI_SetLanguageStyle DirectUI_AutoText_SetControlText DirectUI_LoadSkinResourceFromZIP DirectUI_UpdateSkin DirectUI_I18N_AddLanguageStyle DirectUI_Progress_GetPos DirectUI_Progress_SetPos DirectUI_SetControlText DirectUI_GetVersion DirectUI_SubclassWindow DirectUI_ShowControl

datareport

Stop Start RD_WS RD_W

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

GetPrivateProfileStringW GetProcAddress GetModuleHandleW GlobalMemoryStatusEx lstrlenW GetPrivateProfileSectionW GetTimeZoneInformation GetPrivateProfileIntW GetCurrentThreadId InterlockedIncrement InterlockedDecrement DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep InitializeCriticalSection FreeLibrary lstrcmpiW RaiseException LoadLibraryExW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetCommandLineW FlushInstructionCache SetLastError GetVersionExW ExpandEnvironmentStringsW GetTickCount WaitForSingleObject LoadLibraryW WritePrivateProfileStringW CreateProcessW GetExitCodeProcess OpenFileMappingW TerminateProcess MoveFileExW ProcessIdToSessionId DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW GetModuleHandleA VirtualFree CreateFileMappingA WideCharToMultiByte GetLocalTime GetWindowsDirectoryW LocalAlloc InterlockedExchange InterlockedCompareExchange SystemTimeToFileTime WriteFile GetFileSizeEx WTSGetActiveConsoleSessionId GetCurrentProcessId VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA HeapCreate HeapAlloc CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler VirtualQuery GetModuleFileNameA ReleaseMutex CreateMutexW lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory GetProcessHeap HeapFree CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStdHandle ExitProcess RtlUnwind IsDebuggerPresent TlsAlloc UnhandledExceptionFilter GetStartupInfoW CreateThread GetSystemTimeAsFileTime IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy TlsSetValue TlsFree FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA DeleteFileW CopyFileW SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA GetTempFileNameW GetTempPathW GetModuleFileNameW ReadFile GetFileSize CreateFileW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetCurrentProcess VerSetConditionMask VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW CloseHandle OpenProcess GetLastError Process32NextW MultiByteToWideChar LocalFree ReadProcessMemory

user32

CreatePopupMenu TrackPopupMenuEx AppendMenuW GetMenuItemCount RemoveMenu InvalidateRect PtInRect DestroyMenu LoadStringA LoadStringW TranslateAcceleratorW GetThreadDesktop CloseDesktop GetUserObjectInformationA GetMenuItemInfoW MonitorFromPoint CallWindowProcW SetWindowTextW PostQuitMessage KillTimer SetFocus CreateWindowExW LoadCursorW GetClassInfoExW LoadImageW RegisterClassExW DestroyWindow OpenInputDesktop MessageBeep DefWindowProcW PeekMessageW GetMessageW TranslateMessage DispatchMessageW FindWindowW MoveWindow CharNextW SetLayeredWindowAttributes IsWindow PostMessageW UpdateWindow RedrawWindow SendMessageW GetForegroundWindow SetForegroundWindow AttachThreadInput ShowWindow SetTimer GetDesktopWindow GetShellWindow GetSystemMetrics WindowFromPoint SetWindowLongW IsWindowVisible GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints SetWindowPos GetWindowThreadProcessId UnregisterClassA

advapi32

RegOpenKeyExW GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid RevertToSelf CreateProcessAsUserW DuplicateTokenEx SetTokenInformation GetTokenInformation GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW RegDeleteValueW RegEnumKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW OpenProcessToken RegQueryValueExW RegDeleteKeyW RegQueryInfoKeyW

shell32

ord165 SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteW SHFileOperationW SHGetFolderPathW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW PathFileExistsW PathRemoveFileSpecW PathAppendW PathIsDirectoryW PathIsRelativeW PathAddBackslashW

comctl32

InitCommonControlsEx

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

psapi

GetModuleInformation GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

PCFApiUtil.sys

IMPHASH cf7bd7f3c7dd9e7a5896e8f5fd9559f1
SHA256 d944faf431cc835ec560e52c46bc598d3389ac9c4a0a761250303b66d330504e
MD5 f0502923ab29c29dbe3f86f3ca5f5f24
SHA1 b776319db3e399e4cb2402e16985bc27d6fab06d
SHA512 c90ae2cfbae730667bd1e95e871a7152c98b034c1d28b02ffd89784d09886e66fc7d6958a99fea8936317f5542eb182ed28ea2206b24d038bd3f8ae5d953e59b
SSDEEP 1536:IkfB+NKtI8jdm9gI/R89X4H0gs9FlCe/jp6Up0kdguL2m3:tfFdZPSUPFXN6Upv
TLSH
T117B3F955B300920BD5AB01F2C826B6A43F35AB713740A1CF86C5186D2EA7FDB1F7652B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2c:b2:81:02:a1:43:6c:9d:c1:3f:a6:8b:b7:28:e3:c6:ae:28:64:43

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

101888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

r:\i18nBavDefense\defense\output\pdb\PCFApiUtil.pdb

ntoskrnl.exe

CmRegisterCallback IoCreateSymbolicLink IoCreateDevice CmUnRegisterCallback DbgPrint RtlCompareMemory MmIsAddressValid _stricmp mbstowcs ExAllocatePoolWithTag ExFreePoolWithTag ZwMapViewOfSection ExGetPreviousMode ZwQuerySystemInformation IoFreeMdl MmMapLockedPagesSpecifyCache _vsnprintf NtClose ZwClose ObReferenceObjectByHandle MmProbeAndLockPages MmUnlockPages strrchr ObfDereferenceObject ZwCreateSection ZwOpenFile IoAllocateMdl ZwOpenKey ExQueueWorkItem ProbeForRead RtlVolumeDeviceToDosName PsLookupProcessByProcessId ZwQuerySymbolicLinkObject _wcsnicmp ZwReadFile KeSetEvent RtlAppendUnicodeToString IoCreateFile KeInitializeEvent ZwQueryObject ZwOpenSymbolicLinkObject ZwSetInformationFile ObQueryNameString IoFileObjectType ZwCreateFile PsGetVersion RtlAppendUnicodeStringToString KeWaitForSingleObject IoFreeIrp IoAllocateIrp ZwQueryInformationProcess ObfReferenceObject PsGetCurrentThreadId PsGetCurrentProcessId RtlCopyUnicodeString ZwTerminateProcess ZwQueryInformationFile ObOpenObjectByPointer IofCallDriver _vsnwprintf ZwCreateKey ZwDeleteValueKey ZwSetValueKey ZwUnmapViewOfSection KeServiceDescriptorTable ZwDeleteKey ObOpenObjectByName ExNotifyCallback ExCreateCallback DbgPrintEx NtBuildNumber SeDeleteObjectAuditAlarm MmUserProbeAddress wcschr IoAcquireVpbSpinLock SeCreateAccessState IoGetFileObjectGenericMapping ObCreateObject ObInsertObject IoGetDeviceObjectPointer RtlUpperChar RtlPrefixUnicodeString IoReleaseVpbSpinLock RtlEqualUnicodeString PsSetCreateProcessNotifyRoutine IofCompleteRequest MmGetSystemRoutineAddress IoDeleteDevice RtlInitUnicodeString KeGetCurrentThread IoDeleteSymbolicLink _except_handler3 memcpy _aullrem _allmul memset _aullshr

hal

KeGetCurrentIrql

fltmgr.sys

FltEnumerateInstances FltEnumerateFilters FltObjectDereference FltGetFilterInformation

Name

.text

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

992B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

960B

Virtual Size

948B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

864B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

PCFApiUtil64.sys

IMPHASH 55fe93131c6adfb99e4cfe4fe3c87e4e
SHA256 3256b9a65696b68b334f94d38d8fd4e41ce9f2bfb0243fff94f18b8af9629853
MD5 830e1fc33d18fe29841ed21f5b83540e
SHA1 cd491e59596b6bec54b04c64d2488312a54def48
SHA512 42e2001d089584646da770ff83e3f67f31012236dd61011f529d7beb8b2738613cad72a2ad54271048fc724f41515ef2f9d09cb5b08b86a60465d864d02563ea
SSDEEP 1536:h9T+AGLL3CD0/AvcxjxzLZ5lbX+x5AkvdC93jTHv011Pr2mf:h9ak0IvcxjdZ5lbOxykvdi30HPl
TLSH
T15CE3A48AE73252C6D4B7C535849272A23F70B6B8A720D7CF8781412F1E16FE59D7A704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ab:76:fe:cb:a0:f5:0b:65:f9:d3:94:67:f4:e5:c3:49:ff:9b:fd:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

129792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

r:\i18nBavDefense\defense\output\pdb\PCFApiUtil64.pdb

ntoskrnl.exe

IofCompleteRequest PsGetVersion CmRegisterCallback IoCreateSymbolicLink IoCreateDevice CmUnRegisterCallback DbgPrint RtlCompareMemory MmIsAddressValid _stricmp mbstowcs ExAllocatePoolWithTag ExFreePoolWithTag ZwMapViewOfSection ExGetPreviousMode ZwQuerySystemInformation IoFreeMdl MmMapLockedPagesSpecifyCache _vsnprintf NtClose ZwClose ObReferenceObjectByHandle MmProbeAndLockPages MmUnlockPages strrchr ObfDereferenceObject ZwCreateSection ZwOpenFile IoAllocateMdl ZwOpenKey ExQueueWorkItem ProbeForRead RtlVolumeDeviceToDosName PsLookupProcessByProcessId ZwQuerySymbolicLinkObject _wcsnicmp ZwReadFile KeSetEvent RtlAppendUnicodeToString IoCreateFile KeInitializeEvent ZwQueryObject ZwOpenSymbolicLinkObject wcslen ZwSetInformationFile ObQueryNameString PsSetCreateProcessNotifyRoutine ZwCreateFile RtlAppendUnicodeStringToString KeWaitForSingleObject IoFreeIrp IoAllocateIrp ZwQueryInformationProcess ObfReferenceObject PsGetCurrentThreadId PsGetCurrentProcessId RtlCopyUnicodeString ZwTerminateProcess ZwQueryInformationFile ObOpenObjectByPointer IofCallDriver _vsnwprintf ZwCreateKey ZwDeleteValueKey ZwSetValueKey ZwUnmapViewOfSection ZwDeleteKey ObOpenObjectByName ExNotifyCallback ExCreateCallback DbgPrintEx NtBuildNumber SeDeleteObjectAuditAlarm MmUserProbeAddress wcschr IoAcquireVpbSpinLock SeCreateAccessState IoGetFileObjectGenericMapping ObCreateObject ObInsertObject IoGetDeviceObjectPointer RtlUpperChar RtlPrefixUnicodeString IoReleaseVpbSpinLock RtlEqualUnicodeString MmGetSystemRoutineAddress IoDeleteDevice RtlInitUnicodeString IoFileObjectType IoDeleteSymbolicLink __C_specific_handler

fltmgr.sys

FltEnumerateInstances FltEnumerateFilters FltObjectDereference FltGetFilterInformation

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

864B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

PCFHelper.exe

IMPHASH f353d92eefe0c498e37f5786efa4f0fb
SHA256 3ea37f077bdc72b4e1deccbb591bf9a319eeb2f132f067f87d7e1dd30034080e
MD5 5a512d1a8eaf18c367a0c15ff11671b7
SHA1 b360a012e70d5aadc7a4687621270bb97396e3c7
SHA512 6309982639b05b9794183591575dd9afbd901d5aa50078db18106503520fe47ed434ca407dbcd14cbf8ec600567620e861b0e545429e9cbab9002a286ea5b693
SSDEEP 24576:KRpz42tW2yM90Q6yw8SO3R6hCovGiM2fPpeA20U:KRpttz16yruCKG4fPpeAk
TLSH
T1FB455B10E791803AFAF304F18ABD857DA939BA70171560CBE3C45DAD9B709E2BD31627
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

28:0b:10:50:74:ed:cd:d9:dd:52:7e:ae:15:b7:da:de:21:45:e2:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

762546

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFHelper.pdb

datareport

Start Stop RD_WS

log2

?DelInstance@CAPCDispatcher@@SAXXZ ?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

GetModuleHandleExW WaitForSingleObject CopyFileW GetExitCodeProcess GetTempPathW GetPrivateProfileIntW CreateFileMappingW DeleteFileW GetEnvironmentVariableW SetErrorMode GetSystemWindowsDirectoryW GetSystemDirectoryW GetFileAttributesW GetCurrentDirectoryW GetLongPathNameW ExpandEnvironmentStringsW LoadLibraryW FreeLibrary MoveFileExW CreateFileA GlobalAlloc GlobalFree DeviceIoControl GetDriveTypeW SystemTimeToFileTime CreateDirectoryW FileTimeToSystemTime SetFileAttributesW SetLastError InterlockedDecrement TerminateProcess WriteFile SetDllDirectoryW InterlockedIncrement OutputDebugStringW GetLocalTime GetWindowsDirectoryW DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr ExitThread GetModuleHandleA FlushInstructionCache VirtualFree CreateFileMappingA InterlockedExchange InterlockedCompareExchange ReadProcessMemory VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA HeapCreate CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler VirtualQuery GetModuleFileNameA ReleaseMutex CreateMutexW lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenFileMappingW OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer CreateThread GetFileInformationByHandle UnmapViewOfFile MapViewOfFile GetFileSize GetTempFileNameW GetCommandLineW Sleep FormatMessageA ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe GetVersionExA SleepEx GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetTickCount GetCurrentThread DeleteCriticalSection InitializeCriticalSection LocalFree FindNextFileW LocalAlloc FindClose GetFileSizeEx CreateFileW ReadFile GetProcessHeap HeapFree GetCurrentProcess HeapAlloc FindFirstFileW GetShortPathNameW GetCurrentProcessId CloseHandle CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId Process32NextW ProcessIdToSessionId Process32FirstW GetProcAddress GetLastError VerifyVersionInfoW GetVersionExW OpenProcess GetModuleHandleW VerSetConditionMask GetPrivateProfileSectionW LockResource WritePrivateProfileStringW lstrlenW MultiByteToWideChar GetTimeZoneInformation GetModuleFileNameW WritePrivateProfileSectionW SizeofResource WideCharToMultiByte GetPrivateProfileStringW LoadResource FindResourceW FindResourceExW SetEnvironmentVariableA CompareStringW CompareStringA GetFullPathNameA GetDriveTypeA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FindFirstFileA LoadLibraryA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetStringTypeA GetCurrentDirectoryA GetFullPathNameW FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount LCMapStringA LCMapStringW HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetStdHandle ExitProcess HeapDestroy RaiseException RtlUnwind HeapReAlloc GetStartupInfoW GetCPInfo FileTimeToLocalFileTime GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter GetPrivateProfileSectionNamesW CreateProcessW

user32

SetForegroundWindow IsWindowVisible GetThreadDesktop CloseDesktop GetUserObjectInformationA OpenInputDesktop ShowWindow

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW OpenProcessToken GetUserNameW CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext CryptGetHashParam GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid FreeSid SetTokenInformation SetSecurityDescriptorDacl InitializeSecurityDescriptor QueryServiceConfigW EnumServicesStatusW QueryServiceConfig2W OpenServiceW OpenSCManagerW CloseServiceHandle RegEnumKeyW DuplicateTokenEx CreateProcessAsUserW AdjustTokenPrivileges LookupPrivilegeValueW ConvertSidToStringSidW GetTokenInformation RegEnumKeyExW RevertToSelf RegEnumValueW RegOpenCurrentUser RegDeleteValueW ImpersonateLoggedOnUser RegCreateKeyExW

shell32

SHFileOperationW ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathW ord165 SHGetFolderPathW

ole32

CoTaskMemFree CoSetProxyBlanket CoUninitialize CoCreateInstance CoCreateGuid CoInitializeSecurity CoInitialize CoInitializeEx

oleaut32

VariantClear VarBstrCmp SysAllocString SysStringLen SysFreeString SysAllocStringLen VariantInit

shlwapi

PathRemoveBackslashW PathAddBackslashW PathIsURLW SHGetValueW PathIsDirectoryW PathFindFileNameW PathAppendW PathRemoveFileSpecW PathFileExistsW

wldap32

ord200 ord32 ord35 ord22 ord46 ord143 ord41 ord26 ord60 ord30 ord79 ord33 ord27 ord301 ord211 ord50

ws2_32

WSACleanup WSAStartup getsockopt gethostname getaddrinfo freeaddrinfo ioctlsocket listen accept recvfrom sendto select __WSAFDIsSet send getpeername WSAIoctl connect WSAGetLastError htons ntohs getsockname setsockopt recv bind socket WSASetLastError closesocket

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

winhttp

WinHttpCreateUrl

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

psapi

GetModuleInformation EnumProcessModules GetProcessMemoryInfo GetModuleFileNameExW

PCFPopups.exe

IMPHASH 736032bfd5f3e6ce02545f8156252a9e
SHA256 f1081f5bd5a3c6633c39ceebbc4b82fdbe6ca4a88eb352d4315c92ddae0586f7
MD5 1df50b15c68268ddbf34021e739c1f81
SHA1 0cf83b165a40e273995222ddeab3ad2f615f4151
SHA512 7cdbd03a83003d169e420be5e31f13793636e43d911bedc8b2669eca227befe45bbdedfc2fca5c29b6f97faf8dd7e215f3e1292e55e7327a1aeb5575216eed0a
SSDEEP 49152:2rLHdb+rsgDrztEY580vz7Zfnn0BddXXOU9HRnnJN:2rjdb+ocrzNl4J
TLSH
T1CDB57D00F7D2C23BEEA301B645BD961E8539FA61170165D3E2881E9F2E726D27D3634B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

51:23:c5:34:c9:10:2b:c9:aa:87:31:22:7a:24:ed:29:87:77:c4:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 11, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1171854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFPopups.pdb

directui

DirectUI_MoveEx DirectUI_GetLanguageStyle DirectUI_GetControlPos DirectUI_IsControlVisible DirectUI_Invalidate DirectUI_TreeEx_InsertItem DirectUI_TreeEx_CreateControl DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_SetStaticLogoImage DirectUI_CreateControl DirectUI_DestroyControl DirectUI_Static_SetLogoImage DirectUI_GetControlText DirectUI_ChangeStyle DirectUI_TreeCtrl_Select DirectUI_TreeCtrl_SetStaticLogo DirectUI_TreeCtrl_ChangeStyle DirectUI_GetSafeHwnd DirectUI_SetLanguageStyle DirectUI_AutoText_SetControlText DirectUI_LoadSkinResourceFromZIP DirectUI_I18N_AddLanguageStyle DirectUI_GetVersion DirectUI_GetStringItem DirectUI_TreeCtrl_DeleteAllItems DirectUI_TreeCtrl_InsertItem DirectUI_TreeCtrl_SetControlText DirectUI_GetControlRect DirectUI_GetStringLength DirectUI_SubclassLayeredWindow DirectUI_Progress_SetPos DirectUI_EnableAnimate DirectUI_SetControlTextEx DirectUI_Static_SetLogoIcon DirectUI_EnableControl DirectUI_SetControlPos DirectUI_ShowControl DirectUI_SetTooltipString DirectUI_SetControlText uiUpdateWindow DirectUI_Button_SetCheck DirectUI_SubclassWindow DirectUI_Button_GetCheck DirectUI_UpdateSkin

datareport

Stop Start RD_W RD_WS

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?DelInstance@CAPCDispatcher@@SAXXZ

kernel32

ReleaseMutex lstrcmpiW LoadLibraryExW CreateEventW OutputDebugStringW SystemTimeToFileTime lstrcmpW GetSystemDirectoryW InitializeCriticalSectionAndSpinCount TerminateThread GetLocalTime WritePrivateProfileStringW GlobalUnlock GlobalLock MulDiv CreateDirectoryW WriteFile FlushFileBuffers SetFilePointer SetEndOfFile GetStartupInfoW GetExitCodeProcess ProcessIdToSessionId WTSGetActiveConsoleSessionId GetEnvironmentVariableW SetErrorMode GetSystemWindowsDirectoryW GetFileAttributesW GetCurrentDirectoryW LocalAlloc DebugBreak VirtualProtect GetVersion IsBadCodePtr GetModuleHandleExW ExitThread GetCommandLineW GetWindowsDirectoryW GetModuleHandleA VirtualFree CreateFileMappingA InterlockedExchange InterlockedCompareExchange GetFileSizeEx ReadProcessMemory VirtualQueryEx lstrlenA HeapCreate AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler TerminateProcess VirtualQuery GetModuleFileNameA lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW MultiByteToWideChar WideCharToMultiByte CreateFileW CloseHandle GetFileSize GetProcessTimes IsProcessorFeaturePresent SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoA GetLocaleInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetStringTypeA GetStartupInfoA GetFileType SetHandleCount GetConsoleMode GetConsoleCP LCMapStringA ExitProcess HeapDestroy LCMapStringW IsValidCodePage GetOEMCP GetStdHandle HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue RtlUnwind HeapReAlloc GetCPInfo CreateThread GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter LoadLibraryA ReadFile GetTempPathW GetTempFileNameW CopyFileW DeleteFileW Process32NextW OpenProcess GetModuleFileNameW GetPrivateProfileStringW GetPrivateProfileIntW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GlobalMemoryStatusEx SetLastError EnterCriticalSection LeaveCriticalSection Sleep GetCurrentProcessId GetCurrentProcess GetCurrentThreadId RaiseException FlushInstructionCache GetLastError GetVersionExW GetLongPathNameW FindFirstFileW FileTimeToSystemTime Process32FirstW CreateToolhelp32Snapshot VerifyVersionInfoW VerSetConditionMask GetProcAddress CreateMutexW InterlockedIncrement WaitForSingleObject LoadLibraryW FreeLibrary QueueUserAPC MoveFileExW GetFileAttributesExW FindFirstFileExW FindNextFileW GlobalFree GetPrivateProfileSectionNamesW CreateFileA InterlockedDecrement GetACP FormatMessageW CreateProcessW GetSystemTime WinExec ExpandEnvironmentStringsW GetTickCount GetTimeZoneInformation GetPrivateProfileSectionW lstrlenW LocalFree OpenFileMappingW IsBadReadPtr HeapAlloc UnmapViewOfFile MapViewOfFile CreateFileMappingW GetModuleHandleW InitializeCriticalSection HeapFree GetProcessHeap DeleteCriticalSection DeviceIoControl GlobalAlloc FindClose

user32

CreateIconFromResource PrivateExtractIconsW MessageBoxW TrackMouseEvent GetWindowTextLengthW GetWindowTextW BeginPaint EndPaint GetFocus GetClassNameW GetSysColor CreateAcceleratorTableW ClientToScreen SetCapture ReleaseCapture FillRect InvalidateRgn GetDC DestroyAcceleratorTable SetRect OffsetRect UpdateLayeredWindow ReleaseDC ScreenToClient GetMessagePos TranslateMessage DispatchMessageW GetThreadDesktop CloseDesktop IsWindowVisible RegisterWindowMessageW SendMessageW GetWindowLongW SetWindowLongW WindowFromPoint GetWindowThreadProcessId GetShellWindow GetDesktopWindow UnregisterClassA MoveWindow GetSystemMetrics GetWindowRect IsWindow FindWindowW GetUserObjectInformationA OpenInputDesktop IsChild CharNextW SetTimer ShowWindow AttachThreadInput SetForegroundWindow SetWindowPos GetForegroundWindow RedrawWindow UpdateWindow PostMessageW KillTimer SetLayeredWindowAttributes GetMessageW MonitorFromPoint GetMenuItemInfoW RemoveMenu DefWindowProcW SetWindowTextW RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW CallWindowProcW DestroyIcon LoadImageW LoadStringW DestroyWindow MapWindowPoints GetClientRect GetMenuItemCount AppendMenuW TrackPopupMenuEx GetParent GetMonitorInfoW MonitorFromWindow GetWindow wsprintfW GetDlgItem CreateDialogParamW SendMessageTimeoutW InvalidateRect DialogBoxParamW GetActiveWindow EndDialog SetFocus SetCursor ReplyMessage LoadStringA PostQuitMessage DestroyMenu MessageBeep PeekMessageW PtInRect CreatePopupMenu

gdi32

CreateICW CreateCompatibleBitmap CreateSolidBrush GetStockObject GetObjectW GetDeviceCaps CreateCompatibleDC DeleteObject DeleteDC BitBlt SelectObject

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegQueryValueExW RegCloseKey RegOpenKeyW RegOpenKeyExW RevertToSelf ImpersonateLoggedOnUser OpenProcessToken RegSetValueExW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyW GetTokenInformation RegQueryValueW RegEnumKeyExW RegDeleteKeyW RegQueryInfoKeyW RegDeleteValueW AllocateAndInitializeSid FreeSid CheckTokenMembership GetUserNameW OpenEventLogW ReadEventLogW CloseEventLog OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceConfigW QueryServiceConfig2W SetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetKernelObjectSecurity GetLengthSid

shell32

SHFileOperationW ExtractIconExW DuplicateIcon ord165 SHGetFolderPathW SHGetFileInfoW ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteExW

ole32

OleInitialize CLSIDFromString CLSIDFromProgID CoCreateGuid CreateStreamOnHGlobal StringFromGUID2 OleUninitialize CoInitializeEx CoGetClassObject CoInitializeSecurity CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoUninitialize CoInitialize OleLockRunning

oleaut32

SysFreeString VarUI4FromStr SysAllocString VariantClear SysStringLen VariantInit OleCreateFontIndirect LoadRegTypeLi LoadTypeLi SysAllocStringLen DispCallFunc

baidustore

??0Baidu_ListenData@@QAE@PB_W@Z ??1Baidu_ListenData@@UAE@XZ ?DoMonitorDevSize@CBaiduStoreMgr@@QAEXXZ ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?SaveShowBigFilePopup@BdConfig@@QAEXH@Z ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?SaveSound@BdConfig@@QAEXH@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z ?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ ?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z ?LoadConfig@BdConfig@@QAEXXZ ?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?SaveShowPlugPopup@BdConfig@@QAEXH@Z ?SaveShowmalwarePopup@BdConfig@@QAEXH@Z ?SaveWeatherConfig@BdConfig@@QAEXXZ ?SaveBootTimeHelperPopup@BdConfig@@QAEXH@Z ?SaveActivitys@BdConfig@@QAEXXZ ?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z

shlwapi

StrCpyNW SHGetValueW PathFindExtensionW StrStrIW SHDeleteValueW StrCmpNW StrCmpIW StrStrW StrCmpNIW StrCmpW PathIsRelativeW PathFindFileNameW PathAddBackslashW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpReadData WinHttpSetCredentials WinHttpOpen WinHttpCreateUrl WinHttpAddRequestHeaders WinHttpQueryHeaders

psapi

GetModuleFileNameExW GetModuleInformation

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipSaveImageToFile GdiplusShutdown GdiplusStartup GdipSetWorldTransform GdipSetSmoothingMode GdipCreateBitmapFromGraphics GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateFromHDC GdipAddPathStringI GdipDeletePath GdipCreatePath GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDeletePen GdipCreatePen1 GdipDisposeImage GdipCreateSolidFill GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix2 GdipAlloc GdipFree GdipCreateBitmapFromFile GdipGetImageRawFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipLoadImageFromFile GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectRectI GdipDrawImagePointRectI GdipDrawImageRectRect GdipFillPath GdipGraphicsClear GdipSetInterpolationMode GdipDrawPath GdipDeleteBrush

winmm

PlaySoundW

msi

ord217 ord173

userenv

ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock

PCFTray.exe

IMPHASH d523aa3794530e1c7b9ea23152927547
SHA256 7405580e9edcbedc68d5086ec035ed8997cbfd5c6c116c4f9b11d734e19e733f
MD5 a9fd4e1481e06aa3ed0b29630c9defcb
SHA1 6d49640e06bed8be53c8c9e69a2d5a244798d9e0
SHA512 e70920617a7a9d5850feeeb7bdf96e1949d113a8a100b7d01f2c4b4aa34fdc8f64de94ea1d202b5ef733d682e6c56d95ed8d85fff99a648712a61ce61270b79b
SSDEEP 49152:TwCIqGuvak8WTBx6LjSvWkhvz7Zfnn0BddRX6nQDBj6U+ER:Hik8iBsL3k5Q
TLSH
T144B53B10B743C13EF9B705F28ABE456E912CAE20175460D792C85C9F1EB6AF27E32617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

56:97:0a:bd:7a:5e:6a:63:39:82:4e:ac:94:b8:d9:18:06:fd:56:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

870551

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFTray.pdb

directui

DirectUI_SubclassWindow DirectUI_UpdateSkin DirectUI_SubclassLayeredWindow DirectUI_AutoText_SetControlText DirectUI_SetControlText DirectUI_ChangeStyle DirectUI_SetLanguageStyle DirectUI_LoadSkinResourceFromZIP DirectUI_GetStringItem DirectUI_Button_SetCheck DirectUI_Button_GetCheck DirectUI_TrackPopupMenu DirectUI_SetControlTextEx DirectUI_ShowControl

datareport

RD_W Start Stop

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?DelInstance@CAPCDispatcher@@SAXXZ

sqlite

sqlite3_close sqlite3_errmsg16 sqlite3_column_text16 sqlite3_column_count sqlite3_busy_timeout sqlite3_open16 sqlite3_free sqlite3_prepare16 sqlite3_finalize sqlite3_step

kernel32

GetTimeZoneInformation lstrcmpiW LoadLibraryExW InitializeCriticalSectionAndSpinCount GetDriveTypeW InterlockedCompareExchange InterlockedExchange HeapAlloc GetProcessHeap HeapFree QueryDosDeviceW GetVolumeInformationW GetDiskFreeSpaceExW LocalAlloc WriteFile OutputDebugStringW IsWow64Process FindFirstFileW FindNextFileW FindClose QueueUserWorkItem SystemTimeToFileTime GetFileSizeEx VirtualQueryEx lstrlenA GetWindowsDirectoryW DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW GetCommandLineW GetModuleHandleA VirtualFree CreateFileMappingA HeapCreate AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler SetEndOfFile SetFilePointer VirtualQuery GetModuleFileNameA lstrcatA GetThreadContext DuplicateHandle VirtualAlloc OpenEventW lstrcpyA GetCurrentThread VirtualProtectEx CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW GetPrivateProfileSectionW FindResourceW LoadResource GetSystemWindowsDirectoryW GetSystemDirectoryW SizeofResource SwitchToThread ResetEvent SetNamedPipeHandleState DeleteFileW GetOverlappedResult ReadFileEx ConnectNamedPipe CreateNamedPipeW WriteFileEx DisconnectNamedPipe OpenThread InterlockedExchangeAdd GetProcessTimes GetPrivateProfileSectionNamesW SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FlushFileBuffers GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType SetHandleCount GetStdHandle ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW LCMapStringA RtlUnwind GetStartupInfoW ResumeThread GetSystemTimeAsFileTime CreateThread IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy GetShortPathNameW GetFileAttributesW GetTempPathW GetCurrentDirectoryW GetLongPathNameW LockResource ExpandEnvironmentStringsW GetLastError GetVersionExW FindResourceExW GetEnvironmentVariableW WaitNamedPipeW CopyFileW CreateFileA GetTempFileNameW ReadFile GetFileSize CreateFileW CreateMutexW InterlockedDecrement InterlockedIncrement WTSGetActiveConsoleSessionId ProcessIdToSessionId FlushInstructionCache RaiseException GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW WritePrivateProfileStringW TerminateProcess GetCurrentThreadId SystemTimeToTzSpecificLocalTime GetLocalTime CreateProcessW OpenMutexW WaitForMultipleObjects TerminateThread SetEvent CreateEventW VirtualFreeEx ReadProcessMemory WriteProcessMemory VirtualAllocEx GetTickCount UnmapViewOfFile MapViewOfFile CreateFileMappingW OpenFileMappingW SetLastError Sleep FreeLibrary GetPrivateProfileIntW LoadLibraryW GetModuleHandleW GetProcAddress GetPrivateProfileStringW GetCurrentProcessId GetModuleFileNameW GetCurrentProcess VerSetConditionMask VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW InitializeCriticalSection ReleaseMutex WaitForSingleObject LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrlenW LocalFree CloseHandle DeviceIoControl GlobalFree MultiByteToWideChar WideCharToMultiByte GlobalAlloc SetErrorMode

user32

GetWindowLongW UpdateLayeredWindow FindWindowExW SetWindowLongW SetFocus DestroyWindow IsWindowVisible ShowWindow OffsetRect GetWindowThreadProcessId MoveWindow GetSystemMetrics GetWindowRect FindWindowW IsWindow UnregisterClassA GetClassInfoW MsgWaitForMultipleObjectsEx KillTimer SetTimer LoadStringW LoadImageW DestroyIcon LoadIconW SendMessageW SetWindowPos DefWindowProcW LoadCursorW CreateWindowExW DialogBoxParamW EndDialog SetWindowTextW MapWindowPoints GetClientRect GetParent GetMonitorInfoW MonitorFromWindow GetWindow PostMessageW RegisterWindowMessageW EnumWindows PostQuitMessage PeekMessageW TranslateMessage DispatchMessageW SendMessageTimeoutW GetCursorPos OpenInputDesktop GetUserObjectInformationA SetActiveWindow SetForegroundWindow CloseDesktop GetThreadDesktop GetDesktopWindow AttachThreadInput GetForegroundWindow GetActiveWindow MsgWaitForMultipleObjects CreatePopupMenu DestroyMenu AppendMenuW RegisterClassExW LoadStringA CallWindowProcW MessageBeep PtInRect InvalidateRect TrackPopupMenuEx GetMenuItemCount RemoveMenu GetMenuItemInfoW MonitorFromPoint CharNextW GetMessageW RegisterClassW SystemParametersInfoW GetWindowTextW GetWindowTextLengthW GetIconInfo PostThreadMessageW UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterClassW GetClassInfoExW

gdi32

GetDIBits GetObjectW GetStockObject CreateICW DeleteObject DeleteDC SelectObject CreateCompatibleBitmap CreateCompatibleDC

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateLoggedOnUser RegOpenCurrentUser RegCreateKeyExW RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW RevertToSelf GetTokenInformation RegNotifyChangeKeyValue RegEnumKeyExW GetUserNameW RegDeleteValueW RegDeleteKeyW RegEnumValueW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl AllocateAndInitializeSid RegQueryInfoKeyW FreeSid CheckTokenMembership CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfig2W SetServiceStatus EnumServicesStatusW RegisterServiceCtrlHandlerW QueryServiceConfigW RegEnumKeyW SetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetKernelObjectSecurity GetLengthSid

shell32

SHGetFolderLocation ShellExecuteW CommandLineToArgvW SHQueryRecycleBinW ShellExecuteExW ExtractIconW SHFileOperationW SHGetFolderPathW ord165 Shell_NotifyIconW SHGetSpecialFolderPathW SHGetFileInfoW

ole32

CoInitialize CoInitializeEx CoCreateGuid CoSetProxyBlanket CoInitializeSecurity CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocStringLen VariantInit VariantClear SysStringLen SysAllocString VarUI4FromStr

baidustore

?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z ?SaveActivitys@BdConfig@@QAEXXZ ??1Baidu_ListenData@@UAE@XZ ??0Baidu_ListenData@@QAE@PB_W@Z ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?UpdateSystemConfig@CBaiduStoreMgr@@QAEXXZ ?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z ?UpdateConfig@BdConfig@@QAEXXZ ?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ ?EnableBdKernel@CBaiduStoreMgr@@QAEXXZ ?EnableBdKernel2@CBaiduStoreMgr@@QAEXXZ ?SavePluginWarningTime@BdConfig@@QAEXK@Z ?DoMonitorDevSize@CBaiduStoreMgr@@QAEXXZ ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z ?DoMonitorStartupItem@CBaiduStoreMgr@@QAEXXZ ?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?SaveConfig@BdConfig@@QAEXXZ ?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z ?SaveAutoRunConfig@BdConfig@@QAEXH@Z ?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z ?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?SaveBrowserJunkPopupTime@BdConfig@@QAEXK@Z ?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z ?SavePrivacyCleanTime@BdConfig@@QAEXK@Z ?DoMonitorDevTarySize@CBaiduStoreMgr@@QAEXXZ ?LoadConfig@BdConfig@@QAEXXZ

psapi

GetModuleFileNameExW GetModuleInformation GetProcessImageFileNameW

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

shlwapi

SHDeleteKeyW PathFindExtensionW StrStrIW StrStrW PathAddBackslashW SHDeleteValueW SHSetValueW SHGetValueW StrCmpW PathIsRelativeW PathIsDirectoryW PathAppendW PathFileExistsW PathFindFileNameW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

gdiplus

GdipLoadImageFromFileICM GdipDrawImageRectRectI GdipGraphicsClear GdipDeleteGraphics GdipFree GdipAlloc GdipDisposeImage GdiplusShutdown GdiplusStartup GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipLoadImageFromFile GdipCreateFromHDC

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

feedback

?QueryReply@feedback@baidu@@YAKW4ProductId@12@W4LanguageId@12@PB_WPA_WI@Z

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces CM_Get_Device_IDW CM_Get_DevNode_Registry_PropertyW CM_Get_Parent SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

crypt32

CryptMsgClose CertCloseStore CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

PCFaster.exe

IMPHASH fa43a753e531a03e4cd459a9c2656216
SHA256 2782e27878c82c9ebf7d0c7d4206708962fab1540973b3b75b34882a107ad755
MD5 b6a7c8469e047e64cc378ae224b6fc22
SHA1 401746b4888d8138708fbd192e788c34f4ae9754
SHA512 2ea43fb4fda95f4dc565269a7c8b63d769c1cbd3ec36b6e9be0667a3a8e8ef700e82cb9acb6ed5de762c63d3e0f446d1aa624b464b2854019f20b466bc1e70dc
SSDEEP 24576:hBPtkHNeU3w+UWDGF+IeQaEZJAZYMBNQwfmzDYRcs1C5wzxL:hlKNxesGnCYMpuzDYRcs05wt
TLSH
T119655A00E690D13AF8B305F68ABA426D9638BE311715A0CF53C46EAD9F71AE17D31727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8c:c0:cd:92:f0:85:55:93:bd:78:d4:6f:cd:b6:19:9d:89:31:96:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

682218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFaster.pdb

directui

DirectUI_SetTooltipStringEx DirectUI_GetControlStyle DirectUI_GetSafeHwnd DirectUI_SubclassLayeredWindow DirectUI_TreeEx_DeleteAllItems DirectUI_TreeEx_InsertItem DirectUI_TreeEx_CreateControl DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_SetStaticLogoImage DirectUI_TreeEx_SetButtonCheck DirectUI_TreeEx_SetControlText DirectUI_TreeEx_ChangeStyle DirectUI_Invalidate DirectUI_SetLanguageStyle uiUpdateWindow DirectUI_CreateControl DirectUI_DestroyControl DirectUI_UpdateSkin DirectUI_LoadSkinResourceFromZIP DirectUI_I18N_AddLanguageStyle DirectUI_Progress_SetPos DirectUI_Progress_SetRange DirectUI_EnableAnimate DirectUI_TrackPopupMenu DirectUI_GetControlRect DirectUI_GetControlText DirectUI_ChangeStyle DirectUI_IsControlVisible DirectUI_GetStringLength DirectUI_Edit_GetSrcText DirectUI_Edit_SetMarkText DirectUI_Edit_SetSrcText DirectUI_ComboBox_AddString DirectUI_SubclassWindow DirectUI_GetStringItem DirectUI_Button_SetCheck DirectUI_Button_GetCheck DirectUI_ComboBox_SetCurSel DirectUI_ComboBox_GetCurSel DirectUI_GetLanguageStyle DirectUI_EnableControl DirectUI_SetControlTextEx DirectUI_SetControlText DirectUI_SetControlPos DirectUI_GetVersion DirectUI_GetControlPos DirectUI_ShowControl

datareport

RD_W Stop Start

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?DelInstance@CAPCDispatcher@@SAXXZ ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

SetFilePointer MoveFileExW CreateProcessW GetFileAttributesW CreateSemaphoreW OpenMutexW GetExitCodeThread ReleaseSemaphore DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW GetCommandLineW InterlockedExchange InterlockedCompareExchange SystemTimeToFileTime GetLocalTime GetFileSizeEx ReadProcessMemory VirtualQueryEx lstrlenA GetWindowsDirectoryW GetModuleHandleA VirtualFree CreateFileMappingA LocalAlloc HeapCreate HeapAlloc AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler VirtualQuery GetModuleFileNameA lstrcatA GetThreadContext DuplicateHandle VirtualAlloc lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr SetEndOfFile lstrcpyW GetShortPathNameW GetACP FindClose InterlockedIncrement GetFileAttributesExW SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA GetCurrentDirectoryA GetFullPathNameA FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP QueryPerformanceCounter GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP LCMapStringW LCMapStringA GetCPInfo FindFirstFileA GetDriveTypeA GetFileInformationByHandle FileTimeToLocalFileTime FileTimeToSystemTime RtlUnwind GetStartupInfoW ResumeThread CreateThread IsDebuggerPresent UnhandledExceptionFilter GetSystemTimeAsFileTime GetProcessTimes GetPrivateProfileSectionNamesW IsProcessorFeaturePresent HeapSize HeapReAlloc HeapDestroy FormatMessageA ExpandEnvironmentStringsA WaitForMultipleObjects GetFileType LoadLibraryA GetStdHandle PeekNamedPipe GetVersionExA SleepEx InitializeCriticalSectionAndSpinCount InterlockedDecrement lstrlenW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateMutexW CloseHandle WaitForSingleObject ReleaseMutex InitializeCriticalSection CreateFileW GetFileSize ReadFile MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetModuleFileNameW WriteFile WTSGetActiveConsoleSessionId ProcessIdToSessionId IsWow64Process WritePrivateProfileStringW CreateEventW SetEvent OpenEventW TerminateProcess GetFullPathNameW MulDiv ExpandEnvironmentStringsW GetTickCount LoadLibraryW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW LocalFree DeviceIoControl GlobalFree GlobalAlloc CreateFileA GetExitCodeProcess WinExec OpenFileMappingW GetLongPathNameW IsValidLocale GetPrivateProfileIntW WideCharToMultiByte VerSetConditionMask VerifyVersionInfoW HeapFree GetProcessHeap LoadLibraryExW lstrcmpiW Sleep FreeLibrary UnmapViewOfFile MapViewOfFile CreateFileMappingW RaiseException GetTempPathW GetTempFileNameW CopyFileW DeleteFileW GetLastError GetVersionExW GetCurrentProcess GetPrivateProfileStringW GetProcAddress GetModuleHandleW GetPrivateProfileSectionW GetTimeZoneInformation FlushInstructionCache SetLastError GetCurrentThreadId

user32

MonitorFromPoint MoveWindow FindWindowW GetMenuItemCount GetForegroundWindow GetCursorPos PtInRect ReplyMessage UnregisterClassA SetWindowPos MapWindowPoints GetClientRect TrackPopupMenuEx InvalidateRect GetThreadDesktop CloseDesktop GetUserObjectInformationA OpenInputDesktop ClientToScreen ScreenToClient TranslateAcceleratorW CreatePopupMenu DestroyMenu AppendMenuW LoadStringW LoadStringA CallWindowProcW MessageBeep SetWindowLongW GetMenuItemInfoW GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindowLongW GetWindow SendMessageW DestroyWindow DefWindowProcW RegisterWindowMessageW CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW LoadImageW DialogBoxParamW SetWindowTextW PostMessageW IsWindow RemoveMenu SetForegroundWindow PostQuitMessage DialogBoxIndirectParamW GetDialogBaseUnits SetRect DrawTextW GetMenuState DeleteMenu EnableMenuItem GetSystemMenu SetPropW GetPropW OffsetRect ShowWindow IsWindowVisible FindWindowExW UpdateLayeredWindow ReleaseDC GetWindowDC SetTimer KillTimer GetActiveWindow EndDialog SetFocus GetSystemMetrics GetDesktopWindow GetWindowThreadProcessId IsIconic AttachThreadInput

gdi32

CreateFontW CreateICW DeleteObject DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey OpenProcessToken GetTokenInformation RegSetValueExW RegCreateKeyExW RegEnumKeyExW RegDeleteKeyW RegQueryInfoKeyW RegDeleteValueW RegQueryValueW RegOpenKeyW GetUserNameW RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW AllocateAndInitializeSid FreeSid CheckTokenMembership SetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetKernelObjectSecurity GetLengthSid CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptHashData CryptGetHashParam

shell32

ShellExecuteW ShellExecuteExW ord165 SHGetFolderPathW CommandLineToArgvW SHFileOperationW SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize CoTaskMemFree CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

VariantInit SysFreeString SysAllocString VariantClear VarUI4FromStr

baidustore

?GetPluginItemEnableStatus@CBaiduStoreMgr@@QAEHI@Z ?DoRestartWindow@CBaiduStoreMgr@@QAEXXZ ?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?RestoreToDefault@BdConfig@@QAEXXZ ?SaveShowPlugPopup@BdConfig@@QAEXH@Z ?SaveShowBigFilePopup@BdConfig@@QAEXH@Z ?SaveConfig@BdConfig@@QAEXXZ ?ReportState@CBaiduStoreMgr@@QAEHKK@Z ?UpdateSystemConfig@CBaiduStoreMgr@@QAEXXZ ?SaveSound@BdConfig@@QAEXH@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ??0Baidu_ListenData@@QAE@PB_W@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?GetShowmalwarePopup@BdConfig@@QAEHXZ ??1BdConfig@@QAE@XZ ??0BdConfig@@QAE@XZ ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z ??1Baidu_ListenData@@UAE@XZ ?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z ?SaveSparkClick@BdConfig@@QAEXH@Z ?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?ConnectSubSvc@CBaiduStoreMgr@@QAEHPB_WH@Z ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?OnKernelHandle@CBaiduStoreMgr@@QAEXPAX@Z ?GetPluginItemFilePath@CBaiduStoreMgr@@QAE?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@I@Z ?EnableBdKernel@CBaiduStoreMgr@@QAEXXZ ?InitKrnIPCClient@CBaiduStoreMgr@@QAEHK@Z ?CloseKernelHandle@CBaiduStoreMgr@@QAEXXZ ?UpdateConfig@BdConfig@@QAEXXZ ?GetUpdateState@BdConfig@@QAEIXZ

shlwapi

StrCmpIW PathRemoveExtensionW SHGetValueW PathRemoveFileSpecW PathAddBackslashW PathFindFileNameW PathFileExistsW PathAppendW PathIsDirectoryW PathIsRelativeW PathRemoveBackslashW SHSetValueW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

winhttp

WinHttpCreateUrl WinHttpCloseHandle

gdiplus

GdipLoadImageFromFile GdipLoadImageFromFileICM GdipDrawImageRectRectI GdipDrawImageRectI GdipDrawImageRect GdipGraphicsClear GdipGetWorldTransform GdipSetWorldTransform GdipDeleteGraphics GdipCloneImage GdipDisposeImage GdipRotateMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC

powrprof

CallNtPowerInformation

winmm

PlaySoundW

wldap32

ord301 ord211 ord46 ord200 ord32 ord35 ord22 ord50 ord143 ord41 ord26 ord60 ord30 ord79 ord33 ord27

ws2_32

gethostname getaddrinfo freeaddrinfo ioctlsocket listen accept recvfrom sendto select __WSAFDIsSet send getpeername WSAIoctl connect WSAGetLastError htons ntohs getsockname setsockopt recv bind socket WSASetLastError closesocket getsockopt WSAStartup WSACleanup

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

EnumProcessModules GetModuleFileNameExW GetModuleInformation

PCFasterFeedback.exe

IMPHASH 1d1fd45aba33ed4661503fef5af8cf5d
SHA256 f0843266d1d300565d2470dbcb3b42943ab5f8774e5a636b0325bbf860d62c2e
MD5 6cbd3bef48b6ef362d2399f23b59eb12
SHA1 c080034bb2de16a511caa84a417a74f8ce02df25
SHA512 becb1a34c6fc9c031debafefe1977253af4c08220cc791cddf6eff2dfe8c9a52416f492c4f98427a1c619c114fdbf0494591f9773d0c37e1003d87e6da8b6aed
SSDEEP 6144:u4VYfU//sYGqXYh6Aj4NmL4mJjqAW1j0FLcQb:u4VTu2Ynj4NmnJjqtQ9b
TLSH
T14884AE50F781E03AC54315724AB6AB3A697EBE21172495C7E3843F2D9E317D1EE3930A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

83:76:89:77:77:9a:8c:32:d4:3e:fe:05:7d:fe:0a:b1:28:7b:3b:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

177771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFasterFeedback.pdb

kernel32

GetTempFileNameW CopyFileW DeleteFileW WaitForSingleObject SizeofResource LockResource LoadResource FindResourceW FindResourceExW WideCharToMultiByte lstrlenA GetCurrentProcess GetVersionExW GetProcAddress GetModuleHandleW GetSystemInfo GlobalMemoryStatusEx GetLocalTime GetLogicalDriveStringsW VirtualAlloc GetDriveTypeW GetDiskFreeSpaceExW VirtualFree InterlockedDecrement ReadFile MultiByteToWideChar WinExec GetPrivateProfileIntW GetFileSize CreateFileW GetPrivateProfileStringW FindNextFileW FindFirstFileW GetLastError VerifyVersionInfoW SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle CreateFileA GetConsoleMode GetConsoleCP GetStringTypeW GetStringTypeA GetLocaleInfoA VerSetConditionMask GetModuleFileNameW FindClose LCMapStringA GetModuleHandleA GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount LoadLibraryA CloseHandle GetTempPathW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap Sleep InterlockedExchange GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileSectionW CreateMutexW SetFilePointer CreateDirectoryW WriteFile DeviceIoControl GetCurrentProcessId GetWindowsDirectoryW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess ExitThread GetCurrentThreadId CreateThread GetStartupInfoW RtlUnwind GetSystemTimeAsFileTime HeapCreate TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetStdHandle GetModuleFileNameA lstrlenW

user32

GetSystemMetrics

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryValueExW RegOpenKeyW RegQueryValueW RegQueryInfoKeyW RegEnumValueW RegCloseKey

shell32

SHGetFolderPathW SHGetSpecialFolderPathW ShellExecuteW ord165 SHFileOperationW

ole32

CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateGuid CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString

log

WriteLog

feedback

?CreateFeedbackDialog@feedback@baidu@@YAKW4ProductId@12@PB_W11W4LanguageId@12@1P6AJ1PAUtagVARIANT@@33@Z1111PAPB_W@Z ?FeedbackDialogExecScript@feedback@baidu@@YAJPB_WPAUtagVARIANT@@@Z

shlwapi

PathFindFileNameW SHRegGetValueW PathFileExistsW PathAppendW PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW StrFormatByteSizeW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

powrprof

CallNtPowerInformation

PCFasterSvc.exe

IMPHASH 79fc39bc6839416a3cc717455bb9bfd6
SHA256 6dda95e67fdaa2d2fba7624809d08884c03a4c3637f9c52615e19a85e96071e6
MD5 e7682b9cfc8bbc5fc08030f4467d5e3d
SHA1 7b6c18ca943f432d14d8420cce6260442d1f44b8
SHA512 974b3a89363647d53b0db9fa30e1f049fc835f957f02a481d3826dc692e82edddd29eb6e59520ff80c67de78fda12445e75d635e021e0d1a75c7f635fe074ed6
SSDEEP 49152:BAS2q4EMhNpBjUBEVHkgQvz7Zfnn0BddsXCehkvfXJ/eAqT:BAS2ZhNpB5Wr
TLSH
T124854B10A742813EF9B305F1CEBD45AD5668BE200B5460D7E3CC5D9E4AB69E27E3231B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a7:fb:8c:0d:de:c4:64:c5:37:3a:9b:a9:7a:98:1e:ff:ae:6a:c1:ed

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

663638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PCFasterSvc.pdb

datareport

Stop RD_WW RD_W Start

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z StopLog ?GetInstance@CAPCDispatcher@@SAPAV1@XZ StartLog ?DelInstance@CAPCDispatcher@@SAXXZ

kernel32

GetFileAttributesW GetFileSizeEx ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime ExitThread HeapSize HeapReAlloc GetStartupInfoW RtlUnwind RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage GetStdHandle GetModuleFileNameA LCMapStringA LCMapStringW HeapCreate HeapDestroy VirtualFree VirtualAlloc FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetStringTypeA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW InterlockedExchangeAdd DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe ReadFileEx GetOverlappedResult WaitNamedPipeW SetNamedPipeHandleState SwitchToThread IsBadCodePtr CreateDirectoryW GetLocalTime GetWindowsDirectoryW VirtualQueryEx FlushInstructionCache CreateFileMappingA AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery lstrcatA GetThreadContext OpenMutexW OpenFileMappingW lstrcpyA VirtualAllocEx VirtualFreeEx VirtualProtectEx WriteProcessMemory CreateRemoteThread GetExitCodeThread lstrcpyW GetLocaleInfoW GlobalFindAtomW GlobalDeleteAtom LoadLibraryA GetVersionExA DuplicateHandle SetEndOfFile FlushFileBuffers SetFilePointer WriteFile GlobalAddAtomW GlobalFlags lstrcmpW GetModuleHandleA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc InterlockedDecrement SystemTimeToFileTime lstrcmpA GlobalLock GlobalUnlock FormatMessageW GetSystemInfo IsWow64Process ReadProcessMemory GetCurrentThread Thread32Next Thread32First GetVersion ResumeThread CheckRemoteDebuggerPresent UnmapViewOfFile LoadLibraryExW MapViewOfFile CreateFileMappingW OutputDebugStringW GetExitCodeProcess TerminateProcess TryEnterCriticalSection ReleaseMutex GetCurrentProcess SetLastError GetLongPathNameW GetModuleHandleW ProcessIdToSessionId GetCurrentProcessId WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerW WritePrivateProfileStringW OpenEventW CreateProcessW TerminateThread CreateThread CreateEventW SetEvent ResetEvent GetModuleHandleExW WTSGetActiveConsoleSessionId VerSetConditionMask VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW HeapFree GetProcessHeap HeapAlloc IsBadReadPtr WaitForSingleObject InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeCriticalSection IsBadWritePtr OpenThread LeaveCriticalSection EnterCriticalSection GetCurrentThreadId VirtualProtect DebugBreak lstrlenA LoadLibraryW InterlockedExchange InterlockedCompareExchange GetPrivateProfileIntW lstrlenW GetProcAddress GetVersionExW GetLastError LocalFree FreeLibrary CreateMutexW DeviceIoControl GlobalFree WideCharToMultiByte GlobalAlloc FindResourceExW CreateFileA GetCommandLineW Sleep InterlockedIncrement GetTickCount GetTimeZoneInformation GetPrivateProfileSectionW GetPrivateProfileStringW DeleteFileW CopyFileW GetTempFileNameW GetTempPathW GetModuleFileNameW ReadFile GetFileSize CreateFileW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar CloseHandle GetStringTypeW

user32

SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW AdjustWindowRectEx CallWindowProcW GetMenu SystemParametersInfoA IsIconic GetWindowPlacement CopyRect SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage GetKeyState ValidateRect SetWindowPos SetWindowLongW IsWindow GetFocus GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx LoadCursorW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu DispatchMessageW PeekMessageW MsgWaitForMultipleObjects CreateWindowExW RegisterClassW DefWindowProcW SendMessageW GetWindowThreadProcessId FindWindowExW RegisterWindowMessageW ExitWindowsEx MapWindowPoints GetMessagePos GetMessageTime DestroyWindow GetTopWindow GetForegroundWindow RemovePropW GetPropW SetPropW GetClassLongW GetCapture WinHelpW LoadIconW PostQuitMessage CheckMenuItem EnableMenuItem ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps DestroyMenu OpenInputDesktop GetUserObjectInformationA CloseDesktop GetThreadDesktop MsgWaitForMultipleObjectsEx SendMessageTimeoutW KillTimer SetTimer GetDlgItem

gdi32

GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC GetDeviceCaps

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SetSecurityDescriptorSacl GetKernelObjectSecurity SetTokenInformation DuplicateTokenEx CreateProcessAsUserW GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW FreeSid AllocateAndInitializeSid StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW MakeAbsoluteSD GetSecurityDescriptorControl GetSecurityDescriptorLength MakeSelfRelativeSD GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetAclInformation AddAce InitializeAcl IsValidSid GetLengthSid CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired RegEnumValueW RegEnumKeyExW RegDeleteKeyW GetUserNameW RegDeleteValueW RegOpenUserClassesRoot RevertToSelf RegSetValueExW RegCreateKeyExW RegOpenCurrentUser ImpersonateLoggedOnUser OpenProcessToken RegOpenKeyW RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl

shell32

CommandLineToArgvW ord165 SHGetFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitializeSecurity CoInitialize CoTaskMemFree

oleaut32

VariantChangeType SysFreeString SysAllocStringLen VariantInit VariantClear SysStringLen SysAllocString

shlwapi

StrStrIA StrStrIW PathUnquoteSpacesW PathRemoveArgsW SHGetValueW SHDeleteValueW PathIsDirectoryW PathAppendW SHDeleteKeyW PathFileExistsW PathFindFileNameW PathRemoveFileSpecW PathAddBackslashW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

psapi

GetModuleFileNameExW GetModuleInformation

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

oleacc

CreateStdAccessibleObject LresultFromObject

Plugins/Plugin.Antivirus/Plugin_Antivirus.dll

IMPHASH fef9cf5cc574cabe78e2cb57c510250f
SHA256 4f391a162feaf897f761e5cd853be6c82536bdc3584118cdce4017f771664b7d
MD5 58b6386913f05f033a9f986b30831abb
SHA1 8b797239f758b00eaa7c14438515451848ef443c
SHA512 5fc982c996c288692c8b486b833bf717ef041d7132c75b99dfed5abc2fde72803c82dfc1a21454f7ed33ae624f5fc95040c74020860f24824a0854232eb2288a
SSDEEP 12288:YZezjGnu8QlpDho2fDdV7utBn1YE5gmMDOLfVOmSLw:/mR+XKtt1Y2FkOIm2
TLSH
T14BF439116691813AF9FF0AB28A7C596D913DBDD20B20D1CB93C47CAD0E75AE1B93131B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f7:5f:24:02:54:44:fb:b6:f2:b9:7d:b9:24:b2:ec:f9:de:80:ac:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

371400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\jenkins\workspace\av-green_5-1-1_workspace\bavOutput\Pdb\Release\Plugin_FastAntivirus.pdb

log

WriteLog

directui

DirectUI_EnableAnimate DirectUI_TreeCtrl_SetControlPos DirectUI_TreeCtrl_ShowControl DirectUI_Progress_SetPos DirectUI_GetStringLength DirectUI_TreeCtrl_DeleteItem DirectUI_TreeCtrl_GetControlText DirectUI_SetControlText DirectUI_Button_SetUnknown DirectUI_GetControlRect DirectUI_AutoText_GetControlText DirectUI_TreeCtrl_ChangeStyle DirectUI_TreeCtrl_SetControlTextEx DirectUI_TreeCtrl_SetButtonCheck DirectUI_TreeCtrl_EnableChildControl DirectUI_TreeCtrl_DeleteAllItems DirectUI_TreeCtrl_InsertItem DirectUI_TreeCtrl_SetTooltipString DirectUI_TreeCtrl_SetControlText DirectUI_SetControlTextEx DirectUI_AutoText_SetControlTextEx DirectUI_SetScrollBarSkin DirectUI_EnableControl DirectUI_TreeCtrl_SetAutoTextItemText DirectUI_TreeCtrl_SetAutoTextItemTextEx DirectUI_MoveEx DirectUI_ShowControl DirectUI_Progress_SetRange DirectUI_AutoText_SetControlText DirectUI_SubclassWindow DirectUI_LoadSkinResourceFromZIP DirectUI_ChangeStyle DirectUI_SetTooltipStringEx DirectUI_SetTooltipString DirectUI_GetLanguageStyle DirectUI_GetControlPos DirectUI_SetControlPos DirectUI_GetControlText DirectUI_Button_GetCheck DirectUI_IsControlVisible DirectUI_TreeCtrl_Select DirectUI_TreeCtrl_GetButtonCheck DirectUI_Button_SetCheck DirectUI_GetStringItem DirectUI_GetSafeHwnd

kernel32

EnterCriticalSection LeaveCriticalSection OutputDebugStringA CloseHandle DeviceIoControl CreateFileW GetCurrentProcessId UnmapViewOfFile MapViewOfFile OpenFileMappingW GetDateFormatW Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateProcessW FreeLibrary CreateDirectoryW SetLastError GetCurrentThreadId RaiseException FlushInstructionCache GetCurrentProcess SystemTimeToFileTime GetTimeFormatW GetLocalTime GetProcAddress LoadLibraryW SetEndOfFile WriteFile SetFilePointer SetErrorMode GetModuleHandleW ReadFile FindResourceExW LoadResource DeleteFileW GetTempPathW IsBadReadPtr WaitForSingleObject InterlockedExchangeAdd InterlockedDecrement OpenThread HeapAlloc GetProcessHeap HeapFree DisconnectNamedPipe WriteFileEx CreateNamedPipeW ConnectNamedPipe DeleteCriticalSection ReadFileEx CreateEventW GetOverlappedResult GetModuleHandleExW CreateThread WaitNamedPipeW SetNamedPipeHandleState GetTickCount ResetEvent SwitchToThread TerminateThread GetStartupInfoA GetFileType SetHandleCount GetModuleHandleA GetModuleFileNameA GetStdHandle ExitProcess WriteConsoleW HeapCreate IsValidCodePage GetOEMCP GetACP TlsFree TlsSetValue TlsAlloc TlsGetValue GetCPInfo LCMapStringW LCMapStringA ResumeThread GetCommandLineA GetFileAttributesW GetDateFormatA GetTimeFormatA ExitThread GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InitializeCriticalSection HeapSize HeapReAlloc HeapDestroy GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetConsoleCP SetEvent InitializeCriticalSectionAndSpinCount LockResource SizeofResource FindResourceW lstrlenA MultiByteToWideChar lstrlenW WideCharToMultiByte WritePrivateProfileStringW GetPrivateProfileStringW GetTimeZoneInformation GetLastError InterlockedCompareExchange InterlockedExchange Sleep GetPrivateProfileIntW GetModuleFileNameW CopyFileW CreateFileA InterlockedIncrement FreeEnvironmentStringsA GetConsoleMode GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleOutputCP WriteConsoleA FlushFileBuffers GetStringTypeA SetEnvironmentVariableA CompareStringW SetStdHandle GetLocaleInfoW GetStringTypeW CompareStringA

user32

UnregisterClassA DestroyWindow GetMessageW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx RegisterClassW GetClassInfoW PostQuitMessage SendMessageTimeoutW GetWindowThreadProcessId MoveWindow ExitWindowsEx GetDlgItem GetParent GetClientRect MapWindowPoints EndDialog LoadBitmapW FindWindowExW SetWindowPos GetWindow GetWindowRect MonitorFromWindow GetMonitorInfoW RegisterWindowMessageW RegisterClassExW LoadCursorW GetClassInfoExW CreateWindowExW CallWindowProcW GetWindowLongW SetWindowLongW DialogBoxParamW DefWindowProcW GetScrollRange SetScrollPos GetActiveWindow SendMessageW KillTimer SetWindowTextW SetTimer IsWindow PostMessageW ShowWindow

gdi32

DeleteObject

comdlg32

GetSaveFileNameW

advapi32

SetSecurityDescriptorSacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW

shell32

ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW

ole32

CoInitialize CoUninitialize

shlwapi

SHRegGetValueW PathAddExtensionW SHGetValueW PathFileExistsW PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCrackUrl

Plugins/Plugin.Antivirus/res/res.bskin

SHA256 e0859ece59aad31beab455c96663a0f06d5d6e05945453df1c0592ccf534a50a
MD5 de3ff771d3ceeba2d8f20bc94e17c1be
SHA1 d769246286c2a0d3ee4cf444dec82e90145571ff
SHA512 374fb369117f8ae1f4f4ae764932d19bbc9b48f56596a48ae11e2d04eae1b1f3e22303ecdbc7b5dc21652597831ac39483efe47432b3fa27d760b5db86e1ad98
SSDEEP 3072:+l4IYp8exbxPIBnzL5VayNsCXlq0iyONB1msKE6/JbV9DEr6eNhHYCj18Yowrd4N:XIYp8+bJozFVay6eq0wlmgOeXH1yYowG
TLSH
T1FC0412AC587D829F62F27F5F75AB8142F67447E0B6320BCB714E86B8235391816610BB
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/CleanerEngine.dll

IMPHASH 0c3b173b75b94a1fc563b1e05750f047
SHA256 0ff7eb7bd3ef6cf9e3cd21a1653f537e2e95d9b1bde6a4d1c431e8eab9fd514c
MD5 05e10a04097cdfa22fa0ad809b672add
SHA1 ac1c7d805bdf609887555cda480fa3aee1638b2f
SHA512 ccfe8882d8f532b04c44828b7ee348a852f74b061694a0c0b46c9ca2d94f1373aa0c597a60ee28cc145cc5c1edf478da6a64e5e7835fb618a31cd5184d4d89ae
SSDEEP 49152:MYCyqgpS6S906Zcix0DcGBd+LYVsEAzy4Xvz7Zfnn0BddjXzE7ehLHjxEkEwwZZT:XCyqgpv6qiqcGBdpV
TLSH
T1D1A54C10A752913EF9FB04F1DEBD546D9628FD31070490CBA3C89C5E1AB69E2BE32617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

54:76:43:ff:3f:e6:a1:16:f9:e4:e8:66:6b:04:1f:da:86:9b:14:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1277473

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\CleanerEngine.pdb

sqlite

sqlite3_column_bytes sqlite3_column_text sqlite3_open sqlite3_exec sqlite3_prepare sqlite3_column_name16 sqlite3_step sqlite3_finalize sqlite3_prepare16 sqlite3_column_blob sqlite3_column_int sqlite3_open16 sqlite3_busy_timeout sqlite3_bind_blob sqlite3_column_text16 sqlite3_errmsg16 sqlite3_column_count sqlite3_close sqlite3_free

log2

?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?GetInstance@CAPCDispatcher@@SAPAV1@XZ

kernel32

MultiByteToWideChar VerifyVersionInfoW GetLastError GetProcAddress EnterCriticalSection FindClose Process32FirstW LockResource RemoveDirectoryW Process32NextW WTSGetActiveConsoleSessionId QueueUserWorkItem FindNextFileW CreateToolhelp32Snapshot DeleteCriticalSection CloseHandle GetSystemTime HeapReAlloc GetTickCount HeapDestroy HeapCreate HeapSize IsBadWritePtr OpenThread VirtualProtect GetCurrentThreadId DebugBreak GetEnvironmentVariableW SetErrorMode GetSystemWindowsDirectoryW GetFileAttributesW GetTempPathW GetCurrentDirectoryW GetLongPathNameW ExpandEnvironmentStringsW GetDriveTypeW SystemTimeToFileTime GetLogicalDriveStringsW CreateDirectoryW GetModuleHandleW FileTimeToSystemTime GetDiskFreeSpaceW GetDiskFreeSpaceExW DeleteFileW SetFileAttributesW GetVolumeInformationW GetVersionExW SetLastError LocalFree GetCurrentProcess WaitForSingleObject SetEvent ResetEvent CreateEventW MapViewOfFile UnmapViewOfFile CreateFileW CreateFileMappingW WriteFile GetModuleFileNameW ReadFile GetFileAttributesExW CreateProcessW GetExitCodeProcess IsWow64Process GetFileSize TerminateThread WritePrivateProfileStringW VirtualFree VirtualAlloc GetLocalTime GetPrivateProfileIntW InterlockedExchange InterlockedExchangeAdd GetWindowsDirectoryW lstrlenW OutputDebugStringW SetCurrentDirectoryW GetNativeSystemInfo ProcessIdToSessionId DeviceIoControl GetCurrentProcessId lstrlenA SystemTimeToTzSpecificLocalTime CreateJobObjectW AssignProcessToJobObject QueryInformationJobObject ResumeThread GetFullPathNameW TerminateProcess SetEnvironmentVariableW SetHandleInformation GetConsoleOutputCP OpenFileMappingW CreatePipe GetModuleHandleExW Module32FirstW Module32NextW FormatMessageW InterlockedCompareExchange SetFilePointer CreateFileA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetCPInfo ExitProcess GetCommandLineA RtlUnwind LCMapStringW LCMapStringA GetStringTypeW CompareStringA CompareStringW GetACP GetOEMCP IsValidCodePage LeaveCriticalSection SizeofResource Sleep LoadLibraryW WideCharToMultiByte GetSystemDirectoryW OpenProcess InitializeCriticalSection GetPrivateProfileStringW IsBadReadPtr GetProcessHeap HeapFree InterlockedDecrement MoveFileExW VerSetConditionMask InterlockedIncrement HeapAlloc LoadResource FreeLibrary FindResourceW FindResourceExW FindFirstFileW GetStdHandle GetModuleFileNameA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleHandleA GetLocaleInfoW WriteConsoleA WriteConsoleW SetStdHandle SetEndOfFile SetEnvironmentVariableA RaiseException GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetConsoleOutputCP TlsGetValue TlsAlloc TlsSetValue TlsFree GetTimeZoneInformation

user32

SetTimer GetMessageW PostMessageW GetWindowLongW SetWindowLongW IsWindow CreateWindowExW CallWindowProcW DispatchMessageW

advapi32

CreateProcessAsUserW RegOpenKeyW RegSetValueExW RegEnumKeyExW GetLengthSid AddAce RegSetKeySecurity FreeSid RegEnumValueW AllocateAndInitializeSid InitializeAcl RegDeleteValueW RegGetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW CopySid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority RegQueryValueExW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountNameW GetUserNameW ControlService ChangeServiceConfigW StartServiceW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW RegCloseKey RegOpenKeyExW RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser RegOpenUserClassesRoot OpenProcessToken

shell32

ShellExecuteW SHGetFolderPathW SHGetSpecialFolderPathW ord165

ole32

CoInitialize CoInitializeEx CoUninitialize CoCreateInstance CLSIDFromString

oleaut32

SysFreeString SysAllocString

psapi

GetModuleFileNameExW EnumProcessModules GetModuleBaseNameW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

shlwapi

PathIsDirectoryW PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathFileExistsW PathAppendW PathAddBackslashW PathFindExtensionW StrStrIW SHDeleteValueW SHDeleteKeyW PathIsFileSpecW StrCpyNW StrCmpIW StrCmpW StrCmpNIW PathRemoveExtensionW StrCpyW StrStrW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

ExpandEnvironmentStringsForUserW DestroyEnvironmentBlock CreateEnvironmentBlock

rpcrt4

UuidFromStringW

msi

ord217 ord173

Plugins/Plugin.Cleaner/Data/0002.MyPCBackup.rul

SHA256 0521ada1360240261fa20f6b7760b41241bb7c477320676647f5725b316bb32c
MD5 fa7b1716b54aa5caff1dba1e6346b615
SHA1 a7d5018e9e63dccc29bde2e0372b814c623897c4
SHA512 de1acea2729a7cd3e0f428628ad850db0e53a9f018ca7f22219535927a8f37c6a0dc7ad1f067f55434c576130f4b409db9c3fee059df184b73812d1d15214dea
TLSH
T114017025896D10719233AD000B518D5B67EFCE50207EF50789A6BECE5070FBE84D87AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0003.VuuPC.rul

SHA256 41cd1fce87325aa72a3d0e074e3818e85f648cd5f5f52764429f689710f9b98e
MD5 30b92ac2c8cc614462f326267bbd7e7c
SHA1 de1ca7600043a7902b971109d75cd28357ca10ab
SHA512 f647925f84d2f190fb47abe026ac2aa3396632b998e285208138485de1901cedac73d0a86d72755925c29aa9d812d9b366dd9d5f2ef4adb38f4bbbf94817830f
TLSH
T1B321392148F602F150E716010F62EA652135E9D5730D86922BD85D0AB2E6E9EA8DF1DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0004.iLivid.rul

SHA256 ba39140e1fc128d57f94e55d8c9e9ea56aa6bf5ee067b9bbfb97e7f3811bd275
MD5 bb50fc4955d3eb9e2e06c930679e2e5e
SHA1 75dbaa98aab0b17fa1bab7dc07abcdc18a0a8428
SHA512 677c54739c2a8a794ee8d4d7566ad27e70d29bf450c854ce37677555578856bc283506bec550b0cdb93b5c4f58277c42e4dac8c0772a5ba0459f2e9e9a9c0468
SSDEEP 384:R6ZDbS0tfDx5Q3v2oSoCoaoqouodoq/yPSgQhUmpKL:wZDbS0tfDx5Q3v2D1RT3Wh/yPSgQRa
TLSH
T1B0D2374396EF91370E96448096C3FE55D7DD4E3C00C97A081F98DD5B0B18A6D3AB8BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0005.TornTV.rul

SHA256 0e0cc973f0bcea515c856c18dcd6dd593669a18150fdcc78be4be6a89ef04c5c
MD5 e424b6982059898568184f488ee370d7
SHA1 7a6b76d487b07211c31b53709f9344cc065e1cb9
SHA512 5efefc04d6fb2ae3c43921e3e767f9fe451aca92ff6fc2ece9cbd79eb7f79bd61c7cadf0ed2fb76921e27a3db42e51c13c58d1de83ce933c51605cdb35a48a6b
SSDEEP 96:tmwkAsr12b4mSxu2lqc+1mBAsCYf2bCmiuLN4nLOGrXwy7ywM77laoSqmZRvAxbz:tmGbvf8uLG5WXIVWmbO4k
TLSH
T13A32AF01BE9A972600728105E777D68C3BF69A206841FCC546FCBD89363599F8F743AD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0006.UpdateChecker.rul

SHA256 204818885ac1442d524bfc889a9f8932ddee947bbe45ce7c1a0271c8232ed499
MD5 0027e99d72da2cd2f315fce0aff0f91c
SHA1 0c758f2835697ce27527faa710a989d523e426ce
SHA512 4a17d31bf5d646ead006798880eb852418e65ba5961af3749c2056dfe53750e29983ee841e6450688a8fba8483d02e2dd849a894c19ea1035dad11077a080225
TLSH
T1920149225C72C3686A7321085701DA301BF89755C186EAA812DCE587972ADC7CBBD3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0008.UnderTheSea.rul

SHA256 35b344cdae9e9d7d5ba8e3db7fac0f4fdf9a85e535f2ae03d9a521ed05d991e7
MD5 8e5be1a28cb1a51e7eca6f317d6d0f81
SHA1 03fdc1122fd7901376ed7e72f39eac515ba06cf1
SHA512 f2d7f4a59771a488df85f3c9ed456b9c70766b888cdf29245fcaeedad6edd9801cd8c65bcc29a822c9b702daf9b095f6757695fbf9d4ee3c265d58384db438df
SSDEEP 96:UtjcarkFuDvU4to+RXRy+RGrflal+BJ5RkMV80Uc54r:+ND+UcS
TLSH
T153917B604E304027A1B332044B66DD112BFDDB9532D7FB5511CDB56A9332ACB8AAC6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0010.Martview.rul

SHA256 a8cdb5483e5677219cbdf0d7a795cfe3bb2d45555df48fbe3bb7bdeb1525819d
MD5 c7c4fdcc0bda1ec922ed2d71fba86a7d
SHA1 3ae39407b8ed12e78d7cc97660d352ba89c1a781
SHA512 44ccfc2c1f0cfd92abf849226e1cc18aadd14f271561c26f19fd98ba4f6a8d7023ceb6c471e8816b3ad97182c08bb574c9e6c509ea53b156f21c00c8783410ee
SSDEEP 192:867Df498WwWmndMOkzoBltzCVP+22Ld+1A:37DfA81
TLSH
T11D226D514934402B61B331050B6AEE211BFCDA6931C7DB0611CFDAEA5372EDB94EC2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0011.CdCoverCreator.rul

SHA256 31d5c4bed3b537ca3de76d6cce5fc9bac655feb185259ad838c5d01db355c7c5
MD5 20c504d655fbf22d0b3ab0fee8a2cbbc
SHA1 a63ba9ac2bc8e3ce7f30047a74b493b0173add31
SHA512 c9c1d857b36ff2d792ea75f25999b53d2f2412b7d53f55ce2ecec34a4f805b9028cb2138e25a602696c9c61d1a3c3758532fc8cfa0985f60499ee85dfd99496b
TLSH
T19951371018A3A45D173324505B60EA106BE8DEA0D097BE4D5BD8F5833227EDF47A97AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0012.TheWeatherChannelApp.rul

SHA256 7cb46865af152f0f19ef2e8c9e6e13b5fd60155c35f7e599aee736e3caadf245
MD5 64216b5f2b88a2f15ad0b49b08013552
SHA1 dbe0a5a265d2b0db34a8568bf77a4583c35e7d31
SHA512 6c87a0a4e6514ad0236b26f486bcaa57ac6bb79da1bce59cd0725b9a6ce3974bac3e5bdcaa8e61b67ebf77a714e3f8334d5329ad54ddbe8be431be98a8cb4742
TLSH
T1C10152BBF06F48330A88334863CA651146BA3BFED8745133B849A97FE1B69051D8517D
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0013.FreeKeylogger.rul

SHA256 293318a9b173dec39927d6fca048fb884ac2fdd96c9b97105381aab17fdb8671
MD5 d1cafd07ed3abe0a15e56484d38735b2
SHA1 e6ea0a02511799d1c3708b3d7a49a438717262c7
SHA512 0f2ada7c29277bad7ba8d252487f65a15060cbef21de1e16b6b0f02a1889c9eb8de63eafccc900463716364351384e40168c5edc3dd99f996e21b43c8907cf88
TLSH
T154D0A7036CF8D027A8A2374049765B4137D65F857088BE4706F8DD1E4719F49532D5F7
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0014.Smadav96.rul

SHA256 8b77ba5427833f5fe6e5c2105400b4320cefb6a557a8c875572a9f9cd025036c
MD5 1ea9617c7b1089c95c0b4f8185ef8cd0
SHA1 3c47bbcbf741ca54e1a99ec0f6eed6f2ec72879e
SHA512 ba004b3c0d941b32b2db852a4908120b4e0bba116d51ff08014d8eee31c23118f1e337565b08c2a83fa718cfefeca8baceee0ca64bac5d388fdf4d9c8e291267
TLSH
T15F017B511D346059FA3760088B55D90067F8DA043183DB0402ECE49A2676BDF82E92FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0016.AutorunEater.rul

SHA256 4f33835019b10640a6b9b4f802e04f7102f917354e15ecd7e18f139c0aa2a66b
MD5 611c056abb04ae7da1725f3958da8877
SHA1 c650c56dda5d4d982a5b4986d00227417d12d4c5
SHA512 037bb6339f25c595dd1a203317f12801254e2477fef2a49c007864a658d3ebe0b927ee527b1901fcc88471f98cf5a8124beb85b53190e11b3ab323613fc7f59c
TLSH
T16BE02B018EBCC0BDD562340006055F1573BEEA4BB082CA069CCC694E02377C74BAC196
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0017.USBGuardian.rul

SHA256 639ba102db8d0913a1fe40f4ad00aaf9532c37fe68bfdc159d04f8e65b07a7c9
MD5 7ad3ccda3a07b7184a2d9fd1c9fce2d7
SHA1 8cd16e453ab0944acc501715c361e12cb684676f
SHA512 0d94440c43c0008334077717738cf3561b884456fe94ae4a96341dfa4db2cff75c57caeeb4b817a9b7195472454d346757a0d469838d3005090d4aff313bf2b8
TLSH
T10BE022820870400DB227A7180B50ED0063F5EEA020E3DA8655C8BACB5322FCB44EC95E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0018.AbsoluteShieldfileshredder.rul

SHA256 18b291de8bf35eac83b10f4097e9fcd209fd69125197220d689596516e032e09
MD5 3d469366f123c56673cbc4e3be949fb0
SHA1 f09cbeb70d3b78f056fd0823a6bd96c542868c65
SHA512 e4b58df3638fb38b021c23ee35fa874cc4cd50bd953cb5d8165a91303949bd619ff7c1d069d984b3803db92988022421a9f3d615eac2ae82a44f5e6a50260a95
TLSH
T1F721D6124D2926D46D371005CF90DE111BFADA646293DA8803C8E14F672E9EB18ED3BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0019.AlfaAutorunKiller.rul

SHA256 af2d86a20b9211d93dc35c91bf3fec3c2a130e82630f30c345fe177bbe8ae061
MD5 c0abc2dec119f865fd97e3adc0e17770
SHA1 2f9a6d0e89a149154a414ce6f7269c53da7ff114
SHA512 3cec3281e7d79d6831f58222fc5e47acd7c44b5d8f78901f04559e3a8e108daaa2df237797349e53e184b91db6334ffdf9edde242b3540ee00d5ebb30400f320
SSDEEP 384:jELjaRuN/+1Ec7qhAPgBuzGRf/MxR1kkqvAL9XeQZSopcGB9YoUq:jELjaRuN/+1Ec7qhAPgBuzBxR1kkqvAL
TLSH
T1BBA293664C3655A90A7708440FA1EB117BF9CA10A683EE0810E4E2876377DEF49FD77E
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0021.MP3Rocket.rul

SHA256 8b8ed9d4df6da50e5a42b41088ce9d8800f3be6a8b08d9b8950eb70abf816c21
MD5 dd8dcd868d89c65f4f127901990c52d2
SHA1 3276f68ffcd460a5413adb5ff3051d89c1de77d8
SHA512 9ceff85e7b482ca4835f32389d964614bab57b20558a9d5c9a824c52a3d54488bf15f3944dbeb92aea942b2b86d51839745f48cc0d83bb7b2fd88dada1cd59ad
TLSH
T17141C9024973C06739331548D741EF3273E98D5063D3A68B1BE8DE9E2377A871E586AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0022.AnimatorDV.rul

SHA256 1aa20b592b4d58073e7476bf1124432ae167e3b0ca3db4f99dd3fc3264d25e02
MD5 c5ad00ce14ba0e34d47161e15cb4fb77
SHA1 d910f39cc695e1ca8bb51239ca6d2b11ff1c58a7
SHA512 4df938387c5618edfb07d67daebc2bb05d532cac518a6b66c5f86943a418367b32d7fef2128bbc68465441650351f91b69f5c6a51038cc52eb28fdad1b107c1c
TLSH
T136E02084449C40724B5F3514435B4D30BFD1098D11CDD95D34F48F4AE19E745C9E43B7
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0024.VideoDownloadConvert.rul

SHA256 807dc04ee9b63e47cab7fd75b0a8ff541b766e745e2dba00ca995968103d48ec
MD5 788748bc54c5fa6585c05fdaa7b21ec7
SHA1 227124708f849a0fb331344679000ca787a27b9f
SHA512 634fc562c45702897af2bfa61c8c2b6d62706de4bc94f4628541062e269ea8276b62be9f171f032a48ba630bf3eab408ce34ceb8765effa8dbee8bd83eeaf878
SSDEEP 96:SGufkHm1uf5Yf4c4CFdTbY2xx6AHnN0qrjCwvfytfPGM5JnHiY3QmLRn6ImIJIoA:S08
TLSH
T11D42160229D6A27FD8F5C8CCABF1BB9BC6C419A4E1E92E002F5E7D1612CE614365136D
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0025.SpeedBitVideoDownloader.rul

SHA256 2b948f7b1065af54c5bf471f5ffc7f9ef0c6b401a0666114853c6e25b0f15e04
MD5 f89973a746123f63958666dc73a48d08
SHA1 eb10751c8c5a2b5561fa4367097ae239d4ac4234
SHA512 fa44e1595744088a62089b2349c29e057e21ab7acb6844751e8b2e500888a29c2be79c27aeae06ae32c659c37394c019af48672dbd16c647c2b66c4153093b8e
SSDEEP 384:ah4mnGeflgcN3fI/9OTbrtVSMeUUR9u/Bb:0QGrCvR9u/x
TLSH
T1F962E7225C7608A9197755550FF1EB002BFCCA10A283EA5C05E8F247737ADEB09ED36E
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0026.KaraFun.rul

SHA256 6b140a99082591d89f04446fca37c38b196ed9bcccbb3282ed179fb53a3ba01f
MD5 5c4073ac2ea2c5089e242b3af3c923f1
SHA1 e3a3d6e5ec28dfaf73c3b0e724178c04709b4043
SHA512 8ea4d9f680722ecbe10c0dea80e8985a52625d2bf0bcdc8dc7c9ce0f1244aa5a7592d1b96bb8c41d89f14ea749e2ec671e58b4849924231e70cfdb54915f10bf
SSDEEP 48:ZiQa8bIpHOurxX416STNSNTOx2SBLAzD2Zw9EK9EsS/gDwvkaKjLjfB0UMSG:spB416STNSNSx2SBLAzD2Zw9EK9Esv9G
TLSH
T14AC14D81BDD552D21C63B500A244A80F5FE59B58C1C0FECC66E4BA8251769BF8FB13EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Data/0029.FreeRARExtractFrog.rul

SHA256 45e0659c6677e9113305c381209ce70fbd17eed8fda5febbaf77b2d8fdc42eb2
MD5 5ad8c08b722f07b352a4c65645e6d236
SHA1 461297aaa82607365ea3730936cbe44981809099
SHA512 a91b00c7a3c1106b930a0b6fd5b6dcb7d0a7a77d9f9e72a7d9d46fb3445c5868138a575e75bd7545e5272d09ac108b029bf2645e60a5344c4b9a19025dd97425
TLSH
T191212C030CF745690E765C400B42DA5477F09A2151CBEA8A27D8FD8F62ADACF45EC76E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0031.KCSoftwaresSUMo.rul

SHA256 6b9827528058977e737615a2b7c91d4edee45d4b993aed3f0e3b9725f9a1bc4b
MD5 9357b447a15b64ce52e629ffe6652d73
SHA1 b118eaf2f9e3a3b88b330a91217fcedc7b1696a3
SHA512 c152946834e3fc4a00d188fd092a2f6e2cf7b65aae78db0c1d21979d6272250e5f3b0da3eef6d65ae126487b2988246fbb104924774773f9c8082808a38fbf8e
TLSH
T198F0C90038B083478803ABC48700B9118BE39FC09BC0EDE22BAC9C4E435238EEAB8074
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Data/0032.FreeMouseAutoClicker.rul

SHA256 c5f081b1e273ceb6de72224bda73cdb5c6d541f66e2a2e1787e8e1b9a74ea6e6
MD5 c5a8d48aa08b6ad820140940195c4d49
SHA1 b6b7bf40d01165db6be4118929a1dcf61a2ad91b
SHA512 943afde87024ddd98fd16e5f44b2dbf973d913ef5bd27a839170b6f6bf83d6a1968895e8647691d7ab5037a1e1e1df898fcbba9f8da0ea61c9d9fb475b164fb3
TLSH
T130F05C0504FD806BA9736F805A05DAD533BD4B1620C2CE0610ADC50A771EF8BC1F50EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Plugin_Cleaner.dll

IMPHASH 03f4bf35a757d09dff7b72a43f19f1e0
SHA256 e967f23ede92c8ff3e983fde9e5ed6e288bf80f0c8122c3a3c442ce7e14ac5c2
MD5 e8b756106e792078215b738199f974dd
SHA1 0ebfbe79342b446a3a3a1aa8916d77b8959c684b
SHA512 96f12f3382ff21ab118f839972e6c7a17515f420f13b6bc0ddcf9269a6f64c007dcba713cafa8bf388441e91f8e07a3c927a94959181869cab98278a32840a26
SSDEEP 24576:AZ0K48tOVi3qQ+pdYqN9beO2OHpYMedRZgvz7Zfnn0BddcXBfz1D8v:AdI/jYq/bz2OHpCdRWvz7Zfnn0BddcXQ
TLSH
T14D553D01A782D23EF8BB44F2DEFD446D5268BA60074450D7A2C89C8F5EB69E67E31317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f4:41:7e:23:da:e5:67:dc:bf:b3:cd:19:a1:6c:ae:c2:29:8d:a3:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

638020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_Cleaner.pdb

baidustore

??0Baidu_ListenData@@QAE@PB_W@Z ??1Baidu_ListenData@@UAE@XZ ?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?SaveSparkClick@BdConfig@@QAEXH@Z ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?ReportStateEx@CBaiduStoreMgr@@QAEHKPB_W@Z

directui

DirectUI_TreeEx_Expand DirectUI_TreeEx_ChangeStyle DirectUI_Progress_GetPos DirectUI_AutoText_SetControlTextEx DirectUI_TreeEx_IsExpand DirectUI_TreeEx_ShowControl UIStartAnimateFromTree DirectUI_TreeEx_SetButtonCheck DirectUI_ShowControl uiUpdateWindow DirectUI_TreeEx_SetControlTextEx DirectUI_IsControlVisible DirectUI_TreeEx_InsertItem DirectUI_TreeEx_EnableControl DirectUI_TreeEx_SetStaticLogoImage DirectUI_Progress_SetRange DirectUI_TreeEx_DeleteItem DirectUI_AutoText_SetControlText DirectUI_TreeEx_SetControlText DirectUI_SetControlPos DirectUI_TreeEx_SetAutoTextItemTextEx DirectUI_TreeEx_GetControlText DirectUI_GetControlStyle DirectUI_TreeEx_SetItemHeight DirectUI_EnableControl DirectUI_SetControlText DirectUI_TreeEx_IsControlVisible DirectUI_TreeEx_GetItemStyle DirectUI_TreeEx_DeleteAllItems DirectUI_ChangeStyle DirectUI_Static_SetLogoImage DirectUI_TreeEx_SetProgressPos DirectUI_SubclassWindow DirectUI_AddFontsResource DirectUI_LoadSkinResourceFromZIP DirectUI_SetControlTextEx UISetScrollPos UIInitAniRunInfo DirectUI_Progress_SetPos DirectUI_GetControlText DirectUI_AutoText_GetControlText UIGetScrollPos DirectUI_EnableAnimate DirectUI_GetControlRect DirectUI_TreeEx_GetAutoTextItemText DirectUI_TreeEx_SetAutoTextItemText DirectUI_TreeEx_GetButtonCheck

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

GetTickCount GetPrivateProfileStringW SizeofResource Sleep GetVersionExW WaitForSingleObject GetExitCodeProcess GetFileAttributesW GetModuleFileNameW WritePrivateProfileStringW FlushInstructionCache RaiseException GetPrivateProfileIntW VerifyVersionInfoW GetLastError GetCurrentProcess GetProcAddress EnterCriticalSection Process32FirstW CreateFileMappingW LockResource Process32NextW OpenFileMappingW CreateToolhelp32Snapshot GetCurrentThreadId FindAtomW CloseHandle LoadLibraryW HeapAlloc HeapFree GetProcessHeap IsBadReadPtr WideCharToMultiByte GetModuleHandleW DeleteFileW InitializeCriticalSection DeleteCriticalSection FlushFileBuffers GetConsoleMode GetConsoleCP GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetUserDefaultLCID FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetTimeZoneInformation GetModuleFileNameA GetStdHandle WriteFile ExitProcess HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP lstrlenW GetLogicalDrives VerSetConditionMask CreateProcessW LoadResource FindResourceW FindResourceExW UnmapViewOfFile MapViewOfFile CompareStringA CompareStringW SetEnvironmentVariableA SetLastError LeaveCriticalSection GetACP GetCPInfo LCMapStringW MultiByteToWideChar LCMapStringA RtlUnwind GetCommandLineA IsDebuggerPresent ReadFile CreateFileA SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CreateThread ExitThread GetSystemTimeAsFileTime InterlockedExchange InterlockedDecrement SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetModuleHandleA SetFilePointer GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA HeapDestroy HeapReAlloc HeapSize InterlockedCompareExchange LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedIncrement

user32

LoadCursorW GetClassInfoExW RegisterClassExW CreateWindowExW CallWindowProcW DefWindowProcW GetWindowRect SetForegroundWindow GetParent GetClientRect GetWindowLongW MonitorFromWindow EndDialog SetWindowPos ShowWindow FindWindowExW MapWindowPoints GetMonitorInfoW GetWindow SetTimer PostMessageW KillTimer DialogBoxParamW FindWindowW InvalidateRect SetWindowLongW IsWindow SendMessageW SetWindowTextW UnregisterClassA

advapi32

RegQueryValueExW RegOpenKeyW GetTraceLoggerHandle TraceEvent UnregisterTraceGuids RegOpenKeyExW GetTraceEnableLevel RegCloseKey RegisterTraceGuidsW RegDeleteValueW GetTraceEnableFlags

shell32

ShellExecuteW ord165 SHGetDesktopFolder SHOpenFolderAndSelectItems SHGetFolderPathW ShellExecuteExW SHChangeNotify

ole32

CoTaskMemFree

shlwapi

PathRemoveFileSpecW PathFileExistsW SHGetValueW PathAppendW PathIsRelativeW PathIsDirectoryW

gdiplus

GdiplusStartup GdiplusShutdown

Plugins/Plugin.Cleaner/Rules/1045.AccuWeather.rul

SHA256 fdc975a688dc1ddd4881c8a5810e6fb0fdfc4fc3931b3f4fc961dc59e0affd4f
MD5 e162ad397c404d4f900597a82dfcc518
SHA1 8d4f948b8af756c00ce65239197dd3c6b509eba0
SHA512 a82e0b74813bac7408d7166158a2e2070c941e4ec8ddcbc041859fe8bb367342d69fb98152d48b3bd6f2223d339651c5e5b6dc76de467fdd122ac11cbcff943c
TLSH
T16401F646BB4BD36D35B99080F7407FC94EFC591924DC7E471F446806065460DB7847BD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1046.appbario12.rul

SHA256 3f7895be178bbf37ff6a2d224558b56e418d1ecdddabb775a5daa661ed79b4a9
MD5 91bfd616c986d010057a2d7864621794
SHA1 a1290c3f63968676d2459487d120634b4c37a873
SHA512 edc80f677077a5084dbf5902c0459d48afb782a58f369028ccb85c18aba24ea95553f4d1355aff5db306b51f4e89a2fd58bda945a9a9b61d7646a38ea90daa79
TLSH
T15321C2035C5E401F54E693C4F7D2FE461FB15A0860D8AB064A896C1A1196E8E639C3FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1047.A180Darts.rul

SHA256 f44b6e305b214898ae2c64eecb68b73e69d55cee8944524acf5e7f6c692841c1
MD5 a9b9b4e737a0625e28c5dd9591a68690
SHA1 b73367dec53cf9c4d56581e2ab65d85601eaabe3
SHA512 49bf07b6b7720bee820ca05110c3969004fd95c35709e8e003814fd9b3c30e282cdfad321d433fb9958547377b47ce148daece83d1cf597ed38de3d57b848385
SSDEEP 96:wVWRuJoIW+7K7x74P74jf+v5PWHNOJPOJ9OJ5OJ4OJsOJJOJaOJaFOJa0OJtOJ9K:D0WOv5PW5RzTttucPmbQ6mF3
TLSH
T1C272320B35EDE32B30E7C8C8E28C918B45D1A56E59DA72430BCE6C9771EDA167844FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1048.MixiDjV30.rul

SHA256 6d5e101cdc62001c6e654c67d71791c3b9364ae38efaf546c794e20294850805
MD5 4c7e6b775a4d6ec1bca996bc823f6319
SHA1 0274ef1caf6b22d7afc6733e9d7474cc573eacc5
SHA512 1cab8f77e75bf39b8ff06b97a9a432979be27bb575ffa404f5af63cc21dba02f72fec381cbf35ec94be136e8d458afb207f8b1889a0a2bf1cd5609fa1740d253
SSDEEP 384:Plx9omFmJG8KsKkKHK7KQKtKVKoKUK4K8KRKLKXKkK0KwK2KIKyKDKzKrKOKlKCv:PlxusmJG8bJkmZ4CVzjZu2SpvpJFr0C7
TLSH
T17582002B3ACAE19B1596D0C0F68CD91F86F6A43864D5B8690FCD7D0E139CB0673217AD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1049.SocialSearchBar.rul

SHA256 04c08cf5fcf8fef939d71a20d05d998c5f99bb8f9ec550f647124bfb2570efbf
MD5 beb94c1bcda440e282219b10b3564ea2
SHA1 7214d1f0082b0b77e3ad077487bd32a13808f81f
SHA512 22a47aaa6c0b8bfe6cd5b27e09375ef5209423c08f05019502fa1b80d49ea5f8a710646cbb38021195795b1174e3f39d92bc34c1f58b4f83a2044410c709f70c
SSDEEP 96:olRlIjSDbcSKaga0Bwzf5FgF0cM7K7x7J7lM/Y+Z/a9hFh0QkKXDzD/DWD4DpADt:mqIBdO3r5ztg+7mjmvFdWn
TLSH
T1C782C70739CEA1A756E680E0F780978FC6D5DAB4A2E5754A5FCCEC19225CF2131483FA
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1050.SolidSavings.rul

SHA256 80f4ef2f30fdeb25b31e8e356697aeb638034e238f6b41434f839e503948dcfa
MD5 5f6dbc3f5381ea77b52e0d70a0c1c48c
SHA1 6d9e32e0bd7819bec4a5303f1697d9476ca3420e
SHA512 99e9933c27fbfabf07cd7b1fb20ebb36746dc4ac1784634f09d5fae9b8f1da35c5075d1734cd97366f18b143481347dae6ce19eb49af6899dfa52e56d5be79e2
SSDEEP 96:3Dudh1cYINBj8C7a9Lcs/6DDODGDrDXDwDLDy7DywMDaDoDpCISnCIUnCI3OnCIw:TudIj8vYsCFy1wiJnVhR
TLSH
T101F14813BD97831509765298F746E6086BF5BB31A1D1BCCD0AEDBC0212269978FB438F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1051.SavingsApp.rul

SHA256 09756229fe6fbf9e61aae2a62dd6ebb45ececb796941ff0f0f4ecb22d2ead071
MD5 d77edd5ed701da56f96cab9c28302613
SHA1 88dc55034cb57a8f08086757f2b9049e91804467
SHA512 8aef4e614e05fb633a9794a809167582f9655bdb58eb02b207c1543c4148cb39d0822784b4533b2257172f658c3d5e642cefa1c02aa036b81aa850d11d46e95d
SSDEEP 96:39N3zTkKi8CUJ/RPcQxYxrKnrs3+7+wMWsDIJmJeJ4JZbJZJFJvgGBGLx:jG8lkQqoqdq
TLSH
T1C8E18C12BE82D35105728114AB6AE98C6FF55B61A582FCC802EDBC4672368970F753FF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1052.TigerSavings.rul

SHA256 44e3721109063344b8a3087d7d31ee438e49e022e5dc32812339c294af02b7c6
MD5 8bd3adc02647fbf49d4645113594d639
SHA1 15283eb4adcebf9400a1fe3188b6d2229d6bab46
SHA512 b47621ef0b2263ed31a8e83899ab9a9030abcefaf24530617f676fdc352b840a96579a711cc59801226a61f5af520145da8240b8f4dd96d22c5c12dc6881d88c
SSDEEP 96:3qL23yKqEnr8C9cw7E8nivOKnrs3+7+wMWsU8hHkbQtMA+dS:aoN86A8itq4ksS
TLSH
T1FCE12903AE978721057A5258F60AE90CBBF58B719051FCC94AEEA80291359DB4F743DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1053.SupremeSavings.rul

SHA256 468e2148839cd910e94c1a9e031fd56a5bdc26a61a6dbfdd931df43975da00c4
MD5 fec3375b8bed1dc10246739453b3f8ee
SHA1 caa195a06f5a9d60442f927d3397ba72fe405d0e
SHA512 63aeba24e95a27efa905e3b3571e7e8ba17d54e5935461a3457a5c067d03f123df56b1554adda19ec0d158ed065ce9f65b42f6d4274610ab17bbd4d6acfe1452
SSDEEP 96:3OBoifr/rOr0wprBv8C4CKp7MU3SzIKnrs3+7+wMWsl9XPX1XubXyX2XSgJa:+B5fr/avVv8rXoUCTqYi
TLSH
T1D3E16A13BD83871585774124E646E68C3BF65761A1A0BDC806EEBC0232BA9A74F743DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1054.CouponCaddy.rul

SHA256 e02e1700c68f07ef59ea14ea52d956139210fe1041984ada7812c404ef0e788b
MD5 ddfece98983f3a8ff00b75b541a5f33b
SHA1 541a7476df17ebb5d899d1aac5f65f7c2671aa19
SHA512 52318fbbd53241f5c94e7e88957e7ffeb4750a583833f028a073435958591eb763e5afdc85f09aad3b7bcbd040f7a5de00a8dd86f1b50fbdb38612fe05215316
SSDEEP 192:mo+gGfExAjkw4k46tgPq5s+cpqZ7YVDGnKf1i8Vqx4antB1:mo+gGfExAjkw4k46tgPq5s+cpqZ7YVC5
TLSH
T11DE158E2AE87C71104720114FB89EA1C6FF997508191BCC626FCE941A36598B8F283DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1055.WhiteSmoke.rul

SHA256 309e945e944f2946faf0ee345326c5b377faa323820c677e97ede080e5796a8a
MD5 b3b3e286ff3ff4c2b1f2c80dd06db8b7
SHA1 6d1a2b82c53db649a33ffcc252f758ddf89278a6
SHA512 bdcb56fca17097bb357b763f68552501c7119bc436bee1b4fffbcc8ffaef88ca16dc6b055e26bc52f9a22493724280bb3f1b2ebb10037f3d77eabc13122b27ef
SSDEEP 384:dSW2Lzg8Xyq/Dv7usQzj3BflUkMJaVxc4Q61WrOlqkMZ3sljtdbMUsBWW2azUW3P:vG
TLSH
T19562F21F299D975B0455C0C5E788862DF5FAAD2D4ADEF7120FCF6C462288D0622B0F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1056.WhiteSmkeUSNew.rul

SHA256 624f0243ff2a3035abbaeeff77bf1a90554646072b826cc9ac252c1dc89e7b62
MD5 1239581d9056802011a0f2bad12c0b0e
SHA1 221154999104a55e40d4f301b0aaea814354c7df
SHA512 3efdd7707ef8321240c2fd5726845f6bb7fd64fee8d4f9f361e97c6530d7344a438b133574ae9fdaca916d67b2531e922d7630f69dceef66ac782c97bdb87e5f
SSDEEP 384:OLWtfyad5un/WqGiTpNaKOw2kRhJYvUgZ1NP07Szk/hJoOpkKM8CJRpw77bvaR7R:dt/
TLSH
T1CC72E4072DAAB16706A9C0D0F6448D5E8AF2BD3D81E8B1432FCF5D5622DFD4523B0B69
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1056.whitesmokeusnew.rul

SHA256 624f0243ff2a3035abbaeeff77bf1a90554646072b826cc9ac252c1dc89e7b62
MD5 1239581d9056802011a0f2bad12c0b0e
SHA1 221154999104a55e40d4f301b0aaea814354c7df
SHA512 3efdd7707ef8321240c2fd5726845f6bb7fd64fee8d4f9f361e97c6530d7344a438b133574ae9fdaca916d67b2531e922d7630f69dceef66ac782c97bdb87e5f
SSDEEP 384:OLWtfyad5un/WqGiTpNaKOw2kRhJYvUgZ1NP07Szk/hJoOpkKM8CJRpw77bvaR7R:dt/
TLSH
T1CC72E4072DAAB16706A9C0D0F6448D5E8AF2BD3D81E8B1432FCF5D5622DFD4523B0B69
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1057.TrustWorthy.rul

SHA256 bc49372c94f03f3fe8dbfc0aba46b306a4c64a93c9c1f2803c2e99495bbe1ddd
MD5 b2672d9c8f8b54054a914bd77fd099cf
SHA1 88d9f1c76384b69037bb00ff6c6783a611f0618e
SHA512 00f25f4fdbad30a7a59e4a7fa0edb30707487f1e796f9a59ad2f2ef59afe143a56d943d81d86f8d5ae0be3d947c8bea3c8564dd5b8edaba2279fcfe027cf9321
SSDEEP 384:ifW1swbngJdQ8sMVPLkEQeMq/rvaxq+fb3xqBsRmdDHOUbWk+yIjDjmdldRgLtce:5d
TLSH
T16472640B39E5853F21EAC4C5EB99BD6F06E1897DC1E4F5011BCEAE5D23A8A0736503B4
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1058.ScenicReflections.rul

SHA256 a93a746b66adb6813f1c8fafc57365aa13a3e230cd153ba84dcf8916f1875eac
MD5 e8b99f5be35d45aa8d5f8e83e776014b
SHA1 4ac0ad1a7d36d6ffc6874a3dd7acbebf7e20ee8d
SHA512 a8d96beca2ccc0bb07b84eda8cc39eb6febb9044f6ee5b0b07ab500e80299c8c5ffa8ac00e2ef404c40cc6fb8b00f9862fd6a8a9d9fb1b1b3dd7a571f0fc17f6
SSDEEP 384:g5Wn8UHD4N1wEAM5TXUkYGQqrbzeF6WjPXlaxcZq1bzOYTqkiyszrTGxxRFUrxYO:9P
TLSH
T13F72A40736D9BA270E5AC6F0E248874F85E7D538C8F9F2020FDE6DDA52A8914F121779
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1060.LuckySavings.rul

SHA256 d564228b2468d07a1580a16a77b1ccc2beb3928bf885b4c1edb593950c97ebf2
MD5 64ddc6791a4b993b6d7e69220cf55579
SHA1 249dd25ade5830d0cf091813a00b4eb61a126958
SHA512 2ce3596f3fafd09aeac17cbfdfe922f1dc4be9f671f45bb78b3e42a82ea9b391867af2cffc4516d47a3f049c9260309e134bcffde1b5bbb28c7220308d858e06
SSDEEP 192:jL68Mc0+WqFVgyVg8VgqVgMVgRDVgRVgdVg0Vg2Vge:jLKc01qFVgyVg8VgqVgMVgRDVgRVgdV1
TLSH
T1F6E15B03BEC3CB2504B66105BA4AD50C7BF587625151B9CC2AFDB8469139A874FA83DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1061.SearchProtect.rul

SHA256 61ecb2b002103d11626e46dfc1d1fb9c560f29189082754636df02c669084b56
MD5 a60219ffb4ce8fa46890d2c4269a62eb
SHA1 86decba89dc77c6e1298c54d5a1d38ebe138af33
SHA512 ad2c86a0c6784bb92e854863d0445e98b1a5b7ea4cb2195f9c2db674222300417567e43beb2e08e177ec4834aac04e1c017b81e138a9817be8068eaa3bc4b295
TLSH
T1FB41F4039965A09F94B3ABC053CBCD92B3909D21F8E4EA4CC5859C5A8153F6D43A81FB
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1062.OnlineRadioPlayerRecorderToolbar.rul

SHA256 191e766d4bdd1d65ded08f9057123e4997c18dffd0d2176159e9515e39a4864c
MD5 714f5a0333703ed757b9fac1f988db8b
SHA1 05e336c1361811fa61a4bde21d5dbcff80c43a70
SHA512 985317cb90ac9c6037ff26ddd80ede067d7dc4f7c65105555637c39c048fd60d8a5ec7b2f11093af68443427c2b5b0273847eb41bdc49e987486045d14391659
SSDEEP 96:Fumd1IU7K7x7V7Job3XOq7QMFM0fsrvMGzG/GWG4GpAGWjZCiSNwpdKGO4BUfXs/:FumdaeOxt3d3dmjmkd
TLSH
T1DD82475337C7A13F0E94D4D8B289E70989C2881DDADA7D032F4DAD06A2BD52D36257EC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1063.SnapDo.rul

SHA256 8874233b996d448b8f6669e17ea40a4fe5d39eee0d1884bbf846e1c9e599a68c
MD5 5f9baf9f2bed682c359b08a2e992c54c
SHA1 6d8d091295afd92869db559397961506b27231db
SHA512 47516d4ed4c379062e2541f73b393bc2db1d1451dd69b112a5462bb61bb7fba1dd46234b28fe6ee66f5cf3dbc53423acbe6cd73d745828a07c24e498311918ae
SSDEEP 192:Lbl1bSVMaFbjRgDJvzjVpY/xQguHeKkr1JC+aUtdoWXGRZk1CDCxYCYUDn:/+lJov3rY/xQg1B5WR21CDCxYxUDn
TLSH
T169D27C524C35045966B324070BE3E7152BF8CA29E18BDB6902E8E6977332CDB5D9C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1064.Webblog.rul

SHA256 7630bf9ad01dab0a18419038e43d14caf5cd318268b68f69b7f7f1767d2d482c
MD5 e448082261e3e4910496c63838aca155
SHA1 9004554f3f25dc5148c5f8381fd1b5812ace1ee5
SHA512 9e7ba771786ce06fc11764a3fe0602de9849e31b5b49111eb6a9bd3338e69c1b875b297686c24db85415ee5c691c62afe1feaf9363e41ddc7737f08210d10975
SSDEEP 384:aI3remJlqbTy2iOXV5mWKkSIdt1MD4UFB5jYf+3ITt1cKVIWwgu1dVkff/DmdfKo:J
TLSH
T12672249B3685E257C2D6C6E6BA55C72D85D2D53940E4F8021FCEBCDE228C908A7707F8
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1065.DeltaToolbar.rul

SHA256 194699870923c5fcb84b95ad2a102d2a31fedd2f432ac31f5d3cb10856dd5026
MD5 f73d3c5458fe3661bb20216e90906b5b
SHA1 4ee9391ec10472182bfdfc6bc88d9dfdee965b93
SHA512 167d8e9c3fd7510b0c1707f35cd35257977cbf2b0c3cc322194987d4cd01c6240df5fc4742587cd7942cbcc400067836cbcfaad93f8505154134fc3f4e4e39a9
SSDEEP 192:M2bVjHRjfZvYU5+Fnk4+YI/NwZ6fLdJT9WJgC:ZbNYBk41I/6G9WJgC
TLSH
T1A4825A01FFA2496E85634244B7D5D2C54FAB4582808E78F62B197C4E01DBDC78BA53BF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1066.avery.rul

SHA256 a29d4b03682ab2cd0222a65b03dd38f25c4dfd3b5c3f9f423a42563a356b6dc7
MD5 c82aea1af914705721c945e7440d8002
SHA1 19fa9d822529c9e690586affbe02e0ee7f84cf4c
SHA512 ffc21dd9339a568c7e3d300f224a1421e93ed7d7dfb7e42efd2026345aa8639e8ca70db1cfe7f0be55e737f1a9528683c053bb922955ceaa2072e1ef55d61479
TLSH
T1BE21B190FC654355887369041389CA112FF69775A006FFA510ECB705B626ACBC7A93FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1067.SearchAssistant.rul

SHA256 4b638af5f27487d251dd7c7136183c5e1e8cfd6abf44ad87dc29ab914224e756
MD5 3618a0962ca1bc3e5b58b0cf83a9cb96
SHA1 5834c20df4cdd9344e71f199476463f0213e111c
SHA512 0f30fe8c285af2375799f93b6117769c95f40d90cc3e3d9b815b1c8378f1ea22c7a3feb9c0e6b0bec1bb7bffc81c403f72f580ad8767cdca717dc37e1811f7e0
TLSH
T10231FB12FE11C32A44732A041B40DBC43BE49B52E111BF889098A2953223DD78F7D3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1068.AppBario2.rul

SHA256 ac3dd4e17e638fc5b519e8a27d414890e2691f244b3e011eb0512eac0ff0b664
MD5 66343c88f2a47a7a43d7629070581663
SHA1 3230e4ab02b3240210ed3726fcd6da2ab41338d3
SHA512 57e90264681d76f07a75af7278759bd9607c83b63fc04189756a0b938903b0d72910f51f93c6f0a2127c3edacf7bacbce332e89837c4a6a108d8d55450498fb7
SSDEEP 96:mbLEL6uw3Xd+wVSwyTvNfv24BVzn8AI/ww7P2lRI6CiR67K7U7g7e7UUxz3UGVtW:mbePJrbF24BJnIo8cO6tio
TLSH
T1A4D1EF41FCE7862456535218A7DCD5491FFACA4380857DD80B98BB8622AA9C3CF6C3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1070.IMVUToolbar.rul

SHA256 489d27b700c74d3932e3e3b2b02450a3579471f8f22a8d3fb6eebb0a695e5613
MD5 0579777f23017912ae8a42f49c9816ba
SHA1 b0261a035fda109357d2a693aea42cbf64a686e9
SHA512 d6b47bdba980a02bab0b76ca5a0518a6b483abf7570b1b0970722936bf375f5ca7cb49b5a7b8a9f9fe98856b875294ffc2ecc333fced7558647564bfb1d4ec15
SSDEEP 384:FusSQqYdbchDoi+kzT/M+kss6VbFEBmmPZV7klkpyTVLQADe80i61JL8LHB1STvU:10
TLSH
T19C726C0F3FDB922F159DC491EA494AAEC5E5C82491D9B142CB9FFD1A929DE0031F07AC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1072.MyHomepage.rul

SHA256 f762d23499ca7dc1054ca9fd57e8d917c9c7f8ec77377d91a6f35643b322f40a
MD5 0872c9eeefedc7afa05ee57c79107b62
SHA1 4066040429ae6212e5e9b0d88508a63f0423f8b5
SHA512 d4e6cd5d5ae743c93ad81a201579046200ce006882df446de41777cebee77ce185aa1c7433fa2ac9a8d7ec32dd694be79954fad924df6529d205c3534f18e2fd
TLSH
T1EB4185825CA2F1B74DC337A5B160EAD316E74DCA86CC28F50EE93E9D026445B3F42597
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1074.CodecPerformer.rul

SHA256 f9ea0859b6e026b0cba225f1f3d8c0595c359eff0a7f9cf93601fb13f5f33a22
MD5 dd9ffb76190013f49bb0b3c42134f9a6
SHA1 cc654d4328d9f50f54eae15a8bdff5e8b7ba3735
SHA512 d923f82623dfcf8912af282db6859f0a1a4e6ec8ad5f3bbbf1aa5e54b1746c35f154257e5acde84dbbb7677acb7490f6f64fed9601c50c50b6749fd8efa074e6
SSDEEP 96:3cH7Emv1o3QXXeTKiqQYN/dkLRfce3wzjY+NcNPTATHGdBuD6:sbEmv9XXeTmNA
TLSH
T17DD193224C7605A94A7B94085FA1D60477FCDA606287EE4841D8F6837336DEF09FD3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1076.SavingsAddon.rul

SHA256 76c3a39c001f6266da29992e15b84fd76146799444516840892f87567c2b334d
MD5 69a56a31531f126c3f4a26dd2b4dcd5e
SHA1 0955b474308cb6581a8995fb51bb7ebf549c54aa
SHA512 f0801c974b99687a91cfe59eb2121dbc5668db3d058b6f96a2194331b611681c60af8be167f4b77eac7555061a4198ea16183b8f32af83ef98d39a74e31569dc
SSDEEP 96:3+zydkDZm8Y3oRMX3FKfUjl5weib1ODfGXKvuJ+rVrj3SYoXTo+PyMHpY16DuiUL:ua8oIjQcCnqNLYx
TLSH
T140024803BDA7D3114E668154E2A5E54C6FF25B50AA91BCCC0AFDF80222269A74F743DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1077.BrowserCompanion.rul

SHA256 983b9ab3de6ad78dabb36e8b1ff55d996e174391cff85b5094fbb1317a98dfbf
MD5 6990411e1c87a9ba0bb23ececa2f2a33
SHA1 95eaf5c6dffa604e86a1f5883f4094f0edc5791c
SHA512 818df2a685e0e816c7cd6ba6d8dd84a81be26a76724c5ffbf1b1b1b7b320398d6b35f266679f7c9eadda1144de44510797d8d81d4effba6a8252902a953ffe5d
TLSH
T18F7157120C75996A48B358045FA5D7013BF9DA24B283DA4911D8E6973332DDB98FC3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1081.Funmoods.rul

SHA256 37b282a432fbddb3d2d64f5300a21a749207cc75725a07e7ff3360fbefc921d8
MD5 dde364d3291e88d942c939725bad7f61
SHA1 882b17e37c41fbce605ff73898d09dcca876d4b0
SHA512 ce2b1ad5e921fbe310554c9a3809d7699bd0ee153d7337750527c804c35f69f397d9ad755a0b0a9a16094a1d59b97661594d9a6856b18f63d6d7a07ddd7a86bf
SSDEEP 96:3e3NhqEZsf4TTbEM1KBgKaziUhoApHcJv5mnYDaHtMza6MTifRh/OR8ksyITNh5y:0X11K61DoApBnYDawrYhOzYQVYMbBS
TLSH
T16F6212122DE686AB0A734440A789D3046FE58D6491D2FA041BDCFA4A73B5DD712EC3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1082.PricePeep.rul

SHA256 5f3c06e35601251a1fe4348fe71d0f8a0f7ea03da654472e354b2d649cc6bb9c
MD5 d680a70bafaf4fdf2902a94aea1c7f8a
SHA1 d68b1237ea1aa53a5c0ce889f4126a95562a0683
SHA512 c4a387a83e634592a31392840749e9f7186a2fb791bab613086249a90b1faa85c582f03dce4cdc3bd23c99378da0b3d8c17b9a0863638eab88b26cef19c2e450
TLSH
T1113126419C37467E183B4448AB80DB109BF5C918B2C7EA0A55D8E4537235EDF4EB877E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1083.PriceGong.rul

SHA256 93f6d988d50d27b9b833a4460eddd84efb68aa4a64d920e82eebc296fa1d246a
MD5 1dbf64107119582dd6c34ec6ecb29dee
SHA1 9911c524ea2e17f09b0e0b9ec786af9ab89169dd
SHA512 dddb77ba6e4232d026acf704adca896a5ce4a1d4b2dd342161e9ff0d02df57df151079161f43e9dcb2ecec7b5bb75c7ad23ac5f780b075feb83ba1c6b292025c
TLSH
T1C4518BD29C71449A0C7BA0849B94F70BDBF584209297FA4A06D9E91B277DCCF00AC3BD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1085.facesmooch.rul

SHA256 18b8fdadad37d3fae28a127b4c11a03ccd71d1f1e741aa76037e80d2c8394a3a
MD5 9a14d00eb9dd97c9b2ea18e328ce726f
SHA1 2df165aaa01fd553a6534830c00377c868f5a911
SHA512 20d64403f075dad1da1d0c2182793b94f7872fadf90c157b8c0cffa0edd3cfadaea688700d96f57c8e3db6f8205924d4c21a37bab76a1bdcbae2f83fdc0cf9ae
TLSH
T17581100304EB817F2A2BB480D682D65667E56D1060D5B6057FD88E4B136FFCA79D83B8
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1086.DownloadEnergyToolbar.rul

SHA256 ad0e98b1797d6b56b563ef447f8ec9888c2ad010bb5855dd5eade01389be7d8a
MD5 b136fcd76d93ec64bb7fe038449484e0
SHA1 dcae91f600ede62e59c939ce5a6ebdd60d3e9a0f
SHA512 3b48506ee43e9e9154bf606a1ead65317e917b05af4973b875bec7cd366cb0456ed4513b859e5371de77bbaa84d0c50bff50be274de54c112a1bccd239828a00
SSDEEP 96:SbnIU7K7x7q7MbYLja+/MAFA0zH7Qizi/iWi4ipAiW3VG2OBkl5+CqEFIrrsVm11:SbIymCXNb9Tm9mOc
TLSH
T139726C07378BB37F05D9C5ECE741552D0AC59B9D82C6BA135BDE9C29368CA722330B68
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1087.MediaFinder.rul

SHA256 85993f12c77f8755d2669d4cca81b2fb81ecd35afb940e20c242e2006eb5e784
MD5 0731250c38f0e0d48fa9bbfdeb48a2e8
SHA1 d46d42b30b5d0fae31d2e5517b4d7a97356c972e
SHA512 a5973e253854891aa0b355053078de96a9033cdcf071a90abbecb6b0eacf2e8a445a66a13224c6f5d26bd51f94d4ba40984f7c6609c5521734233c22760c9039
SSDEEP 96:SpoAD/n0LAWbpVRpkQSApoCIKpoCFU8fUZ3iv9H0fH0TMg6gLglgq8vO:KoAD/n0LHjoMoGDB0/0JO
TLSH
T16391B0126C76451B58B3A504A7C5E6041BFADB35A1C2FE4817DCB5432236CDB8AAC3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1088.yontooToolbar.rul

SHA256 a26566db08ac4dc42ca0189175b6f8e3d0777591bc93a2f599a4772304eb8958
MD5 ccf46954f32a90cc67ec008e7128c200
SHA1 c54b984af25dff28183dcdc3b5710cadde27ba5b
SHA512 6f38967646e15d21f0f8bf138b7300726173840ab775b4374966eb7b80a422a59bb89c2feac31053ab8abc88a6362d3ddc8544f3a348292056cc86bbf4baa0ba
SSDEEP 192:S/LUtT/APjgPtlB6+xMatam1QlFQWKtNWijFXGK2HE3DGaOE30lEb09y+T96LNDh:SU4O+Y
TLSH
T11372E3073586A5F70DB4C1C0FB87E71D85E6B5184AE979060F4EECA9758B83632903BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1089.DVDVideoSoftToolbar.rul

SHA256 51f71cc626e1aafe7f56d333cbdd3112e29ef88f9050711fd01250fd95d8fb7a
MD5 feb40dd8257edb24b89d29e5d4d7e7cb
SHA1 6f486fd691d9d95f95234bd7b009ec926a3dd5d3
SHA512 5069c1aeaa862fa780fbe5fc0eac446ea081dc835167b44ea73e0f8e918a74e479f45ca4d6526190edede2923d6f6d98c4dc6c004f4ee3080baab56fe81878f1
SSDEEP 96:SkeIU7K7x7T7P+5uYTJI33F30m2Ix5z5/5W545pA5WUeDVbUvai1v3ZYH4EsSf1h:SkVDV/zRigfmHmpx
TLSH
T12E62340B2BC9963B2559D4C0E78395FA4AD6CB1CDADCB1A15FCE9F5A669CE0020F0374
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1090.DVDVideoSoftToolbar.rul

SHA256 c8b664140e10427ac9b7c8e14fa48f74d2bbcd893d14dab1241d8fa9868eb762
MD5 8a3b8dab07bf540a534ed1950fbe7aa1
SHA1 9238189df9fb74bbf6ddecd8eba38e784cc6f346
SHA512 bdad1b3d777a36110ef6fa0b12137dbd466cae158bbb092ab187fb42f2f6814393b798dfee3f69d90dbc9b7b462840c5dd7fcaa502bd42dd17bf401c2dcaa7cb
SSDEEP 384:YbK8+F5cpM52QvxavVLPyoi4Yi8OMeuP1PkPJchhO7bDxpD8HNdPf7W:CpDMLvxavVLPyoi4Yi8OMeuP1PkP6hhC
TLSH
T18DA2CC02FEF7425645830385A7D6E940ABA755BAA1C87CD42F16B046069D4C3AFE23FF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1093.BittorrentBar_FRToolbar.rul

SHA256 def87de3fa12f81495d98870a2872f1ae9babdbb2d8026d3844936e8386b1c3b
MD5 a8287e0965f4dc5a3ffde1ce2fd3b444
SHA1 f089514066f7568e9e83d515313ea049d52f0819
SHA512 56c3de5215959756e89d4e623e4dcff921e2883f2301345f719014f7695c2b3371fc5978d9f43752357f1e012b01c5b29ad5fc1bfccd0133669c6c4fd4432ae6
SSDEEP 96:SudlIU7K7x7g7i1i0iN7GBNFN08YejHzH/HWH4HpAHWmEFrFeRgA/Jlr+FeSss5c:SudqXDZbnxUuHmbQMmfS
TLSH
T1C872444B7AD593AF50EA8484F380A12DE7E1C67F59D472124FCEBE47618CA14B7123B8
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1094.BittorrentBar_DEToolbar.rul

SHA256 78e343d403b42da6bb818c0ea89caab21babe6ef3557f3a3c5736eb58e108f62
MD5 cddce13371d8fabd21d1b7d62afffd0b
SHA1 a430d80f553ec51a81f95b000275deb122a88a14
SHA512 2dc0467784900ac38bde31430e9ada4a442a6f9f328e7444462678542473d7c81d82dc60fecdc76bd4a2b2aba0508afa32881b998a762b508b07c7059bf7de44
SSDEEP 96:SBnIU7K7VnYWgrhQfvFv0e+AZBzB/BWB4BpABWMGbdDMHiq9nPhQPQcsq31fx0YO:SBI1NzPhBes/mvQamtW
TLSH
T1FA7263173ACB86571CED9D98E384568E46CB96BE5AD9F4023FCD5C9A128DF1133103AC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1095.DigiModeToolbar.rul

SHA256 b780dc01157e8252921cc090cf29b7819b0ed909ed81c2a4731c80632a742d34
MD5 f9c956a440c4ae044be005a52dfe2008
SHA1 edd7930d6b6bf25be05d5dcae4598297f4ac0d91
SHA512 d89c20ab96b399fb12fdc96c3e175cf5a92ab6faa1409bc213193a5f365ea167f1192843abe85cc57533b96e11f497c60a74b85cf647366caabfd393061ce3a0
SSDEEP 96:SMKYqdGnEMc8IU7K7x7Gdm7GKlGsdms+sosjs5sYsnsnFsn0s2sBsGsYshsJzsJy:SjYMFn2ahhT9fRmPmsW1p
TLSH
T16272EF072DFE9237269DC0C0E6C5A94D9BD2AD1EC5E670615F8EAD4A915CC733A203BC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1097.NCH FRToolbar.rul

SHA256 1dab3a7020eba50e7fe09aaa90d3d0f55248dd3b2351bc578188e8c15ecb01b3
MD5 62e47b0c64416ed093b54fdc303609df
SHA1 86af45c92702c60965941727d07f12ed0450210f
SHA512 ec00de56ad61a8f881bca61570068ca1ef3bde4a050881d4d45e185c6aada7e3e85fbf6403c7f0c8b3aa9bfceff4ee32ad02b8e2295ac1940d1ca6a3a7d631c7
SSDEEP 96:ShjIU7K7x7Y769ycKlzuJlFl0Ubg2Lvzv/vWv4vpAvWes9TN2pIInB9T2N2qskRB:Shcnbnx7qIrmJmZMEP
TLSH
T17772CC0F3E86A1BF096290C0F2A9E7091DD6AE6DC6E775091F5DFD16928C93033163AC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1098.NewYorkYankeesToolbar.rul

SHA256 53d3eca7695aae821b799c412c2a33967f30914847e6be2360ba2b468899c206
MD5 906bbae9d02bd825dc56aa9e1fc81752
SHA1 0e1831532f12f1a40217761918eb1fa4fd99416b
SHA512 1469521f194950f1a84d6beb557a5aefc552d3873f0fe3dece1d130f84bdd80accf6147863f2092006d5d521e2a6f94a13bc04e57f3eda1aa52c7d01da68f185
SSDEEP 384:SDVvsgD0zQtmsVHV/VeVSVLV0VcVDVPVzV3VYVCVOV/VvVrV5VjVVVaVqViVRVMv:7
TLSH
T1AB7240EB2985957712DEC8D0E3D9A99D89F2CD18C0D6B8090BCEED97138998433717BC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1099.SearchDeals.rul

SHA256 556d150061a9aff803b29faf62cfea0597452668d3bc5c45d3aa2537bd00e9e7
MD5 4b6d41e54589f003677c74609d07eabb
SHA1 8d7f5d32cc33319503b55980a8cd07e116937379
SHA512 052d96df67c9d57043ecb16a8f57ce763676eaa8d84eb689696831c267b9412d6515b70c0d38adc52da615a38e4b7ff74bb7ed703ff452810c4d114da96f2d40
TLSH
T1A151B9121DBA824B0873E4404BC0E695ABF8CF4061C3FD418ADCE5562232EC75AB93BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1101.VAFMusic.rul

SHA256 2ba72f58bc4549d4e023353f47a77683650b43398d05ce095333a476ce404a46
MD5 525d2fd4dfa392f542dda87f60d267dd
SHA1 28a34a5d3b7f89c3fe37337a6497cb7c3417991b
SHA512 5ba43c89d7f13972e3c3fd92ee24d226791059ffe01aab8b6e3c068d46f7e9fd55df060e4b2bf3dff46beb806cc8f2a623c1d21547e0d77bad22a9079b1fc90f
SSDEEP 96:yVylNI6wVFJJIoSDbcSKaga0Bwzf5FgF0cM7K7x7fr7fHnp1r1n1H1+161r1g1c2:yiwIpBdOFANFr799m/m+7Wn
TLSH
T14E82AA233BCDF53B0855D4C8FBC5E59B8ADAA59964C4F00A2F4EEC1DA24DD5032907AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1102.FastFreeConverter.rul

SHA256 66d29f6832fc84cc8681b14d97cd13d9dda89dbd25d3525e78c0523f1d9e3913
MD5 f796ed9c865da4529eae421fb3e8d000
SHA1 5fea8edfe4a38469008583d24183049cd6de2c57
SHA512 96d44519ea26c7d12c7e9fea902ac2166c10e3f030de677ea93f7ada47b21e6db33e2b5cf263815cb383565db89d5156e268487c605bdf1ab1eafec68e571eb7
TLSH
T1397117424852445E0D7769006A93D250DBBD86F6B3E2BB1802C8C06E27A7FCF55F97CA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1104.SavepathDeals.rul

SHA256 80ccb1c8074bf4f63649ca5df3aaf7a4f0bced5a878dae183c5be52c08f7822f
MD5 7636010d0628071409bb293733f6aae3
SHA1 e93cfdc677b88cb7e3bc9e37ed9511d2313baaf9
SHA512 0d3872830fc016e3ab90f7d88856690693d4c2a3d2a35416e3f134af236295c32451b08ffb7500e354656e28fda7bfbd466cfe5255bd776f08ab5e20e70b3c7d
TLSH
T18A61FF021D658426847786004F51DE02DBF5E4A1A29AEE89CBCCF9467366F9B14FC3AD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1105.FreeYoutubeDownload.rul

SHA256 3fe7ca48b8feb5f12e64f0707e243a4163a9948d18563874a3da565df0a98d26
MD5 2768d31fdd70a8e8874f99de610fd70a
SHA1 f27b17fffef21161eebce37a582542c63c7ad785
SHA512 ff477018567341e6491e5c00f506a5945b3528b86f7912c566322e04e9a8e546266b846b0b28bb543f5fe6482876e26aeabaf98010197577195fa43de790b31d
SSDEEP 384:JrgVA0VsC9ySaeSGtOeFbTEHZ2XObluo6L0OiM3WMu2Zw4U4WQeeeMTIpHr5NKkM:Jr+A0WmaeSGtOetTEHZ2XObluo6L0Oio
TLSH
T13152DE0649BB0457983394805BC0EA04F7F88E793286E94424DAF59B6269FEE14FC7FD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1106.GetSavin.rul

SHA256 b43008c60731ff054aaca34e1ceee64cbe4ae7140e5c2a6476f062829f14d9f4
MD5 24712bf38b6a685dc7c5d332342aed79
SHA1 c4f9550514f5369057474d458de85fd16fd82329
SHA512 8b6e0577625cc4ff166556761273133b19154f8c56db2c805bfcf97a963ea3ac56dc021890086985befcc889e23edd3ceb19acafe4bd54ee1cf9305751e94049
TLSH
T118219001BD248317EA777100528AE9422BBAD35DA046FE4105DD64012233ADBC6BE3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1107.TVGenie.rul

SHA256 fd3740c4bd015c6a0aa9307c3f34dcab87687444a55279d38180c13eff804f97
MD5 119ab85ced7475592641794018545927
SHA1 e91e1cdb9e949ddbc9ef0777b5c1c7067962e264
SHA512 90545bc2bdfe5382c5d6b09d5a711fd737593033685dd20d1a5d0c4e7c2f00d13d13195e82ea37a6eb6f9161415fe9b2f7c173e6e58756d6607acb0baf05f750
TLSH
T18C51DC121DBA820A0573D4004F84EAA5BBF8CF4461C3FD410EDCF9562236DD71AA93BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1108.SmartSuggestor.rul

SHA256 7a5b88ce2e7a248e584f5752bae47b9d0a2e2aa9a18e08e3241c25fa6021959f
MD5 69ff952844cdfc0a7ab278c54975a382
SHA1 f7c47794341daded5b45c5123f830f7831f9c9a5
SHA512 2d55b37475abe50b5eac522053a9b2cc0e83d76425eef758e2c55c7cbbff9c1a8fb1752249daf89d62453305a77569916715e2f1440028425f35f0d273b17c76
TLSH
T112D05E532BC7C7B706A6C080B1D051DBCAEAA524E194274E7F8C1E5712A8A28A7407AA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1110.BrowseForTheCause.rul

SHA256 e0d702c4bb635b3b65e3a60177d140a4f031e94ff2d647c12f6000ce96916465
MD5 fb547a57d39d399a56f5f1dd8bda3f40
SHA1 77a24ee579fb9266d55b95dfd60b373e0e0c562c
SHA512 60b411e0d2d13f868de302c398b697b266320f8b625158a939929beb40825a2ffb625a2207b534ed8e4efc99aa4f807d9720350287fe499e79550245b0547b81
TLSH
T1B411C5500469201486B223841B45F50637FD4661764ECB437A5EE925309FFEBB2FC39F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1111.Vuze.rul

SHA256 fbb6faffd37a4740e4a2b5bcdc77098ac8ec20891c8b4f44730fcb12a24a5f23
MD5 314bf878cd7fcaa571a9710d1e6e4c28
SHA1 0b94a506c0fd5550848cd50a88dc4e801951de3b
SHA512 f50efe3be36425b0393e86e8cd123e4fef128c9bbde365f615f3502cbfa5a372b9483d7d9fef2d69df01456f21254c8a1dfd6603247d70d8d16bdeef8b936003
SSDEEP 96:yvQuvgMIU7K7x7g7iGOY+Z/a9hFh0QHkKXDzD/DWD4DpADWaApvhS1sMjVRXSJKK:yvQuv4w7TJLakXmRmBSk
TLSH
T1C872D0172AD9923F1879C4C8E3C5D60F8EE9A63E65F578420F4EBE15D1BD82532503AC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1112.SaveValet.rul

SHA256 746f07fd297c6c2fe80749e15172d64f1d7b5f7e0f30638dbaed328a56bb811d
MD5 66ffd58c0bae811d5e61cce77a9dc041
SHA1 a71382e29d1d2e03f48421698d689c4217181a7f
SHA512 12c80cb14c7442ca7dc463a3c7bf47ac59cdac1acd4131d13faaa56392780171828fdc74667707e6c71811947800f1c96c3c73ef8ccdc38716215b6be4235010
TLSH
T1F0F0A72729D9C62F39AB8981F65015148DF8440AA3EDBD135F8A7C062A8C54C2DA57F8
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1113.SpyGuard.rul

SHA256 0ad6c48ddeb461e3f4f9e98d7e3478b64f327477a73ffa4e147fa1279caef709
MD5 c2cd8ed6ca17873a1b52c79afc15f2ca
SHA1 2ba610739916d47f2e456d3bb4a2c9c427474195
SHA512 fd1a18c96f91b47878743ca291fab5cdd2a4165bd9fac108d75e855a4b035a31c92441246fe457ce501697496def5e0bb9a8c8d6e9a68c38f9b5f0bc83f60bf5
TLSH
T15A51CB221DBA821A0973D4444F84E691ABFCCF1021C3FD820DDCE5962276ED756E83BD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1114.ST-Eng7.rul

SHA256 ec7ddab50d11ffb301f51442dc666cf45aa94417c19df99f55d3ab5f92303883
MD5 8319efaf669cee347f6fbb38bd7fa040
SHA1 ab8a388d7707873a84e4a00234c446d78c6c009f
SHA512 80bb555c743b9938b3f5c6a624d8d961f91ad8ca22b8cbb9c583e112be00969962e15f74de9f30692c5a6548491466140824325663c77bb5534e4d90944b7b97
SSDEEP 192:ygN20cqg6wlTrJTh20Ny1G1bL8vVMsA9vB/ddju0e1SXXQquUV+V6bBWuk5pcPte:yoN7S0
TLSH
T1C572FD1F37CAB23B12A88AC0EA46995E86C5D598C6E975173FCDDC4E61CD52433203EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1115.Qwiklinx.rul

SHA256 95fd49ed8ce51d2b7c1ff69abf9f7e6ae93e44bb487810a74a6478fdac333e6b
MD5 87c6618ce64a31849b7604dfc08b26e2
SHA1 b9659e8ed30838dd400ebad7d45e15f6c78b9765
SHA512 14f28d42dd7dd41019ae12cd931e681576c7f8b01bc0b13cbb4fc5772f17d075954452ac4d6c7502c0e81906464da3eee22341e83bdb9c17c5ceb3bac84548a2
TLSH
T1F331C2109F5451C454732E052B95DA002FF59B815343AF8649ECF6923332DCB8E7B3AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1116.NewVeoh.rul

SHA256 573e1404d5c242a0eb7e1737af070a9c21e0e1fd3f110932e449b57bde863013
MD5 a5d738ae7b944f7dc90bd942ec7e8d4d
SHA1 d2bed25c4db9ca579ac1b837f724b364aab3d66a
SHA512 871772c3aac05a515d0d8aafe9e3db4f015431e78c94084c6bc7d7ee7549b96b7a504dc4e53cd92439bbaed50c0b031f5d6b09ad7a62247fae973ac51b929779
SSDEEP 96:yTiIU7K7x7C7EnciEPNsjbFb06lS011z1/1W141pA1WYa3p3oDGepLzl8LEosWLb:yTBpxjpns2DmRmXsm
TLSH
T1137237233E9EE12708AAC0C5E799D95949D5E81989E9F2090F4FFD49D1DFE2033123B9
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1117.RewardsArcade.rul

SHA256 e6b9688ae5ca9e4b6be647f57d9ac1a8ec2a934d2f0f2aa593cf85340b20c37a
MD5 26089819915c9bcdd1ec282c022b0f11
SHA1 84596189029bbb6e7d59c10105435d356c4de002
SHA512 7d6cdf6954bb52e0484a29aa9cb08847c4558ef59c5ba4dea4da052e5b669696a3950b7afe8d468789bda8000ae30e70ade557941ab882d0af3606afc71eec9b
SSDEEP 96:ymlIU7K7x787mpix10A92eFe0hppiwzw/wWw4wpAwWh74MQDWbX404ez2ZhsnQ1L:ymqwYUrd5rnmhm0S
TLSH
T17862861779DBC16F06A5CAA5F3C5714D8AF3EF1844D5BB091BCEEC49225C61832283BA
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1118.A2ZLyrics.rul

SHA256 87b2c11e65301750a552f9f047d19ebe495ef748340267845fc20e2f2dd04bbd
MD5 9667346a1df280713e6835d1ccd06067
SHA1 8d3837e176df09939a1d012b188fe571988f772d
SHA512 00029e9e581d58110eef2e6a9b6a28726606ec1f732e04e10f6169f30324246a62099f7f6ab7a9893501e5a19246c932c1ffdcf0920ba02bd01bc153222ca1b5
SSDEEP 96:30feTMjPrDCmKcr1iy1ksRm88b7JjNbuq/an7nwMY8ALBN3QjNXtvUJhu2yHkbQW:3YjPzBkGm89bw8Ost4
TLSH
T1B702C106BF87C716007B8414F604E65C6FF59A629140FCC50BECBD4562B5A976B283FE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1121.KeyBar.rul

SHA256 2532b8e1fd577e5192bd3dc54f66a367d3667ad00aee8ba7e01495fc455443ff
MD5 a1316f8f8f131b82c81e6ef5799ab4a9
SHA1 21a804fb0d75dabb09cc0fc76e692189ea083540
SHA512 24848fe1283e16364d4b9eda38f034766dc1093ce4c317f7cc42790554465587bc0cd588fd8452fd8a61b484acc59450e0653afc36b78f49b928a8c98abaf625
SSDEEP 96:SvalbXYIaLSDbcSKaga0Bwzf5FgF0M7K7y7an7x7X7L+ppt8YtVOmFm0JGml6hRN:SkLPBdOPZEJh3rl5mLmelWX
TLSH
T10F9214073FD7937B1577C4C0E7A186ED6BC1C629E9D471061B8D6EBB26EC8902710BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1122.Mysearchdial.rul

SHA256 2449cd20df712034352b8f9dcc0f3496f55241c47f90a99ffe6da7da81707a3e
MD5 436aff39810df2b94f76cf71927d711e
SHA1 0cbec66361a96da347bc2a92646d73e716334efb
SHA512 01ff01e4d70f5f99c3c9e35f982cb190f2a479221ae60d8debdb31518a8e80ca1c9a5f0c5df4345fd196e597958cef4f349c9ad84ab32e63d740e27f97868dcf
SSDEEP 96:3E3tShAu9kNdmkNCHhavUiCOHFiNMn5TaFNvWHiUxgg/:ucUsaXv
TLSH
T131C157125C3655694A7344082FA1E7042FF8CA61A283EA4D05E8E2477377DDF4AEC77E
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1124.MagicDesktopENToolbar.rul

SHA256 a3b28e2936ec294fda4623551f469fb4174d934061f77a38265cd521c336d2f1
MD5 47b204a6449fc3af65b8c438661404c5
SHA1 9e81b964832c29287fbf599fbce85ab802ca74d0
SHA512 8229d3986533ba9b0e75270c744b246a8c05b2e223ef06d6c68d4d253e130e7f4b2e33686ad306d52ef6c4db212912b16e48bb999b692388b535bc14c8f3b7ab
SSDEEP 96:S6WiIfI7K7y7Y7x7D7k8uxx10gt92eFe0hee9ippiwzw/wWw4wpAwWh74MQDWbX7:S1BwJwJd77xFm7muf
TLSH
T18B82D0072FBFAE6F2AD6C488F745999E86C1D95999E430030B5E6D5713ACA306330F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1125.NCH_ENToolbar.rul

SHA256 0df3d8313d8403ca556b6ecec2bab1427d76577c5428a521ef1e864f12f23586
MD5 407e40957e6cab1cbbe38b1e28951f1c
SHA1 e6440be2f1eea0f7871c61e4afcc89f62c1788b1
SHA512 f67f16c0eabde9d13cc68dff642df36fbd9986f692a7d7e53bd8e93a520bfd697699ae5fb35cefa30a3e9808aed1191e5c0edaf3a93ebe663fd05eb2a67d7c91
SSDEEP 96:SwgEIfg7K7y7w7K7l7ZsTf/mWtjYEFE0308/UTH0uzu/uWu4upAuW7Baq6FIxFSs:Swgv/PujhjZDZmvmwf
TLSH
T1AC82194B3B9AD37F0497C884E765D94E46C69AA89EE5F4410F8EFC79D3EC8402350BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1126.Hao123SearchRemovalTool.rul

SHA256 d9110ae9e21a4bb06511570eb1845ab519622e1afef6c256f66522364c2cd310
MD5 012bfc6005a51a292c89de5c9d4ef46d
SHA1 92a9a372d1edea98eb9f9fcb78ac36f3d525f716
SHA512 64620863663631efe724a0fe9097638f1ccf87cf1728864febc46a744d378ca619915d5c2237a196c3a3cf7e9a3041d485d9db4b1766fad8434f2888f2be1b42
TLSH
T15511E61E887559655A7745802BA0DB1127EAFA10E287D50A00C8F387B2A6DD705ED2AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1127.BSPlayerControlBar.rul

SHA256 a6c15621c999a3d4db3a8f3321926c91efeb58049b933269a4f917c9b064a6e8
MD5 484a84709b3cce1809c1dca848dbe7b5
SHA1 b8e6aeb3f781ffd65deabca6a4fd9524857fa1bc
SHA512 5ff10a4682bea8ad6a09cd3c21a3fe3f886da1b63f11a8563fd8702098681bc2bfc95037ddb2d16e13c412d3f59a0dceba3611bcbd56c3edd95c79babfa00138
SSDEEP 192:6bRf636/D2hkF7+Y6NAANpN5NdNdNMAld+COZXWyOr8XJ7U//7KseSUqXseSNUEr:6bRvcYflk7PXATJ3
TLSH
T1CE827802BCF652784ED6271CB392ED005BDE2611C0497DDA6794B84D41DCACB8BE2B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1128.EasyTVBar.rul

SHA256 0edba59e90a0e66c1a7a33dbe8d79d54d519b294ac4675ef19cf3574c67923f5
MD5 9c5dcc7b4167055c062b5ab15b3bfe3a
SHA1 8dbefe25a14e956124ccaf265800720201e6d6fd
SHA512 ccf68957857e9c97409d2216c56aa0287a86b2cf23296b0ef7de0ed1b9e4b4ad465fc005e697e72ff275dde6aa9f595b051974fb2774e0e445a5236528a26401
SSDEEP 96:SDalsRIaqSDbcSKaga0Bwzf5FgF0M7K7y7X7x7u74/AuYTTtI33F30m51IR2Ix5/:SLO8BdO6uty9rE2jmFmfyWX
TLSH
T19A9255073EABE6BF4197C0C4E7D1AE3F86E4C81866D4B1060F9F6DA5526DC1423A077A
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1129.HamInfoBar.rul

SHA256 9277f0669b25b498b5ff6aeeac159316030342141a4f8c6f4dba26ed6e98ba7c
MD5 544248d3fc5b95a589fc4ac68808d8e9
SHA1 356250431e762aa7435b96d9311ba96e82e00879
SHA512 cdbf35c3d2157eb08ab91d3cac969f8e1ec7f335f3ba4ebe9d57d6d810e13ccad7b16f7bab972e639e5dbaaad46c32e6bf0c7073c9e2588043e5101755003d40
SSDEEP 192:IHbg1O9/mWN6pW3EwilmBMx5Ma1Bksn+/y/yuaLdJLu5v12JUVJ5FWW:gbIO9QKErlZca1BkI+8/12JQJ5j
TLSH
T10BA28B23FDE6436D499F2308A799D6008FD7A652C148F9D48B597C4A02D86CF8F613BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1130.PhotoJoyBar.rul

SHA256 1954073823bd3c406c13d7102b0494df7464cd334c1c24b97881f7065d32558e
MD5 b65194adb4b4e81115905ba7dd78ec79
SHA1 a37f2b205b09eff2ed198d05b6a632c0df43431d
SHA512 c5d1153044a62ae35e174854f973fb534d64ce963b93119f1f23c74105478c1adbc0e13dca0f9bc7c1e691e39c75bbb73d3740c363b4921cfd60f6acda502ad7
SSDEEP 192:SAx0QtAJ2hi3VPtQfSF8D6DVHymFi/Ny62tjz5l53oe4psLzek8iFU94LzKM65tW:S+qYBSV
TLSH
T19A8242233FDFD37B0A96C081F7D6854945C6DD2989EA78011B4EEE1E32A993C3360769
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1131.SocialSearchBar.rul

SHA256 6afeb8b3dfdf411bb38edf33ec525d65d1e907d5f40d9adfe22c63ec931f6a6e
MD5 dd3201af83db027eed5cad4fd9b96923
SHA1 108f88569e22acc5ca5f216997b560906de14993
SHA512 ac856bf70e753d08f96d79df9d2f2631ab2e571a778bd2819a6005eff100541412580282655bc18a6ec3e8022dd5097052accefe12debf03892929506a234277
SSDEEP 96:SvalWJIaTSDbcSKaga0Bwzf5FgF0M7K7y767x7f7zKFdZYMtp66F60NSSJOd9O02:S9mfBdODV0dFD3N1mbmyUWX
TLSH
T15B927F533F9BABBB419FC888F243DB8DE7C1C91A46D534011F4D6EAA5269E013360B79
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1132.SerifBar.rul

SHA256 5d48d8c07c42b03479ed82ec2a7f342bf8dd6f5f154e2741b4612554e3618019
MD5 97042ed85728faf0e7fe4a80a0717b79
SHA1 641be680bc97c4e08568a03f56e2796f2b037c9b
SHA512 b8aad8330ae0d55bc5eec5caefb93f54b44f02a614b81746e1521925b0af2e7ec40a23fbddf68045369c1a3d0f2f6e1d820a8c6d1a13007a275cb81b3bcbf59b
SSDEEP 96:Yb+7vtD+hrNlzoD6LCLSI8vMPIrlMiv5DiaZA+7K7U7g7e7oxndx6Ms5J5kswJsW:Yb8NWDtCVPIrlMivJiamahUJl
TLSH
T12872F602FDB1477C099A2344A3E6E6044FE79553C0C938D91B66748B02FAAC68F757AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1133.Mp3TubeToolbar.rul

SHA256 ab08e70816384d029ffc9a9e66ae423e8cb29c33d29a70b055ef61c64866734a
MD5 154a43682e6f67868ae511e9aa1ab7a1
SHA1 fd4122006c89703449cf46c0e2ea22a7a1182743
SHA512 a22e5110d7ed95422dccd843069a4e3859579cdf9833c2b286f88af6e1c3f0086e95f73e5411709322fd1f457a2100ba42b34eda004e53cdbfb3c02b45d81e75
SSDEEP 192:v8lNJHfYk74fsLCB9JZsBCjOi53sPaPxs27I08:v8f1QICLsBf08
TLSH
T1CC62DD01AD6242A90E735504578AE2146FFD8B50A183FDC806ECF2532677DCB4BE93AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1134.ooVoo.rul

SHA256 45bb6267bc42cff6311ba7d5c5433dbf64dfa1e3f2d370a396cc800a75c58f0f
MD5 fe68bd7e21d64c0d829bd7630750072a
SHA1 0a697d62ecabcb60168ff229045163ae11d77abb
SHA512 68a9249687b93a5cae7b6a7eb90d1751463f9c1a2a132db34edf2f81d673ac9a7740d169428978b79ab37c897ea87ad7724d32e9d71d327ce17ceaf984d65049
SSDEEP 384:yeweXayW2bWsiN1iuxZ2RyexfLWmK86YH3nEdoEfzb1Q5uRwN/vsS3ImYIOfHXEr:z
TLSH
T18F82591F2FCEA6BF3265D684B3C5CA4D4ED18C9C42E879024BCD6C3526995393760BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1136.AF_HSS.rul

SHA256 742e35ef3420bb2ff515be451865cfea59d7a8f184878599cd70f346966f93a5
MD5 3a37ef4efc5a295cf4b0195ce6935a37
SHA1 85cc437be53dab8051ec24b2bc83a0d720668da0
SHA512 3d709c95df107d7f45669fbcbaf11648414ac4b5cf84c1b8ebc7874ae99bae6a04e657cb5fb76b554230ea0d7268d751ce920510929eee57aec529ffb9b627fe
SSDEEP 96:yaqIfG7K7y7y7x7x7tIPTrS6tH04F40rQ4TYPTYqzq/qWq4qpAqWPde+W58thm65:yaJ8j6XBTF/JmPmED
TLSH
T1578299032ECAA77F29568480EBD6DB0FC6CDC5AC92E436014F9DAF5705ACC04BB94768
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1137.TVersityBar.rul

SHA256 adbd3395caaaa326ccab434bf56cdd45128c7bee4f34586aab54ecb29f8f41c9
MD5 9d442fdd05a6d1b5d9a328e81b41e383
SHA1 512ed9006f96dbd33f47288a170eea146d5e3042
SHA512 7f3a9eb59556917c405793a86c3a9df9d947c7c3f59be58efe44043b5855030d01a3711c972ffddfd5d4571c91f97c2401b335ac6b3e5c09eb0d353a6c7af2b5
SSDEEP 96:yE9If77K7y7F7x7N7BsHrD6ytfsgFg0T4AbQnbwCzC/CWC4CpACWX1mWuhEFZeiB:yEicze3xTZPNmLmoD
TLSH
T1E4827F0F2B86D2BB34F98480E3A58D4DC6C9AABC41D574121FDE7DB6A7EC50433207A9
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1138.MapsBar.rul

SHA256 05499446ca319a5c1852d94808099f6313dffea5938b63ba2c8427800c7b265d
MD5 334267694a72759524a4579c3aed9d35
SHA1 a16759d919ab0018615c96bec0c4fa4e8d838210
SHA512 e85c214c3f79b553af25c4e0a00a139d6373087047aff7fd78005129da3d63d07f48eeaf2df5e0e7e5dfe572047fa9457c6cc477001d330855620d8944aa03cc
SSDEEP 96:yESIfn7K7y7b7x7+7IzsyUfXt8TLFL0KVhsViElFzF/FWF4FpAFWoKn5nYzWu57T:yERQKtWZHoWrmxm7K
TLSH
T10382D9073FDEFA6F36A580C0F2CAC5498BCA945A5DD835432B9DEC253B9D420226C7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1139.RecipesBar.rul

SHA256 070a1a5701661985e3f7ea5135de6aab72ea41a722a58b1677355858e280e327
MD5 87e5ed637225d32b029945194921b4c5
SHA1 950a7c39b07c437d37a85504122b634246be1215
SHA512 20166ee0c07dc7bf0e73263e7505cf192c8c7fba07b867089f80292e18bae014857682e90a210288185dafa2f2d89877d581050455c11ffe4527fe28c21ba3b9
SSDEEP 96:YblkJInNAkw3o7q2mEid/5wT2I055Q4bEugLAh8kKuv7ekon+1D1p7K7U7H7nwsN:YbrjwTdlQ8bEugLAaS7ehOLdJj5wALJN
TLSH
T128924C09FDE2D26405E32546A39FEA104FE74986804C3ED82B157E4A169CCC7CFD5BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1140.BroderbundBar.rul

SHA256 45ce5bf269d85cdca378251bc119aa417533f2432f8944c51479c0015a85571e
MD5 ce49197cc7130b495ced9444c08fba0f
SHA1 1a4dc346a9589c95ac4133ef62adf8975e61d8c5
SHA512 0ea7a3c1503ac305c54bf07436b7e4f467b6f400e4fcb4fbfc98f82b18256559c361a7fd70d53b4c4836e48d3f7b609267e98564c9d4ef827a863a12420cdca7
SSDEEP 384:mbPfgSrbTr7GA1PeWEb9JaQan8PzNOtZX628WityyYCbmA07QVcqj6Rta2BNBm61:YPDxRI89x
TLSH
T1FEB27605FDB39259198A1A64E2D1DC444AEE4A42C0BC7BD63B3AF04705DC5CB8FB53AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1141.GameMasterToolbar.rul

SHA256 a2fd075e53c57ff3f72d54824f20c2784f76b21e89ed78b0c8e3c0f250615c33
MD5 1564917fda216abb7d2353fca47e609c
SHA1 c781ffb6fd016a206388955f5735ca2699408938
SHA512 b7163031c97552e6f3ec40fd59337367db5a2980d03d7863e6d8b1aee833c3d1fe671a2d7a93fd639e39633e8e5ddc4bb40578cd4b421734159aae10cd5b476d
SSDEEP 96:AbT7boFwiwZJIvcw/VkVxneSKbXA1lPU5U7q2eiHZebmI05o+1D1p7K7U7H7nwsL:AbcwQvcw/mWFA1IPyAJOLdJIXr2JZ
TLSH
T175A23803FDE1C2540A933218A296EA80DF9F9543804938ED5B2EB45F45AFDD39F513AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1142.KeyBar1.13.rul

SHA256 dc472b675b017f057fdb4f3f15fe6149faae60d4455e7b88d02c578c56ca7249
MD5 b2b54302419c66a352ff1d92e3391506
SHA1 6ce7c296e3f0c671e0ee86b42c69fab72744cde3
SHA512 e21791a9799b9fe31cef4940cdaf5b998ea6efe137b854d20c2cd936ce517301149dcda9229031eda1da7eb1196af80e34ce4f98dc03a444b5851a3e11048452
SSDEEP 96:yyylkydIaHsSDbcSKaga0Bwzf5FgF0cM7K7y7a87x7w7yVWY+Zdta9hFh0QTfWHB:yyXyCCBdOf4zIBTqU3mJmhCWX
TLSH
T1C492AD072FD7D3BF08A684D1F282E57D8AD4A91DB2D870851F8EAC6701ACA443355BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1143.BrowserPlus2.rul

SHA256 eb3c50b9f6ea84e47d763c6c2e715a2630c3a4c364e5e149fd470167e1367cbe
MD5 1ad033916b152f05cef376fb3e1929c1
SHA1 f0ed32837307c95eabc103416d04623f85208ab5
SHA512 7ff07df8596a6c50345652a2209fba400bba6cfad57a4a31f7f04f375ba17cd80d90eda33d6f841b85b3ee7a0345516aa337ecf461fe80978af3726a89b24174
SSDEEP 192:v7IbPnaS91S111w1J1X161b1115A1O1e1K1O111r1U1y1p1V1P121O1t1T1h1+1b:EbPnaNAHJS10ulMWhJsL4
TLSH
T116929D03FCBDA259099702E4E7E4DA407FBA4692808D39C9176AB44A036DDC3DF5936F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1144.WiseConvertB2.rul

SHA256 d9508703b3d65689c065bf503512b378fd5e11ac197c3df766b1f96def19b930
MD5 be929412eca5051cd294e4dc1106e6cf
SHA1 875ba7e4119a0e4daece754a44e864ab8954719e
SHA512 3ffb385cbd61a36b19c4d813f85f2e31008fb9df322148976e1ffcbaa6e9b87056b27df0fd0859fcf127935bafa587b80f29ab74811e4548180ccea414a20649
SSDEEP 384:yaTaMsCuGp64aTryG3/ufCuflZG260CId9V874EFxZLoXev47NFMqVImwQeF9F03:zWzCuGp1aTryG3/ufCuflZG260CId9Vn
TLSH
T1A682D72B3FE692FF06AB8084EA838E5945C19D58C9E835552FFD6C9631FC90633117AC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1145.FreeSoundRecorder.rul

SHA256 06dcc567134310178381620027621b647bf19f313e31f0e7a7d460c6a3873055
MD5 433d0f9ac798deacdf7b06a9d2a5991e
SHA1 afd777f5bf7c42112fe87d797a05a14fff8ff4c4
SHA512 2888d5f86f5da65ffd5ccac00a6b747738a967ef3ef6f2c160b2968f144c29da5f7677a3a385979e8cc5b91d81597ab6b5128e24c398fa9a1304b177f30863cd
SSDEEP 384:kbFlXaA+86x0LYq5m8plFhFs2HJgMKd1UOolq5xLwDLVoU20grKMecFoOuxmjegM:GLXaA+86x0LYq5m8plFhFs2HJgMKd1Uj
TLSH
T167B2AB14FDF6C2BC0842A7D5E659E9881B9B8592C0EE38D40B597087C5AD6C38F913EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1146.BrotherSoftExtremeToolbar.rul

SHA256 dec9823a27f8851f582cda1e1d5d1470b76f95f099e510ad034294cb2f155188
MD5 78a9f6480350e84195daeeadc76e7bfb
SHA1 3812a6cbfee0cfd340c688e5655b4c4ab642efa4
SHA512 74759135e49b5ee820e527043c7c43d9baf74ee01fc3450b846f1bab48a2a505c8b5ce76632d03246a98f7bde3e9af79809bf7f1136b89a14b7d9b5ffa247ba1
SSDEEP 96:yoliHIaWSDbcSKaga0Bwzf5FgF0cM7K7y7r7x7y70PD0ac3ftE7DFD0iN5Edq8N5:yjo0BdOiyyR+dDQ6LmlmzZWG
TLSH
T15B92CF472FB7F7BF81E6C080E7499E1989D4A658A9C4B4290F8D7C5603EEA0133247BD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1147.EntrustedToolbar.rul

SHA256 21b1a56ff176840ddb3a75bbedc70e173b72c939127b31bad4a64dbfa4f320e1
MD5 685e0ca0469c25a5de0e85ccd5b0ca1f
SHA1 0fc3028cff871a25e53fb4d05e4767797b919807
SHA512 d320e8a438f35d0d88eb6138216eb3a61606b0f191a58ee03637b2e9a114223aef9b56094ad420510dff37ad6499877bc8a9d342e91153a5d84052b2dbbeaf04
SSDEEP 96:ywHlewOIPOSDbcSKaga0Bwzf5FgF0cM7K7y7p7x7K7sL4GQbLtAv/F/0OB9wpuwz:ywYwlLBdOTupyt7AWTm9mLJWG
TLSH
T1C2928A472AEEB2FF045AC484F7618D8D19C6866476E831032F8E9E9F615DD18F3187AC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1148.KeyBar1.8.rul

SHA256 d03b557147747cf6744bbdd87a807359fa57cde0a41b72043a029e30ec830617
MD5 35c88da0adf7db437f4e057df256daf3
SHA1 6e54894457992fc2706c0be2c595e7e60ad3a005
SHA512 87a6338fca121e625c50966c93cc8bc7371104aef9bf5ab228ee18dc1251308925832a9c071bdbffa7cb9259525c90ec5e80a7f72df61c20c485caa139698234
SSDEEP 96:yZVPaIfBC7K7y7Ut7x7X7Lytlhw0txiyFy0lqqB2FVW8z8/8W848pA8W1HMQMnqi:yjhA98F1j/1Fmrma9di
TLSH
T14F82CC172ADED2BB1675C0C0F346654F8BE1D61D65EC30039B8DECAB52A9B143328FA5
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1150.DealSlider.rul

SHA256 3fcbd35fa0f5f0c5418ef29b7487ecab1daaeb7258e6b7104c367e44f6d893e1
MD5 67f1e0610b7566477903942bd40bf6ba
SHA1 95d4953d5aec3ec02b19d3b6597eac0f36dba9ad
SHA512 6ea4a055325d50cd000a3697377944c80d8b26543b9b00fe2f09a7ceefda564a1ea799609ce78c64ff01f842704370b4d4625d8dcbd17a737f4d21829067f3b3
SSDEEP 96:3n9SWiedTAVA8wceRUYBAEtKSfeJf/inATa+kChqRKnrs+7+wMPHRWsOd3WYvYt3:tEnw1UGlhUq5R
TLSH
T17A327901FD92CB5508724108F244FB08AFE757A1E280F8DA87EC790F62666975B353EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1151.NinjaSavings.rul

SHA256 7269583dc410f26bf240e45e4e93f3762e8f23ec47d27f284ce7c197bca6068c
MD5 8d856bc5245e3f97b27f805e93b71d86
SHA1 42d529bc6f177a947677fdacc02f4d4dc4607506
SHA512 1db456a98abc348086f37d0f7739cdd754abf0a1b084f4ab383798692180527dd829f19400719ce76d348f2063ad93503f4167ffb37726e7fe54be64ce69333a
SSDEEP 96:38LwQXZ4cVxZw/tckxgEtKSfeJ3usVO77Cq0Knrs+7+wMPHRWsOP4+7lt8AcdmbU:s1wlcOftqWRid
TLSH
T115327747FD87D71048768208F289EB486BF357A1F280B8C90AEC7C0623699975B753DE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1152.DealCola.rul

SHA256 9433b0e04392c3e01c02cfd8b25f1c11d948ce9905e42ac1fdf361707691f765
MD5 2e425eb0c891df6929a402ecf7235cdc
SHA1 515f83c267d87c212ec58108c58ca7d9e69bed35
SHA512 00cc1220543f86c7581d14a99a314c9d5cbfcff250bb22d23430dd1686e14a07eae8f543d2360f0ff267f00a6d67fddcf34b29c1edbbd3b21d6daab28c56f3c5
SSDEEP 96:3pSwFo9sysKKhrH5uojwz/dUUt4EtKSfeJgOsTThCJwdO/Knrs+7+wMPHRWs0p/G:AwFo9stwpUutqY2
TLSH
T1D2229E05FD92DB1008724208F2C8E7452BF35751E195FCCA47ECB80A62A76975B313EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1153.TubeDimmer.rul

SHA256 80e3ff47e92b16eb537d4dec53e876ddb1083d95b75c7b347d1cf0fa57381a95
MD5 f0f8e617bf83fbac883441d39fb44985
SHA1 ae022dd2cf95ac6d98754556cb3818a528e384ef
SHA512 aff5f814b493b6d100520e11582f6c8a6066e2aafc2a12eb85b98042224618d3d55a7ad0d5bc41a808c20a9a493c2fbeffe9b22d6cb0bb8a82b9ef5d3c8f3e99
TLSH
T1D351FD121C7E831A06B3D4844B84E695ABFCCF1061C7FD4609CCE5662276ED756E83BD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1155.CouponChaser.rul

SHA256 3a99dc5da603f2743595822d7e713eee8b4c709f9bb0ace0afc07d4c9cec0e4c
MD5 48e51db3258090050e03ca0b70805c21
SHA1 5e82d0afe91156e2bd4d308b6fb00fa720b1b966
SHA512 17761dfcb2528ecd570881844e4f730f3fbede07498dac406eec0f61521b862e95f552591e168869ca28fae96fe2aa20e9133f112d74eec802b299db853375d7
SSDEEP 96:3VGeswbbWyBBvxZGioLcL8KSn9RacibO8FES8tbFJF6nUEKumL3QrS7SwM6IiLlO:anKnHC8WS87+FBDJukgbD2
TLSH
T15C02AC22AE87C61705320042BB96DA4C2FF8C7A0D185FDD266FCF84A23659975F253DE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1157.AppsHat.rul

SHA256 82daf6103b8b5a9f17148bbc60749e8da3f2ce1efa71c6255f5d36b9607d90a0
MD5 18bb8bcf3c589d354ec4bcb7e6e3049e
SHA1 bdf97cf1630e20bedac897159a6adb8761c313de
SHA512 492c02853dfba6b9f14259fd1b519f67239d8f26a70e2a01e2d864412ec8c6a42707d161e13ef1cec56ecdd1e649c53de9195a27b468437372eb08ad2109da5b
SSDEEP 96:3c9s0Rap3lvhFUaffpKpfFcjsigY4OF5gVErVqsSbwM6gJacai1vv:I0Yv
TLSH
T12091200214DF817B5A17B440D682CA555BE66E1060C4B6407FE88E5B125EFCE7AD93FC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1158.UnfriendCheck.rul

SHA256 928b2e96e05f1d37781b35b6fbf6785f0145954577fe5b144f7c193d22a8ca81
MD5 019ce02ee9bba8caa102646c36110fe4
SHA1 ecae0989d0eec0cbafd156b9d347ea1878827247
SHA512 c759a5e88e8af67f708d033657db51e81bfc90ed98d74d36f62b09281c3d20aa18c81d57b3e9fb7e91eba01e42bcedfa6228d7c57838e52f763746d9b906faaa
SSDEEP 96:3e7Fi376DSz8z9Ua5XY5RSElDYyUMBPckkCjJbJ0VndJCxfd4fdlAs:iE6Ozc9RY5oSfi
TLSH
T115D150220C73456A177304405B52E7952FF8CA54A383FA5946E8EA87323ADDB44ED3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1161.Linksicle.rul

SHA256 16f7ac379c29cf6b0ff5147d5e2b5d55ba36873139d86567662a02d42d977102
MD5 f601d3907bbf6a96aab506b67a952897
SHA1 c8bc4fa2bbeda1e161af087408ce91b625e100ba
SHA512 2b070007d4d807cd7ea4000f665ee62b716a41c788639e4af79d3dd197ff9917630234b511a58ce31f48b32c6743cf0109508632b8972aacd753d56362f8ff12
TLSH
T1575101230D7901EAA077A500ABA3C6405BF9DE106186FA0415C8DD427276FCB89FD3FE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1162.TidyNetwork.rul

SHA256 7504ca52a942dcdda99d5cb74356a8962eb921725a723628f0fe3f84de2be524
MD5 fe17d4d9acbce6f9769ba73d06bb122a
SHA1 59d14f6a4dc0c7cba3389aaa6b99459e349f3d0a
SHA512 a1af3331d01948527c6ad736b520122dbaf0cf424bb1972e8780dc47f4329c7614d51b715c92d9d17e23939f7335644b5260974e3a0d864d008567cd692acdfe
TLSH
T11D41CE01BEC5E31A5463A900F348FA285FE54E91D1813CDB4EDE6E0D2675A8A632E3C9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1163.BubbleDock.rul

SHA256 b06491f62883a2e1248e5094596aaa77c3e07ea87939db92584a6d887f55b28c
MD5 bf008d5d7706e8a4ab8b25e4e8b49d07
SHA1 23052a1010f65673c1316cacade9673d1742d558
SHA512 0707c538ed2bfa32370476ed5829cc2af85a8a1ae02145453cddc18f8dd0da287caf96a0eead5e5aa4e8946f670df4fd528bf5fa9f94cc45552375f876867616
SSDEEP 384:Y/PNAQrADqEXtzlMMz6usyBMz6u5xaxpwuYkkuF:kQ1lMMz6usyBMz6u5xaxpwuH
TLSH
T1C003E196ADB7F963395F544AF2C0E6710AD10EC090842A961FBC1DDB033CAA97645FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1164.RecordChecker.rul

SHA256 7750dbee6812d928f8711298f0bd98b3729c067b3fbbc320a1131e1c50b26649
MD5 0a459b10556c49f797d8004cc7e3dbf9
SHA1 2bfc63d92a825befe741c2050ee0d0508160e70c
SHA512 cc5cbf2ca518f43cd3bdb415da6b8d7ba8d8f2b14ca564264257e681d5d5fc40fc2c4764f30aaf8eaa6aa2e72a43522cba7b574c729c74757032496b185de216
TLSH
T17651CD221C7A820A15B3D4000F84E945ABFCCF10A2C7FD0609DCF5822626DD75AEA3BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1165.SavingsScout.rul

SHA256 6f3d86fe7777f6b5a02bfce5c7b6d73b9d9d96b21db2414d32aa84e25cfbad5c
MD5 fb9d4dca50be75474b0a021220433797
SHA1 4558d54db0aa1cc55e534aaead2e008e26f58e45
SHA512 a20d84fb4b63866b576ede92923578f50230a85ac01763adcad2268218263f5862fade612d0345b3dba9e96eb4d24b3735db12012e3430c1b549c7f9f88af4ce
SSDEEP 96:3zcJzOZrToWTr1BDXC16wluOVsTzlwoQrzuc5mvE5N6VOlxk0N/SkB2dgPqea/hU:DcJIFHwzcSzA6zQQFdv+xrdpeh
TLSH
T19E325802FDC6C71244A28608F684E68C6FF69761F1C0B8C907FDB90AA2655975B723DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1166.SpyAlert.rul

SHA256 0ee78690c604716971e0aaeff99278dadbad1c5aefc7a95c39b8a3f9c544bbbb
MD5 21a7f1f2575a06978a79c55cff4c901d
SHA1 955993971fb43bc2917a58cbe2766389363956cf
SHA512 994d4c11403d5a88f302302604d4c108746e09a782929687ca84bd2fcab662eb214d3a668b6b88d02df79f8cae0c4cd0f02d188ea15ce95f8a81f21c22cbc017
TLSH
T1A651CF221C7A860A06B3D4000F88E541BBFDCF1061C3FD4519CCE1822226ED75BD93BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1167.KingTranslate.rul

SHA256 8f12535c46b026066e3d34600f1740780fa8cf00a3efa4791d53e4288476efb6
MD5 ac50d94eb687367b05673d243aba9f90
SHA1 b430ef4042c145cf85c05949636ceeda15f12865
SHA512 f649dcee0c98182204e2bc2949d4ff1eb0d71e537a68eac8bda1c6e0e6215cc82d9e631fa1f357097427af9d2c65e3fcb5b794aae1e51e6ee55ef303f5c8ff05
SSDEEP 768:UCn+E6oTM0o6ElnlmHEU7V5SRq0gUqp6eUiQUmTTefc8w:UCn+EKFllZFdqpLrQUM
TLSH
T19D532A618D34401BA1B376040BA6EE262BFDDB6572D3DB4411D9E4A523329CBD8DC2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1168.LessTabs.rul

SHA256 0d002e9308138480c76b8975dabd46c1454153abab83005375e38bbbd1e327ac
MD5 8f8a6039bb8afc8612b9271870184c3f
SHA1 b1b7a94f75bb284690b2aad5e2d6ccf35d0da8a6
SHA512 cc83d936040f9b840e86891b60c0949d2eedd4fbbfc763af85e6bc4322929b103e542c2396a5d699dbae852b2e61f7c7d2ebde08f982d53a2caec5f71dc0536f
TLSH
T15D41DD015E79418766B774011B63C6052BF5CE313186EF0806CAEA566237FDB50BE3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1169.LoadTubes.rul

SHA256 a1b842cc50b8ecbf87b350413064920b7483e17344189c5e50fd7948945bee6f
MD5 5bdf41a2df21a9ab7dc3b74cf8685902
SHA1 830dd5468ca6ca8906c0b6c44a8ecf64bf50b5ab
SHA512 c5f0bbf2b5c0573c6fd022efbeded91987960a1693264b8cba47a6672dd0eee49903083293dc2fc145d62a0628ce672caab617959136446cc928139701a65f37
TLSH
T150016B1639A8CA160C22688CF309F6607BE3830200D1F2820BECDF1DA676A85415D6E9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1170.Alawar_Ask_brch.rul

SHA256 f42c2805498cc1b6b087539fc56e6221b1df19b3a607c982d566b326433450a4
MD5 27ec0e33c73e1f87067fdda5d7284c08
SHA1 66193592592ee4ce3d631eaccefe179de78f2fb9
SHA512 ca8f18f1089d305f7fd706461931349f6b922d2af7a314bbcad59851d629d6ae20ba3ca3cdf7db0fa7a52d358df00400e173ffa501708782cd1dda67e6679e13
SSDEEP 96:yjJRIfK7K7y727x7s7uJVKEyd5tWx9F90MXTCDouTXzX/XWX4XpAXW20171OBwQn:yjJO9kEP893q03mtmpu2i
TLSH
T13482701B2FCAF2FF02A68080F385D95ECAD0891D65F4B8162F4E9D5617BD8102392B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1172.AskPartnerNetwork.rul

SHA256 39df8ded44f565d8e32e7ad896e2f38ae5cdfc5a4a402f0fe2c555d1f565e07e
MD5 e0047c313d2bf601681ce5cca7fcac4f
SHA1 f583293e58b2b574513466127529db999b6437d1
SHA512 1e1c5d3a6508a364fdf0452dd682c83ec6f876a2a8e99b51d62f6ab3347df48f739479aabc4b988dd457f6014c41bcd2ade98280ed05d916a7600fc029c5d0e1
SSDEEP 384:eb1MhHyvNn+AzJ3A0weR6iYlSoy//og9nG9:g0MNF3CeWTy/Qg9nu
TLSH
T1A5233F1348A9806755B6A4881B95FE001FFCC75865CBBEA90FDA7C5E136CDC631283AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1175.SySaver.rul

SHA256 5daf3f5548de684b3c691b7808f9588a9dffd1dedbf1a5ad3c942c62a00b6ad1
MD5 e7a42f2f6f8a8ce32e8a347f8cd72459
SHA1 c5b46745fff61f7a96afac5c32d65cf1b299c560
SHA512 4f65c84b1200d10baee5e2e6039bbef56d036a7f3e5353939c51cfc45dc865604905b1c19da55a6ba3e4ad3b30591fd43169a81c0ccb0fb1916fe84d0f31f5dc
SSDEEP 96:33ydBbMk1MEQMegtIan8IacTr1R1sVW2vGuMWg0tFVA/EX430baghVw:C
TLSH
T18002463305CC8A670EAFE9CCF515E976E7E1066894A4B84C45CD4D9BE0B5B8C23786F8
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1176.AutoLyrics.rul

SHA256 9c731cd2a2e25672d69c76a86ce9f0a0c75d2407796e40baf6d721ef16b3ccee
MD5 160e487ba9d6a088da193f65d96213a1
SHA1 10e2e04c691ec44e765deeaab356511d527520ed
SHA512 fb0a200b7873b20c9e9fd234f8e81c089b2ea1f99106e226168de8680e8429cf22dd5462e7c81458dfdb55685ca74f994e2a9ef6f63422ac534c8adc8e860de5
SSDEEP 192:eK5f8u8F8ISbSRSeS6SNSSSFjSFRSwSgSUStSjSGKSoG:eK5f83dSbSRSeS6SNSSSFjSFRSwSgSUJ
TLSH
T10602BE06FED7871904B38894F640EA5CEBF55E509281F8C006FCEA4A6339A835B747ED
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1178.IminentToolbar.rul

SHA256 6b4df0a62d5a4427d7e3d5816e77305155a2f2b8d2622fe87ccb35447123947b
MD5 3bf7b2645fb7a27f25a03cf4c4fafe0c
SHA1 15e6f03e8eab824d028c90cc58cdf2af4170b6e7
SHA512 dfb69d68cabe908fcc8d637c2d12dcb57a5eec961bff43415ca86d0edfdc5155af23030d056c3ecf51eb34ebf2ab0267ace23881934dfb154003cf2a75133e06
SSDEEP 384:Hvgwl+A8npwf2r2kRAaak2/7csx6g5PWy:rl+AgdAaakK7csxN
TLSH
T1F1239DA24C32416A51F775040BA6EA146BF8D72561C3EB4401E8F5932376ECB99EC3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1178.iminettoolbar.rul

SHA256 6b4df0a62d5a4427d7e3d5816e77305155a2f2b8d2622fe87ccb35447123947b
MD5 3bf7b2645fb7a27f25a03cf4c4fafe0c
SHA1 15e6f03e8eab824d028c90cc58cdf2af4170b6e7
SHA512 dfb69d68cabe908fcc8d637c2d12dcb57a5eec961bff43415ca86d0edfdc5155af23030d056c3ecf51eb34ebf2ab0267ace23881934dfb154003cf2a75133e06
SSDEEP 384:Hvgwl+A8npwf2r2kRAaak2/7csx6g5PWy:rl+AgdAaakK7csxN
TLSH
T1F1239DA24C32416A51F775040BA6EA146BF8D72561C3EB4401E8F5932376ECB99EC3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1179.FilesFrogUpdateChecker.rul

SHA256 fa211549231c9da9f597df9b8d2103c6ab3e9c708d6a011e20f284e614cae671
MD5 0c57ddaa004ae25ae806f114a572b373
SHA1 6d6929247c2acfc45e0e51d17e30a2704a867dc6
SHA512 04619e9bcd7e3b547c4a54465c390cbcb72208cb50597237e5380d82922812e3a8cf9f17c2fe4d75de2c7223db55f4dded3f8b459c537aad9949294929afda3a
TLSH
T175016821AC62C358997325049701EA302FF89756C146BAE922DCE14396268C7CB7D3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1180.TNT2-ide.rul

SHA256 5a82241fd38c118dfa94261dae870e77389b955e464fd5ed0bee4cd37e1b3a46
MD5 31f9440da4749d59ae0dde156e0e4d66
SHA1 5c27a24aafedad429441217d9dcc1c01272b4253
SHA512 a52b4c69dc3ed6e1f8d1bdbdffa0ab4b6c021b0d2714cc41b6b6074341946cbaa4b7f257b5872da8989bfddd3555f979d4e59d3de61a60ac2255e6bd73910d91
SSDEEP 96:3NN7sQsSQoZsB/mi530d6cgsUd2nisUQsUHeC/izKlIGPELlDWnNWkNYkNRG+EPU:9GxSJZsBei532tDEATJtvJIQx
TLSH
T167B1C300BD82C3660FB76A44E24AF6A91FD65654C281FCCD27AC614610798CB9B653EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1181.Highlightly.rul

SHA256 897f33804aee16397bab15cc3c6d4705b2311b2f5de65b0779ec7317f0f6497a
MD5 c652f3b7d5ff9df95ef6ba2c1da1d11e
SHA1 4a49097e33dfd273fbefd928da45519387a70185
SHA512 9468c0d1c76867b294297a7743e3a3880fbce86dfffe0cce11281e470a58184ad5e62a937169132b313008b0c4526e5679b9a834a997ea48c50271fe2707b69e
TLSH
T1CB51AE114E2601AA557765411B92D9425BFDDFA2618AEA0400CC9D06B1B2FCBC5FE3FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1183.SuperfishWindowShopper.rul

SHA256 0bd41828fabce44598e07abf365bcea59eaa94088aed43060667745eed089d07
MD5 cb2242c14c66e6e92afcb141ed3f60e3
SHA1 afeb3d220edafe4de3bc31a446eaafe719eecc73
SHA512 5a236ad5de7e4120e77d549e38fbc8e386546ed47e00efaa60298bf513e45865d5f07b2481629cc5398f38a5951e2e162e72c912399c9dcb40ad49669291cffd
SSDEEP 96:5pSVVbYDAH/V3VcVvVUVLNzJQ9xj+Wl6ro4Abayh737SnxVk:rSfbYDAH/FiZOhozjwk
TLSH
T1B4917A516834002AA97379080B65DA107FF8D724B287FB5910DDE94A63B6DCB46EC3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1185.InstantSavingsApp.rul

SHA256 497bb144e9284ad89f48cf24e93cafc53547fbe8faed056f718e1daad94d4530
MD5 9fa64da1fdb9dd3e4a020da8ddb1eff5
SHA1 6a71b10269f02c60f3b26715e74802e036da4560
SHA512 dd9b10fb9d3cc03cec97265fd80442000c86372d486c393960e9d27bc188a383196dafc8c439d29e5394e14bfdff32d735ad6586178cea0ab6f65e2de0c1a7f3
SSDEEP 96:sddk5rOOMLWrCvH9waAvMa7sEtKSfeM0k5CXXexhCr4IlZas7swM9hbgmwHOB5HU:yClu9wauMyLBmgYX
TLSH
T174423802FF96C30508664108A749FA185BF647B1A181B8C903FE785AE3697D76BA13DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1187.Strongvault.rul

SHA256 f6fdae067015bd2adcc2b47be8eed78f54a3cb424d7a701aa16dd41968692cb4
MD5 a62a6a7d7c860023e7dccd3a185b835a
SHA1 ea40a0beb4cb96f98581324a51e6595618ddf882
SHA512 ecb4d17c8974669f2f4b7876a6c5b5c6319f69e2d74287a1e2ff44f7d6ad63217cc6fdeac74367aee1ec446542aaf6489887055d245f63ff6c0c624996c4b747
SSDEEP 768:ec27kw1isWwjIRiB7ERReVFEP6PUH8/T1KUD1+RS3/uIFYtxw8zWuTwtSdgDy:ec27kSisTjIRiBYRReVFEPO1FI8nw
TLSH
T1BF837D514C31406A56B329040BB2EB212BFDDA6572C3DF1811D9F6962336DDB98EC3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1188.InfoAtoms.rul

SHA256 228e59b679f3dd7950fde9b82047ac7b1b6f5d11b9a56e93582d0095327ee07f
MD5 e815a66148bee803ccb7bb22506f2bd0
SHA1 078997e704166f91e563c2b7d629336fb0f23367
SHA512 a5d7a952f94dbf5a6130613a5f85d8633b766af0dce50ab9c80008b5b435e78fe89d712a94b450f885d4b6b14a3a09ce0dc30ddb41a05ee6ef4840d75082250c
TLSH
T15C418B114934925BA477FA406B528D012FFDCB61A582EB001ADCA9225237FDF46BC3FD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1189.JollyWallet.rul

SHA256 69f9ad3283d6e46f995b60c3e07e96c8c664360c949f32e0f1007d0219c09a8f
MD5 9eff23f44cd5dffa08bcd567443a70c0
SHA1 b07a792a159ccb33e60983723cd488fc0b8862ae
SHA512 964a8ce24b67d4cd833a8988b256f6f4a7193995789644ef5db143ae00462d8024deeb237f6f3ea279dd79540acc8df46e2541e0879fba2ba5607fe80d9edc14
SSDEEP 96:no+0yjdz9/8buAAG5UM1+wcADvkGYtC7f6AtSr5EQlt7twM+Oy1jqAX9IkYDiIyc:nNG5Um+ZtpBUt4aHmSQZDCq+pOUwD
TLSH
T1DD22D002AF96C31905B34555F745EEA46BF48B1060C2F8C667FCAD45A336A8B4F243EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1195.WProtectManager.rul

SHA256 202bb44085528cc5ebaeaeabcbe07f09ed486e5e6b7076dec63ac836643451d0
MD5 e38738bdd7826d4403a2b83f694ff12d
SHA1 e3757fefbf6067351e05d023f7327d7bc115573f
SHA512 5cf47030ff6e2d7d29120c83c0464125c9e576202c4846b39d73b769a615a66c7365550474f352084abfc84b73ee3e60c972dd41c0ffa5211b3d947a92b1b7a1
MD5 SHA1 SHA512

Plugins/Plugin.Cleaner/Rules/1196.V9Toolbar.rul

SHA256 202bb44085528cc5ebaeaeabcbe07f09ed486e5e6b7076dec63ac836643451d0
MD5 e38738bdd7826d4403a2b83f694ff12d
SHA1 e3757fefbf6067351e05d023f7327d7bc115573f
SHA512 5cf47030ff6e2d7d29120c83c0464125c9e576202c4846b39d73b769a615a66c7365550474f352084abfc84b73ee3e60c972dd41c0ffa5211b3d947a92b1b7a1
MD5 SHA1 SHA512

Plugins/Plugin.Cleaner/Rules/1197.Desk365.rul

SHA256 202bb44085528cc5ebaeaeabcbe07f09ed486e5e6b7076dec63ac836643451d0
MD5 e38738bdd7826d4403a2b83f694ff12d
SHA1 e3757fefbf6067351e05d023f7327d7bc115573f
SHA512 5cf47030ff6e2d7d29120c83c0464125c9e576202c4846b39d73b769a615a66c7365550474f352084abfc84b73ee3e60c972dd41c0ffa5211b3d947a92b1b7a1
MD5 SHA1 SHA512

Plugins/Plugin.Cleaner/Rules/1198.SaveClicker.rul

SHA256 f00cc01981b08636026683d361d79490c62db6c0bfa69cfcd59358a853b7922a
MD5 e970a812754906fbefa740c28603ed38
SHA1 164c487236694268b85e54fa6472415717498d83
SHA512 60d94b47b1ca62cc4c83375cb8e7f4174cddd2ba53ed3f068701ddc9c62c4f65623deb12de8e337ca0b76512f5b6b2fc5c3bcd9fe4e536351933a02a935b97ae
TLSH
T189512A965D7505094533A5080FA1F6506BF6FA217383EA6904E8F242633EECB49ED37E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1199.freevenpro.rul

SHA256 88aec4897eae3b0277be2aa6e38939d6a848b018592cf6be1f2db2f7ba34cdc1
MD5 a1ee51b4c8eafd1c4be82149aa1970ff
SHA1 4cafa70104de75abaa6536cea12fa6dd3e38a030
SHA512 6268c0a3c633f7ec439b91e4744500af87aa496dde69b973985267271db573c129a14a10258fa411b9dc9ac7bab3ca7ec7a3e417bc2c8856b7f186117ab31f0c
SSDEEP 96:pDe1N3k6xumVoaHSd0ckcA1wncN7yYbI6V6T6G6C6n6v76vwM6g6E6Y6j6J6z9IZ:pDgoKEENLQ+vD6v2v0xd5usYrBMr+/
TLSH
T15F32D021EECA932114738484FB55E5882FFA87D450EAFCC646FCB8C75229A935B243DD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1200.shopperpro.rul

SHA256 a09d85e1b6495f4e827fa2ac1f5b9a6249db15299ff3a63d39b88aff268610fc
MD5 12a68fadae41ff7f14e1acedf15a7f31
SHA1 4a4046f4c37d6c1f59ceb6801000aebab119e766
SHA512 3054742bdadfc5a0ad9bb804a6c447587ecc636d10338dc5e0cf33814f0de28c644da0d8c2a5ed14063ab4b04d33abfe9245bd126771a0cd4a92572e6448bf37
TLSH
T1B03190125C39112A59B3D6040BD6DA002BFAD79161D3EB042ADED3522371EDB56EC3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1202.hqvideo.rul

SHA256 78245fa3b7f9e78bdc764ee41e76162b0ce1321a18d1d94d9d5cb9085f3399cb
MD5 d83a228cd36ad1c03bf1845746580226
SHA1 a6e4c7da318a3bd922944fee83a82a00c7fd83fe
SHA512 0ef1419120ced15e99a8d685ce15987089c2d0b6675b7503bed71d4dea641ccd726b9018dfc6eec3839f73e5568286c838ca6cba281fff5df05a755a56029aac
TLSH
T1E331F9115AB0086593F365311F76EA0D3BF4AB252463DB2600D5E5493232DEFADAC2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1204.flvplayer.rul

SHA256 f082793a7ab4bfbb41557c9e52ad4e73c86c3ddf619f6a2b604baf3d72f2e4d0
MD5 36e7c1e1a10715e9a0afa82b510bc05d
SHA1 4b531b026be4122f5de7900e707738851ada50fd
SHA512 f100409fd5b3ff0a36f360989e67596a91230cfece19b9c5f6b205631792ad29f8f16c116e8577f02f0beba2636d8c51d37466b0de7c5c946ed7241538ceec8e
SSDEEP 384:ugBbuQcQaQNQRQ2Qn6QnIQ3QTQfQKQoQoy:u+uQcQaQNQRQ2Q6QIQ3QTQfQKQoQp
TLSH
T1FC62BF82BE8A83410E729140FA7BD6083FF1CB905941F8C55AFCF988617AD975B263DD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1205.hdtotals.rul

SHA256 71de28b61531cc1b7c8d56dd772027ce1320fa225f854bd6aef96e6452507112
MD5 a38e90d4fee1f459eb54363d323247e8
SHA1 60d9cb5efa825ee77c2f7c4f19856cddc854b434
SHA512 efc495fa271e83dbdd3e2536196c5147af65446894f420d31c830385f835cb411a83649f40a7b88a72c124175c02b1ee8ceaee9ee082197865f4f926f2084476
SSDEEP 96:i9I1UsVvViVzVyVYV0oC5lzVPAu748zJN+cZ+O1RqRuRPRG733cPX/CHOckcAdJW:EV0e8zjjXqQkN1z54cL
TLSH
T192520F11FF83C25149734801A614E949AFF69BD2A144FAC446FCFD61332AA935B393EE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1206.easydeals.rul

SHA256 4f543c1379785987c10681dbc8212cae91bc585bc90d4abb6fd6d0e2eab683d5
MD5 e9c73802f8adc57d87d664f3c73f627f
SHA1 4a84ae82abd5126412a69a6d8c9c5b8db9b91aba
SHA512 c92677bb8751e8196567d48639bbfb9d3f7bdb487d9d1ed834be5402fce9738d12784b77d60eb281bef6a35bf95833b85c2f424a4f4515bb3db33350df68d96b
SSDEEP 96:7LZ2zv1jelzVilWqu+l/89NFvZF10RBRVRaRNWCtduqopIRckcAdKWVlvYIoX6nx:5Wl8v4qOwcC6t5QSdSX997eImJb+PZV
TLSH
T1A6528B02BF9386190563E068E348E50A6FF4EAA06246FCC487EDB94277364D78B653CD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1207.hdshop.rul

SHA256 a90c8360d47b32367df1c0dd6ac05282debbcdb968909f3079acc3c41947bcf8
MD5 3930b0f1952be1e54df7492eba481f30
SHA1 424849dc8497cefa83ebff90bea4bdbfe2998e95
SHA512 65bd1af27433b00895d513aa8bd527d3adb733a42c42a8812e3aa5b0898f35c24e6da2e04ce6796bf4ee024b694d7fc210fd03c5c342be97948299b4807e5f6f
SSDEEP 96:Om6kQCktGuhk89TNioZiyFReRSR3RajvD8roJ36bU1ckcAKdmPp8BQLa75c/1/zc:OmR8roJqQNHL4ZV
TLSH
T1E152AE86BD87C3410473C604E609F948AFF58F519341FCCA06BCBF4192269936FA63AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1208.plushd.rul

SHA256 90a3abdc078ff8d7ef1c19ca53ffba3abe85ddc0e271b5cb4ae7d59994175bec
MD5 ea2910a04577636029f15b89412091a4
SHA1 20d78f1afd3137bf4b1dcbd7796227afd8515925
SHA512 d0f4a3a8f321875b2f97358a2ef5bcca7a0af6d6cac6096c8f23d57b01823bda76f4501b57e2bd9a806899b56470ee56048dbede39b83b333be5612264a33a29
SSDEEP 96:7g9mwfb3rJ5s+tmmMlzVigrWgrjckcAbgCJgCQOWUPB5BPB6B+B7B2Bj7BjwMBnp:M9lfb3FuPBc327pwc90j9jDB/jj
TLSH
T174E143036FA28B5E41739424BB52E61C0BFDC91254D2F58267ECDE06237AEC366543ED
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1209.Torntv.rul

SHA256 8986bfa4922a84a531d2f863f378c72ac305883223129b5206c2c7ff015f0371
MD5 bf69987306867166bea443527e812bfa
SHA1 6c0a83c88a41351bfaa9822baaa072621449888a
SHA512 3fa118cd9814a5b462417c93085575d2b9edb3ab3c5669ad320d95c21e76720ad8d530368b397397233d53857d51dceaaa45e2dcb70407d44c3d522cd2c7433e
SSDEEP 96:tmwkAsr12brkSxu2o81ckcABvKNFYAsCY2bCi6kINegZeurRqRORJR2lhVm91UjW:tmGbQ8AX5MJajG5WiBVWmbO45
TLSH
T12E52BA42FE9B871610629105E327E68C2FF6DA506845FCC446FCBA88323599F8F353AD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1211.surfandkeep.rul

SHA256 cfe90842cf31bc8c82cb9fa7ae1d9ea382498f827afabfecc98c5f35631f22ba
MD5 a59a23291acde0c199e51dbb765f1be1
SHA1 d245e24170bd17f0ff48552e2ce5f5d6b022574e
SHA512 07792005ad8c22abe731280a0b246e4573f1d3fb8ddf1a2ee669c0652ef751eb9d1830e8646141e8501dfc0b41b978c10f1249b60e34748be64352b62bc33d43
SSDEEP 96:DGcFuTWaUkpqR7MufycyGDaaa52VzwhcHc/9Q8JKLKX+v8a+e+u2r:KcFuTWaUkpqvm2Vv8kWc8mn2r
TLSH
T18491D2125C26412A9877B5044B91C9605BFD8E65A3C7FE4501CCB8422336EDF6DBC3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1212.freeven.rul

SHA256 66e8f4277168ac35951a3dd2a5c7e5ad95f603223fa048459dbf6bf740982cde
MD5 4c74f51abe1e8f4e0799b935e0e3e2d0
SHA1 85b0a39073e24d76eb1cd2ed1094e6b61e1e4a97
SHA512 3768a35bad9f2181ec7e16628b039b8633b521dd845cc0ea4b698a55cf6c0ab87e707539e50486300e79b0fab9b798ded48fc8d5160f6a60864d76a7c2f79341
SSDEEP 96:TveqlrlzKhwnuUJ8pNfNZfvMRLRPRORX6mBV+hfkXcTM5ckcAdzlCRhFkCIcAgdU:TvLT8DOhfWCMNiIdToYz
TLSH
T1CB52B902FECB83090CB35980B355E5496FF58B515192F8C806FDBA81167AA9F4F693CE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1213.ZenDeals.rul

SHA256 332223f60196f1d050b3abf5a7331f836ded96319bfcdf35cee983347eb4f706
MD5 7aad985ea0776ed4630b49a9129ee9f3
SHA1 a00028d38ed9460d657734938be1689e874845c2
SHA512 330f456d22edd62bbaa90202f24d9964cf949b0d0c25041ca78239cdf3e9856a69f4dc93cefa0f17d06c7ce97599d10fcf97b1ca876e6be989a9f4522bf104c8
TLSH
T1CA51ED51F996C281A97325005382AE142FB54727D184FEC56F8C6B05A06FDCAEB392DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1214.CouponServer.rul

SHA256 612cd51227869a96c2d4e437d0a1b56ce6b1879ef2c48ef99968c08343fc147f
MD5 1611b64797ff110884f7e69cf85c080e
SHA1 047b8fc801f3db942ede64b3d023653d5c26872d
SHA512 8c0156d60415aae5b4ef126fc3b60f42d9dd93ae3c18b01f4912e693b5bf85fa425d845b096bea57dfcdb409ec5b1a8f67aa7d2bd8ee1516c13f0163fa0bb307
SSDEEP 192:yb7fNNzZXtkfm1ca9wq0SkIi/LG/K/k9hFSMqJ:o3Qeca4hJ
TLSH
T16E529B05FE83C75508624548F685FA082BFB47B4E1C0BCCA47EC784A23E599B9B653DE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1216.BuzzSearch.rul

SHA256 08d3413e2be991589cbc41a1ad6c851271b4504114fc49a9f8939d14a9a295bf
MD5 ebe0005ea28d9814a3e83afe59bdcd36
SHA1 cd1d54993d2e84d42bde6010b3cf2ea353436192
SHA512 4586115f219bf9af0564024a32a570e5426feba928745db6249216b5f5bb76953bf1ec917cc59e6fb986cc9c34f8b511f48e2891df2d1dd87ebd71073ba68b32
TLSH
T1AB3149129DB2812A597358044798D6812FF9DA619243EE8401D8F542A377DCF8EFC3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1217.CouponSamurai.rul

SHA256 22c71ff75c1f0d1db5918b19a89044a831b74f0d3abc377821bf1f90e0ac9387
MD5 9cfc399fc7fc61364b22036382cd4e59
SHA1 5d044e824849aeccc6f8875ff8cf30153993b971
SHA512 161cf2809eceec12dc6fff1f3b20f23a73b3168314165c70d4feb4e0cf5170b45c13cd065525e8a501f4e9646e36b902d58ff5dad7a0dfd625d833c169e77e88
SSDEEP 96:ILuTjojZBHrLC6PlzyB/ujYiGRgn+5wXEtKSfeJ0nPDbojZUHCLL6GBAtmuz/IKV:In/HrNqg+5wKMiqUee8b8
TLSH
T1D3423701FE97C7124C628528F688EE086BF65BB0D580BCC506ECB94D63A54DB9F613DE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1218.ExcellentCoupons.rul

SHA256 748c80a4cef49f493dd2c61803970d732b935689b4a6b4ef77cbcebd935590ef
MD5 def69e8978aa3287764676c7de31bc31
SHA1 fe9249d593a62cac3f672d81718a985e5f451cca
SHA512 550c85f6b28e93de501c43a7acfcd4e2e61b21b15355c4c018b001a88abb4003932a82b14bcbf6b8faae0d77636bffccb25325ae15de8072ffb50178dde5914d
SSDEEP 96:NLDuMyW+PEsFrlzyByoJwhl3kCTvEtKSfeJsPDb/HGEsFCcxMBHS2Dr7rwM0gEfy:NOYwhpkC0qQ/ipmh
TLSH
T11E62D007FEE7D72614768188B281EB586BE647A0D184FCC707DCB94A635948B5B203EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1219.ScorpionSaver.rul

SHA256 70b8b5971c7446b83357948d9815cf8c1151749845210c8ddf563aadee48dd2b
MD5 41090a2dd81a0ebbae8c1676af211926
SHA1 00a033e262fe4eed593d31b609cf8c19b7cd4104
SHA512 e0dc4f5b502df83c288bbc8abc8e216dd1292729a884218adfbc69bd4ee3f26972b34f995078b5248e64a8968877d4942f983b136ad91fd9d903ce1fb2fcfe83
SSDEEP 96:ALzyIUjL6Zp2UYrNtZjcYcTUx61MTeA7wlxHjpTLiQOosOPrV+M1dMlxa+nAnNnL:XOAfq3
TLSH
T1E902EF920EA8C53395737548679AEE2057F8AB5471C27B0506CCFC6E33356C6A4983FE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1220.WonderBrowse.rul

SHA256 9a3ad1d9adfcf3c1bac2d9b892bdba342014b0725850d99e43f56d12c9f12332
MD5 76c631a0af554e5bcf342576f9ebc87a
SHA1 d97fed70633a35a2d64b54f7951df31bbbf38d91
SHA512 4fe012e563b2b6575ad5f3fd936308efbcc184b6cbe9fd8abccf8b1d9b39e4d07c39f32e3ecd662d0bedc1b33947719bea3114cf9b26db89d484e5f937ee1d44
TLSH
T18D4112526EF190271D7391005A82DE007FF6CE5460C7EE8506C9A407572BDDB866C3AD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1224.Monetomi.rul

SHA256 88c43967b441edfcb4498286c6f13f4eedcb5183aae8f7eb76e46457d2cc7f1e
MD5 eac11876886d5f3540faaccf4e457e78
SHA1 26ca1b6a58e47f4be72eab1db73f1e6ac59f02e7
SHA512 58e739806bd9634bd297fdc55f28651742a9db23ef55682cce200520f7c24e2e0fbe8a9d012cd59ecf305339970ed93418ba4d3bf1ac457553f7dedb806d5bee
TLSH
T119412E021E7646468A3365006B54EB006BFADB446183FF8419DCF6026236ED38BBC3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1226.quiknowledge.rul

SHA256 823bc1beccde7a871435e7f00ee66e932287ee3f7ef31eb0029f3e2137a94d46
MD5 e5660559a9151a193eca6f5c8c47e2b0
SHA1 8a8613b079657cc211e84d11e0f59b3a64e46cbb
SHA512 c63d6e784f164494d4d2e3eaec1af7b4d620b1287ea914a670419278278a02c6e77f9d1081b25327f911aef5c2132fea28e160a0670345745363c8764a0b5f57
TLSH
T18B417C304C74015498B335001B66D4402FF4DB66718AEA4C15C8A98AA17FECF86FE3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1227.radsteroids.rul

SHA256 b9935c6f40fab9176b75581974abe644e155af24ba3dd0d5c5c94d0b7d6832ba
MD5 b5053712b05e41dc2652d62cf8ae7b95
SHA1 71752547c6256f477266a259008b915c2b860a21
SHA512 9f1baa79c8d567fdb7498e3c421aea1b74c9dd73ce8fac7f0f325d5aa21808dec4bd644b52c279b6661625c8b926d8bbf8ad3209cb793312d123487145544ad3
TLSH
T1D3218E25DD7642746C7331000BA1E440277DDF9A9147FE4445D968827263DE78AFF2AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1228.couponclipster.rul

SHA256 444618b76a90fdaa2f2d696373948f6c9d34aa29c501141e694b7656b37907bd
MD5 73c529a843fd8c55d6c868f29833b139
SHA1 1b40d1c2ec00cc51949b3996c13362cb80f8a468
SHA512 dede8a2b4ce0ef8019196dbbbd36adb28dffc0722ea413cbacdb7eaaa6b4b1b7f4d688b2e685232298cadfa7b4108d82b3bfc79833af21ec5e8a8c8b1b254c6e
TLSH
T14671AA51AC218415967300370FA2EB0C3FBC9621B543EA1954D8E683B237CEB4BAC39F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1231.babylon.rul

SHA256 1fa009efca67d5be839f339b458af953d831b1490cf2f2fa8c8f33d9c4074517
MD5 56c5426f4b7d45f466f6354f325dc7df
SHA1 a61b1d61040df055839701d75e941e72ff9b4c39
SHA512 c26100e7a154e8724f5017e6a51d3b2db0f56b1093657a6d5c4ae510a3416bae7e1ce941c59952cbebd6210f20c31445c4ae354dc4e5e57358333979c838b127
SSDEEP 96:34aB33LmcGh+4BTMVyh+hKs2mN+eQ9ML80Aj231LhRIeM1rumwJL+pyU2AZ6Rmp7:kxJChKsY9w8k/Yu46IF2fGBfl6k0G
TLSH
T12D327A515C7645699A7319044BA5E7102BF8CB64A183EE0C09ECE2477337DDB8AEC3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1232.555.in.th.rul

SHA256 3de9688a3a0f8a1a3cadef2bb186c93018f7416a9dc1dda56981f16007e2200a
MD5 41e6a07da66e0c7ae22c6a25362cef0b
SHA1 ea72e3b0419018b9873fc6d2964941925c42f41a
SHA512 b810b5714ecb55f748d418ba98444f39e0b69725dbfd9d4ff0b92cf7ce7f309352df6d366b3a61f5ec5449262608f32e286b40293868278b9e5f4d5c0aa939b5
TLSH
T173F0C022BDBBC137947314446700FA142B909A418044FDC73A4C1F0562AA5479B386EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1236.utorrentcontrol_v2.rul

SHA256 90b9388ebf627aa8548fc541857b7d7a30284a703ccb4e049cfb530eb36dae39
MD5 b98c5c9e8e51da2bcbd3ff546361eaa6
SHA1 a0664568ea3c31321eca90475d8ed1f21feb2b6c
SHA512 4a0a2a04fc3bfdc3adaff420714a2f6152eb61b5a475013f7fe5f615f482a2a9adf0668f2a90c6fd1f71433a33baf3a368ab8c6204c52e3d1cb28b7e4dc98ff5
TLSH
T1B751BC40FDA68226E93325044786EA002F658792D081FED5ADDD974091ABAD7CB3A3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1237.utorrentcontrol.rul

SHA256 6d27b1fd3ab5046f414ce6598aa51a5dec9c70a6a8906da60097ecdfa12e4ae8
MD5 fd37ce50989c68305bb005db9b3768be
SHA1 59545d5059e556604ac5aa4d627eb049f01b7127
SHA512 770520fae357452c650fb926cedd7bd104f6ee09d8f5cf943f559b3ab09c5b7db9be108c561cf46f830e12e788692082ce97bd9de7ca3e12d609d79ef47818ef
TLSH
T1C9419B60F9688195B67327004386EA142FB993A3D082FE9169D86602746F8CBC7682DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1238.crawler.rul

SHA256 eeedd9dd02374b18f488f7186dddb32a4d28d46043484a1f843e0172b124bd43
MD5 1de3c8da6cd7c63210e9c19038b4496e
SHA1 f05a3ed26dfb9da7a25b021453ce15b7ba854d70
SHA512 5ea88a0b36b312e6e5cea95194590bec51727fea26abe4fc58bf0a5830811740b4d04cd0c2470ef161d15e9cbbbe58c19aa8a67efb373c6917badf927b3a7a22
SSDEEP 96:3inWBJ0BlHu/M6wQqDBrNICxzdyv/dbmQJTx7xGkoN+zICBQ1ICfFLAEWsqAuBCv:ynWBJ0BlO/yB34dxJIwmIu90HB+rBtl
TLSH
T175D1BE615C3444655A7325084B9AEA003FFCCB12A143EF5814D8E2467637EEBCABD3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1239.fileconverter.rul

SHA256 b661138cfb8f354afc1ca0f398ffb5aa4d4f51c40cb612b9dc39b04583511451
MD5 b3d39719048aae57f7162c3e936f9080
SHA1 6e597958f7c82350b0c2ee1b6626f1adae3dfee0
SHA512 97a1a8633ef9121f0f83537ffba15a9b80dfa871527cbf598057e36d7cc477c00b79b1143f25026de7cb94072a038a96a34b47125a1a7414ad61dac10c92cad7
TLSH
T18851CC50ED49C216E9337D045785AA503FA98792C481FED5BE9D2B00902FAD7CB653CF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1240.shares.rul

SHA256 8d768b5d822462aea74d3659c35523a366013ccd00289500878c05ccb35a0487
MD5 8b160a5cfb900600460ef1ea9df9c907
SHA1 00d580442887cd69680f657663af518116ba849e
SHA512 204d99896e8e650cdcd43019a9a1f25346e89f5e28118cee6f5afae9670865644c97f86f4da3d440b27a13a3db4429d6d3445bdcc46d56c3d403cf1e21dfbc11
TLSH
T1F451D084BDA5C255993329140385FA542F5D97A7D0C0FED9AE9C6300201B6CBDBA63EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1241.certified.rul

SHA256 316d9ca9ffcf28ef60777ac8b15c4c082ffcd84a5f43469a0c233c097e28c8f6
MD5 17fe1cbd1aceb927901cae2bfee76c09
SHA1 cfda154a262163bad69da243198e8024b576b00b
SHA512 9dd1ec99a0b464bb4db0592dd8fec36ebc7c04edd5e11a316a963613118115e72abfdf45613543fca2c9d9602d5f273a07d6e9f6690a1d2b4d3416ac8d480673
TLSH
T17B41D000FDA68211A973B6140385A9106F786BA2D041FEC97EDD6341612B9C7CB3A3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1242.utorrentcontrolv6.rul

SHA256 63e37f7af87dfbc097050745fceec1214e699ef63c780b31b742a45d79be71b4
MD5 fc2c6190bc4e90b07b30e961d7ee4f55
SHA1 ec0210538922e9194327cbaead4a60df374a8607
SHA512 8d539e6fec7b4f4b024d6934579589a3c382c1ed7a303d8e6f31c4de41ad037c56261e1818492d971e1abc53c562d35bc07398b38a76f3d8bc72efdfa5a199b7
TLSH
T17A41F100FD648215A973250403C9DB102FA5D396D041FDCA5DED6641A52BEC7E7A93DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1244.systweak.rul

SHA256 6928fbf4e73e4f1bdf027522dacf3e2dede802e0d1153d341c8b79d8c7ee5201
MD5 ce02c72219f6853574f961cb3835df5c
SHA1 1543b3e4eeb8c66bd632993f327e440bd7f6b6ad
SHA512 4938bfa5934ae1ab9fe335ce8a81d7ebce5e459a635fd55a0e00205eeb2740d36f43a1938ce454edcce45c4a0027c6b2b9c0c4e75b5af5ccb62ca040800f109a
TLSH
T1F541DF50F9248124E57379004386AE143BE98797D080FEC56EAC6704BA5FAD7C7693DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1245.winloadnew.rul

SHA256 a44099a894738f882124732c701f0034ac8349c8b9e53cbf915c6c0c0e810654
MD5 22648c430abf7c5990581d4a5e666a9c
SHA1 71850d79d7d665abaf2e4538f4692831e270d2b2
SHA512 b224dfe933e2ef04ee1f39c198f06915bfc3016a0e2fb8cfcadbb320f25b89376c7f30e8acb85cbdac400621eaee588aaf809a3d79b145aeff1a0aff35ecb72b
TLSH
T10941C041FC56C111997B2A540381DE441F9C8FA2D0C4FE886D9D6B05642F9D6CB293DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1246.vuzeremote.rul

SHA256 055f19635f3e8c793eba5682f667032618b4152cc7c54dd0eaec7c6ba58d61af
MD5 cede2849a939bf4e8d8c55fd3adb66f8
SHA1 732ee4c8a0065994f6d56dec9f7722a841dcbc8b
SHA512 da02bd65314441f526c2d8070de9c37fb248994c1b89879d241fbc5a41d802bc43ff16842a64ad19725fe860614fc6a2ffeafc3643b320cb9d39f6e30f448500
TLSH
T140519F90FD658205EAB729194749EA103FB48396C081FED87EADA700611F6C7CB663DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1247.cleaner.rul

SHA256 2c37019da28f4f014a3d1b458986bbb124578c4aa5261d17f94f09a5db972b1a
MD5 ad821621c1c79c02b1eb17eb929ac343
SHA1 31f8d2b7a9a0f63ad55b67e4cecf6754f2823bcf
SHA512 843b1624ee5909cda7f1d217f2219decea9e08a90382cf9ea1cbf3839f447a33d9554c2c2bfeee72b73883899cb78113060d44a76cf3a267e07076b70798766f
TLSH
T16B21F040D869C15469373E0452C0AB002EF88756D4C8EDC5BD485A0A449FBCACB786DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1248.hotspotshieldelite.rul

SHA256 3bee285be257de440197dec63cf7554befb8794dc305e0a8acda9677edd635e0
MD5 68e69ecd1df905608c5fc0a0c89742cc
SHA1 9d9804fe7c6c4765790b86f8d50b487dfef212ef
SHA512 43119f2e7efd27bf7b5c003e8b60eb5c734fd66699618d8e6714d4547c73dbb0cfbb1ba138531f2b9f8d0f80ea5f486d1163c9e5ebd83746399efc1db2d2a371
TLSH
T1C651CC40FE84C25599B325084389EA502FA4C796C081FED9EE8C2300646BEC7DB753EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1249.searchsnacks.rul

SHA256 b9ee847475c1adc80880dc96556b1fb61b2dbf5f0f4b4f768e9b494120dc5e91
MD5 6b81a5294138c3aeefb2ac96ffbc82da
SHA1 c5ee6e84495a1bf161dc87ab64f49185c018dd31
SHA512 fc1db30c7bcc9c05b89cc1d813625d1937cf29dec09ceaf357f2e4889b09845015975687ede89f66dfc852caeba8d3abc5d7811038954bb8cae11c36a8c37022
TLSH
T11D21682189344136A533A50006A9D9002BFDDF667263DB1800CDE193E232FEBC0BC2EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1250.bsplayerb2.rul

SHA256 1130e9860b03d6bf6ce7b5fdcfd7a653e4693bed0645a0a8060cf8894f96c138
MD5 02f6f7359a3bdf3a8406498524765660
SHA1 6b309118627f19a85e4da00dfa1ce84d5862b495
SHA512 51dc478381984ec0335191f48bb5412a32e732196e88a0279012480fc244610d8a37978afaebd0a5e86c4278e983029599aff2655c05b7c9ee9d8a631287af25
TLSH
T172510E90FD59C29299B31A041386ED502FA99362E080FEC9BD9C6745542B9C7CB263EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1251.freeonlineradioplayerrecorderdm.rul

SHA256 063d3b694d09076c5faa31b7b6b5cb9f8dac4a3dabd9f1b2b5bd9d05a49388c8
MD5 337928259f7ae2b8db0c9bdf3a3a3d32
SHA1 225b47d4f3475f360c0ba51156783ca237573aa7
SHA512 9ba95e2b3bf788f89d8ccff26467b5ec3c9bc89b83f8942df08a00a1551635389fc6df44a77906594a29010586f7dd93dbe6ac31c3f58ace08a1af17eb8e27c9
TLSH
T1F4519E00FC95C205A9332E148385AA402FA29393C0C4FDD9BDAD5705945FACBDB653DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1252.2shared.rul

SHA256 7763a0764681c29ac88de66f5dad020109af5e87f570b92c99ad32827ffc0f75
MD5 1374de24286e25fcd400d44a38fc9943
SHA1 27493767889fba4787d077ce48b060b87f7b9212
SHA512 20ab68c61835e27efe579f0286d2a9d2622ad79ff4287b33b6f3678dcc60597156751b423816f980c0ba32fd47d9848db9997d9e53b5338c4c4a6d45d8d84369
TLSH
T1DD51E100FDE98245E53339044789E6503F689B96D081FE956AEC1B40541BAD7CF763DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1253.toggleen.rul

SHA256 890a7ebad40bd29b7dbebefb1e1ad89219262939e625391b86b445445d976ab7
MD5 c551ba75dc7bcd91540b11c8227d150f
SHA1 2704dab1452fd5d1b54b899aabd5761efdfb6926
SHA512 65b8aeb4f69c9e6bedc35fcc20a53295a3e69db324f7d954661f78811e707827656dfa740652aed7e10c3c6453fba567a0609c79c335a59e444629cbfaf4e823
TLSH
T11651C900FE95820AE6732A148385FA002FA98796C081FED9BEDD2700645BDD7C7693DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1254.xfinty.rul

SHA256 e5fd0e22cada52e3f0c1cc43f719c2691a8391b4d3745524d77bc32721efc708
MD5 a42dfee8faa676e1e03b4b1646cacf28
SHA1 5f59b7c353aba4160aa6a17b86a0a11f3d4822b4
SHA512 b11771374745f37ec5c47b004ecd9d1b7c508c27d07526e98c2778811fea3eb94c16c25512fcd2b08351690c26fb75891f23490b146474ac015d39bcd340256c
TLSH
T1FF41AA40ED45C215D873A504438AA9812FA9A392C441FF9AAEDCA740612F9C7CB363EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1255.pupnukeit.rul

SHA256 7071a0ed5cab44c412683181d3ab729e0656bc7c4ead21d1c85c078e0a160970
MD5 2b1a9863ead635b6098b243f852d7340
SHA1 40d59ef3e2f72dfed1ac40d48e1f258214f14378
SHA512 e2b7efaff16c2e4b08c812a18dbaea58415a707a839a7de233c6de30ce73296ca36d88fceb0f8be63b75065e4b93e94b7b47005e68bfd94f065b721293b3cbed
TLSH
T17C51F041EE918215B9B32D040786F9502FA99392D081FE95BDEC5740641BDC7CBBA3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1256.flashenhancer.rul

SHA256 33afd8f2d948cf5c3e03a5332348fdc776414b24c2e5895b26c5f98de6494080
MD5 4581241a0f7224782201d08da35cebd0
SHA1 b24679b789e4ca304d54fc19b1576217aff73e29
SHA512 468ee9de27857eb076406c700796f71c8dce0d20db76e75469d9c057d5ba95dc48b88d6080019672a58a5d47fc7801cc53aab409f425de3738a1aeb72ff18809
TLSH
T106319E057C24421A557375045B91DB002BFA9711A193FE4446CDD25362369C7CEAD3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1257.blockandsurf.rul

SHA256 8899f5d6824fd62f373ab0db057d1128fa3d861675d4e2a6c5fbd1960b731360
MD5 26819088918123c7889c67fbc041b858
SHA1 1f947a5b9d5d46fad4d1788dfcb1b856280790b3
SHA512 76d816b0896003a0ff5fbf1f761ca34708dd6d4d3064d04500ab28b91c79ea6610bb5afcb6303c83b0447467603566be87d25954e393a003b1cef953a64d96f9
TLSH
T1D22166296E7185731C7352048F81D61017FDDB692243FE0112EDA4425356BC743583AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1258.moviestoolbar.rul

SHA256 24d18c8f60639eb394af59866c1069db5a781d6410f517dd7ea691f5c20f1d3f
MD5 a11f1c778d856a564d53b284260de842
SHA1 35075e5cce0d6a081c517ea3cf704962eeb430c8
SHA512 fb60ba2f5c929d7c522dbb4e3ce31b260db7ab021976ac88b5d782be99f5b30fd652b4545c42e93c0ffe43f003d9b3805463c8a5b3fca16db8f34203698de157
TLSH
T15531BD60AC668022A43377104790FD403FBCE2A27186EF9444C85682B07BDE7C75D2CF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1259.rockturner.rul

SHA256 3c3008b254dda09ec8cb191bb477d73a5a49070bfb4f20a11333ad0c6d0af9ac
MD5 d2634b33f40ea6b8fd9e5d1191e24110
SHA1 6f50c00b2f3a254fc294f10692804840e3c04150
SHA512 22c418cae9cc73b3fce8c0164d22870d88615efd735811e2e591796b7de6a8a27f0196281296625e194c732c1a88b96f9f869bdf25e3e15aa700f04e37575e04
TLSH
T1EB219B126D7645326D7764045B65EA106BFDD7512283DF0804C9A6416332DEFC8BD3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1260.snt.rul

SHA256 673607870c239fab11a47971cda9904aa0654d89a5817c5f5b91aa8dc788e045
MD5 ca4cb54d8e8507a58fe212700bc6cec2
SHA1 8d062f3c0bac8c905393b59d264282e58cc55fe5
SHA512 9ea280a2c9cdd21ce53350c205ff99b4ce488eff426e5f0bebbacaecdd6112ffc0e49cb1d2de16acb732c3acc56ac9bb517a9f515c0cdae381904732b7be0be7
TLSH
T1503132125CBB52AA1C7325001751D7815FF886205283FD040DD9A98F633BEEF49D83BD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1262.appmarket.rul

SHA256 296e3370ff3604ebefae801df6334a8f21ef3b977a3183ea9e395fb6d15bafcd
MD5 48734d71beb42d35294c880a5728db76
SHA1 b03821e6995f6e838af546485f99383685e9dff9
SHA512 727cc4e5e263c118fcf8756349c057c98b2c2af97d049e94dd5e29477d7e834d0b21ba01359221c7494afd62c5f727c5f7b0746edfd4ccd9ee7eb39f22b96ea2
TLSH
T15251CD41ED968206E8B339044389EE442FB59742D0C0FEC6BD9CA609546B9D7C7393DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1263.Pconverter.rul

SHA256 af68c516d6fdd0d26c7310458ee007385f675100a9ea99bb08c8cdc40b37fb44
MD5 37864fb4fa3f73c8ba0e2f5430c1121c
SHA1 517869991cc80db7f72f7f6401057645992737ed
SHA512 6d55efcf1a62aaa13e95e891e4d304681bea3750d04585f90a17eea28a9c1b7b2c6c77dbb990aab4c6e7f61d64b0299a2e11c35015fcb6773839ff7af64c7f7e
TLSH
T18561CD41FD96C216A96329048385AA515F6587C2C0C0FFC56DAC6709A02FAC7DBB63DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1265.welovegames.rul

SHA256 89a001b48e393f35b4873181929ae28f26688f1839074670a2341191f9fd2705
MD5 4ae480436e2a86e1364365430331653a
SHA1 fb7d477be50ff8249b21a06e02384fb20453ec35
SHA512 a5839c95f1e36c66f3eccee4918f3cebe4ae5a8c59c58c101ddcc637b7985d0cce1b5f2b13704e467ef0edae1c26aa8a54f1bda0a6b5c0d8a1586dc64e35e848
TLSH
T1D0510241FC55C216A8B375084388EA442FB49B42C081FEC9ADDD6B42606BACBC7B53DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1266.nvstech.rul

SHA256 7d50275d8d5970c0a0c6ba505963e786d99595d3f07d9dd09c1921683db0c705
MD5 511dc766eaa4ba40aadf0f35f609910c
SHA1 cd2fcf80a56790a6c34dc3e9b524197aa660302a
SHA512 3a7dbd932afc6bc79914580c7c42083193fe9a2937b2265f3e0f1f8fe15d56ea30a0fdea44f7d81e0433036e50e4d018e20b595b806355eefc741e883f703ed2
TLSH
T18051DD40EE168255E87329448785EA042FB99396D0C1FEC66DDCA342701BAC7CB262DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1267.bitlord.rul

SHA256 210b9dc8f73725cf2ec4044eda199fe9e20c58c70908311bbd9e68289225a7c0
MD5 dee1642c7ae81aedbbf624f39a7f9bbf
SHA1 be1add490963bcd543145659b0f45d86c8b3e2b8
SHA512 cc34e410b724eae208a8421129fb41f7a6a0d0f7c6c7d9444b060d97540f32580c7b8cb84e9a196ca282a927187b83ed5ac116c0a728f4f1e56d8e07e1f3c4b5
SSDEEP 96:3mXABzwHu5x4CGE70E7gTpe2dZIzMWqHpDPXWKYe1WUxWux6xwxsbrM:f7JMTplilM
TLSH
T1FF913091EC668105E87338040389F9102F78B79690D1FECA5ECD5200A16B6CBCBBA7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1268.freemium.rul

SHA256 553fa89a1e2d39c46014a04b0f9fc8c025d3d7980c2e56a48723c7e237d3de48
MD5 ccf35298e21c0de421abbdf901e52b2c
SHA1 2669637fa14f4c52572dcfc3baa6af033943aa6e
SHA512 fb00e09fdd24d057f1e08896a3b8426d51b3994fda5f2c19c881e3ee863557e3565b1c75835e612112e523cbb26927b3b1e6eb843b0dfac18d788b1d64c677a8
TLSH
T10D510D40FD56822699B329488384EB057FB5A651D080FEC96DDCB701106BACBC7353DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1269.superfast.rul

SHA256 ba6ec582501e95f72e087d9125a6a88b02fd40054490c301b2ae91d07c561ff0
MD5 bceeb62ea3cd1be67c3d02f7bffc63f5
SHA1 296c142861969a8cca569053da4fbb56121ff2b6
SHA512 a13772ff2e7764c5322d86de43dad90eb0ef64afc9ada8371dc9aeb4179b5aa24b658393707005eca960c4e6226a4814a2549f422cb8139b3691e11a123629bf
TLSH
T12C810241FD668216D4B365041785DE042FB8D742D082FFCA6EDCAA41616BACBCB683DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1270.swirlz.rul

SHA256 a318e533b491ac379a0fa5b11d7c5ce1ae46a3e0d3aae161f10393c80b3b626c
MD5 e5370aec2ca57bb1e3e0d5d2c0d70476
SHA1 9ee0be0dba172239f440c4c4331f001aed4edd85
SHA512 4cdc46beb2cdb091695af83b18e29f3e2aad69aa7a34831f1fd9d9e5093131b09620be0a3231c4d063f10769fd2205465e623f4c3e32b2008498b48082eb6041
TLSH
T11261AA81ED69C215E57338144799ED002FB49782E082FFD529DCB641A12BAC7CB693EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1271.cricbuzz.rul

SHA256 a90f63ef1ca1641f081905d7f7df723a218671f362a57251e80f76846ea73c08
MD5 e7dc0b605fe0459bfd6e2de24102692f
SHA1 87c9f95d22bd6c692fe6f9c70ef59eebeb875c41
SHA512 fb5d5f789b085a1b3efad7d5231e1e7cfff79db554767991df4c1d74a5592761b62010e0bac99a7fde419436c162a9cff7e046e7c22e4851c4b1f10f181d9a64
TLSH
T15251BE42EC658216E17375041786E9002F75D793E043FED55ACCA342A26F9C78BAA3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1272.marioforever.rul

SHA256 dea99eb9d2523913b47d6d0af65fec2182918a2b79d0ebc16b174da25e0badc6
MD5 f6669c633de845f5e36b3aab8e2281e1
SHA1 74494121785089ab83e9e44a16069cf9ddfbef65
SHA512 528d706e45f6dae1468d5b7ff05c7547fd5a2267bd9de69c08ac73034f6b3cfa6da412533ca1b0440298e2c7a961af863465db422b4c7e9f8119c45fdebe491e
TLSH
T1BD710F81EC598145E97335041389E9402F7887A2D0D2FEC65DECAB41617BAC7CBA93DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1273.connect.rul

SHA256 26a0de3d3c7084f2623753f2c8b53e066a2ebdc388f8ac1a38dd59ab2faabf61
MD5 d0588a7eff0636968e539a0f187cef3f
SHA1 3cfd11d8677c0925183687ae7ba8b28007f6552d
SHA512 03e9a18e64c8df5656c1b0a666c7ac330dea279daff5f780126fd69eebc82c346b1cc733a6fba0fb215fe1d0e8566ad9db4431fe97ae6202edc6fa414ad9ad46
TLSH
T15151DD41FE298116D573761407C9D9042F758B82D041FFDA499CA642A2279C7C7693EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1274.guffins.rul

SHA256 09c23004e4f317f1b7277fbffd3b0d00fb32f3c9401cebaeb9774ccf9af931bb
MD5 f41f5b9d8c39be828f79a6b9e71e216d
SHA1 3b8d2cae2e9bcf12f62f9fb287fd1a7dc1ac8323
SHA512 81c114d5464ab3e58dd2c184843b88cddc03f5b3f8fddd8e3aa3aa860b07ce21877f489e06903aa7cb7a16fe71bc2e039a021edad131981633c8db6c26ec8ce0
TLSH
T19951F081EC69C225D57339048789ED002FBA8B52D082FFD55DCCA681612BAC78B793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1276.ipumper.rul

SHA256 dc2a889a9388343aba58843786178a30e83e860b7f6e6d65f339710f52fe43d7
MD5 029ca17a2353f4c5b44adc3f6c3ccb9b
SHA1 3cfd8da2c72671fa7e4c3d3d0df7b0bf3788260a
SHA512 132c67c15bebf8a0789983f619c24e6165b4d3ef67f4a01e2b81b26c397dd6cb3361d9ffa1d013d0b7a0496a194540d86e3f976946b16daedadae5a93c065d61
TLSH
T12651AB40ADA2C216A57339044385E9402FA8935AD1C0FFD6AD9DA702612BAD7CB393DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1277.mysavings.rul

SHA256 396d54df44b73e3330b627b6064357f5a2a9cb1d9191606686d53e77edfff2e6
MD5 34bf48c02e47d0aba46c4c3eae7d02d7
SHA1 2218b4c69ef7125d94675b4150376ebdcff1ca81
SHA512 cfc8f4406312902912a813ea3006d6a887887c8c9eb61be3f97da330afac229235eb697950158a0a5f90a69e619eb44058dcba83331bc8fb88a33d238a533404
TLSH
T1E2511081DCB98145D17364054789ED002FB89792E082FFC65EDCA741926BAC7CB693DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1278.makemebabies.rul

SHA256 fc45933b08cc7ab9190f90f9f74396c4211ef00d22e39d741159ce7baa1198ce
MD5 5813f3d16da4a393ae102fc05433f53f
SHA1 c2249fde9107f54bf0e8ee372997aba45f83b2da
SHA512 86eedcc66fdf153563c63fa58c657646b5bdd394117f6a32d7a00ab3bf2846ca40c8cefc2f8f7ddc72cd1230b115c28458b98b99a2dd82b5063cffb4f331f08f
TLSH
T14371FD42ED698105D57379040B85DE002BB5D7829081FFCAADDCA740A16BACBCBA93DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1279.searchme.rul

SHA256 747b3825436a97e159a1ae15085d1e764cd7ba9dedfad5f49dcd31fe1e421a50
MD5 cfb4cd46ba3566244ed5293e72912b34
SHA1 c7b7abf22041a9e1043fe3f03ddc5c6b3e76f404
SHA512 8b1f804fe28b5a7524e278a870eea26ce2dada9db4df39f1fe5bf561f28b86d0ed7b1c1981788834bc0231f3d354213ca77e8e30156890dcc4f4d425cb452b10
TLSH
T14B51DD91AD29820595B3751447CAFD002F798782D081FE8658DDB680A12BACBCBB93DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1280.sweettunes.rul

SHA256 c0590063f0f2a109269fc04aee63a2bed741e00ff8ad4b1b368a16b62e18aba3
MD5 4489fa24f47082633c44dc036964e0ad
SHA1 acb42a6f60457898442dd5788d6cde08782ce8c0
SHA512 95ad9a9905aa34f9d34d099ab0a70266f9dfd9877e3a95c3fe78de9df3d722386098a2794caeee43259456debd7c0a89e08a59eba42b92ff05627857923beb8e
TLSH
T1B251EE41FD66C246E97329248385EE042FA99792C4C0FFC5AD8C6742505BAC7CB392DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1281.searchflybar.rul

SHA256 373199356aa2a5b3bb8c78eef2d7d30561eeec060aed393f361c4deb7385d19d
MD5 ea0bc72d3bc19f9f6b8a413bbb4a3fa1
SHA1 27c1c1933a38c3f9308847d76d554c1f4871c459
SHA512 ef5aa08e043b767f66bfc847da589982fd719a25e52738cb5f7841146ede560a7b63e27f156169af4ac6b44a80746b89a5eb8e33a5e9f9826fce010dcd2e0d5f
TLSH
T1F251CD41FD92C226A53325044384A9502F69E396E0C0FEC5ADCD6B01D15B6DBCB793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1284.totalrecipesearch.rul

SHA256 3860bcf316e17efea12bc9509b0ee71be63308fd5d87fb4644d2b50fb6ad95e4
MD5 addc734876d6bcbb423c940fc020c3f2
SHA1 9784fda5c691c96cf71e89fbb6f52ef4c6b58154
SHA512 b4e5c1015caa8c25fa1c24fd54ba9cdd745112770f40f796be32dd46a21280b24c0ed6a6cc0fdd022c4c14587ab3cb5b6edbe80d669a0d5b690abd7f8a8a693e
TLSH
T1B951E045ED968246D5B32904434DBA102F798743D080FECABEDC67416227ECBDB652EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1285.midicair.rul

SHA256 d3ec0804ec4ee1118e6cc56494bd4b9927e059f3995c0cee794937e2f54a037a
MD5 7e2689ab8361085f1bd495951ebe2309
SHA1 5ae16555a1b268f8d996e5f274ca3770362a2cce
SHA512 bbfd37302d2421f695a13d78bf316ca45a0f7f79cb388a17981b619c4f21e483fcc8b8f8ee6c9a961e3bf0c7b9275fb79d591a14d28a53a53fd8e93e687961a3
TLSH
T19B51DF80BC62C216E87329448385EB102FB59782D0C1FEC9AD9C5B02602F6C7DB697DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1286.messengerplusbr.rul

SHA256 8ac298a21dc3836c2f49502c794de27df1e79ded30ca54d4c87d888c55fc341f
MD5 0c7cecd7824c4a72377ba8849ec38db0
SHA1 61790ffee8c2e1383402aaae64eceed3284774b7
SHA512 5c3672cecf322bb835a5e1f9d65a280a8b79c1eb47b69cd4b1465d4cf8f0b18ce3d4a083a596dbd4e3fc6ef65e7eef67592bbf0685d4c0a95ea4cb4e6e0b751c
TLSH
T1E851DC44FCB68246D62329104781DA803FA9A792C0C1FEDA7E9D6706506F5C7DB653CF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1287.dictionaryboss.rul

SHA256 01cb6d82b1764ac741206fe2fb7510c02474c06a29d2af31da6404d42fd87d43
MD5 5eb953a9ae93044291f5f50ee61d4e86
SHA1 c643d7f034bbb7783ad143804f4bf1cbd55b149a
SHA512 dee1237ed2a242dbeccefb1e9c06fe454a9f8b70fc03e6a268ecdd94b66678151ed115f6f53883d7e2e762ce1135d6df4b99f277c7f919252b6f6a7c6acecdeb
TLSH
T15F51BF41FC568216A5732900A385E9403F799786C081FECA6FAC7341601FDCBDBA66EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1288.iwin.rul

SHA256 ec574b947c2da2435f25d55c031ec4c97d727035ef1681074f7c5687caa1b6a9
MD5 56e1f3beae7fda202d67c511d1e74090
SHA1 f8797f824bd40b9e4f17163578862a591f341b15
SHA512 192b169fca302793b97f330f76b9cef0eacfd1bd0effb4ee0fc0841fdd4feabe10bc827d1c3301e7c00e55e67ce3e0e60ad0317c054c94766d4db5767fd94551
TLSH
T1DD41BE50E920C21596B3390093859E543FB593529081FF8C6DBD6A02B527EC6E7B93EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1291.oople.rul

SHA256 5ae6af99ecdf78f0b66062cdd7652e573511cac33460add27ebc95842bfcc51b
MD5 e4be57a9b51ea392eb43a04caef3dd31
SHA1 99c2d499371ebb55ad91ccf5efc9bd1429737c5c
SHA512 27bc0360715e8146caaa6cb32b4253d7a3aa429b6fa1a765228797cdd20359904efca0beb92bb306249ddff6bae2d832de5412a1dc4f34e0608c63970deb460a
TLSH
T1DB51FD40BDA6C106DA732A044385EE402FA8A786D0C1FECAAD9D6741645BAC7DB353DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1292.findr.rul

SHA256 2786ceb2c93f2d92654cd8bf405ee520f57e763d6de1c5ea7e79093304a707df
MD5 02bd057f2c8a2f7c647fcda19fca7881
SHA1 7f2f0bdd066a4ec4732e7e491bae6b22ecc1397c
SHA512 5d387ac40a6cc6a80daf0950b0dad04d571f017f4253b2848554ba8e7972c1ed65e50db22865eb30ff43c4cede86d960bcccf2238d6dafb2862b2ee47bac2ddc
TLSH
T18251BC41FD95C25AE97329484384AA442E759392C0C0FED9BDDCA701562FAC7C7293EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1293.sitesimple.rul

SHA256 7fd718b20e8bfb1d35cdf9f95fc91aef664a266067e8d36d158a1252fec5686f
MD5 7b61a19af53e40e055df7cc2272ca044
SHA1 4d4f7a2311a1b561774d900f9fd705cd267ca681
SHA512 962151a6548738de289be6cf124acb1dba73af182ca1eec982b0d39e2e4dc7ee51ddc680d571960e014f9d3900275cab403a70569817112b6986bc147e8a81c5
TLSH
T1DE51D341EC55C247983719108389AD442F798795D086FEC6AEDC6702A06F9C7CBA53DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1296.savingsbull.rul

SHA256 e37d87c0473af9b93a6f8826825f040fe770395cd0e0042f34d4f1ccc3816eda
MD5 526633f0a82eb3f88418ee49ef4f6c9f
SHA1 46e65d34773f30d3908f017859003675ffea68ec
SHA512 e790c99fdad1f72f9518d8c1db02dd628474100835997698806637bdb80b0b6082e9bf91625c4fa520becec80f982e5cedfb70e8194c69699cbdd1d8ceea458e
TLSH
T145D0A7376C75C215D4B397084A9ED581037CD8913247DD5800CB90463761BD3076C19F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1297.freeride.rul

SHA256 f3331c5c3f3826b6b672fbd31c6d6fe6ac1ddebbe7242e92ba6de9a0896e751f
MD5 5def34c4f1a333794e38b12741cb292f
SHA1 b07c1af8f870218d46cf82831bf5a97965a0f04d
SHA512 affe57ad475357bec0bd5d83a8e5f64f1b655bb35acf346690a0e8d82e437a4459457bda12b80b75f22c358f76a9195256e761fe78e3d2a57a8b56eee5a1ef84
TLSH
T1E751EF41EE6AC207D93325448348EA102FB5D796D0C1FEC9ADACA742541BACBC7653CF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1307.runescape.rul

SHA256 0526c8e3873774cdba4220e10208031d3cb0705314f313609980651a458af222
MD5 437f9e9a48c2ddbf8ea0b4df278c799f
SHA1 13436c13ce98c6282e3202e5d93afdf51610e9af
SHA512 7f038ebf89975782603cfc44e5880508082a132bedf60657e48fadef31c3207faad5f9dcee7d31a9b7100401d2eaaad0462fa452a731d1fdde7ef33a2917b5fc
TLSH
T10A51FE01FED5834DE57368049785DA412FA8D781C080FEC66E9C6602606B5CBC7663EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1308.complitly.rul

SHA256 793613e15cbe6b325a16ada1f1f2676d9dcc192cb08ceecb0a6926902168ece1
MD5 5164aa3ad1ceecbbf46d30dab7493166
SHA1 fa9e245d0531dc10436cfbd00e83ba47748557d2
SHA512 72070417cdc86ee095b87d6f786e92b97cda683b462cba29a0b8be6c6ee43abe7003f62547003a6520c871e9d254a4dc1fa59f752dc6416b9a9efb93b5ee3bb4
TLSH
T16D4102021E71919A8D73D805EBA2CB141FF499555383FE050ADCC581333ADDB85AC3BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1310.trustloke.rul

SHA256 0f2ab2466deb8a8d442cc1d4a866f3d14a9f0c11965e35f295ece6fd821ad6cd
MD5 d0324d5765e5a24963341ffc7e298384
SHA1 9db591de1e2a559afae17b899621b3704a4977cc
SHA512 340180f97bf1a981f4f40e8f7ed31c8dc34282fb2f61841eea0fe37cf1ae753c6b00a736b8de3b0fb0af0b19e978c9ea79ba5a5fcefc7b1ec2a770c8a507dac8
TLSH
T19351F380EDA28125D57325044389EE403FB5A792D081FED5EEADA302602B9C7D7B53DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1311.faceless.rul

SHA256 6be595c4e045a444fe61f8a6da99b71716e1a60f341007d7aec7f2156d017385
MD5 6844009571e85ac3ef9772281de3c8e6
SHA1 210cf6f893cfa63ac3a3141bc367595d63dc1e19
SHA512 e1abf27a421539b0874c6a3100734d4a886ecc70acb16ae5e74b21f2be79af889d2059f16b1790e41317c5371988fd50aeb4737d573ebfc5d2c98b4b16a55122
TLSH
T1ED512251AD6A8205943328049385DF802FB99793C0C1FED6BDCC6642626FAD3C7683DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1312.costmin.rul

SHA256 ca240d4cfb4f021564f4a4538ba37c3734f8fc5564b40aec30986935c901e08c
MD5 51f155478780beb62363ee25030fb1a1
SHA1 4ba51dab6b845bc20f1e1243ecc9f34cc13bd1d5
SHA512 8c844ef58bcd93a5d6b7dfe3898e67925b58084fa9e43a8b5bd64fabdb01a100e30b2071668736a5264a23f3cc1dd6270ccd29249dd1838b55f2beecf1622ea1
TLSH
T1E7318887289C616C4E71C883B690BD300FF1431A52996F233F8D940667A994D51F839F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1313.rawcoupon.rul

SHA256 d37a6e08ded71a6a76333150dc3dbd4fef30341ef0d555d1f282b298b6eac89d
MD5 b5b5808048cec40bfca6fd45380bd16e
SHA1 f36d10f00a9a52c22164b7e60bde40c6806f7518
SHA512 4ef2552d0b9907a0b8f0ad7dafaf43a41669059266af5e783b96f449ad0ecb13b684e5de806bc9b4a8ebca3a2e8a36e472429d88db8da4d4f7bf6a828a339f9d
TLSH
T1E741CD226E36452756B369104F65DA001FF8D75671A3FF5601CCA502B323DDBCAAC2BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1314.wiseconvert.rul

SHA256 32e5787cdaebcb813b6cf81d1f443937ddb027d17c89b798e7284676ab9e48ca
MD5 e9afe1f27a7b14f5a2a244c70085f214
SHA1 cb74da79f130dcc5660acacf1eeae2724843d45d
SHA512 c9226374bcbc58f55694823054056f1cf7ab76c8ab687e36a27fb3df63f88a7cf9db4a1032c186e9f54b5fac9ea9ae4dc391ee44489da834ddbd2cdd9d34bbb6
SSDEEP 96:K6KAWDLJ6rD6uefsgFg0T4AbQnbwCzC/CWC4CpACW1mWuhEFZeiKkloLLs1G12OM:K6OtWbD5T1Lm1m2Z
TLSH
T18E62670B3599929745DD84A4FE86C70B4FFA9B2984CD74073FAD7CD652BC72922303A8
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1315.reversoes.rul

SHA256 d0bee44d1e824314666e214c932e31c805a93322c23baedd720020fb2816c0e3
MD5 550e76734e49bf968da2a7555da256a3
SHA1 c766ddae9ae1c621395119421358380ed73b7854
SHA512 5d7090d7d7d849b835c4769eff61dd45233c73b89e0efdf478dbcd9e228dd793706dcd99666a8bd5993c9f3bc021086a92caec1bf12b83ad5b369abfe12c8a00
TLSH
T1AD41D042FD5A8256E9B325056389E6002FB59782D081FFCA5D9C6A02D117AC7CB683EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1316.radiojazz.rul

SHA256 cca422deb6933568dd01fced11a24d7225c8ee737c717d22c192fbd5e05bdd82
MD5 00ce3b088ee73e1b01a5a8c39d238b6a
SHA1 1669744513a85e1ba977e83e54dc0daaa369a60a
SHA512 d7589d6e777181f601ab50f2f1cc8b2a65065d8c859c7d6d61b9a02052af1d31eed725962648ff134384eff38fb4b02bb37ba71467eb8487209235de33097572
TLSH
T17B41C010FE9A825AE83335044785D9003FBDAA83D081FDC269DDA78154579CBCBA93DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1318.reverso.rul

SHA256 58e72ad924b35d1e2ef759d018ba3b6c121b81e400e29a3d9948a76e01269e77
MD5 5a3724f6d71c18bdade6817e93c58bc4
SHA1 020a9671cf88bed20cd5da97dfb931400c303cd2
SHA512 f972e3108306a35603fd9ed323c230db85af00bad7650e2e4debf05a0aa91dc674dd40c9b3e805f82070762a339cc576af472a749d5df5f38a28a872d7297ea5
TLSH
T140410F01ED56C2079AB33904478D9A002F7A9A57D081FEC5AEEC7602941F8CBCB697DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1319.protected.rul

SHA256 6ebaddfc94cf104f193927804cb49d152f0c5fc3eba1f0038558bfec8620b44b
MD5 a98cd7c97551523976f0b5cb50c0d841
SHA1 ec10d42dc26b0fa8897d60c96a657e546da698e6
SHA512 e5fb35bd0c609c2c7e2ae4366483c6e1f93d58480f1443b044fac762cb6d304578a771737488658766a5ddd356eaa38da17ee7bb2b5be6b15adf029031ed908e
TLSH
T18B512241EC498119A5B329008384EA442BBC97C3D0C1FEC15E9C6602A95B6C7D7763DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1320.vafmusic9.rul

SHA256 496a2179afa288de8c28515452facc22c22f94e4b47e12e07d6742d2fbb05c45
MD5 f45891c9f96edc055590d76d14242c8c
SHA1 a8a0acfc1c3d9f6e53c19dc51fd29026c48c403e
SHA512 2617e08a1f09c61433c1a2e6d13cdcc184df581af2635fedb6da4176767e78e38e55fc9151f38496ff95e76f9b4e09276aba2f5ac45f6851e3083bf553a387b6
TLSH
T18A513241FD96C346A97329084385BA442FB5D392D0C1FEC96DDCA201645BAC7CB693CF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1321.searchflybar5.rul

SHA256 34270a7854a60710edfca21701503a1fb68d5dd982b8bbfe70681a33e9f41d43
MD5 f6f8cd25f902cd953e586588a3750eaf
SHA1 e05ff74be985e1dcfe62f46d31cf6c706e071228
SHA512 d8954757b46522d19ad923ad6bba29df406a42498b9ef893e7f626308f1b096e859b9ebf2f2193fea5299c6fac009d6bfc8fefdd4c0453991a2353e71ef04bc6
TLSH
T17351DC40FC52C226A97339484385E9442F79E753D051FECA9AECA6415027DDBCB6A3CF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1322.realorestudios.rul

SHA256 db8e1725ac40d49eda7757489e13d738708b732e3eb3eacbb6975c1c09de1274
MD5 d57e31b7a6e8ea36107cbc3ff755f0ec
SHA1 4968e064bccc623ff4f787db2f668a8b6fee2f53
SHA512 d56d31e4481147bfd8638ffd94284b2f24dbb4f5dbe44cf3693dd4d08661c0a31474ac5d0628698813df2340d7de1dc96d80d0ee434fd9ab400c2a3f30244fac
TLSH
T1E55115009DB5C146E9B33D04D3869F102BB5839280C1FE8A6EDD5A01A16F5C6DBB83EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1324.shoppingchip.rul

SHA256 0364fb936c77b40a071117d3f5977f36745e290c3853752c06e73304726f2ce5
MD5 a919d354282599210d7e80ca61b6d0ad
SHA1 eec7066d7528425a999e7e6077745338d3f998a4
SHA512 0b72e65b20aee740eee578aa21c9691881d285da3f9718633c74ee86a9d422b821462e38c9a0d3f257b518056670eef282aaadc47d18d238ed9f97395db85a26
TLSH
T17921CB122FBC42175877C5009792CF046BF5C614E14AFF4A0ECC550A72AD9CF48683EA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1325.safesaver.rul

SHA256 d7c6e57b482333947fdc34842013fe2d753833ed9777d5aa17dc119a44bd310d
MD5 6141083a456e8000662794fe26269fbf
SHA1 3d9add62a079de3ea69051c3a6fe617be79e1c6a
SHA512 44e5031002c78de5da5ac7eb13047ee92a7ab7001bc99cc631e999d4e14cc9b40459b2c6e88f8047b44bb76c295a45f18bf98f0ed85993861d325fb73aa97ab3
TLSH
T1EA71A3508D24C424D1B394351FA6EE0837B88B627153DB9904D8EA867237DDB96BC2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1326.somoto.rul

SHA256 62e5156ad3bd013840efd2d23f6bdb1ae0ae4ced79f4c0e8f18c81ae62a2d375
MD5 d1e8300c6c468a8afe5369ec00984a69
SHA1 4a3a37122268515e3f422de9f0b4d8a069b299fa
SHA512 b9e6ebacce49d59ce29782b7af84cd00be9e8b84f528abed33e2f2cbf66ca0f99de2051d051b4ac91224692f86c6b72c2f7219a690a6ede0d697e99ddd2fb2f9
TLSH
T160511050ACA9C1559933790057C6AE103FB68793A081FB8959DCA640A13FAC7DBBC3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1327.saversplanet.rul

SHA256 4d836fad1ad0d8e709dc6392d0e0e6baa7073b29222444fbbff9508c948b9710
MD5 f75271d8f560af682605cafaeee131fe
SHA1 2c8b028db5e35552702d0e1ecada9b6bc488304c
SHA512 a18f26fabcb00737d72a5dc93caae3b5fde901070ee57557e5d155e1da25c150b0734e81f5ddc5c195413bb1322e174eacb1146be556cf1f80f00c1d9d68d3c1
TLSH
T131610D41DDB58112A97328045B82E9502BB883526082FAD94ECCAA41E53BBC7CB7D3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1328.reganam.rul

SHA256 db031b21944ae02e581ded8f921a76b4102d16c4f36babe3b3aad57a250c428c
MD5 50da93ff892807bff2e19b40937d7ecf
SHA1 f74777d39f9fdb3688bebca84911fd8c56b9fde9
SHA512 d3af7f60d033ddd01dd20d7c083c4e318ea96e9ac5fc96dd687a89130e412e23b7cfb5cb5ebed84aaf1cd5f56b15247b28486d7430abdb18a2b65567b0836e3e
TLSH
T1A2511F415AA4C2159277390013CA9B512BFA46579081FEC46D9C6746603BACA87BD3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1330.casualgaming.rul

SHA256 8c7e50f6d4ce20443dcdd030a23071737ed253b863fae373227dc5cecf429d4e
MD5 18d08f15c15c3d16592b060bd904c1d4
SHA1 3a50bac2818304a2f60b9361dc4364d5ac7a0aab
SHA512 e13c4065bf1b12ae0479ee5efcba4afc43fc82de4e4dbe73ed7d04895b724a4041154b2b16c32cb010700656dda2c5db06a8ee31c70ef08932ed131fb2b78dd2
TLSH
T1EA41FD409C64D141A67329004384DF503BA98BA7D0C1EB85BC9E9B06A52B9C7D7B93EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1331.sweetpacks.rul

SHA256 3ee32915e3b1703b6735af297d6d0db3cbc5ed25ed9110024e5da3df91d33f7d
MD5 c55b15a7312cff9668a4efb8aa933a91
SHA1 2a4a58cf1ab37645bb659b40236880d491c7b2d4
SHA512 460e1a5f6f4af7bb9a4d1ca199b48f585e62aa76a521d7eef8edf58cb7df73ba446565c6f323c26aac9c18cec19b74e477ee0c843382877a2c4a01c9642fb832
TLSH
T13741F380AD958245F2736E0443869A143FE89352D082FEC49D9C670275277CAD7793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1333.searchfly5428.rul

SHA256 d6d4f975bc1972bdf427dbf2b7759a019a26aecaf7817805765e39ea29d438cf
MD5 3ced4c96837df8c24713e9ca2b03fab0
SHA1 e0e7e4df5a0380ad736479d70cb6c54465f87e42
SHA512 d73ff056aa4efa56e25ca5969e035d4ec00ec6664c6760d8f39a761cb5ee2ff0df300655543b8ade598c9820b194757415cc11b2d0237d861674ea3e8466336e
TLSH
T15B812301FDAEC219AE233604538AE5852BA5D343C0C5FDC5ED6CE04141276D3CBA2BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1334.searchelf.rul

SHA256 185ae6a45d724037f2de6799ff32ef84ecd271a655ebe5a8323f064070ae1789
MD5 39a6f62fc2b30fe5fb45f625ef19f5b2
SHA1 d0b315053336eb827e9638427529589d4e308815
SHA512 26699919d52e2288d4e9492686477b9615594c4e19ec51fe37da710b0dd04b36aab68d455d518ffcd619c8257b368965237cc1b3267d74248176c746f105e2e0
TLSH
T1EA81F148FD99825DA9332604A38AE5062BF6D64690C1FDC39E6CE20151277C7CB91BFF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1335.claro.rul

SHA256 e1af2eaf02c06aa103287305debefd37094fd20c863683c3c3a766360aafe1f3
MD5 09cdb39761d4b9b0aa5615cb3f834150
SHA1 de1d9a737e3a10340b71d21c75308747902f9daf
SHA512 dadad9fcb9cfb447cbb7773f28f4923c0e81a6d8a0799b62655a359c7e1ca43da490b28295e4280c69792b3bab492db70353f9b296a02334e4a45ab2043737d6
TLSH
T1B151B840ED56825698736B009789E9043FB89792D081FEC59DAC6601705BAC3CB793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1336.clipgrab.rul

SHA256 c5471c1a27befa7d77ab17b8cb03b7993923d207b3447f10f86d08e94f26d520
MD5 de4a157c1937b1c7e5df09169f495ea4
SHA1 9ccb46bc2cc5dd0a6c212afd3edc4edb2ee6e67b
SHA512 bcfe0210c7b044ce1fdf2ac98a540270ed46179b8aa32fcc01f7be06315e446d75d538231f1b0e17ca96cc7e9dc4e07cec3bf2475e66757a3ce0f577d597be30
TLSH
T14F811101FD69D65AB96362089386E5041FE4D382C0C2FDC66EEDF4415167AC3CBA1BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1337.wiseconverte1.rul

SHA256 174455142ba1ae4a0bd88dcc7881594b1b1a2ea41a6b2efd674ba3693fb367b3
MD5 08bde77bde3bce7f34e866b4cea95844
SHA1 96df7714d9f8642c5d90b7c7c2090f8fbc2b6544
SHA512 69b998a04239938ba192ff802753f633c07a7de0fa798339642d79e0649568dd5ae47d30eec462c9464f4793e2edc0c8a745cdd881afb010196c10643a2d04e4
TLSH
T198712201FD99826DBBB326049386E9502BA5D74290C1FDC6AFACB141113B1C3DBA5B9F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1338.dealboat.rul

SHA256 1a20358c9c9fa2152acaa4cc37634995c0a8d2a74a7cce7141ab11d3b6b3c731
MD5 c29d1362176d2f9f81077baaf38ba6ce
SHA1 67099d8d7c03719f1b6089ef16d7c5cc91323289
SHA512 0ed0cfc877e85efecf5f8bb0132ef159d3b14b4e524991a723599ab05cd9b9067fabe1faa39e8cec61138a86b96d3656e0485113e06f28c978f16b5904af39d6
TLSH
T109614101ACA0D001627715265BD1EB1C3BB49745A096EA955CD8EB03713BDDF4F683EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1339.arcaderush.rul

SHA256 5fbe37e566e4f9eef3de633ed0cdf8f63f9de4803f68f9bf7f1c83f01b5fa500
MD5 abef434d30e19194b8045f18932d1a3f
SHA1 2dcd1033106cdcf2e2a13bfeb98129377fcb2dcf
SHA512 def8b3b371bf1771a1ebd79ca50050b6978c5115ed302049fb31edad66715cdb5471209b1d27cc73989d50ea8e13795bdf2b1a52fb1f3568e74927ee390e91d3
TLSH
T1C751FE51ACA58143E63365041B84D9587FBCA353D082FE886AECA341617B9C7C7AA2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1340.searchspin.rul

SHA256 4748ff90b6db2f20107f195c16b1481265247fe26db137fc963fa911e1afe90e
MD5 a46026e28a0785b1a0eabdc1056aa7b9
SHA1 c8cce6d5a01fc6247ba8e4cad9ed40ba602f4b0d
SHA512 6565da0f75cf900878025e19c745460a8f89ce078245b246c558158beb73beed89bd192415035390acd4a544f939feac5a2c7f34b0f7773662a1b83453d0a2ce
TLSH
T10C61AF40ECA58319AD732609E38AD4403BE6D742C0C1FDC6AE9CB6405517AC7CBB26EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1341.jobnetworks.rul

SHA256 a87e9b595cd5d3d36324770d454fe35013f3604c7da81117644bae5e1fe9054d
MD5 6b4c93649dc2447c39e6cff24d844917
SHA1 47374b8ed2fb857a6d82ae500f60163d66025b4e
SHA512 e6b40c493bfaca011b7caca93695576c0b7bd5440837b3a6118af4766d8a2e95adfafdff7da0c946f39cd35f6cb79c5db80b8a498ff279ef0702c48a99e7a83e
TLSH
T1F2711F41FDA4C218AD732504A74AA5041FE59B42C0C2FDCA9EACE740945FAC7CFA57AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1342.iuserbar.rul

SHA256 714acea97be90a4f45c143e3a51506505257aa1988bf6abcb0b134f993d92258
MD5 3c764cf15f8ab1e5f25e257f18d5c684
SHA1 35f7498f9bf86174a880d1b71338b74fea10469f
SHA512 2532216ea9243d517a721d3e2f6c91876bc6dc830d6c5557e2ba1b5b96c5fb7cb23ed25d899efc55d19fc6af9e158a5d7e2bb5e04a6e85b03dc2bf281a22e95b
TLSH
T10D61AC00ED998248E9B32708A789F5052FB5D25280C1FEC699ACE5414167AC7CFA17BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1343.ytbyclickb2.rul

SHA256 3a5d29a84b9fcc60a0222dbddf123dee9aab97b010d216e447ab3a8f092cd2c6
MD5 f25d8e4abd5826153c486692f2184326
SHA1 9310134e0e3ed1b5a89d4ddda32d943a8e21dc2c
SHA512 cc401ddeae47a0eda104208bb08675c3dfee4d0efef9f9fda4e2e3edf0c1d20c1262bc1925d2de73619528f083952c12207e1b5e5539a380b5930aa085ace5be
SSDEEP 96:3ZYqzW0CAJob22Cl8ABQRxxzWWr8fwgygONieAw2AiC4xWqxHxwxfNwW:vqlPNbQwgygMBRP
TLSH
T1B3912181BDA6C31959732500E3CAE1142FF58B818080FCC66FEDA60015277C78BA4BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1344.orytegames.rul

SHA256 822bc2e785e3e54b5f7fb4c2cf62f3948364471c822914fb1363029f8568e37b
MD5 e1b36725c13e269b741b9bec12663574
SHA1 5fcf9dffe47d7880e8780e5c2f05308a6350c75f
SHA512 6dd1fa8c35e1fe571e6d4e0847ab5b6b7f45ecedbab75c2e31dc8e1174f2e3b1691a929aae547ae979c449021654e7da2fce0b1b4e9ac70223e946292fcaa626
TLSH
T124617000FDA88319BD237514538AD5502FA5D34280C2FED5EDEDA30260275C78BB6A9F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1345.tcadeltona.rul

SHA256 3f466b73a072621ffaa3bd271b7b265bcef6cb670f861f7360b50bdf1603a4e5
MD5 ec26197a46ecfa4244e5d134964e409f
SHA1 e1f38499da970463e61cb9d85cda9d035dc3f209
SHA512 9809413690f319b8e73f0a42e7c8a91f002e1a24518138c1b6c5e8f58abf9e829b03aec6c4028e442b68768c03c9e89cb8d717a945c7867071f37d7fbc57e4cf
TLSH
T16B51E400FD994259A9B37508934EE5056FB5D7C2D081FEC669ECF24151236C3CFA169F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1346.badgehelp.rul

SHA256 fec7c2819d01691471d433a1864949a8323b65bad3c058b92a532f188d8fab47
MD5 1697371ac0e1c1bdca811773b4fb92cc
SHA1 0db1919a9125861d2701b92292ca97b254ae4258
SHA512 132979ec9e00e84066fa6b9211196538c97be4df5225e7cd785309511f69581c773e5c7a6c8094ed2e925837710672acf6f3ebecd5484cbc39a2cc7ec8c65681
TLSH
T17351DE00BE7A8204A8232604AB89E4151FB5E76795C1FDC99CDDF601021B6C3CBF1BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1347.pandora.rul

SHA256 abbb38a5bf66b6b03a57fa88ae016b9b969691f07513158ecc051315e8dbda79
MD5 8da257bbc138298b6fe859d1eaec506c
SHA1 7767170ecbe9a29682fda47ed7c037b033f6ea2f
SHA512 c3188cf663432f4068f90d1c7b9959a89ee2c26e2ed1705130b8f66c5fb61815d9496edc884833384057408752a563ee2662aa220168cc2c5968de9adacdf3cf
TLSH
T1C251CC91FD58832EA9E32244C349E5441FB8D742D583FDC68AACE141012B6C3CBA5ABF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1348.sitefinder.rul

SHA256 c3f6cde8ab49fd567f6d9b2cfbe38251f8c96321e27faa508e80dc2f80bbd3bc
MD5 3cc55d88fa355fb0ca570c11c8d145e2
SHA1 4f9e38e4f502f13e7d0129369da2b031f8d03742
SHA512 dfd80907063956bb533e1b7ed548292a6a5346cbd63052747df78609718a781ace54fc03f87a2e80122cd4f797d0936d045325da269a81bf31fa7b200eb6ca02
TLSH
T16C51CF51FD59825A58B32604978BE5011BFAD7C2D0C2FED99AECF14080225C3CFA97AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1349.hottraxradio.rul

SHA256 53bf46d7f2fa05e6e8967632c75a07cc50430c187cc0b1793936ab8241f4615d
MD5 fd81446b33399f6b6efd2191bdd56edc
SHA1 c4316082ae0fa9c11adba6d9b10bf11833d1d48d
SHA512 f1a98a3d0833718ddc54eaebfd184e34f694c30271bc90b1ecbf518ce9c40d6647e95d1c0e60566887e4b080cd3b9e55123d91e52616c139a3207f5be96dae15
TLSH
T1B351BD81BD6543456A732505578AD6052F65CB1680C0FEE6AEFCF28112166C7CB707FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1350.fifabario.rul

SHA256 c984061b6dc2c0a11dfc6ca6d935755b4d579e45e68d0f8c77a77f2186a20551
MD5 7217f5379e5b3ad45dba1aabc25cbb52
SHA1 15279cf8238a4211d11c347464a036a28e987ed4
SHA512 4e5eaf33540b98470c4f54d719cff004fabfc16e098c4e78564b8fdf687e1a20f17cd1bea09824abf8533e381231aba536c7e087c095a579601fda65c2b5d3b5
TLSH
T15E51C051BD684216A9B322048789F2051FF9D64290C2FEC9AE99F24015266CFCBA47FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1351.viraltrafficfrenzy.rul

SHA256 ee33118e68545848802558c62b882a1352e4137929bca3ba75c9cf3b46d186bf
MD5 0d6f51f7dc46dbb9b58b1f10d718d3f2
SHA1 f778230daf06128e10d85217b38f3ace7a6ef2ae
SHA512 fce1d5dd32bb9f973d6e08cc618457d8b2a6cd1eb382829e2dfd35afa1ffa4556817ad24771e3ad59770cabe6a457579cf1ed03d314511f98d1b09cc284c221b
TLSH
T17B510000FDB942699D73658C8B44FA052BFAD24490C1FEC65DADB2816237DC787A03AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1352.flybuys.rul

SHA256 66511c012d8a22fb669cd5630e604ca24da5394e0a5353fe398720516e8eeec3
MD5 79d055e0b922a3e4669070fdaa48a526
SHA1 02ee6fcd5a929671f5f0e43286810a5c0b2e9e41
SHA512 07196f46899390765346a6e93383527ead3d82f632c6d6d7e5a477028e36a4682f39b045ac7e90bdfcf62abfbe6bd1560c7540d218f1ca29863d1d529fcce399
TLSH
T1B451D020FD684644A973350593C5E6141FA5C782A0C6FDCAAEEEF101511B7CBCBA539F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1353.stardoll.rul

SHA256 cbb8dd2f495ef38d0376249bfe4e93b1ff9fe46db72a7e329bfc35575e930c7e
MD5 2b9451dd5bbc4e7b39f0a7c646b14453
SHA1 9c538f38ef8dba7b5025c8249e11409adfc34d28
SHA512 44fe1fb6fbe4aaa092ca8e509a0a794002cae07ec026930b3d6514973fb79df236bed54fe062dbda5351b956e572dec38c6f7bef7c55fd7fed8a1c32f4ca0cab
TLSH
T1B0610400FE644269E97367089385E4012FA6DB8260C1FDC6ADACF24250277C7DFA17AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1354.tvjeeves.rul

SHA256 c6ca75e4bb08cf5693cad62fc741bd1f8ef409f5ad720ea8ea56e9198c63a9de
MD5 201cacb59d977a3f2b3282faf01072c6
SHA1 84d0097a263ac40c3246145192b413f3f4d529d3
SHA512 728ddce1f7a3b4a570ffc0696821967294b48e6b48a62040d24ba5004a2e28c984210d3a0381465e74ee2ed188cd9cdaf89c8d5b6d137162b2e99bc22ea75bc6
TLSH
T17051CF24FDE44359A87325085B85E4002FB6D38190C2FEC69DADE601541F5D7DBA53AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1355.slingo.rul

SHA256 a4b6d8887866a8c0447debf144d92a4a3ce6aeb59279a177122b824275b0c3d8
MD5 7f553c6c3e608cf97ed85c7c2cf5c56e
SHA1 95cf07544bd857cd2aaab48d9b881aa184fc26ea
SHA512 2e9220a6928a526e09bd88e48b11775b8109934bb942a28b3f888a3f096a9f66b6071140a9837f72a5449b4c2db445a2e83459967bb498877dcadc5f9a5b43f0
SSDEEP 192:IDqrw3dsRww0EBHamRhZKQB9drNkr8WwT8YkJHVxfcGrJlGLDr0Z+dVYnWKu2vLv:IWJwvZTSZJo
TLSH
T17D622700FEA2975C09935224F397D9064FAA574380DF38E98B3D74C602994C79FA77AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1356.tvbario.rul

SHA256 6bc3aa0b1e515cf9c8e004e819ba9194d943811660c46bded5a792d1aad1ee5d
MD5 7eac03283a48eabd7bf62423bbd0e25a
SHA1 a10a35c6afbc5aa6e77679444cfb495ddbd7524a
SHA512 8f52e0b474ebe70b428276242e4eeb4eec523b62833637063540e91fa5c80c0f52eb4b6d80d303b2f72fcd7d69aa80114b8005268bf86c1e4fc03eecf1c0c4e4
TLSH
T19B51BE01BD94831968737604B785E8015BBAD753A0C2FDC59DADA201E067BC39BA23FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1357.kb1thm.rul

SHA256 9b7d02c5644c79d7f31d5301542f436ac46531ca2e2e60404fe4636131ac43d4
MD5 8bca6874b51de217f1db856d94e88b3c
SHA1 6b58f7b71739882662795047f61cc6b87bd358e7
SHA512 12b623be302028257ad2f356f400a305a1e6f0335e812062066651716b0c972a715df8e3a24de96326aa0ba765a77c12417d95e140b99746c28c7f87f45f9774
TLSH
T18D51FE10FE78C26CA5376604978BD00A2FB8D65590C1FDCA9EA9F24111276C7CFA17AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1358.mundotool.rul

SHA256 513cb24611b8b656eac27e67275dd689975efab789aabe77e40b5d593cc0604b
MD5 d8d771ca78f922046d365217fd59ff5c
SHA1 9493853e811d7a593806c5a76be1c4ac49ef2358
SHA512 b6e41aff632931ca5ff721f2dcac64c081e19c6e09eccd10f088169fca91ca0bc9d8cba3253ccaf1415fc31ea8b747e1681f3aee5942186bf0c824094200d198
TLSH
T15361DC11FD9A4259A9236304A38AD5482FB9E742C0C0FDC5EAFCF10155266C7CB99FAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1359.programascom.rul

SHA256 fcccbcd938201a2f01f7ac264ef0285e1ee5495a7603fb70456a05ad5bea4513
MD5 b5c9351899ee3d0899e2f2dfd25ddaf8
SHA1 7a3bfe9be9c1082f49ac14ee1e5380436f012e8f
SHA512 894f4dab485821799d8e5ccc68db489e833c60bf3eee84060535bf87b62706cb550b8cad22a15ff36498daf1b381709c69e9a34a4955474307652e1979d3c5ae
TLSH
T11A517B50FE684268A5636704979AE4041FBBE691A0C6FEC9CEACB101C0576C3CBB57DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1360.searchqu.rul

SHA256 d94713df23e51bdca78e2464e161be8dc1f23ab4e9952e0e6e9ab347e586cac0
MD5 7d5ca6c0714e56c337b4ee23c1591d5c
SHA1 d5664720506bf7cb5ccea230ca33b80e526f7c29
SHA512 83797a1424476d4d6305ec0ff34e1a710007dbef9a7467cd6f2c6f9c4db9f8c2632b03de5f1d7da9ed959153f164990f09809c45c1952383ef056564707f06cb
TLSH
T13A81E7222C7245A84D7715190BD4FB006BFDCA119683EB4901E8E253B276CDB86AD3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1361.streampinoy.rul

SHA256 64304e1607ed7dce6586106422f1b7ae170d4fb2cd6c30602df98be859fbf5fd
MD5 1c11a9af71ba2a5aa709e15dbda15c06
SHA1 b3de5fad65bffebd0d25a8350e5442838c12bbc2
SHA512 c0cc9e765e4e1adf737a32b7126953a9179bca11c7adfbf909c6b53a706ca43037ca9bb16ba90e6b8807a81dbf2486b6b52f36bbe67a9d8048d917c54a7dd122
TLSH
T169710141FE5A826D79732604A786E9063FF9D64180C4FDC6ADACE10151276C7CBB07AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1362.trinilocal.rul

SHA256 9730b7c755983625686406d8628e35a9898ca8d8a04ecba2de357ba54d76b61c
MD5 2654f6942bd06b541a396f079c3ddb22
SHA1 100c8e9c79ef02cc25c43f334420a3a3c999430a
SHA512 2f269ab8f977e6422129cc2b34e522b0742afdd30732641c424c6fe7414dda8b2507c519e7a0422a10d70ff55262c4e47e7744e38d82f4bbdba735a9281ea144
TLSH
T17B51BC10FD0A4214B8B3260897C9B5052FEED7819082FDE29EEDA5415017AC7CBA279F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1363.suptab.rul

SHA256 ce0ff87a45494e5ce6135eb4804074851db0e69953ea8a31325898aca009563f
MD5 3c1f62f6af66b14dfc491d4c139f9e39
SHA1 d7ab3e2cc331ee17946a281f525d47b780d4fd53
SHA512 c9113fbad073fa44243625b455346f9f8601f31efea28ea6073dfa0e372f3671e765fd5d8ec7079258434d7fb7aef211a27dc8071f22249bc6bdf2d16eb38247
TLSH
T18511C1609DB59079C6B334000F45CE10ABFDD622A243FB5405DCD216A333ED789A92AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1364.gamewrangler.rul

SHA256 0cb99de9c7f0e523f785c69c3b4e72c6c94d2c547d306138898bf41c6e7d990c
MD5 6bacfa05fe9f272b8a1a05c1826a5603
SHA1 33abade565e62740e99ae2adfcff6d5beec6ed6c
SHA512 7efa052841ecd38557b11d779318ebe227387abaeb8838be3c733b015f89f71c7d57e529327de20e32625d663f4a1517bbe5f94ea597bb2a8651117c87fbb49b
TLSH
T15051AD41BE788214DA7325089781E6412FF8C69290C1FEC75DDCA24256176C3CB653AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1365.iwinstore.rul

SHA256 50fb30cbf7802c56dcb202525b83631d99c08be3a827bfaaa300e3a94829873f
MD5 9f603febe219bb02d2fb23f7b410b616
SHA1 05782537105fafb60e734bb7763ead863d69e2e0
SHA512 e388659865bb3df575c339e8f685027cb1958dc3611f5354721a9d7de67576ff2a8e186cc0ed196a2c127a620d18fb8f96371242b116ca8a9070b3e0444cdb53
TLSH
T10051DD50BD5C8218ED736208D349E9143BBAD640A084FDC6EEADF2815527AC3CB657AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1366.taxanswersfree.rul

SHA256 2aee4e6329d82c1152e19493e23b554fdfce9817b27eb502443848568c4a6bd1
MD5 387f9c194685baabb14a8c9b75dca744
SHA1 fde16a0179d67b8c1f20f2209a32960c4a54e907
SHA512 016d16067ac3fdb4b68f4184c2051788f01f932b581f44eb03c4313e7c9268792bb3828363bd2ea62f7f11abd18236db2b8c67c0dabeb867b7bb2c8bd0523a53
TLSH
T18551E140FE68475679337604A789E8052FBAD25190C1FDCADA98F210112B9CBDFA1B7F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1367.bonzuma.rul

SHA256 a132f508513d4b3521b7f8b44185728f5cd05bcb74b09a0bc7cea1e837cff100
MD5 0146a6026115c1fe9584475e492eb523
SHA1 6c0d2bf96f8a7f90d9a164201d96fedbb5ed8def
SHA512 c66ec909092b583157553961a1fb8e9abcb8b3072df86cecd9c14f973325ce5d932ad4d4ce0b649af5b54119898698be42263c013e09564a3c9b450ab587d60c
TLSH
T1A151DD50FE198768AA236608934AC5052FB9DF819191FDC59AECF10151276C3CF62BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1368.ofertilandiatop.rul

SHA256 efdc890b0dd5eaab81a3f8f7072e260a6655ac8782e7bfa3b842abbc345d71ed
MD5 745196e5c89ac90bfe6ffa9661c1aceb
SHA1 c1ab25545b478bfdbcc9e8f3b2ad0cbeb43efb29
SHA512 ce481ad5f5bba0b7564164b1d3919764179e2e62baf4fe6277227d683a5aa0a92750babaa6017ebd73c5a1133741160186d0679c3b02ec3818d2c1d0942c3f0a
TLSH
T1CD515810FC59826DA8B329985786E1041FB9D646D0C1FEC5ABECF21048276C7DBA17EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1369.realplayer.rul

SHA256 92cdb25e5444783db5bae69f1443205c5b41f368d26b26c81080ee74675d552c
MD5 cb1f54b6178ed4cdfc1dcdef1528722a
SHA1 a16a3ea5dda08782d737146ca08c4ea0da9613c5
SHA512 85bacb59effe961b8fe1160a11b34dc23c2e0008e209bc0267d28d4b05bce8a97ac1ac425e8bc68e55bc388f7719ae22c1bcd77e8292e0bb4c5f7f4858f91800
TLSH
T16851F064BD4E4268A56362099346D00B6FF9F651C0C2FECADAE8F10140271C3CFA97AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1370.rally.rul

SHA256 0b9f2763ad5d3a2efa0c7ace2d258927f9cdbd62afb3fde71332717cc29d1709
MD5 2087cf0429393820a81610dc1abedc37
SHA1 009270a9d83c7a77ae9827924a2f5dec4e46992d
SHA512 3758b1d7c8bab9b1e0428a586255aa65fe1e3dac26990459eaa18343f7ed343cc15740eeed2edf01355d66c9014e956886967cf0c796c121b8bb3a9394cd8ba1
TLSH
T1CEE0AB126DA0926556276944EE42C96213F84E4520C5D48707CCB809523ADC666AC2AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1371.nexusradio.rul

SHA256 a3439810cd6ed3f9900af043f5d89d7f3ceee960910bdc78da29fc0c313fd885
MD5 0f4e00dfba1e7aff6f706a68d5da8b83
SHA1 dfea29d7e12c87465d52138275516d57f0dc79e8
SHA512 66668879f62d98a42dcbb4ec7d2537050659c970b9b417d05707adedbbbf8d4746d6e3193b9a06bd93409bc5ba27930e74a9b229cf459dac00fafcd1c3ad7e53
TLSH
T14451DF81FE24461854737A4883D9D1481FE6DA8180C1FEC99AEDF242651B9C7CBE13AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1372.searchpage.rul

SHA256 1d71e89b01434f792fd6655be23c6645c3e8b9607dfa18fe03659f47e0e90bf7
MD5 29ad46b4d4f6af47f030911fc01b34ce
SHA1 b8606880751204b36f647a041781d78a84c2f922
SHA512 2d9f9e43cb6e39f02fc97d79d4b0989201411ce7ff870ee13077dc7bb4c94ce25ee5f0f4f9ddaa81d1fea4977fbd4741b331c173d608ea42590556e80397f5f1
TLSH
T104217F915DA5C14F85F36540E796E6426FF8CB41A081EE4085DCAA117633ECF8DAC2EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1373.sweetim.rul

SHA256 8f1351249922c95fc4879c39b52b35a7049f5eb7061db04f2d43aeae2738a8e5
MD5 b1194e85ef5399185b93e30ce2825da1
SHA1 db7f39a20b1325ad9573e886fd2e4bb19098e62f
SHA512 717ade0cacf55e2445a65874613c33565aa7e0fef69c31914e67b2a5ba8bd6657f083fdd6d8b9e48da9455f6cce3a205cb2fd271e2757e497e2227d20dad0136
TLSH
T13651B011FE9A8259A5377344934AE40A6B7AD781D0C1FDC59AADF24102236C3CFA16EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1374.incredibar.rul

SHA256 e971aee2f4fd07083ed49a42b087b59ab6fb630bcf67b05883d61d0907eda7a8
MD5 84bf8d62963b1d1070448b619d86f617
SHA1 809b0c69f46f765c326b944ea6d6d441014f4d52
SHA512 a02fcd35ec6ff78a1a14abfb7fc88ce1b29cf684c5f736f84d8a160c644f94302aaca3504dc267da690f7c6ca044fa7292cafcb1611e2092256f2b990099a1e3
TLSH
T101515B44BE2C921DE47326094789E5152FBAD6459082FDC68AFDB20248266C7CFB27DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1375.searchresults.rul

SHA256 a9df9a42937446487475e0420081efd2411d297598e6eafdb05e876a943f4a93
MD5 82b8a1ef640464735ab6482ca4ea6ecd
SHA1 3b6e35ffcda7417f77b605ffb061803b19254551
SHA512 62cd8718041ae80488ef56ef212b99fd7b071c1cd0adf47fb1214cd6d0e5d1a87475c85da71d0d9ba5355e3ef9a4fe8612f805e44904783172925a4ea2383f56
TLSH
T16B61D140FD84836995732704AB89F4092FBEE7158081FDC69EACF18145266C3DF696BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1376.widgi.rul

SHA256 a43f6161b06087b555a7a4d30802a1bffeb4f3c6dded6868f1717fd1c49840a2
MD5 df790538c2424c7b6fb08cca1f7af9f3
SHA1 c8983044a2c5166f7471682ece866a281188dd33
SHA512 bd9555245430410479342937f6b5d12dc18398a19958256ecce8f228b5b7cefd0222ccfe9e1dcab0e2d29140401786d67a3c3e42ecefc57557d5f6fc3e65c3f0
TLSH
T12751D010FE5943596AB3210893C6E9542FB9DB4180C2FDC69E9CF18251235D7CFA1BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1377.webalta.rul

SHA256 8714e74715f4419f5142694594d1d5d32ad8cfbafcb4190dd92c7d14fabd8789
MD5 988adbfddcf2283704de8a644ea4fd93
SHA1 f0a95741671bd741b7bc61ef420241ac42fbca49
SHA512 65a19c3dd67e615784788e5fffe40f6cb69af0b2af25d28152b74164b1a7bd384af13f4011d9a22da41003921234188c262e415a55b0f7816abdda1fd49a166b
TLSH
T16E51ED10FDB98266B9B32504B788D4011FB6EB816482FEC65EDDB30151175C7CFA16AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1378.my.rul

SHA256 53e0c693be3d082026eb5e13c38dd85ea1b76ad804538ccb0a0a19504d926afb
MD5 607b776daf92d232273c36e6e2ba5b88
SHA1 a83d57337eed74b56a1f7ba1a9a87582507763ca
SHA512 2a38a5818c94fd3d119274f2cd5c06266174e8318fa0402db69d25a17f88ac21d66350907ad4b1616603fd7db8dd84d4d1b5b4bd6520113710d6ebdb55e47d1d
TLSH
T101518050BE6D4609B6732708978AE1152FBAE78694C1FCC599ACF10111265C3CFE1BDF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1380.bocai.rul

SHA256 03103136e01c9c70eb7c5872d53b75066291c64c7ae36a2469228ad2fa62bdc8
MD5 5b3fd0d53feedaf61dd1ebf9d10788bd
SHA1 703ad55181d43c08520141b98e288e3bd71edaaa
SHA512 2a0ebc544b5a590df380093cc65975d469b7da5f90d0550c735303fb41890bbbd06df626391d9f30e58cdd1673b45215fb30061771f460cbd7e8a60dbc50d235
TLSH
T112517C40BF6883199873264C8359B9042FF6DB469482FDC69AFCB2005526DD78BA52AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1384.coupongenies.rul

SHA256 153709686a36844fb1f011831b6e359e8e0eb88444b0775bd926fe9c43664e07
MD5 09768ee99effe81e337f6ba980890439
SHA1 f1a9a36598c85de3112bd46febc7c609cbdbc816
SHA512 cdfbdef05f397e2c547bdef827303ece64042366aedce7c4661084ccbae01f8c6ab7baf07d2619be1af723ceb043d026958672d60b608260f777600a2b8fbbeb
TLSH
T1F051BB409D21D114A1B3102A2FE6EA0C2BB8D212B552EF9550D9EB037527DD7CF682EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1385.perfilunico.rul

SHA256 c72cc7c29f6529034a20b4f9e0925bb45e607fec87fce4a44f06de60ca1f7855
MD5 c4f93929b1db1da0c0815c6841ef6421
SHA1 db12468a7e6dad798173be63bc9c93cb18ff0269
SHA512 c3b3dd981fd79d233b290a1a7a2b6a0255c0b1d9f6f69281f6dac0f06bd9b6297789b43a617dbdfd09ce243a468e05befa80a1eb524d5861ce9e5c99d8bcbaed
TLSH
T10C310D50FD148115D9B3A804078AEA003BFDD723B001FE8969EEA240225BDCBCB663DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1386.ytd.rul

SHA256 8cde3c98ecd74479bbd0a331a629958f084b8c9deb7b943ac9ef08d829a4d322
MD5 d160882c9e5d775c4b266860bc7c913e
SHA1 b5b48f1bfc0c394480417720b73aecbe4a8b2f58
SHA512 b5c46b777adef84c508fe4255551f5c47dfa5a9c65530fe03c44f1ba38238939b93c75e3838b15ca1b7da818a6b03900a434f593d63c7155c910d516ce9fc46d
TLSH
T1AB41AD50FE19832A956325084385E7042FAAE75290C2FED65BEDF201911B5C3CB667EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1387.ecuadortv.rul

SHA256 54d3216f067786977b4bd48d53b5ecdb13e7cf0056f3c876598fe4e8d3383a3a
MD5 94f2d109a1834e5df2a537a5d867b0df
SHA1 3e71c54a6dd68f909743570faa16ba7b328afd3c
SHA512 897fdcc070409b8cae297b36a2fae015f2cf09e8ebd423322b476877a14f705e2cb3b826a265ca2798d789b0c75327581aaa4827ace4cd434bb371c827e97353
TLSH
T1DF51DC81ED598385B6333908C785D9051BAADB4380C5FF85AD9DB20152672CBCBB53EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1388.sunriseradio.rul

SHA256 d53c2d12053caf09a848129873e7c7128e0adc675d910725bf59a9289cbada62
MD5 0c2a25b5f051113c1a72470b34f1461f
SHA1 bdc02bbc0f391105cb2fe67d54e8e579163d71e7
SHA512 89a3a6cf46bc9a29cb773498a588c3848b9155195923727cbf46737ac92239d86680091140866587897e447ccfcd1a9bf246508880914d6655751add5d7d601f
TLSH
T13551C210FE184356AD736644538DD1042FB9E750E092FECA55DCB280891BACBC7AA7DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1389.jhoos.rul

SHA256 2f5908e44029146bdd20f3b75292a24968db334c67f4b6d005a49f346fea23be
MD5 bb26e57cf404205df5d0bdd2eb679acf
SHA1 80a1c0f07c43b9dee3943392af31550867b9500a
SHA512 df7819bd9c71f7458c76dde04dc1f2095b2555108a733ce031dde3d27314ca1eb855c4983844fd01e1833b1617a04a6eb7233fe68c39cef1c34fdfe470c8cd43
TLSH
T17761A040FE598219A5236214A786E1652FBDDB91C0C1FDC6AEACF60011136C3CB72BBF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1390.thoosje.rul

SHA256 f944945923c78b9e00d6d22e3cded5a7c48399e868d148595d2470e2186c49b7
MD5 f923ab5a8955225c32b329b0bb98eabc
SHA1 df9bf96093446fec8e671fea7bf21c05d7513231
SHA512 f106d787e48b42f539f7afecdc9407b30faac9c1f78083cfef3c784fc80b8c8cac6c283f5dbd4ecfd8057cc55166c64a7fa50dfd566f7824b5aec494822f0f7a
TLSH
T1E971D050FD684329A57366049786D5053BA5EB4280C1FCCBDEECE101601BAC7DF617AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1391.spesoft.rul

SHA256 572f34e2d97a9d13436381966179e03373c3f98e74f45976b2bd69e945d57c79
MD5 6a68813fe054265b3d29095780b61fc5
SHA1 0ffa4d7a64290f4eafcd7ae662817e95b1fe4298
SHA512 448b40b180bc8d5f88239aa5e802d3014ef3e4e6683e2dca4c873fd4ade6ac95e7974c6960aa90f3f9f1f7cff87ae6d6008595ec14929840b5af1e430b7ce7f5
TLSH
T19141CB00FE988265A473150B4789D4123FF6D3869481FDC6AEECBA4122272D7CB657EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1392.wkrk.rul

SHA256 6e40bbb31a2a2d004ab4c3d42155bfa05a1eef332d60c25af6bdff108f2dabfb
MD5 1d81460258bd9b4d69f54452d264c20c
SHA1 0bc120f490b1408455331fb53a39cd495470e27a
SHA512 e4ab510fa252c457a9d95a41812dd2054bf3733865b226b06ef8fa20102631c917efe7fe2449a8d34da32dcfe5e62e1ad6b34e516b8110f945b67fee95d0586f
TLSH
T10051C050FD5C42A9AA736249D349E0041FA5D781A082FEC699ECB38056175D7CB713FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1394.omgmusic.rul

SHA256 c9f577592a7952656acb972b202f94605a4f46995ddb85c7178d25a90dbe75d4
MD5 fcd818d6fafdd7aca7bc1f23d49f09bf
SHA1 7d70b60a77b4d9f69ad4296a98c4815f9e9bc187
SHA512 409717004e7b06ad58576399332fff853d4441fa811bbe7b0b343ac75d48ab682bb7bd3fb7ecc620ab6a69138a7f556420ed0e0f5f5b842ccfe87ad42597ff9c
TLSH
T123519C114D30486983B364312F77DA0C2BF49A202063EBA501D8D646333ADF7A99D3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1395.twinkl.rul

SHA256 d4dcdf791f84b6a17d1308ce36933615eea2fa8dd3be28f79ad22f6e5e743811
MD5 62a86cca490f54915dfa99abb3301b0e
SHA1 09a54b2ad76832dfbdc2f9372305bdebee8dd438
SHA512 59b7452b2e2549c0bfc8dcb81c15e4a45537a891b21264560087f9674fb70b01e15560414f0fdd39b40e009cb2f68b6b830e8456174834d4d80ae696fa09e650
TLSH
T1F551E110FE68435CE47376895389E05A1B7AD74290C1FECA8AFCB18045266C3DBA56BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1396.bringmesports.rul

SHA256 25f5d938bc253a14ae3218ab6f4c25cd4831ffdac585c2a156a9c563225e4ae3
MD5 1505a0037f71eda8f2a6699cfee26639
SHA1 cbbd44c4df5c315661c3bb3981d7321474342a2a
SHA512 5807a500b5ff83cb80850311a56eec195abb18f2cdcfe695b08363ca8d577d99049cc43303884ebc00d706dbbd3cd684df800a78072682126f295d068c5dac54
TLSH
T1D051C020BE58822AA633650CD385E7011F7CD742A0C6FDDA5AADB24041176C3C761BBF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1397.utilitychest.rul

SHA256 1589bf5d010d1abf526f931cd0048f608f41f9df5a94edbcb09e928ad6daa96b
MD5 d494af5a238688bcf29a58c7c57a4487
SHA1 1a22634ae8dffa5e1219f723155b9aebc6aad299
SHA512 12ff6fe0032c602899e7d764cc0411c9b7ffb85998b9ad7bc95fa2842832f0a43e5123683f75f28e7ae0f67d5d1457d96478c1121b49b27c0ddd364d657004d9
SSDEEP 96:R2UfrpkA2xg2PQIqHsiDXviHmvCS0AejQ3ViFi1Xl3EiIWxWqxcxWxKmwF5seJeE:D5XCS0AejS+83EfdWPJUX
TLSH
T1C0729DC0FF95D6680A632385F3A5D610DF9605C2884C38C63BEAB65B82B85C7DF5139D
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1398.retrogamer.rul

SHA256 2d23660c3c2fb7daf6d8f211f5dd7c5b048f11035697670aedd701e05dc9cea4
MD5 f837c7e4ae632169063ba6412fd1244d
SHA1 540e348bf989c7448cb6ba3cdfd19ec92393b6c4
SHA512 da5b9c1087a65579ac6e7d9adaa45f0cbe1b980c5d9dfd518a1273c5a2394ec0a839799c7493688861d50c7e0d74883188c75d6d576efb80afab5dcae2963bf8
TLSH
T16A51AD40FE688328A9732608978EE4101BBAD6529882FDC19DDDB24151177C7DFA26AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1399.pangnradio.rul

SHA256 bf482ca3f2d567682570d7a672c7cfe777aa5cccd4bfd75c34fcd8e3dd8f4c8d
MD5 db58f95efcadc3c0278456f4cbe5609e
SHA1 fc83932427e80d710e7d261aa74a61a31222a625
SHA512 58e714136158a59b872b1a78d6588df4be0c492fc15806b1f877e7397dab8a1e2ea8a97772946c98250574e555b2d560ee4514b33f51c72fc4b5750b882c1c36
TLSH
T1D841BE20FD1142A19073284C62D8E9082FA4D752E0C2FED649ECF3815A1B5CB8F756EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1400.appbario13.rul

SHA256 d884818f462fa52541b39aa747311bfa4999230f621f0b7126da756befbe65a6
MD5 c56f3c78c94b27df08eb8da74390775d
SHA1 b60ccbbf0e1d56196e587b42c126bb547d6048aa
SHA512 ac7d793daeda2b44caf8a886a6bb6e48b464e01c39180d3bc5f89f044f837c4b649bf5c154b0651932e0e4cbdb5b732d05c4210fcc432bbdab9181e4817aaddd
TLSH
T1F141C840AD258215D473234863CAA4123FB9D7A69081FDC6D9ECB30151336C3DBB66EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1401.tidynetwork.rul

SHA256 31e319b6e704def12802ac3cb4ae778e20f24fd9a6c37da64b141eabb7f62be9
MD5 12bc27c226b9323a79e0592bb704554d
SHA1 4e58a7c9dbf9d09d433faadd397d54a6aea96fca
SHA512 082ded42c881a6b722771d3519953a6d9216b9afdf85096a5448b61beda09727481181b264a041228e25001de8b403d938ffb9e3d90e2392f47851d97592d910
TLSH
T19E21EE02ADA9E3425473E404F344FF106FE18B99D0C4BAC70BCC9A152275A458A2C3EC
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1402.legendaryreviews.rul

SHA256 6269972f576ac2330e02ede91ed5cf4db2116c9d2c28ff506572e9768ea67451
MD5 2bf102ce9512f6312c3eb2549d80110c
SHA1 ad6a6a1d041f04af2db6eeb1c8bd4f4e81a6fdc9
SHA512 50ca122d24c7c8ece47040c989a6c0dc9a79251ecf8e74e83fc1a9d03038a259d5b2d748584371f69afe5758c973a825c546d20ed4d42f7b4ab2bdda71deb2cf
TLSH
T13441E3C0FD94824594B325184B9BE5042F7AA74190C1FECAAAECF301606B9D7CB653DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1403.isearch.rul

SHA256 abbee29385e2df86cb7495fbbe07366b447753d046372cb359027931f6105901
MD5 fc97415087a916049b49f163e6ddd80e
SHA1 78eb7d22a385fc13b6126efb6cf494c7f80db43c
SHA512 3e9321a018fa5daaa73265a49e2d66a384c1cc64d9bc8a2270933648f76f44f5b77437c9e381f97241ecd509c2ca106ed616849069a99cddb565afc5f5b2a256
TLSH
T1EB51D050FC9AC256A973A9004385F9043FB6AB56D041FFD5AEAC6201601BAC7CB793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1404.quizulous.rul

SHA256 cdb6fb380f98e68587a62600949b894ed4a1265a7b733eb91bb11659192cdaa0
MD5 20ca90092ae25f90bc0f1188761e9adf
SHA1 29cd277e42327e653075e1501c66f7774b424709
SHA512 6ed69cacabcb398c2d38ff545ea0fa4335779a9c51d2eab159c67b4b202fa0953616d6ae635c847446fe0677116dde7240bd88b9499729624c92eb2af81e711e
TLSH
T1F641BB00ECA5811DE8B365195BC8E9093FAAD795E042FEC689ECA700546B9C38F712DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1405.myfreestuff.rul

SHA256 f5292982b0d3e35e442f49f61f10b6dd00b6dc2eca47102956373e2454342a95
MD5 7558080b6817507d3ad1130342599c9b
SHA1 e58856d852509aaaf0746c09df330cbe1eea76fe
SHA512 5c888c37eebef4f47bc15a4e8e1f73e52211be88fce7ea1ea71d85ebf7b9a46631ab2ba9366de831f37d46d9af03ce95fbbd35d365ee49a115ccac7ae8c0a8d1
TLSH
T101415A50EC25D2B5A5633508938AD9041FBAC749D182FDE746FEB60062276C7CB683AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1406.wiseconvert.rul

SHA256 68a935c425d8dc7b1af3d972680c0a052872ce783267b56ebb20b8b05447e869
MD5 b5d2e96dbd5750f6f6e396f03a8a6375
SHA1 28c51907bcc6760ffc448414cbc7357e5af5e408
SHA512 18025d99245c054a6b05bcd4ee5639159e09c14a8e4cd0772813fae4c27e0e9b1be4cfd6788d7255eb3699bec1c971b286c48b940a19b6c34fd721c209c9d439
TLSH
T1DB41AC10FD1882249D73A80883C1F1146FA9D392A0C2FED919ACB301651A5CFDBB53AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1407.mefogames.rul

SHA256 8dc68bcdcfda135ee634b200b7b8233ab26a3c590b1aa6ece4ca65800b39f9ba
MD5 52bffde72b9790a99291d6658496af54
SHA1 927acf869aee24b95ff88e59432346b215f6f2f6
SHA512 3f87c7fcc1e8afcfbe3e8ea61e58322f0d03ed0379c72dc890df07a12b6d2ba998fe8e7e3778f28dc0ab0cf5042b71a3414377f0ca7791b7c443e5609fd7bb38
TLSH
T12941DE00BC28A225A57327185BC1DA151FB6D281A082FDC56AEFF34112278C7CB793EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1408.quixley.rul

SHA256 88c22b52d066c77963669139868c23e214bd9291072206c89cc65f4ea434f79c
MD5 3ff3a95ac8a6c904a9de8aa21b8fc791
SHA1 4409c7550377929ca91af8707c846b903acea0e6
SHA512 d0e770b2d88504a9132983ca33a67c007f591856cfccc1bc4f68e88a511d1f879122692b7ed30642089bdb7a16522dc580ce36801f89f44c5d337d5b20a40856
TLSH
T1CF41E110EE108659DA732508678199041FBAC766D082FECD6FFDF244192B5C78F213AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1409.mininova.rul

SHA256 a164d72207d1dda89c2ef9a2037b010bfe54241c4204be03f5623b2ba3efb7bb
MD5 feabea06b174b6b956c250579cc53439
SHA1 40f5a641c4de33fbd5a71ceeb8b8e12bd636e4ff
SHA512 6126c9aeba5b24425ef6092ed4009506e50b45fb9e6f0235d4973917b7f441bb1ba8e3d98615e9338b371fa63ee0234de610341445e355290f2d69af5d8b9d3a
TLSH
T140418C40FE294379E8737A04438595052FB5CA4BA083EEC9ADACE34164375C3CBA52DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1410.freewinturbo.rul

SHA256 15d6517b6c0fab09c2a884ceff8177ea7b4c5fc6591efcb074467276c45e79cc
MD5 1f7af105382bf1cc7631d53ef3bdf4fd
SHA1 4ff6e3e429d9cc7c20e977561459dbe50a477cdf
SHA512 196991e474a30896173fab91dd6c1e305b9b7357abc9056f24c7141955382b1a3508d85a1a1c294a9c98b921a60a22ef03f771104e1e90a87ad0f98e566b5cf3
TLSH
T13F2182965915811C0F6A408C7791BB868FF9C63835DFDDC3D189E84829EE31D73607D9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1411.falcosoftware.rul

SHA256 ef975945dde0d84b32456905928f668f80cb27181be171506f8d0bf198877918
MD5 de7ce6053ed291b0166921b07aa619b4
SHA1 34d0514165b6ed7250353c0ee73d421b1e478341
SHA512 89b511f24a3a97fc1a206b9c9e62a92be9452f936547ad5d3b8d6bc2e30b82bb00ece4a7ef196ca0e404257ab78800746e1b9175fdda997c60b993c50579ac25
TLSH
T1E541BD40FD18431499B315189785EA002FB9EE86D0C3FEC6A9A8B60174279D7CBB03EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1412.pchelpsoft.rul

SHA256 7a822e6275e52f6560a0328c3979196eb8a6fc39c94349d105baf25887747666
MD5 436c9fdc85ed09e7600505e9b1767a0d
SHA1 ca863ebbe4188e5b628f858de81447e03b1abdab
SHA512 bb11174259c8e74e245e6062d98170f59b79c4f3922f85801577cced5415d3303568863fa069d2503a5b058d46b6c97358e1e069c0ec379031bbbe5137f74de7
TLSH
T17E41CD64FD248240A4B32704439DE5102FE9E752A182FF8D56EC72026126ACBCB297EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1413.playgames.rul

SHA256 dea26884af1b2386833e621d445f4bb262a309ceadf4e96dfeca7f5c5382c69a
MD5 894bc0b87c997de42dcad92561ce6bcd
SHA1 1e2bf0413950184d6dee9299b94ea9677531615b
SHA512 bbac8db764f2b93c50fbd0405ad97943e5cbc14ba0005771b8575ec6a1ab7d9180fe4a83024bffc8e9eb67346e77e758e36a149722babfd9ae6a864c8f2cd32b
TLSH
T18441CC60ED29825598B3A60C9749E5481FBCC295E4C2FEC60AECB20159275C3CFF57AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1415.phpnukedu.rul

SHA256 faac7e53207e813d65c842d8ab2e1ff451e6f410f6fcaefe6be15649cab654a3
MD5 f9e56da1d943034946041d82668fefd4
SHA1 0c06ca87a79f694c15fb3bd22289da191315da09
SHA512 69db0d0c072cf59888cd8fb52d1616271be255d4a43522f385592cbfcc37b4b6103f1e265d6d8197c2eeef4137afd0a6ac2ac1dd291303b0a45afc95b4d8b4d9
TLSH
T15431DC50FD158151B9B3251903859E082FA9A343D081FED97DF8A740627B5CBC72D2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1416.topix.rul

SHA256 cb0bba18c35205389a31f4c42623a4de876c64a05e60d655843e93388c053d22
MD5 ffa385f71abd0ed7a21d92cb108e6217
SHA1 762ee2e25f1ec1b62bd0789cd5136d2deb27241b
SHA512 f503c24663f3338dd4abcc7cac44c06e9328dd9417857a1d116f897c2edca77aa254b3bccd388f68cd46533d6a62423e7136c765c4d4479b0450f0dc4db76dd3
TLSH
T1F6418C24FD588619D97325048389E6053FB49B4581C2FDC69AECFA40142FAC38FB52EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1417.nectar.rul

SHA256 1f8a53e3ab9ad73ad2e0fde6631d592325842fb1d458c5c863948eae8896e427
MD5 f222715bea8b241ab050fb73ddbf8929
SHA1 c2102523e7368c71b100b228f5a4fae465cd0920
SHA512 3743de83ecf41a960578b7f97e601f803a9cae8166c82e0a8b76377b63a7d4772b93a6eed73a165f18770e0e07a95c7a8e0e2264e3e9cfd21ae294f1f8e759c4
TLSH
T111516A61ED3C4515E4B375090BC9D9042BB9C632A042FE8A55DCF241A17B9C78BB93EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1419.miniclipr0.rul

SHA256 cae3fbc85cfa7a913fe063128fb09d5b60ff3f0d53f44d8d596e16c3fdcd9aaa
MD5 5bfa0f5893bbc143767421b9c5c4dfa4
SHA1 a65de92eb38d7c99cf190ed09aeef0b544557146
SHA512 499a87766007888153da2529c6882fdd0920a3e8dcea125c4fa54f335270d45c03ef9d837a1021351c8c2cdbf6bf54382cb14bbba62f5f50f83d3e07abf19093
TLSH
T1E141CC00FC158729A4B33909538589002FB8EB53A082FFD689AEA2425917BC3C7757DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1420.myjobs.rul

SHA256 bebb14641745186e1513d6e250b11ea05c5febb86d53f36bb0df7d031c0c5e23
MD5 50819e2acd30d0076dc5b156042ee224
SHA1 00849bf65c6fe0f9d9bb25f0c71df77d2bd64e7e
SHA512 49eb2be58284007af9a87a007cdc26a85d0a5eb9236c56698365cae538c12a503f7e9fbd7d4772dd3054225e31653224441d8bb24d518bb6c06ea6498070b625
TLSH
T143518B04FE944258E6B32718DB89D6003BB5EB4190C1FED55DEDBA8014275C7CB62ADF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1421.bundlore.rul

SHA256 f53f71b3f5780e5a0add1cc9c470da3abd500d581728628a9f86533c0ca0566f
MD5 3633b7828b003148e2e18f34405b175d
SHA1 8f05c22507216644123fdbf0e8759f2608c1835e
SHA512 b40dcffc576baf2e5ec2b1504a78db6f464a92c76f652430c076766b9d6c5e9542d54888c534afa6a8507e9cd946b1d2a144e971fdce1957caad9a25d6f9d1a4
TLSH
T1D9519B40FD58426AA8B376485389D5053FE5DA45A482FEC54AE9F20065235C3CBF92FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1422.estaciodesa.rul

SHA256 d3c5f02c5544f4862261238eb9c509344d7b615b1859b89737d83b6a02c368cb
MD5 70713eb3761810a28c2954f1af968d77
SHA1 b0c69882d133b26fb1646778b287892faf79da43
SHA512 a11286d26abcccac8ca287c3e25fb1a7e9494706059f669dbda9f276aa08e71897637561af527c063759ce83c6cf1a2cd6780a8f139228e88738f2a1c8bd7117
TLSH
T1B751C041FE684659E9733304A34AD4502FB6DB41C0C1FDD64AACF20054272D7CBA6EAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1423.yourtvlive.rul

SHA256 e6a56247b0fa14d51febc02a328f9e1b3612c2480e5c3c60df03266e3b29b340
MD5 43eb604bc7b1a5adbfc248d4bb9adb19
SHA1 cf1c8ba2d4e166a7e5cf8bdc1ff69270c80054c3
SHA512 6ae675939c8c387fdcc7a04e9b0b8b6bf2b494d4e8179b0ecc5f1f858b0fcef8fd093e6c3a1834512aac549e37782635eb259f48e58e0c62678881a5a2921c64
TLSH
T180B012B33BE78AF51F1B1478F92AEDB557D20056900132053BECFE2B297134010501F9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1424.browserplus.rul

SHA256 1ce0db412067075ff373753fbfe6406a7f245c7bf24a574a4b9f5357ca24a4d0
MD5 db9f7a4d033eaddf38c27e97485f0548
SHA1 3698a35496b97ecf860f03afc01cd86dfef632c8
SHA512 cd895e37dfc94d47864777307c1f100a2b7b4efc0609d42e82d135fdcfc1e0f711eb01c95c15ee310f5f0ffe6ecf9af62ac58062ed90242fdd7d2f1ac1a8fed1
TLSH
T11C51EF11FE684305AB7323885F86D1043FB6E7469081FCC5EAECF04006166C7CB956AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1425.worldnetradio.rul

SHA256 639fbcd6eda6cf157c9476ca825389da577fecdc8154d04347220ea1e11d1dc9
MD5 5a1d21185510a52ab48293a05b650da2
SHA1 a708cf040b01a24c762ac027647e50e381cc5eba
SHA512 94962f7d38c2422b785a5d6fce253aec407825ff9dec0b0b08e239b6df56800825688f1589d27763069d5ccd4b2c957fb5a172e2f0599aa789a93be57ac396e7
TLSH
T1E2F0D6533FEAEB670D272998F2AAEBA113E206C4008034834BBC9D4E323565156347E4
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1426.mapit.rul

SHA256 a3d1897f8121c217dfe79f450ccb85fd0716038331e05b8e2346297a2396aac4
MD5 f950cacb162a4d87cf41399a164956fa
SHA1 bee1d8b2f87953b5e86b3f441da44193f2089c51
SHA512 fb1756a4c1db84566fbd2b429b9abd052c4236a0939d7814fd3ea3e086219e1aefe5b8342af798c063b25dacd6434dcc008aa95ae797c8200bbcda8173026697
TLSH
T15551A141FD68825568B31748A38DD5043FBAEB42A0C1FDCAE5BCB25150176C7CB62AAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1427.manualsforall.rul

SHA256 a19e3f98ebc0a82625e207bf3fc2ce3a6f8f76ed6e1da4afb3de0feff37b3b20
MD5 622cd3d2797606f065412aab3b8e9241
SHA1 f1f7f18c601a605567274a7469c105833e690364
SHA512 bb983b136d11d8c1cd6ad2a73bac1657796a61ef3948afe8502fe5120ce67087154510276ee357fc89da0b4ea3a1216ddc7b94bd19966c5ef749fc924fbcc2dd
TLSH
T19041CD10FE1042169A7326498789E9002FF5D34990C2FDCAE8ED7201265B5C78F323AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1428.trustyworthy.rul

SHA256 269ecc4099b3a3a36172e0424c3a817fabc32576718c448ed2db8fb903ed0c6f
MD5 4703dcab2d0c3a65ac869b5e7251c5f2
SHA1 f79a70aa1a3ff19ff0fafe2d55d3250560db31b0
SHA512 779add98a695bc510fc0d86506a58709d575e9eb6c6b265b4a4e5bea68de794ed690f96ee47690439e748577d4ef65c955edac157150e09cbb78a54b1c39c14e
TLSH
T11D51B980FD18835D99672608834AD4002FA7DB85A1C2FDC7CAACF18151275C3DBB67AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1429.webgoradio.rul

SHA256 41ed17f2837f66e51e1a7f001a7d7ddcabb0d27f755f1ea686d340b2a8a16127
MD5 a36a6c3b0000f948f6ebee95538303aa
SHA1 f0e77752d10afea5dec12167288888cb142abada
SHA512 a716635a52c486cc60458cf044f8cce9a7a3b119a45e44d974dc6718398c551f9f1811180cb17df347d92663dfb961c6a9b8a0375ba0e5c33a1473f0849c691b
TLSH
T1D441BF90BD5887556CB3260957C999082F75CA40A082FEDA0BACF38251172CFCB677EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1430.couponalert.rul

SHA256 e09a1c680e7246eb8aa5f8538cb2d1c8236a7bfcdb68cf73b1e162234a6a9bbf
MD5 fc81901c9a73412eff7fc86b96c8ca1c
SHA1 b0902378ad718a1e80fb611bb31c387b97c88747
SHA512 551cf41070d0a17cc560e9904aeea4d61367c88b31f21bd629cd66f083ded2097bd964e4f3e77793dccc0dc9c5efc0f8c57e693ff55de93f88e4eaa163ef0624
TLSH
T1FEB0122627DB8A772616ACA8F986DDD743A2175000033103D2ECDF5EA77275450E06FC
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1431.tvkosova.rul

SHA256 1a181d035fb88a174e7a7053684f9688a35b79b10574b998a1986c83dcf4fc34
MD5 773f25a477b04590656a915248866a37
SHA1 0ab6e4211bbf56dc0be9f55ccebaf10113a971a1
SHA512 4e8800f9939ad4bf698358345c8d8a3857eafb420f1a952bf0b028842412b68a459279de776956fbdf0142dd91fa3ad6dc3ac76e0ab2264733ed5ce791cc535a
TLSH
T1ED417C40BD288225FC637108E39AE4053FEAD7544082EEDB59FCB140591AAD3CB657EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1433.homegain.rul

SHA256 c0c62599b92d08ce226d3a1804ea220a87856a24b16a5ff7c8d681ef7b994d0b
MD5 44085dd62aef60cda57029eb58979e3a
SHA1 8b52d7789e3e22a8d7e0f2a07dcd9eefb4c6fbe8
SHA512 4711b7d28c40464d8024f5ba880fd2017e826a9aede70612362539ad8a1a1c2ed09216a03ef64feca8664225e708cfcfd8c54d822a6c1081c15dcf9b5a81b5a3
TLSH
T1BB516080BD6842189473260C578AEA052FB8D695E082FDC58DDDB3812517AC7CBED3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1453.betterads.rul

SHA256 7f2bfb59d475b5ca700e1f4f5308f50702296e0e0c5a8c07445bfd80b4e9070f
MD5 debb3aaff12eb0fc1ce85f5b3c75c43b
SHA1 9ccc628c0f72413e74001357aa65ed7b39569744
SHA512 f3a6a3b890ad2e91bc6f9d689ce5f567333d44b1d9e3c82b5807abcef2cc0c9bef1f592e9dc1db14332277a6d0f588cf78609a5e153800b0033772024595e236
SSDEEP 96:39EURpvlPFuSVz3nzB6p+rwS8NyZZySM2wYEwujl08cyov:t19zUpAGgv
TLSH
T1D79113214C36556A1A7704041FE1E7102FF8CA21B293EA4808E8E643733ADEB58EC77F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1467.linkey.rul

SHA256 fae23bb46ea7d8b132726ff1bc2690c85dfadba8d44e7c96a04a4458469ee608
MD5 0b550f94ae69352c5c3a0f36999163bb
SHA1 5061c9a0cf36c4a8e8e3aa4d1b2bfb52cceaa0d2
SHA512 31008f305e1df27725072ce3934a8afbd9732cc35711683fd829e7143ba86621ccae3083031ac9e7bd2f157796cf14f62aa2f7e8abc82dfa25512423525d4297
TLSH
T1CA21CE915D686394DDB328018FE5EB007FBC86719186ED1618DC9A8222379D742BC3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1483.kurulum.rul

SHA256 ea076d3915f58aca14f272f5f90c3d19760ad067074ca09ab214ae53e6ce02ed
MD5 0c5420d3eb89e66eb3f6b51d8d1f6f87
SHA1 3ad76d5a069da7ad7f204e7eec781a305b4b54dd
SHA512 5ce6d364caee22402b944b8e4bb989b97e42157b573c4026db68b416231b49bed0c92ed36d1e8fe948fce39cd41abf16482f9df3d37847213c5232bd7425906b
SSDEEP 96:v4bayEpjfxD6RcNrgAcBErpFQ83nJUkXDsxDFVY+9oX3A7yqIDpZOyv/swJwkshu:UaV6+rgAcBKFQksFJg6oEm
TLSH
T1B7725803FDE36B690D421684F7F5D7206B960D5680CD78C51BAD798F12984CB8BE23AD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1487.eazel.rul

SHA256 8432ebf990a1fa9d33fc5a6425cc4422a0a367c069c400e96e10a29136e68f59
MD5 7dac46071664c92b0a719e477e115cee
SHA1 4d8cbc2ca23a119624a698ed3497057ad5a87184
SHA512 15080fe560079038e606889b227a2984fcd3e1293007ca86265a111979d509b3b298666a990e4cce9c339a609d0dcc9229a9c34cb1bb6150b8f575ec3bd1cf65
TLSH
T19351C151FD58830964B72A08438AE6042BB5D64590C2FDC59EACF2001457BC3EBF9BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1489.desktopdating.rul

SHA256 a08849cdc9c335fe514446960e971b898cb3a28462414d7dac6cb56a49b539f9
MD5 6a81323740c1b4bcf02c16613728a092
SHA1 001ef6cbaaaea6d68c30eb6811725983f92648d0
SHA512 29247f04eff8edafcc89d0c7ad9601b16bfa5b6e2420338ddfea5512366cf4a2d261dd5247df71711ed91a83eeeb4322782e9d523c1dcbe518744cbd962917ef
TLSH
T1D061DE01BD98C26864732609D786E4006FE5CB5690C1FCCA9EEDF241861B5C3DBA97BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1491.dlsecure.rul

SHA256 01c5318a9e5b339000724a76d5afaffc59eb3e7dc49cd625f433092d4ffd3c08
MD5 f30a4aef7e2791ea4976b3b63c3ef0c1
SHA1 630171fe99807e2bd164844f5e7b31c208d0f1e8
SHA512 3fd755c10b4999445e4c4e9944b286993c0085ab75dd4fc75164aa27eee16bef609e7a17298571d7514612b136cd8528f4a092ee1376d7563712d612e36c25c4
TLSH
T1D4510311B9658245943378042BC4EB453BEDC561E086EB44ADDCAF02612BFC29ABC2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1496.recfree.rul

SHA256 89512b7bdf2f1461d7cc7f266282223578460fd05f57823a9fa96772931f6f59
MD5 010fbc486773f5564328cefc99c01d94
SHA1 b93ec36c93c140f60d456c4c9dea471a95a78447
SHA512 21770964ee0d90a02009cfa29064b2b593c04c1a38b7826c38a9298b39f601c52d78b3488decfebfe8d1bb6bf8ab4c1608601643a893ec560ebd08c79ff0bab5
TLSH
T19451E041EC96C246A57339004398EB502FB49397D080FE8AAEEC6742215F9D7CB293DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1499.mixchats.rul

SHA256 fdd2370e6bb17b6f86cfbc82ff5792db49ce815303523675d049f576946a6253
MD5 9242f651f291636ec67daf9efe4048e7
SHA1 1d509a13a98cd3ee1e8b93d7b5a2ef46fb9e5f09
SHA512 a47238857e2d34881b011497037ae10ae2efb51c3a4b0f68771e2df8504688569cf7b6d342377b96b950e954ae7e2c58dfd4176a4f303e98226028668c89fba7
TLSH
T1247167229C72456A497354044FA5EB0027F9DB61A283EA0911DDE6863337DDB4EEC3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1503.sparklebox.rul

SHA256 a534737182200741895ce73b240729fef505b25414c7783f388b4eff524950e4
MD5 bc4ea26e4c89b1856bbc1a6c47d34dba
SHA1 d07d25e95f676a7c0c1392b5a5d1cfd8b0cc1686
SHA512 de6761eca5c285e3baaee186b677f5b67f6ca93b8d067685006063d608c5dfd802f6b0ad57a01bfaa3b1192db9315f278feaa55aa66fab9f5406595e0f9a56ac
TLSH
T1EBC0227317DACE210A351850F11AB36102D10880000134024B7CAD99A23564010202E0
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1509.marketamerica.rul

SHA256 e8ce0e92625b83c7830bcc2a811aeea173b180618eb5193ffd6df82c7e2071f2
MD5 c035d7e0f57dcfa9888dedc821bebe7a
SHA1 ab07c4692400eafe1f2443d84564ce4dd29dab7e
SHA512 44f54211c43c0265a9955d7de38a20fd4c8becffb94a4b80aebcdb90e0a10f8f0af5335c260c68ed6124e1fd13cdf9d4a6226b22b843fd9b5e5aadbfc0654dc6
TLSH
T16951DC41ADEAC21ADA7379445385EA002FA49356D0C0FE826DDCE746222F9C7C764ADF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1514.orange.rul

SHA256 f849a8275b402de8ee560a58188f6c4f5d10f21bf73326537d3b203363105098
MD5 f10f47c57651fe931a9b140b6f67856c
SHA1 66a7ab81956a417002bd3dbedbfa4b48eaca99a8
SHA512 723b9cc1471856939df296326bbf411ebfa47dcc7b00826b002ac11540bb2d2e4540f4784f215a346947392fbb2396ff90ea438279f22d4c8fc6906a0f28f92f
TLSH
T18251DD41EC5682069D7366004785EA502FE99352D081FFD9AEACA301642F9CBCB753EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1525.levelup.rul

SHA256 f9b50f642fb9682bd020e59f4b2e57759530885379689dc9e8ecb7540620aac4
MD5 9044a97124261413f8c53c3e1a28f4e6
SHA1 0a19b6603a563289dcf8f174e4d479111393e155
SHA512 f14a60d0ccd82ac50cfd84d8f36a308f52660852cc10005b2df38bca259b1a1e031c0070aab9eeb849c0309c953722331e2f9e43b726629f6cb17aa00261a226
TLSH
T15181AB05BFAA8268AE232604A38ED1551FA5D74380C1FCC5DFACE54085266C7CF96F6F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1532.suddenlink.rul

SHA256 840e60cdaf6370b1c0e1e783cde566057dd11dad359bcb9385967f39bf1d8473
MD5 bad3ff71e6d10435acdb6213a34ab25e
SHA1 f759a31150c8086161cd3142f87435c067114c96
SHA512 a2d24fa0492c2ac940e38f7d4cdbea507950b16e87e868f81f88cc52ce9a7ce152e0b5574271e1e64a543410ccf27ac1201be3cdce59595d8b9d604245a1522a
TLSH
T14761DE42FC65811AE47375045389E9002FB987629082FECA599CB741E16BDCBCB793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1536.calculator.rul

SHA256 b3ae9ebaad9ff81ede565a40e2467c188507d9df368ff827409e77761c1d1f10
MD5 c833cd46cd8ef34c6cf0dbc66a23bc89
SHA1 8fc53b10197705adbad2714377e07852d03e6c71
SHA512 119647802ef6f3cbdd54d0ee3e91ab5a8679f75116f1982b523d4a86c349aca2e358e0ebfc99f697bc615dfc3fbd579c12b2e3c34da9b5c40acf7808536684e3
TLSH
T19351EC41ED56C256E8B376004394EE083FB58642C081FEE6AD9C6342611B9D7C7B93EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1544.bandoo.rul

SHA256 fd32942c90d825c35797c91e401c7bfe11a9b400faf7a0db8b794dfbc8bc1993
MD5 f909bc9dfef570f7269feb010c2a1d45
SHA1 ac306ee9e03e0973cf1750a22166ba62821011b3
SHA512 d749f18719bdd19274a15e553ee888ead40aff834987e8423c75170bba7c62b8dcca88ec50e3ed7971dad4e7d7fa2457f575eab92398f6bbaca110b06b1b6d5b
TLSH
T12201F5533BEADBA70E272DC4F29AF7A113E60A80008430834B6C9C1E333964055783F4
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1560.dynamo.rul

SHA256 11b75290419537ea30674484f1e74ad908b63e229305f0f1bc9c3d79517d5c36
MD5 371bde231f9b1d5c7dc760ae986f8709
SHA1 e7321bbfeb2de271aebbd40558313a21fd97638e
SHA512 f752d5b8a54100941c62be12d88d3fe579791651e34c6fbf2160b483c02cd5f14ca43c55362ec766cdadf080dc1bb655222c912b661268a0014ff150748c4b6c
TLSH
T118419F51BCA58106AD735500874ADA102FA9AB9BE081FFD15DDCF601602F5C7CBAA3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1563.limewire.rul

SHA256 babefa64c5415ae3f1061eb77db67128d68b984ebc638909f70cae338c3bb7ec
MD5 6e4941bf1653f13351f5df7404fa5cb3
SHA1 f54108975699d4ec2e44cc053a8d19583ddfca28
SHA512 358457fc959ec12426470ae697fc006fe3fb66b5243e791027cb5dbe9ced6cc39ef7f93d884f49be0e5c39f6b19442c3c55f3c3e4e34624de4203385b79a9bf1
TLSH
T1CF519604F969C298B9732509A78DE1041FF9E689A0C2FDC289DDB64194021E3CFE579F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1570.buzzdock.rul

SHA256 652eedbfd7ff12c6bd858a99fc98780bf9b6cc5a34b7cf30acf1c4931a70d878
MD5 e731868ef2d7e0b04e1a8d3eb9db20ee
SHA1 e513bab94fa267f04cc800d7bf9674447b1d5be2
SHA512 131c118257ceb9a6988917b075e92b48c00ed2ad762237ee2ddf2cddf1b8b72183009b6b42c2b7661c06d1e90bcfc094fe9372028dae08f12f9398e636cd0c94
TLSH
T1C04187229C3511AA4A7369080F95DF512BF8DA242183DE0851DCE2127332EEF95AD3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1576.rihanna.rul

SHA256 c01ed804bb8a1a0add6585820143579bb543b5eeceaa8476977a5a98dc08a5dc
MD5 af1fa8087461f58a76c66caa2e40f17e
SHA1 f23fecd03277b69f40e644e4288b04fea0e0809b
SHA512 0083d318eb391f29d42927a5b4648bb43fb76ca57b7100472e38429fe4d7351414fd182234c7e513cd5a3a12479ddc440d70450756aae7b466265f9e989594e4
TLSH
T18651F010FE184314BA632208A38AE4461F79D682D4C1FEDADD9DF241555B2C3CFA2B6F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1577.websearch.rul

SHA256 c8ec45d9e019313bc9b47b8669bb2546064cabde57039c1ed6e4a8f85c73d1ba
MD5 66d2b3eb562fcf0ab690338d70b05fb7
SHA1 298333cce00401084fc2067ac9aff500d17e7a65
SHA512 2b891cab1089b9443b3a58415212528859c12d41b7bcefb6649dbb67e8b13bcff2292b06ba4b6b4999a5558c17590c22b59d460c7818825d5ed0a594ab8423b7
TLSH
T11D513042ED9A8306A57325408385BA046FB5D766C081FEC5AEECB202502FDDBC7643EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1586.flvrunner.rul

SHA256 61a284ce148b8e025201331a5e7180b7260324ee0171d8109e18a2ce3ff1baa9
MD5 97146f7b6783e9063530fc170fbc09a6
SHA1 14cca87d74778cc0d43fac0a625ddf2964251da2
SHA512 71e6e0a3c139db79f37f31645c62ddb282a53c8e4a5ec4c1286336d352e80d326a64c5d7edc0f05311b13467e8de6ffe621d39d16293aa5a9c9efd6d355aa731
TLSH
T15A51CD45ED95811AE9732A04538AEA102FA883D3D0C0FEC9AE9D7701601BAD7CB752DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1587.weatherblink.rul

SHA256 aadacf95b57b9c0e14726b9180bcfa71db40cc6f3bc9e46819602a74d1a7c211
MD5 34b47dc6b7a15ba03734d1be984163d0
SHA1 088ba088d5f5cf19544a6cf93f7debabefbcb1a3
SHA512 4752c0c7c0d797ca7ea8d2c89f7051575180f9e7ff2ae23f6c058b0cb3ff1d97c0b00957ebf1425d8dcbb4cc856fa24ae19d1dafa39da6b8f69e0720076b5ec7
TLSH
T166510E01ED65C206E5B361404385EA003FB89766D481FED6A9EC6306202B9CBCBB57EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1595.speedtest.rul

SHA256 ee81c545040a7b26fc67dfab3e312251edefde0b5d5753d3d53c51ce6f1d79a4
MD5 6f77c430ffd01b05690a235f066cf89a
SHA1 be5d5532540796cc1d09bc2fce977e5f4d876c08
SHA512 a440f97b1df259d39339922a21a0d76a6346e4b425db4373a6107aebd40ade5efdded07790d4edf6d68700e5e622bb3b6eaf094ab387f5f269ec03ac46bbf859
TLSH
T1867139115C7656695A7304480BA2E7543FF5CA50A243EE5848E8E6873336DEF48EC3BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1596.movie.rul

SHA256 9ccb51b2db9604eee4a0b4216ea93d42f6c7a92c4c0292404152246a1accdba1
MD5 7199cc9287329002e9c2dbaa0c28e9bb
SHA1 ee46bfc86271511ef9e0da3bd6af059bb700e5a5
SHA512 857fee93b46b2b67d697f9b55eeac03a950877149ef8be3ff7e4a175a4516bf5e9de7c2d0b288c6db1cb5a46b6a28c018967a21725954fd59dfcf4f19610da98
TLSH
T16B016D256C7280296E7314088F90EA50B7FDC7165183FE0502DCE58A6727DD755AE2BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1600.clearthink.rul

SHA256 6d6dc47bd434a91a896309457be23cafe1fb52b19604a0efdb4a34f60062d1a2
MD5 39d57a017c44a8c24186d9e13e2514fb
SHA1 362ffa1a6403a1650894212311a1c2d88ec2e489
SHA512 9d4a8e4258b89072a87582a32353aeeae84f498a2c07a6f42c1da08b9d2e8dffa521063bc77f1fe40316ccd64e9c59e8458f4fb4a5222843318d342406b98bb4
TLSH
T19821CD22AC2981226B7751040B65EE00BBFCC7126243EE8600D9E546B232EE7CD7D3DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1601.togglemark.rul

SHA256 b982b40dac8341da662b7f5e05262e13de5487a3d98c2a06a0977104970e08ec
MD5 1dcbb94b7ba29fa59c7cc607f21b81ef
SHA1 763ebe0c66602809fd710e469989c720106a41ee
SHA512 94db5b36bc5fd45e2d08646899a73deda121f4553190c316dcd09be8fd4923e4e6ccf364af434ac44fbe7542a8874226bc1e7973f3bc100dca89e3868e9fcfea
TLSH
T185213A22AC3155A27AB715005B55DE007BF8DE166193EF4900D9E282A332DE78DBD3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1602.meteoroids.rul

SHA256 7a3481d9722a78d9d0e017bf6f9b44741ec1f1f12ca0c3faeb5b0e3b8c8c7d46
MD5 fa5ccafe9c7c9a042ba25d1fcabe9b60
SHA1 877902411631aea132d76d2c167ca2431931775b
SHA512 1bdb3d4364357434c71661bf925b786fcb9753317768310a8d92b3556cf5f9da2f307448e9486a2ee128e68effb9e67d4756ed1a02871dd51f3ebda85d12c697
TLSH
T1CF113A22AC3605292A7399040BA0EA4077FECF259583FE0405E9E1526326DDB44FD2AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1603.musicsearch.rul

SHA256 0aad29c0d227fe0a002cb5348aee6283736e574280ac4efa5b8125294a97b3cd
MD5 263ea503129a66dfd596ebd6053d06ca
SHA1 c770b6fb0633d62987fd31091166ef5124636061
SHA512 ec2fadf0d5bcf6a206e6be0c128c947851b4783bf9a6db5d9d4cf31129fa25c817ba032fcd77adaed9cb661812a471d6d151787e11730c2b8c7831f094cd3fcb
TLSH
T11C41AB25B96A8112E93375000AC0E6003B7CD357B186EF945DCE6642652BED3C77D2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1604.yawtix.rul

SHA256 008e682e8bde2717704a12b82052ee4e11ce02e8e536b514230b38ffdaf6ddd0
MD5 fb3f9ccfe835e238cf66ef40d301a0ea
SHA1 628ef225399e18cb03a05342286fc78faa1c6198
SHA512 264f03ff806387fe091b040f6c7143c60ec921221cbb3a826a42f7ca93fa02da05bee50de5fbbc82e66ed97b3f6be2d216b97c908327af134a8020a3f133e5aa
TLSH
T1C8218B326C7651326A7365000BDADA007BFCCA461193EE4405ED9542B632FE789AD3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1605.gooternet.rul

SHA256 d23906dfd28a451f060ddacdcf3b79688efa4eabcdd8a4f335981f38c7fd22ac
MD5 590a942b302a7257534a53fe58fa13af
SHA1 c18a91971d03bfc71aaf3077a4f8fb10cb5d4290
SHA512 ac927a402e1d48016850526bf34d97c907731f13319c76b27c974e63c855cbfa5483f970fe0d85ccc495e69c08ce406b220fd459b030942473ae2de05e04ee3a
TLSH
T1ED218E32AE25442B697359041F66D6403BFD8B125143EE5425D9E243A333DD7C8BC39F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1612.slicksavings.rul

SHA256 06e1509a6442f06240a9daafdfd3b2ec546fbeae1616dd082c1d4ccd1e7830eb
MD5 2cedcb062d4b817d09daff7abd8ca810
SHA1 0d38a6c3815b8b8b30470d399d762006ab483e1e
SHA512 f69da8a62349f279864f0ac5a328e785a3378bd85386536c69593b2b8406c6da9000e8205c3c8924ef9096ec86b1af3c4caaa6fab09d96a6ee4ea0d9a020f950
TLSH
T1C331CA41FCA5D101E5B729085786DE403FF8B25170C2EA8558DC5B42613B9CBC7AB2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1613.podoweb.rul

SHA256 bfd437acc32065608cfc3b6547452e119bace3662f9e7265ebd254419df5be9f
MD5 a45cd8f381ac4571fe811ac82b3a5b04
SHA1 2ab359e94ae8bdb9ea39a35c9ae77ac9300de203
SHA512 744fe6d8e2d3d1779225fda1dc2c9eada370144a762636793a921ed6eca286b00295168f50946ddbae1b21999232ddf95bf2013ad95c912a1848c010c5939d05
TLSH
T1D5218521997645A21AB338000FA6DA502BFC8A5A2143DF4400D9D1877A33EDB88BD2EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1615.dolphindeals.rul

SHA256 7852c857f2f3fec68a1983dd93a94d63ab987384f83364adbc77ce96eca6fd93
MD5 7f033a1791bf005d4c26a54f2628a03a
SHA1 8eea37f0f9cb806bb19970a56c670ed6e1e93bde
SHA512 1d255583f0ba79a373b3ed368938881ed9eb9ea26017184425891b9bea345575fbadd563fb20b78fe0b0669d5e997fcdad33e1289fa21676d6e640085f37c64d
TLSH
T1C7218A616C620532EA7350044BA5E9423FF88B123283EE4441DED5427333EDB896C3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1617.portalmore.rul

SHA256 aaeea6c80725fca37f103a288734cdf05535bdcadf3a2536237baf4ada825ed6
MD5 d13fbff98242e050bc29561a3901784e
SHA1 c5a5379d92220f6d30daa0161f26333243f53de4
SHA512 76e970e6c8bf0d800050e9a38fabd21ce88920c442ed84c33e9e2338ea8ef6314d69eeba5a7108c8094e408958bc8b441f46c122860737a06a88bae6b3636276
TLSH
T17C31DC225C7945365D3790041B66E9123BF8C756A183EF0101CCD9837627EE7CABE6AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1620.smarterpower.rul

SHA256 9c4277e8dc89fb0582792b19293ecf8b0c2144b42ae303e51585cf60627f5a4c
MD5 e7995161b25fbf28112d1ea98eed0f7d
SHA1 614bcdb7a5970bd7546a060d36854f45b6c46529
SHA512 643f8a426ce8d54e9a87a5213213900583317ee86640ec5d732377cacdc0b626e86e6b5194d92a687de713c5322c9c4f43bd74492e881438be74ab3d6f18c1b4
TLSH
T1B2318B115C719266A973650C4B61CA417FFD87122283EF4100EDE582AB33EDB89BD3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1622.tvwzard.rul

SHA256 d1501cfbb9533e139544d51f20e4fa4e4834dee2ab0efd0e23c5a9ccc9793a4d
MD5 6c9c5c89b95d37d5e27ea7c97fc5dc53
SHA1 f52982376811e8bad77d2672a32c987d91cbf6cb
SHA512 2f44ef4a8fe1f64119a0e862575a0da617edf0ff69c1a5cce5486c7f51af576831a2cf4d3d36e4c6aa4a6f91a0c834b39d9cdecf4afaa7c03f44c6fcee13f72f
MD5 SHA1 SHA512

Plugins/Plugin.Cleaner/Rules/1627.findopolis.rul

SHA256 9667b1172984ad162d1d8b5e203bec7fcfadb9de73e1291be54b369e0f04c447
MD5 497dab273f3926aac45df7d881ae9dff
SHA1 d1bb3df3c86a62f298cfc151d67c6b0480fafcbd
SHA512 f757f6ec4ec3a26394aaf021d3ef0f266b71b43748ddc9dfda0f28aee7815e3818f871f14aa1f54045302244d028969b4eef508a0280cb24eb1d6b0a19d1a247
TLSH
T1BC215C116C3155327A7325040BE6DA003FBADB653183EE4410EEA1527722DE7C9BD3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1628.focusbase.rul

SHA256 9247f46293bf9bb2fb77db32becad3dab557673b01cbcbd5f27e8f8c5e92cbcb
MD5 a646b0b3de01fbf4879dd35a271f7505
SHA1 bcc8f827374514717374b84cf9cfbb487dafaa18
SHA512 789f9da88c668142f5fbde95f57ba9021fd056d538b23a2f3e46206ecbeac14cf746749065cd3e99579bdc8d278c0f677346948b2ba25b458df85e27185b5cb0
TLSH
T17321AC226D754126A673A5000B59DA023FFDCB522183EE4504DD9542B633DDFC6AD3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1629.adanak.rul

SHA256 c577555281241b08c5126457d647b7fd6130cc9e4fcb12d6a1973b91036f89e7
MD5 75518af1d6a3f7f85369e89dd855a9f1
SHA1 660b19e927e843b61b8cc709e8fbd39f2aa79822
SHA512 383948e95294b0843784320436ca9ab1b939e6504a85249c35164799bf9d5b8cf105d9c43a3cd366494ae87d35a230cb4741f6ce8b1fb91389d8c65573249ad4
TLSH
T143319D126C7291363A3365041BA5DE013BF8CA253143EF4501DD99876732EE389AD7DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1632.sense.rul

SHA256 e32711881f5ea52dbf6bad2118ab59f366da8fdd0402daffb636ed037fd3df31
MD5 46374f83b94145d80e0a644b54358790
SHA1 edea2b6842e7c6778056ae45a928865aea0ccf05
SHA512 b742dc8f9d0c4ed0fa3250cf9f232b18a053de813de70499c123327afa9aa8b64f637602061cc094a4c70fa8bbaa2fcedc9ad222952f8cc9c90c74c428e9cfca
TLSH
T166512B115834487592F354341FB7EA0C2BB5DE252163EB6600E8E9453237DEBEA5C2AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1635.2algeria.rul

SHA256 3c741f5c64049d26a07aa24fbff3e4097166393b85f664ad771dfca551e1aa72
MD5 da5397ebbd6b31fbb7efdb80d53f25b8
SHA1 494a8081619d22950a4996cf7451b2d70864c58e
SHA512 3b0e844bb18eaf727f3d1f2d7ac28dee70a58cbc28fdbaa0adb261753866d31383cf87de2f9c7a567ef1f4fb63364b5d6e60690557db2f6d84751355f726cd03
TLSH
T1A3317A00BD35836586B3B4046389E8182F7AC6A08182EF8465FDB5401E228CBC76E7EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1638.splitcam.rul

SHA256 82b3c33c5b1bda2607fed71b086288f10c74ee31bb2462523c8535096c59b235
MD5 675460144f77e691e194686afe01757c
SHA1 5d9b42158b7e2aeec991717711c5aadf64f563e3
SHA512 e44717cc2bc15ab3849cfa8e14e2e8bbd9f2d9e34b544bdf0b511a3439476a7160dbf4a01e17c698155f55ea53ff40c4ecf3c5016ccb32e7b27ac75b5457aba2
TLSH
T19631BC40DF2082669A7329085351CC002FADC385D5C3FF8998ECB242A2369EFC3657AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1639.speedapps.rul

SHA256 2d62e9dc3630070f84e12f2e8a54abe24b265f7484cf87d34ee810a6ef1f7060
MD5 17d10cd20d4c9cae46b2c3f6937f15e8
SHA1 f8c667ec80fdd720468f9915ac4e2871cf4496f5
SHA512 6a2c477d95822e247bd135aa2004cbd572fe241f019a8ec822cb5abf1d93247c709a02c3281503693d746c0d57617f5e972ef30dccad0094abc10cfcc6c3569f
TLSH
T1CF31CE10BD7A41359AB339046785D8001F7897119442FFF464ACB3016D936CBE7AA3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1652.internetsc.rul

SHA256 0aadb93d8fb1b9fd38f892e3cb3f7f9ab8b75b0ee3c22a377be2b23af476e962
MD5 c66491285aa5407a649cf1c9a9572f90
SHA1 aab9c0a5cdffacb252064c47771acc578d9275a0
SHA512 3119b5e342ed30d6bb891d995dd97859580ae6268afb40d31a2f5c0ee0d8199d8251bf062af6d29e42812c3f595891c47d30ea5d3d6f3ac675da4367f9010144
TLSH
T1F3316D11AC2509A583F318325F77E60C3FB58B192473DA3805E8D94B2226DE7E1682DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1658.wifi.rul

SHA256 1cd7a895ff5eb69af83c0419caca08ad49b8dca835a39f62aa434fe6e946dc59
MD5 daca1f54252eec0a84f4d86200b47d4b
SHA1 3016e17ee96add65478beccded612a1c2b5b8c29
SHA512 bbc139771c0a1a786d360e40636a5b505acbad18057188e26bc2f49e6821cb67d05fa3f6fa800425a7d21e878c8935d933f2bffe9b6aab5f6edbf1f4444a6516
TLSH
T19771DB405CA0801690B3143B5FF6DA4C3FB892627153EA49A9DCDB42713BDC79BA82DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1659.iwebar.rul

SHA256 4b91430849a69cb65dd78a3c4d1df2cd7cdd2ba008e42b3e0312510752258ec4
MD5 2d34516d2575a2d5a7acc79bb92caf76
SHA1 fcedbee577421291c5ad6775db729e814a69f3da
SHA512 4ccf36fbb150c488ca23f3496a895374beeb90501fd38350674bf2278c45993e016ac2c42eb1ac4febaf229c00fbd363059def9d2f1f27396c6ceda8e165abe0
TLSH
T1DF415B114D74045592F358311FB6EA0D6BF88F6121A3EB6900D8E6863232DEBF96C2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1664.clip.rul

SHA256 1151761051a2de8f0f9e6c108bf0e655f8fe6b0328ff35f6e9cd5ace5c0e0045
MD5 2d67d89b21a50ea5da3d9fbe514949bd
SHA1 3f64d993be8a305a5456eb690bf1313a38f0e904
SHA512 13e9cdc8bc29bb242d9b3e2e27ef078e068ffdc731e3f1a1356ee6b86e179f0b8acfab99d1c67ddf3f2aa7ea7035b290944afaa41123598bc4ae45c1d96ac470
TLSH
T1C6611550E8208219A17358350F92EA4C3F789622B092EAD459EDD703B13BDD797782DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1672.absolutistgames.rul

SHA256 d7eeb0219d2495c02023979deb09fb6294d93f30af976f106a8e6ca65f5fbf48
MD5 08d481cc940c42d71df8e64207c1d24f
SHA1 2f9482d6220b81ad1898fc9345cb92ce1d43a82d
SHA512 d7fce0b6f44c1e085ff2787cadaa46bab58c13a7c220c990852e16660e3c7e547f0e83ca5ad0542a375b72257b02dd030a54e5591ba7fcce83eef7b12d0b36d5
TLSH
T1D101F937FE4655670062C106B3D5DA341FE6140C40EC762723FEA5550A1BC8E6B73776
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1673.mediabar.rul

SHA256 021ef478fb2fc96a64d16b0289820bf039c73d2a7c4bf1272585b343693690ce
MD5 d3a796d37ecc27e76971e8dbd4eb7124
SHA1 0290991207dba20278f0f52f75c5a805b6596f87
SHA512 60b641c9d4986c2d8f584d19959d9aa29645c062ea0104f41066bf621271435777a366c55cff033756877a78868487ed61b63373b95d5740055429c96d3749ca
TLSH
T1E2217CDA3656A12E28D9C1C8F760A1458DB8851851EEFEC35288AC0429C976F7770FDA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1674.softsearch.rul

SHA256 503e23b563533663e1eac021fa8bf3a054414f25cb2539f7130fc70cbef27883
MD5 2d9c2bb717b5c6133307b633887204a1
SHA1 d9270db7ada18ac1d6d17be9b1c747aff865d32a
SHA512 dc64927d01bb9a539921e3b68a83b41cad835649c4964096bbb1cc51ac67d409e79d5384853f12ad9dc3e92bad657ad20f847aeeb8195ca8e8286819ba0e9159
TLSH
T19FF0FC8369FE510D36E98300F255C7388BE1264CF18DB506568CDF01616BA52D2F33F6
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1675.spam.rul

SHA256 a466a4be9cf0e0ca3a42ae05f1ef2f9894c186aaf404ca36a33575906c52d567
MD5 149533b30244fa4d745a93f833501f2a
SHA1 e1362a08044adf71fcfc301497190c7260e5a265
SHA512 d96b7422cfdf76bec2ac44659ecb917bec4f1aea5f2640356eaee50f13c50bd6661e052050d31d28b6fd5ca9cf76d9a434a8a397892772d0a7a725df0aafd40e
TLSH
T17AF02DCC6E46598D0D76DEA0F78484082EA4AD18F1987909179D76611120AAEA38939B
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1676.egames.rul

SHA256 19de843f54140d4ee97de81545b9116d54a55d4cd07e325a571ba54a6ca83436
MD5 16d71d146077fa0e074c4cb3cc718a16
SHA1 6d9702e1421bc47715a5c9aad433878694d76865
SHA512 8af776d7b8189636a1b15558aa67a133688af20c88240d7a4e8da96f1737dc19b2c6c77be4ab33eb65e786d3fe2e3c088b398761b7718896aeeb4c0ba36b6b8f
TLSH
T1FB01F409FDDE6B4E00FDC84CF394E4DAAFE316554098B8096F9C5C06D2AA8C162643DA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1677.sunrisebrowse.rul

SHA256 689f97b08ace8721102f13d578391205e48b81edd7d408ba9c3e213ecb5ffa76
MD5 d9a653feea8d5b446de3641909f6b66c
SHA1 4f9daf7802790b78b1d7d458327d58bc80f7c779
SHA512 d7fb081099d187958bf49bd5377f3cf5655314e7c25abb44e9022d7f044c26f1ea30f10a6defa4104d3c4f482056a6b332644e9a43d97124436a20b8bcb49337
TLSH
T1FD219D119C7895265977E0084BA9DE117FFCA7102643EE0800D9A18A7632CCB8CBC6EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1678.snipsmart.rul

SHA256 2a1808d5559a6dbfd8f4d1292750c69dad834e30fcdc684cec4a643756fea8a8
MD5 118c540d9bb01e12a83dab18ae816054
SHA1 35be0c612a2fb91e57224c3edf83b47f7149fda4
SHA512 c39e7922b02c2de91c283392098cef5878eacb1c27d68d5a28b060fe02797568db221a22342c010bdd65d31eeb3b881ad91b7aba4958ec9a7f53c6a777ed5c1a
TLSH
T176217C22EC6086565AB36C044751CB113FF98A1460C3EB4604ECB5423335AD7CEB92AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1679.shareaza.rul

SHA256 a5c7f5e2db7c5c1a56990dadbde3f3245eaa74a0270291061469d8388c5bac98
MD5 54f16f4471376eb54876e9988cd6dc75
SHA1 5124701445ca7b52a6f4f8674a3fa27bb4da033b
SHA512 f8ac266171afdbab41366aed4714025affcb0865df4d3b507551525b2f601a961322e79f8b1cb5c324dbd55785baaa7f3c56dce52caa0fb25b360800a12ed56f
TLSH
T16501A2452DE5852E1BEBE090FBA0C1089EFCAC2567D8A5D333CC9815A23E687566035B
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1680.searchmodule.rul

SHA256 857e3788623202227a757c5bbbc603c44b083bf3d98194bd91f1f5bac827f986
MD5 af076dc639df4cd6ae68f1eb4165f84b
SHA1 59e7c6720bb61b58f56529608e13b7c7fdcdb8b7
SHA512 9856f41dba0069cdd35c5d40103b99a51ec5eaa66d39f7b921dc06cb2327774728d49fd0dbccb6d7dc1f8f9e71632b016d15c8e55183325fefa9cf36163d3027
TLSH
T18931D1024DB5852A99332444A786DB503BFA9644A143CB4259DCEA42A337FD3857E2FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1681.valueapps.rul

SHA256 eef9c703d2eef866d525ba8e8f6b67a941e9382e714198507f2fb9f56d1111ae
MD5 07ed9fd001924de5a2f6f953f09a6e85
SHA1 81f8c8d078f2de87c461ed1c6388ef841a35dbb3
SHA512 6fb9f0bc6bd07c8d59c4f3a7cc983c4642c063e590d42865af3b06111208695834ec38d7c1c30ec42e42bcae00cb61e36d73ed3522a026158f7ead658a35055e
TLSH
T1B60149422FACD56E41679011E28EF4050EBA143DC4CCAC4E77A82D8E0392607BAC17D8
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1682.opti.rul

SHA256 e524a5ddf51c939553fb63b505224715473bceffb83730d358406af9f6802be1
MD5 320f49b872732ae621d7ff28367cf3a3
SHA1 67fdb4fb2f6f307b022ffec9040a3611fc14c142
SHA512 6a25a5b4f10c4668094fde3ac2f6b9fd60783281aee27f5928110902a4eea5603ac31e3cd7a2fd6cd8bb3bff54784a4f8bf1e9b24bb3b3dc461f79c8d2685335
TLSH
T11001F9113FC94F061876FC919B5AC0169FE3349762A5F5112B8F1D4016BB4F6DA603F5
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1683.vmn.rul

SHA256 c9c48a6ccf60c0b6d2d65a2e308b3a59b8fa657c115352d8c590184729c221fd
MD5 2b91642c112e9ecadb941261399356d2
SHA1 dfca6f566dfa76217060e2cdc0e7bcd8018bee20
SHA512 4fa594ef20ce81de9795e49730d299143c6e8c2aadb0944f301a8e1e745a87ce52660dabcad69ed15f7f85ba2e80cc458033cdc6a46645e981711bc7ef14bdca
TLSH
T11701A24A3AE5473A1573C012E2E0D88A5FE83A09C3F66CA26BDD98101E694016B6537D
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1684.vlcplus.rul

SHA256 a58ecc58c77316bc708dac9c90f949244ca569b7b39ca9d3845c0a9593becd4e
MD5 660c9af5bfa0a53b3b22858c17ae0a37
SHA1 0db59d34b3681a18ceac792df535e2514dc2504f
SHA512 7f36396eb39c63e558c46a68d44b9837ae6cf494b6124ee1ffa4da8ccb28b353d26f7be758528a9a7af63ec9ff5000a3482e684600a8f4443e002a9ee9048ae0
SSDEEP 96:3Y1j1FbFHV1mw7RRgPfFf0uhdQJOQJRzR/RWR4RpARW2Ltz83y6NX/RgfgMsaH1/:oZgRKUZOoXm3mpD
TLSH
T10762500337CDD2AF1A9BCBF1B7C9835D46D7822B60C479092F8CBE57A588A453A14379
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1685.nettock.rul

SHA256 37fa42277cd0bbe57b597cca68f3ac457c075515257069e6d0528244f393c1ce
MD5 a7b1ee8e6069b48258f57e3fc825929a
SHA1 9f57196e6f96c0dbe5e773569ad1e355b0963f12
SHA512 a8c5c83794b70766ad9360ac4099c7ce2967106c8f48ae9ff2b544efc7fed05bf7f6d26d9ee5545aba4482c3bd5e30122af26b88b9b549c2ec7a4ee100104a7d
TLSH
T17E2197259C3560A76AB765040F61E9003BFCCA552143EE5540E9A283A233EE7C9BC2AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1686.koyotesoft.rul

SHA256 dddb15f9f7d747c3d7354d2595aaae3b69dfdbf8a2445832d17ba9425431be25
MD5 b1d5a72976b66da7f4568004209807eb
SHA1 c96c9015c5fc238d5db526d18d1e5a18deac63e2
SHA512 1181543e6afc92be0c8666a87e9eb4cb4b464d4097d7e43f24b7d9fffa1f0dc6522c30154ad8fc0db73a014f7b95c204513cad250bffc400450d742ca0c7d710
TLSH
T1AFF0C8353D5BD1BB3479D504AB64EA688BF3A40990BB669352FC2858815C882B66035E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1688.rockresult.rul

SHA256 45284670a346f4d3ca4295498db041274429e30c3020663fd7b5ff6f2cda09a3
MD5 ed12ea2a2327015ac26140c722ba8394
SHA1 bbea8d20e7685df27c3f2e19989e6f9a023c1749
SHA512 899967356be21335fbc56fffefb0560bab9ef773853d7a40ca747cc08610fc129e11607b60f6c4b9e28c971d122de03eb2590dd9585a47d40df74faced984cb3
TLSH
T1F0210C299C7561265A33A4001B61DA856FFC8A2262C7EE4408ECE4436233ED789FC39E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1689.youtubedownloader.rul

SHA256 b50a97bd9e9026bd9394cc58711f6efebb67a6de137d56926e4ec00fedec6dbe
MD5 d8725daeaea7641de1a9a89c115e9599
SHA1 83feb337885427352b224763c5104946c5b30652
SHA512 14199b4a198ed8329b407e0ce94fb1cf0f629934937be1978c09eecee2c539fa5f8a3291442f812e94c98ed070331d2915213ea28b8178034536c1e69138d7c1
TLSH
T1CD11C0085559A9292C96C1C4B911E2498F76A83A21ECAEC257C65D0C114C357E7F1FFC
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1691.infotrigger.rul

SHA256 7f6f65f63c69b99837417e4d96e2fb78295d1ba757021ac510c914b396bc05f0
MD5 bdf0a503d6a03ce08e370dccdedf5fd6
SHA1 c7fdd7b33dad8b8e596db1a86f63a6124ba1b666
SHA512 46268f7b6d64fafe0a76ef6e319fc59662d42ab0b69fedfbca5bb7f1dab986bbc42e3d0926978413948f8f52a1561daa0efb76fe55603d0d45e4b8e996377372
TLSH
T17B218E226C2550666E3B31105B65DE013FFD872A2143FF8441DA9143B733EDB896D2DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1693.allgenius.rul

SHA256 df16d04e4030859ef97865ee862586aeae217c7c4ad1a744e5edcae0b7d1631d
MD5 20b2bc99f853543cce6fa41c1a0eacad
SHA1 9081d043450c00e47bf7725ff2ea94d499de8126
SHA512 d68645d5ce9b13968808ca333c66b2e457c5285cf1872534b592c57b3081844d9d8099431e61a10a68fed273574ae3ac89a3bd808f3605708493395205820a82
TLSH
T144219D266D3140267F7316000B66D6407FF99B162183EE5900DC9992A73AEC7C8BE29E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1694.dealvault.rul

SHA256 f4ce3520be07231e87d355c2f94891e8f198ca3d0fdb8cdda86b6938fa205a6a
MD5 f09984c51318d691b38cb2aa554a1883
SHA1 185b23979d04601d8a8d6fbfd70b14ee21692998
SHA512 6870e4330b6af9af4e2b3f571f226256ed8a2cd2e4d15f154624084d695a6c73af175ca1616ae259a5b7f6d391a6345312288af2f346e99062fb843a884954cb
TLSH
T1F5512541AC71C41586B3442D1BF1DB1C2BF98711B897DB8485ECEA027267EDB8B582EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1695.searchmaven.rul

SHA256 d12f0354fb51473d5a64f7b49b85b740ab994e64add38936c0d87b461fecf6de
MD5 adb6de6b5bf4a770d90c2c981c36ecd2
SHA1 1550be38de174013115783617773c1e1f100ff14
SHA512 c1f7b89b87e11b9d55627355b5266837fc90b25c1d0c7acc590e586e8d352884c47d96ae132d83eb8cc39e1f45c2c398b33ad151bf515b15ebcf6a23c4fadd8d
TLSH
T1C5215A135C255126A67351004B66EA00BBF8DB552643EE1400DDF1836233DDBC97D3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1698.gohd.rul

SHA256 bac7b0e21144bff4d105b205e52325ed4241d951cf29f4aa59adc5e2f1a176e8
MD5 5002795c918da55dc0c32841e8995b44
SHA1 a33846bb908b0156769f28f6153a976a4d10486e
SHA512 404d107ccb51404d66358fa163c4cb541ae4ed203b8c912463f88af1094888cf402d963e8e52c9848ab613291e11ca813801b82f496fd873b007b89c26149ce8
TLSH
T1B621052148384455A2B3E4701FBBC91C2BB59A6525A3EF5200C8E5462336EEBE56C2EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1699.savingsexplorer.rul

SHA256 b6169926bd881b101421c11ba297420d04945c6354088a217aa03be8c1f12cc6
MD5 37edadf35582272b98398ac126eba49d
SHA1 9c520957048a779702cea05a47cfeb3656e3d7d7
SHA512 405c2489073caf4d606efd83703bec6f3692dae76fc8e4624787e6cf57cedfb95001d7ebf9430da2d8bec61123d8a85660fdb12ffd4cb5cd1d96a87891e057a9
TLSH
T1C551F340AC61C1149233440A5BE2EB483BBD9311F543DA9991EAEB037277DD78F682EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1700.gamingwonderland.rul

SHA256 72e7ab7baf017487d2dbc0d062db24e81f69fbd87be2f92e63549ecbb9341f3e
MD5 e1c0c26682a4b1996eb61957f505deaf
SHA1 ea96754befeae376704af981bad46892e57003b9
SHA512 59872de176f15529d65340ce274d7d84ec14b7fe26a7db4647b6ccceec86448b42f42943ef484ee5a1cfa4115723f3cb23ad16683a5a751d022ef18fe04eb241
TLSH
T1B801DB423D55411DCAF9C0C6B752B0243BE6263EB2B56F8173CCE600C31FE025340755
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1702.search.rul

SHA256 09c64fb02f8eebc37d6a5beaaf1c92d95c39557d9c6b8af84e132937347bbc19
MD5 52e2bbaf150720ff4aebe2f0f0a9c440
SHA1 32a1a18e49e3eb2d6dee6f9cd06c5902a3845ad8
SHA512 4f35e196a7a7aeff6cb0678d3bc347bc3c0f241596af5de279fbfc235e11add0e1cb1d6a773eea2cc2718644d9fa1f1b41ce6832788760bbb192a1e9e63daf35
TLSH
T19D017D43ACD4850A10F9F55DFFC7D61A0FA3B6458CC43A23C39948404130C8E3361376
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1703.facemoods.rul

SHA256 804348a6c3a71e910eda1d8e76e23ff87626261a1bf34f11363988bfe19bad06
MD5 04b9639356c9d90a16fbee9d444f9478
SHA1 c8d324c37787b2506d40a64652763dca65075654
SHA512 2512b7accfe68305e4572f89becb660a1cf813b25e400a4b15437352de006000b35f7d4cc2068ab089c94080b71ec43bb1b6066e7dec487ce1acd1fb1715b4cc
TLSH
T12401ADBBAD8DB10A6CB1804FA350F60D2BB3170988F978534EC9AD110296EC163C36BC
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1704.gamesbara.rul

SHA256 8636b953341306da9d26e2def33169fed9858c38bdc749a163dfd636707c8dbf
MD5 afb9bf500b5bc7278dfcd028270890bf
SHA1 9934c9d18e1711294bdcb5653ea66e58e88fbc1a
SHA512 ae8c026fb28f5c6342f30b4aa52c7b3c2afc17c0c4dc5d0234c5066d11a9e7cca7c3b691e1c90bbff48ae60724c9f82b81a2ed7e24f2cf95acd1ccfe28501870
TLSH
T17E0168787DB4990E28F5C822E287D4084FFCF744B0CD68A702AD5D4013A5546FB433A7
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1706.kmplayer.rul

SHA256 f6e9c3d8ebac8b2e5c55045b3b3d460a679b7a030dfb944face8533e26124fc2
MD5 b148f0d82a8079be3a80e38ceffd5315
SHA1 bd4c41d58a937fa372dc9e210bb96d4d92bbda83
SHA512 84433a860ee271312f0b1e81fbb4417f6c52614dec23fae5fec970f15299311f7e01eff28db72a0a050620312bce08dc6412c9a45fa6d55932865260cea3d1fe
TLSH
T1A00126052CD4B709027CF040AB8FE658DBABAD050394A88B46D9A54A53FC78A66E0398
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1707.foxit.rul

SHA256 e575d5e93a4a033658ac3ded28df501e0d58a6dc33496047612c05405d8beca9
MD5 15e9b022e3bfadfede875ce20d663e69
SHA1 d834b6dc17fec6178defaec5e0603ea34f7c1125
SHA512 7e7c13d17edc9f6efd030bfe6d3bcad8cdce76f35272eb70b81bf1db4cd9a73319f1d541a110e4b6e585cb92362e60c2c224375051c0f72b77096315631aadce
TLSH
T11701A2622D8A83691FFED550B296C6145FFD2748E3D8784792DD74408AB48C2B3E43BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1708.object.rul

SHA256 59eb40a7fffd63eb0f81881d38e397e976ffbd6294d3cfb073fc0cb3d3e5adbd
MD5 11a760015bc218f6deccc31ac226e1aa
SHA1 0627c90ebf9f503c9ff8bdd73368680d6e1df206
SHA512 bb95656d5dbdce9bb3c67607c042865a54f25faf5f7bffc8a68e333eba6e3928d0d3ae10d5fe54819eca9587262e4c63c0869adb8275c95267fa9c42cbbe29b5
SSDEEP 192:1Waql8qrmlqEC5aWDHlokZXVXbKOi1rMh:1Uwcj5aWHlokZXVXbKOi1rw
TLSH
T124529C43ED4AEA4045B22541E60BDE18BFF59791408AFCE906FDF5812272897CB3938F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1710.frostwire.rul

SHA256 447cce45673617c353f46b855d4faf565643166481059e1cde24bfb19d30fbbe
MD5 00c19d2932ee73c79f9c63bf8767409a
SHA1 1db6749fc412883572765404b244dbd840482dc9
SHA512 08712bc06cb7126a4f39d8c811c4496d17114e19cd78b59ac2145c9aab20712165103ac916d6b0897e0f334d92dcb755e8af7245bc0c65995a7b975a6134c622
TLSH
T1DF11200E3B57C31F8DBDC144EAB2A00A99FC740DECDDBD9672845C51128690B5F7076A
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1711.virtualdj.rul

SHA256 080c8ed5a2d13c202940afd34aac658f90f72568915834c430805a33373470e1
MD5 49ace5f2e6c02b437013cd25175e4639
SHA1 688bc3b171679901fde2787e8c86fad33b9b06e1
SHA512 a9873978fcc62d00576c793c75ff14e17f9df353f0a9ebec91667a5e7838b31f90017a7f276399f359fd50da8f77ac929d8d69afca3a5d902665fb03bc386392
TLSH
T129012D613ECDC15B96A28144EA47D04C1FB8E60763AC6F53ABDDED01A9148C3FBE1768
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1713.apn.rul

SHA256 38aca7631662574485c53b3fbd26bfd078940213ae1278ff2774e8663af4b8a5
MD5 7c26555d616cba161f8b10e5a380d1d8
SHA1 cb831dc060e972343d3ea2ed1f26765ec0dccb89
SHA512 b477f3e7e5d5272a66a0f6e301de948f20a88007c37fcd225b386afdb7f653d9206dc87e697657957193a1b7eb745c74f5418c170caeaac7c51503356387bac1
TLSH
T1A9214B482849915E0EA445CCE741B1524D74F92864CDECB356C6FC9A5FEC73FB2A0AEC
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1715.trusted.rul

SHA256 2d9d0040064931ee0c1ede0e7848125d0621ebe7fff120ebbfdd09224637da0d
MD5 9423a79fc3604ccdbcac67a22b3cd888
SHA1 12bf7b7f41959ad1083fff4dc793e990ec1454e0
SHA512 0dfacc660a6162a6be5a491810c987e20a16833aee0512c16db2d332694d7106d9b7b88d72b0a161b04766ab32bee1ad99a056b82c55029577839f9bf0ea48b4
TLSH
T1E16142404D10C128857354265FA3EE2C3BB88A71A243EE5505ECDA4A3237ED797B82DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1716.bkkzaka.rul

SHA256 1d1ddfcc6ddf08b2d6f3ada117d2728fd88e12f4178cbc55213e031ddc0bc17f
MD5 b2ab259f34ba6e4806a8ea2e16bda199
SHA1 3b4cc03238dd59a50322dfce83af4bd25909ccaa
SHA512 5bb8914b65d4aa259a7553de6a3e117adaf96ebb9849afa2a0bdb782d6c6877c82cefef9816305c974b9ca3effaf3c14d796a76df4bc8281522eaccee38d1b68
TLSH
T1EA216611AC305526ABB315045795EE147FF98A066187EB0611D8D8437323EDB88FD7EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1717.magix.rul

SHA256 d5bb843050efb4ca17c19e33a687030163e16ccc8acc9948adc79f7a924f6dee
MD5 827d79cb6535a44087116b4e0ab3122e
SHA1 ada0c152d96e1e619809331ad27f4e49521e6a9d
SHA512 5235d58017a8184414fb9090640485401a2b6a4ac1cce453dd907bb56596bebb3abcf1156d5b4202d96554336421fe8b6cc23d6b916629e9766f3065b097799b
TLSH
T135F0C8056F95ED5B1564810DFA45819B1A9975C4D9CB23C28F4C2C0143DD6A61BC53AD
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1718.2yourface.rul

SHA256 596781a070d422eda1883502cfb40bf3879bfc9da9d726f4e5402841a996bd94
MD5 e6e18cd1126915c6fe7fe207ff61de59
SHA1 694749445b4d4143c6d3728fc0b98b12a48cf5e4
SHA512 19ebf315af48e78d965c43f0596f76e7c6edb7d7f2576a3f287757c59c0d6bf962cdeada95f005786b3900662da824dd8dfabda3f4e9988a545e61ccdd1982d6
TLSH
T109F0C8037E75454924BCE112B366C1292BFC244479C92E2D2BDC3C05514844A7BA075F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1719.dizzyding.rul

SHA256 664b33d3db42f88a80ca8591fe8e9a1dc0ab301e202a448f85b45165c23b1396
MD5 97634ed0da3ad86c91b4b7f5ab4a7506
SHA1 1aa56bfa94f18a9d68d582c5e49f54100713e1a9
SHA512 51f4b553f198764ac577b15958e5b468b5a0da1bc867af9db2a88074bb40c4a3e88164f10bf7ba6c268c34d89bbbae4dab7fc49c8aff8c90342599eb80e3023c
TLSH
T110219E11ACB544139EB758044F95DE107BFC87616183FA8820D8F1436237DDB89ED39E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1720.bflix.rul

SHA256 6b353c6e0668c8c6d5e884064d043dfcee351dd1f8953e0732703802fb2fa1a5
MD5 481bb872e1c03693313edc2f085a39a9
SHA1 21402c07a0799366010f271115131e656c913050
SHA512 03c475d9a48c049c2917c2bb89e36f701cf51ba3c344efc01217d81418e4ca3dfee17015e8ed0982079b643166d32b818f191bf7dc1ed08d71448f72fe95c11a
TLSH
T10EF0F4837BAE414F1BB7840593ADC2429EA1C638E2C830324BEA3C80C1A96425F61676
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1721.attnet.rul

SHA256 abfc8944ca359eafa93b368449f34f1bbcc29082ed010706e2da5bf68b4039c6
MD5 80341d9d3e0891511050978191145290
SHA1 2c4a228675fc25f85031f9479d951f461d6d2e32
SHA512 6a588ea0aaf45615127f4b5574ae034becabf8f4d6ef215f1463e5f020c22d804139fcc43d6049c397d053ace1ec7d2f02177854afba76ea98b32026b9eec191
TLSH
T166F0AF062ED5C19E006AC024EE40808F8FABDC549FCDFC91AA94E9003E96F289F85379
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1722.etype.rul

SHA256 a30ab55acfec5e7b6b9cb1d986daa65bc3007a93c6357049c89aea86270b39b9
MD5 a80afaf13094e70309a6fd226d6cbbd3
SHA1 d053da239327862ddbd0a2a59f3c8c0021f142ee
SHA512 c908342fd4912abf4020ad8647265f51a75e69cd2d59cea4c4e4dd8fb12b6a0dd2c1d58b11de3f0406f939bcf707cb378a12a1a99ef4d4cc8a3d05806e09fd73
TLSH
T102F0A4053D9A9F2F1D28A43AF290C9558ADE343452AF221B03E91E0D23B4405F264AD4
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1723.fastsearch.rul

SHA256 1c2a2f236b221f3dbe7795f509cc58deb8ba835ada5b893a18ddea61f46b3387
MD5 62b726bda849d32f9fdaea73a4dd5872
SHA1 2f80b736bdc8dce910552d0b04cc355e42f7965f
SHA512 c1ba664a2dad1ab4508165b05bb9b1eacc77d3ee03944f396af6dc75ab6ab785a76ee4fd24694df402904eb8f710132a9f13d90e018512a68fc6ebdbe9835256
TLSH
T149F096412DEF5F4D08B48534EE87EAC59FE59408A2A8291387D59C4107E4E87EEE8354
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1724.krabweb.rul

SHA256 3968db9378f62392cec53a6812bf76ea7a3d5956b2e01b2107e852238fbacb49
MD5 4add7b93d93c279d31f18c55a9ab7b0b
SHA1 f3f44d4a3170332b04a2a9a354df1a7bfc2cb990
SHA512 6f237a3cdcc4ab25356f95b6abd58d985308c815bb2b39379f6bbca65ea8981e6241403493a615f8991692fe5ff52f1e8c186d7858dca39920eaa8372c30c2e9
TLSH
T1CF217602AC2146B64A73B5040B64CF156FFE86016043FA080AECE5027232DDB9EAD2EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1725.ib.rul

SHA256 49d5790a3dcaae4122f5110681916531eef85e11393d18e97adc5546751a3b06
MD5 f96a819a9a40acb75bd10f39b4fc63c5
SHA1 c66d205dd33299991f9d0f5d7e5db9a3f6a177c7
SHA512 2aa5a5104d6fe8186199c1e35b6a6f2b5d9f00a1e4fda5fa9af237931d8639245a0810163779c4b21cdf3ac6671eae28f4c16e3079cece8134c928c684b7580a
TLSH
T110F0CD012B5663E70195C658FBE0F0E59DA02C54D55DB9C353DCEE013744DC6D5A0757
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1726.termtutor.rul

SHA256 152235125df8f1e8b1e2c79e6110a8d7b18c587b28803fcd8cb1777e63e1ed80
MD5 859b692792d57ba5d991972365fdf892
SHA1 a5593938dfc7b075fbaf5b5aa1e1cd36aae36059
SHA512 bfd2b1174c273b1cb92f4c84c6d694c39353bd956a53b8c04a7e00751f19727796434cf711330e247c52b802eb3785f347d843d596bc9e416883f5a89fb4ac11
TLSH
T1AC31BD108E384167ADB374005A56CA103FF5CB6A7193EB4504CD9616D332FDB86BEAEE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1727.mywebface.rul

SHA256 210e0525f1b22637eefc46e1e48663bfa847716a0a3a05bbc0df430c12470fdd
MD5 c8402eb88c8cdd7f8417c30581e50449
SHA1 ed27e5a8c1b95014a488698b7d20a4cd993177ed
SHA512 5a39bddb55936f2e72d158e7ef248a8a56817589d3bbcea75bae4945ef91198fc1183cbf21d0c3a77c0169e3692c0e238af3a348fac8f63aa0589e194b02bdac
TLSH
T119F0C285A9EB4D0F3AFAC1D0EFCCC44D8BF1A80581C8BE0152F53C400379C067A863A9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1728.orbitdownloader.rul

SHA256 16adaf2c0a636e0268a26325866947ce09c4831df0a87e7fb277639bb12eb2da
MD5 97b58c2cdf1a93d72d56d57059ea76ae
SHA1 017798d5b705ddec7eada24e0b1f4655f7f67916
SHA512 c37b99d36f562a7c2e044349143cba8c086ff1a2d5a61788bc46d75329858e996b5fe8c0b43e525a7f45ddadd6b2d9d2f919db80b590bc752aec6d25c6f4348c
TLSH
T175F0F6057D6D790D0578EF4AEBD4E01DDEE8974661CB240D768D8CCA036C8C57F60B69
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1730.cantataweb.rul

SHA256 2f798f956546af3d018216c24b309ce04c459e27b4b1f6445d87bfe55b626ab8
MD5 7bc2efdba58d8d3a2428f5af123a06a3
SHA1 b6284b298fb82067ff14768bfdb8fe9c43782a86
SHA512 719a7e181ace7705ad008c94e77000136c645d03f0050182b929e151957ac21fcfa394b17742abb8ef9137197e02ef01d1b5e07b49b472eb08a93bf667623dca
TLSH
T11921AC016E3585594BB3760817A9EA003BF9DF525083EF4401ECE0022633EDB99FD3AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1732.unfriendapp.rul

SHA256 fb558411e6cad69313c37b358e735fd4040a42ed64700dcf3ec7ffc766754243
MD5 764e68ef06b9ecee5bb8a754551e37af
SHA1 8d601c0d097e01b1b7f3acf1540dbb3d5266e6bd
SHA512 f89ae32bc274cc4db95860d2f5a20a4319b3bc03b23732eec73f994de516e1c89953b53f11f8bdf5ea29b74cf4743cb3d721b9eca200405f52fd8c09320bbd74
TLSH
T1EC118C022F1EA6F950AAC068CB4AF91ECFB47064235D778515DCDE0232B2AF51BD076C
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1736.klippal.rul

SHA256 279200e4c64810629787e01cc73370d99be86989e635d6a61f0200c3bead3c6b
MD5 7bf1cd3af563e3d2572d26925b19bbb5
SHA1 52b341e56f698aa70b22ff4be42d22ba69c35bc3
SHA512 46510d01539046002668c1122d2dea38fb017e6ed66b9249d6108d71de59f7d7cc57ae9f30c085210063a078e67466a10e8266c1756b4e434cb71be61886eea6
TLSH
T177219B11AC70452996775A044789DF013BF9CB192083EEDC15E8E9027A36DDB8AF93BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1737.walla.rul

SHA256 3be6fcb2f337bad2740fd7efe3cd398346f5f6175343410b090315a4ace0438a
MD5 ba3be7a3ef6ea0bb2cada151e02eb4f8
SHA1 fc18d069843ea11df72cfd4705c0e697c64925d7
SHA512 c8d82b14e21068597c495310847eff4a84093a338e7da582f047134a16d5c9a4a00cf19d2e7e564c746b2ed3447cc484973376b9bb06c95ea273ff21d0e895a9
TLSH
T140F0C84EB94D7BCD11FCC0C9EB55C0458A98FD8D8AAB380222D5680D0365CE73B483DA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1739.pagerage.rul

SHA256 6cd6b804797112b8047a2cc2a8cd59f5f292e4ea9ae056174b806b1e9b444e36
MD5 a5c656797dd24e5b4bb4bbbdab189ebd
SHA1 3e7f190bfd40b28012f70620e7b8f994658fd3b4
SHA512 2107797e92768d56534be43efa1a6af2b1a09f0b8bb16645cbd3558c056aa2419d9f045be2d5638f86f71bd660c73fc37000935a8f1423682b7ffafcba55e6b0
TLSH
T147F0B402AD8EDF0D10F78199E69384A96FEC3C14C0DB64C20EDD1642796DCC66388E28
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1740.alnaddy.rul

SHA256 5f1b7b8be842b12431c439977f4299c34310a8f6489384d1e582797465d069c7
MD5 8cea1bc06e785e71c5353a5868f852c5
SHA1 2907a49993bc2075aea52da455a0e062833e93ba
SHA512 5e68bdb5de04d015a414413dc4e7be71a54f8413ee66d11ed77f481c11c062e7ea3b42c6badd827e108ca8fbaa8e9a418f380007e5899c1872924579c725dca4
TLSH
T1D3F0F609BD8E42CD2A14CD44E6C1C0ADDFFAB5344188B3937BB41CDAA354C8663C13B9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1741.mapsgalaxy.rul

SHA256 003971ee57176710b4152eb5c9b34f5b8fbf27ac32fcb5e2faaa18b7de2059c6
MD5 308f9ff162f8ef6ee1c9b066314502d6
SHA1 5c60d5c0e915c1fbf00a535fe45dd26684ac59f5
SHA512 e928de35dc75795513f6243617e8fa42cf4e8523edf1321bc6ca97593f90dbed191b76021373fa9d7a1ad3951b05e207bd7e3acaf2b5e40c2258eb72fa196119
TLSH
T164319D10FD124122E973A91457C9EB152FB49B62F042FE8855EC6302612BACBCB2D3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1742.mipony.rul

SHA256 8a926b7156d71e1456266e2f54b1baa42fa78c93fc9dfa7f4e04f436204cdb49
MD5 c82e072638c04f1d33dc8cb11a752bc2
SHA1 93000c81bebad8b2bb6c63edf37f17f58a7f2bdb
SHA512 fe8b5bac63366a860a6e3a9eb146010050b5dde9bfe1564912b6beccdf603e71c3444d8c8930119646d7fa6c31f26fb2d2bbcfb4a7caf1eedd0894f89421c56c
TLSH
T14E510142FC568626D5B32500A385B9043F759795D081FE869EEDAB01502B9C3CB383EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1743.zoo.rul

SHA256 a43d95c01a1fcf7a11f6fb975324833ca91f6535f5dd250a8f73c373bb78ef77
MD5 77f773f09c16f330ee07fc78a5f56e46
SHA1 c95dc33da19dbb58ba3f2a1c0d2026f94f7449ca
SHA512 e920a3035de87dedced94702e0c64db2d68ccc014b7eb6993830785535dc7c89d9d6c32be0fa8e9699781081cec1736bccc40550c35387e516d70639482a3f64
SSDEEP 96:3kNC1aASi9xEySd4FQFAU3PZto9d4LXArPHDArSUmdSdlcocbUFgbWDicAC0fR5:0NC1a/i78mA0
TLSH
T1CB915F616C22816E957365040BD1E7003BB9CB61E143EF9959D8E282727BDC786BC3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1745.radiorage.rul

SHA256 f86680f8eb3cdf4f6fce37aebe94ac5d4809d3a2490c63105e806ee6486976ea
MD5 74df7f5c15b01637c6836b876afaa208
SHA1 297d256732da117c6dc9cd3099ff8754e2821b9d
SHA512 f2b37320fdcaa835562b14478baff13278a2e68596e16377ed60ba774663e9ad97105f7aadfd5eb0ebeea089043ef7df3341c49776b4bf2be3aa61b7549c532a
TLSH
T15F31C0A1AC32434259B76914474ABA043FB58255A082FFC551DCA241717BCCBCF293EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1747.shopathome.rul

SHA256 75bf8f5911f06182adc1f90050930c00a9579b9d032446444c24895eaf8e07f0
MD5 82f1a79452d814deaba42866ad087281
SHA1 5c1be9ab271cf374609d5c4705834e4f27de54f3
SHA512 807b8421b33505947e5e1e2b7be73de4546cc696f0d8d34a250a301d38eeb069f48b3add078094446f30de7118f9c431485e30ac104370cd4a743ed888429547
TLSH
T1AF51EC41FDA6820A98732A409785F6402FA59795C041FEC5AEDC6641601B9C7CB787EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1748.glarysoft.rul

SHA256 0caf1e6aba0cc01cf47c52fd3bbdbeb8af5490af29f9dd48046fecd4019162b5
MD5 a8bd1cfd5490f098f9c4db6b4be78d01
SHA1 cc2c553c99091ecb481798e5fae15bf751582fb4
SHA512 7edca3effdbee4131230a6b1c523beee1a622e690bb61466d92e29ae0901bb26af194cb411cab0ae517e7e97aecc2a159fcd7aea3278dbc804eb3bc3d4017107
TLSH
T172714441EDAAC215957379005786EA003FB98382A081FEC659DCB741A12BAD7C7793DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1749.marineaquariumlite.rul

SHA256 31045c20b487d203e6fb4ab086d1f40299905cd7c152db21ac9d75b86638c732
MD5 acc4295a79ce4e7d43c76786c947a492
SHA1 448006861e95ba047d971af80ae6b35914a38c5b
SHA512 ecea251a0ff0274e2ef9bdde080350c415c83f41a8076932221097af6bd6bde0d79503e5881488e4bd39f6fd78693b11690ef3960ed7c9063cbef94a274e5d6c
TLSH
T113F04C0FFA4D4B6B0430C553D2E1D4D92EB928445AEBB2A3338CB4020320D407B757F5
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1752.getitfree.rul

SHA256 b1a37c0fd3e4ff1443bfa4f4e8191a4449c5481379ea14643e029a11fc393ff2
MD5 89894f67e792b543a3d6b57c19f77c6f
SHA1 999b9029044f8381bf7a0c5e010dddc49d0c81b8
SHA512 2a0a49786b4bf235f0b08f789a273a12c4932749968bc861e9e006877335b3f25ff0e20dac8f4439b6f80744d6364bfab10527c0868f3c6f41c15039842346d6
TLSH
T1D2F0C2217DD55AC9289AC161F2CAE055CFE11A45A1E83F190BDD0CCC83B4BCA23A1B74
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1753.expatshield.rul

SHA256 efae0d0b25308522cb6b708e2fdf1759da76988f99d2cc8685f7602f20cf5010
MD5 d3800b3a613c70e8d6d3e6658355696c
SHA1 d8db6971c7403443353a5503bf152764e13f2dc5
SHA512 9178b8bda7e3657eef46c1ae0deef1a1574d4eded7d335cef312f5e3fc712b865a115c8b3e4263a47be7b7b64987da95f90e39b5dbba7eeb81dff13cb17cae04
TLSH
T12AF0CD825DAE9FC50055E700F794E71A0BD158746E745941E2F51E1602BCD0617CDFE4
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1754.groovorio.rul

SHA256 58c7b4d6914c711265e450d30b9f55c403858191fa9c91af1383739b086bd769
MD5 de829b3d76b185bee4e58ae770a84d9f
SHA1 7c51f8c95c19ee4bbf42e9470b94ab93a12c55ba
SHA512 d3fb228b1de9b5cd399fbb6955e8464f50719545aca683a4efc90dae49194a151981dcf5d86159ec710dc991dc23c59987914d664be8b10cc4e4c861331d9501
TLSH
T11121FD02AED6D35996336940B789E6003BE446909083FD818AFCAA592237DC347783EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1755.reminder.rul

SHA256 17f81f8003d853a67a047bc314bae84f25480ce1dfc2dfd5447d49d0685eedf8
MD5 27986ef60bc7524f161c6cd03a7cf0d5
SHA1 aeb95cf9301032dea6feffeb61461bd290f8005d
SHA512 3b8daecc45083367c58106d3e4d82ec33a0a9f86e98c5359b21d78c66cbbe661fb456cf502c7337d5e0750e04eb89623c67690a16bbe10b0514795435e85d2a4
TLSH
T194F046253EA65BDF0232B395FE41F4408EF098640099B092278CBC0F0B14E047F703D5
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1756.fliptoast.rul

SHA256 d65c861d1c786e6b7255bc7923345b06a80efdba1dff5063728b9b824129bcae
MD5 e1a536e8a3060beb1e6ca7db1d365615
SHA1 bb34fd35f22b2b8654fa297c8e4c9a494dd38600
SHA512 d712c85173ec69ac0c2fe061c667c2f6c9cc1c08942b41430185a1a13846473dbeff7a8a5dd171505d3d40970c8408c33704bf103fa73dfb0bbc35ef08d2433f
TLSH
T16EF0A903BE9B810FCCA9C1D9B2C4A2078B565A346ADD7C510BC41E043366497B353EF9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1757.allmyweb.rul

SHA256 18eb93140b3e9efd9d0dec406f27a74b536de702709d92209fb39c6125d92da5
MD5 6c5c5de62df5af9b69a32088f79c8b2d
SHA1 d16a10e60513f62f2f7bf19d59c7242525a6b00a
SHA512 c1d40c7c6be93efa909d233da2e927a7161486f5df9f300b5e3f77d996e6ac4f28441d53e1cf0e4abc365464f2fddbe747a3caee7ce12af03c6a0b64b9c1c04e
TLSH
T15F01D6473ED6870D2473D501E356964E8BB43D0580CD6429E28DA948D1A77B6FAB0B58
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1758.goat.rul

SHA256 160a66bed12609a2511fb9e78ec9b6958391e03d26dc9eda6796ba710a1a69bd
MD5 4064551c70b0718f43ecddc1988b8e2a
SHA1 2cb8439c41a967f010433bae5376bb08d5ad9dce
SHA512 b603954262f52cf0a08066f6692ecf3a5ec011720abf44ef51318f3860274a19066f55fe19aa951c6052b12704e04b9744a650d9e583e78487f3e4e05319f72d
TLSH
T1C601D155BD99872A18B9D542EA50D44B0FA8DE1860DD76D30BD91DE30E1C4015FE13A8
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1760.cox.rul

SHA256 eeacec7b85e432c783500c7c2ca5e2e73c193a9247d19e62dd13899bf6854288
MD5 eff4880997c838991efb8a34b0d1b223
SHA1 945fb91ab27f206187b021b6a15051fa42c96de5
SHA512 a0f659b4c28505c91a64090a938fb407dc46595c1c5abff69dc749c9440184b8efa4840db84e30a4203b4a9e2125f3a6981498dbc47a94d524c8869bc7045a24
TLSH
T1BD0149427CC6466519E4C006B3D0D7478FBE362CE28CB7812BDFB4254151C0E9BE9376
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1761.evernoteweb.rul

SHA256 658e63853e1ff7ab0eead26f2e937c3f5edf8756cb7019d54b42ea06aca3f808
MD5 b5e2e813dabf10fcef81c1881c4b7525
SHA1 75231ffce837d3f44936e1d1f84f5aa4038f0c24
SHA512 40a8f1147af65d2eacaeea565462f444d70f5a74dead253625f9e134c392695ae335a1eab15ba7918c9873b2243cbe10d41e8376bc52fb086c37a209940251a9
TLSH
T1A7019E031D4E802E647584C0F963C8162EF5171865C9F1461FCE2E4B5A5C54AA48CBEE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1762.tracker.rul

SHA256 2841927d2fce5b20150c01dbf4e58e4b8f64dbf029e5727b94fc2f40499c7560
MD5 a0d770a7d095809065f3ba903da294ca
SHA1 1c9c3d78ee9bd173aaa024ebf0d6c62a1102e212
SHA512 3d793fbb9139637c08a123e72d7ea3b3430a7b6304173d5e2f8e26a49912a6e3e0d2c9dc4f821ee45e2089265487e9e7165b9e662e6ce56cd28ea66a0338edd5
TLSH
T1A001F9933FDAD7660D272D88F29AF7A117E606C0404434C38B6CAD1D723565563387E9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1765.imtranslator.rul

SHA256 6d2f113135bfc2b3f31b3d46c61e1a5836c106b3805d2e39e766ecdd41c193ba
MD5 7d617391130302fb2f212e3ca271706a
SHA1 858f83ae7bb95ba4215250b73165ceac7491af98
SHA512 eb271b3dfb2029ef7e37dc53be8f4c5edb584854aec0216a777f7c6b2458843f0b5c70c1eb77203beb3d7a752932344323d7720ffd460db123f22690df2183b5
TLSH
T195F0C8533BE6EB660D672DC9F29AFB6102E309C0004135838B7C9C1E72356545A756E4
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1768.photobucket.rul

SHA256 495222674a2c70443880152672dfdeeddc802a708246f428475ef377afbb550a
MD5 92f4e7708734dd236b1f45f4b077b894
SHA1 89ef26f72dd1c4467af6842c1a446be6120151a0
SHA512 b70f1ae4c2131dc62bebdcc50718d7e70d07afe02169a9ab37446e42201321d838e9e8f60a41113be5e5af43b6f8113e373ca00710a00ad3c2696f10d178a7d1
TLSH
T18AF0A4933BEFDB560A2629C4F259EB6517F20A84404530828B6CAD5E323565015746E5
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1769.veohwebplayer.rul

SHA256 c000bc1a3a48e98359ecb8342f1995f172ba3d8cdf1d30c19aa47551520adb90
MD5 265cb08ee6d615b18995d747d9bbb46d
SHA1 47b643abe5a1ce761dee20ea5c8f51a9ee254aaa
SHA512 fdc206a22ec00979bbf3f3796419d46ceb379173b92ca958360d338021c5193f33b4705404deaf5635aa03fcc614cc41e6e8cdea757897c459bab5868c1d3537
TLSH
T1A7F030533BFBEAAB0D263DC4F1AAEBA153E20985008530834B6C9D1E7335A6410B46F0
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1774.magentic.rul

SHA256 87eee6186d047ae18cdefc6ba24708c9068e3869193c5ad14137d387d7e3ec2f
MD5 f472545d62f872a2a56da6210bfb22bb
SHA1 f80113de2d34767e43e3a01fd1a47344c548e53c
SHA512 8bbe4960f0e56cdc3cf628cb9ea14da5ae793403475d3af5f0b62ddfb5c2604348efd485bd82ba28b14919a5cee306bd271a4932ce77dfaeb213777197766ca6
TLSH
T1C301D6467D4F5D177D7BDC80F2A3E218CFF61899B2AC669507883D435A24C111A4179B
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1784.mumbojumbo.rul

SHA256 703cf0994a9bac953be2ce6bd3437da21329480cdb716b6af8f09c5e18f0a4a2
MD5 006999d31082d03b05490c7f5beb8f63
SHA1 9560aba999879907266510e1f0ce26477e5f93a8
SHA512 4eda56f1335971e5aa4f258f24b39ddaa3de75981a356a442c23d8731762dae561449aaf14159988512df3d3bcd59ef45976fb0382285f574ee514dc10745628
TLSH
T12501D6023F69A3475AA1C123BF61C8344EB6A70880B8BA9227DB3E1C07185125BF436E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1785.openoffice.rul

SHA256 c3fa80623cc32cacc16476ba64654f02d95b1306508e63b77fd88cb421df0852
MD5 5598c9b12e9f000d47fb722921f273b0
SHA1 5015ce27d2c0a1dbcb190edbae241c3878adfb8b
SHA512 5f65817786c8f95edbf7e54e417a2c98bf657a1e1e84b05b811abf08f387d27379a2d3b5ee3b4081c08647877b69011f7c44d10306789ac22636f15955db6118
TLSH
T17901F983EDE6535989AAC40792B5D71F1FA01E0972C7A54343C8DE6321BCC871B6477E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1786.savin.rul

SHA256 cc9033d8c5d057d2310d524a6a03861dc27b287837c7365fabb7d6fa6adeb476
MD5 8581c264d15b5201058787c580a996a7
SHA1 bb65137f62df04112b7a3e32e7cec9bdea13c084
SHA512 d0a61c13db54e5c9ee39cc4a092f6dbbfdb34a5bf0329f2f57836e4dd3f915e1e154076e104384bfb3f4bd420e502505d885506951d9cc343ed8fa70d0d2b207
TLSH
T1BF316E41BE60466585737904938AE5002FB9D61AA2C2FF92169C7141223A5C7EB742EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1787.videoconverter.rul

SHA256 bbc37fafcecd7e0fec0a1153d6a1bcf29d54a37edd81ad317e7ec1c25aea2b96
MD5 01ab8393d980e04bf76e898564b59e0c
SHA1 17d04c95d0e18e683577d7b809ca24918222fa40
SHA512 634304a508c8a2a75fb468dc849505bda75e1ae2a5f6668004f59b069617f11a7aa5c98d8943137f786bc00d5f79763d04cf935fd76c9e20f79c656ae516659b
TLSH
T112012B093E746D8718B8C878F244921C4BA5565D21E4A6037B9C2703C220F55E343BE9
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1788.aff.rul

SHA256 d0c6101261765440da5b577d21daeb51352610eb324d15b01157a28f824d6aa8
MD5 1146b66f17d9ca9cccc6fef28528835e
SHA1 7712cf9a9c6613ff69c0c2f86c844567e5f0142f
SHA512 245a9b1a0a8bee0aaf5d27d60c8ada28cd7b0bfa45b78ce6770a3fe3e56d1c55b2631cb8c5b18ce99695d71e31d37c4ca4886e85455011b7cd497bd08cc99bbd
TLSH
T1AE11E2052C99429AF5B040456516F5288BBC731D51CEB807A395AAC3076B79FF3A0BBE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1789.searchvortex.rul

SHA256 aeb90f2a7d82730e500660555c40e4171b82e75d5f00cc1fd646b2f974dcbdbc
MD5 04e104b86b1b1a9ad4e9159d320340e0
SHA1 302aa9ca3464013476e05ccbd8a560a6e209d13b
SHA512 15e36ed4f1adad6c595e47f1d066853b0d8686a7acb0e60a64f81db1288bc88ca8a2b2305c591914ad8801a4ec73f92acc5eeac3e9c6ac47b05522445aa80c5c
TLSH
T18E218BA29C20451B567368040B96D6403BBDCA61A183FF1404DAF543A262DDB867E3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1790.frameddisplay.rul

SHA256 0639dc336e48816f6cba04c67ccf0a2389fbb3f5bef35d8fbae2993aa9a52aa0
MD5 b3814513a09227c0c8972dff378d94a7
SHA1 b1323cccb8f534ae07775172e128c63120d0fee1
SHA512 2d91c9c6f920459bc12e7e30adb62e6d2e0d99a6585da307dbfc54f4eacfd7f8114761bb15d8904d574f3b6517cea50a1cebea3127c377c2276bf4815796f1b3
TLSH
T137216B215C2516622673A5082754CA227BF8CB252087FE4444D8E247B236EDF89AC3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1791.commonshare.rul

SHA256 755f3e4fb74c8c178c7dbb050ec56a4e42bf68283c3f1024edcf66258c91196d
MD5 ba346d5b6d4fe1b67b49729943ba4373
SHA1 bb5c8cdc6f08ccf2695b793e9a349a8a4de6f3b3
SHA512 b4a85a58dd6a7df8eee1373cf772d34179d9f13eac26f20826d36446adaabb37bd6e6d9be13a8846eba33dd34abf83a96ac849bc178bfa34fd48a4484d9ec2be
TLSH
T167314E12A8B99167A97394044BA6EA013BFC871112C3EF5800D8B1426723DE78EBC3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1793.freelunchdesign.rul

SHA256 75410442bca79201e4d6f35f284f5df5af61d1c536553dd9d802d0e5875c3f50
MD5 a0a1326ad7bf751b7ae12130845b009d
SHA1 2a26ecc05073d6d3813cd751e25f2e6290e7ab4a
SHA512 3b4f58735c791c80aef82d06e996d5b989c8cf716b7c4253d66c1001f44e9539653f250d764612e9855d19b1762b9b42720a72438dfd3e0ebab60145608ce7a7
TLSH
T108317A509CA582198973B9880B9DD9043BFD975090C2EB9155DCF343662FECF87B82AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1794.innoapp.rul

SHA256 3db0db3971980b6ed8dc8438da48e9f5d4444af91d7f4e06787e7860903b2a45
MD5 65cb7ccf239715a56eb2a79a13cba3c1
SHA1 10101f88b2694b0634c6882135ad8b7f80cf2910
SHA512 66571a7315e93adf83094a5182e2dc4652ee41e574c0db029f0889c84eb4b7621062e3c4db61869b07819a11666560fbca299b53c683d9fc457f6ca7b0c4c235
TLSH
T1E62179119C7471A6A673A5000B95CA043FF697156183EF0420DCEA062736EDBA9ED3FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1795.freemaketb.rul

SHA256 7313f5a7d8a25430d6f42bd5d6a77ead05a4179b4d5b9d7752c6c89b2d17e1b5
MD5 739b90c6ff083996a223521ae5e88331
SHA1 b7cfde29dcae17283374d7f3d85952d84f333906
SHA512 bc88a55cd037fa3ff7e864b70d2b4cc18c93c1f27e2bf5b7140ef8411c5043aff785c90c4b5cb6098d8e9ee40708397be48b781ba9e23bc3810f4aceea13134b
TLSH
T15F416B80DD788115F6B36A044399DA006FF98353B142EF9550DC6201B77A9CBCBA92DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1796.scour.rul

SHA256 7a274e46f5631bc695e16b4ea1427089c88a58f2a9bbcfde4cad26554493c5fb
MD5 02d3fe1769604939a65ef3fdb51d7cf8
SHA1 637432047e4a0151cc958d581f39e9e7e8206e92
SHA512 8f153a8deea126e3ffa86c5b6514dc8857507cde8c63cc3e30a34dd5d38130e380c3448b8626e6ca123ca9a63d834caf6074f7a7d5573a9a2538999b1b7bb48c
TLSH
T10431DE50ED74C1A8F9B3A1442319B9007F797346A0C1FE8552DCF241A5169C7C36A7EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1797.24x7.rul

SHA256 16457ff652961c733eb1b82cd735e4958963022a0023bfd63a6ed70f31b6b00e
MD5 3ea6a54663c28e3713d4be2f36fce34e
SHA1 3c87d2bce23d6daabda9629742e559030a7fb024
SHA512 18198c478187de8dbbb0b2f673e8a8a9be417fe0c4768060d7323f356ff11a3e0705eafd6f4203d23d58eacc240d32def36a649b15c495c2ab604065d786ad79
TLSH
T16A3169809D2191B6967729004385DB112FE897929051FF9568DCB304732B9FBC7743EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1798.consumerinput.rul

SHA256 3bc4c8a924f0abfc4e4e0f90698d4d19a1971a35b6bd422d1362c29536e12cd8
MD5 6a8418c6d52a38b51bfd5f491e24cf89
SHA1 79f3cd63f6bcdda76351501be0681087cdfcf8e6
SHA512 11dfef1d09ffee5ef94d604ab7b8b9e57379277dcca88c4e89e720b6b925c8aa24d3987822491c2178e27c73873c062cb8a8aa602cbb7fba41c8a04b525e33b0
SSDEEP 96:3Hwnd8tp73QYRHFaF6TmboCVgovETMiJkDR+V7OIVtY/ckplCyhUEMUI7Yaf/D:XwSXTbFaF6TmboCVEMiJk9NS7D
TLSH
T17612CB238D3658A9597744480FA1E75137F8C6216183EE0859E8E6837337CDB09ED7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1799.goassave.rul

SHA256 85c8ba57daf359a0d5e788c774cfd433e811b7396e02a8527676dd7b8fd8413c
MD5 2416d61674d10f738890766b91287864
SHA1 e6ae9a77008975a0c29caaa83a6be9267e9cf265
SHA512 4b03463602f0e552669fbdc77153d332aa67893126494c5c59e97e6e7ada54bb14fbcedcf2b50729534c30fd49c4656bf356cdfdfa480cbfced16d0e4ac6a878
TLSH
T14831F00319E5D61751B9D0C4CAC3CA186BF989D832D9711A0BCECC1B232B98961A83F8
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1800.netassistant.rul

SHA256 f31a126f2baa08cb645da13e6da09cc35a7f85a5254b59ab456c7f295a433855
MD5 83ab2c61424defb38b520bf0de441439
SHA1 8c2f890ba991830a3a3885877ef348d573fe236d
SHA512 a951cf261ce431a5b0e8061ac85790774e806a5e6c491e1a9354a50d4e25d5910499b68a6cdb5ab1c6790532176869790ccafb1357c01bb1996eb772f91810dd
TLSH
T1F3318D829A25811A8573A4414B49FE143FF897969087FF8528CDF141A42BEC7CB692FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1801.weboptimizer.rul

SHA256 a16f68d312446928f1f83135d3f2cddd46c914af85fdd08a2b6513cd26395696
MD5 7c8c4b7718dffd85fbf232a74b41f3fb
SHA1 4b8a0de5dc31c7694749f31901681a85c880e048
SHA512 b0544234e5f69dbaf54589d2a83656c747824f1712e94280972a0cb88b22cf226e3e1a48e9503f9373bafcf4d7a3bb6d1c0491f4743c291ba341fa359396c43e
TLSH
T15651F461FE644319AA6373045789E0062FBED6929083FCC79AF8F00151126C7CF667AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1802.classicstart.rul

SHA256 dd7e7d33137ff38ef92c9b2f39c6ba93f053174101c902da82d211f8bc44d628
MD5 6da10b330f38030c6bd86c07ee0c7cb2
SHA1 f026a25498233fcebda587bb66c9398becc54731
SHA512 0de409bd7c1ef8f26fab7fa99be2951d0d7a1f4ba1fad96597c010fbb0897449cba562ce9e9de3ecc2ffebccdf75146b9e03b331cd8bbacd1b67fb97bf11df7a
TLSH
T12C31A941AC65851599B3B0054BA9EA006FF9D327F142EF8111DCF2426726ACB8EBD3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1803.alureon.rul

SHA256 1dd80ee13784033830080771addad548023fb985d12b3951989689a83e63b428
MD5 d0025845620ba216a1d1417563cae1a6
SHA1 e44f4eb0e2a6ca7e35760cd83181e38d96bad50c
SHA512 c3f12a7cb69eec6950bbdd59a76f888ca2ed07d8c1ec160b410c643153cec14f0d3813c17afcb81a4268ae81271bb1d130d885fc1694dac20a8b31a66b27488d
TLSH
T1F8319710EC308159E9B36954074B99142FF8E765A201FB9066D8B3406727EDBC77D2EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1804.newplayer.rul

SHA256 41c3c543c70d5555561796c5e28ec6bad3e233deb1574308d646a5e774b762e2
MD5 7f8fc8114f3c2814e5cfe11f1770ee27
SHA1 b729706adc921fdd4033d4212eb436c4ce6f5c31
SHA512 2527cc9ac79390cb18c5dfabd9e0cda02f88987ad4b17f6a2b551b118298f73b22945462cf69542c47b70d3814593d0447421ca25a6c29529d313941e86b08c5
TLSH
T1A1316890BE1582A5D1B3590422859A003FB48792D009FED87EACA601661BCCBCB756FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1805.dashbar.rul

SHA256 f078d42a97ba698a8201306654082633074f6ef68497ba112b3032be3d4399b4
MD5 0f29512a1687dab3e66bce67fd249f02
SHA1 cbf8eab13705194517424a9980f1debeafc56d2b
SHA512 f81ac41cf3e6a240aa6e8cf189bee77f3bda3e9e0bbc33531144de13cded96303becaccfd298ea09726e7f658b9401d54f5c27be55c479b9c6c6fcde132db96f
TLSH
T125519C61FF5D8328A873A6094798F1041FBADA519081FDCA4FDDB10229179C7CBA529F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1806.hm.rul

SHA256 b7704a0b14a09588a93c85289898f0541a47de2ceaa9b5cf56caa686de811eb6
MD5 5531f43e48ff1a599e4578e82fd0d10d
SHA1 8979ec8f8eef5b7ec90a0a727b48e96349f395f2
SHA512 7ab0465ff1d3059255da5014472603cc31b936a5b1283d3a51ac8c003dbd0a503482284e09cb0ca23824a104ad2d083670b85df54c8e1ec5c15016f331b44e19
TLSH
T173516E01FE5C9228E5B336095786D4082FB9D64190C1FDC54ABCF14265175CBCFA57AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1807.istbar.rul

SHA256 ba3f0b123d8cdae306de054a170950f86e98d42fa9aa4e5dfa2534779ea1ac0e
MD5 e836985a723b7b4c1df63a5b18879432
SHA1 a66cae040fd33b433e03fed36abb8843b6548e98
SHA512 cba5fbdb3df17d6979a7f49a037a948ccd653c596098d18c64319171d3a0c7d938857b6e012ec80083e1d55ff47309f7b93b8dbfd369a625bec6553ad034afee
TLSH
T1CC31EC81FC6042158A77A504D2C8DB006FB99751A081FF8182DC7101B27A9DBEBEE3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1808.brasssearch.rul

SHA256 5a8b945c86770def705ae1d2284d18928ab490332e8c30d501323ac5f9080a57
MD5 08432db261343a1b0e7ca9308b80c52c
SHA1 bb1f7a9f786cbd463ac4f6f430092dc5dc46239d
SHA512 50584751be1b49cf90d0a32e0461e0251e20b9c969786619d6ef8317820cd8f4074ef7ec77583353c915d779b1dfa2a21766c9bc176b266c7215e4dfbea15d5a
TLSH
T134215B119D3152169A7796041A96DB807FF98A516143EB0425FCF1027231DDBCEFD3BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1809.veevo.rul

SHA256 3ba94771e68086e90f03a95f4a385adbe4300e044fbc0b30064b7914897eedc9
MD5 415af8a5da8ab9843e8496be095545eb
SHA1 c2bd0bb790aff588452ec835eeace9c43679a421
SHA512 d8c01f97c899aff3fd53b8c5d1e903b2946dba0457f268d8bde87e29bea5a7618bff10faff97c7916de1ce036ce5a028ff2798309dbdd0fa8b3c763f9fcda3cb
TLSH
T1613184919C16424696B3E909674AD9003FFDD761A083FF8458CCB101752BACBD7693DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1811.resultsbay.rul

SHA256 5a86affabb9dc9f4ae161806a196b2b7ff897d206855b90fc730cdcff92a273e
MD5 d6c167c6d940989127700cf2ee16156b
SHA1 6758885106f020be85aaf44230eb30710d174cd8
SHA512 556f8a820f4ea43718dc18636e652aed6fe86564fcfb16c9f8aa1f45a6deddd3227ed8d685253bf69e31419614cad2820eab6e920816f3830b3ee266a2926792
TLSH
T1AB21AC12EC7A801686B392086B86CB143FF9D7455043EE5814DCE5537332CDB9AAC3AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1812.setaga.rul

SHA256 5475626ad2f1517b2e8fd707d98172731ff13cfc9ecaae39b810694deb41dfc9
MD5 2388817d04ffb960ae143bb877d9aa91
SHA1 f606cedc4dd7564e773e581088430825845125f9
SHA512 9ab6614a21ed5c28b55a99b9e1ef910114422c007a831df5188d86f1c354e0b7bb9e5d7eec35425da913366614fcedbbe51129727e2b4675703a009eec183957
TLSH
T1C731BE01ACB18215A4736904074DD9243FEB9761E242FF9554DCB740A2279CBD77D2EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1813.neurowise.rul

SHA256 f3679406c6575d1d5b366254902ddc0236ca4eecf1d908a054d0651a0dbd519f
MD5 aff372bd328a6fe3e9d0ae1009d93776
SHA1 68210324553f932a17b301fb36c722ff633f7fa2
SHA512 93f2ed78024d1608be1d28062fa1b87585674cb07c2888d172ded3ad195e90a06bbcf2651cb1f23d93836f443789fecd391c682b4a8ff1ad1bdfaafefb1643c2
TLSH
T1612180906C79402256735508A756DE036FFAC70060D3FF0400E8DAA16633EE7C9BD6BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1814.advanceelite.rul

SHA256 2ffeac62429767ef5e7ec571104e811f912166b285a1e7af5439502c9e8d05f8
MD5 e8ee6ff032e918803d44cbc465cbb22f
SHA1 5b45a0de278ac87d26e6562da208ed09b44cc3e0
SHA512 ecbfbd18992a1b7a93a63c0814116ad4e57502216782b19e46ec570b6c5b79980805ddd8e3cd42766c76af6d701001543835d48b8f0da05f9b68fc46ee50d9fc
TLSH
T18A31CB225D224966597361004B56DA223BF8CB01A243EF9950D9E852A233EE7CDFD3DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1815.localstrike.rul

SHA256 0f7b2fdccce06deafd5ec74841a7c96cff0d37caae8d148b176f28e261c789f3
MD5 a448a51badd594d87e2a4899c1ccaabd
SHA1 171b5eb0c3599bb3a76fb24c8fc460bc11f9307e
SHA512 924365e7b01c7968c905e11cf45e905c3d2f486f6c006ba71a7f86073fffae89ff639571693550f09e6da686024e4f273a08de806d6086894c723cd387571077
TLSH
T15F4143019DD5C11A2EBB7880D701E641BFE9460690C9FA825ECC6E0D755B6CAC3747DB
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1816.ttessab.rul

SHA256 80a895fc79e0d3cba49d25ff508890a0bae201e35be77dcb4601a1aead798aeb
MD5 ea49cb6a76764234359ad94dea76f5a5
SHA1 d27f7d51c73e059da64555cfb02833fa8332ef15
SHA512 5b42419073c00c1c442db21ae1d78e2012a311e4606f0f5149db6cbde4d9efc8092271eefb5ac41c7fdb6df4e4dc565f9f116dde6563a98741ad2c0474a5d9e7
TLSH
T18E21A9215D704A928BB79408565ADF10BFFCC6112147EF4500ECE0022732ADB9EA87AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1817.adaware.rul

SHA256 4e67cb59741cf82a126ecf48a980457079ab9491a88547aeb3543f959e0457ae
MD5 b4a1fea7b96b73dc4bc8f8eba5e9779f
SHA1 41a632df5078195fc1b6c3f54b26768b28a01cc3
SHA512 0e1706e26a262906897585ea9bba9190a1b697ffaca59e866739f84150eda17720a45f72bd2846090bc47155393fd956ef4dfbc771f4a7fb6441c876aa5876e7
TLSH
T14651DF41AD7881169473F6050785E6403FBCD7B1A082FE84ADDC6A05262BDC68B7D2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1818.heroicplay.rul

SHA256 6aba47d65717c4887d140ff42844fffd6a48cb308059ae6d30a6e75dec48a82e
MD5 9dddf02b2c55acf819277974528f2ade
SHA1 7d4fc52691240a41b26f07590dee2c346a912496
SHA512 80d3aab3c1f13804c02e01e681c0972fbfdbff58948103e4f927108829bbf51b68c3ffb6993b9fc18a55b2814210a4710509da7be8e7916835156a9ab172f360
SSDEEP 96:3nsBL6xxaffIH8I18z+6umVDrDmn3KVf1VD/Cr/iVnjtTJ7ft2jdWq1FZYE6n4HR:XqLIH85jumtnm3KNTDwnoOR
TLSH
T1F5224A658C7144AA4A7759090FA2EB003BFDC610A183EF4804E9E2537677DDF49AD3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1819.heyoya.rul

SHA256 39f3a7f24dd87445d3176b309b9cadbe4e06d2d8e2da265538f00b2c0c6ecc41
MD5 9c11a073c526fee291f0c339acff77b9
SHA1 f47e7dff4ac016680877d59203b3356705e624a6
SHA512 6cfee3cc6726b84d22a420092eb1848335a2dce381804f7dae28d17d1e84bfa2ff24f3c25fc84c7d41070ec83670fbe4fca8bb8fc7375e622248cd5a49564295
TLSH
T11B316B129CB68165657319045B42EB003BF9C7526182FE4918CECA836237AEB85BC6EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1820.daily.rul

SHA256 47898e99d786bef29cafcc18cfcf8f7ad90383adceea68dc94199bd4883b585f
MD5 01231b642a9a66d060eff17fb5e72473
SHA1 c8d2587daede0792ca1ee6466f215d7567102e51
SHA512 48c55401809b3dd226094761fcb344d47040bea268e7e713706f5021f72e63b6bbb34a346484a1630de761e2678e7362bc45ff14780847bc00b34fa1f6e4be83
TLSH
T1EE31D941AC614256D5B37A00078899107FF49B569112EFC868FC7B41AA3B9CBC7783EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1821.kingthink.rul

SHA256 442cda31e9b9236fce94f0606ab4762cc40e9d6f97e3d9e536b844590a7d251b
MD5 0b3ece698fe58d85935048fff0b61b92
SHA1 9318b9eb16723c0fc5cfb059532d3f60dca89873
SHA512 8c0a34fdb86ac0c3aed31ce5c92a6ffcc47547be3e85bfd8b1ed6f303142a473b9eafdfc230f1edf39b8f682262f3434eb26c4745c005f993b300c630762b6c5
TLSH
T13B21AC202D24D56696B394041A8BCF206FFA87502147EE4500E8B2037632FDBC9BC3AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1822.ezsearching.rul

SHA256 42e229220d8981423cd7510565f5a51c7884805f74388c1c182d8b738ec7661b
MD5 49973bdeba8d026e5c90f1b8579750ab
SHA1 d631742ae8be02b5cc18504458ac24f307b32175
SHA512 b4ef569a95bec8ef9c0a7318307120828aa70661af224e108e7785a830638311966381734ed6b9f56f5ba706d2ae05ee7c6728180e44da41571d77b8e08087d9
TLSH
T1F551CF50FD999316A9E326086789D4192FBADA81D0C1FDD68AECF14000169C3DFB56BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1823.searchscout.rul

SHA256 c01f628ad953148566112700ebd5b82fe6edbac980741aa6045dc8fecf36ffac
MD5 373d6a2babebb383795b2c4435dac75b
SHA1 b3654e3d2a745f793603c06226aa43b604d66e89
SHA512 2e4e77e87e2f93c6eb0515e12c195dfb0c623af4010b1b93b1e9db21831607a6f95f338de6dad4cbf1202dda77933f69d3f3fef66b61774dc54552b26de93f04
TLSH
T1E251BF20FD084629F9776608578AD5892F7AD702D480FDC6D9A8B10100336C7CB66AFF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1824.zsearch.rul

SHA256 5042dee8fb10305e54e98e939563881bd5bcee15205a36f2ead41365f5e56eea
MD5 e3575beb928820831d3b1c36f41e05d4
SHA1 3a3b7cff7f2c75b65571fe898daca69eea605ede
SHA512 0ffb06f1afe534d02f1bf2f302255bf8733f105054b6c55c82188ebda0d338fcb9195e690984d560b16baab953ff36fe8fc28daa8008326f2d6d1020d03ffb9c
TLSH
T13F51AB40FCA8C319B5736204A34AE0592F79D746A0C1FDC68AECE20051236C3DFA5BAF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1825.locator.rul

SHA256 28564433cde9429c849b6bfa2a0939e2cb5a476c58016dee09b36b6596e3715e
MD5 955c170a28cc162b7eb16ac45aa2a2a8
SHA1 23e1652c80b2701baf6c94cb8924504b069ea35b
SHA512 8fa0501b4b02260ac2d53e59bc905fddc4d576bb0382d6d82787c75eec6a7a347db8f432c7a208e916e9863006fbca5ec69081c52cba90762e2587a131a40ba7
TLSH
T1D351C940FF78821969232A0A9359E8442FB9D651D4C1FCC68AFCB14011276CBCFA77AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1826.platamoose.rul

SHA256 5e2d3a63efd9b96f175a1721b76a86ee4c981e7a068c73af3ee8de44ca5c2b38
MD5 cf4e2901e4d07d4fe33387610152d217
SHA1 689ab49d4e44bbb11388257639ed0893a11a39ef
SHA512 30191ef4b4df421d2cdbaf5aa6cb5a5bbc612ff4bf6bc1a1fdc498e82c98de9f71d02bbdf018a51bfddad34f6efd09d58917415c4cb14428884c5d330dac9212
TLSH
T18F3189514C78446566B7B9040A9ACA0037F88B553083EF9901C8E581B33AECF46EC3FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1827.allsearch.rul

SHA256 d33c660b54caa29993b97b8a3286601b071f3b1c5ffb6f99139ed6b0c75589de
MD5 f872798f8fad63d40b57b32073a5267f
SHA1 c038089e2aa34613168dd1e10913d4528b1bda7e
SHA512 7ad463d077c0d080537be44509500b08405166fdf4b5948950ce5f398b7129276519ee1a2db03850795209943e711ab150a400264903611889a3aa540690099d
TLSH
T18C31A800ED3242668973AA0047C98D043FA69786A162FB9405DCB30179178CBC7BA3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1828.searchweb.rul

SHA256 c0a5b2e8018c7c9713f91a9d2bf0741deebf6674d97da689c0cd8557cc6535dc
MD5 033d0e10ccfc028c77d0ba77c5ce2f9b
SHA1 00a1a4f8179335dc998a12c80299dac7686445ca
SHA512 92a19721b93b3da6f8742bae5614f100e67607bf6b4d913a1897c4eeddc55f772cc0f52f6a6464b16688d38162c591443ba9a3f9620cea02a279efcbf2f2a4ca
TLSH
T143215C01AD29815696B3AA041789DA006FF5B742E142FF9856DCB302A117CCBC6383FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1829.brownbark.rul

SHA256 1c4549b07027080de4a8f2ecd4081c7463808980e3791614951770a24e7f2f07
MD5 91d7db16f57df4b80691534e1524eb2b
SHA1 cff31e0490eb8a4aa5f230181282c6601dd18d4b
SHA512 24b18960c0efdd6ea1c62fa1bdfebaeb08d35593ccf98a29469bc1344ecec139aaca2cfec8ab9f3866208899ae247a981da2bc7c56ff583cf3c0da7dc958d58b
TLSH
T13C113A219D794126A67B65041BA5EE007BF98A255483EE0400ECE1427232FDBDFFD7BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1830.surfslide.rul

SHA256 199ff285a984e5a31f810f2816bf9b6b5091e2e116e3eb89d2cbd0cbeb1808ae
MD5 518f5b34825bc25a0ca1eb554da738ce
SHA1 1cf95283ba87e6635f0e1bb7a076abc5a2835dd2
SHA512 57a624633bbbb5dd1e3433509aa9987ab3e5b172faf4fc2e0e24c2f1c3ffe6efafb6490fa5e4524c3dbbf7178d543670f0e3c924a54bf54228f596820f62e549
TLSH
T1BF116D249C6C41255777D5045B69CB907BF88A446183FE8C00D8E9056336EDB99F92FE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1831.lampylighty.rul

SHA256 e21659113951fc61ed1a7e8642590ee394e8363496f7e1af44fbfa0e2100951b
MD5 220296455dc7c142425b83bf1b5f42ee
SHA1 fe34f68c8ca4612cc00529d1c3f800a1b4f1a20d
SHA512 c9ea368490c03431735b69af48919d4e17d27a76891dd6823f90fff786612adbc63c1ddabb5cfeb84c0c7c134e904ef90905a02ed278daed02e77be9b5fc3beb
TLSH
T1931187546C264025967358094759EA107BF897A22283FE0814ECE3427736EFB8DAC3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1832.techgile.rul

SHA256 71232eac75b13b4541b7365d635b9f7334dae3b58c93caea409ed1d0815f1d83
MD5 3bd9542c3b8b39f4a680dff753894049
SHA1 88abd6e82cb23be8f66c6c1dc99043fae0f739c4
SHA512 837fbe2851d563f64493dfc6c6a93ef223a40da9ed0705946305a0c7054432cd37c44eacb0993a4a0fc6e391586db5e4af5e8ce8aea54631fe3682362f740c69
TLSH
T1F2118C206D2142124AB369240B51DB047FF98B156142FE0811E8F553763ADDB89AD3BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1833.xenotixkeylogx.rul

SHA256 21c1542a6aaa2d910edcd8ad58cc5df3ec91ed916a8b1085145709fc88ced179
MD5 032e8a3da49a047344029c5c7378da07
SHA1 a25206502fd648cf36e9b12b4a1f74c48d13a5fc
SHA512 b32c26125890fbb3fac51288362786157d79a70a187beb86286b1b987fa18f830c1f90b11c66e8202fdb8983a4472de39d9aaff9e8983bcdcb31d00c58802c75
TLSH
T16AC04C532BD5DA690A562994F55EA76253D10584104170974BAC9C1E363975821646E0
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1834.infininet.rul

SHA256 35e3f07f7992daa223525f4c9123765af7c2ab96e5a5b6fbb00174646c845b37
MD5 1fac3de0720be773b4c476045185d070
SHA1 7d80a5beaaf33c926fbee65f8135718c92039ee2
SHA512 5beb4c4939d5da4e036601db9cf5b1e695127245dbf272ef65d06e6eebd17ada620688e50257d4c9514e6af0d898c9a77523305844a595654829f5ceb0a7190f
TLSH
T1B8318CA14D3884519AB3B4080B5ADD002FF98A162183EB5500DCE181A337EDF89BD3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1835.mossnet.rul

SHA256 1db517a0a5008006f3a66c1d5e471992094d8a15835708d3777992e9c873cac1
MD5 e3df72ecbbf44661ba4e0d1ae719e651
SHA1 310c3d475d990eeaf0bde63c42aeec202aaa80ba
SHA512 abb09ae0237d8dec434cf0150a3a1cae861691776ac9221a6e0a54f78710cd1b1ffb65e7f31e2f4e8f727a60b47adf9eaa32ec83ec1fd9dc67ad1fd2440c8240
TLSH
T1AA118920BD2481361EBB58044B55DA927FF987056183FA4408E8E5423632ECB8EFD3EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1836.socialextras.rul

SHA256 0aa7e4a8e8f6cf2fa589722c4b6c57ee5b1f4aeb60ff4c3f1d5d62f763582d50
MD5 6c142a8850e195a0f69efabd64bc32b6
SHA1 751e6bc4f59278eb70a5ed06068feb9a59722213
SHA512 7195526c26ae3b989cf3a3dcfe8c4bd2d8e25fded55b66f70317cea2e408c17a60a9cc55524b6bbb34808bff11ba6fbb3a66c33209c71d756b3734608b4ed016
TLSH
T1570145257C389903AAB33600A2C9F6001BB5CA9EE505FF6919DC69012227A9787692DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1839.enterdigital.rul

SHA256 8791979a84f5ca558306bb9b3a9b21e0d19fd26c36c2bbfef86656c6ddf49b6f
MD5 b8f94e1c37d7360f4fa5796b0d6b7433
SHA1 c0e4fe4ac36a07e0c4bb720cb713520da6bc44ec
SHA512 6b2d0b435a222fcfcb8378cce374b885a88a21bcaa75965cdfe9b9ddbba4bd0a3a89c973f0487a7e1f5f873d4c81d567b1a79098e43bae660cb6ba3f15afb3e6
TLSH
T1AC11AD045C308015667BB5045759DB017BFA86555043EE9C00D8A743B732ECF8AEE7EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1840.radrater.rul

SHA256 8af1a93034542415508e14dd07c9147b2c21e66310624a122dba4aba3c25c4d1
MD5 6779681198f516c30ba6165f95aa214d
SHA1 75494ce425b716d7766263a4f56be4dfa7f6a760
SHA512 d3a41594b37619024b269bd7b64203496a0fe226101893ac22158f0b76e11cc6c52e1ea56522252a4da6cadd615c73fda54ad273c85d49d5ff78eb5991ff74ba
TLSH
T1DF116D219C3494210AB779044B59DB007BFDCA596043EA1484ECE2463733EDB89ED3EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1841.smileyswelove.rul

SHA256 381db2cbf6521b9c746878e3ea423b0a15ea828df71cddefc0b7b3de3afa4512
MD5 420a09386ed471aa59ac1c44bef5fe8d
SHA1 f45e9e67fb8b2cc78d858b1f6d066f5cfcf5aab0
SHA512 892a586a373c7067b21943509d2d9301ba5251fe2b56cf607371cadba8b8c5013f64800b5df1f30124f44e4e8b6cb56d5d9fa0c01ab135860570e90d9952ae0d
SSDEEP 96:3GwVAGdd1lAEsBsmjAGBkjPvCBE+DIeEjrCZsywGrnxrJ4JXK+DizTwh1UPuY0kh:Vd/2fP+RGHK41
TLSH
T19FF1CB118C35807AA7B322084BA3EF112BFCDA156283DB4502DDE46663779C795EC3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/1842.plumoweb.rul

SHA256 239460eb7b8a8d476501950ea4eac7e2988274c22a64eebb258fffbc265dae7d
MD5 3a43c394c23bc9830809dcc2c008c6d2
SHA1 3bd174ded5589389fdd0bb5dad969f3591a91677
SHA512 9106a2cc54a9f35cdabaa50c68700ab44e39d85cd49f69478ae12011be06413220a925b1d93726ec526a79ef06ed68b88f877703ef4847884dc60271764090e9
TLSH
T158118B11AC7401991AB366040F54DB047FF986911092EE1802DCE546B633DCB8BAD6DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1843.browsestudio.rul

SHA256 743e915129e85fc8fa8d19bf9cb377410792176dc98ec6bac67ab64cb2921461
MD5 17924caad4bba00aeb54025150da9bbd
SHA1 e89884ec286207cfe9a601b0d563dfd11214d7b2
SHA512 a4e84630048456a7471efb493b40cedceb5f91be8fdeb8b405420f1d9138c591264bc3f8c40b7059836fd61570bb5f8ec6ab677f285c5c8db2886cd7400ad629
TLSH
T1D1115451AD212411557354141F85EE417BFA87256043EB2C00ECA1D2BB36FDB8AEE7AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1844.boxrock.rul

SHA256 90567b6935a6048bae5dd318f066fe053e50321d3dc69471bfd2a16658a81269
MD5 1c47e908ca5ce7aa66305c827145e83f
SHA1 687d6d4d43f624c5c557f739be89a8498c10552f
SHA512 b65a6cd1bc95849e47498408fe7a3d3bf2ce1385d619797739af14e56ecc8091d5fc5c886398f353db0159944c33a43c69d10da32428e65f732dc091540a31e5
TLSH
T19A21BB159D34415A6DB365004B95CA007FFE9B112183FB1602DCD212A732EDF8AAC7BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1845.appenable.rul

SHA256 4b49b2de9f5df70909f2bdfc56b884f11c8820ca2b5f173d90a01f0a926ada62
MD5 2707dbc6763f561aaa7a2a2d405f20ad
SHA1 dff8353f6bcb886145d5592201428c98d82cf2fe
SHA512 425b31715bb492e8a407093cd5fd953989812a57ef0cd550a0cf7d1053e586e971490ffa8ef8ba4d600ac47cec8aa23af50e535394d0a968be66cf07ee630426
TLSH
T1F4118C91AC3044554D73EA041755EF043BF88BA05283FE5C01F8E582A236EC78DAE7AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1846.besttv.rul

SHA256 8708a596ec7b9043b42ffeea546bac180ded91aa42bcb9bd0d5b59c95bd5b30d
MD5 19bf5cd1e5bc022dcebe860059769a13
SHA1 febc89648817eaa424359c776eaaf3eb5f857234
SHA512 02cb5a87a44a7464f420eb56fa496b026262ee998bfa5348188f1c859f9613ed58f7b66b429c1fddb0676a8625f9152ef0ced6f48ada71ae39e912dc69c047e7
TLSH
T15A51EC20FD54831969332248578DE5001FAAD781D082FEDA5AFDB24161168C7EFB1BDF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1848.clickcaption.rul

SHA256 eda32c1274ec0f57975bf3042d783680e4a7ee1faec22e31acfa355a58a35a78
MD5 63de5e0c717a754934ee7206bf8f2413
SHA1 5b5a367838f579d23fda02f19a64f10cb0016242
SHA512 8a8a84baaa39003b7dce302b028f7fca8d2aedd9dce066fa8fd8d77a832fbafffc33b480031c1ed31e09ba64250b8e05be7d1968264e172fd52ec69b16639872
TLSH
T149214900AE755165B9B365041767EA107BBC82AA7183EE0900C65082D636EEFC6BD3AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1849.easydiscountpro.rul

SHA256 d13a070a592bc415e8e5f7be872aa344e5c568be8c53b7f3bb233035e38b32cc
MD5 bb1e35e1b39204a6174b2b0ff4e840ca
SHA1 07a4d16b4c12c20ec24f76acf80b087b794a0244
SHA512 b02b820fa927614f43dad5dffacd2032c36ad05c87a380258409fe769550b10dbfaef339fa2e5e53509e65161ccbde740ee88fa5ad441c5d32cfcd29260dce2f
TLSH
T11A21D001BDA4420754F36B48A759D95777F28A6570C2FE4212ED950372256C3877839E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1850.shopforrewards.rul

SHA256 39c4fbcf47c46bfb970c6df3ba50a2965acd0aa2877af1c7d5d203fbadcb2063
MD5 e88cafba4c5c52a2824a88ed1a01e180
SHA1 f0216f94ca03e01e01e0d26f0cae43758d4e3de1
SHA512 e0fa88c43f4828ebf42f8739308a6edfc1cfd4c8190c0c8ab26ccac910c38b31dbf38288a1a083714906a86ed8ca3e25590c82ca62eb02b04eb90c8b4e323600
TLSH
T17F819110AC6782554937290487D1E6102BB89792D1C2FE885DD89B82657FACB8B783FF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1853.videodimmer.rul

SHA256 c92cfc6e9c0a1c27b5fc3ea006bef5f78524f92ad2318747dbec317a5fa5a889
MD5 981868352609f2b7ebbc6eeac4f3ef38
SHA1 7e7952dc6b51bb032b7cc49a0fb04c8ecacbbb63
SHA512 36c35c580980f21eb0b7b920a16bcec9c6b34c8e69238224ef10fe9cd447d53da4caa224f5744b36586d5a17111f0d0a208ce18e9551804e801fa095f85907e6
TLSH
T10AF0C8225C3541148BB794540F90CB4077BCC51891C3EA0825D9E56223269DB18FD2BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1854.cinemaxme.rul

SHA256 1cc9a79772bead14e527639ca198424550566381dbcd657c752c3b7f07f6f325
MD5 0adab5d7f0a465c8b379fad584decb0d
SHA1 4dd351ec34d199dc5f14e913927ed0670445f0c1
SHA512 e263e7a5d1c35f05f0ba3c0554fd62fecd2593c1d0a81bd636eb3fdac1e3739b4b1fdd91f75e87e8412f86305628726e3d34cdfbbd53233a9b7bf68ab7e1c8a4
TLSH
T1B371CD418C24C115A0B364340FE6EA0C3FB99A267153FB95A4F8D742323B5D7DB682AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1855.pricesparrow.rul

SHA256 3a8e9be517bd5431300a988e620c87956bd6e0a3d996fa63e53c31dde32bb7df
MD5 5c81de9ba9da36e391f45ceb9fc8a522
SHA1 c403496aa47ac1117bc1fb3136a7d2511fc2005a
SHA512 6446cc72bc6b53ceebdde62fac529e420280a8c3759415b9ce677c0963b43c7932402c93aed80f3befef95c0385039547141a00d963983ea85c097a3ecdb6a58
TLSH
T11B316C628D641057767364006B65F5A12BF89A21A143DB1812DED9922323ECB86FE3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1856.bang5tao.rul

SHA256 172ebfb06b2e30d3557703a686ff156f0be4bd663948198afee6eb175d912cfe
MD5 67d25401d497e3ea99e38f750bf13748
SHA1 a1362d57f9755ea909206da9eb8108fe0fbaf770
SHA512 71473887d91e5dce94d2f0683b05c8d3ea41cdabc66cf62ce4ada2522ea57070261dbef71a3a7624e66606b4839657fa324f4736363d454b45b0f530aca7e1db
TLSH
T1F7613100EE59824609B78848F794E9112FFDA650B1D2FDC406F8A2026578ACF8F653FE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1857.ciuvo.rul

SHA256 0064467c9aec5516f1331347aa8ecd7534b33583cae67fd515f24e6ae3db9098
MD5 0111c9fd8bf07ef7a1116e3fe4b8d603
SHA1 564a1318c11a45a7f26c2507bb4657a731cc1b0f
SHA512 81d451e6f18181b020f544fe7aa7d3d3c21dcd46116ac4f12070db0f096fa3c316c5270958e42ea7d4ffa326f209850e3bbaa29f40791f7b1a7e389b3b362aca
TLSH
T1C331AE110D61516515733A00A747DA522FF5CBA0A193EE8418FCE90E337BADBC5A839F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1858.hotspotshield.rul

SHA256 fd7b84d73a234e1d86fc87620df5461ae696198bbfa5aede51c4f57a2d724785
MD5 733e476cac10b02076239770d370e8a7
SHA1 0f6b104cac9e3e9513ac71760b0e379fb252a791
SHA512 c9425e61816a36f6e782ca7ad34f5c0dbd36bcdcfb4035cf911f5930e29f615dc0eddcb7b3b2bda617f9eae774accdb4a9f3028079615a105617f19a11c72b9d
TLSH
T1BAF0820308F981A36DF765016B118D1057FC9E3E2396DA02D3C5955F4E35BEE61B81BA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1859.browsers.rul

SHA256 901cd564be72824e5575759bafa91a7f819fce849ac4e2d9f55b8ce025eedcb7
MD5 2e765b65502a55ee8ebdc47ac1f65e75
SHA1 2c956c52d17184c9c6f91b078050c971b3293df0
SHA512 7c2438bebc5fa913582b59014f0f46630e16a2f4966450b68c91b7d0bdb36ddb71c89ef832f92dd9d65eb16b9ae1743bd845112aad914256ab18a26a862c89b3
TLSH
T101415B52587504AA93F351344FB6DA0C2FB58E256567EB2100E8E1512333EEFE5AC2AE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1860.blekkosearch.rul

SHA256 5dd6950bbfcd62c543f9e66b940035584294583083382b4bcd0b82c1d1d55149
MD5 a9710bfe2329bdb2395ae78be4c99ce2
SHA1 599733aa699990822859df6c5e30e459b639dd1a
SHA512 2878897d5ba8ea1575306b1a2847286db13fffe69bf07d6b1b05f599597784cb8115ce76ee475d60f65c5f1024b82da97ecc019452429a62762a2b293cab5871
TLSH
T1BF31D060BD7191185473A704429BD5103BB99F71D142FE82E2E87200623B5CFA7BC2FE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1861.wolfram.rul

SHA256 f269510e0f6d511a04e550a9937b938a446c716bed71e248b189b1357b68b5e7
MD5 aab965670702b93a528486ab5194ba00
SHA1 6eaa7f70cf161e19a144c3ea4817f3b2b8efb94a
SHA512 1642c5f9478bbf31210d00611a0bb092e0aad785b8ffb9c5b2a494ce86c6444b17d18707b557b3183cddfe120655e8acc37061d54b3e44adbb337be01f5ea5f6
TLSH
T1A531AF81BD648245E47365440B89EA543FA5A743B022FBC58A9C7741912F4CBC7B73DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1862.doughgo.rul

SHA256 74817ea65f771c635d61c95712627259f23ef14010f66eadbb2a0647558caf36
MD5 93b78c87fa0fc415336c62433f2bed2c
SHA1 58647865aa2e07483ec39802103f09be206d042d
SHA512 5cf794c1b217cbf961da53479beb37e6e2112329956aec892f216fbf093eda51523b0a409edf1997863fbf7242d020f0f20ac31a43ea0aa6004b9698eaa20326
TLSH
T1A7116D51AC34852185739605075DCA002FFECAA96243EE8140ECE543B337DC7CAA93FE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1863.applid.rul

SHA256 06afa2930c14be55722dbf0a21d84b8cc80090acc0eb489e789a306f52191fd9
MD5 600e06ad5476e8994d3514938fbce7c1
SHA1 54479ed4fb2a1de666ae08a67104c1e0106834f3
SHA512 001e5e0595b2691fc0958ecd163a78785397b4ef1ac9e4efb781693958560b9b20a37daa53ae2dfc2aab3add8fbdae5151840bf432c86326a6c2f47ded673324
TLSH
T12D316B01AD640C6149F310301FBBE64C2BB48F2564A3DF1009C4D9872272ADFA96D29F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1864.geforce.rul

SHA256 c8c20d404915678ce24d159309df708ca964bf3fed4521f9511047b8a70041be
MD5 44a61f7fdca53d22020387092af10f21
SHA1 b49fda974ee5303c12f562e5829e944b9c9bc5d8
SHA512 62ea10615acba27349610e7125629a7d04fd54841f9d41f7ea432466a35839b3da3472fbe23b98e143dc1b09b47cb63b3b675ccfa0e0c5237ee4abf6719318bf
TLSH
T182414B2148344875D5F394344F7BDA0C2BB59B267153EB9200D4E6452333DEBE9AC2EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1865.pcdoctor.rul

SHA256 f1f20423b337c099dc3c8b7937430d55d6b8877f365560e9251661d0454e1dda
MD5 ea942533cebda4f5412ccccfa50c352f
SHA1 92c2f4816a5b1a0f6b03aa90c2261988979bfa84
SHA512 fb1a5dba484662c80ead8f4546f112c5f175214d82c221286cb791bf7d39f040ef21a661764edb69f71bccb353483f0959bbe9e6ab9dd0f03ea56e6ef5ae6cd6
TLSH
T153414A114C74085691F354300FBAE65D2FF69F6621A3EB5500D4E9853336AEBE0AC2AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1866.ytbal.rul

SHA256 606967629ee98eba45a9d89f728bd4b2a9d9ccde0bc2d44684e8d3c24ae667b6
MD5 e6bad21b918418fce9c07330164b9df6
SHA1 e34e520c9b0587f4c30419f563d85a9c4705e142
SHA512 bdf77fe59177dbfed7dca1b58dd2133788e821f4effd3c54181ec2a85b6a9e7d6f94749237a2d2db5f79614bd8b4e3731b6acef77066a2177327ad884939077a
TLSH
T1B05153212C3595A6467316045F71EB406BF98A61E247DA5805D8E2037336FEF86AC3BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1867.tornplustv.rul

SHA256 7eef6bedad77d519ec79d8106821a437bb55768bfbcb2955ec1e466adaaa5adf
MD5 a52ec09fd3aef2c6b737f414634951d5
SHA1 e6a447fa00ad534d7dbf62529e46291a19600df2
SHA512 93c4aa892362e86612310b5135713b2eb51b0328993ea2afe9c45b5d250c3a643d14a6b86f4f336e1e67805455748420049aec819d9e1bbd3121343d0b5e0bdb
TLSH
T17E517D208D354465D2F358311F7AEA1C3BB5DB613163EB2A00D4DA462336DEBE5AC29F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1868.clickmovie.rul

SHA256 b6574cd78ee69912220ea07aea23d0c900b5b52adc68a8c084ce81dbd175b330
MD5 088e7d81d94bf95aa7de3c8baa1b1d48
SHA1 a572b6e9e4a8a86f992b3cbabd849c9ff82fba39
SHA512 ea074fcb2942461f2880452164eb5d11a84157c9ef5fee2f1add6f1236c6504e7be669c365305455fbc8eceb7c77ca27d2343e8d32df4948c9d553842784bdb3
TLSH
T15D41BC219D35486151F3A4300F7AD90C3BF49B256163EB1608D8E5472237DEBF1AC2AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1869.thehdvid.rul

SHA256 f164389c3e6039b5b5de66b0b2bf11563de135fc574c7993871b84d84b3ea5db
MD5 999add195e48890698f50025507a0e2c
SHA1 fbf53f7e412c4b7f3e8132cc02960f8176251148
SHA512 3378da1209874e199e73eb30154a589b52a3a4395a1abda698211670dc67178dc893d57049fbc1094a3eb56da5673f1f7acf60c558c1f725ed721cef45314c72
TLSH
T11161BE00EC24452592B355311FB6DA0C3FB9AA25B053EA5A04E4DA42363BDE7D7683DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1870.gosave.rul

SHA256 78cf74dd856e7182ff80db1b09d079705be2ca50e8545d2fba5d7192887a5817
MD5 a905a83b222a6dc7d0cfdf6844b41874
SHA1 3d46f6f4940acb8d4c007ed74c46693c32fdec28
SHA512 7e52f4cd1c0068d3c6b0e7f455320cbaad0d57193430888dbf8805d5bd92e0460f8fdc1d5e2226d6a791829e66bf06b92fcbbca246aed85c2e7d98de80b256d6
TLSH
T1A601F90B3DED570D19E7C05DF6C5F68B8FEAA67482E87CD12BA82D4213146827A41B54
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1871.notification.rul

SHA256 e187e6ea98ac7ad9afb49f9b36602a7fd67ab23e47a141dc4ad108ef930a72d0
MD5 480841607ebf7f1881120c6f196cc2a7
SHA1 162fc896b5dc73a7b6840067952cd2a45f31359f
SHA512 534da8e6994441f51901046cd9b9ed25330ecadfc64021f638481fe00b91e9c865e9efdaa6e0ee6360c3f92b594597e717203714a3e8dc4c676b920d7fc7c4a9
TLSH
T13A317140BD75C359A5732D045785DA042FB9D745A402FD8A49ECE3012237ECBCBB629F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1872.wordproser.rul

SHA256 1784c9dc5b98b70ba8592e2bd31d44269a9ac4074d68ef01f604e80f4e47b0e6
MD5 b3ab094bd211bbde7ea28a4b73f25e99
SHA1 53ef2808897d8a49741c76c430ec617325e52947
SHA512 1c72828e42f78a607aa5f1379abac2cbe0a685e0c7b0376a0ece2cbb870e72839daff9fdc6c0f4d6b8ba953ead52e215dcccacfd84f9f9da21c60ff4680ae69f
TLSH
T119115B019C395642DEB394006B19F6523FFE87257126EE4420CAD202A622ECF85AF6DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1873.onlysearch.rul

SHA256 15346c9d8073b593cbf25c191a7bdaee225f5e344bb9cd5bf7323ef24324338e
MD5 8041c8137e5cb360921859798e5ef581
SHA1 01fff45302d407afbf951583d0db2401782e1c54
SHA512 a7d240ca27d817fdd44c793a4849045133d36deb38e3094feb5ef3b4653d23b8fc761410fb26e597c193d7ac1bd6aadec3b49afad80e9d076a3dcd819f04e9cf
TLSH
T1D2E02B01AC9AC212E9B62B00414AF9D41B557B57C0C0FD8D2E5C2500550BA8EDB606DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1874.cineplus.rul

SHA256 48be7de38e12b0b6f09ef31555a112f4224e291a4ce04a0ce17adcdb15e7c968
MD5 0e4bfc5f3ad06daad88d1e234a8b273a
SHA1 e20fba29d80529c93f8e906002d7a04c1e3a17da
SHA512 a9a778b7b82ca46c3c8afbb2b75f6ef4b42f03e8fbd042a70b4e1f6b0931fd52faed1db6a561bab8a1af0e92f927a2e47b0a3c34048d348f4d674f24fd33401d
TLSH
T161314B215934485AA5F368301FBBD91C2FB59B763462EF5100D4E18523369EBE0AD2DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1875.stubborn.rul

SHA256 ac6fbb8c181fd869413ff79a4dde59402b45158f2383e07f44aeb5e5a07c7623
MD5 e4bda78ede25fec3ad00ace92f7b6f87
SHA1 772ff8f812b5d9f6556e5db4e1a89fe9078451ac
SHA512 6d68756d34d159f13d55aa11dd30140b389d1559bdf1c6dea44ee427aca406c6609be9bbb2bbb424ed603d1780b27cdc00178101f1276c09df7585d6ec98647e
TLSH
T1AE318B717D2582165A37AF090395D8502BFFA7435043EF9816ACE3406B326C7876D3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1876.mysearchs.rul

SHA256 b3075a026ea62f869ff065bd0365d3e32be56b1cc7278abf68ea7de8fcbb5956
MD5 3700e0f321520d81b332a4c39ac84993
SHA1 3b7e6f8e8ec89130d5bda03f7512714f33c3472c
SHA512 009013265ee2f26924b02ad95db7c6c1db639c4f10cd75ac2a6228579f8823c6a8fd5e2d36a10d2defbe47eee5b6a745596358f3d4703a6e26aae6bd4cda7c90
TLSH
T149E02B00BCDFC206A9B32A105189B9801B60939780C0FEC99D5C9600941EA8AD7206DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1877.sm23sm.rul

SHA256 d0d119ce441b8fef57dbf9f5b9076c163cc6d45f9af15bdd3c5368c044a6c391
MD5 386bec8e6928d5365e5d2b52ad7b9912
SHA1 c31f0c17f7a8709789b8c93ecd42de09154507b3
SHA512 b612788e67db95dfd0736a903f17496738a29fbc190effad1978436be44cff9a6114e07350655c36201a4ba4c796c31435db166e18b92574ba5fcb0f989d3720
TLSH
T19A416E218D38045A91F3A5300F7AD90C2BB59BA52053EF7204D8D5453236EEFE8AD2EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1879.foxpro.rul

SHA256 ab78680b7d2ede38d35439ae0faec6664c2231d8fbe5df0f1d3678b28ef91de8
MD5 cea5e0095c1c5be27d06146f1de5424a
SHA1 6a9dd219e1183e8229a5a419b34026675d3f8a83
SHA512 befa5685743fdb1c2e7ff28f58b2b2f0520d10d84e8e44ca0872f0533ea7ecf5fb3ee81a1eb47046a777cb5a9c05e8735a0d6b960e7e598a491e55133ffd71b9
TLSH
T161314141DD22455758B3350C471DE6102FF5872471C2EF8615EC7D41A226ACFDB682EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1880.easydeals.rul

SHA256 62134e16beef97ed4110bdb394245a41b7ab9681fa24d8fee3f08d7a4b66574e
MD5 55d511f736a5ab19aeb360512036f64e
SHA1 f0d936bdf4abe5519753e1c42f3dd2ca711b3f7f
SHA512 a6cde5d613fd68df3d723a3f720308f9b2b03266bb70a95206beed8da03b2cd2ac7b284f7782ffa1edc01c6928d87fe78077931439d6eefb5123c17956dd3932
TLSH
T10F21C25098204DD951F365301F77A92E2FB4DEAB3862EB5001D8D4593632ADBF16C29E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1881.sourceapp.rul

SHA256 b1b68b3d173c1a6daa3fb1d950b72d881092537cd4df3224b118e67c6309dfe2
MD5 f9e858a5288fcb2deec2ab861923e52c
SHA1 18a8285d97b52a513e4738fb62c87a84e287bdf4
SHA512 54ed0252829a42411b739b7153ccca5458e6b2aa22afecd00a44f0f6aee0d240a3ad3bd5469669aa03ed043de662aeb87a6e6d7a0c7b7992c679f43056da9e8d
TLSH
T1CB21CD322C70501B46B351081759DA117BF586702347EF8904E8E5026336DEB86F92EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1882.holdpage.rul

SHA256 da962dc5481c428699d2e967ee019d1ee1147086fd97c5d5a8840dbb10f78624
MD5 830c89e1020306f6c7c874a30a87bdd4
SHA1 6df73c83d7a5a63800eb5a2154076444bebce811
SHA512 c19032682d24afe7a83dd674ebe8ec9b13e0c70ff545e9c28327aa26d97e655edbb64173ad6c00559c6dabea362e3e80c22b16ac30ccd5a543a79135d898c95a
TLSH
T170118B916D758625DAB360089B51CE042FFD8A106083EA8814D9E2027632DCF4BFD3AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1883.icinema.rul

SHA256 2a9898146be7ae0e5f4659ff2fd0fc010bc89df5333dc40bc676d5a02972f246
MD5 5d9cc11357cdda3e6bb38661b7989315
SHA1 32be01274dad65c32c9d6169436e09317860f09a
SHA512 af2b1b3bc16fc8ba155ecff44b123e6a4d5996a881fff4414e2616058dc45701daf47c6cba6c42a7c98352c27bf663bc2784a94b972f386e6e3d4543bcc03cca
TLSH
T16131441199384865A1F3A5300FBBC90C2BB49F267162FB9100E8E1552637EE7E56C2EE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1884.thegophoto.rul

SHA256 a83e7f655e4cd7d31d25e01120323b6b267cb9c63e611d1ae61f8b00b0d582d7
MD5 1249ce90628d5f8a70c8f61f1c1aaee2
SHA1 330af30a514fb8b52e4c31afbc18fe7dd7654979
SHA512 6d0895644a62d8fac2a5bc0eefca65d74be9afb15f84b788a9f109655ac822c74bc6c8446ad1df815d592bffa422e2c5392ccd07c2b5760566057f9466bd0fc3
TLSH
T173314A108D75046291F3B4300E7A9D0C3FF59B293063EF5200C8D45536369EBE56C29E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1886.browserapp.rul

SHA256 c8c8d5a779480bbd963875e5bc1252a3537897e01c65ea30ae88f2c4b1051fe0
MD5 b357722fdca79df6306e489de6e56ece
SHA1 81cdf179640a146bd41a9a0db733781107a36096
SHA512 1f99446432db9eabe24e2c124d510542e3e3e1347ca6463cf901a9e3ef9193687c708b3d69dd15ee3a4c22d5a3dd25d060f2b07a1dc88d489be9b2902e0485fb
TLSH
T1B9313E015C341C5583F355311F76E60D2FB48A212862EF2505E8D9057233EEFAA6C29F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1887.hdquality.rul

SHA256 26c0b194946223d34350d33e0f6aa5cb4d79d6783d714c2b18b691dd4b2b339a
MD5 c0992ed53771fae82797472157fbb090
SHA1 55b4e8b24b2f3b9d8f937119a3561d79bb79e7ef
SHA512 fe5b3fa6c9ebe1e995940667c730b4c6c844422330029175e90b2d06d6dd05ccfca42575de6695ce52e93b795bb65034c7f3d313bb9f5c5a2a2f1c3d0891dbef
TLSH
T1FF315020AC304C5983F324316F77E51C2BB49E613866EE6402D8E6467232DDBE1AC29F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1889.cinplus.rul

SHA256 bf36b20ee18abfdcfdb95a6d422d1eea4ab51fb61f785f6ac9c79730ded44c9c
MD5 cb8f49e80decf30df5a4e604275744cf
SHA1 371d829283258efe15e3e45be2272791c85dca45
SHA512 fe786f928ae6567c1b88d79febda67672aed4be86afd31ddf052a36f3f5742268007d0512fe935a484da44764ae753053b6714ceb5543197bb3af1f6677e6210
TLSH
T18131291198204859C7F354351F76EA1C3BB4EE116472EB3900D8EA452732DEBB5AD29F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1890.mediaplayersvideos.rul

SHA256 6d63e2eda1a5a8f3f9d47a33a2bb7ad222afeef68744ec8b32423dc7f6ad3b85
MD5 15d00b276aedc0a22459333851037e81
SHA1 fae349d4393ea808dc77ab0e87803f49a1d90eb0
SHA512 86828b0593ef443e4ac3f99cb31c3534cfac22eddd6d587d713b5c84b9263bcd66d1aa6e074aeeddbe76657737c70046649853dfbfda6bb85d549328fd58df54
TLSH
T1C9210550ED604D5550F3A4302E76A90C3BB19B623073EB4051D8E84A7922ADFF6AC2DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1891.radiocanyon.rul

SHA256 b9643df1432486ef577c6937c21794fa13f6a12d67a5f3fc180d439b1bd82bd7
MD5 83553bc5f317aca8fa41aa382a17ccf2
SHA1 c79cf23a36f7ef8a26a7cb343ce12d481907d1b4
SHA512 13fb172f619afc00e5dd5b00d4b34954675a7f5f16f5b493dec73daf8bf31733a5ac5fca1acea2d432334846347252dfecd55597ecb25ae4a278eae159f14457
TLSH
T123314D00DC64495987F358351FB6F50C2BB4CB9162A3EB1500D8E54A6336EDBBA5829F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1892.pandoratv.rul

SHA256 c680ef363c01f59f02a1b8d0ce62f9be1bf1e38ec153e922ebc96ea9806e5d99
MD5 d7044d62b294cd1cf29467e79a6e44d9
SHA1 1111b71d838f0884b8c3a6e44c5092d3cab9b9a6
SHA512 0e4e51b4220ec5a27340a807c57536679726c9ce3f39ece8934701f981d60baaf664df3a085d16d767c75810342d0624040b8d8499ba7fa108aa095451723989
TLSH
T18201A7092DEB423E21779191EE50C1846FB12B3590E9BA47E6C5AD010225B8197C177F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1909.vonteera.rul

SHA256 2c14dd51160ac9b1637b4556ebcb2ee683d667147636ea45479210de9572380e
MD5 11609fce274366602943203f40cd9104
SHA1 1deb6bf69a851fe1110aa5c02381478ac6b489ec
SHA512 78040eccbd6710baa444081fbfbfbfc86d417bf99827d6e1ce71252849a2649e516fdd70e0d1062d70d9241baef852b0bfed84213092275d5cf85964e09e9de3
TLSH
T100014864AC24021280F778069B5589106FF673B1A183EBDA18D8E151152FED3CD789AF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/1910.youshahd.rul

SHA256 9ab608fded2ede0214955c7cff33efdd20594f1b35b2d2ab5152c572c3fd5fc3
MD5 f4561a77b26c0f314c5f2e86c370731c
SHA1 7caccb3622c83c9420d143b0a667bbb302eb768b
SHA512 43061abeae2d72f19cf462a286e500de3c388d0dbbf178206b820d55d4a04f2f470a30393568530ec0d0b181e46016949613ff330bc63abd9f0307a68ca4d416
TLSH
T1AD61BF614A748067A2B331040B67DE2117FDEB5532C7CB2111CDED6A2B36AD788DC69F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/85Play_Games.rul

SHA256 ab4b4d46dc8f6f2f062e314b517e01b1b5977dd2b3c54b1b0a35890dc9ec1179
MD5 a58106835a1a84de94c5477ae693cc69
SHA1 b81071749cfdb4cd98b8087554b36f6a73cfbd80
SHA512 954d154ae8b6be2f41dd8631325e8f303fc34fb8000ce09c7fccb4288672f1150aae990c88123eb99aa29c97bf44f61ca4ccd920b275dbd561111a83fd12bbc6
TLSH
T115F028137FDADBAE082615D9F6A9E25987B309840040388343ACFD0E32316214B792E4
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/Aflamster.rul

SHA256 358800c93f4a4f00edcf7092abe00b264340e1f16325bdcb018fae395df348e4
MD5 d57cb127a2774d8a526cc6cf5ab500c9
SHA1 a9cd865e4e09935a8fe24f89c837d862499b00b5
SHA512 3c211b34a789ae908f8ad268449bef68537a8b60a82c29671cbd69a191a484f584cb2f6b7a608b340e9cc6f27fe34874a2fba731ee94d34194abdab1c34920f9
TLSH
T11A312E43FDCA874509C782E0E75CD19E1EA2EA9580D47EE40BE9718D1598402DF3E78B
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/Ask.rul

SHA256 dd7d6338607635916e9cb23b2c80b7219150decfc776a800e8c2759fd2e49a86
MD5 844ade28cbb79bd1fde0cba0e77f2e25
SHA1 b234deb31abedff9d17cbe3743dc4830789cf0c9
SHA512 66cf67057f3862bac807f66f87f53311e1061c1c1f60c67e6738b971405e83293d1d48e44422d1b4fedc47e6adfd4cc826d628b707b5f1619293f0361764d3cc
SSDEEP 96:CZ0I0d4nj4nTq6HC8ScoQHK6LN9+BLLZOMbYNLKANBG077lDMedrA6oVb1h4MVwX:CZ1XX3+flJLqq4kGE9
TLSH
T13932CC620820C0BA54B776080751FD101BF8CB1129CBEBCE4BD5B59A2375EDA95ACBDF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/BrowserDefender.rul.bak

SHA256 0eff4a2159fe7ba4ab2126f3399442fc2747e2a12ee0142390a954518706a111
MD5 996883e23193cd69433c5545f29a3868
SHA1 0a7242df3ee16b60442946c0319becd3f0d0e080
SHA512 90f1c66717d0ae168e6f1cb80a336ae2516efd53d1b012f48fc0d828da025f6cb217f76daed794ea8731e56fab173120227609b4f8e17c8075c0993af6e455fd
TLSH
T1A671AC41BD55530E94F36240AB8CDD042FF99BB1D086BEC8999C7601252A5C7CB793EF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/BrowserProtect.rul

SHA256 54c6a37e91c975bb1c9648e0f57f76a7a9a860fdcd62871901dbfc3f4304f636
MD5 cc5172db97d366a0045e331b3afd5548
SHA1 11cdefb0fbcdb716f359548a22f4e35f9c949ad2
SHA512 6daa34f677dd510e85aee71145a49b896535ddbbe1a4f5583fe430520a487ecf184a497c0b666e3bfc6177854a6090e7d9fb79c2ba98ce5b754f44ab6319d9ab
TLSH
T131B012025ACCBA0A1D953988F809DF5173E100C00082719307ADCC09323424430681BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/CouponCompanion.rul

SHA256 5332842b8206fb2d53d108ece9258b6672764333e60b7e3b88e11505ead1ef50
MD5 13ea496e9bc6f3a8d9c642da7ae0dae8
SHA1 cdc42b8fc038a18a783c7b16b977ca489a9f4af0
SHA512 5300081e9484a6f69a31736a475bce31e41ac0eb1ebd5ea5f3958cde033e232dffe437fc3779f83c9fdc1bf2c92a32191d0853493a34c680f96e2ad7fbeb6060
SSDEEP 96:3J1GhWcbGitrlhGEYxef8jttgxiyvzEvW7WwMek5k974bswESB:2tkEO08wCbj
TLSH
T137F12512BDAB961608766550BB89EE886FF94751C081FDD406FCF8801664DEBAF603CF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/CouponDropDown.rul

SHA256 e59f5885c18b60f861f5a6bc93f29fee2f202ea8337ac3ba1199e56b0558bad8
MD5 1696196cbbdd4dd75262c72bdc367d26
SHA1 454a997248ecd3a62f55760920e12969a5affa38
SHA512 d4b57eaebc16bdc358bfb846f46b032d95d3f14d5071bed821183e08b7e28dc0f1575d3b89df8fd2c23ca9c1926fa32dad4b35b737edde43a41840d8c0144fa8
SSDEEP 96:3hv5VeEf3A8VUENO8CuLxUKqHLMXe7ewM2MhANATAhAKbA2AyA+9EvAo:RjQ8+N8pOyCZo
TLSH
T1D8F12642ED9386A20B77600CB689ED896BFD4B158181FCC006FCB58566A1DBB4F2538F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Deal Spy.rul

SHA256 72d6cb87d0cd4084048d1f31e39b091509928c264e8332799886162f45132996
MD5 e107038e894d4c7694c5e16413f9d5ac
SHA1 7ef3e62b0f77fb991769a0de5b4736bd41d1f413
SHA512 5a5c68bf2b6ddbc3002345339b63973451e43219ae8d4fb8c29ba7418f6dc58ae0b18ec253f9511d40e10c21348cf80a2db85fb050496f054a08242b9c241252
SSDEEP 96:32POmkDB8BrrolMTUAPOUXVIlGOTfoDq7qwMCA92l2k2m2bb2L2X2xn6H+c+k+KN:mW8JwMYAGUqWU8LlbyCGt6PR
TLSH
T12402CD41FEABE71104A24145B749E69D2FF24B908440FEC947ECBC4B1A27A975F603BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Dealio.rul.bak

SHA256 df8ee3b1085d4d0bbd20c5db586e88c8f2c9a44140684f8502e7ed6287ef4454
MD5 9351ea1040786fc7dffa3df6b482bdd4
SHA1 24f1c89d2d8d3a5a10f67130791bc16541c84315
SHA512 fc19f0d0863ac244c64c3b5a8418e46577ab503dd593eafa59b0f8d2143cda616db2c24a76c3ea4bbd686c1934f1d07b0a0c78fbcff02a057be4c8e565c8f4db
SSDEEP 96:8xTNKAjEjyjzxD4+4s44Vfy0Hc0HI+Hzjf6Q0pXSkBROf1y5queodpy/Ix/4mYqe:87LvK1k
TLSH
T132E1B2914D30801BA2B3720847A6DE122BF8CB6971C7EB5501DDE8552372FC786AC2EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Deals.rul

SHA256 80fa9c82ec84df6367a87ffa4db279f3320f16296b32165f7eda0a7bf287f74d
MD5 f86f6ec03d1794ad28a8f2ccc51fc5ab
SHA1 411096f3249916b7388344818f5490108167fd5d
SHA512 d386a787d2c16c8baacaebbb35bc7e76bf93ec9489065cebfacb9d1b7b308522702ceacfbaf18898350f321481dd886ee94c5642e437510998fd47f476d551b5
SSDEEP 96:R0oYnkhq8HjVgw838xHmfMkpVepg7gwMEibuJubuJuCbuuuKuGDm7w:Rm8HjKwy8E8yYiYCiht4mk
TLSH
T185F14C11AD47AB2204BA8140EB8AEE997BF757925252FCD4C7FCB4051632F570B603ED
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Genieo.rul

SHA256 577a79a526131746707a7690e2d2b98e08a1481685cc7507a46f66a02217ae61
MD5 e4c33ead38ef121323e5944a59b9e835
SHA1 a9f3097e812bb0e9ecc28a0a1f33934c6003fc33
SHA512 8526f5671e607862a2fe208638c803635034729cadf2bb513a94a64126ed3980846957f4a081b993734bf0b6cfee4eea16219833d406121f6305ec5ba8812aa4
SSDEEP 96:3Y2jI4wuu/6ok+YjHdr0rpZLJliIrlCpuWmfruwzpNTKTsMUnbszMs3ibihifi7K:o2hAhZNj
TLSH
T1A6E15CC708A2F4AB8DC373A2F160EEE315D74CCA5BD854B10EF92DAD52984167F418D6
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/GiantSavings.rul

SHA256 20b936603b693154988b8d201d793457f0cb274da66875588f10c34f96589fd7
MD5 a0f27afd08d9a7feee7a1c6df6366c56
SHA1 6cd6d36cc813c2577c8a744af9bd6bb11871ef4f
SHA512 768c9758dd13a17301903d1be60795fa7d81b8f26232748054f0c0a549eb98d85a7215396bcaa22f684385ab50f08cee3c2b84ec2c72891f47828a0bf974e81a
SSDEEP 96:3QG7rjJjGT8RBOMUdbt44I3dgURE575wMR3E+EG7br3Ram:Ltq8RMMOTdbx
TLSH
T1FDF14C03BE4B821909B68960EB86E91D6BF597607051BCC84AFDB9065378BC70F7438F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/IWantThis.rul

SHA256 ea8159c26d1e4b593474eb09fd054b839386b0acb79f7d3fa34d6f9c4de8b235
MD5 7ec2e24219a24d87b4d529d80ffabe85
SHA1 2df1e53d6abf39d7578f9745728ca1ed3d86827e
SHA512 2132d4b73b9d19b1e286c7db3c65add9b122150e2a882eb6f519b68a24c347bdfaff731b19959d6e1864d01df0e813b9932155b05cf2d0fdb9e4a8c7a912b451
SSDEEP 96:3yQKNCayFMCrzoa38K48Zi9Za7ZD5iKKnrs3+7+wMPHRWsOqLeU6lFz8Nb15krot:LKNub8SITakqRl
TLSH
T15D12E082BF93D729147A4048F605EA58AFF15B5152A1FCC50BECB80A1279B871F243FD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Inbox.rul

SHA256 b41c00fe4b985d2c130c1fcdf6293bac6fbf3ca6d1ebc8bdbd261c475a192bbb
MD5 91105d23e0503ad4565ac0baac68c7af
SHA1 81303666de81d19b6d22212526b01cf9efd4e3db
SHA512 1101aa9df562a603d841c2238cc1d9ce36fbaa2960e00be5b3cb2159d51bfd96b2d3316d3700e8ab030a6b9fed28415c5066d8cabf7615d16f24322d9b8fe5f4
TLSH
T17E71CB226D7241EC193314080FD1EA042BFDC9106587EE8A41DAF5837375EEB4BAC36E
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/InternetHelper.rul

SHA256 f8f76fd51d7d1407117780da7d2d35f194a7be54f96cfd753b6166d5d45d2acc
MD5 75f209b9d6ff2b9808e49ba7b80ba540
SHA1 fd770989e7be63969d8d9dd6a65eee8084f180e6
SHA512 e63d04f971ff1fff053891eca305acf8dd42ded5873f399f8afdf32b1cf67fe46baf5e3213a53ef74fc5f44274e0ba4f818f5f1707c3819b758814ed189c67e5
SSDEEP 96:olm81kZKIoSDbcSKaga0Bwzf5FgF0cM7K7x7Jm7+GfmdZYMp66F60Nd9O0z0/0W7:981kDpBdOh00AETlNLrmRm85WY
TLSH
T1648226233EEBA2AB05F9C890F3D1961F87D29E6451E5B4122FDF6C1562CCF50234876A
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/MixiDJ.rul

SHA256 7e3723cd9349cc2ef34314cd7d5f6372dc29fa15d10fccb31d16f881d6dd35be
MD5 3dc47f80fe7ed139c599f24fdac67bea
SHA1 5f1bced88c282ae54c6d325e1db00b3841ba3a5d
SHA512 b17ba9439cda466b7e5fc82d6c494657166a6d8231b5ece7c27c8a03dc32dd7be87d7bece33df0f77fe601a435f9561880b92848fc8450f1ca80456db4e13487
SSDEEP 96:zOLjux3ylpZUtgtm/K76UFMwGKTlI4lMB8a0hxyWum3ITGErX0drcw8bDyc6cAkO:zRkRa4lMB8a0rybJkrcw8nd3BW
TLSH
T126F189116D634169193315046FA1E7142FF8CA616183FE8929DCE643333BDDB8AED3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/MyWebSearch.rul

SHA256 77e27ead72a778cb71c8f35d96a9f0cf8f38e27f2ec275b21e324dc60f37d381
MD5 cc9d08dbf48df60c78448f46b40f09e3
SHA1 99401b9d286d9ca136e974443a789a1bc12dc6f9
SHA512 9eec48e8669751ad8459fa1f932c6cf45086690fe5a66054808e8db2d44fe439db7fb0381d22808cc0838cdebc605ce5ec8e9a6367ded7dcbea60bbca989e99b
SSDEEP 384:PBQJkkfNhpZPpl7LFFuG1USvxeGX9gKSV:5QRf3xl7L/uk9g
TLSH
T12FB2E5215C3214A9197314045FA5EB943BF9CA25A183EE8C11ECF6473336DEB4AED36E
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/RebateInformer.rul

SHA256 2b7ad9f79dfa1a270968427b8991c83ca1c89fd50419a2bbf8ecdb70d6cd9290
MD5 f4691eaf814c333969b0f8d0a665b07c
SHA1 d18d36dc083a286c71441f01380078879713b52f
SHA512 5a9cac4251d5bfd9d8b122a60addfee7c293a64e0f574fbd20e7d3c5f9c1408d09d54d8438b87276ecffd9392a260c7f6b2f7ee86061bdec4c2c58e9ee074470
SSDEEP 96:8tlPVt3F8Hu/M4iCQWoq6QJh7ZBOfutc3TAn+GX:8tlPVt3F8O/riCQ+BCc
TLSH
T18AE15C221D2245ED187365480BE1EA002BFDCD20A487FE8901D9F5537279FEB56EC3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/SearchAmong.rul

SHA256 40fad3557a6cbd92c8affdd67f5508b30b69dde3cd18187c076834e8087c3bad
MD5 c61d64cd1ae580d59bdb2ce1a5719619
SHA1 ecf1b57e727fb965860756741125edbc3aa7b01d
SHA512 b3b6c27d299315c04dacaecfd1d65841fdf55fd976dcc769d72f99559e31994e32fbe08649121178d0ec4cf602ef7688fd15a78ef14cc221bfe58cab30b74af3
TLSH
T18A313B11DD3505AD8A7324040BC5DA012FFD8715A187EB8945D9B28AA12FCCBC7AD2BF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/ShoppingSidekick.rul

SHA256 437c344c8fe0c3c3dbd360044940ca7089c995042a68a4212ad1c39a36d3d00b
MD5 ad696822fb97fb0a726041c2c95c89e5
SHA1 09c0a0e431d588deb1188e965e166a69efca17af
SHA512 20aab5c9f74002797c3d50f111ac0bb8a28a597cf977516146fcecd5fce8952b4df6fdc54553c8b6afb8000dc11fdb7ac90cd72c35215a617fd26255b6d7b613
SSDEEP 96:3m1Jfv3rmromdrX8CYCpwfXo9cbE87mOAI41pK1c7cwMwW3fYfhfHfkbfQfMfAx0:W1Jfv3abD8PN0cQ8C1A/yB/kDaGL
TLSH
T19702EB23BD665A6608F71488A709EED9ABFB6BD1D140F8C406BC74421564EA38F703DF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/StartNow.rul

SHA256 a4b13d9bf5877c7f1d42faf49d8fad28e3ca3c348c912d7d4837a78e4110704d
MD5 66b1d6b28535855a8b3c7d35314d799a
SHA1 f8abcac93f1f947b18919622a54d5fa285b086b1
SHA512 919c628aaa53e4967ca429096ad8f06c9650100651875c1ce44c70a9ac1dbf2e2d9a512aa545b207b055054172285c0b970f638e592df1d76ea9da6f96c8b838
SSDEEP 96:3MaytE+w57aNHU5ISDsJA83CiSxMULiuiQGzuxZW:8N+SZpD
TLSH
T16D91CC21BC6245B9587714084B95E3042FECCA25A142FAC915E8F54373B6CEB4BBD36F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Tuvaro.rul

SHA256 9f74f1f463c74a6c9dcfa9152050fc97a8c5c233510d7fcd68d2062c575826cd
MD5 a98a1d147347fab44891a2258c70c0e5
SHA1 363cb9725056c56a29c63b9b7b35c1a39d6f661c
SHA512 9e68794e8cc0e9e2409d2e1aab41b2956e28b4c3f649f72f7e088c538104f2e298fb4b8533698421f5c6fcabc75f90d6fa3b1ef8659bb8a8baac494518a63b62
SSDEEP 96:+nbyzgzm9+0j8VWXiqZqFBGeJHf/AnkaM49s9MLETx0jML5gnY/+IvFZKoXSCXR:z2Y0/JHfYk749shVPh
TLSH
T197D179125E7645A90A3340485B59E701ABFD8B90A183FD8906DCF1633733DDB0AED3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/VDownloader_Ask.rul

SHA256 57f96e46f4587e7ca3a82bd296c781d11cb5006ca5058f55430f1f4007e4f859
MD5 ad62f81e7bf9916e8c366074afdf2112
SHA1 5a07ee9f1923e9f1e660b7c22b54e17353402b00
SHA512 bc608a6d66f01a33979dcb1a31836c2bcb582eac5c826c32cb6ec9a109fbd87ebe40f5debbce71b6d9e9a5c3835280520b584f41d271e3827b344a86ed6fc254
SSDEEP 96:XI1igej7d2jWP5AykGSAPkEpDJf/1HX8CfJY4BeOJvvY7soW5mFcFwp/LZkYN5Nm:YwhqmnVY78s/Jjw
TLSH
T120020F50AD2581266A732208179AEA202BFDD6956283FB8506DCF51533369C787FC3EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/VidSaver.rul

SHA256 2d144e43572c476e55305568b032f5083169cbedea433cf5b6d88883164a67c1
MD5 c6312e8c83f3bc3d3682dfe60c008e57
SHA1 d7a1a49c98b971183492118d8a9995d8c1e2288d
SHA512 a8b7f2863523b4e6db02b2cf5a3ae0cf481da72c7ef77e47223621f99ce08bcddf2216fefeb92f761015f134fbbbddb8b8b6414c0a7e5a8e01542f095a11ce61
SSDEEP 192:UDSUrN8pUxwmHKFeyZg/+iDUVJ2XNe9cBDd0q22:Uujq22
TLSH
T185D1BB02AF92825508328584F656EE587BF58B1091C3F8CA27ECFD4A76719870F283FD
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/WhiteSmokeToolBar.rul

SHA256 09cf614435e1928f2c2bbaafdb312cb88f638f3be8cb4b02c7d2532ebecdb730
MD5 c05fc1d098ca62549c5d270f8d18b16f
SHA1 9b67b9b92f4c18ba9ffcdced2bf1a67d5b58f1b0
SHA512 3593479c363512bd1751976e571a482d4b262d31a49d32e40fa4bd6e7b601b54ba3000edde5667c9ae075c7b428b7c0dd1cf748b72c453c780691a7a8517b03f
SSDEEP 96:ol/TjXSIoSDbcSKaga0Bwzf5FgF0cM7K7x7Z17/G3168X1kbjFj0CKcttzt/tWt0:UhpBdOJ5zbB20HmHmddHSCGWn
TLSH
T18F826D03A4CBA197539FA8D4F3C1E54E56E6CB2942E6B0021FDF5E271289B2C37453B6
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/Yontoo.rul

SHA256 d4feaa7bb778d43afa2262181a23d035596979306eac2dd4dfd72370d78652f6
MD5 eddb93f27e0530cedce610576d1846be
SHA1 661a522248f5db1469233ddb4bc01b12718b85e4
SHA512 6af9e22179f3bac0869cd930890c3110fc4fab06625b7d2d81b98f3e4a80fd6a5c817b9561312311621ea47856f6498a27a5c9cd1df503045ea9b50f2c5385ee
SSDEEP 96:8POTy7ywMaoXYNmsLsAqEbI7A2lcjOyUCs/RS8HkR:8NOmzU17y
TLSH
T1F2B100521EA9052E16735204AF71EB502BF889A161C3FA4512D8F9473376DDF01ED3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/appbario7.rul

SHA256 02f82791ea4583aecfa021a79bfef0b4811a5ad20cd40bac0c52d5f8e044efa8
MD5 99e6fb7dbe9895e09f705753a99845dd
SHA1 f760c1597fb21f65f12e35f6606ed5b68b97f3fa
SHA512 40343cbfa2e291fc9055be9be55e0a5895e5ed2a32cc92fa53aeb47f59112164ee6afd44530a8263e637097836310db99b6d30de1cce28a064c41f6d9e4d6872
SSDEEP 192:Sfbyj+IDRdIJk/kyniUeQShP4/olBhBdOR7CJVLdJ8Wn:abyj+I8UkZQl4C7CJP
TLSH
T1B5A2D201FDE295594D83D20CE3E9D50A8BD68583808C3CC41B56BB5613EA9C38FA93EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/oovoo.rul

SHA256 febc2815bfacea0bebb0a8867d0385aee94cb5fa4e86b51ad09f6badcf4bd4cc
MD5 6b337296ff83e6a4375de6da5f6bb781
SHA1 c19344f96d6d4fdd4b9dea8d6570ca2246604f79
SHA512 ba22c83feed299feb0e6824f358f2f2e8e7df22e713aeff0eb28b30ecb8a10ed3a0bc2779649bcdfefc3db1b383991a3c825a7590d6fbf43bb87be3294eaf665
SSDEEP 96:3wCH4nj4nq6HC8ScRFRkRARdNRnRcBRpRx1Owv85L2MNto1QG077lDMedrA6oVbz:yKjIcFRc3//+flJLq0B8
TLSH
T122D160514E348126B1B376040767EE2127FDEB5632C3DB4201EDE96523369CB98AC6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/searchya.rul

SHA256 20d875d1dd6a2e7818ed11ffd9c2674fb94511a23bb2e70e8b1fd396fd77d8b3
MD5 025ae7ac88c42671ca6e78708732f093
SHA1 4d7e0cc9368b7ddb146705b00f63e493bb36e201
SHA512 75e0d3daa7d88d7fccc9daf7987c804638d785a697cb955bc2fd9fee064a1d7c1379cc7ece9078bb15a83e0ccf6fae2fb7c493ec06df6d48bd6a13c8acfbf67a
TLSH
T10E8126625C3504795AB315041BA1EB103BF8D661A183EA0844EDE283B377CDF89ED7BE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/uTorrentBar.rul

SHA256 df5adb03dda99a5641e6fa634b1fe5b6d973a4302de972ae56970adbf5251ae9
MD5 f5d91b1d12f2ab6e8056dc3405033f05
SHA1 1010dfc3e092714b98abe64bbb95e9c28c393982
SHA512 42861808884a1986f9f53789b1097a9ff030e802703ce601896c91597c55bca501e299c7ec2e43fd0cf350c7cb4fb27d5d1a794b0d96a88b345e5368b582a335
TLSH
T126414A42BD8A83550CC381C8F758E6970DB6890841DC7AE55BC9B48A029C50BEF753DF
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/Rules/uTorrentControl.rul

SHA256 ba7d87e76ef2103745e64f2b3f4544bc9bb039d7b56cb7b09463693278f6ae90
MD5 7c192ef551934b17c0047c3497d0fb41
SHA1 c304c13e19f65c9912f9bff2a0bcc5d4b4860fed
SHA512 9aefdde117a7da997b2e37b4b16602afef3439c1713d5a4ec9d6ccd66bb05e424424f3704e62adde7444f68c71f648e0a9969248a8cd6bddf5b1996aaa0a711c
SSDEEP 96:kiIU7K7x7D7/GlnH+6rgcFc0Pbfc2z2/2W242pA2WTpSSidAZN6WeIxEPnsxq1qb:kBYa6rcDTdXmrQxmuNR
TLSH
T1BC72042336C5DA6704DBA4C8E391E21DDAC9A4BEA1E477130FCC6C8621EC716B799374
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/Rules/webcake.rul

SHA256 430e35916504207f5fe6baec1c06a750de1376c1f354bc0b301c04177ba1097e
MD5 5917e1b15a26a684564fc511c5d9a8be
SHA1 98b20e69d4144834b240688f0d4819568d14b65a
SHA512 a62f940b8a1568c5bdbe0ec8125dbddcb88c23ed560fc22a35d73d4f9e22be9b0548b67a38e669c2781bdb16c353175b8fc810ac00460b68e9e4c3c3d1de575e
SSDEEP 96:35sLcGtVqilig+iS84vPE4NvrdrzT0Zo7owMcKRpPt4G7:psLHUGiEqpvMdz7
TLSH
T1D1A10D521EB9555B0A7325486F72D6916BF8C9A050C7EA0512CCFA0B3332EDB05EC3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10004.png

SHA256 19dcaabb6ef4946e91add18700bfa3ae809fdfe7d1a97587dccd00e75503ab43
MD5 c53b77cf1c4a1d7d8486443a72a2db1a
SHA1 ac53c9ac053a627993ae3afe409affedbfb8367c
SHA512 fdd9460c925b58727061e46cc7f286e80bdea78aecf344c780f2b7512d9ea0bdd84bd533ccc81697497c3f0f13855bb270c43f0dc536c8a15c705361e4374f4a
TLSH
T1CF41197216D30DCDEA8DE3B346CA1696EB2E36500E5B22248DD15628263680BC963E9C
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10014.png

SHA256 0b54d0d8115b734dc3308ff713e68d2a58bfa17b8c840be17b2ca52061b82f15
MD5 d4603b7c087bf4a530a30abb4daa4c1c
SHA1 4d5d50edbea8e56beda94bfad923fe88dd5d8e29
SHA512 e19d4f275561d18d4405dfe6989e8fe4d90dd49513b17f359a3f840fd50bbe74de28359f4cbf3cb2fe03e57bc0aa9aa1228a81428a258a290d18f136878ff7c0
TLSH
T1AF512C521944191CB3D705F1922959BEEA878F462FE7B5CB6D25FF0F2381F0401E1229
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10017.png

SHA256 9d1de44015c7f09df6e8ccc71e7089991f4e088d7daacc06540828455e12f1e7
MD5 6fd437e8e7ada5e135c90e91b5d32fcb
SHA1 863ba2704393a039b9a47cd8ab67860ca5b1db9b
SHA512 06903652410ac74a3a0948e143fd4c43eeb4155a68a543b6a3fe9db964e1f32e44e87fb6c0199d5955a393a189211150f0c182ca9f95139fb3574b53a68c7ff1
TLSH
T1EE514BB2581AE51AB9BCBC3281A57081E4B75778F93FC31824EC4C2E4166B6CF95C1B0
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10021.png

SHA256 2fd043a7fa2e1783a29202738c48fd23baabc4ea9d1658e7565cfbec1ed45b3e
MD5 8a40bbc6180b83cd33e0da063927e519
SHA1 21d607c967db59022dc549c897a9454c382a1e16
SHA512 689d945a670b16459e194b8d46204fd1296c3feebde93af2ce414c5be85684917b1a71073ff9879a422c9eaf5ebc2a1a1f536cc3ae2813654e4847b7ab08b03e
TLSH
T1CF716DDAED27203F986C4939AF918AB0FC5C418F470128ED5551411EFEB9B72E090677
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10023.png

SHA256 b5bb66becb5b72928e38a70be4043ff20e1d2fcbb7f49b062174f8f1c1ac2e56
MD5 6fbe288ab4b09e14c859c1c8ede9a2f0
SHA1 c0d5f7e3c844b6216c385317ac568cd7fc6447f2
SHA512 eafc10eb848debe48b4727907d6bb551fd1542d4f8a5c64a765f2b3049b3804dfbb3a4c8bda9f178ba35b451e6e112bc85df19e6bf8b63ebec8a8a28f6c48108
TLSH
T114716C634282AC375ABCD9B1923AEDF7D897591C41A38047713EA274950034AF307BC3
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10027.png

SHA256 cb454604fba17b3db6b5d4802bdae0179eec4c61182bc0b09f6aa61aa1a730ed
MD5 8f0411c374153964ca090ce487c6ed9c
SHA1 7e35acc362b7cbd8544066b7094a1a743c7a5a98
SHA512 ecb82b2faee1c128bfa2c33e38c96c490694b94841c193bd86d242ac12f8c7d39e2536ef1ac2fdf78ce2ec40de941cee20a6d6cd9a0497ec0bf57f086398f13f
TLSH
T161817E43C6181737C803757718BA5B3979EEAEBC33046A1339A3DF5127EAE45C46C096
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10032.png

SHA256 ebf45ea7344d47a113d7be86ffa43563c08796a776745f9b577a8f2b20a40a3a
MD5 36c851e5b5113ef2bb952e2bf136a7af
SHA1 739b76ea55d9ea11b3d04c18917d9dd40e222112
SHA512 55f5acf3ac1fbc634f9f8771f50a3b3a06d45cb05f5696c52bd8a3e73a14c9629650d19590f59a5aa63d090bb21bf7536948248985c9bfeccee98afe98a789e3
TLSH
T184715C8BE3B0FD61EB4223038694052BE08D7D096E3C0D1ACC0797622BC613BE04F686
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10041.png

SHA256 dfe12819b4539035db73a4abf5462bd0f1874fe87f86b61f1b382a99a08e77ac
MD5 b7fbbe669da6285e59e159ae22c87b6b
SHA1 8a1bcec3267973cdc5fee98a7233b9a0855df5a6
SHA512 1df989908bd7034b7f1a02b724763dc9f2379288f2e109cbef858a98e47bee0e99dffd0a02ece4082d2a5d52a2701b7007c6566cf171a55f2ff0893cea1151c6
SSDEEP 192:5S9/qWBmAG79xBLIZWkOL5HdCxLtxsUZL35xe2O:gTPex6ck092YUZK/
TLSH
T1F702AEAF32E9B25B11E6039AC19F41C7D2D205290FF7F2051B9583B059156CE26CB7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10045.png

SHA256 5ee82e2c71b3c1a384ae3144bc4bbb71280ebf34f2f2b1bf47c5f32100438af9
MD5 44b276377e660588e41fef7c1a1d3023
SHA1 6d25589b40dd40febc4056332d9686afc849f04e
SHA512 842333558b30148a04b2c754e8cc919df5e2bdcd15297f77bae5909b9c31ce3333ee1c11e380abde1e0f7d712ef17d4c2c2b9d2ed51e3575fc59686918823cd7
TLSH
T14A717EB2A8F01D91C2563899959C19239EFBB301A340481D1315FF34F142409B0FF1FE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10063.png

SHA256 303f488d57cb9918f86c1aeacbd1e607c01b256df786d3c4488c79796699327f
MD5 899cf19c1dce69e48ceaade6aad1a59a
SHA1 ccd412310280b226201551e76ec6438c47584b59
SHA512 3bf626f9ff9d214880053646f61d04bdb645566231a08b209ca075e7a1eeb788bc216c9344f24ad31d49d550e94af97f435ee9818d3ab1e51640e8fcb9967823
TLSH
T1E6514ACE9682A9D3CBD390287B215133DAB4C475B94898581DAE14A2B4540BFBC6E2DE
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10065.png

SHA256 0f53580ca5e7cac020c27bd237248c065257188ec91b94d514000ca23ffb243b
MD5 f3bcdfedd515e94fc3cd2509ff6c9b2f
SHA1 e08b54bdec69aa04ba8ac6e7a29c1bf58be23c2d
SHA512 2256f6eda5d9c156af34df26b6fa679928cb853911285dd8a0b8c3de11a3ca320bbfd264054fbb4106dfe0b746b068caa887c4a8b572dae326893b569db7b6b7
TLSH
T11B616FB9712892C760C13143DC3BC12A7B72F5EAD435239A67C3674CC171A46B71284B
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10067.png

SHA256 b0a800aac828387ebcbaa3dcb9ec209ab25a069ab1e38fafd9207625e9265543
MD5 eb41f89664d8f7bb401928929a1aed92
SHA1 12144d76fc967e66daae15184f1a945d45195760
SHA512 07fab1995c8b49817a6f78867e8e0fd060885240d92c20f0253ee04e7af843a0f8e32c2f604ab7af7ac4f483c0fe5e5b53eacdc7ddb5f5d0b6e9aec0dc518bf1
TLSH
T106816DFB820F65CC32366552C0F70A35D531ECD8FFBB18055A58E9D98431B5456E5A0F
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10092.png

SHA256 93d13c9c979ddabb3c73ceb6118b4e344d0e8b7ba9e3a0e31e27bdc82852783c
MD5 e31de3985eecd275be64712040f8d429
SHA1 bc396f3a5366d7da0a83c367c6cd482aa29164d2
SHA512 b7437e43df31dff0fb333a38d167b7f6fc23bfbc7c5bb315ff45a7f86005a92e563b21d96834ff1ce477d3d315c65e9183c44256d8ae16088e256ef710cfb5f6
SSDEEP 96:K9Phj/EbHT6rqTm2kt22nVoAmFXXh403ZyrHINs/8Uub5uaaS5jS4DE:YF/Eq2UVGACXO0pyr2seb0aaS5ji
TLSH
T14DA18D429F346C0BCC4D0234895E6A275E36CDDAF571526CEB9C2AFA070258F807AA35
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10095.png

SHA256 702aaa6102b6548cdc7367cc4c19c29c31ba525a5eacd5a51b1739516bac4dd5
MD5 f64e552016eab2c9a51c263aab448d80
SHA1 225c6e6de38cabc2c410416e0171d91576e5cc4a
SHA512 30134e412f76791ef5ca3318db7b6924046928db7c3cd55033bda1d9c04dfae2430067de63726cc842f4c2404ced10feb07ad59a089ad6e4bfb317dcca155d23
TLSH
T133716E4D6FB1CD341168905D6BF1CA7DCB33C6078AA1D215AC5D7E0C971806702FA9BA
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10123.png

SHA256 024eaaed9abc432b79e84d101fb6b0647b66667dd4e442bce20ffda477058382
MD5 49c233f2526414ac1f6a3e1470dc80ab
SHA1 93f899b2f89900b4be9592be2c765a15a2ec0cd7
SHA512 14817dc5f3b8870bd634d9a494d9eef51c27fc51ac57feb85c8aca87acc8049fe0a72bdcc742059bf3ca2f72f87050928211317c87210b6377529e64f79b12f3
SSDEEP 96:HZPcAjzUfMmC2d+GotrCr+1v8Y8Zp8wfygasPNz37XbuR9U/TZ:H14MmbDWC6MpTagasdno9U/9
TLSH
T1C1819FF9AD533914CD787E5AE495992B3680C1E4B05099312E41BF3C272C430FF7A168
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10129.png

SHA256 3ac33335fd04b81a04a5726209e0615b0ed112338fe1c361ed0daebaac7040f4
MD5 918b77e298ae7a0f0662cf470f1e2b06
SHA1 69abf0f8f8251c46d7c33f95dd069b9593873c09
SHA512 473788b4e368c46db165bb01fef7dbbdd5984f59a3008980e6134d13ef9a4c0fd7d7d2c9f4456eede0c9ae1a741a1c7a1ad73f7ca272675204c72b6500717409
TLSH
T1FE514EDEC5B761B1DF86BF5804E52CDD751EE860CB42164643ABB8C4228C9553685F21
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10134.png

SHA256 db3da43c5eb3219c90a849f931744c77b90d6b34a9247befe4092e72c2b7d7d1
MD5 f2e0d17acfbe88c4a5c11df7775c6ab7
SHA1 1782245f0628dd40bd021f13b4905cc7edcee6eb
SHA512 f55d5cedc07a5348a3c36dcbcad1aae8f4e402b12cf2920404e33d92a7dc663fd7e15f2621c89a2cab17e15b0668464aea4ecb175a6d05663578d661df6b6d5c
SSDEEP 96:nkXv22/FVYjYIfJhshYG25IHJnMzNN0VgjU/eIqbOLYBlpkyhzPP/7Z:nkL/aXuhYG+NsgjU/eIqbYYHjzPt
TLSH
T154915B8F41841C9B02E596E64C3EE87D803206EE870E2C4A2C66ED603E614CDBFF6D74
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10149.png

SHA256 f84407c530051006399a5112f9ee9019c8537de2879b284e473929bcbac29968
MD5 c33398fd38fa75bec1074c0fd19f804a
SHA1 fe4f26f69836bf1d64e319a57a20c8a3649d45af
SHA512 45a9e1fe326fab4ef6ec954ca645859698b44a77866883be6d68f3aaa9dcad6263e547d272705c302036f5f3fb6f209d91cea678d1371f3637297ab48d49be9d
SSDEEP 48:vAY4w4DAuHiu0XSknMWPExRMpF4zm9aiWODWK95cDIcLFjepszcJCzGfC80vHUad:34fAuXR42LODWK9AIPszcYGfC80Ad6E6
TLSH
T18E817DD5A7E82D353796069844F56C938B892E01AF0CAEA0645D3CED5B0C9CF442D77E
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10174.png

SHA256 96e9c1588ad479841c2f170ed09afbe7901abc90c07eca77cb6d5cfc3d3e44a2
MD5 70dfd5aff7adb53985f786d1b62eb42e
SHA1 e79e7d77c04e436d2bda03dd7d1a20832154a7fd
SHA512 e138ec0349e1bbc82f13d98af831f12763144cd49ad819d560d87535edc76e5dedc8dd0ed0f3f2d380f26d5279f3304ced56b809badedddf195343f51b960ee9
SSDEEP 96:GwedBE9OLR0xhbC9N4FlkfdpYMdmZ20UP5JNihlaMfBejvBNe8Wc:GwefE9OLOu9OFyfnYGm3UP5JNkxfBwJr
TLSH
T142A18F8665BE43A7E5D8F3D61D2DC36C3E52640F4088406C45FECA296A2FE3E3C621C1
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10192.png

SHA256 7690a9d8102e37176e2f4168b1db00a8b6be2906181f413ea67ffb7198aa0e91
MD5 ac208c0db4ba4c4ecc9902e3ffaceec8
SHA1 26f41bc275085408f20aaa9774d898f3a2814b15
SHA512 fe2b25c099b1a6436555a64b2efffd58f617a3ea64182cc2aff513918bd3ccfe82957994062c934b699963f81b3aa1eae7b2574c72f7e59b493e78fe161aab3f
SSDEEP 96:9iY6sJkqwlGah1QIAzCuuzAh9iFifGbQdNqZWEa6O77XF+:0vsJIgIQ+uJUq0QbqZWEaRk
TLSH
T13A917EB3BB5C3669C44B1A01F7A483390B1539117E5FF44EE18A9DD8273C6AD8E00509
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10203.png

SHA256 fe275bceb73538b575dbffd82b2ae5c008cf88d4c7cec4a4877138dc1f5b08f3
MD5 2d11b9dba17885930d94d90f8fd9c208
SHA1 84434db7a62388b48d84efc974cd2e6a7e78db42
SHA512 a26f8aabfa6046503c2f4342cc2066c7653528f93ca96a2ed02f51b686aabdf5eb1e7c26076c0330490d14970b30a6531b52cfe60098ad409e0659a2f2ed70fe
TLSH
T1C6514CC46FA21014FCE4F88EF37B1D601A9E64456D77E8C2B67ABC106D16AB9109CA17
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10230.png

SHA256 35215897c5f105fa1abdf54a8071531692505faaac731d1a33657b766cec43d4
MD5 5963ac2f4367401ec2d1b64cc9151605
SHA1 336fea0a4a6ab34e0a5ed619159e28f87c6b3ca6
SHA512 8ec3380a23a5dd2f4df1c8ef7bce450ed8c751b83eaf8e158fff7e21c51ffa5c258be435c3e6ead21a7f0758de490caaee6b21879d754ad706d4ca486c053c2d
TLSH
T1E7613BE459E4939348BEA7A1940412EBE66663382F199129CCC0F94C6432AE216DFEC7
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10495.png

SHA256 a0ad127e02d81b33bed7cf1bb41b2529e905bd8b34462d3b21b465162a953fd9
MD5 d7f75524d8013623eba70954b47e8a9a
SHA1 d1de235a096d62c09547426d29de01848f6f2f77
SHA512 d1e1cdb93bfc86fdf69838a0c9e1b0ff0ce5e2e108603dba85085e6d1af1e62dabf22f62a109fb175d15a09c397016fa9e50842b34009d875144588330d6f4ad
TLSH
T1F9716D3ADE289D56C6406056B7530B2D125FA77E04DFC30F95A6D28F2F8EA14D13C994
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10531.png

SHA256 7fb5de3da0bd639587f5082b800889f748fc120ec0531975890a83c35ae462ad
MD5 dd51d93fbaa4760fd43c15f4dce12c03
SHA1 1c8f730deec94e5df0c5b9cfc1ede6815856273f
SHA512 c939cd676d58667eac59efda6c20f903925450efe51191d12de4aa2d778d2fb82ed729715d882864322d6c984e33341e47cefb8559cc902ef79754cbf43b41df
TLSH
T1FF516C0D918D2C64ED4ED36DE0C437DAC1AFEC5552C5EB17FAAE3529AFE20B04A580A1
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10535.png

SHA256 6eb7f33bf655a4662e2eb620612f979620aa7d40d3cc030a1f5a5dd0590afbe3
MD5 5d7fb20fd59ed35a24ab126800424db9
SHA1 48d3c88abc6d14a664b5ed3e941d9529bf62cb33
SHA512 98c78442ae2aa35cae8c8fed9239ec6e0254411cb302fca5bcf361d4c866f1a576720d72d30b0711f0c8e04f3679ca92987f68639aa2eec6aa4c5be77e477358
TLSH
T10B817DFF437A556DCFC0046046FE5D171DD9A087138D9E6F41181EB23365A4682E2B21
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10549.png

SHA256 c146fb2b65c1b2f7a9a9736cc61bfa7e75924b28cee73b7d438d1f4cc6b832b6
MD5 8f0b8144f84d170772d6cf88c19fe542
SHA1 b969bbbe969fc52a38a6ce3c6d42f82a881e1e69
SHA512 ca3dc7138c4651acd7c656fd4e9f0422a737293e12dc39cdcff7de7f8b6258da2c35ba673a6b3cbf2c386cb9fde9b813fe98bb545c877f02dc219c9caf579bfb
TLSH
T16231EA720A5442C35C6135806E7385BDCFF539EAC2FE1B88B2B774B55272A4D40028D5
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10620.png

SHA256 965bc26b8c2ce1e5274d5087572e4d3e26ff822a7cb3b6a801c68d5b3a3c1851
MD5 9be1eda5336284dcfa5bc6fd11670fe5
SHA1 4ca0b1028765e3bd6a2b0bfd7e6ee1d2d392dd6a
SHA512 246c95e32fb8b7bf47f082c1ffd3c82c2e978c90113498607741006c8a640fb1f73f7d174e2219c2787034a654420bcb8f29cb6c55112d09bcfc0620731d32aa
TLSH
T1B5717BF47112B8A7510DE12BCE47BB33EEF449870A8869B828EC5CEC22E28086B01501
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10684.png

SHA256 400a52978f386031c5e48025d8ab23eba1229ae604cfe3c8866534fb6e593f27
MD5 bd2620f7b9cedc486ea7efc2f7213259
SHA1 25351543f110ce09b3051a5ca937eeeffd2c8b2d
SHA512 94b0429cc8756a59c13828054a8be3d8369542ec5e1b2addfd0caaac8cc92525bbbbd3a872d11280efa24f1af1e32fa11eaa7dbfe42a2595e66b7547537375de
SSDEEP 96:b+XX8phk2/y5JnA/2lHjWkXKMlcZlAfG752hG2ox70cfSkKKGtCBe:iXXj2/kJVHj/1cZlAfXhGV0ztCBe
TLSH
T1E1A17CE10BC14EFCD44AF0CF22419FCA196532FF9CD2DA476F817E54513AA8A0A2A561
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/SoftIcons/10886.png

SHA256 5496fada321a213bbeb8397a7b6428afcf25c1722f1ddc910c77d2c6a8201ba4
MD5 4e4ab17d4d92c753ae2b7b667313104c
SHA1 8cab05093c955d275efa7fe7f28826f5edcb49f5
SHA512 3d1f9295ca8a352501b472af836f341f0d84bea239a1c388ae78a46c814375e75c48a7c72837d606572efd6599dbfa97a755d9c868a904b3cdcb3e2a105e646e
TLSH
T172412B0363F7AE71FAAA3B8544912604E451440B6E4086C6EC3F4E9F41E319C1DF22B7
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/10945.png

SHA256 cb8d11fca890088bc693d6ab47e001c1261c3eaf5229ae856958db33cdff104f
MD5 9bb854ec32e3ac6c2ed21c3bc6dc6ef3
SHA1 3302b79ba5978c4eadec8776737e4b1a1b6c9447
SHA512 a2ad5af5b06f68c984b6de96bd65de73d005b9ed4f52489a7d6cbd55dcd43ce5033bbb0621930bc5d9088783fe2ddbe7e7cc1890c27184d31f25226d26c7f95a
TLSH
T1D5514CFE91626A3CE0170F366B190228CAD2AB07B08509BC6EF8D4FC961F047056860A
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/11248.png

SHA256 9739ff05b2ad030ae9b9ea0e6f508df0641fdc5812d029df633f6b172ca14574
MD5 c6cebbeb81cd32571fdae81494f16cf6
SHA1 31c7398a196187a2418bef9882f4de2edf5d3a2e
SHA512 1f17c76b8113d9ced1edbf446f502803494f3eb0ad0ce91694baedbc23addbd06e9a25f55073f9d1c146376b0d50d0cd97d5c977f0ba01013d856aa242472b8f
TLSH
T142714C1565944F75ECD0B095978DECF3BEE20C4A6D00F649082B3EBAEDE8B20D98951A
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/11321.png

SHA256 7dfae9413bb9d27145a4321c937b2467cb69eb28a8135be12efc8c5953085afa
MD5 6d7feb115de3bf5e988b22dff497b9ec
SHA1 667cb8147783866ab56dc4cfbbe5fa01c1429309
SHA512 07bc414eec64349c6aa1683cdbe7f0b67985ef79f09c845ac0de211ca7a112c17dbd825b2c1473df9231242dd542ef20c926e392cf8b36614d94bf7157d398d3
TLSH
T104818F19E283C8D00689BD31F25362424A5D59560BEDD686E3D83EB6D739960A153D10
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/11351.png

SHA256 f48bf0bfa45beaad7b0170aea893d8b1ccc537108250714b8964e1cce6ff88f8
MD5 f78c8a3fd6112147bf72ef8089a5ffd0
SHA1 48a6bf31ea44080547404ca30fdd3fbb6d238516
SHA512 fd59bde3eb6d16880a0cbc1eaedf842fe5885a877c42e97571fb692adb4b645cc1106a993fe0f8c5921095275c0d2ecbf5c1a5c355d89bd794878be04ef4243b
TLSH
T1F0816E33F9A496120ECBBDBAAD8D411F928660FD91522081905B542D691E65FF44138C
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/11355.png

SHA256 d385d40e3d601c44e6bb5d71d4b7635b56bf1dca843d60f705b2fd6f8bfecd70
MD5 236c4a12b3f7bbe40a7450578c4f34ad
SHA1 d148aff16e1f89f19bf51982e56aa89eb7a69cee
SHA512 3a79c3c28ba024235aeb6c09ca73bafb0e05f68dafcd83f49a80c8d9018c40c572beb7698a41f6b15a2326f756adba0a00945beef215bf2b6f8b27c0c7f5e7e6
TLSH
T18F516D066EE7B8B782B67C5131B5A0E6E54F4D40040E0245FF27E53ED32260015D27E6
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/SoftIcons/11452.png

SHA256 a8be93508f5c945c64efe66106a98646aab2a0750677e57c6e1d572235126d12
MD5 8d9ea8098869d725e97ddb44927b9020
SHA1 41938b040eb6b5aae2fa31d04b49ff2d28fd24d5
SHA512 7ff9da2fda39f064a13ea7b7f6e2e29b1814472cd65dac00252a6fc10ef40b717ce3d0b1c99e10b9649a3bfd83906514b69e12674fd41916c0f291d7ac826870
TLSH
T1A74108F67B08E676624F2A3194CB8C4267386B03A0E090DC447A1C6753697F792DA193
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/plugins.db

SHA256 031be1bb12c9bfab16ae044edfda118575b5fbc7bc91fcceed5c92db07a77597
MD5 d36c26238c994f35249c83498c60e019
SHA1 74c10679935f7611c2706b7f2970b1a1a933485f
SHA512 90fd49f58fe28186300ad0e8f80c615e94f23282def915ed719387479ea65d8c1fe37f8ff97725a3e38674d44be851a8a40f9f106d7b5c1a7991ecf044177347
SSDEEP 3072:CMhwisxXGcgRopCGcgdK6XVoLJgMKFN/z:C0uyGJ
TLSH
T17D15546677BE3644841329677CB1B5E178FF8EC07708A0D17B5B06370381FA6A63A762
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/res/res.bskin

SHA256 3509e914e66a3b6df7171a442025b630fbbb42f61a367483135a45f828c58897
MD5 9724fdd628626b187f46048ae4626050
SHA1 505143cb8a8b4b3045d15030e4d5a42585d5135d
SHA512 8a712313d676a435b617cff02d876d61f8818b06dfcf66f78e9e338cbec7d97d33111750224c9ede01d005f0a42751a7614953e2c32af818355a8a3489a0e04b
SSDEEP 3072:qA9ATcrxS5WCAd9wv1JHqzLtUV3ycOyPZTlIihuAIULZk3BRc:lRk8CA+YLt83RlIAIULZCm
TLSH
T178E3128C801A2B711CE42537A6BB7B7E944C2AC0E077550B3F153AC68754CDBCA6D72E
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/t1.db

SHA256 6525d0d320c29a08b7ff700446d7707529391b34b11d8cd6d05e14aed378e686
MD5 4bfe7cd9f3289cd3dfa8eca48a4c54f4
SHA1 c652642a9ef2c287369301b3cdaf2d487ee4d3e8
SHA512 d9a1c8f1b15625005429248727b97995bba6a22e041ec4b96c4b3fee08d92e9f366e7d08c9bb6256ca2622c321b717b97e24b5cf2470b585937bca7930493b65
SSDEEP 6144:H4rRvRytwPdPf4lBUWwAnOy4TYLsHabpKzRpnwsyxgAUK:cytwPdPf4lBUrAnOy4TYLmmKzC
TLSH
T147D48708308DAE38137896A99FA39CC9DA0817CB8B2540517B4C95972FD7AE41DF76F3
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/t2.db

SHA256 5260786b0fb27529f817ff5308874413a6bc64fcc2318772091d9219601b88d6
MD5 7eca1585a1b10c79791f79e9f3720da8
SHA1 0bc9f1950199f57e8876db8c9eb73ec0a8d6b228
SHA512 c8f4e001c4758547384e493a7f575a38b05ecf5ee62739caa333f35a11f8680681f40963c3980506f0ebf52cd77ceb0fe41f8d34653ed1848a612a4ec47d9a3b
SSDEEP 1536:lG5qJh2CAx/fWGKzu+BhoWLqVwVoH+MJcqsmmtm:P2CC/cLLO0m
TLSH
T161244D1A32C5BE6693B81219D6567459EB4D4ECF8B4043E232ADA1A60FF39D049F70F3
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Cleaner/t3.db

SHA256 00004f7eef25a10eaab35978c2e80111ba14699019f71895c4d436d868112447
MD5 07cf6dce4e945305c6b9894a14c65595
SHA1 e6efc0ce1d464a02b892ed0f011a24a3c81fa68e
SHA512 94743947bceb433d095c56ca262f152d3c2d800355c6532e9d81666e621f1017cd45721ba15ca816bec6a353887ed5cd9936cc6c20de067d22a30518e7d25a8d
TLSH
T11FF0822C51C81F05533250FB4EE49C58BE0D2393871A8570F99839FB3E968848E93432
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/t4.db

SHA256 6f094f634e9b39620c3ac26d3d0062ac9ffb7a363d1ddd13ccc07281798de07e
MD5 6e1c88d63018507b79b3ecc4baeba151
SHA1 e1a72a53cf54422c934f38f1d463518f3615f193
SHA512 b12ef692319318eda78c4c7fb454274ee4b4a7fdffe3588684e4a98cfb4cf3ebdeb4d81e167b5f61a81d974fbbbe09ea60bc4294443a0489effeda83362a0327
TLSH
T10C01964242963E185711C63F7A9BD3AA639518FF16680700FF1A703354DBA310EE1D27
MD5 SHA1 SHA512 TLSH

Plugins/Plugin.Cleaner/t5.db

SHA256 6da67e16124b54e2c28b6be5adad2c4b0e3ba730ca28bb3fea9c13fc81baf843
MD5 1a87220f75d18df5da99ebeadb2cbc5a
SHA1 7dce017887342aae1c9a659b055d9122fd3cbd39
SHA512 dc7eba456e73cc167955562c988d70d01cd6b82a002869c2565ad491ad89c4d6a5fc82e2737fc1822bab2180ea25c6724dae71a2f4db3a19bf10b7793687bed0
SSDEEP 12288:cACtF08EUaQhNL1iLM0zOO7JDu6ZGsNgxfk2a:cdD08EAkM0zOOticGsNYfXa
TLSH
T1F2D4DF92C6FAD5B34AC765EBF7BD21C2C411AF58224855BF0A75C29ED729B0F03324A4
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Facebook/Plugin_Facebook.dll

IMPHASH 3cc7266e3aeea2c50249cc8db721b4f6
SHA256 3112cbfd51291e6ccb0a929d8068447b71ab5b8959aecd593e56d16d2f96ac8c
MD5 e964dc4f825630b472642be525a302ef
SHA1 0565142c77e1051add608c957a68389b6539f62d
SHA512 1ab9704f367ac3a4959c5115f5d1fe02a36bc19b403d3453345ed37193b11a8c92d746a6e6980970e020289db441779b27b926ca77eeb87c26387f72f4ee2f3a
SSDEEP 6144:BQlRoFLRGddlQqpcxFIAfPGsBkRz0ME3EV+:BQlRoF9GjlQq+FI0PGsBQzHE
TLSH
T136943900B6A19139F9FB0AB29ABD915C553DFD610B64D0CFA3C8486E1E71AD1BE31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

59:5f:13:d4:0f:d8:d5:30:18:fb:6a:ef:df:b9:38:31:97:80:46:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

205160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_Facebook.pdb

directui

DirectUI_LoadSkinResourceFromZIP DirectUI_Progress_SetPos DirectUI_GetControlText DirectUI_EnableAnimate DirectUI_Static_SetLogoImage DirectUI_GetControlPos DirectUI_ShowControl DirectUI_Progress_SetRange DirectUI_SetControlPos DirectUI_GetLanguageStyle DirectUI_EnableControl DirectUI_SetControlText DirectUI_GetVersion DirectUI_SubclassWindow

kernel32

lstrcmpiW GetTimeZoneInformation GetPrivateProfileSectionW GlobalFree GlobalHandle GetFileSize ReadFile CreateFileW GetTempPathW GetProcAddress GetModuleHandleW LoadLibraryExW FreeLibrary CloseHandle WinExec CreateFileMappingW VerifyVersionInfoW GetPrivateProfileIntW WideCharToMultiByte GetPrivateProfileStringW WaitForSingleObject VerSetConditionMask UnmapViewOfFile MapViewOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetCurrentThreadId GetStringTypeA InterlockedExchange GetConsoleMode GetConsoleCP LCMapStringW LCMapStringA GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount RtlUnwind TlsFree TlsSetValue DeleteCriticalSection LockResource EnterCriticalSection SetLastError GetLastError RaiseException FlushInstructionCache GlobalUnlock lstrlenW MultiByteToWideChar lstrcmpW GetModuleFileNameW MulDiv LeaveCriticalSection SizeofResource GlobalAlloc InitializeCriticalSection GlobalLock GetCurrentProcess InterlockedDecrement InterlockedIncrement LoadResource FindResourceW FindResourceExW TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameA GetStdHandle ExitProcess HeapCreate GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime CreateThread ResumeThread ExitThread HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange FlushFileBuffers SetFilePointer CreateEventW SetEvent GetProcessHeap HeapFree HeapAlloc VirtualAlloc VirtualFree CreateFileA GetModuleHandleA WriteFile GetCurrentProcessId Sleep InitializeCriticalSectionAndSpinCount lstrlenA GetStringTypeW

user32

MoveWindow RedrawWindow UnregisterClassA GetMessageW DispatchMessageW SetWindowLongW GetDlgItem ReleaseDC GetClassNameW GetWindowTextW GetWindowLongW InvalidateRect RegisterClassExW SetWindowContextHelpId GetDC GetClassInfoExW BeginPaint SetFocus CreateAcceleratorTableW GetClientRect LoadCursorW InvalidateRgn GetParent GetFocus SetCapture IsChild FillRect RegisterWindowMessageW CharNextW MapDialogRect ScreenToClient DestroyAcceleratorTable GetWindowTextLengthW DestroyWindow ClientToScreen EndPaint GetMonitorInfoW EnableWindow MapWindowPoints EndDialog MonitorFromWindow GetWindow DialogBoxParamW DefWindowProcW CallWindowProcW SetWindowTextW SendMessageW ReleaseCapture CreateWindowExW IsWindow ShowWindow SetWindowPos GetSysColor GetDesktopWindow SendDlgItemMessageW KillTimer PostMessageW GetWindowRect CreateDialogIndirectParamW GetActiveWindow SetCursor SetTimer

gdi32

SelectObject CreateSolidBrush GetStockObject GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteObject GetDeviceCaps DeleteDC BitBlt

advapi32

RegOpenKeyW RegQueryValueExW RegCreateKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueW

shell32

ShellExecuteW SHGetFolderPathW ord165

ole32

CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal StringFromGUID2 OleLockRunning OleUninitialize CoGetClassObject CoTaskMemAlloc CoTaskMemRealloc OleInitialize CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree

oleaut32

SysFreeString SysAllocString DispCallFunc SysStringLen VariantClear LoadTypeLi VariantInit SysAllocStringLen OleCreateFontIndirect VarUI4FromStr LoadRegTypeLi

log

WriteLog

shlwapi

PathFindExtensionW PathIsDirectoryW StrStrIW PathAppendW PathRenameExtensionW PathIsRelativeW PathFindFileNameW PathRemoveFileSpecW

gdiplus

GdipSaveImageToFile GdipGetImageWidth GdipCloneImage GdiplusShutdown GdipFree GdipCreateBitmapFromFileICM GdipGetImageHeight GdipAlloc GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromFile GdipGetImageEncoders GdiplusStartup

winhttp

WinHttpCreateUrl

wininet

HttpQueryInfoW InternetCloseHandle HttpOpenRequestW InternetSetOptionW HttpSendRequestW InternetConnectW InternetReadFile InternetOpenW InternetSetCookieW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Plugins/Plugin.Facebook/res/res.bskin

SHA256 a7b72fdb874f21063f68461a2ff8111a2a84eef6728813e29557256b1e87a4fc
MD5 064790668778203d9612f58374c89143
SHA1 c4cc937901348be0d157250d72fcd48651bef4f5
SHA512 6c13c177583c6e79a08e9c4f9c59d86c6027c7e64ea798d987e687daef69b2a5da33533cdef00f2924753b8ac3c3e1cc16b9db1eb268316612804dca354bdfc2
SSDEEP 3072:cRgPr59mIB+mUPpn6wN2HnwIVo/YuIykQWKGGhhPDiIg:ugn1B+36wsH/owbykt9oh+
TLSH
T1A8C312C3A47424BF20D1CEB261E9E8C5673D5EA9349CA9AF384F9B3B4177392D4094C2
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.HomeEx/Plugin_HomeEx.dll

IMPHASH fb4ce372cb880d7b707249ee8d8dda99
SHA256 8f4539a1d12795bbdfc39bcb7b1818a18b7dafbba56f0004d16d3ee45c1f2775
MD5 6f78abf2534cbf9942f10cadff56aea6
SHA1 c84cb6f4e4a4b95c20a7a2172e6796369cf4fe5a
SHA512 916783380191f994d8859caecab4176c4cc6d02d6538a01e1e52aa14bf3e54a7959b08aff89962a8ca1f98c8a903b98498bfb90e583d6ff1456c23f7df479462
SSDEEP 49152:ijF8oPBFvEw8Uvz7Zfnn0BddPXzsp8TAey:hoPBlE
TLSH
T18E753C01A782913DF8BB04F28EFE445D566CFA60074490DBA2C8ACDF5AB69E27D31717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7e:b8:ee:df:fd:61:53:65:fd:50:12:bb:d0:19:2c:b6:68:fa:e2:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

838392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_HomeEx.pdb

baidustore

?SaveActivitys@BdConfig@@QAEXXZ ?IsConnectSubSvc@CBaiduStoreMgr@@QAEHPB_W@Z ?ReportValueEx@CBaiduStoreMgr@@QAEHKPB_W@Z ?DoShellExecute@CBaiduStoreMgr@@QAEXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z ?LoadConfig@BdConfig@@QAEXXZ ?DoExamSysRepairScan@CBaiduStoreMgr@@QAEXXZ ?DoExamOptFixUp@CBaiduStoreMgr@@QAEXXZ ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?SaveSparkClick@BdConfig@@QAEXH@Z ?DoExamCleanFixupStop@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanScanStop@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanFixUp@CBaiduStoreMgr@@QAEXXZ ?DoExamCleanScan@CBaiduStoreMgr@@QAEXXZ ??1Baidu_ListenData@@UAE@XZ ??0Baidu_ListenData@@QAE@PB_W@Z ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z ?DoExamOptScan@CBaiduStoreMgr@@QAEXXZ

directui

DirectUI_TreeEx_SetStaticLogo DirectUI_TreeEx_SetStaticLogoImage DirectUI_TreeEx_Expand DirectUI_GetStringItem DirectUI_DestroyControl DirectUI_CreateControl uiUpdateWindow UISetScrollPos UIInitAniRunInfo UIStartAnimateFromTree DirectUI_TreeEx_SetButtonCheck DirectUI_TreeEx_GetControlText DirectUI_ChangeStyle DirectUI_SetControlText DirectUI_SetControlTextEx DirectUI_Static_SetLogoImage DirectUI_AutoText_SetControlText DirectUI_AutoText_SetControlTextEx DirectUI_TreeEx_ShowControl DirectUI_TreeEx_SetControlText DirectUI_TreeEx_SetControlTextEx DirectUI_TreeEx_SetAutoTextItemText DirectUI_TreeEx_IsExpand DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_InsertItem DirectUI_TreeEx_DeleteAllItems DirectUI_SubclassWindow DirectUI_AutoText_GetControlText DirectUI_LoadSkinResourceFromZIP DirectUI_AddFontsResource DirectUI_IsControlVisible DirectUI_GetControlRect DirectUI_GetControlPos DirectUI_GetVersion DirectUI_SetControlPos DirectUI_EnableControl DirectUI_GetLanguageStyle DirectUI_EnableAnimate DirectUI_Button_GetCheck DirectUI_Button_SetCheck DirectUI_Progress_SetPos DirectUI_TreeEx_ChangeStyle DirectUI_ShowControl DirectUI_TreeEx_GetItemStyle

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

FreeLibrary WideCharToMultiByte lstrlenW MulDiv VerSetConditionMask VerifyVersionInfoW GetLastError CreateToolhelp32Snapshot Process32FirstW Process32NextW GetPrivateProfileStringW MapViewOfFile GetFileSize WinExec GetLogicalDrives GetSystemDirectoryW MultiByteToWideChar ReadFile GetTempPathW GetTempFileNameW CopyFileW DeleteFileW GetExitCodeProcess GetFileAttributesW AddAtomW WritePrivateProfileStringW GetTimeFormatW GetDateFormatW OutputDebugStringW GetLongPathNameW GetCurrentProcessId OpenFileMappingW InitializeCriticalSection CreateEventW GetLocaleInfoA GetLocaleInfoW LoadLibraryA RtlUnwind QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers SetFilePointer GetConsoleMode GetConsoleCP InterlockedExchange GetStartupInfoA GetFileType SetHandleCount GetStringTypeW GetStringTypeA LCMapStringA LCMapStringW VirtualAlloc VirtualFree HeapDestroy HeapCreate IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation ExitProcess GetModuleFileNameA GetStdHandle WriteFile HeapSize HeapReAlloc TlsFree TlsSetValue TlsAlloc TlsGetValue GetCommandLineA GetCPInfo InterlockedDecrement CreateThread SetEvent OpenEventW SystemTimeToFileTime CreateFileMappingW DeleteCriticalSection GetPrivateProfileIntW WaitForSingleObject IsBadReadPtr UnmapViewOfFile HeapFree GetProcessHeap HeapAlloc FlushInstructionCache RaiseException SetLastError GetCurrentProcess GetTickCount GetCurrentThreadId GetModuleFileNameW LeaveCriticalSection EnterCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource Sleep GetModuleHandleW GetProcAddress LoadLibraryW CreateProcessW CloseHandle GetVersionExW InterlockedCompareExchange IsProcessorFeaturePresent GetProcessTimes InterlockedIncrement CreateFileW ResumeThread ExitThread GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InitializeCriticalSectionAndSpinCount GetUserDefaultLCID SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile CreateFileA GetModuleHandleA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

DialogBoxParamW GetActiveWindow TrackMouseEvent KillTimer SetTimer DialogBoxIndirectParamW GetDialogBaseUnits DrawTextW GetMenuState DeleteMenu EnableMenuItem GetSystemMenu SetPropW GetPropW GetSystemMetrics FindWindowW DestroyIcon PrivateExtractIconsW OffsetRect InflateRect SetRect IsWindow CallWindowProcW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DefWindowProcW EndDialog PostMessageW MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowTextW SendMessageW GetWindowLongW SetWindowLongW GetWindowRect SetWindowPos ShowWindow GetWindow UnregisterClassA

gdi32

DeleteObject DeleteDC SelectObject CreateCompatibleDC CreateFontW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegOpenKeyW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryValueW GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids TraceEvent OpenProcessToken FreeSid CheckTokenMembership AllocateAndInitializeSid GetTokenInformation

shell32

ShellExecuteW SHGetFolderPathW SHGetFileInfoW ExtractIconExW ord165 SHGetSpecialFolderPathW SHChangeNotify ShellExecuteExW

ole32

CoInitialize CoUninitialize CoCreateInstance

shlwapi

PathAppendW PathIsRelativeW PathRemoveFileSpecW PathAddBackslashW PathIsDirectoryW PathFindFileNameW SHGetValueW PathFileExistsW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winhttp

WinHttpCreateUrl

sensapi

IsNetworkAlive

Plugins/Plugin.HomeEx/res/res.bskin

SHA256 f30428107d6662a604808e918fed5c829b071c057f8067bc41c7966d54c36ed6
MD5 27d91f4cf9b78582d4f223dbe6bc32ad
SHA1 6f7232490fc45d737ec98fe80652ab5f9f4ab98d
SHA512 c2d197fbb2affb1e4322544039dcdeeb2fee1c53757d8599fd65c9e815af5625be29038a3290b29087798da1e35d8934464c2610c22a126be4049ef7230e377a
SSDEEP 12288:WS7WYw/qDph1V12h3nvbKxwF9BFhfCZKY9/v6K0reCbFyhZPxvZ7xDgHKi1:WQFL1+tnvbKwB3KKY9f1vJB+
TLSH
T1360533A9E515D716E15DB543D2EE1C2D2A390CB4C724F822A7B0808CF5ABDC39ED1EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Optimizer/Plugin_OptimizerEx.dll

IMPHASH 2ade46a4a62a5d58223142f088f56e6d
SHA256 78ab8686a6b64635394a353d2d9419afbdab6ab3b8f870a8b039f6c2c39ef025
MD5 2690dbec431b57a8faff23f42330e88c
SHA1 202c65f2ab365ff7565677fea1285322b495b9dd
SHA512 a0abad7c3c97c7bba9957e882f44b722c280bf59a4f68d1db4e7bc17257b3bca2addf14285e5bfad83a551524aff70aa47bf5c2c02f46002d398fb3154479b7a
SSDEEP 24576:ZirCREMDK13Xpuk4wZHQc05vz7Zfnn0BddhX3BxyvXJA:Zi913Xpu7wZHQc05vz7Zfnn0BddhX3B+
TLSH
T17A453D01A792813EF8BB00F2DEBE946D556C7921170490C7A3C8ACDE5AB79E27E31747
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c0:cc:e9:cf:0e:2c:e2:12:4d:bc:61:bc:cb:81:0a:d6:b0:6f:df:96

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 11, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

532479

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Plugin_OptimizerEx.pdb

baidustore

?SaveConfig@BdConfig@@QAEXXZ ?LoadComponent@CBaiduStoreMgr@@QAEHPA_W@Z ?DoAutoRun@CBaiduStoreMgr@@QAEXH@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHKK@Z ??0Baidu_ListenData@@QAE@PB_W@Z ??1Baidu_ListenData@@UAE@XZ ?GetInstance@CBaiduStoreMgr@@SAPAV1@XZ ?PostKrnMsg@CBaiduStoreMgr@@QAEHPB_W0PAXK0@Z ?ReportIncCount@CBaiduStoreMgr@@QAEHK@Z

directui

DirectUI_ListCtrl_SetStaticLogo DirectUI_ListCtrl_SetItemSrcData DirectUI_ListCtrl_GetItemCount DirectUI_HeaderCtrl_SetControlTextEx DirectUI_ListCtrl_GetItemSrcData DirectUI_ListCtrl_SetDrawItem DirectUI_ListCtrl_SetButtonCheck DirectUI_ListCtrl_GetButtonCheck DirectUI_ListCtrl_InsertColumn DirectUI_ListCtrl_DeleteItem DirectUI_ListCtrl_GetHeadCtrlId DirectUI_EnableControl DirectUI_GetSafeHwnd DirectUI_ListCtrl_SetControlText DirectUI_ListCtrl_SetTooltipString UIInitAniRunInfo DirectUI_Progress_SetPos uiInvalidateRect DirectUI_EnableAnimate DirectUI_GetControlRect DirectUI_TreeEx_GetAutoTextItemText DirectUI_TreeEx_GetButtonCheck DirectUI_TreeEx_Expand DirectUI_TreeEx_GetControlRect DirectUI_TreeEx_IsExpand DirectUI_TreeEx_CreateControl UIStartAnimateFromTree DirectUI_TreeEx_SetButtonCheck DirectUI_TreeEx_SetControlPos DirectUI_CreateControl DirectUI_IsControlVisible DirectUI_AutoText_SetControlText DirectUI_SetControlPos DirectUI_DestroyControl DirectUI_TreeEx_SetAutoTextItemTextEx DirectUI_LoadSkinResourceFromZIP DirectUI_TreeEx_IsControlVisible DirectUI_TreeEx_SetTooltipString DirectUI_TreeEx_EnableChildControl DirectUI_Progress_EnableMoving DirectUI_TreeEx_SetStaticLogo DirectUI_SubclassWindow DirectUI_TreeEx_SetAutoTextItemText DirectUI_SetControlTextEx DirectUI_GetControlText DirectUI_AutoText_GetControlText DirectUI_TreeEx_ChangeStyle DirectUI_TreeEx_ShowControl DirectUI_ShowControl DirectUI_TreeEx_SetControlTextEx DirectUI_TreeEx_InsertItem DirectUI_TreeEx_DeleteItem DirectUI_TreeEx_SetControlText DirectUI_TreeEx_GetControlText DirectUI_Static_SetLogoIcon DirectUI_TreeEx_SetItemHeight DirectUI_SetControlText DirectUI_TreeEx_DeleteAllItems DirectUI_GetStringItem DirectUI_ChangeStyle

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z

kernel32

SetLastError EnterCriticalSection GetCurrentThreadId CloseHandle DeleteFileW CreateThread MapViewOfFile FreeResource CreateProcessW GetPrivateProfileStringW GetVersionExW MulDiv WritePrivateProfileStringW GetPrivateProfileIntW DeviceIoControl OpenFileMappingW FindAtomW GetProcAddress FlushFileBuffers LoadLibraryExW InterlockedIncrement InterlockedDecrement InitializeCriticalSection lstrlenW lstrcmpiW DeleteCriticalSection GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA RaiseException SetHandleCount ExitProcess HeapCreate GetCurrentProcessId IsValidCodePage GetOEMCP GetACP GetModuleFileNameA GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue GetCPInfo LCMapStringW WideCharToMultiByte LCMapStringA RtlUnwind GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedExchange HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetUserDefaultLCID GetLocaleInfoA FlushInstructionCache CreateFileW GetModuleFileNameW LeaveCriticalSection Sleep WriteFile GetFileType GetCurrentProcess GetLastError LoadLibraryW GetSystemDirectoryW IsBadReadPtr GetProcessHeap GetModuleHandleW HeapFree HeapAlloc FreeLibrary LockResource SizeofResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar UnmapViewOfFile EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetFilePointer ReadFile CreateFileA SetStdHandle GetLocaleInfoW GetModuleHandleA InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

CharNextW IsWindow ClientToScreen GetSystemMenu SetTimer DrawTextW KillTimer DialogBoxIndirectParamW DeleteMenu DialogBoxParamW SetPropW OffsetRect SetRect EnableMenuItem GetMenuState SendMessageTimeoutW GetActiveWindow GetSystemMetrics GetPropW GetDialogBaseUnits UpdateLayeredWindow ScreenToClient LoadCursorW GetClassInfoExW GetDC RegisterClassExW ReleaseDC ShowWindow CreateWindowExW IsWindowVisible CallWindowProcW DefWindowProcW PrivateExtractIconsW PostMessageW GetParent GetClientRect MonitorFromWindow MapWindowPoints DestroyIcon GetMonitorInfoW GetWindow GetWindowRect GetDlgItem SetWindowLongW EndDialog SetWindowPos SendMessageW SetWindowTextW GetWindowLongW UnregisterClassA

gdi32

CreateFontW DeleteDC DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

RegOpenKeyW RegCloseKey RegSetValueExW OpenProcessToken GetTokenInformation GetTraceEnableFlags GetTraceLoggerHandle TraceEvent UnregisterTraceGuids RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW RegisterTraceGuidsW GetTraceEnableLevel RegOpenKeyExW RegQueryValueExW

shell32

ord165 SHGetFolderPathW ExtractIconExW SHGetFileInfoW

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathRemoveFileSpecW StrStrIW PathIsRelativeW PathIsDirectoryW PathFileExistsW

gdiplus

GdipReleaseDC GdipSaveImageToFile GdipGetDC GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipGetImageWidth GdipCloneImage GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectI GdipDeleteGraphics GdipGetImageHeight GdipFree

Plugins/Plugin.Optimizer/SysOpt/optlist.dat

SHA256 8978ea2ae876551164ad48f8040b5f1c7752bb01988fc3c74533620068a25699
MD5 713ddbfa51629d4bc3819b0c8ff6d805
SHA1 933742a23652959262f77c69ce8c2091e92ee8bb
SHA512 af05d41803f765240a5cd29bca07e3c646fbc7f8ac2c5395cc8c8ee7b3dde23e6b028ba353ed261751bed36da2f5eee522f197658c1385baf9f31b06c17e4119
SSDEEP 12288:XBiy6/OwmvLr4TcqnKKFGpRGdJ7LfmjaAhiediqlUhxJllpQyzJWtMxFxow85NhT:Iy6/OwmFqnKKFGpRGd+bb5ot+
TLSH
T19EA500516BFA4328F6F7AF746AB492948D76BCA2AD39C75C1110064E0972E91CDB0F33
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Optimizer/SysOpt/optrec.5.1.def.db

SHA256 5b40fcd71d7c9293c5ed23ac4c8ccbf95e1d903a988640b6fc90b910ae911c9a
MD5 2f8bd8c36c3766eeabeea717654d9db4
SHA1 1ad0e9f6dd272b4d9ba79873dc04e4ef95dcca78
SHA512 a549865e35dfaec99d832b3ef6412ad706ec3fd8bf8e2e3384e058f85019fbdd7a12b0ee76cf3efaefbe0644b82df932f63f9f7134624a0127610bc1e308b73e
SSDEEP 48:OZJpLNHIpbjYiqFlkGUBrdqg0VT5OuNI6YDbijD07OIoj+r1HAcUDyNrBWzdByWY:00aMlhAPRDk5
TLSH
T145E15E751CB783FBE1B662011F63F6E03035B6A296CADE6245E85C0136C3C8AA49F51F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Optimizer/SysOpt/optrec.6.0.def.db

SHA256 aeba1d786555bce4334f565b29367e51faaa6e9313885bb44b185535ede1caaa
MD5 8a302fbe07a5d5866b68398a370a4e91
SHA1 69aa07268adf087e85d189eb10aefbf391e8c05d
SHA512 0c20077b125fd4ef915186d1885e580f45d15f3d1f96efe94b4610cf57bb15fc122183461e2e7d71f1924dd377a6cc75556ab80e17a3e02ebd269bc07f80c7b5
SSDEEP 48:OqOJp0sfFeaXjjYIi+SF0GUrCndOuzYmEPnlNr5pftONOkItrf1HOIAdaglY2F9f:wbwgkk1K/DFmGP2x51kn
TLSH
T16C326D751CB783FBE1B662011F63F6E13039B6A296CADE6145E80C0136C3C8AA49F55F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Optimizer/SysOpt/optrec.6.1.def.db

SHA256 fe278e4fb2409f6a11db3de2deffd311afa53bbf05838571565f5eb81d9bb889
MD5 c53db2b0f9866772ce73140fa1a5598e
SHA1 e673da9ae562757a636deb4cd1be2d35e1bb56eb
SHA512 590eccc107d895ed837d887bc18fe29a0d4ff78ff95a9f8efa521f5c9d517c6f3881a1a7f5e638fe2b20aabef7454a75b8268ba9c238ece1a0dcca7c1b04e5a3
SSDEEP 48:Obq922OJpHFSwexOIaXjjYrBi+FTe0GUvc2zrndOu9fmzY5EPnlNImtO3OvfO6Ou:NwVAsB+IX2eOhGK/7VC3GR1x5Zkn
TLSH
T197327E751CB783FBE1B662051F63F6E13039B6A296CADE6145E80C0136C3C8AA49F55F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Optimizer/SysOpt/optrec.6.2.def.db

SHA256 5d2d450de1957481e56e05e7e8ce822530507e99d6c86178e169630ab70c461b
MD5 89229cc667380656ad81235d4f14ffb8
SHA1 ce43db1e00381d9ff236a5663952e56f35dbb959
SHA512 fbd60c554e5365eea651422460504f33efb4d620061c898536e6cbcd5675e1cd9375174a08555d776622873d5537cbaa72b5c10e8638bdf582d7f752f79f0c7c
SSDEEP 192:cl1YQMB5fkaxtRGd/bmySP4xfWPzZAJD0n:0I7fkavIdjmy/uLZ0e
TLSH
T1CBC26B711CB783FBE1B662051F63F6E13039B6A296CACE6145E85C0136C3C8AA49F15F
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/Plugin.Optimizer/SysOptEngine.dll

IMPHASH 5c6e20d3be0fc7950105988df442c9ad
SHA256 d639c0a47d8b49bbc08964afc024158c83cd9a28921f4f202733a3108dbefdf0
MD5 dd91db51d97742fc0e7418c3ec0e0501
SHA1 4e1252d99436a092872d82c4d4f0ff0bbed570eb
SHA512 4d67ab993bffe463b759b2785a29d911190cc4f8e813454f3870ad639daf4551f48847bbb78839d89d1bb9349d9588e466938fd7bc9c09cc19bf257e33b10730
SSDEEP 24576:OnuuZTz/Disp2AU9IPeDMDlfb+QfMvBYFXev3KKL2et5xR8xvz7Zfnn0BddaX2dM:OnuuZTz/DipAU2GIlfDAYFOv6KL2et5G
TLSH
T1F4653C00A792813AF8BF06F1CEBD446D5268BD310B5490DBA3C85C9E59B79E27E32717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

02:55:16:b0:7e:46:f4:58:b0:5c:6e:b7:9b:2b:d0:af:25:58:89:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 11, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

658164

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\SysOptEngine.pdb

sqlite

sqlite3_column_name16 sqlite3_step sqlite3_finalize sqlite3_prepare16 sqlite3_open16 sqlite3_busy_timeout sqlite3_column_text16 sqlite3_errmsg16 sqlite3_column_count sqlite3_bind_text16 sqlite3_close sqlite3_changes sqlite3_reset sqlite3_free

datareport

RD_W RD_WS

bdapiutil

BDRegOpenKeyExW BDRegSetValueExW BDRegCloseKey BDRegDeleteValueW

log2

?GetInstance@CAPCDispatcher@@SAPAV1@XZ ?WriteLog@CAPCDispatcher@@QAEHKPB_W@Z ?WriteOptLog@CAPCDispatcher@@QAEHW4OPTType@OptItem@@W4OPTAction@3@PB_W22@Z

kernel32

LeaveCriticalSection CreateFileW MultiByteToWideChar GetProcAddress EnterCriticalSection LockResource DeleteCriticalSection CloseHandle DeleteFileW ExpandEnvironmentStringsW FreeLibrary GetProcessTimes LoadLibraryW FileTimeToSystemTime DeviceIoControl LocalFree VerSetConditionMask GetPrivateProfileStringW OpenProcess GetModuleFileNameW VerifyVersionInfoW GetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot MoveFileExW GetEnvironmentVariableW SetErrorMode WaitForSingleObject GetSystemDirectoryW GetFileAttributesW GetTempPathW GetCurrentDirectoryW GetLongPathNameW FindFirstFileW GetVersionExW FindClose FindNextFileW SetFileAttributesW SetLastError LocalAlloc GetCurrentProcess WTSGetActiveConsoleSessionId InitializeCriticalSectionAndSpinCount InterlockedDecrement TerminateProcess GlobalMemoryStatusEx SetEvent ResetEvent CreateEventW GetDateFormatA GetTimeFormatA SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP ReadFile GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle HeapFree HeapAlloc LoadResource FindResourceW FindResourceExW GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW SizeofResource Sleep WideCharToMultiByte InitializeCriticalSection WriteFile IsBadReadPtr GetProcessHeap GetTickCount CreateDirectoryW GetModuleHandleW RaiseException GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetModuleHandleA LoadLibraryA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA lstrlenA GetSystemWindowsDirectoryW ExitProcess VirtualAlloc VirtualFree HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo LCMapStringW HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime LCMapStringA RtlUnwind GetCommandLineA GetCurrentThreadId CreateThread ResumeThread ExitThread InterlockedIncrement

user32

CreateWindowExW SetWindowLongW GetWindowLongW CallWindowProcW GetMessageW DispatchMessageW IsWindow PostMessageW

advapi32

RegDeleteValueW RegOpenUserClassesRoot AdjustTokenPrivileges LookupPrivilegeValueW QueryServiceConfigW EnumServicesStatusW ChangeServiceConfigW QueryServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle RegEnumValueW OpenProcessToken RegCreateKeyExW RegEnumKeyW RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser RegQueryValueExW RegSetValueExW RegisterTraceGuidsW RegCloseKey GetTraceEnableLevel RegOpenKeyExW UnregisterTraceGuids TraceEvent SetSecurityDescriptorDacl GetTraceLoggerHandle InitializeSecurityDescriptor CreateProcessAsUserW GetTraceEnableFlags

shell32

SHGetFolderPathW ord43 CommandLineToArgvW SHGetSpecialFolderPathW ord165 ShellExecuteExW

ole32

CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoInitializeSecurity CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocStringLen VariantInit VariantClear SysStringLen SysAllocString

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

shlwapi

PathIsDirectoryW PathFileExistsW PathFindFileNameW PathRemoveFileSpecW SHDeleteValueW SHGetValueW PathAppendW PathAddBackslashW SHSetValueW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Plugins/Plugin.Optimizer/res/res.bskin

SHA256 d581c0938a29ed44c8e85f38f2c16bf9972951f6312d0a328dc0cd63e31b4ad0
MD5 15966088f4ebe99f191e70cb0f2eabcd
SHA1 48f25db7f829d99fc1764aa37a44fd1678a760d0
SHA512 56acf13ee65c8433fc93a9027e1560684257eba2c5c6c157f54515707935c6a33c336292769f6cfab4f2b58b57f2a51a44b300de150e2fbe160a24ac71a3fbc5
SSDEEP 3072:fjrZ+DAhkzk+RaPVSv/J9wTJ1J66HLCQMU:fjd+DY+RaPVI9wTrnrCQMU
TLSH
T1EFA30224482665DFC926664FB10757F13CF97C3E16BEB00480E9136A7B24EDEB41B2DA
MD5 SHA1 SHA512 SSDEEP TLSH

Plugins/PluginConfig.xml

SHA256 9085c44f54444f0bcfd10f1f04ca85eca733ec9d5a6212359c96074d76680711
MD5 1533dde30d03b08e441be4e16f5b3bbd
SHA1 b5366a0bb2207fdb0dddbcfb34f85028838636d3
SHA512 33f40f6ec55b5e75ce7a963f47a4b55e5f9f35ee7fa88e5dc2baf771c8d403a92985d8d91d650d57c04afd7eaeee5058b4d555f67d51fa2a03afcfc3467484cd
TLSH
T18841E491517E85E5152423257BBCA8E83ECD07DBCB02D015BC7D65D6BF0E9A3C175322
MD5 SHA1 SHA512 TLSH

PopupConfig.ini

SHA256 d342f236f95ee051f4840c9294554a961c7f859e35c8a1c188d657bcd424a738
MD5 99d54433927e5a9b7e530de25f8aa3fc
SHA1 0ea35a34b58870da10916886ceabea7ddbc709a3
SHA512 545beaa23a225ac2b8db0c83f8726bdf84814aa3657a90aaab14d8256b85a18fad184bcf927332d4745e276d91acefd6a8cefb2709da82331fa1bc7489d55133
TLSH
T186A0125146D0C013100CA07074F185780105E5C470882C5853C040046EE9A0DE3250E8
MD5 SHA1 SHA512 TLSH

PopupTip.exe

IMPHASH 3f1877284f342df14beb6318f0ac10ba
SHA256 9ee463df7668c7cac87a6799bbee66db21b0f41ea667b10da78f35c6d99990c6
MD5 a51a758d765307d6127a278835bd4a7c
SHA1 4b25c58729783167e3c37b89659125d2707019bd
SHA512 06b7dedbd13c715dd629491758a1607bbd7a4d933e1ea4c90b48f92ed7e8be38da57825c0205f10e844107a86577cad06a8470b527402cabb20d71f17fc46d1b
SSDEEP 6144:Ljbl3xpTrUyuMj4vqfSGLZsDMTXRQTXRhYTeXYAiJ1m:Ll3IyuhqfSG1Y4ejQ
TLSH
T12B644C00B781D036F4F308B69BB9866AA92EBE711F1850C7A3C51E5E5B716E1BE30717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8f:1d:83:5f:25:a9:e1:92:59:c5:6c:52:71:22:80:8d:fa:3f:a7:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

170375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\PopupTip.pdb

webclient

_CreateWebClient@16 _DeleteWebClient@4 _GetMainSafeHwnd@4

kernel32

GetProcAddress EnterCriticalSection CreateFileMappingW LockResource DeleteCriticalSection GetCurrentThreadId ReleaseMutex CloseHandle CreateFileA CreateFileW GetFileSize ReadFile SetLastError GetCurrentProcess GetCurrentProcessId GetVersionExW ProcessIdToSessionId GetTempPathW GetTempFileNameW CopyFileW DeleteFileW DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW GetCommandLineW GetModuleHandleA FlushInstructionCache VirtualFree Sleep CreateFileMappingA GetLocalTime GetWindowsDirectoryW LocalFree LocalAlloc InterlockedExchange InterlockedCompareExchange WritePrivateProfileStringW SystemTimeToFileTime WriteFile GetFileSizeEx CreateProcessW WTSGetActiveConsoleSessionId OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot ReadProcessMemory VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA HeapCreate HeapAlloc CreateEventW AddVectoredExceptionHandler GetLastError RemoveVectoredExceptionHandler TerminateProcess VirtualQuery GetModuleFileNameA LoadLibraryW lstrcatA GetThreadContext OpenMutexW DuplicateHandle VirtualAlloc OpenFileMappingW OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory GetProcessHeap HeapFree CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer GetStdHandle TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo RtlUnwind GetStartupInfoW IsDebuggerPresent UnhandledExceptionFilter HeapSize HeapReAlloc HeapDestroy ExitProcess LCMapStringA LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetPrivateProfileIntW RaiseException lstrlenW MultiByteToWideChar GetModuleFileNameW LeaveCriticalSection SizeofResource WideCharToMultiByte InitializeCriticalSection GetPrivateProfileStringW GetModuleHandleW WaitForSingleObject InterlockedDecrement InterlockedIncrement LoadLibraryExW LoadResource FreeLibrary FindResourceW FindResourceExW UnmapViewOfFile MapViewOfFile CreateMutexW lstrcmpiW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetTickCount GetSystemTimeAsFileTime GetStringTypeA GetConsoleCP GetStringTypeW GetLocaleInfoA LoadLibraryA SetUnhandledExceptionFilter

user32

OpenInputDesktop CloseDesktop GetThreadDesktop DestroyWindow GetMessageW SetForegroundWindow TranslateMessage PeekMessageW SetWindowTextW DefWindowProcW DispatchMessageW CharNextW GetSystemMetrics GetUserObjectInformationA

advapi32

GetTokenInformation GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid RevertToSelf CreateProcessAsUserW DuplicateTokenEx SetTokenInformation OpenProcessToken RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW

shell32

SHGetFolderPathW CommandLineToArgvW ord165

ole32

CoUninitialize CoCreateInstance CoTaskMemRealloc CoInitialize CoTaskMemAlloc CoTaskMemFree

oleaut32

VarUI4FromStr

log

WriteLog

shlwapi

PathAddBackslashW PathFileExistsW PathAppendW PathFindFileNameW PathIsDirectoryW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

psapi

GetModuleFileNameExW GetModuleInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ProgramFileList.xml

SHA256 a07db92837fe214146d2f9d56480485b2770203920023d14fffe16851a2d835d
MD5 bcff2036d6c09ad150574d1f59e9a59c
SHA1 5ecb1b75394aeab4a4e0aeb5a342a7f54cde8f69
SHA512 3bde46fa852489913516ab43e2bd1f80b676f78bb7a7f6493f36da77dcc682f6582687c25f6ac1ca7a89cbfb712667b1c54c7ba28580d834779b30acff11ba0f
SSDEEP 6144:nWGiq8DQMcxzx1Ahye9Yva0rwl1ipmpTh:VhxkynvaLiIpd
TLSH
T10484437910B46E7921FAC3FE9FA332D86D549E7204DA1A10F12EB69219CA535F2F3143
MD5 SHA1 SHA512 SSDEEP TLSH

ReportCommPCF.dll

IMPHASH 89a62d8c9ff8e33cb69820a72c659e88
SHA256 81477e9a72d7a61563e44e5a6aeea429fde6565834715c9cee0163770e07409b
MD5 d0126f512324904d6f7ade356c3ae046
SHA1 faecdc5ed37cc40c28736e9977ef3faf97f98264
SHA512 645a4f94138eaab54012f1a0679bd6bc6b67935edeffe70c8aed742f7b38c668c2aa6066cee8a721638d69a3fc9ffd3f07fb25d0e9c3f3dd9a5eb9efe41c523e
SSDEEP 6144:nYqEsPVatk+90cT/lt/xrMrsvFB4rlsRJF70759TBv++/Kc:nYqEs+k+90K/lHp4rlsRJF70759T9++
TLSH
T127947D10B782C036ECAF05B58DBE866D967DBAA10B1850C7E3C85D6F5F256E27E31207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

16:10:87:e8:13:e2:4c:a2:34:6d:19:02:f6:3a:c9:40:f4:98:87:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

213973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\jenkins\workspace\ReportComm_workspace\BavOutput\Pdb\Release\ReportCommPCF.pdb

iphlpapi

GetAdaptersAddresses

kernel32

ReadFile GetModuleHandleW DeleteFileW GetCurrentProcessId GetTickCount HeapFree HeapAlloc GetProcessHeap SetEndOfFile CreateFileA DeviceIoControl InitializeCriticalSection GetStringTypeW GetStringTypeA GetLocaleInfoA WritePrivateProfileStringW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetCurrentProcess GlobalFree TerminateThread ReleaseSemaphore CreateSemaphoreW SetFilePointer WriteFile CreateDirectoryW ReleaseMutex CreateMutexW GetCurrentThreadId CreateFileW LocalFree InterlockedDecrement GetModuleHandleA GetProcAddress CreateEventW GetLocalTime GetTimeZoneInformation Sleep InterlockedCompareExchange GetPrivateProfileIntW GetPrivateProfileStringW InitializeCriticalSectionAndSpinCount SetLastError GetModuleFileNameW WaitForSingleObject SetEvent CloseHandle InterlockedIncrement lstrlenA GetLastError lstrlenW WideCharToMultiByte MultiByteToWideChar InterlockedExchange FlushFileBuffers GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW EnterCriticalSection LeaveCriticalSection FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetModuleFileNameA GetStdHandle GetPrivateProfileSectionW GetPrivateProfileSectionNamesW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW VirtualAlloc VirtualFree HeapDestroy HeapCreate ExitProcess HeapSize LoadLibraryA IsValidLocale EnumSystemLocalesA DeleteCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetSystemTimeAsFileTime GetCommandLineA RaiseException RtlUnwind HeapReAlloc LCMapStringA LCMapStringW GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree GetUserDefaultLCID

advapi32

RegOpenKeyExW RegEnumKeyExW RegEnumValueW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetSecurityDescriptorOwner SetNamedSecurityInfoW GetSecurityDescriptorDacl RegCloseKey

shell32

SHGetSpecialFolderPathW SHGetFolderPathW SHFileOperationW

ole32

CoCreateGuid

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathUnquoteSpacesW PathFileExistsW PathIsDirectoryW PathAppendW

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser WinHttpQueryHeaders WinHttpConnect

ReportCommRetryPCF.exe

IMPHASH 1325920fb30432ba9c7f872d7cda3d98
SHA256 0b2ff190cf874ea5e3a611813275703678e78b6fe946aedbcf9d1eb7fa6316e5
MD5 48f3e5a87d0fba6eacac740af4c6310e
SHA1 8746d10e4e408028ab1dc03d7d0917a7bf55b39d
SHA512 df600d7b172ed7af514bb0113ce0cbcea526824363e4ee6579ad79385cf341dffd69e91f41acfd0a7b62ebd41e040dde05a96f6eb30c703a5c7160bb14bd0538
SSDEEP 3072:QHsGTX5TNZ7eASSfpH0yeJY3xcPwzhoNYU0M9vDObY1KTxZuqnWTXRt5YY7RG/+c:M75Tb7A8e6UTYIGYwTx8VTXRjkGCIxh
TLSH
T120246B207A91C037E4A715798DF9C776A86DF8210B25A4CBB7C80A7D1F616E2AF35343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6b:63:0e:81:ca:fd:ad:14:de:9c:00:70:bd:23:f5:88:8d:4e:fb:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

70772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\workspace\ReportComm_workspace\bavOutput\Pdb\Release\ReportCommRetryPCF.pdb

kernel32

GetCurrentProcess GetVersionExW SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetCommandLineW GetProfileIntW OpenProcess Process32NextW ProcessIdToSessionId Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId VirtualProtect GetLocalTime GetCurrentProcessId HeapCreate SetUnhandledExceptionFilter RemoveVectoredExceptionHandler GetModuleHandleW CreateProcessW GetCurrentThreadId TerminateProcess AddVectoredExceptionHandler DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WritePrivateProfileStringW SystemTimeToFileTime WriteFile ReadProcessMemory VirtualQueryEx UnmapViewOfFile InitializeCriticalSectionAndSpinCount MapViewOfFile CreateFileMappingW GetFileSizeEx SetLastError DeleteFileW CreateEventW GetProcAddress CreateFileW ReadFile CopyFileW LoadLibraryW FreeLibrary SetEndOfFile SetFilePointer GetFileSize LocalFree CloseHandle ReleaseMutex GetLastError InterlockedExchange GetPrivateProfileIntW lstrlenW MultiByteToWideChar GetTimeZoneInformation GetModuleFileNameW Sleep WideCharToMultiByte GetPrivateProfileStringW InterlockedCompareExchange CreateMutexW WaitForSingleObject lstrlenA HeapAlloc CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW LoadLibraryA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA FlushFileBuffers GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle ExitProcess VirtualAlloc InterlockedIncrement InterlockedDecrement InitializeCriticalSection HeapDestroy HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree VirtualFree

advapi32

RegSetValueExW RegCreateKeyExW RevertToSelf DuplicateTokenEx SetTokenInformation CreateProcessAsUserW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetSecurityDescriptorDacl RegCloseKey RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW RegQueryValueExW

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathUnquoteSpacesW PathRemoveFileSpecW

version

VerQueryValueW

psapi

GetModuleInformation GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

SdkConfig.ini

SHA256 1d8396f875b15046153298463c5e7a12c55b0f2011c92c7bf35b5d96a5677253
MD5 daf08cb9437a886ad33cf74d62ab232f
SHA1 c09c671c4be31c05572f7f62c8f5720be66e7a74
SHA512 674c6e494950ef0dd3a2a1756c6fdc3c70ad5d68c86ce757976aec3e2d2e106138bda44b9e13342b6dfe2dfcbda149144e7a05e0fcd8bc0fcbe8d436164ba6b9
TLSH
T13B314E1733BA171873B30688D5F694B2973BF556F969C7AD40E0054F1AF2A0089A2FE3
MD5 SHA1 SHA512 TLSH

USBDeskBandHelper64.exe

IMPHASH 43bb2b2dffb0b1457a7237aec16a6658
SHA256 ce938c3ffbb0c033eaace10bfe5e148fd9f45c463728a2995953b93a13a9261f
MD5 d3980fe6655e64e50a7baf674965619d
SHA1 d43d1f25b6ddea7f821b7c2a5d9ea927996b01c7
SHA512 1fb0eb8bce2c9005e85266dea7e3b55e84adaba0a6dce3e8b4fe311557778c8404c525e3081e8727f8fbe0edca89fcae136de4414d5f866908e3c605ee06abfa
SSDEEP 1536:UTUA5sUXlESqbg6O5jWr4r50hkOLBIa8ldZ5Lpq:UwWsUVESqbg68S+ba87Z5L
TLSH
T113836D8AB3A441F5D8668174CCE24B46E771F41A1F79538F577883A61F233E15E3A322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3c:20:e5:b7:96:02:78:fa:3c:1e:fd:72:58:23:40:4e:be:d9:a3:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

9548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\USBDeskBandHelper64.pdb

kernel32

GetModuleFileNameW FreeLibrary LoadLibraryW GetCurrentProcess GetVersionExW GetProcAddress Sleep GetLongPathNameW GlobalFindAtomW GlobalAddAtomW GetModuleHandleW WaitForSingleObject CreateProcessW CloseHandle RaiseException FlushFileBuffers CreateFileA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetStartupInfoW GetLastError TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ExitProcess WriteFile GetStdHandle GetModuleFileNameA RtlUnwindEx FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA RtlPcToFileHeader

advapi32

RegOpenKeyW RegCloseKey RegQueryValueW

shell32

SHLoadInProc

ole32

StringFromGUID2 CoUninitialize CoInitialize CoCreateInstance

shlwapi

PathAppendW PathRemoveFileSpecW

Uninstall.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 5bba5e0057ab63b60516cd197cdce1a3fdb611fc98c52b84145bc1d34b9a0dc1
MD5 b11de1238b5655caa9c6718e31c89432
SHA1 0a92f383cd23d5be0e38fdd8479b5fa14c3efe7c
SHA512 b02c90468ecf6c8f3d54422a597e213166b583619c4872d9806096622bee82f927a6853743dd6c1445a382b61057b34d0b79e8867af00c929d143168a50b0a76
SSDEEP 12288:LmJ2Xn37mJDATvVlkThUKtMuH2gtBJklBrL6I+7o2BWBLNr:LmJ2XuxTzZV++7mB
TLSH
T1F0A4124BD390C0E3D5B40A710A9BE950AFB74E720CE57A67F75032573CB6AC41635BA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c5:b0:30:c6:fc:64:be:7a:57:37:08:57:34:a4:7b:a4:57:27:54:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Updater.exe

IMPHASH 43d17e460e43ed82f6087c3e9d5f1f52
SHA256 82f68f4501317af28903c5e2d08814ca8fe269cdf205bccfb7cd1133a277f03f
MD5 1e5f6a7543b676324a95e4474762f363
SHA1 9e6a9f38a8f8b721cadc46905c26b4773e1c3368
SHA512 a81f961fd0336da29e175fa243d12efa4da7c78cf2cd4f96651a25d3a0f3118d8f98af56db26c8b2d8449603e4ab8eedca56ac99bcf304006e4e8bda8680eaed
SSDEEP 24576:Qam1enAvUlWbM37NhmqWUT1adO9hMCcYkIqumM6Br0e92:EQLNhVN9WCcYnqs6JV92
TLSH
T1FD556C00B792C03AFAF355B58E7A81AD8538BE710B2590CF53C86AAD1F716D1AE31717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

96:78:48:9c:7c:29:b1:86:9c:d2:d1:21:93:e9:8d:89:d4:02:ec:42

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

413269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\Updater.pdb

log

CreateLog CloseLog WriteLog

kernel32

IsDebuggerPresent ExitThread GetDriveTypeW GetSystemTimeAsFileTime HeapReAlloc RtlUnwind RaiseException HeapSize VirtualProtect VirtualAlloc VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetCurrentDirectoryA GetConsoleCP GetConsoleMode LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA SetEnvironmentVariableA DebugBreak GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW FlushInstructionCache CreateFileMappingA InterlockedCompareExchange ReadProcessMemory SetUnhandledExceptionFilter CreateFileMappingW AddVectoredExceptionHandler RemoveVectoredExceptionHandler ReleaseMutex lstrcatA GetThreadContext OpenMutexW lstrcpyA VirtualAllocEx VirtualFreeEx VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEvent GetModuleHandleW LoadLibraryW GetProcAddress GetSystemInfo SizeofResource LockResource LoadResource FindResourceW GetModuleFileNameW DeleteFileW MultiByteToWideChar ReadFile GetFileSize CloseHandle CreateFileW CopyFileW GetTempFileNameW GetTempPathW GetPrivateProfileStringW GetPrivateProfileSectionW GetTimeZoneInformation GetLastError WaitForSingleObject GlobalFree InterlockedIncrement CreateEventW SetDllDirectoryW FreeLibrary WriteFile CreateProcessW ResetEvent MapViewOfFile UnmapViewOfFile GetCurrentProcess OpenProcess DuplicateHandle OpenEventW OpenFileMappingW UnhandledExceptionFilter GetStartupInfoW GetFileTime GetFileSizeEx FileTimeToLocalFileTime GetVolumeInformationW FindFirstFileW FindClose UnlockFile LockFile FlushFileBuffers GlobalFlags GetModuleHandleA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc InterlockedDecrement FileTimeToSystemTime GetThreadLocale lstrlenA ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA lstrcmpW GetVersionExA FreeResource SetLastError GlobalLock GlobalUnlock MulDiv GlobalMemoryStatusEx OutputDebugStringW lstrlenW GetWindowsDirectoryW MoveFileW DeviceIoControl GlobalAlloc FindResourceExW GetPrivateProfileSectionNamesW CreateFileA CreateMutexW ExitProcess SetErrorMode GetSystemDirectoryW TerminateProcess GetFullPathNameW WTSGetActiveConsoleSessionId MoveFileExW GetPrivateProfileIntW CreateThread LocalFileTimeToFileTime GetCurrentDirectoryW GetFileAttributesW SetFileTime SystemTimeToFileTime GetLocalTime ProcessIdToSessionId HeapFree GetProcessHeap HeapAlloc GetCurrentThread GetVersionExW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW SetFilePointer LocalFree FormatMessageW Sleep LeaveCriticalSection EnterCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSection GetTickCount WritePrivateProfileStringW VerSetConditionMask VerifyVersionInfoW GetExitCodeProcess CreateDirectoryW EnumResourceNamesW SetEndOfFile WideCharToMultiByte VirtualQueryEx

user32

BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetSysColorBrush SetCursor TranslateMessage ValidateRect SetWindowContextHelpId MapDialogRect PostQuitMessage DestroyMenu SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx EndPaint GetClassLongW GetClassNameW RemovePropW SetFocus GetWindowTextW GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints TrackPopupMenu GetKeyState SetMenu UpdateWindow MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect GetDlgCtrlID DefWindowProcW CallWindowProcW PtInRect GetMenu SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowRect GetSystemMetrics GetWindow InvalidateRect SetCapture ReleaseCapture CharNextW IsRectEmpty SetRect CopyAcceleratorTableW InvalidateRgn ReleaseDC GetDC GetNextDlgGroupItem MessageBeep CharUpperW UnregisterClassW RegisterClipboardFormatW GetThreadDesktop CloseDesktop GetUserObjectInformationA OpenInputDesktop SendMessageTimeoutW GetClientRect CopyRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetWindowLongW GetDlgItem IsWindowEnabled GetParent GetNextDlgTabItem EndDialog GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetPropW FindWindowExW GetMessageW PostThreadMessageW GetInputState GetWindowPlacement GetWindowInfo GetForegroundWindow wsprintfW SetForegroundWindow GetCursorPos AppendMenuW CreatePopupMenu IsIconic IsWindowVisible KillTimer SetTimer SetPropW LoadImageW EnableWindow GetWindowThreadProcessId PostMessageW SendMessageW IsWindow GetFocus

gdi32

ExtSelectClipRgn DeleteDC GetStockObject ScaleWindowExtEx GetMapMode GetBkColor GetTextColor GetRgnBox SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC ExtTextOutW CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox CreateRectRgnIndirect GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegQueryValueExA RegQueryInfoKeyW GetLengthSid GetKernelObjectSecurity SetTokenInformation RegQueryValueW RegOpenKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW GetUserNameW EqualSid QueryServiceStatus RegEnumKeyW RegOpenUserClassesRoot SetSecurityDescriptorSacl GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx CreateProcessAsUserW RevertToSelf GetTokenInformation FreeSid AllocateAndInitializeSid ControlService StartServiceW OpenServiceW CloseServiceHandle OpenSCManagerW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ImpersonateLoggedOnUser RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

ShellExecuteExW ShellExecuteW Shell_NotifyIconW CommandLineToArgvW SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW ord165

comctl32

ord17

shlwapi

StrToIntW PathIsDirectoryW PathCombineW PathAppendW PathRemoveFileSpecW PathAddBackslashW PathFileExistsW PathFindExtensionW PathFindFileNameW PathRemoveExtensionW SHGetValueW SHSetValueW PathUnquoteSpacesW PathRemoveArgsW PathStripToRootW PathIsUNCW SHDeleteValueW PathRenameExtensionW PathRemoveBackslashW

oledlg

OleUIBusyW

ole32

CoTaskMemFree CoUninitialize CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoInitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CoCreateGuid

oleaut32

OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy VariantClear SysAllocString SysFreeString SysStringLen SysAllocStringLen VariantChangeType VariantInit

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

winhttp

WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpSetCredentials WinHttpWriteData WinHttpCreateUrl WinHttpOpen WinHttpConnect WinHttpCrackUrl

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetModuleInformation GetModuleFileNameExW EnumProcessModules GetModuleBaseNameW

ws2_32

WSAStartup WSACleanup htonl

WeatherMini.exe

IMPHASH 038676c821a6a1977f60126d34f42066
SHA256 6e68f06daf880e8328a040ef05695a1df16f9fd22259ce4fe35541706f5ae7ca
MD5 1d440e5823170907aadefb04239a492f
SHA1 a24b29b39a9ec8dc4a058c7fd5c9d35f94cea828
SHA512 7916614b008c0d6d89ba4fd9e69432567a64fa0847e5bb0803ba18d48e8ed7fc0362bc8bfee4c17dae0521b0c9e36df3cce371df015087b3b9793633116ac3c6
SSDEEP 12288:O64eNCLOzaJLwuwQtXz2k0WzIdNzqzQz/ROMkC0Ifc7oVowwAAezL+x9KIFClpgC:O64YCLfD2WcdNrls7oZL+xM3gJ8
TLSH
T1F525A5F262C6746FE39E103500998674E13D7D4427EB88D60E96BF22E8316A1CDB793D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9f:d1:c0:64:af:ec:0f:0b:26:19:f4:b2:c7:62:50:25:97:f2:24:cb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ShenZhen Enode Techology co\,.Ltd,OU=Security,O=ShenZhen Enode Techology co\,.Ltd,L=ShenZhen,ST=Guangdong,C=CN

Chains

Apr 23, 2015

CN=ShenZhen Enode Techology co\,.Ltd,OU=Security,O=ShenZhen Enode Techology co\,.Ltd,L=ShenZhen,ST=Guangdong,C=CN

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 3, 2015 - Mar 3, 2026

Subject

CN=ShenZhen Enode Techology co\,.Ltd,OU=Security,O=ShenZhen Enode Techology co\,.Ltd,L=ShenZhen,ST=Guangdong,C=CN

Serial Number

33:b6:f5:65:ed:70:52:f8:a3:93:6b:7d:48:c8:20:56

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 9, 2015 - Feb 9, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

414400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\app\gensoft\softmgr\weathertool\Release\WeatherTool_Mini_Silent.pdb

wininet

InternetOpenUrlW InternetOpenW HttpQueryInfoW InternetCrackUrlW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetQueryOptionW InternetSetOptionW InternetCloseHandle InternetReadFile InternetConnectW

psapi

GetProcessImageFileNameW

kernel32

FlushFileBuffers LockFile UnlockFile DuplicateHandle FindClose GetVolumeInformationW GetFullPathNameW SetErrorMode FileTimeToLocalFileTime GetFileSizeEx GetFileTime GetStartupInfoW HeapFree HeapAlloc RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetSystemTimeAsFileTime HeapReAlloc ExitThread HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapDestroy VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA GlobalFlags GetModuleHandleA FileTimeToSystemTime GetThreadLocale lstrlenA InterlockedIncrement InterlockedDecrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc WritePrivateProfileStringW GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW GetConsoleCP GetLocalTime MapViewOfFile UnmapViewOfFile CreateFileMappingW CreateDirectoryW DeviceIoControl LoadLibraryA lstrcmpW GetVersionExA FreeResource GlobalFree GlobalAlloc GlobalLock GlobalUnlock lstrlenW MulDiv SetLastError GetCurrentProcess FindFirstFileW FindNextFileW CreateMutexW GetTempPathW SleepEx ReadFile ExitProcess VerSetConditionMask VerifyVersionInfoW WideCharToMultiByte GetCommandLineW CreateTimerQueue DeleteTimerQueueEx CreateTimerQueueTimer DeleteTimerQueueTimer GetCurrentProcessId LoadLibraryW MultiByteToWideChar GetExitCodeProcess OpenProcess GetFileAttributesW FreeLibrary GetModuleFileNameW GetVersionExW CreateEventW CreateThread Sleep DeleteCriticalSection InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCurrentThreadId WaitForSingleObject TerminateThread SetFilePointer WriteFile SetEndOfFile FormatMessageW LocalFree GetTickCount GetModuleHandleW GetProcAddress DeleteFileW CreateFileW GetFileSize GetLastError CloseHandle FindResourceW LoadResource LockResource SizeofResource UnregisterWaitEx RegisterWaitForSingleObject FindResourceExW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW HeapCreate

user32

SetCapture DestroyMenu EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetSysColorBrush SetWindowContextHelpId MapDialogRect GetWindowThreadProcessId SetCursor GetMessageW TranslateMessage GetCursorPos ValidateRect PostQuitMessage ShowWindow MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem ReleaseDC GetDC LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW GetPropW RemovePropW GetFocus SetFocus GetWindowTextW GetForegroundWindow GetLastActivePopup DispatchMessageW GetTopWindow ReleaseCapture GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow UpdateWindow GetClientRect MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CharUpperW CharNextW IsRectEmpty SetRect CopyAcceleratorTableW InvalidateRect InvalidateRgn GetNextDlgGroupItem GetSysColor AdjustWindowRectEx MessageBeep UnregisterClassW RegisterClipboardFormatW EqualRect GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetSystemMetrics GetWindow GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetWindowLongW IsWindowEnabled GetParent GetNextDlgTabItem EndDialog GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostMessageW LoadStringW wsprintfW GetDlgItem LoadImageW SetPropW EnableWindow IsWindowVisible IsIconic SendMessageW FindWindowW PostThreadMessageW UnhookWindowsHookEx RegisterWindowMessageW

gdi32

RectVisible GetStockObject GetMapMode GetBkColor GetTextColor GetRgnBox DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx GetObjectW SetBkColor ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW SetTextColor GetClipBox GetDeviceCaps PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode RestoreDC SaveDC CreateBitmap CreateRectRgnIndirect TextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegDeleteKeyW RegQueryValueW RegOpenKeyW RegEnumKeyW RegEnumValueW RegCreateKeyExW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

shell32

SHFileOperationW ShellExecuteW Shell_NotifyIconW CommandLineToArgvW ShellExecuteExW ord165 SHGetSpecialFolderPathW

comctl32

ord17

shlwapi

StrStrIW StrStrA PathFileExistsW PathAppendW PathCombineW PathRemoveExtensionW StrStrIA PathRenameExtensionW PathStripPathW PathFindExtensionW PathStripToRootW PathIsUNCW PathFindFileNameW PathIsDirectoryW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoTaskMemFree CoInitialize CoCreateGuid CoTaskMemAlloc OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

SysAllocString OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy SysStringLen SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpWriteData WinHttpSendRequest WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpReadData WinHttpAddRequestHeaders WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpReceiveResponse

WebClient.dll

IMPHASH 95405bf9fc58b72d0583bed1b0abdef6
SHA256 3437ed3dddf86d3fdd66bd07cb632ee3b4bc722d5f0e9ec0ea824c1d017acd28
MD5 023522a1bfaeb0e64a8b64bf4d0401e3
SHA1 9b086586e1dd51c43eb2602770bf19bb1496c05c
SHA512 5d420c126585720b6b26d206e1d6c8e9b0b92a114f55870844b6e16271fd0eaa9016dcb819cc9f62258c614d55ee6a1bc43be11e251f99fd6a2a9a42a31ded7e
SSDEEP 6144:hgZJcuBiGJHKhFd5tmemZbNGaf2Xufp9S20FLBO:OZJxikHKhfDmemZb2tBO
TLSH
T18C946B00F7E08135F9FB1AB59A7995AC853ABD610BA4D0CF93C8395E4E31AD1AD31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ab:96:f8:9c:70:89:40:b1:2d:3b:a7:69:b9:ce:ac:a2:48:4c:d5:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 13, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

183389

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\WebClient.pdb

directui

DirectUI_ShowControl DirectUI_SubclassWindow DirectUI_LoadSkinResourceFromZIP DirectUI_UpdateSkin DirectUI_SetLanguageStyle

kernel32

EnterCriticalSection GetLocalTime Process32FirstW OpenThread LockResource GlobalMemoryStatusEx Process32NextW CreateToolhelp32Snapshot GetCurrentThreadId WinExec CloseHandle GetCurrentProcessId ExpandEnvironmentStringsW MapViewOfFile UnmapViewOfFile CreateProcessW WaitForSingleObject GetModuleHandleW GetExitCodeProcess GetStartupInfoW GetProcAddress OpenFileMappingW OutputDebugStringW CreateFileA GlobalAlloc GlobalFree DeviceIoControl LocalAlloc SetLastError GetLastError VerifyVersionInfoW GetPrivateProfileIntW RaiseException FlushInstructionCache SetThreadPriority lstrlenW MultiByteToWideChar GetModuleFileNameW CreateDirectoryW WritePrivateProfileStringW GetPrivateProfileSectionNamesW Thread32Next GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedExchange FreeLibrary GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount LCMapStringW LCMapStringA LeaveCriticalSection SizeofResource Sleep WideCharToMultiByte Thread32First OpenProcess GetPrivateProfileStringW GetModuleHandleExW GetCurrentProcess VerSetConditionMask LoadResource FindResourceW FindResourceExW lstrcmpW InterlockedDecrement LoadLibraryW GetModuleFileNameA ExitProcess HeapCreate IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue RtlUnwind GetCommandLineA GetSystemTimeAsFileTime GetStdHandle GetFileType WriteConsoleW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapSize HeapReAlloc HeapDestroy InitializeCriticalSection IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange CreateMutexW FlushFileBuffers SetFilePointer InterlockedIncrement CreateEventW SetEvent GetProcessHeap HeapFree HeapAlloc VirtualAlloc VirtualFree WriteFile DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetPrivateProfileSectionW DeleteFileW CreateFileW

user32

AttachThreadInput GetShellWindow GetWindowThreadProcessId DefWindowProcW CallWindowProcW GetPropW SetWindowTextW UpdateWindow SendMessageW IsWindowVisible GetSystemMetrics UnhookWindowsHookEx UnregisterClassA GetMessageW DispatchMessageW SetWindowsHookExW CreateWindowExW IsWindow ShowWindow SetLayeredWindowAttributes SetWindowPos GetDesktopWindow GetClientRect RedrawWindow FindWindowExW SetCapture MessageBoxW ReleaseCapture GetMessagePos DestroyWindow SetTimer GetWindowRect PostQuitMessage LoadImageW PostMessageW KillTimer SetForegroundWindow GetParent OffsetRect LoadCursorW CallNextHookEx WindowFromPoint GetClassInfoExW SetPropW GetForegroundWindow RegisterClassExW GetWindowLongW SystemParametersInfoW GetDlgItem SetWindowLongW

advapi32

LookupPrivilegeValueW RegEnumValueW RegSetValueExW RegCloseKey AdjustTokenPrivileges RegEnumKeyExW RegOpenKeyExW RevertToSelf RegOpenCurrentUser ImpersonateLoggedOnUser RegQueryValueW RegOpenKeyW RegQueryValueExW RegCreateKeyExW OpenProcessToken

shell32

SHGetFolderPathW ord165 ShellExecuteW SHFileOperationW SHGetSpecialFolderPathW

ole32

CoCreateGuid CoInitialize OleCreate StgCreateDocfile OleInitialize CoUninitialize

oleaut32

SysFreeString SysStringByteLen VariantInit SysAllocStringByteLen VariantClear SysAllocString

log

WriteLog

shlwapi

PathIsDirectoryW PathIsRelativeW PathRemoveFileSpecW PathAppendW PathFileExistsW PathFindFileNameW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

winhttp

WinHttpCreateUrl

WiFiDeskBand.dll

IMPHASH 075e4040f83a96b86f664569f666c7c5
SHA256 5b021871c300a6755b6688866b48f52cac2cc0166791518e907d0ec9ccb0ad48
MD5 c152bdde26d86a26e938d21f1b95f147
SHA1 bd489e2847cab00ff032975377eeeffc01e8678a
SHA512 38905c5551c99f5d5f892b506cce49e9afa93aec056639f67a2ce7d873e1c81a69f11ba71649bc58abc03053f397e18c30deedd481720fc7fd4761a9badc64f5
SSDEEP 1536:fO+5hnW5g0O+NUI6WR5ikLLvlBs7QsIV3U+hADeFbD+diC4h:f750eMewFwQs63U+h6eFmQd
TLSH
T186A37C2136B1C0B6C85958316422D21247AE7C225FF489C73F963F6AAE723D1EF39356
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2b:b3:12:53:e6:a1:15:25:08:8b:ca:7c:e1:e7:a5:be:a5:97:84:d2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Apr 29, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

16195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\WiFiDeskBand.pdb

kernel32

FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP SetFilePointer GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetLocaleInfoA LoadLibraryA RtlUnwind VirtualAlloc EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapCreate GetEnvironmentStringsW GlobalDeleteAtom GlobalFindAtomW GetModuleFileNameW InterlockedDecrement InterlockedIncrement OpenEventW SetEvent CreateEventW WaitForSingleObject CreateFileMappingW SetLastError MapViewOfFile GetLastError UnmapViewOfFile LocalFree GetStringTypeW CloseHandle WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA DeleteCriticalSection GetStartupInfoA GetFileType SetHandleCount ExitProcess Sleep IsValidCodePage GetOEMCP GetACP GetCPInfo HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree

user32

DestroyIcon SendMessageTimeoutW GetSystemMetrics RegisterWindowMessageW LoadImageW ShowWindow FindWindowW SetFocus CallNextHookEx GetWindowTextW SetWindowsHookExW UnhookWindowsHookEx DestroyMenu TrackPopupMenu GetCursorPos SetMenuItemBitmaps SetMenuDefaultItem AppendMenuW CreatePopupMenu EndPaint GetClientRect BeginPaint TrackMouseEvent InvalidateRect UpdateWindow RegisterClassExW LoadCursorW LoadIconW DefWindowProcW GetPropW GetIconInfo UnregisterClassW DestroyWindow DrawIconEx FillRect GetSysColor SetPropW SetTimer PostMessageW CreateWindowExW

gdi32

GetObjectW CreateSolidBrush CreateDCW DeleteObject DeleteDC SelectObject CreateCompatibleBitmap CreateCompatibleDC GetStockObject

advapi32

RegCloseKey RegSetValueExW RegCreateKeyExW SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyExW

ole32

StringFromGUID2 CoCreateInstance

shlwapi

SHDeleteKeyW ord219

uxtheme

DrawThemeParentBackground CloseThemeData OpenThemeData DrawThemeBackground

WiFiDeskBand64.dll

IMPHASH c9e5ebe1077448e7bc0f9321310e8456
SHA256 e19c5478da6a012d5d75e26dc440933762759c35f8380535f2f31175208790b4
MD5 c75778b11865a8391d82d9eacf0ea32a
SHA1 11d254dc1835f707758f5ddc9b2f28c4d104aa43
SHA512 0ff583e0334f3bf14dc38f1bb4b8ffdc2dbd74f28ed7cfb0a2439d42badc6961aa2bb091aa7be6f08d0868d145d9b3eac723c306d550cc1451a04d9f84853456
SSDEEP 3072:wuCq3WvoCdHjeYzWNIjW1QilWKlMDIV5NB40ceFm:PmhYYzWNIjCQIWFDIFd
TLSH
T1DEB35C5B72B500BBC4169135D8A3DA06E3B1BC0A0B7543CF1668AA5AAF733D15E3E352
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a8:67:e1:91:ce:48:f3:9b:7a:ab:7a:d9:8c:0f:2b:06:90:9d:77:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Apr 29, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

18180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\WiFiDeskBand64.pdb

kernel32

CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP SetFilePointer GetStringTypeW GetStringTypeA FlushFileBuffers MultiByteToWideChar LCMapStringA GetLocaleInfoA LoadLibraryA EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapCreate HeapSetInformation GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings GlobalDeleteAtom GlobalFindAtomW GetModuleFileNameW OpenEventW SetEvent CreateEventW WaitForSingleObject CreateFileMappingW SetLastError MapViewOfFile GetLastError UnmapViewOfFile LocalFree LCMapStringW CloseHandle FreeEnvironmentStringsA DeleteCriticalSection GetStartupInfoA GetFileType SetHandleCount ExitProcess GetProcAddress GetModuleHandleW Sleep IsValidCodePage GetOEMCP GetACP GetCPInfo FlsAlloc HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetCurrentThreadId FlsSetValue GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx WriteFile GetStdHandle GetModuleFileNameA EncodePointer DecodePointer FlsGetValue FlsFree

user32

LoadImageW RegisterWindowMessageW ShowWindow SendMessageTimeoutW DestroyIcon GetSystemMetrics GetClientRect SetFocus CallNextHookEx GetWindowTextW SetWindowsHookExW UnhookWindowsHookEx DestroyMenu TrackPopupMenu GetCursorPos SetMenuItemBitmaps SetMenuDefaultItem AppendMenuW CreatePopupMenu EndPaint CreateWindowExW BeginPaint TrackMouseEvent InvalidateRect UpdateWindow RegisterClassExW LoadCursorW LoadIconW DefWindowProcW GetPropW GetIconInfo UnregisterClassW DestroyWindow DrawIconEx FillRect GetSysColor SetPropW SetTimer PostMessageW FindWindowW

gdi32

GetObjectW CreateSolidBrush CreateDCW DeleteObject DeleteDC SelectObject CreateCompatibleBitmap CreateCompatibleDC GetStockObject

advapi32

RegCloseKey RegSetValueExW RegCreateKeyExW SetSecurityInfo GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW

ole32

StringFromGUID2 CoCreateInstance

shlwapi

SHDeleteKeyW ord219

uxtheme

CloseThemeData DrawThemeParentBackground OpenThemeData DrawThemeBackground

WiFiMac.dat

SHA256 c6f2d19283c312af7264a8322e3e5462760a42fb7fa9327a7a2d0d972f81d56e
MD5 ab074417a1b54d53804ce2fd073da140
SHA1 dd47bead2c7fd351305fa8662281753a25e4700a
SHA512 54f7b0e4531d4f1377648920134e247607091006b453e6251815ab76c18cbc3489b6e4c15ffea6af24210451afb64834da3e3fa3a20b5b50a922a7a2636269b4
SSDEEP 384:3IRqkPvQc1Has+mGwpyN9ed+za/sczKcsFWXTqdzk1yAG/QJlnMvxL+VkXRbS5R4:4RBvQctJ+mxps9ed+zaLQ8yN/Qw1CfEb
TLSH
T128B25C9893365CE776D801EB45CA6BA2E36C6D291B0045F433C238E4C40B72FEB749A7
MD5 SHA1 SHA512 SSDEEP TLSH

WiFiNpc.dat

SHA256 72b50e4156f676cb4e708a9f047c7d22143e7ddd07b98913ec0ea1327066ca27
MD5 e2099eef601fe69aaa0a42e67e794df0
SHA1 2c3e175ccd64c4672d95c029cf85e479b6a79a79
SHA512 d9dd9e6c8572636aaa9c26d37ac80ebe8a4e9dc648ad2b588d627cd6f011d72cd4388555dd1ed20c94a2bfa70cfd25fb46e46ce61d956305ed2c78cfad9a4c3c
SSDEEP 192:jqsPHdAlL0SeqIdkDP2kHVUxg13SN6J6wBNX13p/tpeX4DdCfwKbf7MI:p6wKDP2k1Gg13SSHgIDI9bfQI
TLSH
T1152224DD8379C98E729E5ED4C5617722EA0EA37726C850F21285A872F1CA07DD781C2E
MD5 SHA1 SHA512 SSDEEP TLSH

WifiDrv/Cert/root.cer

SHA256 e78e24d7d174abdee6f24b143bb950f7c52e09714211f3c1a23529456a47cafb
MD5 e448c03cc749608281b94bd643e8e611
SHA1 7cca72fea5af0b76be3e65faed9b72ada28e66cd
SHA512 dafd9929189638f5671a4e52bee5eb91a300241f0f7dc4d79545bb3c7548e6486bb2a40d7111a8770901b513f190edbb0ba410569ba0faf749db46fc9948ec86
TLSH
T11621465F15001835DCC51F80D6D3E6639D746190EEE465D364B480945FCABF2674215F
MD5 SHA1 SHA512 TLSH

WifiDrv/LWFDrv/Win7/amd64/ndisrd.cat

SHA256 b2a5d59e11925797b3424a678f7ece21c641b5a961a42774c8ccfd67eb0dc9ac
MD5 2cf0004e9aa9c59c7f9206f485261050
SHA1 4f56cc5c6312de302199ea74a5af33e91f48a4b3
SHA512 d298ed3f6353aaca833f60e074aa25295ffa612eee1df780a9f9e61724049b5d66dd8aae958fe984e1c92a09fa393ac72f9fb4b741843519a7a2d1e2f7658886
SSDEEP 192:vfznYe+PjPrNrrC+E+viw+jtlAur9ZCspE+TMArU0lUK:TnYPLrhCNUHeMFM
TLSH
T10F0209DB0A196462EDC78EA0D6D6D0AFEC31F3E66D8454AF50B682D11EC2FA1370940F
MD5 SHA1 SHA512 SSDEEP TLSH

WifiDrv/LWFDrv/Win7/amd64/ndisrd.sys

IMPHASH 4c4c24a188af43b4db0ba86b8188ba73
SHA256 8026fb968c8151a85ba81c4e4cd3fecd513ccfbb00d1e6ec6688889944c536bc
MD5 491d817b2690ffa643637c35c1f42468
SHA1 ff8b982d4e3018c6c570f5a0abefb8f6ef56def4
SHA512 444cc449943fd759055b0c52f5501e3092f597e64096b3fd4f17b0ba626000b6520ebe9d4fecdb1b965afc48932d9630178b34a74b1ed1bd39fbc1de4eca0364
SSDEEP 768:7wasCjr8fVRFaYS/BUdvddMSCXfR3YChYWxZlfKxbiUR3b:7wasQrn/BouXfRljxZN6jRL
TLSH
T100138E6AA6385059EAEA8978FEF68707CAF0F4C21B2541EF059086D50F3BFD1563C349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

85:d5:11:c0:86:48:3f:ba:cc:a5:a7:22:c5:b7:99:08:96:4d:fb:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Chains

Jul 23, 2014

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Serial Number

55:6d:ad:9f:ec:2f:a8:66:fc:63:97:74:df:a4:e9:45

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 3, 2013 - Aug 2, 2015

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

6

Entry point

42456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\projects\SVN\WinpkFilter\kernel\bin\lwf\win7\amd64\ndisrd.pdb

Name

.text

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WifiDrv/LWFDrv/Win7/i386/ndisrd.cat

SHA256 327c72e2ce1ae648487c10a1ca667016e44edcc2d6406e1f5918f70d32b53b25
MD5 161f13c67e28c0121156180ab0d2db5f
SHA1 d614d348938bd96712f86917ba59e7492009a1eb
SHA512 f6b75ab0ee3900dd149d78a0697e208107412268910b4e6e3d0cb287eeaaf597f0fd3b988c1910b02f006aa73b2c78bac990f1259c65cd2ec39e985bcda805d4
SSDEEP 192:Kdj/nYe+PjPrNrrC+E+viw+jtlAur9ZCspE+TMArUlk7:KnYPLrhCNUHeMFG
TLSH
T126020B9B0A182462EDC7CEA0D6D6D06FDC31F7E69D9554AF60B682D01EC2FA0374940F
MD5 SHA1 SHA512 SSDEEP TLSH

WifiDrv/LWFDrv/Win7/i386/ndisrd.sys

IMPHASH fa4f5425da4152f019a8b7c0099629af
SHA256 69e4415021d3d9761f04f9bd432fee86c4e61f772d9584a9090ab55aec1e9f47
MD5 9c82d6860864d70d3d2d35fd612584d7
SHA1 2212bec2151f7dfc894fe34fdcd2945b196e9a43
SHA512 f3459e0214b37dc15d17d2e19141a9ff70d8cfed2582240e0a4dfd1dec5b45b8b9a8b7938807fd01f6bdb9d6317e9d684701c4c87a0b0ca2ed4ff2d8f6cf1831
SSDEEP 384:tkt/TZ+UrFmO4EbU/H5r0ehQcuHAntCTs7gI9+sadKy63LBBJszR2d/TfIVN+zNx:evm1Ebg5r0tgnNcI9BaIh71U25wyZUsj
TLSH
T173F29F1265081435DCCAA9F0FB4DB727EDB8A2E21F1140D76B608AE15CB5BC0E9F429F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:ae:4c:0a:a2:c0:29:de:4a:17:af:3c:b2:fb:c4:d7:31:fe:9e:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Chains

Jul 23, 2014

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Serial Number

55:6d:ad:9f:ec:2f:a8:66:fc:63:97:74:df:a4:e9:45

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 3, 2013 - Aug 2, 2015

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

6

Entry point

34082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\projects\SVN\WinpkFilter\kernel\bin\lwf\win7\i386\ndisrd.pdb

Name

.text

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

568B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WifiDrv/LWFDrv/Win8/i386/ndisrd.cat

SHA256 9fa1a5ae1684e82670ad2635302944da28b736141fc49845de3f8f3007279d2f
MD5 d54b6483a8d4058c2d3659055d9bfea3
SHA1 ead85f6486f447fd731915f4f75dec402f89b330
SHA512 719061df65226201f17cfc56793fc8fb04bbf444baed031f89771debdf6968dc9d746568025442a2d6f1edcd45b13a74ff92345d8c376824a850c6038c5a78ba
SSDEEP 192:DEnYe+PjPrNrrC+E+viw+jtlAur9ZCspE+TMArUvZgn3:DEnYPLrhCNUHeMFvE3
TLSH
T187120A9706186462FDC78EA0C592E16FDC31B795AD9490BE60B792D15EC2FB0371900F
MD5 SHA1 SHA512 SSDEEP TLSH

WifiDrv/LWFDrv/Win8/i386/ndisrd.sys

IMPHASH ee0857fa167050b445764734b6548b2c
SHA256 c71670a44cff65d79efd10345cea951a94abbf34de17decc50fadf0b5c163bfd
MD5 ad278035d2eec08fc7563c6c955487ed
SHA1 39a4699e3d7466b176d22ede45114691ecfa205b
SHA512 12bbb1914f621ad6c23ddf880020cc00489b1df1b1343b7084dbb313f35675bf6bcfb1cb34dde99e984824b1c96284675e84e3d564f7c6e81ec25788e7b9cd65
SSDEEP 384:/+8/TZGUrF8xg+qBvvzGBOtJKaQTwe2q2s+sUtMKradkunneJZyXrxYKYwipVS3p:m68VYvqBOjQ5wsUtBraecMWYV9I3UQiE
TLSH
T1C5F27D5269084031CCC699F0FA5DB727DDB8A6E20B5190DB17668BE06CB57C0EAF428F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3b:3c:85:a1:d5:04:b6:dc:c6:da:3e:5a:52:16:e2:ad:1e:85:10:18

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Chains

Jul 23, 2014

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Mainline Net Holdings Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Mainline Net Holdings Limited,L=Road Town,ST=Tortola,C=VG

Serial Number

55:6d:ad:9f:ec:2f:a8:66:fc:63:97:74:df:a4:e9:45

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 3, 2013 - Aug 2, 2015

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

6

Entry point

19828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\projects\SVN\WinpkFilter\kernel\bin\lwf\win8\i386\ndisrd.pdb

Name

.text

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

568B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

WifiDrv/LWFDrv/Win8/i386/ndisrd_lwf.inf

SHA256 5ce41127f92e53382f62b57bb65e54045c95e6da35df36b627fe40c1f15f8364
MD5 027243affdccf85628700e982e1c545f
SHA1 3e86fa3179a361bd5b7ddfc57010cca373c9f76e
SHA512 e0ba6c60aaa9edb9ec2163696afae9dd37ee12cca76eba45bbbca7a6a427d0e78e2fddd266cb64faadd78d1c2895a86b45d935b43575179f613b826bee811b80
TLSH
T16651223D4EC536745463D25F7B0E29C1F82C2084959D1248B2DA4493D78FAED772C968
MD5 SHA1 SHA512 TLSH

WifiDrv/LWFDrv/ndisrd_lwf.inf

SHA256 e7f59a8d1298f1edb968b53f5692d90c43d409470cc4bbd58689479a44d416e8
MD5 a222362d96e4a3067b6bf22532bf226f
SHA1 f983202d9dc8347d3d7620c90df92af5c1e13ce4
SHA512 d46f08b42dfee74297d1b7984102e67522d1f6985d66d31c912e0d93c440d6ac14c144a8a0b8a98386edb805d612a884a3ea6f6c89253a881d4c1462806607a6
TLSH
T15751203D4EC936746463D25F7B0E29C2F82C2084959D1248B2DA4493D78FAED772C969
MD5 SHA1 SHA512 TLSH

WifiDrv/Setup/amd64/certinst.exe

IMPHASH 8467e11ef11d14f98738f4971c36ae50
SHA256 61392c5e9605ac7baaff6f51c06e1c8682884eeb9b7814508307924eeb06f705
MD5 56cb07df87ebee12ef5ab0a01e1ad5c9
SHA1 705e21a33425eb439e6f4433f6ef4c5fa848ac7f
SHA512 b7fecdebed25be2f923ab1ee22ca386f3b3a642f0c21d0b213ebc0c2922436a1d6ce03cc9f546e5a89661e5cdad0835f3b7adff1bc10595115c3ddb30e0ac19a
SSDEEP 1536:5ftxDkhB2AjZYGxXBUrLkmkiNe1XmAd31tPZBp45pQqf:5ftxIzLYGNZmkL31tPZBp45p
TLSH
T14B536C8A636044F9C8538279D8F29A16EA72F8071BB5438F5738C16A5F773A05F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f4:6b:08:8a:e2:12:fc:c4:4b:a5:d6:ed:d3:ea:a0:e2:2d:c5:18:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

5076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Project\WinpkFilter\setup\amd64\certinst.pdb

crypt32

CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCertificateContext CertCloseStore CertOpenStore

kernel32

TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId GetLastError FlsAlloc HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount HeapAlloc HeapReAlloc WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle CreateFileA

WifiDrv/Setup/amd64/snetcfg.exe

IMPHASH 3ec6bd316a73f2d096b8713b29c83ddf
SHA256 6cb8a98a12b4b52c24c47f69cddd87fb7eda4489b7bb635ed9721067b18d63e9
MD5 db664517c2489c71cddc57668f61b265
SHA1 4b39a2ac388e2463d7db4f158efcf99a9f1e0b4f
SHA512 da8efb393d9d2c4dfa2001116c2bccd2242eeaa5b45a2f94f14f66b436ba39a51f1d85d1b2f753c48b6c896aca0ce5a0c2ccd8fd9a51fb70d81ecac7bed745ca
SSDEEP 1536:1KrFKSqAtY4WYmjMBVcSgKt5fybyUYNvWtp44lqB5AvuTyfo4G4PrH1og:eH3tYRjjMl3fA04lqB5KuefdrHC
TLSH
T103A34A17B3B520F9D4B2C538C9E29A1AEB72B8254B3447CF466546091F373E09E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3d:76:a0:d4:59:fc:ca:e0:04:b3:9c:51:1c:78:b1:95:3a:64:fb:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Apr 29, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

12268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\snetcfg64.pdb

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupCopyOEMInfW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiRemoveDevice CM_Get_DevNode_Status SetupDiCallClassInstaller SetupDiSetClassInstallParamsW

newdev

UpdateDriverForPlugAndPlayDevicesW

log64

WriteLog CreateLog CloseLog

shlwapi

PathRenameExtensionW

kernel32

EncodePointer CreateFileW SetStdHandle SetFilePointer WriteConsoleW CloseHandle FlushFileBuffers GetConsoleMode GetConsoleCP LoadLibraryExW InitializeCriticalSectionAndSpinCount Sleep GetModuleFileNameW GetCurrentDirectoryW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA MultiByteToWideChar WideCharToMultiByte GetVersionExW RtlUnwindEx VirtualProtect VirtualAlloc SetThreadStackGuarantee GetSystemInfo VirtualQuery TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetACP GetOEMCP RtlPcToFileHeader DecodePointer FlsFree SetLastError FlsSetValue FlsGetValue GetCurrentThreadId FlsAlloc LCMapStringW OutputDebugStringA GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoW HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW

user32

UnregisterClassA

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize

WifiDrv/Setup/i386/certinst.exe

IMPHASH 604c2b22bc19670884108e615f9b73cc
SHA256 baac27775ad330a32f45e1046972d5ba52be3f7eb3fcbf2abbfe09dd03fa3781
MD5 a740550bac4fec399b0b8d02b38ccf34
SHA1 244d7dc7efb47711dacfa585e329f48969e7a84f
SHA512 bc59c14814ef0ef7b3a222f2ccc9a14dcb93b2ac2950e44192de737e3068a1ed83cdead43b00b8d9cd98da10f807568f4ae52c7cf48b6101c33a0154e36d2ba3
SSDEEP 1536:2uckIR6QLUj7rqKaPxPF0PZFQosJZ+26q:2uzFQLEWKj3sJZ+2
TLSH
T187438E663990D073CC8159B44475C3529E7EB5321AA4C487BF9417BE4FF17E0AB2B32A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

dc:d6:ff:de:13:64:76:d5:ff:67:50:c8:f4:85:4b:e0:db:0b:c5:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

4949

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Project\WinpkFilter\setup\i386\certinst.pdb

crypt32

CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCertificateContext CertCloseStore CertOpenStore

kernel32

TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar RtlUnwind LoadLibraryA InitializeCriticalSectionAndSpinCount HeapAlloc VirtualAlloc HeapReAlloc WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle CreateFileA

WifiDrv/Setup/i386/snetcfg.exe

IMPHASH 0277e93b8f7d107b9e1f1fbd1c97c10a
SHA256 bb4e8384d920a5f067d399f18aae2257fbdcca5ecfdaf8ff22e7f0199b989e99
MD5 464c176084488a4d992c8f53ed2a5427
SHA1 3d7818247c9ff7cce6cb7013feb44c04b636e6cb
SHA512 00c087a71e66585852b8607e4c9bd381b51ab3c3fa677806030a7f9a09edcbd43e477390d60362a9d8ddbd252aa66f64db22f914e7ccd5068c1f7793256741b0
SSDEEP 1536:LPXYq+TaUpU1Tb97FDhUk7be1U9Fpr8PgqZj0Stz+TStT:LPX6azTbLDU1U90PXj0Stz+TS
TLSH
T163A35A11B6E1C032E0A2187259B1C2A19B3DBA316F7589DB73D9066E1FB23C09F35767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86 polyglot

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

39:1a:4b:06:fe:98:0b:73:1f:e6:85:e1:05:01:1b:52:ab:9a:b2:19

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Apr 29, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

11254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\snetcfg.pdb

setupapi

SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupCopyOEMInfW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiSetClassInstallParamsW SetupDiCallClassInstaller SetupDiRemoveDevice CM_Get_DevNode_Status

newdev

UpdateDriverForPlugAndPlayDevicesW

log

CloseLog WriteLog CreateLog

shlwapi

PathRenameExtensionW

kernel32

TlsSetValue CreateFileA SetStdHandle SetFilePointer WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle FlushFileBuffers GetConsoleMode GetConsoleCP LoadLibraryExA GetModuleFileNameW GetCurrentDirectoryW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA MultiByteToWideChar WideCharToMultiByte VirtualProtect VirtualAlloc GetProcAddress GetModuleHandleW GetSystemInfo VirtualQuery TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId LCMapStringA LCMapStringW OutputDebugStringA GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetStringTypeA GetStringTypeW GetLocaleInfoA Sleep

user32

UnregisterClassA

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

WifiHotspot.exe

IMPHASH 47e9de2cdf8b847ac1825e994b069fd7
SHA256 9f049c35d19d06de438e4736f3e9b8570e434f0fe77b0b9a127e246a33c6e0ae
MD5 c8e3e8d5594b9d03c2664b63056cf67c
SHA1 b4dd3f878e7d9faf1cb3cd7861c1c1dcb51033c1
SHA512 4ae7123c18f6b2fc63fe302374383a4b3689adefc7c377eb4102dffe25730e6634a7f414ada5876fe8f6ee60ac7d7d1c9c29ec8fba4f6235a5c149eddb3de1bb
SSDEEP 49152:NhoXmBZqWRwBFhWLhWpWlU8u02boDH7ks2:NhoXmBZqW2BFhmEpWlp2b
TLSH
T1C8954A11E7D3C03AF5B35AF1AB7D42AE95287E301B1190CB53847E9E4A749E1AD32723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f2:1f:36:04:9d:5f:72:4f:96:3f:40:94:16:5c:3e:cd:a6:e4:64:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Apr 29, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

701257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\security-client\trunk\pc-faster\public\output\pdb\WifiHotspot.pdb

directui

DirectUI_TreeEx_InsertItem DirectUI_TreeEx_CreateControl DirectUI_TreeEx_SetItemHeight DirectUI_TreeEx_IsExpand DirectUI_TreeEx_Expand DirectUI_TreeEx_SetStaticLogoImage DirectUI_TreeEx_SetAutoTextItemText DirectUI_TreeEx_SetControlText DirectUI_TreeEx_ShowControl uiFindElem uiFreeElem DirectUI_ListCtrl_InsertDrawItem DirectUI_TreeEx_DeleteItem uiUpdateWindow DirectUI_Edit_SetSrcText DirectUI_ComboBox_AddString DirectUI_ListCtrl_InsertColumn DirectUI_ListCtrl_SetDrawItem DirectUI_ListCtrl_ChangeStyle DirectUI_ListCtrl_SetControlText DirectUI_ListCtrl_SetStaticLogo DirectUI_Button_SetCheck DirectUI_Button_GetCheck DirectUI_ComboBox_SetCurSel DirectUI_Static_SetLogoImage DirectUI_GetSafeHwnd DirectUI_SetLanguageStyle DirectUI_I18N_AddLanguageStyle UIScrollToBegin DirectUI_LoadSkinResourceFromZIP DirectUI_AutoText_SetControlText DirectUI_EnableAnimate DirectUI_TrackPopupMenu DirectUI_GetLanguageStyle DirectUI_EnableControl DirectUI_SetTooltipString DirectUI_GetControlPos DirectUI_GetControlRect DirectUI_GetControlText DirectUI_GetControlStyle DirectUI_ChangeStyle DirectUI_IsControlVisible DirectUI_ShowControl DirectUI_SetControlText DirectUI_SetControlPos DirectUI_SetControlTextEx DirectUI_SubclassWindow DirectUI_GetStringItem DirectUI_UpdateSkin DirectUI_GetVersion

kernel32

GetFileAttributesW lstrcpynW lstrcatW SetErrorMode FormatMessageW SetFilePointerEx FlushFileBuffers GetFileSizeEx TerminateThread SetEndOfFile SetFilePointer CreateFileA SetHandleInformation GetFullPathNameW GetStdHandle CreatePipe DuplicateHandle CreateDirectoryW lstrlenA ReadFile WriteFile CreateFileW ExpandEnvironmentStringsW GetTickCount OpenFileMappingW LocalFree IsValidLocale CreateEventW WideCharToMultiByte WinExec GetPrivateProfileStringW GetPrivateProfileIntW DeleteFileW CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW GlobalAlloc GlobalFree GetVersionExW VerSetConditionMask GetDriveTypeA WriteConsoleW GetConsoleOutputCP VerifyVersionInfoW SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleMode GetConsoleCP GetExitCodeProcess GetFileAttributesA GetStartupInfoA SetHandleCount GetCurrentDirectoryA PeekNamedPipe GetFileInformationByHandle TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP ExitProcess LCMapStringW LCMapStringA GetCPInfo RtlUnwind GetStartupInfoW SetConsoleCtrlHandler CreateProcessA DeleteFileA CreateDirectoryA GetFileType SetStdHandle ResumeThread CreateThread IsDebuggerPresent UnhandledExceptionFilter FileTimeToLocalFileTime FileTimeToSystemTime GetSystemTimeAsFileTime GetProcessTimes GetWindowsDirectoryW SetCurrentDirectoryA CopyFileA GetModuleFileNameA GetSystemInfo LocalAlloc ResetEvent WaitForSingleObject CreateProcessW GlobalAddAtomW GlobalFindAtomW GetLongPathNameW Sleep GetSystemDirectoryW LoadLibraryW FlushInstructionCache GetLocalTime InterlockedDecrement DeleteCriticalSection InitializeCriticalSection LoadLibraryExW RaiseException lstrcmpiW LeaveCriticalSection EnterCriticalSection lstrlenW GetCurrentProcess MultiByteToWideChar InterlockedIncrement GetCurrentThreadId GetCurrentProcessId CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingW SetLastError FindResourceExW FindResourceW LoadResource LockResource SizeofResource FreeLibrary GetLastError GetDriveTypeW GetPrivateProfileSectionNamesW IsProcessorFeaturePresent LoadLibraryA HeapSize HeapReAlloc HeapDestroy QueryPerformanceCounter QueryPerformanceFrequency GetTimeFormatA GetDateFormatA GetSystemTime SetCurrentDirectoryW WaitForMultipleObjects MoveFileW DeviceIoControl lstrcpyW GetExitCodeThread IsBadWritePtr CreateRemoteThread HeapFree GetProcessHeap WriteProcessMemory VirtualProtectEx GetCurrentThread VirtualFreeEx VirtualAllocEx lstrcpyA OpenEventW VirtualAlloc OpenMutexW GetThreadContext lstrcatA CreateMutexW ReleaseMutex VirtualQuery TerminateProcess RemoveVectoredExceptionHandler SetUnhandledExceptionFilter AddVectoredExceptionHandler HeapAlloc RemoveDirectoryA HeapCreate InitializeCriticalSectionAndSpinCount VirtualQueryEx ReadProcessMemory WTSGetActiveConsoleSessionId SystemTimeToFileTime InterlockedCompareExchange InterlockedExchange CreateFileMappingA VirtualFree GetModuleHandleA GetModuleFileNameW GetProcAddress GetCommandLineW ExitThread GetModuleHandleExW IsBadReadPtr IsBadCodePtr VirtualProtect DebugBreak RemoveDirectoryW SetFileTime FindClose FindNextFileW FindFirstFileW MoveFileExW SetFileAttributesW GetFileAttributesExW SetEvent WritePrivateProfileStringW GetTimeZoneInformation GetPrivateProfileSectionW GetTempPathW GetTempFileNameW CopyFileW GetFileSize ProcessIdToSessionId GetVersion GetModuleHandleW WriteConsoleA

user32

TrackPopupMenuEx EnumWindows SendMessageTimeoutW OpenInputDesktop GetUserObjectInformationA CloseDesktop GetThreadDesktop GetWindowThreadProcessId SetWindowLongW IsWindowVisible ShowWindow FindWindowW IsWindow GetWindowRect GetWindowLongW UpdateLayeredWindow SendMessageW SetFocus SetTimer KillTimer PostMessageW ExitWindowsEx SetWindowTextW MapWindowPoints GetClientRect GetParent GetMonitorInfoW MonitorFromWindow GetWindow InvalidateRect GetLastInputInfo GetCursorPos SetForegroundWindow AttachThreadInput SetWindowPos GetForegroundWindow DestroyWindow RedrawWindow SetActiveWindow SetCursor ClientToScreen EnableWindow TranslateAcceleratorW CreatePopupMenu DestroyMenu DefWindowProcW AppendMenuW RegisterWindowMessageW CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW RegisterClassExW GetClassInfoExW LoadCursorW LoadStringW LoadStringA PostQuitMessage CallWindowProcW GetMenuItemCount GetMenuItemInfoW MessageBeep RemoveMenu MonitorFromPoint PrivateExtractIconsW FindWindowExW CreateWindowExW LoadImageW PtInRect OffsetRect UnregisterClassA GetWindowTextLengthW wsprintfW GetDlgItem EndDialog DialogBoxParamW CreateDialogParamW SystemParametersInfoW GetWindowTextW EnumChildWindows MoveWindow GetSystemMetrics DestroyIcon

gdi32

CreateCompatibleBitmap SelectObject DeleteDC DeleteObject CreateICW CreateCompatibleDC

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

CheckTokenMembership RegOpenKeyExA SetSecurityDescriptorSacl RegQueryValueExA RegEnumValueW GetLengthSid GetKernelObjectSecurity CreateProcessAsUserW DuplicateTokenEx SetTokenInformation GetTokenInformation GetUserNameW RegCloseKey RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegQueryInfoKeyW RegDeleteValueW RegOpenKeyW RegQueryValueW RevertToSelf RegQueryValueExW RegOpenCurrentUser ImpersonateLoggedOnUser OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityInfo OpenSCManagerW OpenServiceW QueryServiceConfigW ChangeServiceConfigW StartServiceW QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid FreeSid

shell32

SHBrowseForFolderW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderPathA DragFinish DragQueryFileW SHGetSpecialFolderPathW ExtractIconExW ShellExecuteExA SHFileOperationW SHCreateDirectoryExW ShellExecuteExW ShellExecuteW SHGetFolderPathW SHLoadInProc SHGetFolderPathA SHGetMalloc ord165

ole32

CoCreateGuid CLSIDFromString CoInitializeEx StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoUninitialize CoInitialize CoSetProxyBlanket

oleaut32

VariantChangeType VariantInit VariantClear SysAllocString SysFreeString VarUdateFromDate SafeArrayPutElement SafeArrayCreate VarUI4FromStr SysStringByteLen VariantTimeToSystemTime SystemTimeToVariantTime

log

WriteLogA CloseLog CreateLog WriteLog

shlwapi

PathFindFileNameW PathIsRelativeW PathRenameExtensionW PathAddBackslashW PathRemoveFileSpecA PathFileExistsA wnsprintfW PathFindFileNameA PathIsDirectoryA SHDeleteValueW SHGetValueW PathFindExtensionW PathRemoveExtensionW SHSetValueW PathAppendA PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW PathAppendW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

iphlpapi

IcmpCloseHandle IcmpCreateFile SendARP CreateIpNetEntry IcmpSendEcho GetIpNetTable GetAdaptersInfo GetBestInterface GetAdaptersAddresses GetIfEntry GetNetworkParams GetIfTable SetIpNetEntry

rpcrt4

UuidToStringW UuidCreate UuidFromStringA UuidToStringA RpcStringFreeA RpcStringFreeW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdiplusStartup GdiplusShutdown GdipFree GdipAlloc GdipCreateMatrix GdipCloneImage GdipTranslateMatrix GdipRotateMatrix GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipSetWorldTransform GdipGetWorldTransform GdipGraphicsClear GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDeleteMatrix GdipDrawImageRectRectI GdipDrawImageRectI

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpReadData WinHttpWriteData WinHttpSetCredentials WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpCreateUrl

setupapi

SetupDiSetClassInstallParamsW SetupDiRemoveDevice SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiEnumDeviceInfo

feedback

?QueryReply@feedback@baidu@@YAKW4ProductId@12@W4LanguageId@12@PB_WPA_WI@Z

ws2_32

socket bind listen getsockname connect htonl gethostbyname inet_ntoa WSAGetLastError getpeername ntohs getsockopt recv send recvfrom select __WSAFDIsSet WSAStartup shutdown htons ioctlsocket closesocket sendto WSACleanup setsockopt inet_addr ntohl WSASocketW WSAIoctl accept

psapi

GetModuleFileNameExW GetModuleBaseNameW GetModuleInformation

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

config.ini

SHA256 409d1e773bfb9ed4e62b111041924fb5499acd9edb672c3f78eae80309f17bc3
MD5 e03b4002bb779b45284c359d0f41e958
SHA1 75be4810aaadd1970ef11121c806a06a5a748606
SHA512 74ac2c3418fa3474848b0645f43198964bc8dfd4522b75d4aa86cef099ab664ae11473f12b789a196129de14b0443292e7b00f1aeb6d62703443906da0c39de2
SSDEEP 96:rG4udfx4V4Mzi2YK3QFfn9D9vQRJoZ9evOnSw9vQRJoZaVreLWzflfUNWLfsD+Sq:64udM4MzzYKgfjvQRJoDemDvQRJoKeL4
TLSH
T163C1B04367F91124F2F36E88EAF454B25B37BC56782CC59C50E1120E99F5E409923BEB
MD5 SHA1 SHA512 SSDEEP TLSH

data/LinkCensor.dat

SHA256 00c26570bd8c2739842da08a51e3ee07c34303e11acb5e11c7a13b1a19c31a60
MD5 03776f57e25e4bc9263ae902214ffe84
SHA1 6d5650cf71f9f37cb623691eaa7c5a40dc02e970
SHA512 367ed78e02c75427156bfb4ebe5bae32f3df0935902ed9e29419850756b13b9a9b5d30e0d5fafa50f1b2eebbeca35aaac8e42dda7395ec946f8a5c9993aed84a
TLSH
T1F5B09228710800CFA088E00622121D54BD06A23915C3C9E269A0C60E5F0232274B92A8
MD5 SHA1 SHA512 TLSH

data/mn.dat

SHA256 44e19ff1c41cdd17a0d4990c8ca8b557cc1121e1d2c7594c778dc00af8d6da99
MD5 6ab6b2052e5d5f91df4411165473e7f8
SHA1 ca9ae3006347d177c89cbaf4d128277efc91d389
SHA512 63163c62b8a4cb72a3836d2f82eef1ab4f8588762352bc3137743c639a082b50f3f55c3ef7149700e4641c4d4e568c57fa69d7120429296eb253aa29109f5d14
TLSH
T12721C664F9563E2503B83B8BE29439F39019226706E63F19A096996C3D1428CAC39DA4
MD5 SHA1 SHA512 TLSH

data/rl.dat

SHA256 8d02e538f7ec779cd360244a8a0fccbf14982c00a62375e1a877ec9b2dbdaa25
MD5 d54f59f50c92017be711a7c612440dc7
SHA1 013483df54177b6f0f3110ec3504a2dd5f3d4f51
SHA512 46405982d19067e451ec9bdcd62b2f100ceca42ba0e57e9f6307a3b27dae2cda6f8a79db1cdf6ed20f45e4d8f198570fea8fa3023657d60b2a7022d9279afebd
TLSH
T1190152E42D051348B617DF5CCA5B0219C9388AF7279DE6574C952ADECC481468930E79
MD5 SHA1 SHA512 TLSH

data/sbr2.dat

SHA256 f25b5d7ed4bf573a5bf23c18a583617524d751125c1e6a74df5cb4a64b523ba4
MD5 f889ef56d17f853e30a69065bf78a564
SHA1 60f901894a8d8ec04958d40270071b74bbb4fa9e
SHA512 8e30587bdc0a67fb7d8f32f0bba3ba52b96b6b5da68fd258fa62c32e14a4526e8bd27ff24c82199fdcaa0614f31ff6ec29572a9b19c53383c1ed4f4beeca72d7
TLSH
T1B72108B67483C9202225293107B758F62445CC87F90D931AFCAE76C93163AEEC2D889C
MD5 SHA1 SHA512 TLSH

data/site/api/querydownload.cpp

SHA256 c73215f57eeb222d4a2bb860b067f0930f8c5886f6c70c634990610a5203fc80
MD5 3f3ea239b3ee84627ff6f2019e18e2c9
SHA1 dd5e42174fc591cd360a43d8a94a8dcbd7b81613
SHA512 6316be5468c1dc013219095f473001a17cffb5cbb3f8fbab6395e03d446a41a65b849d0da817283917762bc9d81e00cecfeb46db9fd8862064b923f9dc711198
MD5 SHA1 SHA512

data/site/index.html

SHA256 c40dc7c26b87c8aec4ecfdaedf37f1aab20f70144f5e4b2a150140f5b43adbde
MD5 4362862bb42d1229666737addcd3d340
SHA1 84984800a1d41ae94be454ab3f31fe928f419379
SHA512 e057733651ed6b1b1f3918691dd21a372c133b99aa4b3a55916b93237045107281ea6b70e22574b658e16f38c5d31800f01ce6201ff9b6716077842a7f04edb7
MD5 SHA1 SHA512

data/site/static/css/common.css

SHA256 fef936530551e63d794cf4b155c01b838f44a5d539179eb776b1e617e82e2ed0
MD5 f984afbac91abcbca7d1ef3b2d642206
SHA1 8aeab63e5ae8535a332e17c55f050e1aa70a5900
SHA512 b281a18c76bfd06534ec3867ef43b218c933e66ca4bca7dc83e6469696071431c146a76c7ab58ca7f01fd3614f45db061f2d8f41a6654a2a699f359caab995e7
SSDEEP 96:J8Jsu49gnNJ7eSfUgFcvmW1ZAT/FptwGkoWEmcKsbDFFR33hKtF:2w9gPSSzFdmA+4EzqJHhKtF
TLSH
T1FBC1A73545906004B0BBAA62E5E04BEF396FC017ED230D7DB6A93869E7EFD5A1022583
MD5 SHA1 SHA512 SSDEEP TLSH

data/site/static/img/bg.png

SHA256 61251ac6ea6a23781bc6bf2ec8848be18bb33d40cef6359418aca55a80a1ae1f
MD5 f8fca87bd0618b3fd58744e33818c135
SHA1 1d9dfee32b1c529be96af066c506314c7603b58c
SHA512 3c03361dc3869a43a86c6cfcea885b84fd029669ff3a8ebd446d0e474fdacabef0d9721e4e4cddc4c012cb1a0e13dfd7216d50efd242a8c7ddba11ac10dc5f63
SSDEEP 96:6xYRk4KBvhCHsXZPtbPtdv7q7fxafTytK2WYpwR1Y/aFyAnARn92:6xYRWvhSsXzzvO7w2t1WYKRq/CyKAR92
TLSH
T1AC917DAA135DFDE0124439D5A6502C43E0986725FFB727E3EEFE42514EB216C4D88DA8
MD5 SHA1 SHA512 SSDEEP TLSH

data/site/static/img/close-tips.png

SHA256 63bdc9d553ecbee36fb4ac01f832783461f4da3106d0f67b4dbc8f0b36d524b0
MD5 9df8bd25126f8f9ef72fd256dd8f8546
SHA1 aea68f866bf2f1854a6df2bc29001fd3f4546abf
SHA512 007f09d181a51d9ad86b95e8fba26a109bf2849bc5aee1add5c33a8d1d78d5c5fca6a99e1a6aba667683288d66fc667bc6b2225fd3720c013442066b2c48fd1b
TLSH
T18FF0F1D3EB00141AC7D110B7177C6AF168342D560699139201AF3E0B08738325E4967F
MD5 SHA1 SHA512 TLSH

data/site/static/img/download-icon.png

SHA256 ad4091b25d35e784727ae8f29f319dbb4d34deb548d08c81adfb19c7e3fe657c
MD5 2979427eaa576e5c4d3c243133964435
SHA1 7c767f85b6118091c54a355f30aff2d428a00335
SHA512 42646898d0bb58f049bd2b6558650eba68262938637d970e1260d660f626cce73fb9beea2b92534d22856a4fd3cceb5dc4a770ffc548e234762b2d42c3bcb0ef
TLSH
T1A0F002DD42F03AA0E4A5E795451A66B89E361515B1320558F0D618324BF32CE7195F86
MD5 SHA1 SHA512 TLSH

data/site/static/img/header-bg.png

SHA256 1eb577e42474ddd3618cf7a3f253b1a8b3a998091eeef4a88744bae3c8741fdb
MD5 fd1f9d05e89704430df93b58eeabf884
SHA1 96b56df7b77f2e73baaa6e1acf2a7588ca79b388
SHA512 0d886ac83e0b94d3df2d75628e5b433a296645bbba845a22c860c5201fbfee411c7aa568abc504bca24ddc23a560738a17cdf76917f8f1b7f88a467f90e9f405
TLSH
T1E141F7591391D195D7DF5E7B9CB9538AEB26A8C0106404B200563CB21FA2A0CE7C233C
MD5 SHA1 SHA512 TLSH

data/site/static/img/icon-add.png

SHA256 6d3dac3a252b207ed1ae71e472f30fba1f7364a92813bf784b42640098f7bd85
MD5 603181b2b98ff74f67266eda1382cbe3
SHA1 e75193cb7ee9869647785330b9c34d84dfdd9892
SHA512 d45ca0c8c2b0d3946786d9352d31d0bbbf510d790856de5069870340247da798c0d38107e3ca4491e3065a4e0659437aaf4ead0364188b76d698675f8295a1b9
TLSH
T1C31102D5FD50684256D89C8935F68037DA931880D7D1F7A6B4CECB162B741F1C89ACCB
MD5 SHA1 SHA512 TLSH

data/site/static/img/icon-file.png

SHA256 a31846a8cbe52f73aaf229907028926d4a74354ff0655ad18bc4999bc2f22905
MD5 64c22209eab66ba34fe1345a0a25ade0
SHA1 50faaa46a931c96a082c562a975560c6db990064
SHA512 16d9993ad85740a57dca4d6181b30419b27df7acbae386897a2d61f58aca5c53609821676486fdd9addde4b91a40a0f8c6648bad0c7140d93e9889e418a9dc75
TLSH
T140E0C0B08001BC96ED4B682741020130D43F5E93737256492116FDB9FC6A56B596F138
MD5 SHA1 SHA512 TLSH

data/site/static/img/icon-pic.png

SHA256 b2291f9cc2618280afb7ebc1d89d89fd1bd15cde9dfbf9990601d0bf00ad92ad
MD5 5dab8da5ce00e815675644e47daa7179
SHA1 cf19f0d9d37a03246bf34f4e871d403c28580b70
SHA512 76b0dd679601a4fd9e717c89fe0d212be2cf26ec7b28eda494ea345044e8a7c2121418469baee1c86f4bd8b67e8752873ff4bf57079855b06f81d74dd64a5e27
TLSH
T190F020F25792993EF9947733344A1410C869AE482AE1580AC0A86AB8623D4E54F4B608
MD5 SHA1 SHA512 TLSH

data/site/static/img/icon-right.png

SHA256 dc02ed2bbb0643e9d263e13b7934e260a2b8959e7d0bc10a0cdd7aa2da8799ad
MD5 7a2551de732251b7082ae4bc73f02c3f
SHA1 32d970aff768a64fb1bd2486d28658c727186ae3
SHA512 24f3fba81752d4791f73792fa9c7c57af89a01f39cae2ab291a40a76bbda38ed01c467be354d53937582e914a742e82287486ad2e5accd8ea024ceb791b65a43
TLSH
T1F9F020A16C74B31E60E9FF97669B64BBAD06059C2376C30C9E0C8D946430A217448E28
MD5 SHA1 SHA512 TLSH

data/site/static/img/loading.png

SHA256 b1daadd98ea4224ec15e5a37ef886cc54c506e10cd97c89658b9215c020a3011
MD5 039597f3d42fc80ff600edb55a4b5ab9
SHA1 b017e16214403ff4e109f0cc4a416ffbb543b2bf
SHA512 e0392f3c16dce88d28b180dae6dbdabf0f1706637f16b1ec225970cbcc20d725f7487be813b09f463f2b14e998d2c78af0c3af021bd779adc1ab802787d7a7d2
TLSH
T16D412BB5F683EFBB04840564DD4E26F9EF730D067509BA52491A3EB22F3C12A43801D2
MD5 SHA1 SHA512 TLSH

data/site/static/img/logo.png

SHA256 83a977727c7e152470326e4ccaa3e1a48df19a6f78cced058532dafad394986b
MD5 a654a00051c36f3fa0a7c1adecf8410b
SHA1 a73cb96366bf9bb5463e8a14ac0fd6f3dcbd8cde
SHA512 0bce091e968c40be27e3697b2ff68afdfdd252bb1efb4d6da23696e37ecb405894ef90204e703ce671f1b5e5910955db29a30803e2ff0f35a3c57664ba23927f
TLSH
T1EB311B4ACF721DE8C2A0477C419F0945153455394D088FF8411E487D62414F5131A2C7
MD5 SHA1 SHA512 TLSH

data/site/static/img/pic-upload.png

SHA256 9cb694e7303f2a9e2e03805d2bbb8cdd7dc5611c9ddf93d3ba845a7268cce620
MD5 6fb1f6944be99511715b5c656e5d5479
SHA1 9e2085ecb5c1a05f9cca17f7a3c6fe95fa130904
SHA512 d6523692931b8bb52032e4e09e87fc1b241404a6b8c3b308591d3578b7106463649b6f1be94640d89446896262b89e1afc5146af0d0193882a1bbd3af7520447
SSDEEP 384:U50wCA8yKRiSwkAFhHPUE/zz/VbNoRlWS9Bktc6xC1:ycAzwmkqDzz/bozW8Iny
TLSH
T1D772C04B94DE0CCF3C485ABD071FB2ADAF0BAB647E4A16A44E91D8824D19E1B7533744
MD5 SHA1 SHA512 SSDEEP TLSH

data/site/static/img/star.png

SHA256 778b1f2608fdc30b77ef377c54e34cd748b8c7c0039606cb92f1db39080f62b9
MD5 ec999bef024711fe1ae1d90a38e95707
SHA1 8fbe567ed4918560a84ee32498f1fd8863906899
SHA512 ac79e0df51ff6b73069ebb935bf9d5d4d26dbe88a72bb4f10fe02f48cbb597b888ce5a1eab1321524c23836c3edb97f4ea98b43f57c28d2d1744a28c440590c1
TLSH
T17531C7DD64F6AA10D5ABEA35720D6963713FD02096E76106B8B1B8E360174E81605D27
MD5 SHA1 SHA512 TLSH

data/site/static/js/download.js

SHA256 c40a0d4904d175ad4bf86477fcd8591772a36b2a62e2e006ec07aa8feaafaad7
MD5 f461bf05b0954026dfc6c2661d73f94c
SHA1 3762d8a25d2fc51070bd4cfe2d9d9354830bbcc7
SHA512 3e247f0d16870928eb2583c7491ce269c92117a469bf36635ef9a64c10bb2a37d74e2abd3276d43fd4202040b1e14215a9b8586a6349ad9fcff57ec5414d7b9a
TLSH
T1EC810E4DB9468619D7B7B1B88E7F4A04E273225B18054E083EBC5680BF7052A25D9FFF
MD5 SHA1 SHA512 TLSH

data/site/static/js/upload.js

SHA256 fab5e653bb92b21637809e212550ab7273af09c2ed1e11376dcc50980f25b183
MD5 0257199cb712d5bc162cb4f30d8c6156
SHA1 dfad530715229249d8d5872c437474193a3b00d8
SHA512 59603edc8aa3202ea22415c621898563591761730ae90bf8383e57ad584acafd8b5b8a4379bc9fbd5103b825e985220540c6d496e8c2995c05efa2efc98e40b2
TLSH
T1AE811089691A59AC92BBF1B5CF7E2115DAB7501F19060E213CBC64801F3091E21DFEFD
MD5 SHA1 SHA512 TLSH

data/site/static/js/zepto.min.js

SHA256 d42f522305d1f6179a0435ae853ae662792295ed7e990658f5d9ac02872be2c5
MD5 f7c3f67997f5a30713f3e079dd5a902c
SHA1 3c499f00fcbbe4e29bca1e730daf13fbdfcecec1
SHA512 d72975e37ee3f4ca7d59d72f33488d21767187b97ae774d74f66d40edf25f82e1c2287da6740cfcb2ed60a41d060dcad8fddeef38120f2151500fa27aae0b02f
SSDEEP 384:WFrIZGWy+ktr9F4w9/36N6+vSWsam0fd26nf+mensBRZuZ69qPS3uh4P15ZS5w:vE+kVGv3VTf+hE/qPS3ug5ZSW
TLSH
T13DD284CCB282F46207A772B4416F620BF23B6899340E4054F168E8E17D7895E963BF7C
MD5 SHA1 SHA512 SSDEEP TLSH

data/site/tool/1028/download.html

SHA256 e8b0fa5cb78e0c977321c10ac8d480fbaf8b405d5b5c564168e1fb0946b002f8
MD5 0fb5eb00578a6affddd9f0d99faa6319
SHA1 2e52d3246a930f6b062e29163f4501e9e0b6f192
SHA512 dd9c912eafd1f9dbae58cf7795ee4772de7346d2003fc194cea0f22ecfc9d76f2e94a1d42874a0f25fa538474a76c79c0b4b18896933e338d47a84df3063c488
TLSH
T1665141076C41D82740B3C19976F6EB1CEFB5420BC741D9813AEC565B5FB2EC888C32A9
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1028/upload.html

SHA256 fb921b4ba3e3ac79790a3dadf314101dd11ec735cac3cb0ae0aa497eccfab95d
MD5 f6b12cf640d894f42b1beeaebffbae78
SHA1 feec75c49db6c948a06c08025bcf18d227b846e2
SHA512 2a246551d8dc1515b2a82af68b9439aa1dd5fa6e6757d38c93b6d3ae6ee12e81e23ada17a95acf8b837ca2641a5807897b92f6c34e3f63a0d1abda79b08ad6d1
TLSH
T1E7510117AC41DC1740B3C19567E5A608EF7482078681EA9179EC96EB9FB2EC4C8C3398
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1033/download.html

SHA256 2282d2ea79d450123539649a05b3a33f586a7c117317ae70d33d12be7c5d65a3
MD5 04b788b936f80e03f5c4582315dc67d1
SHA1 b44d70e4a8d18cb851ab899d172ba1c9e8b57d2d
SHA512 a30805d9b3cac4b4cd658b215833181e0cc598afc8000320772e9c61af88bad646d205c1380dba646ceff8ff2c39829f2e2de66e5a6c50e5a9b97f8e6cdffb92
TLSH
T1305124076C41D82B40B3C19976F9AA1CEFB5420B8781D98176EC465B5FB2EC888D32A9
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1033/upload.html

SHA256 03cb207a83f1bed4a8f4b3273c1c51c581cfeffae7c2c35e2d1821f096a13121
MD5 5226218446c0976c007119408f743a71
SHA1 9218e70186349a10f93af751772d0489c49f776f
SHA512 04d20f783cd97a4045cc4ff8afc109bf0f5d6ca0f7d87f02662220388f6dbcee97f12b55452d87062e1972cefa899a0b7c6bec78126925057834d776fd04a747
TLSH
T1B651E1176C41D81740B3C19567F5A60CFFB482078781EA917AEC96D7AFB2EC8C8D3698
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1046/download.html

SHA256 54075bd4c839913a50e2020d9470bce6a2aaf1e55815b2317b25e1f5b60dcf35
MD5 77f34f0575b36f88a40e2280ac1bc574
SHA1 0bd39d13eb27f0d8f27cd63bc21f62e4f26b47d2
SHA512 15005bc9b7973fe6c9f3f5d63adc69caa75a275b0a28ac1a17ba40fcc35144d8c1a0de28b6c038bb6c17e27c465340a319787c98040bb7613a05b521c30b5416
TLSH
T1215112076C81D83740B3D19976F5AB1CEFB5420BC781D9817AEC565B5FB2EC888C3299
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1046/upload.html

SHA256 669efbb95130a484819376f4019783efde75b65519b773ebd76fa944fab72429
MD5 d23591c38a8ea7bbd84ca1f821f9c189
SHA1 42605e9e35713867986e509c3d8e0081569869d3
SHA512 bd9736287d14cd6452e6b995f8e7dac62fdd77c54dfd4bd00424512456ef588f083ebbb683f9181091dbdbc33a59886827faf82ef3f9c3dcaf2f8590ea6130bf
TLSH
T1A451C1177C41D81740B3C19567E5AA08EF7482078681EAD17ADC96DBDFB2EC488D3698
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1054/download.html

SHA256 04195e14ba819001a9cac9698655224dfd39846e11cee0b62145d40a5ffda083
MD5 6661ad88abf89ca49ccee4ef9698b7da
SHA1 06b65feafd7167258bca0f62ace9865075fe2a27
SHA512 8d4ffd6590b60be20fea7d8f56a29a750d527b1757e2eb3187403b9fca23583f57b053c93638c77cc36e29989e32081da97723409a92bbb146cafae913ee1705
TLSH
T1315122076C8198275073C19A76F5BB08EFB5420B8741E9C136EC565B5FF2FC884D36A9
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1054/upload.html

SHA256 e49b966491f7e40760d007b3aa2354e03601f4671da16bcc401f0d9c08ac28f6
MD5 897d60ffb21611f2091f2d8f031c0122
SHA1 88961f253df073b04b4edd2608fd802ac8d6e5da
SHA512 7a5b5b884b89160aa020b05f1dd6d05a2003c0e7506e1c2feaf66f817fae04eb2baef1757ffe9fe3f8d86f86f50f25a2573ba980b3e76f5d94ab6193c8cbb011
TLSH
T16051FF176C42D81750B3C19567E5B608EF7482078681EAC17ADC96D79FF2E8888D3698
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1057/download.html

SHA256 55bb0bd9e1bf1052909b6c1283a839d51394118bd298fcd0c8626ddb227eb025
MD5 6ead5eb4f278bb129f66dc926f1f4ea5
SHA1 45914a485572dc6498071feec9f20d8301556253
SHA512 e75384b5efce44e6cd17427eb6455f1827f44dff3978c38c28bc2a05347877a904d6c0f91faa90d3d967679b58fa88a4020fc358d18ab3fd9a34eebfce98930b
TLSH
T1B35113076C81D83740B3D19976F5AA1CEFB542078781D99176EC465B5FB2EC888C32A9
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/1057/upload.html

SHA256 5144dd18d0cdba26338e49a966a655b246bb7aec602c43fdf2ba4bdcf1bc256f
MD5 94fb46ffb8cf579bd0d6c78e7aceecdd
SHA1 24262b42617788f82da11504a2b034a4bdce00c9
SHA512 cc4928af6e92aaf0eb4989893f818e3a713132cb5a2b0bf6fe2f68a9f702972457f5b7b7573f81faadb1a0a30f653f77b736af4b3076ab5b1f389b9d2fe83f84
TLSH
T12C51D307AC41D81740B3C19567F5A658EFB482078781DA8179EC56E7DFB2EC488C3698
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/3082/download.html

SHA256 42a9caa94b258e34ba522bca0a5bca7cac24043ed20b781b994cae6db0814d41
MD5 4d5d08bb0ed688c11de5dc3d7503aee6
SHA1 280ab51565fd368fbc31deeeed49fd3e96574321
SHA512 c74590d1f61d4d2e40f0c0044f15a7f0afaa5a668a223d8df62b1cefc0e82f5424b2cd325c0d965bae4d0ed93c5e4a54f5ce4335bd47360c0e2b151090b28a69
TLSH
T1665141076C41983740B3C19976F6EB5CEFB5420BC781D98176EC465B6FB2EC888C32A9
MD5 SHA1 SHA512 TLSH

polyglot

data/site/tool/3082/upload.html

SHA256 d04d470ba66c5af8fa1eaa86de1a3062499e190a0703ceda28619d8b8c855c60
MD5 87cfacb57953d731c2de143f357474c8
SHA1 68115a6e4d3e3fcaa9a57d7b3f236890f25bb98e
SHA512 6cb5ea2069c7800ebce68fb5116e86d8d17d4baf9aeea39507e7090a9c6c0f3d978862ed108edf3be26da7a84e9f825c7353880e2054b9194a4e654a22d22c21
TLSH
T1A551D0176C41DC1740B3C19577E5AA08EFB482078681EAC17AEC96DBDFB2EC488C3698
MD5 SHA1 SHA512 TLSH

polyglot

dbghelp.dll

IMPHASH adf9759800fcd48cc981a4db72368f41
SHA256 000c4ae5e00a1d4de991a9decf9ecbac59ed5582f5972f05b48bc1a1fe57338a
MD5 88d62065f635baae190eccf04a37a4fe
SHA1 ae79e513debde83462147954e71c7e7e11af4a28
SHA512 7023dcc314bf185114fefe25a1df2637a20d534ad29b05bace86388fcf2d9ab9bffdd73fecbd6781f4bcfa13a18460821041b8cbca37e77ff3039e166cfa8f3a
SSDEEP 24576:eb9GdYvgjNX80VtI5I/LJY2rPtWKpuFL2:ViJ5I/LJY2LN
TLSH
T119357D31F6509275ECD21072E27C7A3A21BDE277031951C7A29809AE6D627E36F3C6C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e1:de:fd:03:98:61:30:2f:aa:d4:b4:a2:d1:b9:4d:8b:8b:56:1f:34:6e:55:7d:7f:ef:be:29:c4:f7:c0:9c:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 7, 2012

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

de:fc:c6:f8:4b:ea:ce:14:08:26:e6:73:a5:87:88:48:68:4d:ac:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 7, 2012

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 26, 2012 - Oct 26, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:02:92:4a:00:00:00:00:00:20

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2012 - Apr 9, 2013

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:49:55:00:00:00:00:00:0b

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:c8:30:00:00:00:00:00:0d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2012 - Apr 9, 2013

Minor OS version

2

Major OS version

6

Entry point

434923

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dbghelp.pdb

msvcrt

_lseeki64 _write _isatty __pioinfo __badioinfo _read ferror wctomb _itoa _snprintf _iob __mb_cur_max mbtowc _fileno isleadbyte _onexit __dllonexit _unlock _lock memset memcpy _ismbblead _initterm _amsg_exit _XcptFilter memmove __CxxFrameHandler _errno iswspace calloc _wcsdup towlower tolower _wcslwr _wctime time _ltoa _strnicmp _purecall ctime malloc strncmp isspace _stricmp free _strlwr _vsnwprintf iswprint fprintf fflush atol fclose iswdigit __unDName bsearch fread fseek _wfsopen wcstoul strchr _wfullpath _wgetenv _chsize _close _get_osfhandle _open_osfhandle ftell _mbscmp _memicmp wcsrchr strstr _wcsicmp _wcsnicmp qsort iswxdigit wcsncmp wcsstr wcschr ??3@YAXPAX@Z ??2@YAPAXI@Z _wsopen memcmp

kernel32

InitializeCriticalSectionAndSpinCount DeviceIoControl GetFileType CopyFileExW SetFileAttributesW LCMapStringW InterlockedDecrement InterlockedIncrement LoadLibraryExA FormatMessageW GetModuleHandleW FlushViewOfFile MapViewOfFileEx LocalFree VirtualFree GetVersion RtlUnwind InterlockedCompareExchange InterlockedExchange GetThreadSelectorEntry TerminateThread CreateThread HeapCreate HeapDestroy VirtualQueryEx GetThreadTimes GetThreadPriority GetPriorityClass GetThreadContext ResumeThread SuspendThread CreateFileMappingA GetSystemInfo LoadLibraryA Sleep TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlCaptureContext GetTickCount GetCurrentThreadId QueryPerformanceCounter ReadProcessMemory SetLastError FindClose GetLastError LocalAlloc EnterCriticalSection LeaveCriticalSection CreateFileA GetFileSize ReadFile CloseHandle TlsGetValue TlsSetValue FreeLibrary TlsAlloc TlsFree GetVersionExA InitializeCriticalSection GetProcessHeap DeleteCriticalSection HeapReAlloc HeapAlloc HeapFree IsDBCSLeadByte SetFilePointer GetSystemTimeAsFileTime GetCurrentProcess UnmapViewOfFile CreateDirectoryA VirtualAlloc VirtualProtect DuplicateHandle MapViewOfFile GetModuleHandleA GetCurrentProcessId OpenProcess WriteFile OutputDebugStringA SetErrorMode GetFileAttributesA DelayLoadFailureHook

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

DbgHelpCreateUserDump DbgHelpCreateUserDumpW EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx MakeSureDirectoryPathExists MapDebugInformation MiniDumpReadDumpStream MiniDumpWriteDump SearchTreeForFile SearchTreeForFileW StackWalk StackWalk64 StackWalkEx SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymAddrIncludeInlineTrace SymCleanup SymCompareInlineTrace SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsEx SymEnumSymbolsExW SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromInlineContext SymFromInlineContextW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrW64 SymGetLineFromInlineContext SymGetLineFromInlineContextW SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymQueryInlineTrace SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetScopeFromInlineContext SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW UnmapDebugInformation WinDbgExtensionDllInit block chksym dbghelp dh fptr homedir inlinedbg itoldyouso lmi lminfo omap optdbgdump optdbgdumpaddr srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

dynamic/PluginHome/rocket.bskin

SHA256 c2cb4fbabaed95d13fb375212457e8bd81d0e832eff20ed21bcf3466462ee21b
MD5 f4985a0a4ffdfc29b258d2b3153f4b9d
SHA1 69da5933044824c1830c2f29f1777d9ad73c7abd
SHA512 34ddf6be6043514e9dfe60c32826c3effc667d76969b184958bfe22259cb420378ee875b33574b5a110024d9f1da09d4cc9e65bab0153bd04eb755c7eb0ba22e
SSDEEP 6144:xYYrajCK3XuYqIfrqek/NAWPOXewm8p+IGxWpHnzewApswUTg0TnW:WVeKxXEPN8VCwXwUnC
TLSH
T15B842369074E7B20F19B239173AD4F0A6A5D1F0E7A7AC274A479058A6BD8D00FD083DF
MD5 SHA1 SHA512 SSDEEP TLSH

dynamic/ResultRecommend/config.txt

SHA256 c478941029cca1b1fddd6075f47531b7723e7dd4869b320e8a04312d40445ce5
MD5 14dd1fb3da7d7d5f7c896b77a5554370
SHA1 bfe02ab80176d7315b6a0895cebab93719437382
SHA512 aeaca8cbbe39b81274d1b91d08c326fed935d3f07b81f6937d8c66e71576d82c36a5ca83b2caa052f3f4c7079d140d9efa3a9e34086b49e1ae8ee0233bd176c4
MD5 SHA1 SHA512

dynamic/WorldCup/server.txt

SHA256 4840873ad41126686d75c16432aaacc035dc1f853b5c4921406c91f02a0c6fb3
MD5 36bc303a5d354ae96472327781d28181
SHA1 29730cb346ec97a7cc0980b6d4558fead84d05f2
SHA512 290e5188f5e31e501d02170232cfe1b6fe57bfd04ddab80e4efb3ad5f86db692b74c0aebcf3eedf02c76fd96257cc37daff50e72428045be868c24fae7ce95b5
TLSH
T11AA0026369755652B6943659C05167868D65F29210D14045328564716544A43AA0647B
MD5 SHA1 SHA512 TLSH

dynamic/data.bns

SHA256 3ebfc2c3f40a809c7e6bbe6ed18814f75bb689fb3d4424c16dde1f7b023eeba2
MD5 9ddbdfb6895b75f9cec430fc7c9b6056
SHA1 abfaa986b65e6cf62cbdad5788ca36f622ce1a56
SHA512 ef701f0097aa4c72f7d95842eff6863bb6d967bcdbe87568b22d44278342db287a333c843f35dc13be9822f55ef1ae4c33f3690de16079b64fd0f49af752ed6c
TLSH
T131F02E65764FDBD9D8E43367F46544C3BEC9332C5320A466B24C94B941B5C23D12D71D
MD5 SHA1 SHA512 TLSH

fn.dat

SHA256 6193a7c8816041f2aefc947dccda6984eb08a5fc1cb077cae27db8e670744d24
MD5 1f5dc6da142a263e9980b06ed3b38b57
SHA1 1110d88e2fceb73d1f1f42ab50527418bac93e3b
SHA512 86d0ce461b7c024a01ebcaae082b9e66bfc9ee4e3c6d0d5a527696a6b0abe7cb46cb7766a939a37c113b9bc54a021a28b2d3dbb8bc3989397ebf9010229ed28e
SSDEEP 768:2QQvGpV/yzHPxOgOiyYf99ICyh+ClawdStcgvm1IhyWGRoU:2/GpVq7xD3yC99ICyh+0awdwcgvny7R9
TLSH
T1036345C9522DBE0D10B6736EBA584D2C4E4C50E6AAE70C37D5F33FC56124FE60A4E2A5
MD5 SHA1 SHA512 SSDEEP TLSH

liveupdate.exe

IMPHASH 21779acfe85e87a0d148e76c24c5f4bd
SHA256 a52aa1a9d9c93deb7a6cf6d16f724edfab1b298e80e876952da4855bf40fd46b
MD5 a3dd9eedc3d9f301cb523036720e6abf
SHA1 b6ce6c9be6a54eda932370eedeb3a3aacfdb1ee2
SHA512 e97ee83f4891f72f94df98b6328cf149b79d5be62debdc2171871506899f2bfa63e54ec5d63579ac47a39674bae7cb5181bca4d899fa234b80b3961b5510e443
SSDEEP 6144:HUGDxN0nL9JOA93pxhXFjtNmAnLJqjLJvRxh2LpLlKCyTXRRTXRvYqmxaUB/P:Hti7zLxxxijjLTxh2V5KNoN
TLSH
T10AB44B00B6A1C136E9F309F68EBE926E9939BD71172490CBA3C40D5D5E716E1BE31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3a:51:1b:92:3c:aa:b8:d0:80:9d:83:65:df:c3:a6:82:61:e9:f0:54

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

291589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\liveupdate.pdb

kernel32

GetPrivateProfileStringW GetTimeZoneInformation GetPrivateProfileSectionW GetPrivateProfileIntW GetTempPathW GetTempFileNameW CopyFileW DeleteFileW WriteFile InterlockedIncrement GetModuleHandleW GetProcAddress SetLastError GetVersionExW ProcessIdToSessionId DebugBreak VirtualProtect GetVersion IsBadCodePtr IsBadReadPtr GetModuleHandleExW ExitThread CreateDirectoryW GetCommandLineW InitializeCriticalSection DeleteCriticalSection GetModuleHandleA LeaveCriticalSection EnterCriticalSection UnmapViewOfFile MapViewOfFile FlushInstructionCache VirtualFree Sleep CreateFileMappingA lstrlenW GetWindowsDirectoryW LocalFree LocalAlloc InterlockedExchange InterlockedCompareExchange WritePrivateProfileStringW SystemTimeToFileTime GetFileSizeEx CreateProcessW WTSGetActiveConsoleSessionId WaitForSingleObject ReadProcessMemory VirtualQueryEx InitializeCriticalSectionAndSpinCount lstrlenA CreateFileMappingW HeapCreate CreateEventW AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler GetCurrentThreadId TerminateProcess VirtualQuery GetModuleFileNameA ReleaseMutex LoadLibraryW lstrcatA GetThreadContext Process32NextW DuplicateHandle VirtualAlloc OpenFileMappingW OpenEventW lstrcpyA VirtualAllocEx VirtualFreeEx GetCurrentThread VirtualProtectEx WriteProcessMemory CreateRemoteThread IsBadWritePtr GetExitCodeThread lstrcpyW SetEndOfFile SetFilePointer GetPrivateProfileSectionNamesW FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LoadLibraryA GetLocaleInfoA GetStringTypeW LoadResource GetStringTypeA GetConsoleMode Process32FirstW CreateToolhelp32Snapshot FindNextFileW FindFirstFileW GetCurrentProcess GetTickCount OpenProcess VerifyVersionInfoW VerSetConditionMask FindClose ReadFile DeviceIoControl CreateFileA WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalAlloc GetLocalTime GetCurrentProcessId GetModuleFileNameW CreateMutexW GetLastError GetProcessHeap HeapFree HeapAlloc GetFileSize CreateFileW CloseHandle FindResourceExW FindResourceW SizeofResource GetConsoleCP QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle ExitProcess LCMapStringW LCMapStringA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP InterlockedDecrement GetCPInfo RtlUnwind GetStartupInfoW GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter HeapSize HeapReAlloc HeapDestroy RaiseException LockResource OpenMutexW

user32

GetLastInputInfo PostQuitMessage SetTimer EndPaint BeginPaint DefWindowProcW DestroyWindow UpdateWindow CreateWindowExW RegisterClassExW LoadCursorW LoadIconW ShowWindow TranslateMessage GetUserObjectInformationA DispatchMessageW GetMessageW KillTimer OpenInputDesktop CloseDesktop GetThreadDesktop

advapi32

RegOpenCurrentUser SetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity AllocateAndInitializeSid FreeSid RegEnumKeyExW CreateProcessAsUserW DuplicateTokenEx SetTokenInformation GetTokenInformation GetUserNameW RegQueryValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf ImpersonateLoggedOnUser AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey SetSecurityDescriptorSacl GetSecurityDescriptorSacl InitializeSecurityDescriptor

shell32

SHFileOperationW SHGetSpecialFolderPathW SHGetFolderPathW ord165

ole32

CoCreateGuid

log

CloseLog CreateLog WriteLog

shlwapi

PathAppendW PathRemoveFileSpecW StrCpyW PathFileExistsW PathIsDirectoryW PathAddBackslashW SHGetValueW SHSetValueW SHDeleteValueW PathIsDirectoryEmptyW PathFindExtensionW PathFindFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

iphlpapi

GetAdaptersAddresses

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

winhttp

WinHttpOpenRequest WinHttpConnect WinHttpSendRequest WinHttpWriteData WinHttpAddRequestHeaders WinHttpOpen WinHttpCloseHandle WinHttpSetOption WinHttpReceiveResponse WinHttpSetCredentials WinHttpReadData WinHttpQueryHeaders

psapi

GetModuleInformation GetModuleFileNameExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

log.dll

IMPHASH 1f1b4a93890829f1d8956b91e3836d9d
SHA256 1c034dffdcc09558951a3c8710314a5b73258750b4389849e8344ce99e9b8e29
MD5 6335136a732bf3f36f961b30c0bf2006
SHA1 4b4bbc9e626860e9df74fb0f356e8d4b59c8c4ad
SHA512 dd26ad1360f3e41a148444bbd79c70fc426881a660e25a01620ebd2a9ba0c88597b1347c5fa0608b89c81ecd1a18c365d52f02b55b4a15ba15a0d713e6036f47
SSDEEP 1536:noD0NZDi0xiCz/RWQN2nUg1dWiQNt1vgkKhDIcdg+nI6qN:HXi0xErvykDIQg+nU
TLSH
T1F0937C21B650D033D4D69479826AC3B29B7F79316BE894C7BF9407785F603D0EB3A60A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fa:32:4e:fd:2f:c1:07:fb:7f:1d:25:78:6c:07:8f:29:fd:c2:71:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

12677

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection FileTimeToSystemTime CreateFileW MultiByteToWideChar FlushFileBuffers GetLastError MoveFileW WideCharToMultiByte GetLocalTime GetFileAttributesExW QueryPerformanceFrequency DeleteCriticalSection GetCurrentThreadId CloseHandle DeleteFileW LocalFree WriteFile OutputDebugStringW SystemTimeToTzSpecificLocalTime SetFilePointer EnterCriticalSection GetFileSize GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess GetStdHandle GetModuleFileNameA HeapFree HeapAlloc RaiseException SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc VirtualAlloc LoadLibraryA RtlUnwind GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA

advapi32

GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorSacl

log2.dll

IMPHASH 169553d9c0e80575142f16084137d7ac
SHA256 1980bff5d376f07c7f01a6301f60d2012a90e84c2f9095ef4c1def3cbfcbe25b
MD5 175ea664f62cdc31949d29a9a3ecd4f2
SHA1 3b8904f28c0e36b9aab2cfeacf2516d47dd3beae
SHA512 8a16e53afe3a086140887df18e7df220856935c3941bc7e4f51066898764887d1b574ee7944e3d4f71c4382b1fccdee969704a5ead0061eac603f6d8fa02e09b
SSDEEP 6144:Cc5AZ/WzdF4TqGr4/DHA1a5JQ3is0nUuEziKd:Cc5AZmRG0/Dg1aTQ32nUuy
TLSH
T1E6745B00FB91C135E8BB16B59A7E96BD863979610B25C0DBE3C80E5E8F316D1AD31327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

68:4a:01:7a:5c:ee:96:cf:8e:b8:45:16:da:e6:ca:5d:8e:b5:ba:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

199315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log2.pdb

kernel32

GetPrivateProfileStringW CreateFileW GetFileSize GetPrivateProfileIntW ReadFile GetTempPathW GetTempFileNameW CopyFileW VirtualAlloc VirtualFree Sleep SetFilePointer FlushFileBuffers LocalFree UnmapViewOfFile ReleaseMutex CreateFileMappingW MapViewOfFile CreateSemaphoreW CreateEventW CreateMutexW WaitForMultipleObjects ReleaseSemaphore ResetEvent SetEvent GetCurrentThreadId GetCurrentProcessId SleepEx QueueUserAPC OpenFileMappingW OpenMutexW OpenSemaphoreW Process32NextW SetEndOfFile GetStdHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess GetTickCount GetLastError OpenProcess VerifyVersionInfoW VerSetConditionMask WriteFile MoveFileExW HeapFree GetProcessHeap HeapAlloc DeleteFileW SystemTimeToFileTime GetSystemTime TerminateThread WaitForSingleObject OutputDebugStringW FindNextFileW FindFirstFileW GetLocalTime FindClose GetModuleFileNameW CloseHandle DeviceIoControl LockResource GlobalFree MultiByteToWideChar SizeofResource WideCharToMultiByte GlobalAlloc LoadResource FindResourceW CreateFileA CreateDirectoryW GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileSectionNamesW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount LoadLibraryA InterlockedExchange FindResourceExW OpenEventW GetConsoleMode GetConsoleCP GetLocaleInfoA GetStringTypeW GetStringTypeA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA RaiseException HeapDestroy HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetSystemTimeAsFileTime GetCommandLineA RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringA LCMapStringW ExitProcess GetModuleFileNameA HeapCreate SetHandleCount GetFileType

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegEnumKeyExW FreeSid SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AllocateAndInitializeSid RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetSecurityDescriptorSacl GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl

shell32

ord165 SHGetFolderPathW SHFileOperationW SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathIsDirectoryW PathFileExistsW PathAppendW PathAddBackslashW PathRenameExtensionW StrCpyW PathRemoveExtensionW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

log64.dll

IMPHASH 2bc54f94d0056c15ea653553144e41f1
SHA256 f2d25f00ebed3c3fbdf59a1f43c19b2dbd9d7c77a636c860176ea12e872b40fa
MD5 6dfe00d395ef76efcfd2a4726ac97884
SHA1 0a2a2715e737edb55c3ec8ca95ee5d9b3c2b1e81
SHA512 df0930371a9e1b48bd247abcf19107abf8255ebccdde8e49120f742131a23cc591c1f96902a2253b6a824a469d61e4f0c05b56d005798648e057b9347f4374b1
SSDEEP 1536:GEJ53+uBdTSrMiF7OouBU7PkwqzprwODAw/oxQOCr/cJ5U5N6Fzqx:GEJUodTSgiF71uBU7qb7/+QOCrEJ5cNl
TLSH
T1F7A36B4BB3B400FAC45AC278C9E35A5AE771781A0B7543CF6B65875A5F233E16E3A301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f8:92:f9:74:7a:da:e2:ac:4f:95:40:7c:32:af:c6:1c:27:7e:9f:02

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

13992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\log64.pdb

kernel32

InitializeCriticalSectionAndSpinCount LeaveCriticalSection FileTimeToSystemTime CreateFileW MultiByteToWideChar FlushFileBuffers GetLastError MoveFileW WideCharToMultiByte GetLocalTime GetFileAttributesExW QueryPerformanceFrequency DeleteCriticalSection GetCurrentThreadId CloseHandle DeleteFileW LocalFree WriteFile OutputDebugStringW SystemTimeToTzSpecificLocalTime SetFilePointer EnterCriticalSection GetFileSize FlsSetValue GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc Sleep HeapSize GetModuleHandleW GetProcAddress ExitProcess RtlUnwindEx GetStdHandle GetModuleFileNameA HeapFree HeapAlloc RaiseException RtlPcToFileHeader SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LoadLibraryA GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA

advapi32

GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorSacl

skin/PcfTray/PcfTray.bskin

SHA256 554123c7b1cc9fc16ac6fbaadca38a83ee8e2f2bdc167c69138c18bd4a511856
MD5 6fc1db13628345efaa5efd832a9eb2b7
SHA1 aef49622fced19311c138d92d285fb55b5f0365b
SHA512 8b41e16e59728a03e440a37bbef1eb61d8077d417e73ae405740f7bb172c2c3abd3a7f527a5d03e430284ddee8c4cc55da0510184da337f66b6ab474d3aa7448
SSDEEP 1536:6qIyRsndlNahgcJVYwAtFrFkFMaohZuG0ovCs+Or9pTXQxEervj:BS2gwmtP8Ma4D6sjr9Wxp
TLSH
T1065312086BA04203F5467CD4E45F5A71F4C28EAF601AB7AC4DC44DA921FD51EA3F8CAD
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/FasterNow/fast_big_animate.png

SHA256 1046752486de439709a346c4f3b781d3db381de3b808615b29f892b8195249de
MD5 bd98cc552dc46cf0f337475ce0663be1
SHA1 d2cf19666c8374588134e28d577cad7f7943b439
SHA512 09a96cfbf7ea010b6a62fde4ffd0268e34325889df66e339eaab6106a2660a3116b2fce8d5a1044f0443ebc24e8ecec31860c93ee7898d457a9c53319bb7fb91
TLSH
T1C7615C85BE80D0115249DAD6ADFBA403EC459940D0D7F76B38C3F891092FAF9504DCEB
MD5 SHA1 SHA512 TLSH

skin/Scattered/FasterNow/fast_big_outer_circel.png

SHA256 800168e9b5c72631ffb5b8bec1fade0316f1ffbaf469141f2c7c778c6a0403d8
MD5 6c05eba25a973c572507a401578c81e9
SHA1 256d02b6c799c3d62d437f2d4229a15f7c1a6476
SHA512 d34db3d01ed828a73b04013432bcb9a4a4792a13f18d814d59ae2518d29b70f68a9f163a261893955dab66586133a3d204ecfb63c0900cbfe6813171a984e520
TLSH
T17E814BC9EFD0B605C2C4DCA119E414376993EE98F9C0CD543C8FC826285A6B52A6CAE5
MD5 SHA1 SHA512 TLSH

skin/Scattered/FasterNow/fast_small_animate.png

SHA256 6377083164b6c54d9248d3e32d754344a018ea1b148bcc48db05ee764d75dfdd
MD5 bd6b2c4768ac0b746ef8af614e4b413c
SHA1 1340d67642358d4b6056d8da6305dd92d9b7bff2
SHA512 828f46c8525fa90d6aec82c34563d2047bcd88dfd039117fe4095f55814821d6117e4d677d7153918e2f53bf710588daefd3e58857d3d640f687b64bc12c224b
TLSH
T10A41D789F68028E32047D69365D78017FA376D418DD0B4967D8BCC7726A44FE602DACE
MD5 SHA1 SHA512 TLSH

skin/Scattered/FasterNow/fast_small_circel.png

SHA256 6f5e5f7636b35c6abb0a08090e67bc08500d9dcf5e563f5efd55665c1f312258
MD5 96f868db8ae71cc719e67a22c5cf67d4
SHA1 8e78a88df65e41bacf6e42471fa4545080d1f0c8
SHA512 f9fcb2187e3a22a2a4e2fc16af87568a32946a18c5a0833d663b2fc8bbdae1b9a87627022d61fa26d27fe8a212399ef36542fd63a5238b4ff838d2f46d8c6f85
TLSH
T14131C78AFF805652E341C4C210F2801798268841EEF4C62A7B56D43628B14B9DDBC1C7
MD5 SHA1 SHA512 TLSH

skin/Scattered/FasterNow/memory_circle.png

SHA256 4f2377784b46e9d364beee742715933c8b14cafce686a3afafc329bb8c9d9f0d
MD5 545c338bf4de00b9c88c3bf5779505d7
SHA1 6e1e0c1b242d1ab4a215dabc4f0812f0889c7711
SHA512 8afbc30d9fc0f38e130b477195e4cc8b83569de004134ddfb4b37ed0168d8c515582c6485b450f4934c656ae2fc0ee02377c3614181a5d896806473e3c71cbef
SSDEEP 192:Amj0SI651NM1kfGYmMK2n7q+Icco+shOePhHxJJjK0x23GD:hkoykOYFnNco15ljK07D
TLSH
T198128E8CF261C04023199CF229ED4A5B6B2196D0CBD8B0C87DDFAED6026D5B7444BE9E
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/FasterNow/memory_circle_point.png

SHA256 7ed616e733f46722774a2ef6d87eb2eb0f19c4d75a8d5239b7c788cfb894cfb8
MD5 228fa83d093779a14ad288747f3f02dc
SHA1 3ee14908fa2bcc9b92c7a80f7628d9630bfdb464
SHA512 fdaa07585f844c6ab5b19cc50261dee328748bd3930875e9e0eca9f447f5bdb9a474d2cb7eeb441ddd6a46048a146907a4f5069be5074d17c12bb88d50df3a87
TLSH
T1A8410F0FA6D05D095246AED31FD7F0033712157B77F0A55C69C68B8645310AD40BF6CB
MD5 SHA1 SHA512 TLSH

skin/Scattered/GameFaster/handle.png

SHA256 531fcf8bb1fd29376de5fb37cffb6b91b96b7eddf6923716470f0257a8fd6a48
MD5 98a4cfaa9fe7108e4cf7c320b055fba8
SHA1 23a7a85da33972fd48a45b1d19d195566e0fbf1b
SHA512 294955f30722a5084f984d39db2c516cc5ac8a11582158f3afb646d03fc51fc331f85513edcf170b1b3d4a65e3610be7315b7f763a787ffc22116f13b2acfa97
TLSH
T15E717D8EA809057D114F4B5B357E9C0B8A16AF44830C2E4DAAF9C30F8A31D802D30A8B
MD5 SHA1 SHA512 TLSH

skin/Scattered/GameFaster/restore_mask.png

SHA256 0b9502c38fc3cfb11b3a10a50460c2bb919524659c068236b87254d3ed829e3f
MD5 f2854c0fea3d15b20d268a151cb3dbe1
SHA1 ae73db499c6097144663bd7d3eaaf16017b79258
SHA512 4614ac4435947096bd98d798931063eaedd12fd29562afd56661a700738f44d69d1fcf17080efc2fc4e7b2feb422ad5493a3973b0532c13cbdae2215fa465908
TLSH
T18B0141D3068445AF487F57D720676CA86E5B1AA70A2B7018A4E525396B803E255B82A8
MD5 SHA1 SHA512 TLSH

skin/Scattered/MainFrame/shadow.png

SHA256 36be3df05f86274b2999efdb2d3ecf4d634462d2cc4ee04190e66c84985d75e9
MD5 dc0ea16844dd5af1683dee33db7cc95f
SHA1 33050a5b775dd2674159c81384c9f263cee2b086
SHA512 9322559a62205aec0ad24e2c2c49fd197ec33490bcc9b29f4f96c251e686281c5dabb826464109c7ad19e5f8d4f8e1bcdb1ff959b5c76a938afe275408147b80
TLSH
T19631B584E682FA01B584A24794EED463A8098E81C9D7B97D3CCADC8314163F84A1E88F
MD5 SHA1 SHA512 TLSH

skin/Scattered/MainFrame/splash_light.png

SHA256 42e7e03117ea72e938b69191c40df7c8434089f8f7b11cd7cfea81d726b4308a
MD5 f8bdcfd1615b250ea13b9264b40198e7
SHA1 f2c9131483da97fe466ab91d2b709e4ce7109aaa
SHA512 98cc4c3231bd5cac834eef533c6dc09d407a0cb814e9e347e682628571ec8fea71180e7c36692bf0f1b2fd2475f0a03c7c40dc47e242f7cf4381f9c7a718865e
TLSH
T17D41C78BFB206094500AA99624F6E036E522D98259C0FD25BFEFCC28CCB067759650DB
MD5 SHA1 SHA512 TLSH

skin/Scattered/MainFrame/tool_box.png

SHA256 4bcc0778d5cd25e6f1385498f069fd63ff927f6aff545da3e110503207cb8cc9
MD5 f4739327e28bcf8f19a9d8892963952d
SHA1 17bbe9727831d4da12c3a270084808c2c460eada
SHA512 b8375a39b1bd3b7903c49268765a78f83b9b65bd7ef21a0c6bc9fcd3970bc8a840488180be562eda04ebfe838a02feff5883e026c72e30d887a675a9a28c29b2
TLSH
T15811324AF9406C429F48D5A224E6B4639A239CC0C7D0F47E79CFC89A0C712F6DA6D4D7
MD5 SHA1 SHA512 TLSH

skin/Scattered/NetworkSpeedTester/bk_downloading.png

SHA256 a2efc66d229a20452c151a95d105b789d840cbd6ffe1e5f3b6f15e2ff015f3d3
MD5 bffe6f039c87caef70a65adcd9d1defb
SHA1 8d7ddc41e87423bfc788a472aed766b34e446269
SHA512 63e1dd3e3efe5c56761f8c34891e12558eec6abae2e18f7d62a8e50cc5bad3d7385aea5f34f4f4a059bb316f664a659a2d3464c672ec03ded9979a49c960c594
TLSH
T18251E7EAA60024BB6678AA5520FC8579DB0F48C0BB987DD7798DC436CD2A1E94C5C1CF
MD5 SHA1 SHA512 TLSH

skin/Scattered/NetworkSpeedTester/bk_uploading.png

SHA256 0b3e6abdbd1a4f940b2c2f158650bf8a079fde6a4f3309d8c0c9ff750b891237
MD5 e4579ac4b5da98b25486ee5a8743b07b
SHA1 28565f473d70c1c5bedcdf5e54b55bbb5eb62bca
SHA512 fd83d4bf7adbc003ec5cc8822d9fb9e249d55670920c625a87ee726f783c0828c9c7af73eeec517589719501d6db9bf9e7fe132d9363e6d5cd390afb0a3032a8
TLSH
T14051D80AA5089903022A79C324ECC41BDD0B8CE26FB87ED7F58AC02AC5740E4559F7EB
MD5 SHA1 SHA512 TLSH

skin/Scattered/NetworkSpeedTester/clock_hand.png

SHA256 586e546dd36ead42634dd0da1acda3f613e965d343c16e23521bab0e92a11643
MD5 1aca51c785e1968cb7dd75c8c992ada8
SHA1 5bcc2dc39156057f2ba226ccddcf419e1db06960
SHA512 eb38172a2ade76b4ecf20b6e9807b960aa5f980bd205d613631e827464d06b825dc73347b597633687cd505370cdda66744ab0517494b0ec7ef1c2647b8fcf3b
TLSH
T1A8816B4744510399090A0BAA327EDC065A17DF90978E1E1CAEFF836E9910D107D38B67
MD5 SHA1 SHA512 TLSH

skin/Scattered/NetworkSpeedTester/connect_circle.png

SHA256 5471a69f6d79a5c577214334775c497c64cfc568c4055cefb286e8d7af4f379d
MD5 07027163e07dc7f0fb96e455aa69dda6
SHA1 81956a613a15e5f63a7192dbafb80d5e8f466c2b
SHA512 a705857b395d3f1aec1861741c3771a11f4d3f571ed308f063d2a7c37cfad86b669910d4b23940dff67a147cbbfa90a914b7aa64eb834290317a9bcb74310de1
SSDEEP 96:ZsSMllcHitlIxv9vk7C1+I4wWHLihk/xbrWoaspzHwtUvXC0TWAxr57C9Ie:ZsSHIIHUCD4waZWoaYHwqK0TWA55GD
TLSH
T1D0C1AE881C854C1604CD957F7C77A413C5AF3B84A1885D8C4AD9E33FC23AC2A7A3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/download_circle.png

SHA256 9d795c71281459c37e67cf01e0944e2b4ee5c1e8de967371f0d481e1d74cb346
MD5 5f902280a974da5d9b98cf465c8fe091
SHA1 40f719044e0a23bf11eec86e54463cba58c33149
SHA512 295cd4bd71683bf74557162076181822057bd654fd69e711c46ffcca3ebf7dcab9347c9b2641280502a7672ce68c6887667b4f45557eba0478c5facaa3f6b834
SSDEEP 384:S+Tp+bSytyhYFJdaT3qCnGcpd1rhLzaOszobXp1cnADvV+8E83MJqzbfon/lvP6d:S+p4SczJK60Gwrk8DpGnADNGn4zbgnte
TLSH
T167B2D02081243156CDC875E727D680FE16CFF483C950B62AF07BA4BA85B99E3810F1E6
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/download_light.png

SHA256 66d3919e37bd04c5b3f99a2c2a3652519e5773fcc06f00e0471fefa5a4df227f
MD5 018bcf92bdeba576594d07665be31233
SHA1 1bf99062a56cda7e5cf0d7a28ad8296560e521a2
SHA512 8d23d83b91fe33f2327638bdbfb368b5630bd6be4b5ccaab84aa5653a2e84c46012033ba4e1dd8c603843b9f06b4f6b42768251190da3d854296b5b468aa08ea
TLSH
T11F111F4EEC4CD883A26DA89625F1C037D91709C0BDE0E1DAF8C9C44EC9283BA44181EB
MD5 SHA1 SHA512 TLSH

skin/Scattered/NetworkSpeedTester/map_BR.png

SHA256 00dcfa74884dd1066de4900b35eb2d101accad851ef0f00294b27631cf1c7a69
MD5 92ab9d53ea1831bf8896247d2413c79d
SHA1 2a02783947dae953ecdc6c30c635235ced19f301
SHA512 32ed2fab850b7789f260fc15367cc83d87a64144bc574169ba5d75058b386707af2d89a63447ed59cbd3da57e5379a113d9d5939c1d2282fab5fb2bbc48600ed
SSDEEP 6144:zCSI+MQIBdXffjeAw/iMWubvSE4skG13HnQorhA3YKoiSmIag9EoLcU7VVrC:zCSvu9NIwm57kGJHQoWS/g0VVrC
TLSH
T1FC6423186471CDE9CFD97B7385C246182BACD542DA943E1B427AAE70432707D8AE3EDC
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/map_EG.png

SHA256 0ebf76448a709095a6e96f5342584bdead15702bf52f0e75f665b94710b6d54c
MD5 36773233dfa07b6255bd08ba810ca9af
SHA1 055fbc624787ff923e2cfa5055159127d4654c65
SHA512 fe7eda135eccece89ca4ee7f8744bcb04ebcae757aa6063082652352dd3dcfce819f7a0087c14195461317e14ec0196f041e4eab43cd1e74920405dd3d48431f
SSDEEP 12288:HPW72cEVOi1hx/LeXb4tNj6PtZPNvYoba31WrD8Hd2dbcUPnO6LT7RCYPFuqQOz9:vknEVOOxTKtZVTAwH8gdPPn74Y487kY
TLSH
T1BE15337E7B359A338BA06939EFBD3F483D51AE8F7D19C1CAD604686C8994C8C760E051
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/map_ID.png

SHA256 11c7d2dc56c78da0e431bb9f06b12177882d3e439b5b8851c157bb6b63bb8120
MD5 c90353e95e926a718074d8c386e34837
SHA1 9396e1767a487103cb348a58644519d60d30d422
SHA512 c1ebec154f7e689d64887eec618e72d583fff8a0990085b412750926508aa4d363eaee8519c0078ed701901b87db882bbcc2d13189517fbab7d97725a64b3e02
SSDEEP 6144:0j78BlaMVKq+Rom7G7CaWFZIWhjDGgIo2MFlO:0/kKq+2xTWFZIWhal
TLSH
T162241337DC68ECA23813CB26CDD248A2785C247EE0CB0B5C1A7269F615D459B5EFCE64
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/map_TH.png

SHA256 aed39d2da1d512f3451f078d0028011aa4e646bd3f7b17998366832cf710d6b8
MD5 50770d6ead788c29bc5afc3697d13feb
SHA1 b1cde2c91ae945ee2403d9b4cbba539a330cc3fe
SHA512 3d1330043e8ff1c93767179957783afb8545a8c06fd404857879fd2c59575af2fe149361d27b8239e648e6c2395a24017c5c7c017431ec525b6ccdf34852ea5d
SSDEEP 6144:cQCIa3VVrIlBnTyDQ0fjTT3KVKLLc1pN0xLnoX4AIF:cQo3VVsdeDQkfDBPc1pNQMX4AIF
TLSH
T1DB34228C65439E75FA5CAF1431832456C32762B759AABBF8019632CD3F70AB9D09F231
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/upload_circle.png

SHA256 c79de23e4e38b9ed4cf86acec1269a8601aba1325d870fbd815abad1f68da59b
MD5 774939104c19b93dd87c8908201438d3
SHA1 9714cbcd2bd66d64d3fa2d101859d2827c3cb37c
SHA512 2a1994b6892411bb2a9d3846100bb948ab7c5eef1e0f4b74fa5909fa76ee316fbefd8babfb72172868df5a539aa2b111657b358b34ebcc27a18c46265ba34ab6
SSDEEP 384:Sn+e3NjE3NtJJ0xLgXzHTwTovEp5FKFOe+gvXf1hmLGoAzqQFb8NmejeKEVSgJIt:S+3/1Yovi50F5+gvXfLm6P8NBfgJIt
TLSH
T146C2E093BCAEC9DF57D79491788BA1BFBFA553216D842B71B185105B600C0DCACA63C4
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/NetworkSpeedTester/upload_light.png

SHA256 1c8fde61063484c76c75349f93cf9456123930ae9d98b3a1c5b85e26209fe733
MD5 b7c250f21ae921dc3ae77f261aff4cec
SHA1 e82249cdce865c1c9a4be9ec7c94d8d39312bb95
SHA512 a4f314c4d4d6cf2e285fc61d294c89155976ce796a0b427139ddd6598a02c5bc427ddbeed6951f6adb2b52bb9346d1747fb721af7eb3b23124054a35e4bca437
TLSH
T1B6113209E540E54F56AAA5B770F1C037D91B0CC08DE0E09AF8CAD45E49341F9885D0DB
MD5 SHA1 SHA512 TLSH

skin/Scattered/PluginHome/rocket.bskin

SHA256 c2cb4fbabaed95d13fb375212457e8bd81d0e832eff20ed21bcf3466462ee21b
MD5 f4985a0a4ffdfc29b258d2b3153f4b9d
SHA1 69da5933044824c1830c2f29f1777d9ad73c7abd
SHA512 34ddf6be6043514e9dfe60c32826c3effc667d76969b184958bfe22259cb420378ee875b33574b5a110024d9f1da09d4cc9e65bab0153bd04eb755c7eb0ba22e
SSDEEP 6144:xYYrajCK3XuYqIfrqek/NAWPOXewm8p+IGxWpHnzewApswUTg0TnW:WVeKxXEPN8VCwXwUnC
TLSH
T15B842369074E7B20F19B239173AD4F0A6A5D1F0E7A7AC274A479058A6BD8D00FD083DF
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/PluginOptimizer/img_circle.png

SHA256 e4e8ce4514f6d813fed497e7cbe3000e88092b9646cf728abed3ef1930e37bd1
MD5 2b7a05460ddd34a8d3840d4f0660978c
SHA1 9a70214db21dc7eff70b34a31c566f382af866aa
SHA512 391bb3eec00480bc39f45f247b48448d8c1c7d17437766426f782b6bf1326158c0165f29d53d6410c55c799fcc045938a052cc0e84487d4ab3519a1c563d6bf0
SSDEEP 96:pSTpqpWdqo0pRyrWadDNAh0WyQyL9j5NUy47OUnUF4v7Qic+PoQ6hMrCxwN06m8Y:pSNcFexdRtQyL9j5NUy2OUUWTVP1osSf
TLSH
T10BB17D984A0B9A0D44650C0DDCBE35619EC7FC1877A67E60BDDCE8C8E8F9245711FA32
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/WifiSharing/device_icon/Alcatel_off.png

SHA256 a830508631eb7e5cb79141342f1df37e278487279f37d00de7c041b1b098b2e5
MD5 4bc922c83bedd3c7fa22ab916f987acf
SHA1 129ba6626accfa018ce54d6675d85a779abfb899
SHA512 84df76a03d142d4f0fe1f0ebd960d1c2e216d198b57667bd2794b9b8073e4e11be942c3f820426f33fcdd35855c110b1a63205ca40308078e0092490d535e907
TLSH
T1A1F0AB9782286CE4EF50107B5A3A3C11C8784C1A6E62361F60898A1525360EAD27A365
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Alcatel_on.png

SHA256 f898af81b41a03a6fa906de4decd0ca5f145ad7b9b81bc7e8566ac6a3400dfa7
MD5 ac92b01339274dcd826da8495121a5c0
SHA1 39c3cbb2f89b996031b23f82e32c83c04523df50
SHA512 d42571fea913c0df6d32bee128bc058a446f3af39b914931f9ee9214f7d1fc57101a3bef70623594372ced215647bc8f1588fdd36758951d89408eb52841e927
TLSH
T110F07598FD385CF09BF8C6A3E6B3946C06312010831F2227E2AEEC0C45C21DC51D1647
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/BBK_off.png

SHA256 dc4a79bf2c62439c4e298367e3ed17a4b2ae7af0e92cdeffa8257b0cb0b0402c
MD5 738975f545ce71767a5939a6e80096af
SHA1 c1d01b8a9f9d18fbba9e8b2fa4013a9b766b6512
SHA512 f2c3267b745a0258e6ef2a803ac3bc9d980e2ca4e93533cf5fc29ac9adb7497245bd2ddb89b8e758be63818a729ab156fc1466993ce247623335edc643024822
TLSH
T125F0DC837B20AC389FCC1017EB387588D0FD622F2C20214AF24D4C86785A7CE02C4306
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/BBK_on.png

SHA256 998a7e4a30c845b7cb9d5a866a386589a556de098b491c88100652b6e619bfa2
MD5 5d6838133ed4de48472e4b0b8e9bd601
SHA1 2bb54752f2fc92dccfbfb2aa05fc3d5d68c031f5
SHA512 e5c7f92b6578b42609a48b1a7f44745ec4493c52c021ae47d8946832d5494b045d54ac4d1ac2991f5a496a80fab133cdfd1aefc3be1e639f8b121fd651bdfc28
TLSH
T12DF05CCA804EEEBEF7F15D115AB3C0CAA833C00A800CB00B7D0ED8292290A8CA091028
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/BlackBerry_off.png

SHA256 35754f3fb4e36d147276b4c53d29c046d0a9fe65862fdf1220865724ed4b8391
MD5 0c008d034b8f87449f7bdb30c07441e9
SHA1 aebb4039f2edea1949307575a527d322eac738bf
SHA512 9f0b385d5d6f54355e93817a124b51f24e238bf9dad74acffe113d531b3a544ee0b85e8bcfd18dd189eff958c47bcd337aa8f4172558353a1fcdc3f3d6f4ba7e
TLSH
T154F0AB53A9379E7AEB71AA9B0769B2809A52C095180387AE8004D46D5DF32D1B0C2707
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/BlackBerry_on.png

SHA256 a8ce84e781c3524972d82cd4089fba2d606064d0f2fd2d9ef6a090391b9cea33
MD5 18e57210de72f90b66db8ed936d91f43
SHA1 69f89ce422ebdd1307cab4fe3d880b5f3c83b5f1
SHA512 1a1c73d3ea7337c446b6f18e3079f74c58cb8c9607e9a7552fb75e4678c6c761c195e8ef14056e1bf7b78b599447cc3375591203507e2272e589d99617437404
TLSH
T16CE0ABA26320CDA81F8C53A6112A8D2DE9204553812EA22686A0612E41017FD6523A6E
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/DafaultPC_off.png

SHA256 ca1c9f7c3a21a1ce88f2d9cdc07cb56ca4157087ba5e26ffd08ff2b3649cd9ce
MD5 6a7a6a90cd6385b43262d70be412e06d
SHA1 830198a31a6cfe050cef936469b6e73cdba32eee
SHA512 8f26e34dca5efc866fa00e4743c3ba10f55877e4bacc9400785926d6e9b7d8011d8cc18e0f69482b26a0e03cfbf7f08b97b4904fdf173294fd70f80f8bcd7134
TLSH
T1DDE0C0D141214D6F861F8C1E42267092CA244CD24802B20B653442E6A9701F8C08475B
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/DafaultPC_on.png

SHA256 09b2b4c9e509f03721e3b4e59463dbb9fcc49e931d2802b61a4f78d694ffc9e3
MD5 50155be418dda50aa4277693e53608cd
SHA1 03e5361dff5877e4c12cd74a2906316fb761a3c7
SHA512 b65ff655413d89cbad5e3aa2568e537bcba3b9a27003db80a084024a0de793d45451b312b5203e034f9774df0f85db4445ffc5b6d9a33cbef908fd448e55ce3d
TLSH
T1DBE0C0C1023E0DB6CBB7021B83278587560F33F55235D90AB1050C788A77DE944B884E
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/DafaultPhone_off.png

SHA256 0122f95ae55e39764a130894cb6c3f77af3430355ccbfe2faca0c1092d1d76c3
MD5 422bda5ce5b155c7c94f26210ff258d5
SHA1 6acfd9bc4ba49ef73022bc75cfb478888c03bcf0
SHA512 6fcfb383033afd536501121df7c051ebc57b924a5e30567480ed285c1b454297fba553f44bb5676691bfc36421ab6972714e1043ff76a2c818d636b7d93afb81
TLSH
T18EE068DA985199B6ABDC913B9238F0C2763506215B1B50670208C2404BA02C122C2733
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/DafaultPhone_on.png

SHA256 5942411f60a3d0467070be7cf9709e057af0d16912049272503ec27d630d0592
MD5 cd36a02e4bd253d688c346523f379543
SHA1 72213fc2672bb0270137fdab5689dd9c7d6ac886
SHA512 404484c1e5c180b166d57d2d8593988ea655468124299e7a50f9449bb654fa3b53aae59b8082bfc0e532c9d79bd5138e1d9340c684b8029abed81008085a28c1
TLSH
T142E0C0F3AD9F2470FF3208675F10D746F35CB0D80566D5CAA7880D206A716854AE0BB8
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Gionee_off.png

SHA256 5e3e1a0259a4e30037f467697b5a866c03e09b954ef84e9213eb40b39aae583a
MD5 13ab891ec0537694847cb3537300ce58
SHA1 c28bdf040d9c19939ea71edd03d1086c7dae24f9
SHA512 79ac7c8732faa5ff0990423fda65a98d4319b04ccd8ff9e730c839971176c57af0e8c9ef936b11b63ea43b8a5881436305bd8f96477bf7066d5d063428cc0672
TLSH
T1D1F0C08BA685C4DC2F5C1A26059AF58EAB24174419D0E83BF14D406B7D722F44AACF46
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Gionee_on.png

SHA256 97b695433258f9e3f4d7fcb1feff4bb27083685829ab8157063da84fc7079543
MD5 0a884ce6f0151963df2a7407d85115cf
SHA1 9f33e1935e1e66958bc12697940c629d3779487b
SHA512 dcad9bb611435ed69ce79f09b436fbf02262305a02b48923a380f8d9ef92b0589a34ef63bb522b79b785ca99e5e5f9db97f02ff678910564154fbf707f572b11
TLSH
T104F0415EE31C1C78C2E188A30534327D4EB41B6256C8C24A335E66195452DE894ACB76
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Google_off.png

SHA256 5d192a92d8924ec1c84a80a752d915a10220a7e48c5bb38986f5cfb91c1905bf
MD5 c3f7cbf9af1872545f057c694532899d
SHA1 be5956612fdd233a1018c1b2b24440297985b30d
SHA512 4b411897910ac4196ed01d11731ae93d7feda500d7cc779dc147100af93f008516599f19c0acef8124f916309bfbd425ac11b470dd22026497b943f56de89e04
TLSH
T1D6F0625382A73FF04B480161171174C3A7B7304A6C1E075502688DFE8291FD4265074B
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Google_on.png

SHA256 156bf970a264fa485051cad71da7ccb615ae846cb1104c1843da8795ae84a4e4
MD5 63872611dc58f3eb086e8d4a4c08b690
SHA1 1b427b8b16bd9c6faa0decf93351839dee295830
SHA512 0484f51a8a151b20aab4fcaa0544ead41385ff4fbdf9421d88ded960273059ec510fabe37e63803890d35acd84f90ad813da5f6860afc9ae5e180f0c2847b52f
TLSH
T14A0168DD78052FB583262FB2127C631B87E005BEE4721377A83511B70721E053289CF4
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/HTC_off.png

SHA256 ee0aac300f09f3061b7ce5c86a8327e8873e68e823d0e85ded8e55b8916634f5
MD5 42aa6ceb60ba56216a5ce589b371b60a
SHA1 f179b758d98df281d9215a08ced754d7ed03c229
SHA512 f09d691bc58cb838f23052c09f31590688315567f60d5d7e79adab0c34b159ec604ce4947565bb35ceab99ab83b47ae791f35772de6a51a04868691c07d8c3cb
TLSH
T136F0A397364068D9CDBC231E4375F4A246B0A1145A4367AB61854351841B4ED07D6B9B
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/HTC_on.png

SHA256 15761a4b79ecf0e9b7a9d42a042024f12b2c2a1bf8e8987380c1f8950710aeea
MD5 0309407dd372cb03b14314b6451b0ea1
SHA1 87539d162fda338ac7fe687f611872045de6937c
SHA512 2d9bd1a3250b961ea012b45f5112802cf8a5ed4555c4f6430ec585d67a5167977e80ef9680db437c1eec29f3c0d06d7ba055d30782d2eeebba0b2ee99de62ae6
TLSH
T1CCF0DCC7EB5D3EA2E7721470E7A8EAA5DA9E35EB089B03C720821C4009375A81021997
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Huawei_off.png

SHA256 4d27e17f96c6b117c06b6ac6567cff23aaab09caa9f0e92403dd3a60ad3b64b6
MD5 aa9131c110f406c4d3e174d87a58e648
SHA1 c4b9aa26a47360fea0f309e2b6ba595e28182ffb
SHA512 b666d6ebddb7439fefb491bff57eb58db94e552bf6e790d39048adbbf8bf90f486319099c8be31112bdc3c79ae41ded3631fe7131aeab7adcca857d892a84975
TLSH
T167F062E60AB844A1436C013242B03848F2380213D5D2EA5B4BC047790BB04C8A73C33A
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Huawei_on.png

SHA256 aef5e0050a0c0cf4c1fad84c5c133480586f32f4598d90393acbfe2028b74d47
MD5 cb3fa8fa391c50ddee82ee30b5c7832c
SHA1 f40d3b5f5f24a43587acd52d7bfb8abc5d223cfa
SHA512 2c2a5c8927f18e580853935f1db63d02645b11617fe9b7411bad54fdf09b8ab6b5d2763c870261e69c30ed7959c646263209dbf7bd836f69127d7311d3352838
TLSH
T1230183F22409DEF88B8CC277067900B2D3EB09BFE503231CA03487E2B56B8998116C6C
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/LG_off.png

SHA256 7f1fdff00258418aa74a9b28f0c519a2c75490d0a1f7334d0e962fda75f70b0f
MD5 75443e5a9e6917b0ef192b3f21060340
SHA1 2b683f6afaca0030e3b959433c49b2e7908f008a
SHA512 ce4a6887da1c7f5462050fa4270243e20a7d5daf35e87c4886449957a6a241ac55f737bdc72be1574ad1040986e0b19c6e27685d46cd1bf3771f24ff4ea0dfa1
TLSH
T1E6F0E143534E09FAA009466E8E2670257673F4193C27762F090702FB12516D6A840716
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/LG_on.png

SHA256 3f792eb873d0354b33de124f4080621763393153483655e2bd4a8f3bd3c0d16b
MD5 0eb34c7d9917b02c161af4108b668b4c
SHA1 3a9b6ff577090b2b56551bd9e09253f093e49a34
SHA512 9102557f6dbc21f53f0701be629c3dec197c2cd64a3446d978343b4cb6c9219eb699663059d8de4a5e1373be5089513cdf459710b5017126ef6d295ce53f6ff1
TLSH
T18AF00CAE252217CDF210E0FF9B1DC0AC9D30C309652D12FE48ECBD3A3A2664202895A2
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Lenovo_off.png

SHA256 950772d2bc46dccd1addc0b102223bef375cfa45264d09f2e028606a97e22f7e
MD5 07423503637ec9a79960e7fbc6f6b555
SHA1 a8f3c7f9061e9f52e19f83b4c301d80c679adda1
SHA512 487806ca40bcb9cee1c2aadc6d9ab3e8d5860a99f532aaca8909e5767086a5dd77248d9751346572f13af18711960bf383b668a01fea8931dfedae8fb947dd71
TLSH
T1A1F05482C4087FDBBE9638A9C6E9B024B5E1D011D820360D1007F7BB567D8C4C0BD702
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Lenovo_on.png

SHA256 3f4773e3d09e5f7de7e1eaaa80a02c06e8a687c0f60805594c46847eea4f8fb4
MD5 b2dd3f1f8007df80b8876c9c35c0094a
SHA1 77fe861052d4c8c639c5f237d556e0a6dc815af2
SHA512 2d80e25336c2777e13074d22735a591df0d9975fd6e5472c9217b7761b92c03e55d38edc4d0085717bee0fcbc54a7970986021792d17e7acab30fe4dec8b7fa2
TLSH
T12FF0E1DB5F7888E4CE196C5F02172280AD203C55807E5B57054C51B81CE50C787F8D37
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/MEIZU_off.png

SHA256 af029105a72615c50afe2ce04566aacb4e929acb052fb4085e90136482dcc8ad
MD5 e8e97446c6fa27bded166b110e9764e6
SHA1 27dd3db8579d16b793b7309ce60ca151d9694a1f
SHA512 54e3c29901cc45b097fd550328a3cb17192fad0ad040063304279e90760f3fa7f32954837aadd0ff78717c3f04de74faacc5a7e4de612e11f33b62a67b184500
TLSH
T194E0C0C65110BC275734024A016C78DBDF050C08F86A61D5A6C10023A70BBF44CD7306
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/MEIZU_on.png

SHA256 0edab535e391f817c8e6c4eac5a59104d8eaf4f4c2555781a634fd36079e368b
MD5 0386514e35d08395b100ef7fbf5d47fc
SHA1 b3852936f2ff5bb8af5b5dc405744662276c7172
SHA512 1b097ec321818222bbc1a7ea717508493662bea6d377be4c886b6a35948248e8ef02652bedaf2d747fb93c0e53552e3b111e8800a5f38d6c46c3a3521793d480
TLSH
T1AFE0C081F461BD9CC31121E60B204011AF33C02A186203E622428D5629593C2E0F6023
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Microsoft_off.png

SHA256 f53264bd8d4dad507167de736094cf04c9893490f9aea2d8ab3edeecd2b12c47
MD5 74b4a1bc3b2fae9b715add1a937cd7cf
SHA1 316e75b2067d7da266a8ef2029e2523ae847142d
SHA512 4315925f6ed81abcea59333adb8c6cb112780987084fc63e0ec6085487b40107524a690fec5358e75b58770fd79e804bb555fde53210b7ad5d4288510f6a04f1
TLSH
T1BEE07DC3F3606C53866145BA9AB9FD693C1947FD3E136201910B8262D60B9C5D4707C3
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Microsoft_on.png

SHA256 20d9d3a966581bc5d1c90ac56c09e966f7f3f1991083d2e1b642ad1dc5a7b0c9
MD5 d6b6e3c2defd846f3f7012cee649b7f0
SHA1 6555b9826d39e3f438fef78fd4173b552b86693e
SHA512 fb9e3397b3fa48016bccf30dbfcbae9f6d32ad0a476bad3fed8d65432a366be4f5638afbaf77b13d1401bc8b59e16914e4d2af50c9cde80a5ee442b18ec458ce
TLSH
T18BE07DB34FC15EF8C780423B012C14E16770B22181DC53DFC4564E1B581157395B0062
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Motorola_off.png

SHA256 671d39fe1a70a11ae3f35240672b5ac28723a52c2cb2a3eae484e9fb3524a86e
MD5 57f8c7f5e20b42bbc1d18850e96cac4f
SHA1 d41506991350d7b2ab2a25ca67b4aa45efd3402a
SHA512 27c0af3a5d7f85f3ea0f1db0bda435ff89cbc1fdf8d9e6c713fb43134db65a3ffd1ae8e9cff191d10b91d42cd3c7e681b9bcbf70a0abf31fda5aa50fb5e8a2e6
TLSH
T188F00ED242A0DE78BE9C287308A2F5AAEA10DC3D8A65801E68406139033DDE5EBC4363
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Motorola_on.png

SHA256 93301b0a3264312c57114db607e6813076a51a5b79b5390d804697066a0f7922
MD5 92ecdf263af03c26d54cad500706f861
SHA1 fa1fc49c8cdfe62abb14db01c50c04febedf1b5c
SHA512 5c411c8eaecefa068561d2f8dc51abc8c23fbf72c31888eef7c2526ce9072985f091397586b24dd911965eec79d399e5a84ae6da9ee3e9fb18a130f9c707d324
TLSH
T108F08149321088717677F3293E156441A6911664D8275E1786549C0A4AB628AD9F1F1D
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/NEC_off.png

SHA256 5109d572ecefe2d7f72b8df95c82a9974a55001fe78770dcf0825c4f5d0cfe8f
MD5 8b1a490bbbab1c1df4da533c26d4bd00
SHA1 f50a8aab5b89ba0d63dfff6506ef150f958a64c7
SHA512 9805f1ac22ecbb2c139e271c16bbd53ea3865450bb5d5af83cce7caca2832539853220df63e8f62dffc332d55aaa67354ded83e9b54238ddf80cc0c6ece3120b
TLSH
T154F0F1A72307C5B64BBF4C1B8A3AF105F7B9554F5B0A70AE2245491A74360D7488CB58
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/NEC_on.png

SHA256 2fbe078c702367a16f836bbc1139cb69607838df4cb60bb1e0703b89cd995f52
MD5 05e3bd38ee40da6c15aaaff7612f0ec6
SHA1 9c1a3294035e43110803d4264c610550a7ed1e98
SHA512 baa6f713cf4c20e7591165d459052d3e9762b191c1ef1e3c086cbc76c31c1f4f2f7ce343212010c02d1b62ac1e4f8dcc8c49b63a9c4bb2160582e94f8de6464a
TLSH
T1C7F02389C2B1BA1866C91D7B132A0B236571303434C96D9B31AA0078710528C281FA28
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Nokia_off.png

SHA256 56908542dd393009da101c6a33f795c20d9b68fdbb0ca38cbdd6dd3270ea666a
MD5 41be1827866ee0d3542b60a033701b5d
SHA1 19836cd9d7cbbe75e39baac46ecc6e8170ba8eb7
SHA512 1464a5408aa6b5117d8f7609cc2cabc65eaf182278eff72707fc289af0a38287b9bf5580b4731bbe6e2adb16438de02f2a75a305ac3c6f4a7f2beba3f106ff87
TLSH
T1E8F0DC910721843997B7B27143273383BB268269A982F7AE125182222EA02E98B00B02
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Nokia_on.png

SHA256 532c76807eaa6ead8f22d207c47597c527be11d264788aae3144cf9344e9f112
MD5 7de6bc607cf724f3224eb93856daf635
SHA1 ea433a2f31d5e0071f17460681932770a4c366ed
SHA512 ca87eb12c63c36531bc647f30f9648d0227bbfb4c90a56b85ee757e087a7db818de605c85c63f28e031fe71122b4050440810a165707e9f3353b937c85caa977
TLSH
T190F00EE61632CD71DB120B3E4E2081C5F7F553C5057918133A291430EE1605AC069705
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/OPPO_off.png

SHA256 884e6c97edaeb064f17235a8f4430db05ea821eb80d925f6aad584c33d28ad7a
MD5 4f3000577dcbd666692d97146af66d6c
SHA1 5fa2eca73b43e41943e873d8ab4e8367fe541f92
SHA512 a59bceaee94b1ff91361a50143785e12e13edcc8b59d01689e3b2dea07df9dbca442878dec2449ff4e29ec11475f0131c1bda331bd656169454247dfaf5c8add
TLSH
T15CF0ABA264129E65E7B3011A032DB1B0BDF715138F54B26A541DC93C2B332F951B632A
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/OPPO_on.png

SHA256 fe42273d43a398a600049c962d9a162e7523e5ce30e1f22ccac11ba070fd5fec
MD5 0fd2ee7aadacac4af630cb9003c19a83
SHA1 d56da49ac4d40a3e22a15284e1abeadc0844c6f4
SHA512 89438badbc98425999f02cc3eb1497b18260c310f12f5f65db9034d8d7a543a18d3bfa1b732fee9c2bdfc64ca9d830ff3eaf1a51f0da69dae6b0ecbc3f81856a
TLSH
T165F0AB4B061FACC49EB271653674821CB2AD3CEF411541A420877DA379364AD047214F
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Palm_off.png

SHA256 8569d454abee9e4a9ecd363ff8f69604c973bceb519aebc95bb0dbf0d8f81cd5
MD5 dda82d6da66677df34895589fe2a647f
SHA1 513b541b642478b8280d565fcc0e6ad3b396c0fc
SHA512 abfbbfad20031ea791705e1780dfaceb687f43bd7c95bef80f2bf4a32cef9c504d0760c107dac40046a0f32b9fc6ecd05b844e32bec24a53588e780597af2831
TLSH
T1ADF0F1DFB3E0AC6F971532290A22FF43EE3380BE2C5E500D01631812A6157C71568FC2
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Palm_on.png

SHA256 bef95d289f44bebcbdc8f157bfd406ec5e528293787805557a3eabb9614bb30d
MD5 de34e1645443fed03757e83b1347a0a6
SHA1 f42c254750177eee76293a5a69c44cafe74a151e
SHA512 ec104fe4ffe0a61bd2b9ae3305887e898fb3ab7435105f3dfa5ee9d3bd3156286efc9c774bd8c0f3be6779c2568c1f51d3175331f50b8736481ddc10d0ff57f1
TLSH
T1DEF02BE3602EBE3887F65E324355C573AE86C24B410C730D534EE5A6902B29841C29E8
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Philips_off.png

SHA256 a25efb54f3f9486500b6dd0ad94e41ca6ac333ba1e5f17dae40d8f3f3d4e9049
MD5 37a22520999b3d72c0f075cb6f43e6a7
SHA1 2b7caa7e4c45542a2e778da3afe4fd1e1beac379
SHA512 03946e5131e953f0a2c011d1869a56dc2e078882ed6fea6416bbf961a520c9194a19a662ce670168d6725a507de8f463b436708d9d3881876aaa05250d403c69
TLSH
T17AF0ABE7A0516CADCB626B2C8BA8B0426961EA2E1C2332C51B8D28B150114E8029C322
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Philips_on.png

SHA256 ea861f2d1502c34d1fdd7fb9783dcbed639af405f0ae61677fd48f728e1ba8b3
MD5 1c380ea1d4d65762aad48e3d8bcd2f9a
SHA1 d6e173c946b1c180ae5c015474ed253e2042a2fd
SHA512 b4746530612ce444f27c40b8fcfa33cd565a6efa7835e363494eaf9c62ce6be3e0ef24759915f5e5b11811a5928f6a6019939a0f3e4cc6f1f340a1de52ed4740
TLSH
T1AEF0F173AE75ACB5C2F55B330724F561AD01ED4121720709018A841F9B574FCA1F4EF6
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/SHARP_off.png

SHA256 ad56fc64c9a0d48fbc0ee06527d7fec16880a5af6f1cf32451262adfaa4ec6c8
MD5 fb9407d0fb82a1179da3c3c749ace874
SHA1 8d22ae6729b054fc539f5af14618b2075c607571
SHA512 e0d0f327efd0fdd84b143637badce0029dbb7967ece23c8888cef8ea727f1b273a5a9519c9d3bbce4bb228adc4b4add33ab0b6dc8f4acc8ea56dda21ad0ab1b1
TLSH
T1FEF05483B3724EF4E68598640622380DB021F66E6EEA7206464FC4ABA0110C445A4334
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/SHARP_on.png

SHA256 57008fb345b52922dbeddf8bb2f463d2abe813fe242bff7df0bcb3cba5b56b99
MD5 36b2819dd44d5a31492c46d9a4b2f02b
SHA1 23da52514be36f31124033baa008b7099d4326af
SHA512 f8d6c74c2dba8105d566e9253a4aea4b0d61c3c7a7f7dbaadd34f913110245c61fb35a78a8509417e32b04eb4df65fdbc892b8e95beb861389a9f04087705930
TLSH
T186F020B32912D3DA9786493B35E48C34AE25BF2F4FA3CE939542AC1E2208564CF4431C
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/SONY_off.png

SHA256 5a58f36ef7e41ede288c4f31626cabe1b8ee81aaf362c2f471e4ff776c8d5e01
MD5 f169b847d346ed23c95b97b34b5c8607
SHA1 c80204ac21724b85a5fbdc266fe1c078ae619c7c
SHA512 e59f8f52bb76f55fb0342c70ad06f8726195523861c4d51820c836525387ab769c02216137743d4b0091417a4c8c806dfaadb0a3ff88e7120cf9ca5f8fe027b1
TLSH
T10FF0205E4D0D82B0EBF92207C75BF6875BA70A805E8D6008FB5E543965363C2A35CB83
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/SONY_on.png

SHA256 e244ad8832c44eb4b90cde8f6d58afd37f0d861fad69f32382f768186f2f05c1
MD5 2d757298f0ab48bbf9fea95316dae9a4
SHA1 3c0c45738e3f858d43ae7fe218aa5798c51ea426
SHA512 4c05ed6bb3121e752e1213a5650ed867938284b5e0c9445ffa2804ab71c7417aae07213fe5db1641662031b6fd8c36e180cc3db5930c069323441213660e58df
TLSH
T15AF0E1DD716EF9A56A53521F65278092CA5001111FD18711CD7F93F34502BF630469EA
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Samsung_off.png

SHA256 c597bfc06b93ed4f3cf93f905b5505351aa627ffa053336fa28dc7598dcb550c
MD5 b93702c5f9e817615f337d0dc51c864e
SHA1 8d98a8702046b84ccb2e536fc5fa2d8972bfb992
SHA512 0a1e1877370882005e1c64709f6e01ac90d2e90be5a099c136bbb979bfb71f70910e6acc753789384832f5ad8d028aedfca757d05f6b952ee1ee128fe0e3e5d3
TLSH
T1EBF020674F0C9C07EB7875A6021DF713D3A4102647D49A06F449AB8940C33C021C53B3
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Samsung_on.png

SHA256 9d3640bab6f977fe7b8947e1b05ca30027ab0057dd1c6550fa171f625a15348a
MD5 ab6b4cf018a41775b59dd97855edefd3
SHA1 b5c87f49d85eb0e2396ea02812f2e9f81afc1fda
SHA512 74ef1549625d67cf9bbc8da6b2bc951ddb47f87a1171fff545625718411b4ebcf5f3e55953ac03e130527f0669f0d5ef360c7f5c12699f949b8f4100d8f21277
TLSH
T110F041AD00EF58345224983E4AE742202A2CD0092DE66227DA8D84D06AD3853F5C0771
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/SonyEric_off.png

SHA256 f7a37d928378e7a14cb1e345375b9bed6eb76f2f5500626c01ff99657538ed2e
MD5 6f1fea6378cc09dbc4cd379ad258d037
SHA1 f4ecc5cfd339c2e532fad7d266b514ba07632e6a
SHA512 9223e12183107dc8acf63b3bb7270dc7421ab037fde99912ecc9b43a88b89cfffacf088de69ebb181dd5724f126c8408fe99532dd9caf746624d3e382327d956
TLSH
T13CF041A679FD8FD4C3CA093CC3BAF18C92A0D1B2164C51C7786792B600823DD0446396
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/SonyEric_on.png

SHA256 6b342abda6d02fe11ff060e259f143755b77e9fae54145b8ff001c1231660326
MD5 eb3a7bfceea73694b78b9587bb09900e
SHA1 bea62d9d735f6f32445be0343718ab7ca73aa3c7
SHA512 76f823a550cbd83558e8e006fb3ba851d677a797fbbbcc126d32bd3e220b5282a5fa0e2e85a8529e2103e3ef7f5c2d70692ec8d8d9a4a916bb6fc8f6b6e46a88
TLSH
T1540162E76632CC38E5C530131C7ABB5684B0389703D8A01A6BC04A4E0F0632CF4CFB90
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/TCL_off.png

SHA256 a29517c4901ee7116757e4dcc95b25690ab0299c0ad60e862c5fca991ed0d5d8
MD5 05547cf3604359d3a055a03ffdfdbcaf
SHA1 a72f45b1736c7611c878b9427581e9296019de45
SHA512 1e33bdf89b16d3b272e7fbb0406e4259db6ac57a7c3185f4f1196bf518a20d8f2a94e39fe61f69b18332f8308fc6fd3e80fdc3b83389ed2b31d9a28b6fe563d4
TLSH
T107F0F15339D540FCE3E3543410E5B60ACA74423C3E0A760A6000613880DB0C2E388715
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/TCL_on.png

SHA256 27802dc8197c7a41ffd104ee0b24db812359b8e625f5e86ab537cb936f06c38d
MD5 69ec017e3e6bb5ef5a70ba92e597528e
SHA1 c4479eff22b32c3c044210249d67eb0882de52ec
SHA512 b5e0ba3266239aac77e82b17ef7671b52c9805253cf40b00ff889a7e126c4c30a13b9e4329e3a9f6e495de50711d373462682f3551ab19a75a9e33eae266f531
TLSH
T1F1F0D4B66CF85E843F730D7706E1708FCF4221097C08910765549D94D53612FAB4523C
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Xiaomi_off.png

SHA256 9c9ec8da0a8e6d84e9f408098217d80fe2b0117108ddacbdb36012503b916816
MD5 f62506a8e32182d98a4b60598a1fbed2
SHA1 06c820d147a5c748d2769c4445ae8a1aff061b73
SHA512 c72cfba735686ed72284453375d9905a8a6bb89c41fc014e85c32e2957d50fc7940ddb152a3af4da0c1d6927c02cef65305c8a48b40cd38e04d046021519fb66
TLSH
T194E0C0D755919DF4FF261213474DFC403F71585639C1BA0B0A7692302D100CA55A0B96
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Xiaomi_on.png

SHA256 00a5e58c3e06cfa3a2e8be3409dcce138638d5c234a594f1f7b198e81ef8a5a0
MD5 59256494db3465eb417d641c6d499ca8
SHA1 6911e16ff3a7c69bd365b30372589cd769e4ef05
SHA512 a86f775e49ffe0734c6395d31a28d3ba453d4272580be2c870abd0587eb3ae4625257df3b30184ae8ce76526f2e57ad127b193080454d8bce6b62021cf1ae93c
TLSH
T16CE0C0870A2C58718B96836A77248615DD32BD067F827B6E9398C0E287720D68013BFE
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Yulong_off.png

SHA256 09ae187e86dff33fc15ecc4fdd67a81ecf2507935f7c507b089a0f19cc9a37ad
MD5 374a0aa966186a8cab71b8bf3c476ff9
SHA1 d0674b8a92074ffca07c0d0f1002ce4c68aa156a
SHA512 24683c0052233089f9bc9edf9998487e31c7198074a1c3eaeeadac24c73a29dac27007c9cc82056e1a366ebed73f36761f4c26889507e7745cb0ec4dcae82f40
TLSH
T11AF0209E08456C3A9B26BB2E83E074B87652A100A549B20397D18622A86A0C1C6033EA
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/Yulong_on.png

SHA256 cd98ca8ca1a14335ff3b24d75411046ca8da9b65ca7676772659711634d1660e
MD5 868371b5a154b235fa8be4f55231307c
SHA1 9e6784033d8a510194098a540665bd3824ce68d9
SHA512 bf05132001d6edaf24ee211b70af1ae626d48654586b0da12cf2d5f1f13cdf1d82cc6d8447d68a81863e2e7990efd357d5dcc289a5b04627f12fed329218d106
TLSH
T1DBF0419BF2236FFFF3A430B8020252980B22996621302A39075C251A888C60DC9C0A2D
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/ZTE_off.png

SHA256 34af71d49e8d811df67c99643274800e2b9632aef6a499238005486fcf5ce7ce
MD5 2f39164d0875362684fcfbc394a93a5e
SHA1 9353751023c4c316aed8acb150a452b7b6219276
SHA512 8e2dfc032975e8c5e84ef54f4dc37c4cd6b9f45a969e444d727866bf5d965d4a4df26923c018ebd0522b877efd4eb1c4634126ccb5433329e697a92b0d7c59f8
TLSH
T15CF0A3EF42509F398775055F2662F29EAE359063D65DA2166711281201200D19884794
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/ZTE_on.png

SHA256 fea5b2a451a119867bf448aa7e81aecafe4221b7906a41f075af01d7c41a752c
MD5 69cc9c2838aa3c5dc73714fa9a3af09d
SHA1 2172105bbe0c448ccc6debfda4a303d0362e6271
SHA512 374d2915038be4d626839a9bb34eb6c44bcb2108031bd9a4423abe8c327c30b64867f4bad1266e6f4f0647b8cd30a85573ff054b6fdb925829c5fef990584f4f
TLSH
T18BF0DC6BEA1CBF44CE18126E13B480CA90C220749659C02622752BBB473B5C64028315
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/apple_off.png

SHA256 ce9fb8edf753d84ce9a6df2bd93d685ba42aeeef020227c8e4257de42dc9dde3
MD5 dc62c33af7595de535b301c5b7d4a8c3
SHA1 e95568cbae6ba4a57beb5a784688fac512ac343e
SHA512 b995163960da10dbec696a16021b6178d1f95cc91bda1cb83defe9b4988d784a419d7a7c0ccbb124bffec3f57b7d5fd9ae34cf7003ba111a25cb52cb58ec0d28
TLSH
T1A4F00E9BB3015EB8A3A04064D34CF96D6938A1690D06A34014F8B91188631C810F93E7
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/device_icon/apple_on.png

SHA256 7e6304804ad3aac101a6e7269729584914c2410e4cbcd96167a30dadd5c510e4
MD5 90b96968d9c42c3e2309b5a37e68732d
SHA1 c03aaa049c6d581bb2f298304f063bf4600c5e2f
SHA512 22d62add99205fcb70fe5f0bee6db0604b6f0614f2a94142f4eff71b256826f651e3f03c3e622a20754c1adeb4e743d11e84e19c5d1d0af1a05dd02d3ab65d50
TLSH
T14AF0C98A26251E21C66D282E0368CD9EFA3D475684CB037D0F828E62803269C91A7991
MD5 SHA1 SHA512 TLSH

skin/Scattered/WifiSharing/loading.png

SHA256 2f4aa771c9b9e693416b83c4ef6688f3409cdb935477d4895a15cc6999c51027
MD5 254d194c2da7cecc7624b1a0de57cade
SHA1 f9d8d7b5ace54c1681a6b81472de8aa54dba11bd
SHA512 c1019c3c55fef4551ac8e1d19b10a19175bce5b2487512c8329e3d04bf5e4508147bc4887eb2c8c17b30e6c507ecc66b5afdb56e6b444a26eb0b93d469e9a138
SSDEEP 96:qSK2EXN0tPGp+5BvDhhUCK+vg6vQtKC21sD2Y4F9rp2OPNNy:pEZghhUCK+Y8Qt12u2Y4Lp2Sy
TLSH
T1B3B16D04F95172037BAD549218F6007DCC421DC595E0A4EEEA45C56AFE250F41D5EAFF
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/citys.txt

SHA256 3c634ff8a0ba35ad1e73378ab5fd22fb93ae170adf3de81495ba7481336427ac
MD5 743bc435f890d1784c60ec71bd4e7b74
SHA1 20a3c2d665df2b62cbf5e5e61c979efe4466e5e0
SHA512 19b8c93705f9c04a6b4b1ced4da0e4b82f6545aab31c147eadd6c648eb1d44b037524a30fe8ae4d87f768879d5d66d325a5106eb5e7fb5f8832a3cf24855961e
SSDEEP 96:rbemOc/xYa9u/dJLcAw/ecYh8CHv0FkaTJn7tr6bYB7jRf5D+cU7VrxsYPXP82M/:nefcpYDJJVcO8skkOxMBmgXPIXxzEI
TLSH
T157222D1A65E9935254738351E2F504B36BB7780EE0BD9B1E10C213152BD1AC26C9BFEF
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/littleboy.png

SHA256 bac826dea0d886e3520019d38cb933a685c4eed9a74dfa12cbe38eea6239501e
MD5 72bf79307d4011409995f478427e2512
SHA1 80952d03fbc3d4017fa1f4dd0fac281d34596d9c
SHA512 c9c6de374eaedd20c5f2490058335f2150fb0bad8e782f038fddeb893019e6da011395b0096328eeb08d3f613aa8acdffeddd84309dabd84b36a8ab3b67230c6
SSDEEP 96:3Y2vU2zms58BLcCGaAu9bUiSqHkn7vmQdbb8gRUl49FofedwsmHSk:3U2v58MFTqH6hqxqwsmHSk
TLSH
T177C16D3AFC083B41C08ADDC10CD5948F8AF66E9285B770DBBA6542D648448E5CE397A7
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/1.png

SHA256 bde6ca8906102a507e280981cc3a9455179117e884551f2b3e1a4e04481bab7b
MD5 68c18d69099003a39463197cab4cfc8a
SHA1 8d5584eebbc2878a3bceb1c0221b38546aabe807
SHA512 918b0e9e23b9b2a78d8cc40f54d6467de574af4d964eea8df191c547a6414c82df960a90d0911bae0f71682ee6617b75cd72275c072c74a30b7f2b7db7ed4dca
SSDEEP 384:95OtVYFMFwkW5t66alLp/V576I8hTDbQVfrMPPsiA3zyeRkM36krQNS0PdAz:94tkMukRLXp6I8ZwVfrTIeR1368QJO
TLSH
T1C992D0D92D865125231EAC6116D348B8A350BB90CDE1FE9ADF2CA153CE798F5C07889B
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/10.png

SHA256 c67a19eb068462cbc557a94fda9099b121a4c4fac60b4b0529934065dfc5317f
MD5 2c3664b0fd1e0ee8b5892b7892f322bd
SHA1 62e650924b9a628e4202db31002681ebdf79132d
SHA512 40ee061c102c129f58021f4c175ffb56bb4b65a7f37ca39fba54684e15505eab7eae68815f3cfd6aee058694bceaf71f81393d2cfedfa86fb7a544c7e1ead347
SSDEEP 384:9ZDTXRB7bixWEONXMt9aYavFKwEM138CCRmgqosFe02ntt:9ZDzR1+WDMt9aYawRM13HImgqrFeft
TLSH
T1F892D090D411757E00B2C9808BE1752F6D343661CBC99C52BAD9DD8AAC3E1DE940EEE7
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/11.png

SHA256 fe75e654f8f6c2acc3bd1992357db1174870d75bbfe0094dcf4b8cd64043d339
MD5 ade1bd10e6b0f92cbcb036d3fb4ffff2
SHA1 25bc692d68c13aca884091df9362e3fb6a2d1f88
SHA512 a60f690f52231437c113ae118f015f10c6d05e7584180c0e94b69e76f879036abb65a1e44f56a07bd807b0355ba638360c86f0c5dc64d169df6de89b36bd4631
SSDEEP 384:9xHN3pFtJe0rCcAscaT8hCCkJ5emYFk3+Z3oHOHLTzHHT:9xtZFTrVAsFQhRkJ5em8k3MoGLXHT
TLSH
T1B492D00F6E4213ABD2902F50303E4567F7894611AED43BB5355CC698609AC38AE8BBDF
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/12.png

SHA256 3ae3449b5eb71020a4f91b7572de4b438406c8b73f919874cb16787bf4bd78d1
MD5 8b7d200cd5a881da2fc589228f2f37be
SHA1 a7a595b7477cfbd067ef8dc54feed37fb1b4935d
SHA512 8c7338d3f09c5936bab293b28cbe57dc58321c8f8194d4b8747274f57aafaaf732ef2965426d87c0e0a8c23535ecfa06c2d1cd6413503c421d2241332d4e688f
SSDEEP 384:9100loMnKO8haKIMzOg3yZ/JoY+S8YeD86nzzm:9jv98hTunPeg6nzzm
TLSH
T13182E1CA60C12D01D78E0CDAB0C203B274C1DF8DA9FA6D8BD6ADE45679DD407E8548CB
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/13.png

SHA256 22a0161cb1a62101005363cca7b0f1972316084048e1b7df42d9aad7bd43a7dd
MD5 a049dd98795726c479377835724a8b6d
SHA1 2da07551568daf5047457b78aaa862d5d55a6379
SHA512 2e5a65178e55792a415b9bb0604f13c9953c95493a78414d6006c24dbae18416676b65f7db84a1eaae8aeb1cd53a2f9b29c6f9510ee061ae09ed8c709243f1dc
SSDEEP 384:9BO5tkDNe+VWDbt7qPkQW2XGGWM1HcXsT3GnFGnVrrrX4ph:9w2NeR3t7rQW2XSRFSrrrq
TLSH
T17182D00E77DC1C58522E6E9015AEAC5B3D26C518D350F6A690C284CF5E7C3B6FC9172B
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/14.png

SHA256 8c91c5932428dc67c888f6fecccb9ab1d251aa7cae076fb1ee8c0dfa2fcec4bd
MD5 d5d8d38ce06be9220e93dc62391c787c
SHA1 21d3425e9d010d1f20e51226f16b06bee1c48227
SHA512 5ba32cd711febc0184bdf97ea3970d92a7fa0f08b327ca4acdf65124d152b3929a212473c1dcfcdcab8622457507ff894c5478bda7b81dadf1b507358d46abcf
SSDEEP 384:JYr9Jz6Rdn1U5HBRJh+/i2/pOg/UfsiryQ0c+lnH6eP:Jq65eW/X/pcsD7cQz
TLSH
T18F82D0D9D74D6B022253390C29D286272F44BB4442AC680DDBCC9D9CD7209F0D5D32E3
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/15.png

SHA256 bb691f4e43463806812154eba9215ca473677eec6004369de6510ccb19636711
MD5 d859f4ecc73c42bb2fee50f1043621f5
SHA1 46c3a8f02b8f5c8695811b979b4a4bfd99a09264
SHA512 897a7744675270ce7bcc076c0e9d8d15f60ecde84fd0f6437192a45a42eb1c4f7cdcbc5ab61dc1c7e04497012fd40c3e3035f92acdf2ba5c8af49eea802719ea
SSDEEP 384:9j5nP83bHGnuwX4yP1JQqjnJLDWD4ekgOLOjaDVGSe5+BQN:9dE3bHG5NKcnBqJk/0om5+BY
TLSH
T1EE72D044BEE1A152442A711333C9F6678227DEE85FD1A78D136A368D0AD1F1AE12DEC3
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/2.png

SHA256 2fe5488df7869b81f855de1ef2adae9f3b7b285f932df691e245da2f0030dc28
MD5 b5c03ee75e686558d31ba15fa3d1e545
SHA1 8ec9c5cae763574267d8c161f542652556fa9fbb
SHA512 29da3dae4165c41e7b34c788b224d1c94cc1284d06c80d7ef09ff84ec7a7c8e2ef7d3e2a5f6484ac5928be61d064e954c8ae663e3407ef9796476c1494725059
SSDEEP 384:9g/wgMKMmjtBvmreaCK+DykkU/l86914y8g9Pd1sWlcX5vYqga3eQ3/7oyoJU6Im:9XgMK7jtBel+PZ8s84r/lcXB73eA/8yq
TLSH
T1EEA2E11543646191CF88FE553F225C3366AD5B28CAE5FDD4D03A11BD29283F0CE016DB
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/3.png

SHA256 28d5554985e0429e4343bbfde96f99dba186f2759d04afd9d3d011ef612d7526
MD5 2a69956f4980bb1f482751cb82094707
SHA1 9a9b93851c269f3aba80700d843804aa13dda3d1
SHA512 4f58d57f95fbab338a565eafb68d6e6dc5f9fcf7a84b8d8e907f490d8ffb31c8c2e356fcabca5882dcaea3787a542d8c66347090ccc7ddb93446d060e6be0c57
SSDEEP 384:9Vm5krVdxeg9+yG67nnW6ecUfQpvA9Qg4n7kHb6XXY1yplpZw:9VFVf+GnnW6ec0UvA9+wYogW
TLSH
T1EFA2E16AC361D640F2ED665F34A3E9C90AE519847BC77C12CF875C9D7B5444C6C23AD0
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/4.png

SHA256 7b372d77a4bb1a278fbf4aa48bd1fb1d7916fa3a803c059e3b623cacbdd0d2ad
MD5 7aad71a347da428c77d55197b2676297
SHA1 277f49d4c1ab114c66e1bb4a9636b0a1bae8e684
SHA512 e61dee88a83093f628d635a6c6b5984763f3eef6437baf5f4c2c72d1edcd7436ce9558d0ce61f974d1c9ac8ff6641633c2a5ff4142ffffa3ffc678c458be54ec
SSDEEP 384:9ZurXPwMLN5UeEHzO+3lfacKhTUfBr+Gb010Hv2inZTUePbR:9krYMLN5UeETO6facYQqR1kuinZ3PbR
TLSH
T1EE82D056EC207003BD659AA60ACC71EF97E9063334A9B5F937BE5380DD24854CA3E5A8
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/5.png

SHA256 a19f97be7976aa64b562a7bdaa8900ec476867666fe058c3e0b4ebe422c189fc
MD5 421294c956192de201499cf0d2bcf17c
SHA1 42ba904dfeba76fcf8ffa5c4bfa52f839d884898
SHA512 fcada55a2a7c2bf5711a2498c64ada199a7c229d252597b96a8e25024ab713e8dbae6f60c82cf867b668dd8689bdf7bf6297d8bba20a9b28ddeb6b4a5123d511
SSDEEP 384:9EOL+e+LtWDQOYUMVOymlEUrVndmgJnlpAhcw4Z5ubEP8SGArra2gcSDl:9EOwUKyFUgt6cw4DO68AfaGy
TLSH
T1DF92D0A8ED95A815E45F65C2B8ED083302A30242CCA7F67D57FAF81BED34C66D734281
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/6.png

SHA256 4d36f03bd793a3238bbcfaec5b6bf27899159d8fa05c056430705796d2319aa1
MD5 a21a552c13de748afe126bf610c023a8
SHA1 0b19e0efa3929aeece985780bfa4a591d3cabbdc
SHA512 427e69cc27e0aa5053bcd7c4c2d15795829d9a18711d26a9492ef4fa90fef717e5ee67182cccba896d233c6a9f5c9fc84f310307c1e498e834691ebe37db43d7
SSDEEP 384:9YfpfVCpbrg2+SWX4VyZfwtitXqqJLqNc0xM8PxmjaLZZyLN9/:9YfGfWXUzQVqqNqpM8PZkb
TLSH
T15592D18BBE2798C49B20A41D30D9D86A40955E7C3FA0E016798DC0BF532E6BE0DC33C9
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/7.png

SHA256 5da40f0089b4459316953f072e5d33343a27bac0ad338bb4363a719ce791229d
MD5 d10a43b401626a6cf3b7812ef536d0c0
SHA1 902030ffa82926a3510e30f96027e25dc82cd983
SHA512 7bd48fc339dbf4095537150bd8f7d1abb9c654bc32433077376f5aae614257905cb31fb80c634ae1df1a729d412c71f10c7f33531d42519a7acfa1a0084cdc1a
SSDEEP 384:9rq4cC5YMbANWlQl0aa3PYI4/fX8f1N3hFsXkblhdIO7bxazZMx7Vw:9G05YMs2QlPa3PeXM3XsUb7dXxatMS
TLSH
T18B92D0E5FE40D714AF87655BC8C784E33BE2C6C61ECED41213B3E8DA3A66480D84B529
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/8.png

SHA256 6ea5fda07d803c41a05a53b2ca39ad4b4513b3779cdf817fa2d5823b6e4a9589
MD5 957f133f725f1c6ad03ebe7a31de8890
SHA1 b09e8c0f2bd5381aefc2ee065aee12c55d21bdb6
SHA512 babd0be45f4bed84ae38c084e81f41978c1013726b39a1ce9cf1e6b79cb6fde02017cebf117b514c5b8fbd01fb3ffc8d46b15475a9061cf039e3edbd96b7676c
SSDEEP 384:9TJI+f2FHDicrYnDhm+QrU4eVfYWkr5hoWvwEmRKl:96SA/EnDfKFeVw7hHJmRg
TLSH
T1FF82E1C6BD9D6F9861110D23497AE186C1A9D5CC4FA2E641EEFFE91E54421F248804F2
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/logo/system/9.png

SHA256 0e292ef8b38887c4f54b625f9dedc6804fa92db2bbd9e9a047381d7dffc3b3c7
MD5 61cf62d4cf12a2debf224f6f4b32f8f2
SHA1 fa5d0045416bbc77b9f41a85cc3739a5aee2c384
SHA512 be45fcac622dc95bcc8244bde8f1eb3d9c7b6db7de30ba0449ca7345368e282cc179f0d658cb492bbf923633f7ef6b2dcdc27772f06b117b6793f3a2ec0c9f00
SSDEEP 384:9u/iboYJNrFtOzKdz3n6K4+zK8bWIkh+FaT7yaobi50aeV57XSAUaX:9u/BWdzny+G8Qh+FaPyaii5Y5SAR
TLSH
T175A2D09CF622471390A620FF04C640A1E628CF55EC303ED563BFD554A6698F652DC9EF
MD5 SHA1 SHA512 SSDEEP TLSH

skin/Scattered/boottime/weather/big/cloud.png

SHA256 8e1d2d21034ae8fbb91de8f3b1460404b2036ddc3a63c56383a44d7ad05be3db
MD5 7f1b03d7a1e341507e68cd30180c39db
SHA1 8c8a0ec3f6afdff00f9ce231d769c33c3e6f3090
SHA512 102d058bb53ffe954f1eb9dea04339d98cc4d039da39add1dab8d25d5e922580e68ab35d6a7903f6f3aaea374ce1353194f503b824d46dfd10d6cc40527c206d
TLSH
T1B8510A4EFC906D01A2A0E1D605D21062BAE546C057E0F4DC7CCEE9EF6D392761CAE98F
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/big/cloudy.png

SHA256 06e791883e436d768b9ac9548b8d311c44925faf4f7a9555713b60984506a250
MD5 5b2942736e47599ad5f97f24a16fb88b
SHA1 3b2a999eb67546240616fd9853696db944c57774
SHA512 9611b1af33efe77b94799105263f2e370ad32af8cb91fcce09f1a558777f3382c4260cc59531e419061ed29e62fab1387d5237bff75f378aba1e2fce2faa92d1
TLSH
T16A512C5CE6905992E7CAFAB21CE16232ABF346404A70F54A74C7C02D8A3CA7358B03C3
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/big/foggy.png

SHA256 9d3a26a3a4c42f80925c2bbbf6622803d22a780934371efda54340fe9a0181b4
MD5 97b9b2f5e5bbd6ab41e1283a76d0642e
SHA1 2faf87326efbd09e3dad4db275a4201fff350865
SHA512 d59e59b60ce624a298aa985a04316d1283d0ef50e20651ea8f77c0942810a3e0bb4becea03334f33435dafc0ea68aa32bcfb9e9d3873c86f83e60930a1eece11
TLSH
T18B31B74CFD01740253E8D1862EEA843AE6D64F80C894F435F9CDCDDE8A1947685995DB
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/big/lightning.png

SHA256 435daec0b45fb9a2ef08fb09e8514f3c0e5806df0c0c2100d0f0c5c2594a992c
MD5 a39a6c4c385e439ca0b6196e8f60280e
SHA1 9f845363e79d8664a9dffb9a5b892f4970a48d9b
SHA512 9289d7f23e8ec236414bc09564bc3901f56ddd59846ed0e642a35ef04d00aae71f82613a45998cce85799ab86e802e660293fa8b143e61ad83c458be387e39d5
TLSH
T187512D5EEE01A951E354DAF23EBB5C27D696898084F4E45DF0C8808F5D242F90D899FF
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/big/rainy.png

SHA256 2ee23931766f1c4b08b2012182ca5ce11b9b89202fcaadadaffea69056ed63d4
MD5 e2e0f8090388cef35974c59a3df2de18
SHA1 7dd3f847a0e6498f9b3865c8aa2aa6f633c0c9b1
SHA512 1594c39c05ab2711f6c7fb706d700930ce1d6b45b1f2d7001fb749ef30207e3a18c0ebe9984117bfc34496f22f139e23be148af3cec02135ed16457d68a9e873
TLSH
T196512949FB61FD1563CA7A0301E2C027AEE35A846894D89750DAC46BBF700DA45BC2CB
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/big/snow.png

SHA256 2c2487e65e770842b51e1f2ccdc70d57eeffe3091c62e88941fca94b0a6cb391
MD5 cad5b5574828b376d679cbfc93dd79ed
SHA1 f7846340cc676223afc08e0b5483f613dd961eae
SHA512 ae6c9868294364070c31186267bbc5ebc0423efd71b2cbbce1b139457b6a0dc3542e637f3c3b13a82de6685e523916d049bd4450f2977ad131c4aaa4dd025e1c
TLSH
T1B751395DF9521180434CE78397F7D5A3FA27A390C8A0E4BA6ACCC42A4A703B8D59D2D7
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/big/sunny.png

SHA256 7aea6cc663deca2de23a20033604e2c30cc411fed961988e44744ef35619da3c
MD5 8c3feee2e8180dfaeb015027b6e6fb68
SHA1 1841762f580b9a815656055e43ad48a595f2d442
SHA512 2d87a305f9343347d7b31f2e6991b7c3bf789ed221deba6c387a2b5097a0aaa0869f2dbdc3b8065d14520cbbe0491d0484a84d4d7159050fbcedf3d781e56af0
TLSH
T17351E808D6052C429664CE361AD248B3C7E646D4DAF0A6F6ADDD84470B758F1E4CD4D7
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/cloud.png

SHA256 69bdd188044702995282d731881e2c940c13caaa768dd1243e6b852937400022
MD5 c86fdcc5cad69d79fd9535b8c112e452
SHA1 bd9b61a028f5eab206ebda6180b3bc6b761ad0e9
SHA512 0f951c3177c4d9a02b3239fe4b7dbfefe99eaf6fa818733a6f58c4fc1488d105c6fea979c525bf07c91719609ad9caaf3c4715b03e44831861fe61e604d324be
TLSH
T17021C80BF7406942D229F4B314FAC013DA2148908AD1D75924CBCC331C611B4F17E9DB
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/cloudy.png

SHA256 af8b7f0c5d6a98969680164658d30ec171d5bd741f33174f6e4b976420d01031
MD5 ba52f686e163d90eeed7369d99892f82
SHA1 b1e0063136c94506eb22689c275cfe53e3461079
SHA512 66a8ce93292b28a5e17b1327b17c8d9a09855cbc49cd09e040df0e0f70c059b07467be05749f1f9dfed356d044dfb971fda38d95dfc0648869377faa0038b426
TLSH
T196217846EA5048129275D07324EA84139A5149E09B90E5B2548ECC2719713FC841F5F7
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/foggy.png

SHA256 2e69fddc3ae43a0e8af4eeef9c5d933022b9007198cbc819023216c91e94789a
MD5 447f4e3dfb94fa2e728c259a2eafd49d
SHA1 e2df7fb9d940e60985c14d5afed694fbaf3f955b
SHA512 ef02d59b519987f5cffe81d21370610de7f5fda2d2934211c15af03d5026c4c8c71a364a9bc0d43091636c39b9f8d2eb85d74ad3e72dac3c0c15b7246fcf6483
TLSH
T11A21A865E2501C039166E8B3A4EED412DD669D805EC1E71520C6CC3B25602B7A6AE6EF
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/lightning.png

SHA256 295920361ee0e00c40705c04c690d674b2889a2f3ecc4429e8ec390495df2ff0
MD5 82493bc157ce86534f6d37a6b35068fd
SHA1 ceb9bf629b7e42b21af6e1cc6efe54c496658cb6
SHA512 96178a4ae812b9090d40aa402207aa14c802f8a58905254488adbc801026630371038e3648524c06c02c909cec557d098385c71b7ce97d834b4f51235117a757
TLSH
T10721C848F6813C02D206E43314EE9013DA5349509BD0D635594FCC671BE83BD897E7DA
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/rainy.png

SHA256 eec7c77cbbbbcbdb66ca848a5f25d06259d59ea1d1c0082a233b28890e8aab11
MD5 e46cf2febcdd60b9c38330ab9df47d94
SHA1 96f221697f08f7c845c3881e2d621fb641a12f03
SHA512 a598d7d78372c4b39e88f32aa17685e77ba9555c9e70e1e9f89dcb88463e644d89faaa632191f9a73e2b72846d29932ccd2c01fbb9454a289c7fa8bc7adc1e98
TLSH
T14821F345E6512C039165F57238EAC4275523898099A0E297B49EC81377942F8CDAE9FB
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/snow.png

SHA256 9e15edb7a2e41d9ba94a0ffe41b7e26aed22a844df8c7b3ab71150a0102fb990
MD5 9691d8600be0018d1c55729076916ffc
SHA1 38a68f09f68e71a84e424006d944806b5b9f888a
SHA512 fbc380032f7be65811ff94ba4093a2888641faf97cac804b6547e7b0260708f13279723240e59d04f240f83dddd758245797be48c7f4ba2cf03424f4da559293
TLSH
T1E22145C9E7802C028159E4B324EBC0179A1359C0EBC0E365658FCC3328D41F9996F5EB
MD5 SHA1 SHA512 TLSH

skin/Scattered/boottime/weather/small/sunny.png

SHA256 a6a144622d9eb0bcc4cde3546c15c6e86be859164f99b0dbd989893402790ce5
MD5 f1268bb801c32c9d7f7dd5ae95c8adb8
SHA1 a3ba8159e0097bdadc872a89cc15e15916aafa6e
SHA512 49859af46a8cdd5bd634c0b8659f9aae300bc85adc711f05ccfd5ed8ca1d422e69cc14c3a22e10bd3c36b2776e61452be1c6d6dbbc5909e7f46b8697b6967359
TLSH
T147216846F5416C43818AD4F314DE801B96234DA0EBD5F065648FCC2B56BD1F0C6994DA
MD5 SHA1 SHA512 TLSH

skin/common/common.bskin

SHA256 b328a0154ca83da60bd0fd36092dc92386a98a7dde0e0c65fbfb29d7ed9a8f72
MD5 df1fbbe79065f9b70a13665a48c4e02b
SHA1 4ed16aa352e126c40139cd48367641c05ba04dae
SHA512 38ae7750101ed06eacd624d4dc82743d39a6a50537a680c36a86f6dc813075bf4a8bebbfbb4a849f03f4dfcddb22ceb4a653d15ad5fa6f111da04cf3f84ad43d
SSDEEP 1536:Lhfo1EKZstYYz2bWcsE7xztwpj9QG7fMU:LhgHEYKLxEdztwp9L3
TLSH
T19B4301E871A51A3CB32A459AE0F5B3E3F4ADC20016A72F5603D64434EE378EFC812949
MD5 SHA1 SHA512 SSDEEP TLSH

skin/feedback/browser/lang/en/en.bskin

SHA256 a2797dcae8d02a9dd81aa57ebab80fab2e79e5121e6503a81519a0de31bad920
MD5 b25d5f69070d35bfd874bd64d28c6d1e
SHA1 9609d0861aabad7a05171068d35745a4d6bbca55
SHA512 15291b3fe224f6940151e8ec80f2d58ced0edbd0cd17725a7da6acea2ea3cf10f2f723bd0588d4d37d54d4159b7147027022d884a0f7f24a74020c0e296e42a2
TLSH
T1A0F0548F0F9C8B20F172953351AD9125A2716142C0092E2E69C1398118524C14411699
MD5 SHA1 SHA512 TLSH

skin/feedback/browser/lang/es/es.bskin

SHA256 1128c33c81ecccc94a93760b68dc11782d222f4aad3431dbc12c8c4f7a7f296c
MD5 aa19b31c5ac32e20393bf855bc14e7dc
SHA1 06ccd9d6f6118c2f633f616af423e3062f6074c9
SHA512 e8369b942d537e56215c3b508048dd85340f64bd63b7eb2b3fdb6d40b62a76fed8a2a20eca4d5b500191f85784c799581cbd980e531a4b984f4219c40bc3ab4a
TLSH
T10BF0D4060B554AF5FF8265F5D0A77427D3BC660E163906575C126C8384934C1B5FAA64
MD5 SHA1 SHA512 TLSH

skin/feedback/browser/lang/id/id.bskin

SHA256 019ad9a366a406a0fbe104a72dae3477893609c97300d6aa57765b3b04c21539
MD5 fb3fa1dcbed6ea9bfc8234725ab3fb92
SHA1 ea365240ae42370d22e8ae7a00fbbff79e72546e
SHA512 69d5992432e3af3f2494a1646fe07a0e3f8b73151fb7c840517a459fc1fae3be29fb953623ba7856d8f444c140d2dedee15e5b27e507287d91ee42c19cb8e3ad
TLSH
T11FF0DC574F8CE76AFA7106F4972B99022BBCA75A1A048A1E70622580199261AC1676E8
MD5 SHA1 SHA512 TLSH

skin/feedback/browser/lang/pt/pt.bskin

SHA256 f38b3d5a46d6d6924bec5b625f7f36c4247adbdcdf81b8dd3b776283bb85be4b
MD5 5fc97c951a197689a7cb2e38cd1af2b6
SHA1 8c7b3b306f416d023ae224e386c3fabcce012da9
SHA512 bb87365927a7a5606fdb9590391ca52f88cffee9bf511d62eba23671b7748d4dcc5737b55cbf66a528a0f064a61fdf466b30ec8a1f2ecd052718801934351643
TLSH
T1DEF07506460CAB61FC8500FB80D3A400B3DCB30941DD42374B4C34436612091D2A978C
MD5 SHA1 SHA512 TLSH

skin/feedback/browser/lang/th/th.bskin

SHA256 f5d8220c49cf64132d6b57e32857da1f8a871d9794f834169320e3a1bafbe9f7
MD5 79e5b7d1f18eb7522498521266ce61d9
SHA1 ac888303fe375f8b57e431eb92197e25189b64fc
SHA512 b1ad9bce57e1cf0868f699b7fc6144fc4dbc30bf9cc1075b5420be4b0d72f4faac72cc6919939f82bccf550d346c7e2023b1a7671cb8c1116f50a58680029af5
TLSH
T1E3F0205B870BC387E354C6FF737D33F8B712D6BA0C6AA51AC895A9C004B1162C4A7B80
MD5 SHA1 SHA512 TLSH

skin/feedback/browser/lang/zh-hk/zh-hk.bskin

SHA256 a4f0b270f4d93db81b97b62ee120270399456b2f740fbc5e034407384e1d1714
MD5 02b561257ab5b4d29093a9962c42e4f9
SHA1 f1ff3e84cd31b0e00f64e71e083bab2a099da2b0
SHA512 1a1e821eb19a2f2e345df8d3bdc3ec7227ce2790482b6a312a38dd476762d5e498381726bbd5a0da952c55a13891e1600d1f90ef9d97fc6ef18e000cec6d0236
TLSH
T190F00E460E4EC385DA60AEF1E63361210B5AE18B9436495A4A412D823C230AA44AEB9E
MD5 SHA1 SHA512 TLSH

skin/feedback/browser/main/main.bskin

SHA256 e75eaa1af8f88eee34a6062ad7468364a33ff2e63962a883022a06b0dbbac754
MD5 4bb82a909814011d0b61cbb603c110c9
SHA1 5a07224ffbcc403a070d7e4008385e0699f8eb41
SHA512 838d4b577b5bef54e0779234fdd179d91ef56ac6fbafb11be01df10d5dab07b02840aba0bea15123206573054460414e95d1b767092ba34b8a95c5d2db6db2cd
SSDEEP 3072:6sey16ve+sJlz+ruCxShO6ESrFpKlEFtDXRElC2UHcQWeya:6IPXLiVxyO6Tx0lEfDXACR8oya
TLSH
T138C312B5F092B7329F0029D751AFF5480BAB04D480B1A12F5C7DBDDA39656C438ECA97
MD5 SHA1 SHA512 SSDEEP TLSH

skin/feedback/screenshot/main/main.bskin

SHA256 7630b0f9a3bef502b043728896076c385cb3bae3bb571b82e60086048b633e39
MD5 9af928517855725a44f8d31c91ee0b1b
SHA1 ca199f8b85d4abc951675ae6f591ddf9b4f1ff67
SHA512 0724fa6961f496228d8fea8b20eb7224a517c76688025312f981db46511d618896141b13cbf4a08258e1ff5104dc776737e3fa705be9744f704e57b0af914365
SSDEEP 96:ZBX0rKgg2EFSvIldRY6xRLQsP+m9T9CXPAdr6nTo6t8RziJ86GQX9lXpHsq/:ZBX0rKqI0IdOeQVm9AirH6cie6GelHs4
TLSH
T12EC18D4A3E7185AED85DF22A63D1A483F6C413FD928840A44E834B987574DB47FA5846
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_boottime/skin_boottime.bskin

SHA256 195ae8c6ea2c7a72e1bd502bb0152b39ecf76418e32c9c15f5c40c9d71f28e9f
MD5 015bb8b7a6cb8336e90d236efc82510c
SHA1 0481b1a8221c99a91961819b5c8718f6b59733a6
SHA512 e2b91979828f690af1b1f7a989e2d2d3d737486bb23214c762cd30925edcfa6a1f1ff2729b6957f2c276c4a759f695c1b316826a8387bb465220cfc816db9ac9
SSDEEP 12288:d54HndzO78Suk5vRR9noMbetfI10LRucuMb9HVFrkXxIddYDRKsM8r:dmHn47ntvRR9/aqGRucL9HVFrkBIdd0v
TLSH
T14DE433A5E6DF3AEAB2C41F053A7E414DC71C872279BA881F01E4DF87F1871B62716249
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_crashreporter/skin_crashreporter.bskin

SHA256 e7aabeb8f72b22b31d7adaafc22ae23ac8a8981acbda0a8b7caa81ccf3d90d0a
MD5 64411b58527f5ea11a4f6d15d1cbad73
SHA1 46a3c1221b101759b74e8d0fe83d997be7762284
SHA512 5e61fe713d22f8eb6a1c8ce47262371fbbdb5c104e42a2190cb085e1dbbb050f31910386a3243b8b757057b790969ea97cd60e20e4c358e211fd831c4596132d
SSDEEP 192:XpqnsAstFQ1ZZPESc5qawe4gNiEz9dwlK79nqzH:AnsDK6SjawefNhzjb0H
TLSH
T1E602A0B162BD85B8CC9083F3BC43570D760636ECBAB041C588DE77B99209567763951D
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_default/skin_default.bskin

SHA256 8814d67dd33173c59208ade602d7c090b9d159f275fc7426bf144975be5cb25a
MD5 f672ac7908016a4463818f24ac5fff61
SHA1 6b6cf0749ae9b1026d86b25de3673871b92e7436
SHA512 4f7f964a13356ff4858ef8afe744adc1d4824b00e61b6986624fd1ccdddec15d524b63bb2963a816dee7ac0c614ab6f90135ce172fa6a06f52a8cd895db9a4bc
SSDEEP 6144:KMhg1C9nNrUegmbx0L8fQF9Q1sSfmPSZgLvjKg2eUq:EC9NnzxLiUmPSZg7jKg2e9
TLSH
T1D92422C15A4539A08CED5ACF1C0889520A8DA6D71B9431ED36AE830E0EFC9FD7934E6D
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_frame/skin_frame.bskin

SHA256 b21c1f7c68315b2bd830a1e21576c6c91bc9319a9945fda20c82258ccedd11a1
MD5 8678dec298c596ef0df39109f9ee94e2
SHA1 dcec590ddae6596487b3fc2c77accf0dd514d77d
SHA512 b13e26bcd708923caef9f74d224c5ae43bc72029e6b4fe025b91cb3d4c0ebc9be87cf9b02979af6db95be2c6ae7081f536fd31ce8cf4aecab19e69570e8d0913
SSDEEP 3072:5AZHwEM5wOjPnGp3PS3xBfyvcfoyvuEC8gebdZS/cVlGW4l4nce5T1U:5SJMOODGkWvcfZBC8JXGW4Gc8Ta
TLSH
T1CB04237A27FA2674BB02D4D90490CDD949F2AE6A98CC355FB5C328D0B600D2E51369FD
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_homepage/skin_homepage.bskin

SHA256 5373383b87b4ffa7287c7d9332812fe7f7cd86f1bdf32dfc5e16ef44e3560a29
MD5 a57a2705a0941b020da9bbf867e27016
SHA1 d2a2655924dcf670dc9e7a8ffb3628c9991d9341
SHA512 18f1384fca20dd939fbe1ffaa16bd6ced659d4a7277b51883aa37e281fe6fa7d901f5e948eb0708076aa8fd616ba2b7f9d5e1d834699bba4c728b636eefef1db
SSDEEP 192:8ALiOcAq+WJLboeCJGwc3YQD9L5UoIH4+Y7Mb654GTbkoRUiH9QVVPRlt7eJ0gey:8mwlPCzc3YRK7QGPkmJH9CVJlk6Mt6rm
TLSH
T15D72D04E1887C34E80ABBD4B5B637CD178700EEC51B18C5892538BC7A66C4090FAF85D
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_ieprotect/skin_ieprotect.bskin

SHA256 2e376741bc5a73adafb64ae20ba95482269fdc07eae3d8197125181fb4444870
MD5 38c8164ba7759fae33560b2b79cf1f5a
SHA1 0b73ad70e231850924465254dcf933c4765fe224
SHA512 f5888b38bf5ae1443a74d6f8d7eafb4aed30aa0cad0642069c4e28e6035cdbfe869415c1138253cb668ce8823bad5c22cc0878a72f8b0469030e13e79f2cd3ff
SSDEEP 384:JmwlPatl+UmI9s8edshHBbqFiZAgWPC3+81lW:u7bmiemhhboahCCu81lW
TLSH
T1A552CF04D0C7F68E54EEBF9ED387B9B8F2BDA94860099DE5C1788A83C28C118356D07D
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_junkclean/skin_junkclean.bskin

SHA256 70d81ab3d2702407aae9916c40530f3f11f322806a908ea92ab7e7ca9c306473
MD5 6c36cbe9aecfc229a7109f486252cbb2
SHA1 f36f5a4f24608989bce54a8dd518e5362b6175e0
SHA512 a64fb47524df0a21c8a9b225f109ae2edd6daa1d45899269d7095ece06d153ce3a25e881561aa292bbee1a6e486148c86964c31c422ffb4d7cf236fbfef7d4f5
SSDEEP 768:wKbcKSPIsw14nxtbx0Si7Jul6YB/MrmTbqteAapS5P+j6n:gKHswsxtVnAU6fSO8IPR
TLSH
T175D2F174E075BA7E8F89F390E0E1475E006EF3B966E9ABA0700FBD89615089315432DE
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_popup/skin_popup.bskin

SHA256 c515b0039df327d411ee68308e875440b504d589c1b2d692388fa23d3dc31c2a
MD5 46dcecae38ea8530e822105206846276
SHA1 fb994a97303c7dfd80880a287ea7a014b4bc089a
SHA512 c9e9f1dbed5ba0a5f677303b285b8d004216f51bbe23e801a3c7b3658d1ffb0c343b1543345b8c0ef3827f256d86127c1b10cf16d0ac6ed21c87a61b9060e06d
SSDEEP 3072:OctmQuufdEQL1ICd54JPMj5HeqXe+x0MGMYG6wVZJNp3o3fJ:OQmAdEQDd5QUdJMM+wVZLp+J
TLSH
T14DF312DB822F79CA101AA4DE7B71308160131A34E8D3E8FE89D9EBC3952159F7764D34
MD5 SHA1 SHA512 SSDEEP TLSH

skin/skin_webclient/skin_webclient.bskin

SHA256 4916572f785d85d3265ae7a2b53b97b0770be40e53e591d4aee798a5716690ba
MD5 b692389834a30274e3a20104f3f2d611
SHA1 fac7802208c54eb4d97839707b6d58c755e4d2a1
SHA512 655d2a9fbf93361a83034f168292d308ad08884b265b9ebb58d55dd72de752c0d510d7c7d04ba20d0c8f0bee0f8d21da5a8a2d680e27c5a5513c004e2b660b29
SSDEEP 1536:dUljmTORdxvBjor2PAct7qHgkpuVoTbf0G:dUlKTMxlK03NqHgkppr
TLSH
T13843F16C81365C6B064DA7EA34A1F3E8B145434A4CCC0B9E9B3CB6527D6AEBB513430C
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/BaiduWifiSharing/BaiduWifiSharing.bskin

SHA256 626a2f8339b25c45d4bf704851751390e3fbfdebad70ed3fcceb0df8d3898167
MD5 4ed48286ea3712b377a1b1a301b15573
SHA1 ae2ff49f932fb3c2052fe7ec97b1ebe4d49aad87
SHA512 f5d4a912264494c0c1f1a79ba9fcd116b0ca28d10c421bc0b7e22a5ac97577d1440c32bfce96843b7e892d9883c8412f3a5947bc5092ba179b08de5985488085
SSDEEP 3072:bs7zkWdl8kOivA+0kU5vzfcAOW77a5Yy6C7XjnHrxv6LpiG4tS7j2Qlw12OOvoeB:OOADQj6WC/nVIhr2AoqZI51JrUzr
TLSH
T1E03423B0129F68A0992231D4573A7F93743A6B1DC892F415A4FDA1FFE73035D2962CC6
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/DeepClean/res/res.bskin

SHA256 4ea4441b4ed34d5b3a2dad09c4d5e780159837e179f757f27ed47486fc3bf135
MD5 bfc67606f0c002a1468659b5d011de8f
SHA1 1ffc264431e0265199483f1bb81aa82bbc1c8d0c
SHA512 0ebc4f35f9e8be1d2eebdea959ff8a927cde4833aa49eb4f9dde4efdfbb8e1a3ee8b9a716dc7014320be57d46f161290938820a00fe59a3c075611668d686517
SSDEEP 6144:HNr7EhjTqz+8EA7U4RJJciIUsB1PcKOW6FaZ/V6qiSKy/L0psBAKZX3HrzrX2Dvv:dI9d1413eHYF05epsBpXXAudm
TLSH
T1A8842307D8900B65E6567F5BCDBF8948AC8C8A7BB5090D0AFB364059C021FFD29CD98B
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/DeepOptimization/res/res.bskin

SHA256 cdf48ae2f7938b22cb1de0e9e51b95c78b99de7acfa8f6c78c71479d1f0d30b9
MD5 f84fff886ba4ca98029c335170a0a7a9
SHA1 0ea4fcdbeeff12578cafd2baa8e70f0133b5032f
SHA512 b8609dca1e0a8537ead39156f53f32e44d75ea1c29b10d6098921c91a0a64ace51ebcdb5047547672dc3e969ff62be3644ba020f1d945676d23f7a1be7311d5c
SSDEEP 3072:JX9LYCjBMAOMlq7qvWr2CoDF/1GncrmJPclXmPygKCdFc:JXLjBKMerWBNG5clGygKd
TLSH
T113A3129EFE1732BBDFD8C6F4185957A5EC8031774D302A169944ADF314AD3A4AC4828F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/FasterNow/FasterNow.bskin

SHA256 3405171a505125955b0949457ab7478a09c7e686bae869d278af0b4307ca51a3
MD5 295684d770ae6bf07d67279b2c0182a2
SHA1 6fa3b94b5beee8c68be7d4f8289e6246afe81cae
SHA512 8090823bd85a31aab7f190630f3b04dc9aacc17335a04617bcd5cee987f9ea92f5ab955e6165352276e0f32be502ae7fc098fb20c129dcb5b2dc2bc7f1c8238c
SSDEEP 6144:r15SpEApro2yj7ZiukgynJaQ+0f2KwkuyG:Z5y63PZiUlYBuJ
TLSH
T19224137C43B751E8E2EB809CA6A1BD0F16B3F2860D93BA706E3696B0C0D537E5171C56
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/NSISInstall/NSISInstall.bskin

SHA256 f8ba24ddfd441e6c158ce9cdbd67609a8896be33349b3b72232c0c6f9020b2c8
MD5 7af1c3b56c1b7bd4df188ed855e18d08
SHA1 825540532bb1a4821b4cbbdb0c4c49333058bb0f
SHA512 d88df7e6ea66378938897fc9229402772ebdf89571950dda675061ee31e02b51d57921b081b2e4ca67a4b663b224419397f8cb3a03af6d31557a1fc35351b48b
SSDEEP 12288:awM60le6/b0SO3nsvhmCcIQXzUhU8IdHe6:c7j0SOXAeI2sP36
TLSH
T1959423DE7F087ACA85620B7F95DDA077708EE32BC929C134CE619BD02514365C3647AB
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/common/common.bskin

SHA256 e9bba8636948996a3b2612eef801027350236a6108b57f15d4ed99a482d857b8
MD5 32b6f18d136bd716bb51a1974bdca161
SHA1 d14707c4b6274ff3beb22abc1734736f8e8d4d8d
SHA512 8010190b8104cf9a571a900a35166ec6d4d005076cd208f777017e2b6547a367912347bd4c39e032ab1b4339fe3f4bee36daf170eff0cfee42a1d3281fe1a2b0
SSDEEP 384:5DBrB6rCrGNGl8deN8AFC4U/tV8ahJLW3WAyZa:XBeCyNGG8u3tCso3HyZa
TLSH
T11472D000D70BE1DEF09E2A210FE9A6A8C5EE9D26856334CE1E1A550DCFF4E31CF40584
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/skin_feedback/skin_feedback.bskin

SHA256 3e0eebe938e4cf1d7fdd749172753b6f6b8081ef87dc85b606cb57602589bdee
MD5 3665900427e3ebdac55cdc163eca1dc2
SHA1 67e37c77345f143b11d573bb51d8d0315688d0f8
SHA512 5c91dd56b28226f8ddb881395fa7023f3be8b737662c15de0b097a9bd292446a3f20952cb1fa8b5d46635f0188a88c88bebc7f17ec14272099878e2ec04356b8
SSDEEP 3072:ZR/lDsjKMS55RID8/axFJ9wMTpKLxnuqcUEwwKtJvC68Pt:pIWMSKQ/KekEnvcUEwtP8V
TLSH
T190C312863EC7CD621E963340B1D86787E1EDA64B32950B88E3DDEC827DB95C9293DC50
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/skin_update/skin_update.bskin

SHA256 d53f6755b595c7a17ca84c71f8241b0a5df8bc698d11ce476e250199c8c55ff1
MD5 437e57d579c00f59838ec1432d2a6667
SHA1 5584f6bec85b7f5aef76c196fdd80307382c9c40
SHA512 c0d93528d17174c2867adff245ced7ee70bc18a1b8c0c2a3dab281d52b1496d10f6ee69670c3a0ca92c6175416ac226982eeed1b3759d07a735f84119e576bfe
SSDEEP 384:ulpR5TEeX4WVzTzeNSkEtVgTlGYS20oZQYUWkGtMAa6:ulvx5SSkE7oI921Q3v2
TLSH
T1F192E252B391F18922D4F2FD6A2B0C9278332A0C5CB435E677873B2A81D5933637858F
MD5 SHA1 SHA512 SSDEEP TLSH

skin/tools/skin_upgrade/skin_upgrade.bskin

SHA256 f478f369506172e7b70cf4aa04d493aa9ca38dae1e91f36c3a2129efc63b5d30
MD5 86a06b7674a6383b23c0f4fec8b81455
SHA1 39f031d7362219eb436c2d8a920f1e96d95028b3
SHA512 3b4da619d5091d8d69b4995280ec36f61c27863cf3a13026fb87be441529593c376b7dc264f7489403f4656419172d8d40754a44f63a178268cb258842211aea
SSDEEP 192:49+ANWbiCSy9NGpCOIkNdPHmNqfqCzhaoyTrRBme6RA3dGJdccdpg:49FgF96wOqCzhdLROd0ucdq
TLSH
T11912BFAB7B01FE109A4FC1BF133D74280642A12E0A34BFD58D8E1E68886B614F9D65B5
MD5 SHA1 SHA512 SSDEEP TLSH

sqlite.dll

IMPHASH dda36a7c934f3550f7f33bb648da1215
SHA256 b31b5cb066cb1b4ca37c927f252603a27d91fb45331645a62316047e8372e741
MD5 955d4123c0e51a493df0d879ac1470cf
SHA1 95a51fe110bcaccacd6df9d757b21150204b48b7
SHA512 64731d4a67d7b88ab947cfa5f59c4c25d2c4529a7a70bd68f4dffb4079c9e5292364b65a90fea14fc04e1e856f458c8bfeea3acd1eaf9de55d2fb98761015d4f
SSDEEP 12288:SokU6CMTJzOo8eoPMWh4vkN3MjRCdzy+8ebA4IXmW/dwSFndh:f6FyBpXh4v63MjRgy+8eGXmE7
TLSH
T136C40701E6A1D43AF8E300FAC3B700BCBE245B31534961DB96C1BDD5AB358E57936A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9f:71:3d:cc:96:c2:b9:48:2b:a0:cc:30:47:bd:6c:e5:e3:6c:89:8b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Mar 31, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

478122

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

p:\app\gensoft\security-client\pc-faster\public\output\pdb\sqlite.pdb

kernel32

GetFullPathNameW GetFullPathNameA HeapReAlloc CreateFileA GetFileSize CreateMutexW SetFilePointer MapViewOfFile UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject InterlockedCompareExchange UnlockFile LockFile OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameA GetTimeZoneInformation TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA GetModuleHandleA

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strnicmp sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8 sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_utf8_to_mbcs sqlite3_win32_write_debug

sysconfig.ini

SHA256 0cf07ed0679d0902c0a2dccec8ed8bfde7a2a05ee40c195e02b9a08272fe7756
MD5 dce99fcfe3584af15d92560c164b2c86
SHA1 b6a3423f9e80fa0d8dd58bcc121abb6cd10358b2
SHA512 5ef7840d71c68f43802ef5b7555efa6810b64e2d7dedad10c60fd41f44a0e6d3823c28800180c2cc31ab41d596ffbdb3dce93047c9b81876e1069f82fa4f3d62
TLSH
T125F00E38E717F45E531CA6B4302881F7B318018D80385A9635056F38180ED4C6AEC0AC
MD5 SHA1 SHA512 TLSH

update.dll

IMPHASH 69d500ea3d436c4132a5cfa79a9f08d1
SHA256 f8984ede16aab342af017c1040b2cee8ae80e85832fbd6cb24f13c623585763b
MD5 bc1c049ba086957b839d1ac1c3099864
SHA1 76ee12e00db7a814951dc9af3c4f248c433c5038
SHA512 86f404b253d0d053c065f4ac72dac083ce66272794f273eb137be0d5b02e935b66ab693c1705e9a31f38234823ab0ca5d56ddffafb429dc985c83b3b208c3848
SSDEEP 24576:3h3w+TAn3hiS1rEeQzQZRxiaSVyfORwoBs1xC0BghNxqbMswtt9EZDPV:3C+T6zEXz0uVyfORwoBs1xC0BghNxqbR
TLSH
T120457C10ABD1C036F9FB06F55A7E866D5934B9A00732C0CBA3C84EAE1E716D2B931757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f8:d7:0e:7e:9e:29:f0:49:05:81:3a:5a:e8:8d:81:9d:1c:4d:46:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

May 7, 2015

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Serial Number

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 8, 2009 - Aug 8, 2024

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

558190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\app\gensoft\security-client\pc-faster\public\output\pdb\update.pdb

kernel32

FindResourceExW SetFilePointerEx SetFileTime WriteFile FlushFileBuffers GetFileSizeEx SetFilePointer GetVersionExW CopyFileW DeleteFileW GetFileAttributesExW GetModuleHandleW LoadLibraryW GetProcAddress FindClose GetModuleFileNameW VerSetConditionMask VerifyVersionInfoW OpenProcess GetCurrentProcess FindFirstFileW FindNextFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTempPathW GetTempFileNameW GetSystemInfo WaitForSingleObject MoveFileExW CreateDirectoryW CreateEventW TerminateThread ResetEvent FindResourceW SetEvent SetFileAttributesW Sleep RemoveDirectoryW QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW InterlockedExchange InitializeCriticalSection GetCurrentThreadId FormatMessageW LocalFree SetEndOfFile FreeLibrary InterlockedIncrement SetErrorMode GetTimeZoneInformation GetPrivateProfileSectionW LoadResource LockResource SizeofResource DeviceIoControl GlobalFree GlobalAlloc CreateFileA GetLocalTime FileTimeToSystemTime WideCharToMultiByte lstrlenW MultiByteToWideChar lstrlenA ReadFile GetFileSize CloseHandle GetLastError CreateFileW DeleteCriticalSection EnterCriticalSection CreateMutexW GetPrivateProfileSectionNamesW SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID LeaveCriticalSection ResumeThread InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA GetLocaleInfoA GetLocaleInfoW GetFullPathNameA SetStdHandle GetModuleHandleA GetConsoleMode GetConsoleCP GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount GetCurrentDirectoryA GetFullPathNameW LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo VirtualAlloc VirtualFree HeapCreate GetModuleFileNameA InterlockedDecrement TlsFree TlsSetValue TlsAlloc TlsGetValue FindFirstFileA GetDriveTypeA GetFileInformationByHandle RtlUnwind ExitProcess GetCommandLineA FileTimeToLocalFileTime MoveFileW CreateThread ExitThread GetSystemTimeAsFileTime SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess FormatMessageA ExpandEnvironmentStringsA GetTickCount WaitForMultipleObjects GetFileType LoadLibraryA GetStdHandle PeekNamedPipe CreateTimerQueue DeleteTimerQueueEx CreateTimerQueueTimer DeleteTimerQueueTimer IsDebuggerPresent HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException CreateFileMappingW UnmapViewOfFile MapViewOfFile GetDiskFreeSpaceExW GetVolumeInformationW OpenFileMappingW GetDriveTypeW SleepEx GetVersionExA SetLastError

user32

wsprintfW FindWindowW SendMessageW

advapi32

RegQueryValueExW RegEnumValueW CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptHashData RegSetValueExW RegCreateKeyExW RegEnumKeyExW RegOpenCurrentUser RevertToSelf ImpersonateLoggedOnUser RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey

shell32

ord165 SHFileOperationW SHGetSpecialFolderPathW

log

WriteLog

shlwapi

PathGetDriveNumberW PathFindExtensionW PathAddBackslashW PathRemoveFileSpecW PathFileExistsW PathAppendW PathFindFileNameW PathStripPathW PathIsDirectoryW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

iphlpapi

GetAdaptersAddresses GetIpForwardTable

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

wininet

InternetOpenW HttpQueryInfoW HttpOpenRequestW InternetSetOptionW HttpAddRequestHeadersW HttpSendRequestW InternetCrackUrlW InternetConnectW InternetReadFile InternetCreateUrlW InternetCloseHandle

winhttp

WinHttpOpen WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser

ws2_32

WSACleanup WSAStartup getsockopt closesocket gethostname getaddrinfo freeaddrinfo WSASetLastError socket bind recv setsockopt getsockname ntohs htons connect WSAIoctl getpeername send ioctlsocket listen __WSAFDIsSet select sendto recvfrom accept WSAGetLastError

wldap32

ord27 ord301 ord33 ord46 ord79 ord30 ord60 ord26 ord41 ord143 ord50 ord22 ord35 ord32 ord211 ord200

ole32

CoCreateGuid

update_config.xml

SHA256 ab564ed32b1b1009c36bbe540f0d38519fdb2b2bf0e7df8a75a9f5db665c2f8f
MD5 80fa186b42b8c812a0b923949761f2e2
SHA1 53c05aec8c44766dfe5d4bf6a515a6e338b96e0a
SHA512 da99d506555ec53c9b1cd2a7d854493c714d422891bbe09335083bf43a3074df58e822b316f925af07edafc074f89539ba9899132cda6dfbc1557a5d5180ca7f
TLSH
T16551F062B306BF627288112B4F3AA04A15339CA6356D0276B15B7A7F530FD4C1CCC6DB
MD5 SHA1 SHA512 TLSH

url.ini

SHA256 49e211cf1ae2adf4ef7d7a245b869875c1e968c8dd7ce7798116afefda628ea2
MD5 8d703c9d972b33adf458d11b4b1b40ae
SHA1 99150f0c08ea0a69e0b1ca8db3b7496b883b0ba0
SHA512 c9fbb8fc086c9a5aa64956e7a267fefd4fd0a20ae0a64a58c535721dd8be947bb2f18dc5bed82766f3e76a84106b420ad6b2605a262534f675697e5645eaf728
SSDEEP 192:udJWeP6lbZVsVUr9i0une/PSHABEUjf/MorsNZKcoNoTc8jdOIkgjdQOU:SJWeClbZVsV49iUPSHABEUjs6sNZKco7
TLSH
T14522040336F92208F6B36B5D95F980B09F3EBEE5A915C66E21F0410E65E4F901812B7B
MD5 SHA1 SHA512 SSDEEP TLSH

version.xml

SHA256 dfc93cab9e598c879101e56b9b98ff12c13191836395d1b4fc94766172683de6
MD5 04943c25e23a02a645a50a5efd706584
SHA1 f84c2026110ce0ea838c098d7926b7ea5b0fc338
SHA512 11688bef4bcef71c3d8a8c932cf4cf6fc9b62041f874c1c2e001d997b5586dd024de849284d41f8ff3ed4d611f4eab0866754f89c0176784db46db92f3097e6c
TLSH
T1A0E0CD0E45091D74D1431B581755BA04F7FC535A32CA505C5AC254476386A7E42D8374
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

PC_Faster_Setup_GL.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/BHips.dll

PE Signature issue

version

fltlib

kernel32

wtsapi32

psapi

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

generic

$PLUGINSDIR/Communication.dll

PE Signature issue

kernel32

advapi32

shell32

ole32

log

shlwapi

winhttp

generic

$PLUGINSDIR/DataReport.dll

PE Signature issue

log2

kernel32

user32

advapi32

shell32

ole32

shlwapi

version

wtsapi32

iphlpapi

rpcrt4

psapi

winhttp

generic

$PLUGINSDIR/InstallCheck.dll

PE Signature issue

kernel32

user32

shell32

generic

$PLUGINSDIR/InstallUtility.dll

PE Signature issue

iphlpapi

wtsapi32

psapi

version

log

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wldap32

ws2_32

rpcrt4