Install_Xfer_OTT_137[.]exe

resource
Install_Xfer_OTT_137.exe
unpack001/$LOCALAPPDATA/Xfer/Uninstall_OTT.exe

resource
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/advsplash.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$_13_/OTT_x64.dll
unpack001/$_57_/rebyter.exe
unpack001/C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin
unpack001/C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin
unpack001/C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin
unpack001/C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin
unpack001/C:/Program Files/Common Files/VST3/OTT.vst3
unpack001/OTT.dll

Install_Xfer_OTT_137.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb
MD5 d37e8c8e92d55af5d4eb031d07544238
SHA1 1b8a72704a8a6b871cc90ac6c72155a9f7779c6a
SHA512 6a3236fb58dfe8fd502e44910f202323c319f12a6f3dca9f0d67b001a70c58a1838efff58c2f48455b6b09084a2aab12bcc523a5837dbbf4f566de9afc118a67
SSDEEP 196608:+E2a9qG01Uk3Go9DT9+ovDJC21i0hVynPu89M+xkKzl:+doR0173GYDT9+mJC21iMVyPmAdzl
TLSH
T1748633877B15A8CAC4DC16F01BCEC836B6964DF2171013E356D0AE2FB4EA9C744C6B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

69:2f:88:79:51:57:e2:b0:97:9d:6f:e7:7b:1e:15:3f:ae:8e:e2:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Stephen Duda,O=Stephen Duda,L=Studio City,ST=California,C=US

Chains

Mar 23, 2023

CN=Stephen Duda,O=Stephen Duda,L=Studio City,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Stephen Duda,O=Stephen Duda,L=Studio City,ST=California,C=US

Serial Number

0d:8e:39:4f:36:06:1f:ef:36:de:c5:2c:04:f6:03:33

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2020 - May 12, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

13509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$LOCALAPPDATA/Xfer/Uninstall_OTT.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 f27718f1350b9f46eb26905645a50fa806802c85b49f8d5dbb13b47a78008613
MD5 9a2c647d8deda681b0e5e97f2d7a86d1
SHA1 6601a2625824f4a25861606f8acd42a400c14cc2
SHA512 4018e2493ea6b39e1770ecca3e4d60514abcccea689b5c46f95997d715d1ef71d7bc96295f5a0cc42ac88f68c50d3c90ca73884076fc5ffafec1a47eed4f37f0
SSDEEP 3072:fNRCywDw1DiJku/Zx+5kqWHK37YFOFv6h:fT4DtbEkzOZU
TLSH
T179A3BF017720EC53CEB306B02579D77B5FB2BE7616A1CB4713E0ED0BBC92A926D09285
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

6f:a8:b9:c8:32:e8:79:98:71:f4:61:da:14:f6:78:2e:0c:f1:55:47

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Stephen Duda,O=Stephen Duda,L=Studio City,ST=California,C=US

Chains

Mar 23, 2023

CN=Stephen Duda,O=Stephen Duda,L=Studio City,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Stephen Duda,O=Stephen Duda,L=Studio City,ST=California,C=US

Serial Number

0d:8e:39:4f:36:06:1f:ef:36:de:c5:2c:04:f6:03:33

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2020 - May 12, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

13509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 12c8ee2d311771db4e2734f25fa2edec27f57829226dff796cd61bea01c90db8
MD5 6a7dfbb00ffd72ef54b21f9664b67b53
SHA1 336b2cea8f8d82028e3587b6bb10ef06a2197450
SHA512 bf5b3d24339c9f91c8d4261e1457a8e5ad4a44a0d34032e8415d636a81695fd2e3c61647e00044d61e9379bda9d1c83514cbfb1a77666cbc918d38cfc4f18763
SSDEEP 192:dh0nORlC5rJnWlfCEyP4moPg7aVLKYq07msvrdlN:jKysueBu6ArdH
TLSH
T1D9C26382171CCC03EA90EED58DB3C8EFC1537D699CA16487F464B3AA16BE7B1110EA74
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 54eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d
MD5 fd944873f187518849e6e3336c45f968
SHA1 3ba4d7d455372a329eb44200ecdd2e3075869047
SHA512 d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e
SSDEEP 192:8tq4juZtJc621zAgTZoN5qxtCZiF46E5tOPfPq5hFziRZG:8tqvtW6tUinK
TLSH
T173E394EC7911C899DFB9367079A1258022A37CD30BC68207F0BB372D557B1A96B0FC96
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/advsplash.dll

IMPHASH 4d85954a016da6eba41af38db29369a8
SHA256 62b3db0446750ca9fd693733eec927acc1f50012a47785343286e63b650b7621
MD5 1871af84805057b5ebc05ee46b56625d
SHA1 50e1c315ad30f5f3f300c7cd9dd0d5d626fe0167
SHA512 c1979ee98dfdb807776c439218528d80b4b244a87e692f1538e40f9c2c82db8b77485eb1429325b6f44419bf1f4cd454e43ff381eff077a8b4f4d9eb0d7e54d4
SSDEEP 96:kIUNaXnnXyEIPtXvZhr5RwiULuxDtJz+wolpE:kIx3XyEwXvZh1RwnLUDth+I
TLSH
T16FC1B837A2C261F3D29B01B168467BA343A59871375259580DA3C9C9ED92DA7DC14743
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 12c8ee2d311771db4e2734f25fa2edec27f57829226dff796cd61bea01c90db8
MD5 6a7dfbb00ffd72ef54b21f9664b67b53
SHA1 336b2cea8f8d82028e3587b6bb10ef06a2197450
SHA512 bf5b3d24339c9f91c8d4261e1457a8e5ad4a44a0d34032e8415d636a81695fd2e3c61647e00044d61e9379bda9d1c83514cbfb1a77666cbc918d38cfc4f18763
SSDEEP 192:dh0nORlC5rJnWlfCEyP4moPg7aVLKYq07msvrdlN:jKysueBu6ArdH
TLSH
T1D9C26382171CCC03EA90EED58DB3C8EFC1537D699CA16487F464B3AA16BE7B1110EA74
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 54eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d
MD5 fd944873f187518849e6e3336c45f968
SHA1 3ba4d7d455372a329eb44200ecdd2e3075869047
SHA512 d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e
SSDEEP 192:8tq4juZtJc621zAgTZoN5qxtCZiF46E5tOPfPq5hFziRZG:8tqvtW6tUinK
TLSH
T173E394EC7911C899DFB9367079A1258022A37CD30BC68207F0BB372D557B1A96B0FC96
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
MD5 48f3e7860e1de2b4e63ec744a5e9582a
SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
TLSH
T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/splash.bmp

SHA256 ff1f661c015ff0cd9794f5b6cb81755f528c98c522203fcf69550f67d427ff4f
MD5 237aa22aff8343665911c8615c4cbfdd
SHA1 d35067296d0fe72cb55e01793846165a0c3b9750
SHA512 6929a3230a4c3b9057ed6e3c5eac2ce9f6a2cf6c3b58bb980aed88006a014adcd591e6bccb5eacec26a016f3bf785d08527464d276d4ee314c3744f3754d3d38
SSDEEP 384:Yk2ChD6QU4uYcCRUvMPTQys+WjZQXOPCGOQwNNCahMMgA8y+:5m4tcCy0VWl4G0HxMfS
TLSH
T15915C9DC7418E597DFE0BE78394622746A67A0D303C902A5F0332B4D6917BE5272FE4A
MD5 SHA1 SHA512 SSDEEP TLSH

$_13_/OTT_x64.dll

IMPHASH 61d3b4877af4b8670908947d5cd84a7c
SHA256 ecd51e056860a37dbff4223c4dcab1a12f91e3f280161bec249fe8d97ab2378e
MD5 4543efc047af424b8f8adc11c20c93c7
SHA1 c5a62c50fede0d85ba7e146d86b1f507c39fe8ae
SHA512 3f4c764b27b24f05f3081b037bba1e92e18e4db416e3de71ab068460c01afb37fc5a354d02cb45f905e8b3c3dc1a0bc7f0e2ddcc5b0ca130a58ae78de2968db0
SSDEEP 49152:VM5sWoj2Nh4euWYhB+9OSpkFCtxAP3ZZI1vl0P057TyBTwOnG1u4:65Hol+pBtxl08tlN
TLSH
T135E5AD5BB26800D8D07AD07CC61BA90BE772781107609BDF16E14BAE5F63BE01E7B761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1709220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW ShellExecuteA DragQueryFileW ord74

user32

DestroyMenu CreatePopupMenu KillTimer SetTimer GetKeyState AttachThreadInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetFocus GetFocus GetWindowTextW GetWindowLongPtrW SetWindowLongPtrW EnumWindows GetDC AppendMenuW TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture TrackPopupMenu SetMenuInfo SetMenuItemInfoW ReleaseDC ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect RegisterClassW CallWindowProcW wsprintfW GetClassNameW GetWindowInfo EnumDisplayMonitors RedrawWindow SetWindowTextW GetClientRect GetWindowRect MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient WindowFromPoint GetWindowLongW SetWindowLongW GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon CreateIconIndirect SystemParametersInfoW GetMonitorInfoW GetWindowTextLengthW MapWindowPoints

kernel32

InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WaitForSingleObjectEx GetSystemTimeAsFileTime SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock ResetEvent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList SetLastError RtlUnwind TlsAlloc TlsGetValue WriteConsoleW TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation CreateThread GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindNextFileW ExitThread GetFileAttributesW GetFileAttributesExW ReadFile SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock MultiByteToWideChar WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW GetTickCount GetVersionExW LoadLibraryA GlobalFree FindResourceA FreeLibraryAndExitThread GetFileType HeapAlloc HeapFree HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FlushFileBuffers

gdi32

ExcludeClipRect CreateRectRgnIndirect CreateRectRgn CreateBitmap CombineRgn GetKerningPairsW GetTextMetricsW SetMapMode SetMapperFlags SelectObject GetRegionData GetGlyphIndicesW GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC RestoreDC SetTextColor SaveDC StretchDIBits CreateDIBSection AddFontResourceExW CreateSolidBrush SetBkColor RemoveFontMemResourceEx

ole32

GetHGlobalFromStream CreateStreamOnHGlobal DoDragDrop RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoCreateInstance

winmm

timeGetTime timeBeginPeriod

imm32

ImmGetContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmReleaseContext

gdiplus

GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipCreateHBITMAPFromBitmap GdipSetLinePresetBlend GdipCreateLineBrush GdipSetSolidFillColor GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipSetMatrixElements GdipCreateBitmapFromScan0 GdipGetCellAscent GdipCreateMatrix GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetCellDescent GdipGetEmHeight GdipCreateMatrix2 GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipSetClipRect GdipDrawImageRectRectI GdipFillPath GdipFillEllipse GdipSetPathGradientCenterColor GdipGetImageHeight GdipGetImageWidth GdipGetGenericFontFamilySansSerif GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipCreatePathGradientFromPath GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipIsVisiblePathPoint GdipCreateBitmapFromResource GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipDeleteMatrix GdipSetPathGradientSurroundColorsWithCount GdipDisposeImageAttributes GdipCreateBitmapFromStreamICM

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

500KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

495KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_57_/rebyter.exe

IMPHASH a69a20b85ef89cc149f2c89737acc996
SHA256 412485f00da589aca33c9963f4cd4ac8202013fff298c8355c33fe32bf5b42e0
MD5 24796de0cb33dfc35eb7dc3dec783441
SHA1 d1e519a6a8a677eabdc84cf7c205195140047305
SHA512 cfac8ae23ac304b750fed641a8e4e6b915193579785a372704aa059852755bf62367bb8e469a0caac02c5ea4f635d04e7924bebfecfbfa97d448c9be94953fc6
SSDEEP 1536:VWKeT8mDIrjMiT4D8YcKCS2LQZ2opQp8QM/UC5dUIDlEcU0:0K0kP688CHLA2o+mQMv
TLSH
T187836B03F79601FCE35BA2BCC6925A46C372FC1B076597CF57908A2A0F227D16D7A225
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\matta\Documents\Xfer_dev\FreewareCombo\win\x64\Release\rebyter.pdb

advapi32

RegGetValueW

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception_context __current_exception memcmp __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memcpy _CxxThrowException memmove

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fsetpos setvbuf fgetpos _set_fmode __p__commode __stdio_common_vfwprintf _open fputc _get_stream_buffer_pointers _read ungetc fwrite fgetc fflush ferror _lseek __acrt_iob_func fread feof _close __stdio_common_vsprintf _write fseek fclose fopen __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_errno strerror _invalid_parameter_noinfo_noreturn terminate _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _register_onexit_function _exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv exit _set_app_type _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

kernel32

RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW LocalFree FormatMessageA CreateFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI CloseHandle GetLastError GetFileInformationByHandleEx WideCharToMultiByte RtlCaptureContext

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin

IMPHASH b4e2f1fef8cb71d668d97be196d46db5
SHA256 802494be6b40d9abf1abc3374323b555807fd772f2a2243a982a923fe273b5da
MD5 485ee79117f6f40665dd4ad0d955747c
SHA1 fa008df2bba9d442357898aa5a88ec789ad28a59
SHA512 266597dc5958be88cd854cb6dda382a67b7359eafad8bf4d246ecc6d6fa7063be35c4ff3284db0d432b18253c37609c972b33bff3911e10d46ed7bff32c7715d
SSDEEP 49152:KBWO+3L2Sp+7uFsLnU1/62WKecJDVsNTi2TNM0OnG1u4jx+6:KB3uSSypbKecJD4M0lNL
TLSH
T180D5CE217412C079C5CE02B19A7DBBAF827D5F6A0B3805D757E4AEA84C341D22F7369B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1568720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW DragQueryFileW ord74 ShellExecuteA

user32

DestroyMenu CreatePopupMenu KillTimer SetTimer GetKeyState RegisterClassW CallWindowProcW wsprintfW GetClassNameW AttachThreadInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetFocus GetFocus GetWindowTextW GetWindowLongW SetWindowLongW AppendMenuW GetDC ReleaseDC TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture TrackPopupMenu SetMenuInfo SetMenuItemInfoW EnumWindows ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect GetWindowInfo EnumDisplayMonitors GetMonitorInfoW SystemParametersInfoW CreateIconIndirect RedrawWindow SetWindowTextW GetClientRect GetWindowRect MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient WindowFromPoint GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon MapWindowPoints GetWindowTextLengthW

kernel32

DecodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent EncodePointer LCMapStringEx GetStringTypeW RtlUnwind RaiseException InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW LoadLibraryExW GetTimeZoneInformation CreateThread ExitThread GetCPInfo FreeLibraryAndExitThread GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose GetFileType FlushFileBuffers GetFileAttributesW GetFileAttributesExW ReadFile SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock GetTickCount GetVersionExW LoadResource LockResource SizeofResource LoadLibraryA GlobalFree FindResourceA MultiByteToWideChar WideCharToMultiByte FindResourceW HeapAlloc HeapFree HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FindNextFileW

gdi32

CombineRgn GetKerningPairsW GetTextMetricsW SetMapMode SetMapperFlags SelectObject RemoveFontMemResourceEx GetGlyphIndicesW CreateBitmap GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC SetBkColor CreateSolidBrush SetTextColor AddFontResourceExW CreateRectRgn CreateRectRgnIndirect GetRegionData ExcludeClipRect RestoreDC SaveDC StretchDIBits CreateDIBSection GetOutlineTextMetricsW

ole32

RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoCreateInstance CreateStreamOnHGlobal DoDragDrop GetHGlobalFromStream

winmm

timeGetTime timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

gdiplus

GdipGetGenericFontFamilySansSerif GdipGetEmHeight GdipGetCellAscent GdipGetCellDescent GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipCloneBrush GdipSetMatrixElements GdipDisposeImage GdipCreateFontFamilyFromName GdipCreateMatrix GdipFillEllipse GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDeleteFontFamily GdipSetClipRect GdipDrawImageRectRectI GdipCreateMatrix2 GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipFillPath GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateBitmapFromScan0 GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromResource GdipDeleteBrush GdipGetImageGraphicsContext GdipCreateBitmapFromStreamICM GdipGetImageHeight GdipIsVisiblePathPoint GdipGetImageWidth GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipSetLinePresetBlend GdipCreateLineBrush GdipSetSolidFillColor GdipDeleteMatrix GdipCreateSolidFill GdipCreateHBITMAPFromBitmap GdipCreateFromHDC

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin

IMPHASH de49250d133e32e6af16efcff25bd4be
SHA256 00794e3da4028f9827b92347576feaff16fbca361d3e7b84c2808bd103347e71
MD5 e5e9e7ea97523b6efdd9f20a4054e030
SHA1 ce7237bb8bcb0380a9081fa2867894a73f8a93e6
SHA512 30ac69e70f90045e8d0812de9a63f548e6ee890210d811471107c782c8daa10725dc1ae172f6ad6f835a6446197b2b1c680cae9fb3f02fb7e8b19618880e27da
SSDEEP 49152:mM7WA7M5ZpzDPz7ZU6He6O5tfXGPvZEnBa21C0xAlCuvnH28pVTDET10eIOnG1ui:NJMHz7ijtPtn1wn3LlNN
TLSH
T199E5AE4B726500D8D4AAD07CC65B990BD372744907609BDF16F08BAE1FA7BE05EBB360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1767028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW DragQueryFileW ord74 ShellExecuteA

user32

DestroyMenu CreatePopupMenu KillTimer SetTimer GetKeyState RegisterClassW AttachThreadInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetFocus GetFocus GetWindowTextW GetWindowLongPtrW SetWindowLongPtrW EnumWindows GetDC AppendMenuW TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture TrackPopupMenu SetMenuInfo SetMenuItemInfoW ReleaseDC ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect CallWindowProcW wsprintfW GetClassNameW GetWindowInfo EnumDisplayMonitors GetMonitorInfoW RedrawWindow SetWindowTextW GetClientRect GetWindowRect MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient WindowFromPoint GetWindowLongW SetWindowLongW GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon CreateIconIndirect SystemParametersInfoW GetWindowTextLengthW MapWindowPoints

kernel32

DecodePointer EncodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RaiseException InterlockedFlushSList SetLastError RtlUnwind TlsAlloc TlsGetValue WriteConsoleW TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation CreateThread ExitThread GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FlushFileBuffers GetFileAttributesW GetFileAttributesExW ReadFile SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock GetTickCount GetVersionExW LoadResource LockResource SizeofResource LoadLibraryA GlobalFree FindResourceA MultiByteToWideChar WideCharToMultiByte FindResourceW RtlPcToFileHeader FreeLibraryAndExitThread GetFileType HeapAlloc HeapFree HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FindNextFileW

gdi32

CreateRectRgnIndirect CreateRectRgn CreateBitmap CombineRgn GetKerningPairsW GetTextMetricsW SetMapMode SetMapperFlags SelectObject ExcludeClipRect GetGlyphIndicesW GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC AddFontResourceExW GetRegionData RestoreDC SaveDC StretchDIBits CreateDIBSection CreateSolidBrush SetBkColor SetTextColor RemoveFontMemResourceEx

ole32

GetHGlobalFromStream CreateStreamOnHGlobal DoDragDrop RevokeDragDrop RegisterDragDrop CoCreateInstance OleUninitialize OleInitialize

winmm

timeGetTime timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

gdiplus

GdipGetCellDescent GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipCreateBitmapFromScan0 GdipCreateLineBrush GdipSetSolidFillColor GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipSetMatrixElements GdipCreateBitmapFromStreamICM GdipGetEmHeight GdipCreateMatrix GdipDeleteFontFamily GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetCellAscent GdipGetGenericFontFamilySansSerif GdipCreateMatrix2 GdipCreateFontFamilyFromName GdipSetClipRect GdipDrawImageRectRectI GdipFillPath GdipFillEllipse GdipFillPolygon GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipSetLinePresetBlend GdipCreatePathGradientFromPath GdipBitmapLockBits GdipCreateBitmapFromResource GdipIsVisiblePathPoint GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipDeleteMatrix GdipSetPathGradientCenterColor GdipCreateImageAttributes GdipBitmapUnlockBits

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

495KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/PlugIn.ico

SHA256 a7849a94cd1a1d4a9a59e8e1351449c726fc73a8ea1ee3aed3d9d5c200131807
MD5 5592ec57ec7fd6c30d5d57af0461965c
SHA1 d9fb4aa7b76f4dad1cbed20e3c94724949e50608
SHA512 524d183bc4c6b7d93a5005de7707be59680a82ddf97d4a9fdc2601dc43b341666df348bef7ab1bfdf8d5b8faaa1cee5b1b536c453cea5d88500b61841ea47b0a
SSDEEP 6144:oCT09tRJVXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXL+:o88tRK
TLSH
T14E7483767703980FD26B6AB09868F7F0185E4EA0FE4B611286F1796670B07F42F8D2D5
MD5 SHA1 SHA512 SSDEEP TLSH

C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/desktop.ini

SHA256 5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
MD5 798095cd31340606c8e81d0a5107d57e
SHA1 39d058c4d45ef84b188f7ece620106124eb3d74e
SHA512 9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
TLSH
T190B09B15282F5020D57FC3071990BDCFF2041857985BE804C78287854EE17164FC855C
MD5 SHA1 SHA512 TLSH

C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin

IMPHASH b4e2f1fef8cb71d668d97be196d46db5
SHA256 802494be6b40d9abf1abc3374323b555807fd772f2a2243a982a923fe273b5da
MD5 485ee79117f6f40665dd4ad0d955747c
SHA1 fa008df2bba9d442357898aa5a88ec789ad28a59
SHA512 266597dc5958be88cd854cb6dda382a67b7359eafad8bf4d246ecc6d6fa7063be35c4ff3284db0d432b18253c37609c972b33bff3911e10d46ed7bff32c7715d
SSDEEP 49152:KBWO+3L2Sp+7uFsLnU1/62WKecJDVsNTi2TNM0OnG1u4jx+6:KB3uSSypbKecJD4M0lNL
TLSH
T180D5CE217412C079C5CE02B19A7DBBAF827D5F6A0B3805D757E4AEA84C341D22F7369B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1568720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW DragQueryFileW ord74 ShellExecuteA

user32

DestroyMenu CreatePopupMenu KillTimer SetTimer GetKeyState RegisterClassW CallWindowProcW wsprintfW GetClassNameW AttachThreadInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetFocus GetFocus GetWindowTextW GetWindowLongW SetWindowLongW AppendMenuW GetDC ReleaseDC TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture TrackPopupMenu SetMenuInfo SetMenuItemInfoW EnumWindows ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect GetWindowInfo EnumDisplayMonitors GetMonitorInfoW SystemParametersInfoW CreateIconIndirect RedrawWindow SetWindowTextW GetClientRect GetWindowRect MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient WindowFromPoint GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon MapWindowPoints GetWindowTextLengthW

kernel32

DecodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent EncodePointer LCMapStringEx GetStringTypeW RtlUnwind RaiseException InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW LoadLibraryExW GetTimeZoneInformation CreateThread ExitThread GetCPInfo FreeLibraryAndExitThread GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose GetFileType FlushFileBuffers GetFileAttributesW GetFileAttributesExW ReadFile SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock GetTickCount GetVersionExW LoadResource LockResource SizeofResource LoadLibraryA GlobalFree FindResourceA MultiByteToWideChar WideCharToMultiByte FindResourceW HeapAlloc HeapFree HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FindNextFileW

gdi32

CombineRgn GetKerningPairsW GetTextMetricsW SetMapMode SetMapperFlags SelectObject RemoveFontMemResourceEx GetGlyphIndicesW CreateBitmap GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC SetBkColor CreateSolidBrush SetTextColor AddFontResourceExW CreateRectRgn CreateRectRgnIndirect GetRegionData ExcludeClipRect RestoreDC SaveDC StretchDIBits CreateDIBSection GetOutlineTextMetricsW

ole32

RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CoCreateInstance CreateStreamOnHGlobal DoDragDrop GetHGlobalFromStream

winmm

timeGetTime timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

gdiplus

GdipGetGenericFontFamilySansSerif GdipGetEmHeight GdipGetCellAscent GdipGetCellDescent GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipCloneBrush GdipSetMatrixElements GdipDisposeImage GdipCreateFontFamilyFromName GdipCreateMatrix GdipFillEllipse GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDeleteFontFamily GdipSetClipRect GdipDrawImageRectRectI GdipCreateMatrix2 GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipFillPath GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateBitmapFromScan0 GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromResource GdipDeleteBrush GdipGetImageGraphicsContext GdipCreateBitmapFromStreamICM GdipGetImageHeight GdipIsVisiblePathPoint GdipGetImageWidth GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipSetLinePresetBlend GdipCreateLineBrush GdipSetSolidFillColor GdipDeleteMatrix GdipCreateSolidFill GdipCreateHBITMAPFromBitmap GdipCreateFromHDC

C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin

IMPHASH de49250d133e32e6af16efcff25bd4be
SHA256 00794e3da4028f9827b92347576feaff16fbca361d3e7b84c2808bd103347e71
MD5 e5e9e7ea97523b6efdd9f20a4054e030
SHA1 ce7237bb8bcb0380a9081fa2867894a73f8a93e6
SHA512 30ac69e70f90045e8d0812de9a63f548e6ee890210d811471107c782c8daa10725dc1ae172f6ad6f835a6446197b2b1c680cae9fb3f02fb7e8b19618880e27da
SSDEEP 49152:mM7WA7M5ZpzDPz7ZU6He6O5tfXGPvZEnBa21C0xAlCuvnH28pVTDET10eIOnG1ui:NJMHz7ijtPtn1wn3LlNN
TLSH
T199E5AE4B726500D8D4AAD07CC65B990BD372744907609BDF16F08BAE1FA7BE05EBB360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1767028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW DragQueryFileW ord74 ShellExecuteA

user32

DestroyMenu CreatePopupMenu KillTimer SetTimer GetKeyState RegisterClassW AttachThreadInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetFocus GetFocus GetWindowTextW GetWindowLongPtrW SetWindowLongPtrW EnumWindows GetDC AppendMenuW TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture TrackPopupMenu SetMenuInfo SetMenuItemInfoW ReleaseDC ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect CallWindowProcW wsprintfW GetClassNameW GetWindowInfo EnumDisplayMonitors GetMonitorInfoW RedrawWindow SetWindowTextW GetClientRect GetWindowRect MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient WindowFromPoint GetWindowLongW SetWindowLongW GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon CreateIconIndirect SystemParametersInfoW GetWindowTextLengthW MapWindowPoints

kernel32

DecodePointer EncodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RaiseException InterlockedFlushSList SetLastError RtlUnwind TlsAlloc TlsGetValue WriteConsoleW TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation CreateThread ExitThread GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FlushFileBuffers GetFileAttributesW GetFileAttributesExW ReadFile SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock GetTickCount GetVersionExW LoadResource LockResource SizeofResource LoadLibraryA GlobalFree FindResourceA MultiByteToWideChar WideCharToMultiByte FindResourceW RtlPcToFileHeader FreeLibraryAndExitThread GetFileType HeapAlloc HeapFree HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FindNextFileW

gdi32

CreateRectRgnIndirect CreateRectRgn CreateBitmap CombineRgn GetKerningPairsW GetTextMetricsW SetMapMode SetMapperFlags SelectObject ExcludeClipRect GetGlyphIndicesW GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC AddFontResourceExW GetRegionData RestoreDC SaveDC StretchDIBits CreateDIBSection CreateSolidBrush SetBkColor SetTextColor RemoveFontMemResourceEx

ole32

GetHGlobalFromStream CreateStreamOnHGlobal DoDragDrop RevokeDragDrop RegisterDragDrop CoCreateInstance OleUninitialize OleInitialize

winmm

timeGetTime timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

gdiplus

GdipGetCellDescent GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipCreateBitmapFromScan0 GdipCreateLineBrush GdipSetSolidFillColor GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipSetMatrixElements GdipCreateBitmapFromStreamICM GdipGetEmHeight GdipCreateMatrix GdipDeleteFontFamily GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetCellAscent GdipGetGenericFontFamilySansSerif GdipCreateMatrix2 GdipCreateFontFamilyFromName GdipSetClipRect GdipDrawImageRectRectI GdipFillPath GdipFillEllipse GdipFillPolygon GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipSetLinePresetBlend GdipCreatePathGradientFromPath GdipBitmapLockBits GdipCreateBitmapFromResource GdipIsVisiblePathPoint GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipDeleteMatrix GdipSetPathGradientCenterColor GdipCreateImageAttributes GdipBitmapUnlockBits

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

495KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/PlugIn.ico

SHA256 a7849a94cd1a1d4a9a59e8e1351449c726fc73a8ea1ee3aed3d9d5c200131807
MD5 5592ec57ec7fd6c30d5d57af0461965c
SHA1 d9fb4aa7b76f4dad1cbed20e3c94724949e50608
SHA512 524d183bc4c6b7d93a5005de7707be59680a82ddf97d4a9fdc2601dc43b341666df348bef7ab1bfdf8d5b8faaa1cee5b1b536c453cea5d88500b61841ea47b0a
SSDEEP 6144:oCT09tRJVXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXL+:o88tRK
TLSH
T14E7483767703980FD26B6AB09868F7F0185E4EA0FE4B611286F1796670B07F42F8D2D5
MD5 SHA1 SHA512 SSDEEP TLSH

C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/desktop.ini

SHA256 5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
MD5 798095cd31340606c8e81d0a5107d57e
SHA1 39d058c4d45ef84b188f7ece620106124eb3d74e
SHA512 9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
TLSH
T190B09B15282F5020D57FC3071990BDCFF2041857985BE804C78287854EE17164FC855C
MD5 SHA1 SHA512 TLSH

C:/Program Files/Common Files/VST3/OTT.vst3

IMPHASH b9074a380f2607420c99849afbf38b90
SHA256 8965c7114506d7a74361233c418b0988ebbd0f7a59d602b9a469c83e31f6fd5a
MD5 514568987e5730d6cde55513f2606cca
SHA1 abd834f18877543178158ecd6bf1416e0979fe83
SHA512 76c263a4ed2d2e37c7dbfeef30d61793599e1fea0f1c5d14afecfb575410c816c1e355bb54b10291fb74d4afa572fdf4e2e0ba703dcb307ed39c921f3227d400
SSDEEP 49152:srEdCjsjS6LyO+n9Ng8HpJtT2YPgZxLeTMh1X4WkPwi8q/Th1T1ELL/gOnG1u4:UEdNyO+nX/fty4S12w3ug/glN
TLSH
T1C8E5AE4BB26400D9C07AD07CC65B9A0BD67178554BA097DF16F08BAE1FA7BE01EBB350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1761188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

ord74 DragQueryFileW ShellExecuteA ExtractAssociatedIconW SHGetSpecialFolderPathW

user32

DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW SetFocus MapWindowPoints GetWindowTextLengthW SetMenuItemInfoW SetMenuInfo TrackPopupMenu AppendMenuW GetFocus GetWindowTextW GetWindowLongPtrW SetWindowLongPtrW EnumWindows GetDC ReleaseDC TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow TranslateMessage SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect RedrawWindow SetWindowTextW GetClientRect GetWindowRect GetMessageW GetWindowThreadProcessId AttachThreadInput SetLayeredWindowAttributes MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient DestroyMenu CreatePopupMenu GetKeyState RegisterClassW CallWindowProcW WindowFromPoint GetWindowLongW SetWindowLongW GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon CreateIconIndirect SystemParametersInfoW GetMonitorInfoW EnumDisplayMonitors GetWindowInfo SetTimer KillTimer GetClassNameW wsprintfW CreateWindowExW DestroyWindow

kernel32

RtlUnwind SetLastError InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer TlsGetValue SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TlsAlloc TlsSetValue TlsFree LoadLibraryExW GetTimeZoneInformation ExitThread FreeLibraryAndExitThread GetFileType HeapAlloc GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW HeapFree FindNextFileW FlushFileBuffers GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock ResetEvent GetTickCount64 MultiByteToWideChar WideCharToMultiByte GetTickCount GetVersionExW LoadResource LockResource SizeofResource LoadLibraryA GlobalFree FindResourceA FindResourceW HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize CreateThread FindClose WriteConsoleW

gdi32

StretchDIBits SaveDC RestoreDC GetRegionData ExcludeClipRect CreateRectRgnIndirect CreateRectRgn CreateBitmap CombineRgn CreateSolidBrush GetTextMetricsW SetMapMode SetMapperFlags SelectObject RemoveFontMemResourceEx GetGlyphIndicesW GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC CreateDIBSection SetBkColor SetTextColor AddFontResourceExW RemoveFontResourceExW GetKerningPairsW

ole32

CoCreateInstance OleInitialize OleUninitialize RegisterDragDrop RevokeDragDrop GetHGlobalFromStream CreateStreamOnHGlobal CoCreateGuid DoDragDrop

winmm

timeGetTime timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

gdiplus

GdipGetEmHeight GdipGetCellAscent GdipGetCellDescent GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipSetMatrixElements GdipDeleteMatrix GdipCreateMatrix GdipDrawImageRectRectI GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipGetImageHeight GdipFillPath GdipFillEllipse GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetClipRect GdipDrawEllipse GdipDrawRectangle GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromResource GdipCreateHBITMAPFromBitmap GdipSetSolidFillColor GdipCreateBitmapFromStreamICM GdipIsVisiblePathPoint GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipSetLinePresetBlend GdipCreateMatrix2 GdipCreateLineBrush GdipCreateBitmapFromScan0

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

520KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

495KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

OTT.dll

IMPHASH af2300083eff180114023180ed206d72
SHA256 7d37a5e0932b5e1eec6591a591f5838227fb46c4dbb6e01c7d8292c05ba2ac6f
MD5 75331d983b19109519faef7d75032e81
SHA1 a8e85b2936cb497cb83255cd07e0a5f96ba9dd03
SHA512 a4693b866c7bc00958102399e6cee0db4ced080e6d1c2c6cd64e056577436f549b3fcf06479e89356391524523dbf63ace7562f4ee4cfd524f5a5a896aca6864
SSDEEP 49152:ThaqM9EqlKvUMAIzxcziL++50RGotksT++Tw0OnG1u4lSTmg:Thuyh4iL+40RGoto0lNlM
TLSH
T195D5BD11B502C239D5DD01B0997EBFAF41295E780B390AD79BD8AEAC58381C32F73697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1511824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ExtractAssociatedIconW ShellExecuteA DragQueryFileW ord74

user32

DestroyMenu CreatePopupMenu KillTimer SetTimer GetKeyState RegisterClassW CallWindowProcW wsprintfW AttachThreadInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW PeekMessageW PostMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetFocus GetFocus GetWindowTextW GetWindowLongW SetWindowLongW EnumWindows AppendMenuW ReleaseDC TrackMouseEvent GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW IsWindow IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes SetWindowPos GetWindowPlacement IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetActiveWindow GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyW GetCapture SetCapture TrackPopupMenu SetMenuInfo SetMenuItemInfoW GetDC ReleaseCapture GetSystemMetrics GetSystemMenu EnableMenuItem GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRgn InvalidateRect GetClassNameW GetWindowInfo EnumDisplayMonitors GetMonitorInfoW SystemParametersInfoW RedrawWindow SetWindowTextW GetClientRect GetWindowRect MessageBeep SetCursorPos SetCursor GetCursorPos CreateCaret DestroyCaret ShowCaret SetCaretPos ScreenToClient WindowFromPoint GetDesktopWindow GetParent EnumChildWindows FindWindowW FindWindowExW LoadCursorW DestroyCursor DestroyIcon CreateIconIndirect MapWindowPoints GetWindowTextLengthW

kernel32

IsProcessorFeaturePresent GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer ResetEvent GetSystemTimeAsFileTime SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW LoadLibraryExW GetTimeZoneInformation CreateThread ExitThread RaiseException FreeLibraryAndExitThread GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose GetFileType FlushFileBuffers GetFileAttributesW GetFileAttributesExW ReadFile SetEndOfFile SetFilePointer WriteFile GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle SetUnhandledExceptionFilter GetLastError QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread SetPriorityClass GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryW SetThreadAffinityMask FormatMessageW GetLocaleInfoW GetCommandLineW GetCurrentProcessId GlobalAlloc GlobalSize GlobalUnlock GlobalLock MultiByteToWideChar WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW GetTickCount GetVersionExW LoadLibraryA GlobalFree FindResourceA HeapAlloc HeapFree HeapReAlloc GetStdHandle CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetConsoleOutputCP GetConsoleMode ReadConsoleW GetFileSizeEx SetFilePointerEx SetStdHandle FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize FindNextFileW

gdi32

CreateBitmap CombineRgn GetKerningPairsW GetTextMetricsW SetMapMode SetMapperFlags SelectObject RemoveFontMemResourceEx CreateRectRgn GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps DeleteObject DeleteDC CreateFontIndirectW CreateCompatibleDC SetBkColor CreateSolidBrush SetTextColor CreateRectRgnIndirect ExcludeClipRect RestoreDC GetRegionData SaveDC StretchDIBits CreateDIBSection AddFontResourceExW GetGlyphIndicesW

ole32

DoDragDrop RevokeDragDrop RegisterDragDrop CreateStreamOnHGlobal OleUninitialize OleInitialize CoCreateInstance GetHGlobalFromStream

winmm

timeGetTime timeBeginPeriod

imm32

ImmReleaseContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmGetContext

gdiplus

GdipGetGenericFontFamilySansSerif GdipGetEmHeight GdipGetCellAscent GdipGetCellDescent GdipGetLineSpacing GdipCreateFont GdipDeleteFont GdipGetFamily GdipGetFontStyle GdipGetFontSize GdipGetFontHeightGivenDPI GdipDrawString GdipMeasureString GdipDeleteBrush GdipCloneBrush GdipSetMatrixElements GdipGetImageGraphicsContext GdipDeleteFontFamily GdipCreateMatrix GdipFillPath GdipGetPathWorldBounds GdipTransformPath GdipAddPathString GdipAddPathEllipse GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipGetPathLastPoint GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateFontFamilyFromName GdipSetClipRect GdipCreateMatrix2 GdipFillEllipse GdipFillPolygon GdipFillRectangle GdipDrawPath GdipDrawPolygon GdipDrawEllipse GdipDisposeImage GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipDrawImageRectRectI GdipDrawRectangle GdipDrawLine GdipGetDpiY GdipSetPageUnit GdipGetWorldTransform GdipTranslateWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHWND GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateSolidFill GdipGetImageWidth GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipIsVisiblePathPoint GdipGetImageHeight GdipSetPenDashStyle GdipSetPenColor GdipSetPenLineJoin GdipSetPenLineCap197819 GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipSetLinePresetBlend GdipCreateLineBrush GdipDeleteMatrix GdipSetSolidFillColor GdipCreateBitmapFromResource GdipCreateHBITMAPFromBitmap

Sharing

General

Malware Config

Signatures

File Explorer