camfrog_bot_setup[.]exe

resource	yara_rule
static1/unpack001/help/Camfrog Bot Developer's Guide.pdf	pdf_with_link_action
static1/unpack001/help/Camfrog Bot SDK Example.pdf	pdf_with_link_action
static1/unpack001/help/Camfrog Bot User Guide.pdf	pdf_with_link_action

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource
camfrog_bot_setup.exe
unpack001/$PLUGINSDIR/camfrog_stat.exe
unpack001/$PLUGINSDIR/cfbot.dll
unpack001/CamfrogBot.exe
unpack001/copy.exe
unpack001/netcore.dll
unpack001/plugins/8ball.dll
unpack001/plugins/badwords.dll
unpack001/plugins/ghost.dll
unpack001/plugins/greeter.dll
unpack001/plugins/heap.dll
unpack001/plugins/htmllog.dll
unpack001/plugins/imcontrol.dll
unpack001/plugins/math_trivia.dll
unpack001/plugins/messenger.dll
unpack001/plugins/roulette.dll
unpack001/plugins/rssreader.dll
unpack001/plugins/trivia.dll
unpack001/plugins/version.dll
unpack001/plugins/whobanned.dll
unpack001/plugins/wordtrivia.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

camfrog_bot_setup.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 45459c112aed9172a8bcc216dd372e241e8a809060a8395ac1da3438e25b85ea
MD5 5b27d31a0ddf02308ea12cdac94f092d
SHA1 be95dd66865efe7666d52a6acb00fbfeea231caa
SHA512 69f3ef3cdc2989cef15291a7b4eb01e07989048384b55dbb7742256899a674249e29d08042900b77b9541e7d08dbd3d65bd39bad056727bef598a85e1c47314f
SSDEEP 196608:e3nqL0jetqGOOF7s4EqASVEj1xej4eWArch00LCOV9Z+4Wyk2/GNSHruMptuR/SR:eXy0je8GOuAvptj3ejUArch0TOV9DW09
TLSH
T179C633DD6BFDA4D7C1069A3CCA9339E8A326426985314911F8687FD274107A3FE2ED70
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

81:12:cf:19:ac:c8:fe:45:d0:86:19:57:1f:f6:b3:dd:20:cc:ca:a1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/StartMenu.dll

IMPHASH a648aeaa164b592c1e8892a10400b5ae
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
TLSH
T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6391

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/camfrog_stat.exe

IMPHASH d042c943a3cd094ad1414aa2544befd5
SHA256 43165b5d365ccecedb4ba6a56166280ccb4853059bf8fd2dee12a14cf40e0750
MD5 5d3b20d031bde7faf58333e097804bbb
SHA1 bb6b3506a7fd77685af72ca1fb208824a6647405
SHA512 c8a00b9c6de59ee9e83cb957e774f845ae4aa338716e16c34b9aefa93fa092021bfa2fbcd07a704305da99b15313780957dda4c3c4177637eaec424d7af823d6
SSDEEP 384:AlThAy1zWsGdRArbKIiO6A09/bpgKFec/lmtvYQvJklOnYPLnBOeMzK:YThAAuIjt0xbpgKFxNixelOa/
TLSH
T142136C5379A09037C9C78AB041A8D6469F37A21117F195D74A6444CBAFB27E13B3E38B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

e6:23:c2:23:21:01:27:1c:82:60:aa:ee:f2:12:e0:ec:49:a0:03:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

5378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/cfbot.dll

IMPHASH cc0528f18927c83f22764a0a743062a1
SHA256 b79417b77b56546cdc103330ae1d105e134b586f92cb3982ed16b7df7050b5e4
MD5 1aa13361dd17854b4fcfc5a4946fad69
SHA1 226a672d9578887039c0cff8a774f503d5b21b94
SHA512 e354b44322e7b7a89674b478b9d1ec25c4f3e126cee72db6ebeae219fbddc97e059e1fffe11916d17c64105bb98331be340a6a89983b11394f01e1c001407a94
SSDEEP 12288:prVr9FCno4AsJjVuoQxj7AZbwCmheoWza:prP4ndJjVuoQxj7AZbw0Va
TLSH
T155D47D117641C036F9AF05BAC6BEB6BE573CAA54072564C3F3C81CBA4F651D27A3128B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

cb:cd:d9:9c:5e:35:75:a1:9a:43:cc:24:88:6f:64:4e:82:b0:f7:20

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

217139

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError GetFullPathNameA RemoveDirectoryA DeleteFileA CopyFileA WideCharToMultiByte LocalFree FormatMessageA SetEvent CreateEventA GetSystemTimeAsFileTime Sleep GetCurrentThreadId GetSystemInfo GetVersionExA GlobalFree lstrcpyA lstrcpynA GlobalAlloc CreateFileA GetFileAttributesA GetModuleHandleA GetProcAddress CloseHandle lstrcmpiA OpenProcess InterlockedIncrement InterlockedDecrement InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetCommandLineA HeapFree HeapAlloc LCMapStringA LCMapStringW GetCPInfo WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapSize VirtualAlloc HeapReAlloc GetTimeZoneInformation ReadFile SetFilePointer GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW LoadLibraryA GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW InitializeCriticalSectionAndSpinCount FreeLibrary SetEndOfFile GetProcessHeap CompareStringA CompareStringW SetEnvironmentVariableA ReleaseMutex CreateMutexA GetVersion GlobalMemoryStatus WaitForSingleObject RaiseException CreateDirectoryA

user32

GetProcessWindowStation GetSystemMetrics GetUserObjectInformationW GetDesktopWindow MessageBoxA

advapi32

RegisterEventSourceA RegCloseKey RegQueryValueExA RegOpenKeyExA DeregisterEventSource ReportEventA

shell32

SHGetFolderPathA

ole32

CoCreateGuid

shlwapi

StrRChrA

ws2_32

WSAStartup inet_ntoa

Name

.text

Size

418KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 707ad20d0945204baba9a20d2a54dc4dfdfb3bfda706dc9035f833c742089370
MD5 bdcd17bd9729c017759746d6ef6bc577
SHA1 88d2f5aa8db123db0deaf55bd568a223c2235ed7
SHA512 71e2865a20267e52f973665e2823ba9ba5f55b7649af3e06404a4ba19d37a0a1c9a594ad57ef174633cbbf59b1f1b635d44bfd48be1926218acb0c9b0c76f0d6
SSDEEP 96:eaok0O+kJDXuylWXlza34CAtP+QCKptwbOrfQXKKGrbo+OiF:ehkDzuyl8za34DFAKf9rzOiF
TLSH
T1B4C24B457459CCA580614A70CFADC6FE19A90D56DE4E7C6BB048BFCF3E7A03A204A024
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CamfrogBot.exe

IMPHASH f8b206608f142e4752a889f15478ecbb
SHA256 5c08d83e5bf90bc9741c95200288c8e79c74097e2165a7b9284ebf70a61a0f12
MD5 b732823d834f751414a7785317486a9d
SHA1 9b4e4625c2cc92869a1088088388345b45c11af4
SHA512 df27e4acf72d531ef593dcd511b88046b2041c6b018f36669e0b11c0d13771f047dbdf55779819b0668be1835ed05dd46adbd93b3f931cb5e2087a819343a9aa
SSDEEP 49152:9kY3oiBjJKyJJ1b+6oq5Kris5kJUmKKz7rT7k+toeZKhby98XuTB0uI06qaQ//uM:KY3xg2KrioYUmKKz7bfZ4yaex
TLSH
T129F5C042FB44D0B6D94B117128BA534BA338B6AA47345FD7EB802DDD9C326C36D3522E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

45:96:b1:fd:c1:0a:7a:8e:89:67:42:05:68:b3:a8:70:9f:ab:94:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1639704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shell32

Shell_NotifyIconW ShellExecuteExW SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

netcore

?bot_apply_settings@@YAHPBD00@Z ?release_bot_library@@YAXXZ ?add_bot@@YAHPBD@Z ?sign_on@@YAHPBDPAEK@Z ?sign_off@@YAHPBD@Z ?register_bot@@YAHPAEK@Z ?remove_bot@@YAHPBD@Z ?update_profile@@YAHPBDPAEK@Z ?get_bot_modules_list@@YAHPBD@Z ?turn_on_module@@YAHPBD0@Z ?turn_off_module@@YAHPBD0@Z ?add_module2all@@YAHPBD@Z ?add_module@@YAHPBD0@Z ?remove_module2all@@YAHPBD@Z ?get_module_init_data@@YAHPBD@Z ?get_web_access_cookie@@YAHPBDK@Z ?copy_settings@@YAHPBD0@Z ?bot_cancel_settings@@YAHPBD0@Z ?remove_module@@YAHPBD0@Z ?bot_get_settings@@YAHPBD0@Z ?bot_process_settings@@YAHPBD00@Z ?init_bot_library@@YAHPBUcallback_struct@@PBD_N1PADPAK@Z

kernel32

FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW SizeofResource LoadLibraryExW CreateMutexW ReleaseMutex CreateProcessW lstrcpynW CopyFileW FreeResource GetVersion GetFileType GetStdHandle GetTickCount QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus LoadLibraryA GetVersionExA FindClose GetCurrentDirectoryA GetFileAttributesA SetEndOfFile SetEnvironmentVariableA CompareStringW CompareStringA CreateFileW CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetStringTypeA IsValidLocale GetLocaleInfoA CloseHandle GetModuleHandleA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers ReadFile SetFilePointer GetConsoleMode GetConsoleCP GetStartupInfoA SetHandleCount GetModuleFileNameA WriteFile HeapCreate ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetStringTypeW GetCPInfo RtlUnwind GetStartupInfoW GetTimeZoneInformation IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime LCMapStringW LCMapStringA GetStringTypeExW GetUserDefaultLCID VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy lstrlenA FindResourceExW TerminateThread CreateThread InterlockedExchangeAdd InterlockedExchange MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetFileAttributesW WaitForSingleObject Sleep lstrcmpW GlobalLock GlobalUnlock InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement FindResourceW LoadResource LockResource GlobalAlloc GlobalFree GlobalHandle GetLastError SetLastError lstrlenW GetFullPathNameA VirtualQuery GetModuleFileNameW MulDiv GetVersionExW FlushInstructionCache GetCurrentProcess GetCurrentThreadId EnterCriticalSection RaiseException LeaveCriticalSection lstrcpyW SetStdHandle LoadLibraryW LocalFree FindFirstFileA FindNextFileA FormatMessageA EnumSystemLocalesA

user32

TranslateMessage DispatchMessageW GetSystemMetrics LoadImageW CallNextHookEx IsDialogMessageW PtInRect IsWindowVisible LoadAcceleratorsW SetTimer SetForegroundWindow EndDialog MonitorFromWindow GetMonitorInfoW GetWindowRect MapWindowPoints MapDialogRect SetWindowContextHelpId GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint IsChild GetWindow GetDlgItem GetClassNameW CharNextW SetWindowsHookExW GetClassInfoExW CreateWindowExW DestroyWindow CreateAcceleratorTableW MoveWindow SetCapture ReleaseCapture FillRect GetClientRect InvalidateRgn InvalidateRect GetMessageW ReleaseDC GetDesktopWindow DestroyAcceleratorTable LoadCursorW RegisterClassExW CreateDialogIndirectParamW DrawTextW SetWindowPos GetFocus SetFocus GetActiveWindow EnableWindow SetRectEmpty ShowWindow IsWindow CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW GetSysColor ClientToScreen PostMessageW ScreenToClient GetCursorPos SetParent GetParent SendMessageW RegisterWindowMessageW UnhookWindowsHookEx PostQuitMessage IsRectEmpty FlashWindowEx IsIconic CopyRect GetUserObjectInformationW GetProcessWindowStation MessageBoxA LoadStringW CreateIconIndirect GetDC PeekMessageW RedrawWindow DestroyIcon DestroyMenu GetSysColorBrush BeginDeferWindowPos EndDeferWindowPos EqualRect DeferWindowPos IsWindowEnabled OffsetRect SetRect MessageBoxW GetDlgCtrlID GetScrollInfo SetScrollInfo GetCaretPos DrawFocusRect UpdateWindow GetAsyncKeyState KillTimer GetWindowDC ValidateRect SendDlgItemMessageW DrawFrameControl DestroyCursor SetCursor InflateRect EndMenu GetDialogBaseUnits SystemParametersInfoW FrameRect GetCapture GetMessagePos DrawEdge GetComboBoxInfo SetMenu TranslateAcceleratorW GetNextDlgTabItem GetForegroundWindow GetAncestor GetWindowPlacement GetMenu MonitorFromPoint GetMenuItemInfoW SetMenuItemInfoW InsertMenuW AppendMenuW GetMenuState CheckMenuItem GetMenuBarInfo GetMenuItemCount CreateMenu CreatePopupMenu TrackPopupMenu SetMenuInfo GetMenuStringW UnregisterClassA

gdi32

CreateRectRgnIndirect CreateDCW CreatePatternBrush PatBlt CreatePalette Rectangle Polygon SetPolyFillMode CombineRgn ExtCreatePen MoveToEx LineTo CreateFontIndirectW GetPixel CreateBitmap SetViewportOrgEx GetTextMetricsW CreatePen SelectPalette SetDIBitsToDevice SetPixel RealizePalette CreateDIBSection GetTextExtentPoint32W GetClipBox CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap DeleteObject BitBlt GetStockObject GetObjectW GetDeviceCaps ExtTextOutW SetTextColor SetBkMode SetBkColor RestoreDC SaveDC SelectObject DeleteDC ExcludeClipRect

comdlg32

GetOpenFileNameW ChooseColorW ChooseFontW GetSaveFileNameW

advapi32

RegDeleteValueW RegQueryValueExW RegCloseKey RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW RegisterEventSourceA ReportEventA DeregisterEventSource RegCreateKeyExW RegSetValueExW RegOpenKeyExW

ole32

CoTaskMemAlloc OleUninitialize StringFromGUID2 OleLockRunning CreateStreamOnHGlobal CoCreateInstance CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize CoTaskMemFree CoTaskMemRealloc CoInitializeEx CoUninitialize

oleaut32

VariantInit SysAllocStringLen VarUI4FromStr VariantChangeType SafeArrayCreateVector VariantClear LoadTypeLi LoadRegTypeLi SysStringLen OleCreateFontIndirect SysFreeString SysAllocString VariantCopy SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy

shlwapi

PathRemoveFileSpecW

comctl32

InitCommonControlsEx ImageList_Draw ImageList_ReplaceIcon _TrackMouseEvent ImageList_Create

copy.exe

IMPHASH 0fb9f05a9e628f0620e24ce242135e4f
SHA256 075e235865d997578e4d1a8110f5901850268e2c7008ac663db1102cff4fab12
MD5 8b09903068ccccb5be1f5f271676f32b
SHA1 3e07a950c1525fb000011580fe59b3bfb7090ac7
SHA512 6326fb2048e1cb1dbde468ea8dc47042143f36ab30ffcbced8300a438a8b1d13a2d20f72423251d6a8e14d9bb5fecfa24e9e2472cbf3ad9f1097f56c83cd9444
SSDEEP 768:AhJxm6njqY+6YMpeNYlkzF+yZDXhffskkarCED8nEt69B6jpCT9aWYN:AhJxuYz5e8kzF+mfEkFgEY6NCYWYN
TLSH
T156435A1275A0C032D0A259305CB5D692AA3FB9626BB481DF379C06FD2FB17D06E3935B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

e6:97:c3:29:63:68:55:bc:7b:f9:b7:96:b7:4b:18:ba:f8:ad:71:05

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

12143

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\projects\camshare\bot\Copy\!Output\copy.pdb

dev/samples/sample-src-sdk/bot_manager/bot_manager.cpp

SHA256 d3782ac6608747c4e9424db7a63a1bd6e953433e4c61d2d85df43061e9f57380
MD5 956f9d102ae82507a023fa1f79bd8ca6
SHA1 8033b5cac9a933b53a7dc3e74f16af0f2382fcd0
SHA512 327c12489025cdf5b0dc4ef07a8dad86723334f1317584c4b7b85101721230ebbcd79d7e7cbb9013afe03cc747b03ae474ffa7d031f7eda276396339a318995f
TLSH
T12F414C36CD6E407687F3D4A433F66564C70B93732B6CB56170BE1D885B40382B29F696
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/bot_manager/bot_manager.h

SHA256 991fd12ea70b8428906bb3bd4dc7b80a463f5446836478f7a51806b1a21c3038
MD5 58175ec6e839a8d03ef2891b12cba190
SHA1 6f68a8d41e0bab61ad7649c014cb64f6b5da07ef
SHA512 554962adbaec389eb928e07924038a232bbd45a84f835439e5245a5417b5a4b0e3d1023e2cf895d86821e114b88a7d44937894b93cc6027365bf64afb40c418c
TLSH
T167E0EC39465E045296B7544F142247A1450EF3923F3DD982347E897D7A15555B0C362B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/bot_manager/bot_manager_item.cpp

SHA256 272afe22171e602c73ebcfd966040e3eb19546f5da0abb53db9a417867ddf9c9
MD5 49180136ae0d9fe67d9f5c958e375cd6
SHA1 4fdb8500c01cd03f75d27a82f8c576ef8d0a29a4
SHA512 8d1e329f29a449d3ee084cb1f778dada176cc5f96b6ccf0db457b8b5fb463d02271bac1d6ef10c8176ada308cc153d36b94448ddef4d5ed5715ab21ad68cbf4e
SSDEEP 48:qDnmgmLbG64jn488rjYmEIFulMIPEKgo1xkCDVCRKMZZ2qIrKGyMC5zkClgnFen/:qDnmgmWV48uVNKgOrKGy3zkClMihbS+
TLSH
T153E10F437DAAF47258BBF05923711001C60AA3E53B78B3B4F09F14945B2189271FFAB1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/bot_manager/bot_manager_item.h

SHA256 c20d72db69cbabadf4edf2db8958234e298e0cb3eeda02c25b159a1b8e9b0370
MD5 2b8766603003e2b9397b3f86515c1d4d
SHA1 ab761012406aab49bec26c1cbfd7c9d4e7ba3f54
SHA512 e07fa8eb6cc04729fd5cf3f495e9dee1c3dbc2150367ad8f97e0026aa964a1b26cb6dcbe25659af5fdad2166f94f1dc38cf269e203e07c94e3128a596156c8e0
TLSH
T1E621AF805AFB48A38CA9C0EFA57222515805F3613F34ABA6307F5858AB15B12B08793A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/build/gcc/CMakeLists.txt

SHA256 03011f9de869f92050f97c3dc6e6ba576c3f290645bc945dee34b72ff60b06d5
MD5 7936b23136a00a75c32890f24f64ba99
SHA1 c5f631dd0edc940e63d2e4b439f75100f9572bd9
SHA512 55b6d777f7867c5e52118bb0b234f3f9c0be1d9409c31036e4749e7f3fad5405b159e1b062291ee6d04107a9e05e54167597769b508f00817005c8b9e608ceab
TLSH
T105E0ED2B433838521C6B6A22350208C46657DD136FE8BD0479BC9BFA2B832A57861279
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/build/gcc/do_it_debug

SHA256 337e88ad4e190e94f8a5b9eb9ecb26aebe3fe460d0ecb951217ec94cf87f0aca
MD5 5664df02ee4fbc923de17d21441cd319
SHA1 4543bd17bb992efc387bffa4cc0df1093ab05ce6
SHA512 3b32befa57eda493b7d7d30d6b6a2c5db7874f0e99489646d98124a92b04f909844f64b749fb5b00debc96c6e5d84c6d5fb1a19ab8a291b291ac1add6333b54a
MD5 SHA1 SHA512

NSIS installer

installer

dev/samples/sample-src-sdk/build/gcc/do_it_release

SHA256 a4c83199fa91d6ae678839ca71a1941de7160b953365e942dbb9e7fbd9be9819
MD5 4b62309275abcb78600546d95d22c470
SHA1 aeb458c9155feec175c04c24b4eba104d23e0163
SHA512 971de66e9caee442600f7dcddd39380ffee51068ff8250fdf830b7407a7e05f05abdbd357cf72d8d988f4f374ea8bbf808c657aa500148a22c9439ee29b19e2e
TLSH
T11E9004515F103C411500C00171C355F45F105D35174517DD03F14FC537CF1541447401
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/build/ms/sample.sln

SHA256 a21df2c5add75e8ab29e02d800173bd86ecddc9f0b288a7c2361bc22a03acba1
MD5 9a524909be9161e1055dd1bd0738a5f2
SHA1 95c0aaa409ed4ca77233cce90d092021853f2bde
SHA512 1fed499c497f3d1b227cffccdda45faaccc72725342f213f1e674245cc9d879c4d45da9f90baa8277eaf83e8a8a4a74292bdaef5974bb4a4d10b10da7138440c
TLSH
T1E2115C94203E6D9755472A5FD6B85DE27E378382C55D493C0595D0C8DF7AF42830B4C7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/build/ms/sample.vcproj

SHA256 96640317c3e0ac4cceb7db600351fec899492c7fb343880c1df3c384e7844a31
MD5 74d5a32d3393d6c356cc7dc222b8089a
SHA1 86fa569e5237d15d49a59d939288b9cce7fda816
SHA512 be39a26495aced6ef421e2106a53bb8d9d3747268a0126b40d9fba85a4895b9a4e41d59bb189548ec3ac07d40ada06d40879bd1fa74bde2733f31c363527ba22
SSDEEP 48:c1wL2c2qagmKNEkypkETDMyMsdRUjwl1gmSbl6uBWTowCnxNlYqew/dFQc2qagm9:jIq9zOttgFrpCoQq9zk4tzXeECoabI4
TLSH
T179B1BD55331C3ED652D197932EB618C43B1ECD9E061D41FBC16AB87AA58F89933223B2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/defines/defines.h

SHA256 d4c280920519ea3053ced9ef574f093a3b66cf156356fb8c454c7b662323dec6
MD5 124d2796630f3caf383be018042effad
SHA1 fc69906623eeab2010dcd5b41ae6b18f6005569b
SHA512 f2a5ef66f0bf7173c2ed68cf3a283a5b98aeb2b1115c2fdf7270ef88409e05b702bc47b6f3d793eb234c9bc794d413004b1547becdfc54a2e4d5540963e43f62
TLSH
T18301885F1CC5A0E214B8719665089129A28EAEF719D1B4C9B81D7AAD2D20C0867FF7FC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/export.def

SHA256 1564d0eab673b5562186ff36daf373eaab0499f0c6f4d1dd938537fa1de1c2ba
MD5 b418686096a8b31c545b168003a1a814
SHA1 3a99b0ef0554f344d207dfb2f1631bf21bf6fa1d
SHA512 11c62031faf840ea6acc5205b940612f97ec1d33140db11c156b64d90e65f662e2f49373fb90d622192c5cdfa9635a54758bfa327bb43b6e5291b7347d68cf35
TLSH
T14CA012488C0508DE0C700A0200744180253513551550E0353C18150BF70000832C2348
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/exportd.def

SHA256 ec5ca1f90b534c448e310e64c31b7400b6afeda328649fad8207bc2311a15505
MD5 236a38dbf1a82cbb50594655e85b417e
SHA1 773550d9e4f554d264699b9be8680edc08f36dbd
SHA512 80aeeb3762cc6b8fd2ffc443c6ea29b2942f67c026009cba55b87fe47918db620d407e797a131aa5aed06a971fd010c8522efefbe81dfcb82062899adafbe31d
TLSH
T178A012188C0508DE0C700A0200744180253513650560E021BC181607F70000832C2348
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/resources/resource.h

SHA256 039edc6cb9db50a10bbfcacf3342909a248398d92f52e0f3db16e525d7283f70
MD5 0c83296c5f6f2c11a3ab870f94019265
SHA1 9391d41d4724927810cad0629820e8db07446cc6
SHA512 8c0216d3657f520d1803bf124fad010b7fb91b1eb74021aa24afaf415c1f143edcf7f5a43d2a1384bafb9a958a3caae33ac679c4becf65b0b6f5b9541d9ebe1d
TLSH
T197E022398988C02B5454F0C200012417495CFDABA6990B7F32CCB4ECEF2A8A502CE08E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/resources/sample.rc

SHA256 7aa06f9ac880bd7fbc51ebdefe7a37c7e1e36ee57ae76f863ef0cf0e4f8c173b
MD5 e7da21cb51c37a2d2410b3132a56c2eb
SHA1 1e44c457f428a2a7828fbc76c158383746bb2859
SHA512 d152232635b9cb677c4dabc138878a3761932d6600f16c60bd8141363e0a592ba02861f47f0d1bacf19ec8c0366139f5400e135a32f69713a12ac27b70418942
TLSH
T11B51F1A3594501770530B3F16C002D97E3ACA39B26A24918B44EF4E95FBAA1F038DDAD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/sample.cpp

SHA256 4365cfc4acd9d1bcc6599ff3d231ea0d83c2d78dcbc3e4b29e055f1776b45ee6
MD5 0255dcec32cd140171f6941b0ddfb3b7
SHA1 a9c5dc0402b33ae3b8e591476c77b61b03e97f6c
SHA512 83f75942cf30cac81eaf1621b10b79493fdac6998015504b750688b74e013d6e72437a13f1be10f7a34caac2d5289d4510a8ebbe5524f7de245fc8c824545284
TLSH
T1AE219215942D00235DE755D1303358618549F3A26BB4F5A0F8AE78CCAF750B6B3EF266
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src-sdk/sample.h

SHA256 c2d92e1456f412bc610ad8edf15b2a9d9e13e1f6a01e16d4ec553569e4830837
MD5 b696101fe8617873ab611b78e8e22938
SHA1 cd611cdb339ed64197e95674867a90e02637a06e
SHA512 d0b51babc1d57af2212e5b0ddaa7fed383002559301f31341d18401ccb8eb5973c1261fe3297787921ee1215ec13226321eade8302b9f3be9cb85444c7264129
TLSH
T1F8F027714C4F142300FA756A90A007A2104FA3E29A31E90634620896FD5396162CB72C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/bot_manager/bot_manager.cpp

SHA256 840c8b4625f1991c25ece659b9d6e7ccec7ea072d6491e724ed4846e17c4ddb0
MD5 b4001e9dc6cd849e7332719c1f888ff3
SHA1 77bd15c8ede3a39f84adbd33aecb068add01113b
SHA512 57c97a0f9eb32a4ee6d923daec2fdb0c57f8cf5a42f0982496bf8f6ace87788c8b20103225b210976a0e013982d2a11f3a0148083d38139494768a8cf8407cf0
TLSH
T17D51018355AB78279BD73AC226B608029D05E022B3FC7EF8F09E0868B4A205571F3565
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/bot_manager/bot_manager.h

SHA256 527ef1c7c310237b9bfbe8fe266993ee57fe6cdc29489cf71841287c638bc002
MD5 175ca02374bb2145d58481c393e56551
SHA1 ac6709184b5c501c17b49a65dcc58c03b35e157f
SHA512 b8b0a99fb4da73feb95d21355ef3f152d4b5fdd6380f323723e56869e7f819abbdbeb4ae0e7d6423a28f2edb815912f73a97899d5c0a5c24245f996c3b5ac7fe
TLSH
T1F311C08182AF78518DD75AC67A7718026440B111B7BCAFF478A73CAD90A748370D7B29
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/bot_manager/bot_manager_item.cpp

SHA256 15ea5847bcc0df2b52d1ac2d565b773207824a2dbe6b65a509339b7c474980fc
MD5 584d0965b90129d22e67643f14d46479
SHA1 00eb5ba6d45d5340f8c1c9ae26c780f203956531
SHA512 64a0689c77f5d3e6ef4446a8f38b363a7a5df4ed5bfbd40dabef08375f2f8f3961d4d4460fb8481a2315ebd626e4061a135b090adae2b8479d270559bae4b846
SSDEEP 192:hiO/HMYmTD+9D/0b4gFg5771A7dVgx7dV4z77GhL1B:I4HMYWDEP1B
TLSH
T11ED1728774BF793A1CD3A84564711107CD8CE2B567B8B3F2F88B5490A0B08E693F56D6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/samples/sample-src/bot_manager/bot_manager_item.h

SHA256 ce53a9ea59d61c405dccc8b9cf9d0bc83983122c145b2f2d2ade2019d9ea9d1e
MD5 9f56b47a4a771352ec2254c26f769c77
SHA1 6d36cccb40fe47455faa6fbaefaefeb718e7733c
SHA512 ac09ed7fdebd2782fa548b955e0e9667281b9a14dc9d043c41496c76a49c211e5830f971ec927ce4ad6242afa157454b3ab6c60be1d9f3011c07a47bedd8088a
TLSH
T1ACF0498352AB94724DAF9597B6F309035C89A2817B7D7761B8ED2CB880130C171E7A28
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/bot_packet/bot_packet.cpp

SHA256 0c74fceaede077a4fa9c039a87e7ebd8800422edae32945c5f2b26cc9624adf3
MD5 c1597cf193cabaa5d4e935d00e0c9b24
SHA1 2c891744d2613b541b8bc1024e53d3fce9821175
SHA512 a7c879b2ce7fe2606c437756675cde43de3659a32769afca320c3c1d82cacabf66f5964d2964ffc88804d763a92d8e5aa2fca579f73a69782cd53abdcc525a4a
TLSH
T1EC819BDB30A7A07ABAF79A4A03320900AC5D28D673F477F9F0994548B4B1CE5E2F6546
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/bot_packet/bot_packet.h

SHA256 df11d8a6202a61b80f649ffdb70689be123e72116f0ace6695eb54443a2b08f6
MD5 be922b1587e619a0934b5a44020277d6
SHA1 65b03b648fc72bb11ccd82c0797789fa5f85af4e
SHA512 c69548a5fcd518f4c9405a0b7ba94808f2e001aaa9c9856c6e9f00bc144d55ffadc00a05cfcca7769b2787c6d291633df8fac2d989805def250f04b1e0ec55da
TLSH
T19D1122B9646E62F374D74B4A45731D02BC8D11C0B3EC1AE1F5BE549860A4840B3D6528
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/build/gcc/CMakeLists.txt

SHA256 267e8c78bbb6979ab2b0f71a54f55e5f91f71f991793be67b1beabeb8e6fddd7
MD5 e0b2bfcfde149282b84ef4b274c9833c
SHA1 cd318a6e6bad58057fec59b3e314634fce1522b5
SHA512 f71282b6cd62a740760b147425156dda307d7cc3d59abaac1075d121287cfc2f2a2e2176e4dd76bfe7f71539d178d77e486499b891b545d69b713b5f1197efa2
TLSH
T1DEF0BE0B46B9F052AC6F2F0225020C909386D813BFE5B90CB83C067E6F824E174899FB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/build/gcc/do_it_debug

SHA256 337e88ad4e190e94f8a5b9eb9ecb26aebe3fe460d0ecb951217ec94cf87f0aca
MD5 5664df02ee4fbc923de17d21441cd319
SHA1 4543bd17bb992efc387bffa4cc0df1093ab05ce6
SHA512 3b32befa57eda493b7d7d30d6b6a2c5db7874f0e99489646d98124a92b04f909844f64b749fb5b00debc96c6e5d84c6d5fb1a19ab8a291b291ac1add6333b54a
MD5 SHA1 SHA512

NSIS installer

installer

dev/samples/sample-src/build/gcc/do_it_release

SHA256 a4c83199fa91d6ae678839ca71a1941de7160b953365e942dbb9e7fbd9be9819
MD5 4b62309275abcb78600546d95d22c470
SHA1 aeb458c9155feec175c04c24b4eba104d23e0163
SHA512 971de66e9caee442600f7dcddd39380ffee51068ff8250fdf830b7407a7e05f05abdbd357cf72d8d988f4f374ea8bbf808c657aa500148a22c9439ee29b19e2e
TLSH
T11E9004515F103C411500C00171C355F45F105D35174517DD03F14FC537CF1541447401
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/build/ms/sample.sln

SHA256 a21df2c5add75e8ab29e02d800173bd86ecddc9f0b288a7c2361bc22a03acba1
MD5 9a524909be9161e1055dd1bd0738a5f2
SHA1 95c0aaa409ed4ca77233cce90d092021853f2bde
SHA512 1fed499c497f3d1b227cffccdda45faaccc72725342f213f1e674245cc9d879c4d45da9f90baa8277eaf83e8a8a4a74292bdaef5974bb4a4d10b10da7138440c
TLSH
T1E2115C94203E6D9755472A5FD6B85DE27E378382C55D493C0595D0C8DF7AF42830B4C7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/build/ms/sample.vcproj

SHA256 8a7b122455a23aa681bca838d0f1606bd789019b024e5727bc34dcb3f62b1522
MD5 a8414cb1ef8ba0f443d27679309fce76
SHA1 e37bb3ac1885d4908f169dae62a1cc9216d6c380
SHA512 4c80327b7b74f4f689fda6d8b059af8dcbc6762550ffe4a4b413de242a4f4b0f7dc05afc5b4210c451a7a290ea87a22e37ddc1bdeae1c2dec6208f2985c42e3a
SSDEEP 96:jIq9zpttgcrpCoQq9zp4tzceECouBGbI4:bhpt7rplhp4qeEU4
TLSH
T125C1CD55331C3ED651E19B932EB218C4361EDD6E022D41FAC16EB87BF58F8A923113B1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/samples/sample-src/defines/b2b_proto.h

SHA256 a12a3837f3dc645224be7253cedcb185d79784ce2e02e83addb6cbf757d04436
MD5 c9c4635b0d4dfd1b971da78f2df1f785
SHA1 eaea30ec4199f71a82d35e1f0b2e178fdc8bca23
SHA512 f91f8c64a76e092d8ddcdfffbdcc3a8af1e7aeef9f53975db56e47348337893f84014367d10f3f579bcc73d5c563ae7aa408642148c7d1088b3b1036175d8d0d
TLSH
T14C11290B4FFEBA7A042908034CA45222D4C172514B7453B5ECFDE85C156180154B698A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/defines/bot_api.h

SHA256 0f2a2019dc7b2eee8e8672301508a370f024656338d801ecd1272928beec3172
MD5 813e7370414abc2668d231b2efb29a40
SHA1 d9bee759f13fefe0915b5a5bf81302f5f9b8b822
SHA512 038e8a2f92dc1f86056858576f72a859f40cb9019de9382b581a380465033da79729c97d161560e5998994461b8b501e16d7bbb27d95dd51a3fbeeca7e1800db
SSDEEP 192:LfdP9AU1r6bk6ZMcmWUVLo7Yk47VhslxqA9:v1r6bY7WUCYk47y
TLSH
T12922320A1FF2B635096912132DB90023E764B4551F3972B8FC9DC83CB8B585665F36AF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/samples/sample-src/defines/defines.h

SHA256 2580c9a35b9e67bf1562eee83cc46d764d1cc70f779f6408725afe5004e28340
MD5 bed86126c0ada5ad0474f8f44fa74fbc
SHA1 1994b05f8c0a2d752d1a168ab0b599a4d5b1bdf5
SHA512 9767f35f19f0178c489325bad8a07fd5028c6c9b7091da22ed036e824f309b94bdb1987399f48f0af49c6d12e8973376dc382f623c0989eee3d4c957d5cbd029
TLSH
T1B401885F0CC6A0E214B8719665089129A28EAEF719D174C9B81D7AAD2D20C0867FF7FC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/export.def

SHA256 5a32b22ca185d526e6ae49b05d7467055d671e4398356608113d75d0c3abb4eb
MD5 beda947ff79b7e756f45ff86846c50af
SHA1 927fe67bc5629b54932807f6e876433f1eb442b0
SHA512 b36e8c5c3548004b5284b986f8a2baae1b248965a80dd625d8822c504731368b11bb3be847dd12c9410a305109c668e8628d8bd2a3d55762a738a2a7a5566373
TLSH
T176C08C048C021CEE28B896221838E181423134149E707824AC080D0F7A804A072C4708
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/exportd.def

SHA256 765d8aebb9d5492f933efad7a2bddf09961ad0927078277015c2621c58e15828
MD5 31712b99c2a2eeca1f9709d05ebb4f40
SHA1 20418724c9e04aea1c3e4a5b87a08122ae7d22d7
SHA512 1f3cb7c1353bcd99e6d737c13d1aec74670a1cba791e13649dab935cea0432db6a6c6a188bb38a9f4625e5f84b63da69663419cdf3a520e75cefbee9912881c3
TLSH
T160C08C048C021CEE28B896221838E181423134248E70B820EC080E0B7A8046072C4708
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/resources/resource.h

SHA256 039edc6cb9db50a10bbfcacf3342909a248398d92f52e0f3db16e525d7283f70
MD5 0c83296c5f6f2c11a3ab870f94019265
SHA1 9391d41d4724927810cad0629820e8db07446cc6
SHA512 8c0216d3657f520d1803bf124fad010b7fb91b1eb74021aa24afaf415c1f143edcf7f5a43d2a1384bafb9a958a3caae33ac679c4becf65b0b6f5b9541d9ebe1d
TLSH
T197E022398988C02B5454F0C200012417495CFDABA6990B7F32CCB4ECEF2A8A502CE08E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/resources/sample.rc

SHA256 157f45ffac7d0abe1b864a2105579a92a7805b9d775d3e25d8e9418d5953e40d
MD5 bdf6064d46fa55681a21e32fdb3b4268
SHA1 baeff747056c1907566db4f05aaae89215ab6e90
SHA512 f0c18ff7b6df5c4f16f3948ee6060ed7d6dd42bd03b53821784cb4d8d6f65c8001484ee49d237ec5b9e2f668a32d645b2099a18158c3f50b5b2feabb56125f74
TLSH
T10341DFA7494541334A31B3F26C002E56E36C535F12A2191CB14EF4A95FBBA1F02CDEAD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/sample.cpp

SHA256 cccbff0745459bfa4a214e83b0290034ac0dcb58cd1b550f337b799b81320c4e
MD5 c11637f73c0dd48e8674a46849606f24
SHA1 276be1c53fa1bd48e1a3958dba745a35d1f39e50
SHA512 5f1b9a70eed12d1147becee967168490803f14e12ac983305284e0e1e7148ecd2beed91473e2046d4c6f58a73ae052422f0b3ede90d8b7958f7f6f2176b3bf6e
TLSH
T1DD41E142742764533EF6B3E6313768008668B11223B9F4E1F5923899A8F04B7B3FE395
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/sample.h

SHA256 81c2cdbd9a8611b4ec74acb7a209a79fc73277c40bd8bca61c4770674a8a753f
MD5 8d80309a69a46561000664c3f231282e
SHA1 0dd35a2f87d1eed1f9891593ba21ff7285603205
SHA512 3003426b8796d028a949787044dac3ae889f44d1975b00964471ece9353ac0a8c9195c9a18964c41afa5f0dfa32a0b8dece3a1b217b823e3d927da9625887675
TLSH
T1BE014902A94B2C5199F7676CEDBB2111A0F03092A575FD17B0873ED688FA40372D3B2C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/xml_interface/xml_interface.cpp

SHA256 c3f4bfac38e6793c374a645c800ac30314bbf7ff130ecb2e2daea7edf358ca62
MD5 7f462628c50f9ffe56fcf72cbe860e21
SHA1 2a9c04d55192dd4bf860abf3dc92490a31ebb23c
SHA512 599eca8867fe08c83f32a0210b8773966b32d486878cf6d16c7eb94d3d8f1b352ebd24374acb74c9d3b73dc97d13456977861f823acc9ef8a43e41f1e17f6bef
TLSH
T19A610CC276FAFE2CAF821082A87A850A8C5DC571126475F7BC9E18A4C1F0858717F362
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/samples/sample-src/xml_interface/xml_interface.h

SHA256 c414a15a97b3c669d24c7f8d49b88af12ffc1d706d80be53e298ce1a60376be2
MD5 bf77738e09710dfa10d533c79726b592
SHA1 1b247dbcbe0aa6bebcdbd761d4240af881ccc0ae
SHA512 b2439cf6ac46cd91e0dc4b12db2d5e182230b93aba796dce4e85a3d31fb1dc95d34e3af91bd868ff1c11074f19db3baab8406980ddf2a56ffad9fe8f19c9cfce
TLSH
T15DF05C5151FBFC688DD7302FB0B11D032899F8468B7937E1F4E798285911353B079439
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/lib/ms/vs_2010_express/plugin_sdk.lib

SHA256 9cc94a2a59f111f69275f3499fb43ac393cb16d5f3520d26e1babb4d28be2cae
MD5 658fea4d30205c6312ebca7839f586e9
SHA1 e0d3505874526d71dfb91fa86046b4388594f88f
SHA512 28a2a4f6aaee9dcf47fe13c4bd238b2621d70a7b678ff33e5dc202dd993e1ea725767d1f91e8888ecd9325b8c216b40d8fcbd63ca5438a6c0f91aef6d6369a35
SSDEEP 49152:okc/WtzTv/DwpMTUdq3H0B+5GxardUr+MVm0GGwZMP5OKUMVTN2Mirxix0O/6vF:oqPM0M6Mc
TLSH
T1EF164411B60E85C3D8A673F199C192627734AE92BF05F353A2DEE0221FD734C79A35A1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/lib/ms/vs_2010_express/plugin_sdkd.lib

SHA256 1ce905f0cfe28f62a82ee7358e65777b4fc044102a0d71cc21c1d4500718b80c
MD5 c4baf35d4a24da1f90846d649afe635d
SHA1 9223c5004b35571c0d3b1f449835adfb32f35a6d
SHA512 f5a3f030c0c00da9b1891cb409bf441ad287dc240af69ebb193cd1dd22afbaa6f98b8303094d0823d13c7dd1eaad877193bf172b80d5a8b76afc801f8724cb00
SSDEEP 49152:mxl/SsFJ0Q5xu/Brp47vfTQO2aDLNlNW7yNgxKmSoxIRoPdONq10AgoxVQkkEp7v:gxxIx8Cpx6BS4xq
TLSH
T10FC69831B25E8693D8A633F0D5C6525573306C82BF05B353628EF0272FD735CA6A79A2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/lib/plugin_sdk.lib

SHA256 d64d54f27ee1862560a03d1efa6dfdbafcc05a5a1cd50d84fee40b1c578f9fb0
MD5 4969f787e47222c4a21de9263066f3e0
SHA1 6558b07552812db4bb2e536c6f03a0c733b906f3
SHA512 f0902254a1030c89729e50bc5fb15f775c5affa510d9a3083dbcd15979ffe7cf430b92cd5ec4385e29fe07364b9edf864c0a6c5763db8f37fec2ad4c392b178d
SSDEEP 24576:nc35G1lsG3/HGOgecFj/ab+3K/Bbd3Jsne/EbHR/Qoru/3bJhdEJnUX9:nEGb+3Kbd4fbhVAbyu
TLSH
T19A162422F60E8593D8A673F0D9C152627730AE92FF05F353A2DDD0221F9734CA9A75A1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/lib/plugin_sdkd.lib

SHA256 3af87982e9eb93c9f81c366b12710e3d085047036f2093a09509e8cfe662bda5
MD5 76ce016ddd0b0cd26886df8c2a9da01f
SHA1 21e70a8892f6f98a3dfaece78a883cadbe678d58
SHA512 73aef0bb4eb430db1eabc7e468098cb6bb5963a6f026a5753d65af4bddb970a9bd3b8baccfbd1940167021abf96c36d09cfc8f2ce0a6e6b19595e5fb92162f27
SSDEEP 49152:CeK1mb5nMairhtLULFudrORIb/b730hjIrc0FgY+QadGpxIthQHmRWDfu0gwb3IH:CeKcbuRb1SFGf2+Pbz+81XNbMvl
TLSH
T1E7B68821B29E8693D46633F4D5C25155B730AC82BF05B393528FE0272FD731CA6B79A2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/build/gcc/CMakeLists.txt

SHA256 6881bf8a5ffda114883f756613ef7e8600b3e389f6d2ec8ef102c79b62311f99
MD5 5fa08bae50506cc8e3c08fb85101b49c
SHA1 fb8329e1e81ed777782b7183ebeb223c83dcadf3
SHA512 57662ef9f25afa5fe921c1e0c461fcb828a26f310613402def851ec64a2c81fb98562cb1c889719ecdb978b79c99ed97b2b6d7074b431728cf7b3e130c94b840
TLSH
T1A201D37BE4783C4384762F4516502484FB5395C3FF218E017E1CE1399F359948223325
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/build/gcc/do_it_debug

SHA256 a1438877ce3917700d7daf000c5878248c3b47bf0dc79342c23ce79aaa2a47a1
MD5 7c8ed3034dbbb969af4c5e8230116467
SHA1 ecdd52c9a8399d4ee902b1923bfc6796de4821ce
SHA512 0a3b3b9c6b757fb64e5fdd794d2c381aac2f7ab1cb8b276adc878b9901c4682593dc72e53c594970a65a60d0a1d5f4cdad472bf2d68b87e55ec67bb2e02f7565
TLSH
T19DA022B32EC23C202000802030E8A2F02B080CA80A0A0BCE33AEEF8C038F082000F008
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/build/gcc/do_it_release

SHA256 2b66d843aa9a255d172512540e7cbfbeaac2a6e51e49040ca4fc50f0e2a28c98
MD5 02783bce0b803906a31541ae662a4d53
SHA1 12b26f06011b4f68602cc178747a6ed96f90a390
SHA512 c5e01537e2874151e1a3575bcf538a17ad0819a6c66530ec0397012efcb14a61e5c2454c45d6852763f7f548752de52e3da97a608a13e448e4a8d1e6f5529e89
TLSH
T121A022A32E803C222000800030E2A3F82F088C280B0203CF23AEAF8C338F088000B008
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/build/ms/plugin_sdk.sln

SHA256 024191c5cf1bfd91aac6941ddafdd215e8daf1ddbb19123ac346cfde24a82e2b
MD5 5eb1cfc468c14343c5260ab37e14316d
SHA1 fe7ac7d93557af1d53dca92eadb0f97144571329
SHA512 567eec5bc535d411bd7562fc09232800952c164963e681487049d2ac43e897156cca379232a35c5625a544174cee0c30babaaf6b5f34432f8a5a024c1a7dcb47
TLSH
T1B9119568202EDEE46A835E1FC2B45CB77C7B86C0C14D693C1474D0A8DF6B780924B88F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/build/ms/plugin_sdk.vcproj

SHA256 e2c7d5a1ab43b6b839e116d15559079611a0eebd5c522bb1a267e6c6e5d59184
MD5 bb7cd063a2cea1409b29b1c893f89e26
SHA1 ee5f59f0211b81bba082d16b2cf8921f4c782c07
SHA512 5fa36cc975b1a3e96df64d0e7d92953a7de2ac450636663d2a754936648dbba0e93266b4d90d154da2f9e1c16ed05d754486530d4a9ec07fc6886168163b4741
SSDEEP 96:nrzzHlfqReaXzNb5oheottL6AmD6AIJZXavdbI4:rPHYHDF/b5F
TLSH
T149F10CB1335C3FEA60F09F932AF42AD5351EED9D125C80F6801E787BA54A9A097213F5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/conf/config.h

SHA256 6bc8f1b9ed6cc048183cc07e40c1cf86e08ee9a3a86105bcc2d9bdf6c826c665
MD5 cafb922c6ae1b1b05ecd2581a2120a4f
SHA1 0803645bc9a5357d4034d2bd31e108f7b4d82f0f
SHA512 11f3ac23c03e33f6b637522a0940c475fc7ae126ad7765ad70d8a2d0085c2ea82d8436589f68830aa5e3179cef71754832c2aba90547729e7562c81339f85ce6
TLSH
T1D55131B2FA09D81B239321D183384C40DD6892A5F37874F1F0AAA4DCD435C22D39F1AE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/conf/config_file.cpp

SHA256 4ac6c297acc8585f9dc1af29a6ed49d6631e77d6f76c9cb902a39e70011eb1bf
MD5 02c8ce7db5d9f6e12b662a59bad0af72
SHA1 2c508e106431db4c130123230c19e939d63fb1bd
SHA512 fd26d63185d39882f37dae1a13342adc51ae9d0b54eafc44d76c11cf0a1e8a2307afe0266fa5e7564df7e01c9b5be2d986f4636e83cac90d414275ee6d8b47bb
SSDEEP 96:mFeogCkAdoNMD54LjLYPP/Sl0tzuJ7QSsWKI:WgC/ia4jYH/EVF2WKI
TLSH
T1C391F0867F8B61263961E061163C1556CC69B49067B126F9F8CE5188E32100EA3BFDFE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/conf/config_file.h

SHA256 6f72010f297ede4ff06bdea576272b7ab3d956fcb7b5d958ec724d90f29dd78f
MD5 13afa0b1edb8d14fe59dbd246c9750b3
SHA1 4e3bf31d4e4e1d712f0751d496b88076303b5eb3
SHA512 0423f9fcba698adb2c37036638ff83701f8b8938bb37e6e2cf574edef7c8ac3fae25312dd1e6c1d17ed951d683f8a2d366f7090658f9bebcf4aad42baa8b88ef
TLSH
T1563110D65ECA2873C450D081CB321C6AD801A5EEBB159A91F0DFF454A72D03692FF89C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/conf/config_file_load.cpp

SHA256 9526247265e07f694e1fd7bf8511a68c2faf1d409889752c2927e4ce0d0ff199
MD5 1bb3f475a133bcdc803cbc3c7b025ba9
SHA1 13697ec694aaff4c62d2f6ec1cada2aa44094c02
SHA512 630daa7254c5175d9f4895e4c813cf235bc9a67dd4d25c7a671d38fbc304af1151efe6e882432b09f6bb2a0aba5c7c44785d839fca0df921bae838a4934ef8db
TLSH
T10F610F71BDA7A10997D1E15426B40907CD99E462BBB81BF0EA6644C4C834C2E037FAF9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/conf/config_file_save.cpp

SHA256 dcced35dc04648567d8a3fbe3a7b47fb149315a85f6300c6451593d558e894d6
MD5 08e84a057562da5dd059457a7ba36c0c
SHA1 f46ec46fc81ee530d290eb10a45bfecbb136937b
SHA512 23cd1fba22539be551bf4de7b4ca7dd82e80bdeb60ef2d50a9653e7af709b25deef7487f546097122aa4fd26e08cee21f230a859a980d2a88d91129ee73bf25e
SSDEEP 96:Em3HvZG6LOM2VYuVYFOMJVYyVYtRmAzbU6XxCyG3lSX5Wq46SNM9H1TUM914T6eM:P+M2VZVJMJVrVMzXxrmSo9yYxT6Rivu
TLSH
T1F40233927EBBA80576A0F09505796812CC1DE492B7780AF0F7DF5884E3B940A437E9FD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/conf/value.h

SHA256 a074ee9d53bb781fddb4e6889d55b2deee8168ad2483dc10b88d5c1e06a138c9
MD5 051d82938115d8dad656a10d6b377367
SHA1 e18cae0abd337504e6f8a201058b1bdcc647365e
SHA512 53a9b4d2e5cde74ad761c8bd2feccf99506898dc6442472a192fe4124532181a4198a71a86e8ef6e22ebe985253144abe904626c63f92d06e49acde960534bf1
SSDEEP 48:Rn8cqKxaxhCzVqzjdO1X0VmPfu9e6py2dVirQVYVtOCG38aVB/i6VCJJUdVSnZxU:hVRSgfgAQ9CzX4QTE
TLSH
T1B4C18955FE97B4729143C05E57344E87DB59B0A0B77C2FC5F8BB42A81810C1AA11F5FA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/defines.h

SHA256 242c81ad4c4aafceeb2c7ce5fd73d71e9ea7cd44396b8ab67a2948d7d863fe53
MD5 8eeac6755d5bd4b8c945f29b7ed20562
SHA1 3bf0386b950c4d1772776d8cb11106c6eb9752cf
SHA512 5e4c68f2faf01e98062e7bbdcfe827dcb530d90b933ddc87c24611b32917f3f21a58fc2fecd30ddc9d3b9a439683208e7d329a2b2b29e682e381820d062986cb
SSDEEP 384:H5d+suwmoeQlj01B/gNVmBi20gG0g6WvgGXwIgzvgMeqgMmg3g+KgUjgSo3j02Wy:H5d+suwmoeQlj01B/gNVmBibgG0g6Ggn
TLSH
T17252DC4A6FCA2E724A7AB10052AD14E291607673723A26FCF84E3C344F3C9D5D1F269D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/description.h

SHA256 53df7f14ade553d8445e27178c8c7477d447ad2ef18c75d83ca88f2d605d673a
MD5 cddd91bbd9ea300c91b9ab121db89261
SHA1 fbb23b23db7ab224ba4cb3df70f02e32784f8a39
SHA512 a4e4abd07e56984460ce532dc39241e528f12d6381cb7eb366a3a3d637f3e181b333a30818c96442f573391a527d31920b4b5df963cce9b5c9086a10db8dad38
TLSH
T1E3017B4E2DA2E06218AD23872DB55105F334D7C58200EB9CF8E4A4980D075EBDBEEEDD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/event.cpp

SHA256 00c7fbbe806330356b170b6750070163d307085bfaa7bb1f716ebee8b0acd740
MD5 a65671061cfabdba87600af34b1179ff
SHA1 1b59b13ea33f86b92a071b9d7f455eba291cf7cf
SHA512 f29b6cc72a437ad4f902460a81ee1d47584d9ecfe7b5ebe323844097db84c93f78f5aac7b1ce38acd0cde210a87646ad588017382b18db9d726ae19bce2ad214
TLSH
T16561EED07F8990F605EEED9D23705600E43EE3E5AEA55081FC5E9DC4FB11105826FDA0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/event.h

SHA256 7cdd6f575425a6bf5f7a5305ca4cf9df832d91f3c82dd605c91915109aad899a
MD5 9ebd0da3e2060eb8070a8c6b12e9b9d6
SHA1 61bd8e8fb57011b65a55878f0c01472d1209931a
SHA512 5e4f4322c6de6a0a7907ca8c46f6f4bd98ac48d1598345353350989b86121489336432437ea71daff6eff8568404825992c0b7a1260c706fc7c6aa8dcc1beec3
SSDEEP 192:hd4Z24TTxq9oadjD93M6QRJCsn9zwxI//9zly:hd4ZItQX7y
TLSH
T1810241402B88B3F6196F3A4513780952D839D3A73E6D7642FC9D1CE1671921025EBEBE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/form/control.cpp

SHA256 8c2946d7543b855c2840a6cc3d3745de41e65555ac92c14aa7b6b0da533da76c
MD5 b7c9554d0a63c982cff615c4af0b8ef2
SHA1 9ede7778aa88d33712397771316a5371d5588d78
SHA512 73ed7ad0d0e8ef00e576742709832271d4e4e5c72e17eec0d960c1314b204a0545888744aca22e76ac69e934a2345a78f62ed90f0a4efbbb66756305c45d7b11
TLSH
T104316DA53C16E5759379D0AD83705151DE5DA6D0BB20D2D1F23E4CC86BA082660CFD35
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control.h

SHA256 cb18e4538efc8664b90a9372afcad60c38f56afa1862b241ae6db34508a9bb6b
MD5 1be5eba7aec780ab1fe9736e2b6f08a2
SHA1 d72cb5511039c2241f78a6232d79764abca04a90
SHA512 64ee7d34f844e63b50ddbd5af93890d4716e52903614606591f0885706b6f0fdf37e92c6be291f65bdfa0d242a24158f2cee2b254ec8688f5e5d8c94b69c6a1a
TLSH
T1EE8113307653A5A2D861C086C3339156D13CB505FB2FCAA3B5FDB66C2372500C67B9AB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_button.cpp

SHA256 0a3dd63f4591ad5666c94ccd5ccc4284b2d95037d5c6a4d4adb3abae46333561
MD5 3e179e584c132cf59257909fea6acfb0
SHA1 a865572ce1c5f3d0420cdda3e528fecbbbbe2a86
SHA512 7f12e6085c3d5bacb5069297209a53b14466fc56c1ca706ff034a9953aff0d39cab0ddd29cd7499897746fb4d3da94a3f9cce17b6c27fd298753cbbcda237a03
TLSH
T192511ED47E4DA43D95A0E04E11B842D2E9CCF3A0876422A1BE9D8C08F7F0040B3AEBD7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_button.h

SHA256 ab78f3d794b4dcb448795e8679eaeb842d4a0c1f618cb2559847ccbc15bef865
MD5 708b73d842b154f0958a2a78732a881d
SHA1 88be9350548ec9c5e8365f5598a6eea3d34a4884
SHA512 ac2b24f14a86081cc4cfdef70442667d88420fd8c21aa27e039235892010669c85bc930e3f631f11f7b62ea3c19600f16ffdbac1460af384e094f6761a8db7eb
TLSH
T1355153462F607733F9A2E04562371982E531A244B7A3B56330EDFD6C17BA130A2D7A97
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_checkbox.cpp

SHA256 fa759af5930c130539abc987641d31df62ca4ba78c4d706549b137e038a6548b
MD5 d2b37753f83e5b306073a90b2c27b929
SHA1 e55405e1aef94ecf3ce846a8e0b3aac58aca098b
SHA512 a1816b28e5e6531945c32d05f3ec68f4f16808f94c2e6dcb6e81d598b80b0e7c8ea10aca410caf2c08706916be711bb1db546c2ab2b2b8132b21d8b9981a1515
TLSH
T1E8316D567F3A6434E5A0C84E2534CB82E191426117056B71B8DD424CB7F8848E3FF29F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_checkbox.h

SHA256 01b8a7d74544a53bc9c24653299d4c68dc996a6571435287443bd8cac9c46656
MD5 6f62d72a67ef1e1f64031ab8a428316d
SHA1 5e138805cec95aa1dc35650a0da5cc621a00a4ea
SHA512 f7031b238c03b4fd51c8e25e31eac839185cae8c3bad44895e343e7151732448e6b1e5532621e63b27c20b5b32aae857d7ef32292672d9e66748cd50331b5547
TLSH
T1EE41F21B1E646732F871D045663B29D2C5315209BB23F9F734ECF91C17AE220A297B8B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_combobox.cpp

SHA256 2e8853490aa38f5e78710f85af16ecbffcdb083b76914c2ec2c0849cb349825b
MD5 94a50fc2fbe5899fa48b0a18b622cfc9
SHA1 1584198a47302a0cc0ac46332df406bb327f321d
SHA512 21894ac5d7cbd60d9e56f9d0cb6d2688915ef4ab3318c52f7a726c4b3b88a10425f74537681eb5533430b8ae6866a49dea7327276c50cd8d64bfd3ae29a376bf
TLSH
T16B511F963D786432E570D06A63B48645D5E192A0AB752ED0F42E00DCABB1805D37FB33
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_combobox.h

SHA256 62da7c7386f2c86f283468c00075867b00089a90b6a40117cef53e1f721b3cd2
MD5 3a588b57bb2d504c93cab76adc760c4a
SHA1 51289c23f3339d9949f06b794541c9480458250f
SHA512 4f31cc3c2cc7864cb1e73322195e8da4fdecc57c8eac4c57fff0cf49025549f91180eaf131bb5afa0203ce54efadcfe0a13d114c774aa6346ee558c389c424ea
TLSH
T150515345695C56329C728007F73A264290F063E6FB2A6DE3F0AD64AC17F5220E267B4B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_edit.cpp

SHA256 2d698f63caa508bd0eafc2ab2aa124ceac7567579fbbce4dd117de096fc2d0a3
MD5 50f4886529ff7cea88db40a6c4918462
SHA1 cd08b7e321fc8c73c666c8b087a7583f6374b828
SHA512 7196f7e9b9b3069694db36a3e61fbad4b106689d68a23fa27a34c4d2e9e3d8a0db0ada33756e3d5b955a04e4a3bf03474163255c2df96e12b5ded780f8490137
TLSH
T19C2110863E2A6535E2E4C05F26308A81FA48B3E017043221B57C878CF7B0814B3EFB53
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_edit.h

SHA256 37bdf6d1718e4aaafd0bb99f6457e582248af086ecd334e064cb3275f92b55c8
MD5 431f2125ddf85dca5b48622eb7c30cb5
SHA1 93a2a4c3b486c0360ca801e8d5bcb49826383113
SHA512 f3cdd65cdfb244dd7e019d86daf2e1c8eef2fc4011d7f7fc311027d5f069d057048e594cb232719e5d0d35ec3fe7267961115553a0e1d96e73e6925b9fa83c47
TLSH
T1E741210B1F646772E9B2904666371DD2C5342245B723B5B731ECFA1C17AA220A297F83
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_groupbox.cpp

SHA256 f501cc9d10cbb377115a2165e95539b2879b082688d349f537c3b7a78c7f8b25
MD5 83f1fb63b16434990ca84d76abb8fa68
SHA1 f421ebeb487bcc0a3399c305932b4c70e2210f84
SHA512 7d366b39ed3e2cba5bbc045e3e1ec157ec73ae5815cb9bec5fc80bc3ef422a66763d9ddf89fe005c85bbf7ee3568fd74efb9b8bdb2f4c15ae49a6c7c33a37203
TLSH
T1B11199987E356474A4E1C89F2534CE81E284A36287093231789D835CB7B0C42F3FFA47
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_groupbox.h

SHA256 1cedcb4d6cd4d491796464f8bac11031f1cb46fff0806bc4e7a606fa0fa1d3e0
MD5 d0b23a8ee900ed62f6aa8a10876bce82
SHA1 f66d50d9069a73af87a89a09da0d040a6baeaadc
SHA512 df282e366621d0c69671b28722ad94a820a3615e3ca211a25c9d81b6ee5406b5c763df99f81b155c0be96fdccad80085ffd64f2df8e8c5c13156674af551af6f
TLSH
T19521AE265A9067B2F4F4D08467336992C130A505F93B756734FC7B2C27E79128057E97
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_label.cpp

SHA256 7cd34af8b53ef4e2672529588a006e73d1be24d9a931c5188143d11f2ddc1abd
MD5 e671aa1383f4285a31c35929b3236e55
SHA1 967637cbf08b7b21d0c4b595ea9015c3a70763d6
SHA512 1209812868e16a2072c20c43cbfd479686fee9bd546c73a9eb53e4aec9cbfc21ec1e56a02f56b7feb40ee91b5dfdb8ecbd1b445e31bdc114700f64d500a5aeb2
TLSH
T14601DD897E757439D581C8AE2534CA91E584632103053331F59C564CF7F0406F3EE657
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_label.h

SHA256 02bf44f730fd379f6e326ca55cd4b003873a61370ae1d43c816f0fa3dc8d3b51
MD5 3a39a62dbba8672b81d48282344ea099
SHA1 34d0485d0d370806838d0fa963bbc47af55ed230
SHA512 f818c9282b8e60234b9d3541eacd8f2ce852141d046727b34b6649126b0d418b4283b938ce71c1050331f52acb04f18f9a4d31af48915b29166fc8a76a6554c9
TLSH
T1D521EE2559A0AB33E864D0587B326282C035A604F63BB527F1FC7E1C6BE7512C247E67
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_list.cpp

SHA256 ce0e656f49de3ebcb60e8fe6538f6e6b2fa88779a34818f1b41c5f5726ac4e49
MD5 478c57a72b061dfd85e7d664ddeaec02
SHA1 95ecca7ee63b494618e0f515dc3bb00d454fa2f3
SHA512 64169fad1080bb8d9ddb52e4eb514019e9fef5dc7bb0e9422c962cb0b000dd0ba174d3623fd63a8a50a766693ffcc57836312bc6466a2e835262b84f66fe9b89
TLSH
T1B0518C157E367930D6A0C4AE53B4C545D6A2D270674426A0B86E014DA7F4C08D2FEAA7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_list.h

SHA256 3a0a5b9d3e1fe49c2e1ac66bdd4f9869a35011b59de3839c9161fc488b529541
MD5 6df54b11a468f5c85ee695dc948fc4aa
SHA1 78fa41cfd8be471800febb9ec4f595ddc6db658a
SHA512 9985e89feafc7d7f50518aa7a471030c7a27904bf8b9ff096e8d7652f0004b81c5a0d537dabd73aba042218a5fd22255d844750658c2ca40dfa2722108d9532b
TLSH
T1BE3131295AA32E22E8A5D0666B321582C034E100F727B9B671FCBD1C23A7A10D2D3757
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_radio_button.cpp

SHA256 8034db7c2574d78d9ab23baeeefcaee207f55daec49d4ecaa11f14bb528c07e8
MD5 5907531e58f0e02c7281eff665f3e569
SHA1 4f496dd51f0de04cab619ef5b9f94ddad34c1cce
SHA512 f1bc22350cd0009436106d323226e74fc2cbc5714085da4107f211622e3d1d1e857cad1d75d30d1dd677c25670f43da3023507a3cf0ff584ef991fd1b1086c70
TLSH
T109119CE57E267A24A291C86E2935C691E584A32147053621746D428DB7F0804E3FE287
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_radio_button.h

SHA256 5e0448bf30feca92496496b1eb81c37b081c6db70a445beebc7b6b30c0faec33
MD5 ef2122cb30f6db34f2d14115d843523f
SHA1 f9b86045283bd671d68d6d3a2d9acf6bb9ae5083
SHA512 9c47a7e61f7c9c7af57118954cc79c9534ed5ca5f9a85a31e61e542bac6d77f03ac0e06bb47ddcf7da1f1fdc358b22413e54847e34315ef130c8abf64627fab7
TLSH
T11741675A0E242B33F9B1D0526A3B58D1D5357605FB63F47730EDBA9C13A62209397B83
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_radio_group.cpp

SHA256 c70d5a7f6230a986b77710b1b2b50b5ae29d7783088fa7f4f39630a691484bee
MD5 37718edb845e32a1e0ac285553b3ab3a
SHA1 92a9841e29f3578ca51d5bb6ce1db3d4733f48ec
SHA512 b94c39f3d0a15b6f2dbe48411924913bb865d7d82d5e67adf56bb361ea373a6da54a33826aa36267e23bd5322923620852ea520c08571713ec2ad32d52595a73
SSDEEP 48:WjaVb2DxKGp6wSGiXGwhxbE4S4yVtX9AFbyssfR+Ar9RIz3AcThKX:WjaVbyKGpliWwjE4S4yVtX9A9G+my3A9
TLSH
T1B7C1ABE22C55EB36A7A0D0A643378941EA846551B7B0A6D1302D72C8FBE3002936F96B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/form/control_radio_group.h

SHA256 c724a3190e2e519f1a853675ad738fd47ebbc5edb96f7585db7692fd455d52c3
MD5 c0b7efe7b00e3c75f0b5c4bd54b8acbb
SHA1 6d488bb095e68dac72f5e044fd2ea88886e67ee7
SHA512 210c6ca49508e31238d2b047f07abe3e069d2ad32ed66738fbe2b6bea40ecaa905b8eaa1ae2e52d37172eed714d461bec39792d1d68ecaca334a71fe0ab141fc
TLSH
T1585110B16259AB63FAE080C693379401A548B243F33BEA92307D56AC67E3510527FE1B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_spin.cpp

SHA256 3abde9eec3341d0ab1151b775d75fdb18166808c5842891f3458a8aef950cc36
MD5 00bf326152812dcaef86a27359617ace
SHA1 98a7398e685f4cc5871e63f2d339dce3c01bb402
SHA512 bf748c0b8fa9e7f7f51594f269289c151b3fa2912709a668950a319d0e7a1e303db909f675f7b9fc4ef70027230fab461aa57acacd2c7d6db4b6a122aa30d189
TLSH
T1763102857F2A7835E291D25F26308581FA58B3E153143320757D458DBBB4814B3FF796
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/control_spin.h

SHA256 d877ecb255c2d22d9cdec3ffa96ca51d8ffa4d616407778d46a3859c64a3af3c
MD5 eaabff7f9e2ddb078bceef5c34c8f7d9
SHA1 6d7b9cc9ecb7064e896ed1bf27b4fd6cb1f2609c
SHA512 dbfe9611d47aded1bc1f076aa5556b3618c11e1d643d028cef3bfcb8951e2ee66f4fa1ae43be02ab68ccef79dc9d2874cd7e55f2cb67e9b47319c593f2864cc6
TLSH
T1535120452F246A72B4B2A045533765C1C535620AF66376EB30FDBD6C23AE120D2A7A87
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/data_exchanger.cpp

SHA256 373eb7068c4ad2394bfdffd163c2c343dd0a7599ef67acd3eaca0504a875a36d
MD5 c6f698e3f5742bb2e9ebebe12a964ed9
SHA1 32c94408ec585789aee04a4a1c56a4fd14721c33
SHA512 dee6515e3f6f14863a338c37eb7b5bb635ca9d5d7cbf1fdb1b9b7a5d8a857e8c9f14ac2dacbd2f44e757092761adae15150f78b49523fa9fcd2509501c56276a
SSDEEP 96:jaISgmyKZSg/rKiSg/rKjSgzs0Sg1gnATSg1dEcTSlsVMbEYmN:9Sg5ISgT1SgTySg40SgCuSgjLSlsVMo5
TLSH
T18D91FF203C73647B61C6D09C57B0A4C8CC8AB663F7F452F2EDEA18A8D49181910AFF8C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/form/data_exchanger.h

SHA256 72d4971ef55127dd91ce8323b9654af7a78c20a63632fe58bedc7b6678639f90
MD5 205f851b1388a70f493c3f4b8c7c21e5
SHA1 a82c57848534bc26ea31e7177f4a378d719c7bc5
SHA512 7671ab3c953323bad66e37314f529e389ce660134f1c8287702ac0273806ecef2eb1cd70c356563096d624608c095e2b3ebcdcba6e1548c49bb538173a0af5f9
TLSH
T11451FE1076D33D37C8C8719B97F57082A58CA980F7619DA0B2FEECD81142C20B16FE29
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/form.cpp

SHA256 c56fe730c7c2dded7ef0c4050b026c4b8f92fa5533e451adfc6721948a69ddcf
MD5 1ece12c88c6888237d4367f146299de2
SHA1 2c046e6a8cddc2961c8d73e07b8d071a17ddcaad
SHA512 93565ea32f3574ef4e22607249c482ec7c009e8661c1ebaca01f4696f7b4f329bfef164b9da521c0878ff858986b3db49d1ee4e1ffdb7485b9a63595a236a191
SSDEEP 96:DavaIJ8yecOGAyUk7eReuAfC4PVPz3w+w5VPz3PhSD6eXAdnIeOEIelBeIfV4Y:qtovRQfCmJ325J3lzdnIxEIev
TLSH
T149F1CD562C319B7265E4C5AD1372DAC8CA11E613F3A642D6386D95C4BFB3003823F9AB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/form/form.h

SHA256 9e0e8278b60d6e3c8eaf3198bdf73a7c8c324527527c0a89aaa3c4eaeabf3bbf
MD5 43e6d150bd31699a28eb8dc1ca82e38c
SHA1 ebf5c63e1c96b2915ad204717fc19eb8a95db7e5
SHA512 725fd99a85f8f045adf3b6bb36c6798bedc73eb197fb04fe54385d260e35710db1f4ddf1371f64c7afb5f12da63abab2bd469abc2bb0fe749555919b53da7c71
SSDEEP 96:Ln72r/ePb5fKA4cFrRIjuA72V4iGsyO15s78FvKlDbFBs29w5AdCp19R1cGS9RzY:M/eVfKcFrRIOVb1fqDbrVSzRCGSvh+
TLSH
T1F2F18716B68B9E638C618145D3726243D768F205F33AFF8238FDA83416A0551E27B74F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/form/form_cfg.cpp

SHA256 856f41ddf42b2233ca90ee9b6ef59634846ce16fbcd5cd27330560eae6096894
MD5 e3b1f5e61bb89b6097f374b5238e15fb
SHA1 952f5f411f564ad3d49949d935da999ad8405249
SHA512 8e75e75c3072d01c940fcce8e30d8d34d4d859ce1e15f10baf3c670e0a553fbcbe807624efcd342beb029bbff404cf558024efcd66e54f84adff928fc41b7666
SSDEEP 192:7+CgqzMXsoio0ZWoLuo+QIzGQon/1Jb+WLrLlcODXUpdInEO2owou:fW6mBUd1IpdIn6
TLSH
T197624251BCAEBA296FB4D2152EF4E900DF0DE2A1A37406E6F89F4140E734411527FBA6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/form/form_cfg.h

SHA256 c610e1b8556af2d8e33820da42efa85bb63dcf27acfcc5fc02a33ada2ad11c2d
MD5 6011566a7be369b22f5250bd0d79b35b
SHA1 86004862d3a8c755038b80c57fb1114c7eacf532
SHA512 5d31a26393b9a6921223af5a4bba4f77d50e60fad3b4e07c24c67d7d464076af4b8560e30ece740ea95501b8199834ef0df80ef25beb536b01e50bbd80f3f0b0
TLSH
T1AD61E094F0CFE851AF748B4395FA0352DB887182B3195EE2B9BD4A28733115130EF76A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/form_dialog_file.cpp

SHA256 d3ecd4b0b3d083f0e17b4603bca10769ae239e870930c36df6966cd721015553
MD5 00331db1bca7e9702b856f1142e99da2
SHA1 b358b222e158d69aba335a9c610c9b959d8ca199
SHA512 65af65e3dd9bf690f279d39598ca5fbe8b69c1e265da1c4f17a0cb49e617448a91015a195d21d32aa75386aebf50d8d8f26954dc26a3fb36290c3aebc9d3e73d
TLSH
T1DD51FECAFFAE0976D1C4E428A7798945CA04D31C73F5FB51648E088CB992004936EBE7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/form_dialog_folder.cpp

SHA256 0123330683053d0a0ccba4ec45956ca7448e1dfe8540f15e9430f6a2c18e7fc2
MD5 b0aec69ab41ebcdd6d585714ac868e82
SHA1 e0c6430601f717b3dc50a0031efe348d783b92c9
SHA512 4ef83ec9dac2462bb7c605bbe1bdcb8d9e2486bb5da561a1034bd8e0aac04406e28e4d01219e771cbfbcf1a0732a07d667ecd25a2d4236bb02e3b6f18260e7c9
TLSH
T1CA117D576E6DDB386916D65D23388D06CE80E16373A42673BC5E1084A3A008962BFB18
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/form/form_dialog_font.cpp

SHA256 6a18634d2b8915f69ac0d5ecea99b69d84f1d5618e6222c3867710d3c2979d18
MD5 30f81b809236024666690ca5513931ef
SHA1 8777f526cbb99eefd7e24a135137d286756d0dda
SHA512 6a9e7b57a0e1a7ffc9e1990b974bc8f54ad343ffcce59284fce1b69cd14965939b1730dd97282c55578b0d4d7d72be87c7b1ad22b8b99d3af6d01fd0ace58272
TLSH
T1ED51CE32AE26013075CDD00D3779D44AD8A459137AE41AEAF4AE01C8F7EA104D6AFB7B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/notify_callbacks.h

SHA256 94d7d01028e37522bafe0be531c477d28ed90032e880463ca584b9bcd3936fa8
MD5 1ced720a59581937d53e4d76f4c33833
SHA1 5fab0900182e85e5d091f49e440931531f9a094b
SHA512 cc1f0aff3883927d8b3e69f61262f0cc273bd5a2e3d5fa20d3793127da6f84a1240be551f7f806c578f8673d339a0e77fc9915e03190d21fb3d2cb47254ab94a
TLSH
T13BF096BD0773C5069469A7AE87130210C019F2DA7C18ADEB363EFB4477260269253999
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/packet.cpp

SHA256 0dce1fbaee1e51193e2888a5e5514336e063f5c5f01b8f8fda749b57d8f53101
MD5 e31e1dff5c9a509fd593de48d3827ec2
SHA1 4c2607e61b0e815af5928ba2b45eab3b90d7b4a8
SHA512 e970712053a36052b87f7a328707b63192c8d8ba72c9003353726967dc4632e652d9f15c5a21fab90546e38aa8dbccb5f00738ffe55c3b5e637e1458f3fc60e7
TLSH
T1E07199DB3197C0FAFB67D24A03320900681A2A9633F53BEAE4D54158B832DA5C3B6176
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/packet.h

SHA256 7c947e6a7a42b1243151684a9b7c061184dc6a27e2b3dced5b7c22bc1581f50b
MD5 4d9771d751d16f6fc56a76a9681d2808
SHA1 4003ad4e4efb42d503759c0e753e0f85279827cd
SHA512 40dcf068cda1802901f58e6ed2fd664b4a448ab7a74bf277c4d17616770b35c099eff17923c1f20ae4d3141e8752d98d56247a00e3e800201ec4b5cd43d0a66a
TLSH
T19161A0E4FFC7A1F1E933A181C6711483E4EA6648F3BA5B94F2D554602520D21E73A5F8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/plugin_bot.cpp

SHA256 46ab78b0191dd5e687092c5e30148cc8d6b8d569cb98bc02a05c86104d02a721
MD5 dabaffbeb50311cc638661786d4b54e4
SHA1 69b4339682d18c197a002ea7a23c21abab2b1e41
SHA512 b62a07b8fc4528accd0afcda23f9e3a4484e5ab4b52b3f258b16ad3337ab1aadce131be1d5e15a12b3599f5627fda0939051e60b6910c5a4d2712605b13781d1
SSDEEP 96:wJXbyhrMFLd0Wjb/xhwxf0btiuRiTb9P/He9vHZFOiNcSARVlfQ:0P3wBq38FS8QRk4
TLSH
T17AD111861C6EE972A399C5946B754051ED75E3E13778C2A0FDAE3800EB25093F0FF492
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/plugin_bot.h

SHA256 7fc4212f9cb49b3a7cfd1dd69b0ebe6f9aee637298d27a93d8747ad12e027c6e
MD5 a8251f56159712b78d210339cc98e83a
SHA1 d7b8de4a7a55fb3d9fd4e783e638cc32d60d3369
SHA512 ceb5a2e6e5efff006d6ae7ac5227c085682898ed703c93c8a2ed137dfdd94c4152c059fe8d9971b32100a117a7e894882fe2385c986511355ccc0d7fbe364161
SSDEEP 96:kwHS8lFd7A9IhXMIMSzeSqbVhvxIvxqXWPSJQR/U7y5J0uty:KecIJ6Ty/n/UrB
TLSH
T11AA11156178A4923D4B511D6937B21E2E139E2D47337EA8534FEBC182B29830A1E7DE4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/plugin_bot_factory.h

SHA256 09842a3c7537e559564754742b8195d519dc8e199cc8e88f30663a8469a8b70f
MD5 4a077559d8beedcb84f6b127eea4db1b
SHA1 94d9b861350d17bfd0f2634fd131935256fdf9d7
SHA512 d185752be6d0e3e2241c6a9a64328c37bfdef7cbdef42fad04ecccce12f5f7e5700c95cd7d8e820c162876f23e2ce406ab423fff6ad659a073644f2fad575012
TLSH
T17A11C438024D8123C0B715049137A4F3E2ADA6F5AB39C8127DFC94453F799B176D7A99
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/plugin_manager.cpp

SHA256 6bdeb0ef4a78a3042fef5fd8d217d8396f47694ac0304f7a3aba64dce59d9ab8
MD5 87bda06c35ec265633341fa1fefdbec0
SHA1 a1b2f6a4b2592699b9ea226b0b93938b1d935ffe
SHA512 64ad1e4622946f00bde44424b24c4201f2c18d9b90b675ec3d2ac685a92c2f1c6bd6e5d70519505b1f9804a07a23a41f746ed23ae9ebcd0646406d01f456b569
SSDEEP 192:/cuLztmtQ8JautrU26kWCMZc68PaPW9PGSE:WddHM5O9uSE
TLSH
T1A12245C53C1FD17666F5E2A807B4D150EE4AF39463B491F0FAAE5440FF60142A2AFB62
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/plugin_manager.h

SHA256 075372c7a3ffaf05cb583db1d134f563637a6dba075ff38185fb409d2b522200
MD5 c3bbb9a5cf046201068dd6ff3f14bcc7
SHA1 1256dbed104f86f914b666184ce7cd21ac0306c9
SHA512 8a7ae01eae1fd091b7b9a383deaeeb02b71414db463bf65c608fd40c2515b8ad8cffdd079628416cd1a61736445085fba30143fde2c80c876dc96631ef13cdcc
SSDEEP 96:g8JH47xcxNKeVw0oy30ma3QQxhPSlvxIvxMK9UKjwGIvzEhs:nppimMf7WyL9UK8GIZ
TLSH
T1E38173794B8E501368B52192977302F1D01AF2E5F771EB2239FEBC542B2A83071E3A59
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/plugin_manager_interface.h

SHA256 e5257a383ff57e3a57046dbca9b4724e11ae196e112fa7e8f29a0aa00d3c6051
MD5 45749eeaf37a608106b5a3ae35e55bc6
SHA1 0d4e6eaffac1bfa44e844e533a3ddc6c0b6f6e99
SHA512 e04e001586667fddb80343510f3a158af23a93c8e6c20418561c19d1cbf9e35d065951c5bf36d67b00533f2a2ddf6f0cc79226f06d181fb02a081f12f1ecb27a
TLSH
T13A31124E0347A46308BA528B636107A1C04CE2C67FA99F5375FE053E1BC34D0617B61A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/plugin_sdk.h

SHA256 402609aaf7bb48f4c732f38f4d42a58dc2c1116ef6f88e0b34ed31359392adac
MD5 2e78f9229354165d3bd398b8e8843a27
SHA1 069db7c2769018eb7f50bfc37d188cc090c421d4
SHA512 064229930ce9dd0b59d658c2387742e5b341f1635c0922a7188280d0bb6802c9beb1da01362fbd0edd19397ad92c935286b6b62221026f57140266e63969a980
TLSH
T1C0D0C975044EE0A214B7A616424505F2144EC3C7AF89E9BB30B295A93DC7BF034DBA2A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/pluging_bot_interface.h

SHA256 a741d95a301a474dc662914c390243a337974e366e021570d8ce97e37a4e1e8d
MD5 8ae0769d67ef1b327b02cb39e62447cd
SHA1 405a0087f6cf78d533a0e6f86fd609ceb0ff3ce5
SHA512 74e86c319d2636553cce5de4bc5964f6d4678800843d573d51f0f6b5d31d9363db5f14e31bc2b93e5c38e6f94c96e7712528993b0240ed8df26ea461d645db1e
TLSH
T14A01B1191287E963D435814543570EB3514CE2E7876ACA1629B0442E2DD7DF060FBA0B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/utils/functions.h

SHA256 d57a8c01b807e497eb82426b7c0efdbe2468170334da6024faf0ebe9b28a7b2b
MD5 8dce76f9ae4f571891f104d3118a3db7
SHA1 4fad52444f95b60d8068eb5b92a4faa3491fb624
SHA512 274280bf9bf6da9d38206b981a4bb7f3922c8897c3f7e0f7a5f8caa22470673855d881272358de410f208e43f1628ef4059b5ed9262839d3565837a93f52210e
SSDEEP 48:iU2UQ/FPgglCE/2iCz/LPALSo6t0SH9mI8JmCMHIAYECMLU1ecm+LL8CYmUy:iJbgglCs2iCjLPp0wJg8Cp
TLSH
T11DA143C1AC97D578EB7AD34190BE5035C86AD50677F42AFCF49F20580712019A3BEA8E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dev/sdk/src/utils/structures.cpp

SHA256 27a421bd338416e29bc0e768e73d4cefb61be6b13247d99e7e71ce8d0fcfb612
MD5 57b33e6682876b61926dec9197491d4d
SHA1 4e111a6f7500ab97b32ec302d2b4cc07d24cbcb8
SHA512 46a5f96397d177d80deeec8b1b37257c8d92f3e98b8b255c076432bf404dcbe8ec3fb04f492a466b8562b0c5f1d5fa23165eb9fa1dd1dc2a808bd83229f37b02
TLSH
T144E0D81CA073B66DDFC25FD34978A8565D107A42A3BA9FF1B88D00E4B02015D54FBAE9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

dev/sdk/src/utils/structures.h

SHA256 709505e6b0fd47fb2298d2f76d089a9b87c0b9cd9d48d8034952111a7921b964
MD5 bbfe392b6f720325b79643a41a0194ca
SHA1 ad8fa2e0eb32605e5429af68a6bf722b26c3bfda
SHA512 b77254254a5cf993e9c36db08e7899b2f31dc76114cbfa33ca3c4eb909f15985572e51e6a4045938074d2ba5a967536538f31318226922a5d972ab641923267e
TLSH
T19421F33B18E1C3635CB94415B77B6885E618024762E579F0B4FE82511691F2441B9ADE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

help/Camfrog Bot Developer's Guide.pdf

SHA256 547edb3e34c50b2e6ba9a085ec2bc405b10413028cb0eb747c4f1fdb3af7b399
MD5 de66a679bdf6e011bd5b7880ac8bb396
SHA1 f28f721654f08ab9e007c72b5702e0840c23853e
SHA512 413a2c9fdfc9c1328707f48849dc1e7b34c3780229fad3d783136befcd8c92d3dbd8aa50ea60785e96bee04ec13c5d1f157e47077be5a56ba09471030aed17e7
SSDEEP 24576:+rpV5C72wZkJT82hDe2vLLWQ9JIrbwQ9uXrHGnp/ij277ue2KJ:m5C75Q42h5vLRInTwXLGJij27BJ
TLSH
T16635CD20888CBDEFC39657C26B2F7D2DB01DB272F1CA56450769CB8605A1A7FA90354F
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
NSIS installer

installer

Extracted URLs

file http://www.boost.org/
file http://www.boost.org/en-US

help/Camfrog Bot SDK Example.pdf

SHA256 1f9f6977fbb4c06cdec5ef592d7adb038c81e16c6b4c4c758080d7e92b573d81
MD5 92e98a1396b8f1b307140caa994d1827
SHA1 ac873dc8ee13e325dec58c54428d22d6482c1c4e
SHA512 78580936ca65460ec1b06b2e274103d6d700fd4fc8bce44f1752becc669246b17a9d485cc7cf4a1463382998302e12feb56e5f90bc23fe6875346fa2cf31028d
SSDEEP 49152:CUaN4grk6DA9qNh23Om3hSwO7A3UD62GciYYwIgC:CUaN4gQI0OWSwo62jC
TLSH
T104A52249940C28DFD7A507F0AB1F3C99746EB167F6DA93545228CB834830B3E6593A8F
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
NSIS installer

installer

Extracted URLs

file http://my.site.com
file http://pkt_module_v.data
file http://pkt_v.data
file http://sourceforge.net/projects/boost/files/boost/1.48.0/
file http://sourceforge.net/projects/boost/files/boost/1.48.0/en-US
file http://sourceforge.net/projects/boost/files/boost/1.48.0/en-US.
file http://v.data
file http://www.microsoft.com/visualstudio/en-us/products/2010-editions/visual-cpp-express
file http://www.microsoft.com/visualstudio/en-us/products/2010-editions/visual-cpp-expressen-US

help/Camfrog Bot SDK.chm

SHA256 6b3ca22f31f667e6e3743cfac1cb949cb14d98e9879761dab851ba0dcf3a29a5
MD5 c3253f6e189bf3990a9be8d14915a368
SHA1 6702e2c189c9f61296cf764f2945364b7113b852
SHA512 03088f08c334ccc22530d6a9f349034b12a21213eeec829053112970dd0751cfdbf3de760d9fc88881d94c78d33f7813d83f4e4f041997a1e5946ad86599b4b6
SSDEEP 3072:Ah7gWOz/7AIgcik8h29NYPS+GxokZtAChqBckXuo1t/82m0pQbU:AJgFcPcik8h29WyxoYtAdBcWbU2BpQY
TLSH
T19AD312EA23D41226F1B97A3A9DC99ACD7D84F40717D920C26D49B26CFB7A30C61F580D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

help/Camfrog Bot User Guide.pdf

SHA256 e897bc129902443f4dfa0634e1cbc524d11e513b2f9ca75101227e57c2b6292d
MD5 0eb34b38bbba864015bcd37cd34730f6
SHA1 8da68a845fdb36ffb30ad159dcad045bc2fbea47
SHA512 7776a2d19b6e0f1a02f2fcf9081d9c4796ebaa8d6c89492318bf24f3a283989b815c12ef440ee16706e48a1287d8efdb822ef2dc0fa34fb34fdeba997353a33e
SSDEEP 24576:M0uE434brqqAeNVVl3l4KpUmt1HJjKIKZhVFx1KPU+WnwZ7kC3os/SyZsgx5w8VA:cqNLl3TqmHHxKIcGKwZ7kcoZ+sgxLVTs
TLSH
T13F65EF60984CADEFD3520BD11B2FBD6DB51EB272F0CA57810368C7425261A7FA65324F
MD5 SHA1 SHA512 SSDEEP TLSH

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
NSIS installer

installer

Extracted URLs

file http://download.camfrog.com/
file http://libghost.so

netcore.dll

IMPHASH 59e0e197c7fa97a2c08bec26b9eacf82
SHA256 88edec160760a3d7682240499fe4bda704bafdad67aa14c5eee8cdca60ec2cb1
MD5 9aac52e42b813dfdab7d046f7c97f299
SHA1 d13818e701a879a4355d6676c70d413032be6515
SHA512 f192a1dfb5d1b1ff5e3355c6e9aa4c3bdc4c5daedc175e1ee8e8cb9f8c4cefb53e09ab4f29df0348fd6564b50805326e2ccca0c609d97ca32aee568d019d0ed4
SSDEEP 24576:ZsdfSXlIq0jpxuW+FInqMIPx5ljid7IAyBwAgqZ5/yR67:4Wqbpz+FInqVpXjiDgwAgqZ5H7
TLSH
T195559F21BB85C076FA8E02B2893CB78E257CA6710B3418C3F3D95D9D5E705D3A63169B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

86:dd:be:ce:b2:c9:d3:be:64:22:68:7a:f0:ae:a7:b8:44:3f:80:ff

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

790176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

send recv socket closesocket getaddrinfo select WSASocketA WSASend WSARecv listen shutdown ioctlsocket getsockname getsockopt setsockopt connect bind accept __WSAFDIsSet freeaddrinfo WSASetLastError WSAGetLastError ntohs inet_ntoa inet_addr gethostbyname htons WSACleanup WSAStartup

shlwapi

PathRemoveFileSpecA

kernel32

GetLastError TlsAlloc WaitForMultipleObjects WideCharToMultiByte GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameA Sleep GetCurrentThreadId lstrcmpiA GetSystemInfo GetVersionExA DeleteCriticalSection InitializeCriticalSectionAndSpinCount SleepEx CreateIoCompletionPort InterlockedCompareExchange QueueUserAPC TerminateThread SetWaitableTimer TlsGetValue TlsSetValue GetQueuedCompletionStatus SetLastError CreateWaitableTimerA GetCurrentProcessId OpenEventA ResetEvent ResumeThread GetTickCount SystemTimeToFileTime GetUserDefaultLCID GetStringTypeExA LCMapStringA LCMapStringW SetEndOfFile InterlockedExchangeAdd InterlockedIncrement DeviceIoControl GetFullPathNameW FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryW GetModuleHandleA MultiByteToWideChar AreFileApisANSI LocalFree FormatMessageA GetVersion GetFileType GetStdHandle QueryPerformanceCounter GlobalMemoryStatus GetModuleFileNameW WriteFile IsProcessorFeaturePresent CompareStringW GetDateFormatA GetTimeFormatA HeapReAlloc GetCPInfo SetEvent WaitForSingleObject HeapAlloc CreateSemaphoreA CreateEventA PostQueuedCompletionStatus TlsFree LeaveCriticalSection EnterCriticalSection CreateFileW InterlockedDecrement InterlockedExchange ReleaseSemaphore GetProcessHeap HeapFree GetSystemTimeAsFileTime CloseHandle UnhandledExceptionFilter CreateThread ExitThread SetUnhandledExceptionFilter EnumSystemLocalesA IsValidLocale LoadLibraryW CreateFileA WriteConsoleW FindClose SetEnvironmentVariableA GetLocaleInfoA SetStdHandle FlushFileBuffers SetFilePointer GetConsoleMode GetConsoleCP GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation ReadFile GetStartupInfoW SetHandleCount ExitProcess HeapSize GetModuleHandleW HeapDestroy HeapCreate GetCurrentProcess TerminateProcess InitializeCriticalSection EncodePointer DecodePointer GetLocaleInfoW GetStringTypeW RaiseException RtlUnwind GetCommandLineA IsDebuggerPresent

user32

LoadStringA GetSystemMetrics GetProcessWindowStation GetDesktopWindow MessageBoxA GetUserObjectInformationW

advapi32

RegQueryValueExA RegOpenKeyExA DeregisterEventSource ReportEventA RegisterEventSourceA RegCloseKey

shell32

SHGetFolderPathA

crypt32

CertGetNameStringA CertFindCertificateInStore CryptMsgClose CertCloseStore CryptMsgGetParam CertFreeCertificateContext CryptQueryObject

Name

.text

Size

925KB

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/8ball.dll

IMPHASH f01ece00cc4b5109a3d1b536a3426294
SHA256 f8e75f48969f76bb7f38e6d53edb556bf411cdc17c3a6609c48f8523c8b98cb2
MD5 ac944b01a4261cb565207ad855dfe609
SHA1 918dff8c8568f97895ffcf829ae857a56f53781d
SHA512 a62801addaa45afdd8e2be9d640dce14d74914d7266aff306b5fd1ce7e2c2337b9b7052358dfbd505ce27308477c6aff3db2edcaac7314cc450013d436191454
SSDEEP 12288:HgQfYddqZwqkI9PbswMwxetth6wkPF1ZrJbrM39TEeVrnuXo0bIkf0O:HgGY2ZwqkYo2PFzrJvM3hLVrnuXo0bnT
TLSH
T11DD48D12F7C9C172D94F11B6482AE33D677DA6604B318BD3F7A86B1ECE206C16D36186
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

5f:66:30:10:17:ac:b8:af:66:de:f6:1d:eb:ed:0e:0a:cb:82:d2:a9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

378355

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage ReadFile SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

483KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/badwords.dll

IMPHASH 84b6ae0b32aa8faefb72c2ace0af270b
SHA256 f28cd7151fa37d72b730c6f3a545636aa884e81825875d70e953c9fa2e5f29ee
MD5 b7ef873e16de1be32c51ea6a7db1c660
SHA1 8839e57b7e94ee3a42d8c9d866663804a843bd87
SHA512 1d4b49e744c674cc5da7437529eec06baffbbe179eb271e575931e93dee95178e8bd9c09aa84ec68d6b88d92ee093671de0fa5046cac407a05bacd11290e3aee
SSDEEP 12288:Z2Rde9DWOB6otQy19Ws0Opi831Fwe+JaZIq5ksXKzVP7cvggDfBNV03rtzDtIb7p:4RAxPmIWsE83XWVP7co6fx03hzDs
TLSH
T127E49D11AB81C13AE98F01B78D7E97BE52A8A8510B205ED3F3C86A5ECF315D27E35147
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

3e:ec:da:f5:07:ac:66:95:0f:68:84:9e:29:0a:51:e9:05:49:77:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

462701

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage ReadFile SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

563KB

Virtual Size

562KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/ghost.dll

IMPHASH 5497f59e0521155a65ca49f09db9965a
SHA256 8f61474f2fb0b5607da35f4a30e96e80d616db66d5a9ac93912d073fb746bde4
MD5 ace9a1482ba17be30075072169adb2f1
SHA1 6fe2f6bb9a49723f1b11dd59a365b6a684fcb384
SHA512 9ea17a7961dd0b43d3129be93af6d0269155410319ddd7721b608bb28b927e4b8473d87965f1cf9e44606114495648434fcdc281df3f4dbbc2cae429c56b019a
SSDEEP 12288:GOiMAzrvWTmC3ugql/HuoMba81uwT3cuAdHnoDXro8m8nLc8q+ab:GOiXLjCeqcxdHoDbo8vnLc8U
TLSH
T155F48D52FBC7C17AD94F15B60829936E9539A5500B308FC3F794BB1EDE212C1BD3A24A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

0b:d9:be:64:58:df:9d:1c:68:9b:12:ac:25:e5:6c:1d:72:e4:57:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

464874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle MultiByteToWideChar CopyFileW GetCurrentDirectoryA CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW FindClose DeviceIoControl GetFullPathNameW GetLastError FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryW SetLastError GetProcAddress GetModuleHandleA AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

575KB

Virtual Size

574KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/ghost/easy_words.du

SHA256 131b6246df4af46e99bfffd9968f2987780d5bab37774fd1fa8a4a4ecfea4c41
MD5 1d7c13cc87463ba523b3456fa0fae99a
SHA1 7cbbcd9d06d4b67460155e6208a4d66db19a005e
SHA512 940201e7a60d8b56cf26634263817381c130665383f45ec4927b09157cb9a89a7419dc01180958e6833cfb69a424ab0ad6442db5323d94ce33ecadcb4bef8eac
TLSH
T124A012212018D10A29911A90123023433B4C80671B81387C109D18D8804223CE61C970
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/ghost/hard_words.du

SHA256 131b6246df4af46e99bfffd9968f2987780d5bab37774fd1fa8a4a4ecfea4c41
MD5 1d7c13cc87463ba523b3456fa0fae99a
SHA1 7cbbcd9d06d4b67460155e6208a4d66db19a005e
SHA512 940201e7a60d8b56cf26634263817381c130665383f45ec4927b09157cb9a89a7419dc01180958e6833cfb69a424ab0ad6442db5323d94ce33ecadcb4bef8eac
TLSH
T124A012212018D10A29911A90123023433B4C80671B81387C109D18D8804223CE61C970
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/ghost/normal_words.du

SHA256 131b6246df4af46e99bfffd9968f2987780d5bab37774fd1fa8a4a4ecfea4c41
MD5 1d7c13cc87463ba523b3456fa0fae99a
SHA1 7cbbcd9d06d4b67460155e6208a4d66db19a005e
SHA512 940201e7a60d8b56cf26634263817381c130665383f45ec4927b09157cb9a89a7419dc01180958e6833cfb69a424ab0ad6442db5323d94ce33ecadcb4bef8eac
TLSH
T124A012212018D10A29911A90123023433B4C80671B81387C109D18D8804223CE61C970
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/ghost/super_words.du

SHA256 131b6246df4af46e99bfffd9968f2987780d5bab37774fd1fa8a4a4ecfea4c41
MD5 1d7c13cc87463ba523b3456fa0fae99a
SHA1 7cbbcd9d06d4b67460155e6208a4d66db19a005e
SHA512 940201e7a60d8b56cf26634263817381c130665383f45ec4927b09157cb9a89a7419dc01180958e6833cfb69a424ab0ad6442db5323d94ce33ecadcb4bef8eac
TLSH
T124A012212018D10A29911A90123023433B4C80671B81387C109D18D8804223CE61C970
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/greeter.dll

IMPHASH d29f8dd69c5f9b0ee0bb656d82f47de8
SHA256 2125ada8ff034d3c072a60565a8aeeef95e95055e56158bb3a6f1b06448252f4
MD5 4a79ea59d050a2f8b36cb3e9a736ba54
SHA1 09da4870fb9b89c48b51c63dafebda4fa03ecc38
SHA512 ec2e8e6eb628c0efaeeb60e129101dae99e1e1584fce4f25d01037cfa4dc40bee93284c4626a027ca15c595c7650e2954f3d566e643d43f172d0e50cbd406db3
SSDEEP 12288:/nXc6OgBWcSZ2vLWUgJ+m34SHY1Z3gDH67HcRY4mLi+PSESqQXn:/nXPOcWcMS51ZQDH67Ho1+PSESqcn
TLSH
T1A9E48E22BB85C1B2D64F0176482AE37E567965614B308FD7F7846F1EDE302C16D3A24B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

db:0a:d9:a9:9d:26:2e:ca:71:12:27:e0:7a:d3:0c:e7:31:2e:0a:69

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

413473

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW FindClose DeviceIoControl GetFullPathNameW GetLastError FindFirstFileW FindNextFileW GetFileAttributesW CopyFileW CreateDirectoryW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc ReadFile GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/heap.dll

IMPHASH 336c3da4463dc6afc99bb621584d9914
SHA256 f2545d0f606ebe0058b773c32c215a86f647936c57d2302287a8317f699222e9
MD5 64abab00efbfbf2a3730e49ee9bea1f6
SHA1 fc3eed4f10f141a8752a02bf277a5113d75f390a
SHA512 51276cdea6bbc6d39f1d03a1f124e2f58a492104918e6f033c6bb75144b29900c27b7d48401f180579bccb5b39710d636f7044579ae14c52dc8e7fac71b2a229
SSDEEP 12288:USQqWyoMjbleKJ45bDs2fZ+KSoTsRvD27d9O4K8EdpKpUBIFdd1X1cRj:ZfS5bxB9pK8EYUBIFdd1Sd
TLSH
T13FF48D11AB41C03AE99F01B6487E977F5238AA2107249AC3F3CC6E6ECF755E27A35147
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

6b:e8:61:0f:34:e0:c9:a2:7a:d1:c0:bb:96:ce:da:6d:3a:d6:0d:dc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

469724

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage HeapAlloc WriteFile GetStdHandle GetModuleFileNameA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId ReadFile SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

570KB

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/htmllog.dll

IMPHASH c7e8b2d0571b9bfb8e1f5a30130d36d5
SHA256 4b46aedba5fd505c86e03733cb2611c0c0ab5d18c64f388538802559cc1acca1
MD5 5928be587ce3aea14e3994a6862589c4
SHA1 deff0f9d84716b8df7106f90596076b823dc3b26
SHA512 8f75d1e1441b1767515110a448a649890bc35c43964a46d67c0399cabe4f28c60f1985d157d988a5cf4ee60d74e1013838be3b7557c9be04f5d7b631e9564987
SSDEEP 12288:DApBhmnl6za3guvgKvnh3xUPorx5eOWZsStwMpcPP+BA6EW6Ww4X47l:SBh0l6z8YahhRStnpcPPOPjw4s
TLSH
T11BD48D22BF81C136EA8F41B6883DE63E567DA5600B2459D3F3DC1A5ECF21BD26932147
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

2f:7a:e3:88:e9:02:bb:2d:d4:a7:46:f8:70:17:a3:33:c2:7c:1c:25

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

398589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MultiByteToWideChar CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetTimeFormatA GetDateFormatA GetLocalTime HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA HeapAlloc GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc ReadFile HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW InitializeCriticalSectionAndSpinCount CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

shell32

SHCreateDirectoryExW

Name

.text

Size

496KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/imcontrol.dll

IMPHASH 3cc5c2a8a150b59673ba9005592bbd07
SHA256 1902784be0afc8b390fca7a1dbd8b5c5cf265e582f526a6db60f4379ef0f5c9d
MD5 adfdc5da7fc751f9cee38396743df850
SHA1 c46b0764ce5cf32c94c7d61acaea84bc4d5f1db6
SHA512 912124290ddf107f210c7b5808117a72b2c70b8d85f407fba5a091dad26c996c07a8a0ddf6f4d29f5361140139ca5b04717208196ec5c58f470f2cc59a4ac84e
SSDEEP 12288:/QhM3cYQQ3YQr9Sw4PTo5pY03YUInYLsR0qn/XjB2JCXXxjyYti1in/PoFVpb6GK:/Q6kEMo80oUInkiXBjyo0in0pbqozxXu
TLSH
T1E4E47D11AA42C03AE9AF00B3897E97BE5278A9514B3056D3F3C85E6ECF355D27E3510B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c8:69:e8:d9:fb:99:64:2b:41:8a:77:9e:a3:bb:10:e5:f1:a0:30:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

448230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA HeapAlloc GetConsoleCP GetConsoleMode SetHandleCount GetFileType GetStartupInfoA ReadFile SetFilePointer FlushFileBuffers HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle InitializeCriticalSectionAndSpinCount CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

553KB

Virtual Size

552KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/localization-sample/8ball_message.txt

SHA256 b0be52f05fac0b0c558d1127a08134e8ba4b7a4b8049cbb723ef3137eb900109
MD5 2ceda59aac9d1e6f4576ec351e2a18fe
SHA1 22b2741fef8d4d0ba69f81d1de68797201878806
SHA512 05ae5ae0da1e4ae7b4805291002679fd5d44c6b7fda1556fbcdba39fea646633afb215f9fbd6a7fc4cde00370b6ffd88cfbfab2a46faa479b84fc187a8e8a575
TLSH
T1A3E0DCCA7F8220F30A6207630389F7B2C124B56B20720E8135086B47B7D1364126B0A8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/badwords_message.txt

SHA256 d9328974ca71c9c1dfb4ae5c642c37ec4d47f36b325a936df64694916313df59
MD5 f71c01ad92fb0710eec07ccbceb4c889
SHA1 258a4706b22c12580d3e2389abc1d23f9ccc6ef3
SHA512 dd8d2e5f33a4e6aec9d7c55cbba82fcb72a33e2e89183104ce80bb0e1673dadd22e5f395d483ab69e813b78f5b4a11e78b65a2b9d586daf65302999f88d15c2c
TLSH
T153F081CD7707A4A70B6217130B85FBB2F309B35B10735A416D09964773E23AD536A4D9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/ghost_message.txt

SHA256 a351e52e267262e4a516e2fd134e672839aa766498775a2b0237a5e5db907693
MD5 c49bac2236cde87ebc1700abe0e80209
SHA1 be4f9aa871344eb005ad5f76e01365b7018bf18f
SHA512 6a8db88401474294f960ddb1c15b934d264545bb86ce886f736f07efea1040118215548971ca9039c53833b5d00d0b95566bd840efce9bcfa3a222d325c4543f
TLSH
T15F31CF753B579BE3033143218705B131A11EE1A7D6B36AC5154EDE673156F9F036D4C4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/heap_message.txt

SHA256 ee20b03fdd7fd7ea3a874d3b1ac7da2c29f7380824fb635e5e5d7d13b3c3df24
MD5 da4514b962c8273241439898919444df
SHA1 4d799858ed20c8273168c842ab9a9ac1ad8bd342
SHA512 d16ec9ca9babf1e4d8028966dca9a55098781be534ce848cb3809605787b680a56759c62aab57e921b08b2e35c0909fffb2caf0b5f997f9c631fa1e56010cdf9
TLSH
T1AB310009392B56F703724362020EB361D64F926719B73EC4704EB697B34A56B072A4D8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/math_trivia_message.txt

SHA256 a93b0485121c17e351c32353193094f568bb751e53716518ef4dbda1755cad48
MD5 6cba680969acd16514a7854b1f22fd5f
SHA1 b0e6aa9cae206de210eb86ba8fac260e25335765
SHA512 25fa1c0e92b6f64548d4e8a3836fb980f1f4c587cb61bb78001b8f9a682b6b4d40f168c2cf5df4bc95760afc73851f23e9f01636bf54e5e622ff64a7f46a6358
TLSH
T14411C46D7A4BA9E30F7257531305B733914DD39B70B62AC0340D661BB2C475F4219A65
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/roulette_message.txt

SHA256 3880262e3097e233ed069c7729fc1ca6563387c7ba8f5fc16f65cc7668fed729
MD5 d2f74e7137947904039faab8777ac4a9
SHA1 854d32afa7e6e4ec63e76808a3d5249c86c03b6d
SHA512 5fe5d7c4c699b612fc5ff8d02eb0176eda8b34f12b599ba589124a5d625cbe1bca56128dacabdbb2f784a2b6edcb466b2bb7a32fed59b2001532cd994a8378be
TLSH
T10DF09ED53F8E78E706A207271289F6B1E105A19B61223D41700F2757F7E179613199A9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/trivia_message.txt

SHA256 742dc37a0a55be72b5dd16cb05d7259d78660a1ef75832dd8950b5d60769eae9
MD5 1a08c55954dbaeed7ad26d9516aa8f0d
SHA1 e21f73a71f357a4a67346a8058fcc09653eb5243
SHA512 31dae1852b852162b0fc9bbea63c65588c69f8d7691ad9fc712fd3bc9ad3565ce49d365ff51f1b62e731ef87b08ef043e08cc1dd5d62b8d6d4ac017c75c0d0dc
TLSH
T19121B16FBB1B5DF30F7217232308F763960FE3CB71F22AC0240E561AB68A75A525A455
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/localization-sample/word_trivia_message.txt

SHA256 f88a7f8da06cb59526ddf35d416e606f3c76868b113e5a1ea2ead906a60840bf
MD5 ed20fcbfab6b1c22428691aafe587a32
SHA1 b2716732bcb3a572cb7ab4240e665cb5b5eb3901
SHA512 e0b2e77f2b0f4ee5ea0e97408d770d72b7b7f6e7fdbfee9100537be70bbc803a187e056fa1154d27b243394d3cb254509a60c66fe3fe066164e7cf1dc485a19d
TLSH
T11B21F15F7B0E4EF30B7317232208F763924FE3CB70E66BC0240D565A758978B4226855
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/math_trivia.dll

IMPHASH 0b1ab2c50312606ad7155b6d78aa2e88
SHA256 b329f05edd05a03679b64db361dd71148213f5cb58cb70f7edf6203d46926e85
MD5 db7a8c3375f3440c621c707ce65d0ef3
SHA1 60e832eed289fa6a2f37cd0616d14f2cbf2c2ace
SHA512 c888e0cca29d46c3cf0ce58fcd9cb94bf58fcc2bae0a4cbdd5015fb19d3f9ac9b5a2dcfc0345aca7e0a898ff2c357c58479abf49e10b14724c0f3d95c5bf3db8
SSDEEP 12288:7Lz/6rsYbQJxXj9rj+q6/VWOTxSo3ynEni5+eIhYNF2vg57LsKnI2atiI0qS:7LzitbQJZ9QynUw+n9v84KI2aK
TLSH
T1B1E49E12FB86C17AC54F01B6442DD77E2529A5651B308FC3F7846B6ECE312D26D3E28A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

41:da:72:f5:40:50:aa:20:3e:89:b5:7b:0d:ee:79:af:6c:a0:73:51

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

444961

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW FindClose DeviceIoControl GetFullPathNameW GetLastError FindFirstFileW FindNextFileW GetFileAttributesW CopyFileW CreateDirectoryW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

554KB

Virtual Size

554KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/messenger.dll

IMPHASH 58f54994834a3407a0a5fa0becae3c27
SHA256 338800c8486c4f1509eaf152c6967d47d484622c33dfa3eb00190d6f3381f6f7
MD5 04fa7a3feb631df61da417385692236a
SHA1 aa692f79bb74e03fa79e107d5b971f1e0a048ce9
SHA512 d26458aaacd34e7711c62aa360be19530804068bae2e02f3269168b679635595680b6660a67e0b201b0afe611318367ce5166f968f4b358ff7b7501451abf676
SSDEEP 12288:MIFa/9YE+oMA4D7zxGgV32GDlze6fIcJ20yl1ZR0+AKU4mgnBBG:MeAmE+jAcLfIe20ylhFAKU4mqG
TLSH
T12DD49D11BF81C136E99F11B6897EA63D927CA9600B245AD3F7C82E1ECF25AD27D31107
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9e:79:e9:a8:67:2b:07:bd:c7:60:ca:fd:a7:39:6f:08:70:6b:19:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

393113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage ReadFile SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

497KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/roulette.dll

IMPHASH a896b9bb43b39d846b8c001351ac63a6
SHA256 b8228ff85dc431503f014c554aaa9140b35909538a4b1b2515dc305d70a8879e
MD5 27ee8972347d32baf1ed3cbb8d9bc1fb
SHA1 3669138a3d0fbeba58f7f42866bac60b618e08da
SHA512 018fc64af385dada25ec2bc1933354df6366b8a9a0d30074c481da33c1da8484648bfddef38d4993c88a4ed8fe3c2c30797c79a17f4c7d7c660c84510cc18c84
SSDEEP 12288:hVsQke+7jj+E0UMPrAEyOrDHVVhbb6pon7gcRI+aUBok4EHTM:hqHp73yD1VhbkontI+aUBokxw
TLSH
T141D47C12FBC7C2B3E64F11B54429E33D567AA6604B308FD3F7986A1ECE606C16D36246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

89:1a:ea:8d:28:cd:6b:6b:a8:01:8b:65:17:ef:07:19:35:34:18:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

395534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle MultiByteToWideChar CopyFileW GetCurrentDirectoryA CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW FindClose DeviceIoControl GetFullPathNameW GetLastError FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryW SetLastError GetProcAddress GetModuleHandleA AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc SetHandleCount GetFileType GetStartupInfoA HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage ReadFile SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

504KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/roulette/messages.du

SHA256 cda206ba4fed24ad422c759a14b6c398a787253ec051f2cb8d80b12ff8be92ff
MD5 72bb1c634d08c432e07a4abc5b39a454
SHA1 6a2d2d4e95da1ccfe3ccd20aa3590f8ce3204736
SHA512 8dbeabf6baf914cf0ca1ec9e349861cf6e98a07717bfe51a033988a9fa37fdb146f6ba4cfd2d05bfc7e471553531b12ed88579b6714c4d168eb7d981cd69d336
TLSH
T1D8B0121B7680810E4DA920100459C253C6400061A13B00F11B88C61676560A040904A1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

plugins/rssreader.dll

IMPHASH f04d3b567cff875925ed7b23d0765743
SHA256 e6cdfaab069f9352efb0e6bce995dbd4db28d32ded3918f017a73f4ccbc948fb
MD5 e2c2912b32e419b9e1e167ca7e4e9c64
SHA1 282624c4b67c7b6ba0821eab7dfa704c42afd178
SHA512 635e7fa681841f37086d321ce093d9c0e53c5deff6100c6524e615ca74358b14ccbab2ef023436be24a580c3125fd71f36de6e278acffe37fc64d95a091b7143
SSDEEP 24576:cOaETv45G1RMa1pDgvpy1KDSAq221aFjqAh4Yf:EETv2HSAq2GMjqAh4Yf
TLSH
T150256B00A701C13AEDAF09F38EBE866D526DA951075424D3E3CC6EAEDF654E27E3114B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

b0:69:25:33:8a:5b:64:86:20:be:9c:19:6f:df:f8:43:ae:ee:7b:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

698321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

freeaddrinfo getaddrinfo WSAStartup getsockopt WSACleanup getsockname bind accept WSARecv __WSAFDIsSet select listen inet_addr connect WSASocketA setsockopt WSAGetLastError WSASend WSASetLastError closesocket ioctlsocket

kernel32

WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle CreateFileA GetLocaleInfoW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer ReadFile GetStartupInfoA GetFileType SetHandleCount GetTimeZoneInformation GetStringTypeA InterlockedExchange PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange GetLastError CreateIoCompletionPort InterlockedIncrement CloseHandle WaitForSingleObject CreateEventA SleepEx SetEvent InterlockedExchangeAdd GetQueuedCompletionStatus SetLastError InterlockedDecrement SetWaitableTimer TlsGetValue TlsSetValue DeleteCriticalSection InitializeCriticalSectionAndSpinCount QueueUserAPC TerminateThread WaitForMultipleObjects Sleep TlsAlloc TlsFree HeapFree GetProcessHeap GetTickCount GetSystemTimeAsFileTime HeapAlloc WideCharToMultiByte GetCurrentProcessId OpenEventA ResetEvent ResumeThread SystemTimeToFileTime CreateWaitableTimerA GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetFileAttributesW SetEnvironmentVariableA CopyFileW GetProcAddress GetModuleHandleA MultiByteToWideChar AreFileApisANSI LocalFree FormatMessageA IsValidLocale EnumSystemLocalesA IsValidCodePage InitializeCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetCurrentThreadId CreateThread GetTimeFormatA GetDateFormatA GetCommandLineA GetCPInfo CompareStringA CompareStringW GetStringTypeW GetModuleHandleW HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc GetACP GetOEMCP

user32

LoadStringA

Name

.text

Size

799KB

Virtual Size

798KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/trivia.dll

IMPHASH 8f7d3df165e2c691e7c9cd977a9acb53
SHA256 57339d50519fd9c9d08fc365ec5b58169b56067aebc87be4cd991811a600d690
MD5 d60c364a25d2334c0413db196766cfc4
SHA1 054f1e2c69e0e1bf656fb39b53a6d4f3ec1a74f8
SHA512 39d854adbcddfcad8a9c77a2b01b547e31b3ce021bd947a71f616b692ccbc7c3bee615e6407b928dd64cae05a47d2fe3342af5c2c0f66d5ffe23b1a99fd193e4
SSDEEP 12288:PO2N4JhUvKNgdV7GBUX9CnxXYCNCmggFfZhkDfZzswd2V8alZcWmHyXnvPJjUVSq:POEnOBUtCRYzWwQ8a7cjSXnvRjUH
TLSH
T13DF48D10EB41C036EA9F01F6887D9B6E5278A961172089D3F7C8ADAFCF715D27936207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

88:b7:fe:90:bb:ce:b1:85:ba:32:9d:1d:94:81:b6:cd:58:8c:f3:c1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

503554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CopyFileW GetCurrentDirectoryA CloseHandle MultiByteToWideChar WideCharToMultiByte CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW FindClose DeviceIoControl GetFullPathNameW GetLastError FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryW SetLastError GetProcAddress GetModuleHandleA AreFileApisANSI LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA HeapAlloc SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc ReadFile HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW SetStdHandle FlushFileBuffers InitializeCriticalSectionAndSpinCount CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/trivia/questions.du

SHA256 c028aab7b835679a643ac2282e8f8e0e850da258be8e575373a7c49de7e80d11
MD5 7d9f7366dc6353cc109ef8af4cf8698d
SHA1 b428bebd4215ac5c8144a4cb42cf54ba9dda397d
SHA512 35940832eb97c7bc6a182aeeb5de7daca1f69938d58bf81d48467a1e98a855170eccf4f440b07a93ffd7ea3e9884b0d1087e087a6fef5b52d70d598a4bb84e0c
SSDEEP 6144:1JN9t7BQ1BHAdhtOhAnQPe78b8a01Ku7F1QLPjrvWIymcxW04Ib1:Z+h7Rj6IymnQ1
TLSH
T1F094B6BF62C6737E35618369100EA1D6F7198067823687710CBE95FC3242869B3BF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

plugins/version.dll

IMPHASH eabcde06e9646aea1a79d6b972f18d1a
SHA256 2b32255372b87ccfad62cc227b3f85abb22f54f3ab67286322a7777649716f3b
MD5 7448c9b983f1ba6f4ef88907dc1886f9
SHA1 d9f96540e551f0c3a76d0942b9d43050737bc468
SHA512 f5858d483a754b85cef163848ec6407cc504082efd406e9908c9d8d65b7a0a78b7ef58e387ba4afa9b2b9ddae00cc50c483815606a5fa671ca133dce3ede78df
SSDEEP 3072:PHMSJXrA8U0ITU9c1LIKuUrh3IHGJLQZ69CigpCk4r53qRmr7NiY:EStrc0IqKlryHZ+ip3Wqw7V
TLSH
T1F5346C107601C136E8AF05BACABE87BD56ACB521079590C7F7C81DBD4F765E27A3028B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

2d:18:95:6b:f1:9b:b9:a9:f0:12:17:25:13:d5:35:84:ed:87:9e:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

118218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

InterlockedIncrement InterlockedDecrement WideCharToMultiByte Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree GetCurrentThreadId GetCommandLineA LCMapStringA LCMapStringW GetCPInfo GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapAlloc GetACP GetOEMCP IsValidCodePage CloseHandle SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile GetModuleFileNameA GetModuleHandleA ReadFile SetFilePointer HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers InitializeCriticalSectionAndSpinCount CreateFileA LoadLibraryA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap

plugins/whobanned.dll

IMPHASH 5d4942a598bc4ef929ef028ea3f8752c
SHA256 4b82e732506e0096445b695fa767fb70f57f5f10104ea9e49f1ffcf52766c58e
MD5 501a271c44c604c24775840b4d998b83
SHA1 f3f7f149a376c63f33cb19df2c9a20153238fab4
SHA512 1039f0d1a851031fa9332d523a284a2cb3d6f68fb3a22257792581db31a85ecff92058201e4620b4e7e801e161b5db8ffa221eccf8f4129ab7a9c6dee68030e0
SSDEEP 12288:c7Oxyj39jfiLmGBNglAGVqpUmf3GuopcBf20YbSR2tBAi5+96Ey6cdEjWxfimsrc:iCyjJQBNYAJW/SEtBAp96EA6jWtimsrc
TLSH
T1FAF49D11AB42C03EE99F01B7883E977E5638A8614B245AC3F3C86E6ECF715D67A35107
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

09:5a:59:a4:63:0e:61:ac:17:37:f5:25:1b:5f:98:f8:c5:f5:7b:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

465027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MultiByteToWideChar CloseHandle CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW DeviceIoControl GetFullPathNameW GetLastError GetFileAttributesW CopyFileW SetLastError GetProcAddress GetModuleHandleA AreFileApisANSI WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetLocalTime HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo CompareStringA CompareStringW GetStringTypeW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetStdHandle GetModuleFileNameA HeapAlloc GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc ReadFile HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId SetFilePointer GetStringTypeA EnumSystemLocalesA IsValidLocale GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW InitializeCriticalSectionAndSpinCount CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

shell32

SHCreateDirectoryExW

Name

.text

Size

565KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugins/words/questions.du

SHA256 5d5219fa7f6098ff126327c6487cffa86838095ade4e8b3acc98a5706c995ba0
MD5 537670ca9fe86a422e09e70f3a6c0c37
SHA1 21280de836e6a17865d21cf647b9ebd6b914efe5
SHA512 c90e6a93dee750f21929d0d7e09567dd16278600449fd3e5479877ffe939ed3927231186282f14670afdd8f0fdbfa96b28686ed2e4bc4baedb6ee1676b03454a
MD5 SHA1 SHA512

NSIS installer

installer

plugins/wordtrivia.dll

IMPHASH b7aa083254106b4034d9fe7c220c98a8
SHA256 08d4d2c6b47c8770ba9c83805a665253e00d7ed25d9a6bd4228d6e7c3800a1ac
MD5 eee5e2926a1f0224f9cf2aa6642ca355
SHA1 6c4ba62ec0c9407fd46b6888e296c6aa3cfeed96
SHA512 52ce0d18d5c94f7e64e18300985553ee5ef32a1bfedd139cd2b03b00d15ee3dbf5202972e5a15bb378463b5aa29666410e82279f5c06bd3f776ca3028e686acd
SSDEEP 12288:k2oUvRHndGS/gM4a4q49J4v16fUEUhKpAWcHnQTAaAJSedqlCHYwHdp4Q26giDu:k2ZdGQgiv5oTNAJSedKCHY2dp4Q267Du
TLSH
T1C5F49D12FBCAC07AC54F05764429D77E153AA9615B308FC3F3886B5EDE742C1AD3A18A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

70:f6:6c:dd:1c:b5:87:8c:92:0d:99:f0:b9:3b:bb:a1:68:de:fe:fd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Chains

Mar 19, 2013

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Camshare Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Camshare Inc.,L=Austin,ST=Texas,C=US

Serial Number

26:6c:ab:5a:6a:cd:05:ad:ff:bf:47:93:0b:5d:1d:84

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Oct 11, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

456705

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle WideCharToMultiByte CopyFileW GetCurrentDirectoryA MultiByteToWideChar CreateEventA WaitForSingleObject SetEvent GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA Sleep InterlockedCompareExchange InterlockedExchange SetEndOfFile CreateFileW FindClose DeviceIoControl GetFullPathNameW GetLastError FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryW SetLastError GetProcAddress GetModuleHandleA AreFileApisANSI LocalFree FormatMessageA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLocaleInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime HeapFree GetCurrentThreadId GetCommandLineA GetCPInfo GetTimeFormatA GetDateFormatA CompareStringA CompareStringW GetStringTypeW HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer HeapSize ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage GetStringTypeA EnumSystemLocalesA IsValidLocale GetTimeZoneInformation GetLocaleInfoW InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GetProcessHeap SetEnvironmentVariableA OpenEventA ResetEvent

user32

LoadStringA

Name

.text

Size

567KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninstall.exe.nsis

SHA256 75c0f40cf6474ed618781e6a5669aa8e8973494c10b0ba28762a6d647901e1f4
MD5 c6b5c27e06e34d215603a29d925488b4
SHA1 35978bb4a60e1bc4d539d06f5dad9ac8728d2e31
SHA512 b49863ca30918f51bb06cecf9a15a8055d2c34fb7292fe2f1318d330b21564049d3879c0b91bdbcee3f7509de163cf5088cf705cb47db2928eb1b9c8124bd6bd
SSDEEP 6144:2MuE2WiR8IvrpflDWk4pCNzXMmfOHa48ia/nmIrtN0I:XuYiR8IrtFWnpCNuHP8ia/nPrgI
TLSH
T15C34231E8F69C131E3326C0B220E3CF7A64A35A6B742CD45B8D2ED91154579B79EEB30
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

camfrog_bot_setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/camfrog_stat.exe

PE Signature issue

ole32

kernel32

urlmon

user32

generic

$PLUGINSDIR/cfbot.dll

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

shlwapi

ws2_32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

CamfrogBot.exe

PE Signature issue

version

shell32

netcore

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

shlwapi

comctl32

generic

copy.exe