Ballance[.]iso | Triage™

resource
unpack002/DirectX9/mdxredist.msi

resource
unpack003/MSDvbNP.ax
unpack003/MSVidCtl.dll
unpack003/Mpeg2Data.ax
unpack003/bdaplgin.ax
unpack003/bdasup.sys
unpack003/ccdecode.sys
unpack003/ipsink.ax
unpack003/kstvtune.ax
unpack003/kswdmcap.ax
unpack003/ksxbar.ax
unpack003/mpe.sys
unpack003/msdv.sys
unpack003/msdv98se.sys
unpack003/msyuv.dll
unpack003/nabtsfec.sys
unpack003/ndisip.sys
unpack003/psisdecd.dll
unpack003/psisrndr.ax
unpack003/slip.sys
unpack003/streamip.sys
unpack003/vbisurf.ax
unpack003/wstcodec.sys
unpack003/wstdecod.dll
unpack004/MSDvbNP.ax
unpack004/MSVidCtl.dll
unpack004/MSVidCtl.w2k
unpack004/Mpeg2Data.ax
unpack004/bdaplgin.ax
unpack004/bdasup.sys
unpack004/ccdecode.sys
unpack004/ipsink.ax
unpack004/kstvtune.ax
unpack004/kswdmcap.ax
unpack004/ksxbar.ax
unpack004/mpe.sys
unpack004/msdv.sys
unpack004/msyuv.dll
unpack004/nabtsfec.sys
unpack004/ndisip.sys
unpack004/psisdecd.dll
unpack004/psisrndr.ax
unpack004/slip.sys
unpack004/streamip.sys
unpack004/vbisurf.ax
unpack004/wstcodec.sys
unpack004/wstdecod.dll
unpack005/BdaSup.sys
unpack005/MSDvbNP.ax
unpack005/MSVidCtl.dll
unpack005/Mpeg2Data.ax
unpack005/bdaplgin.ax
unpack005/ccdecode.sys
unpack005/ipsink.ax
unpack005/kstvtune.ax
unpack005/kswdmcap.ax
unpack005/ksxbar.ax
unpack005/mpe.sys
unpack005/msdv.sys
unpack005/msyuv.dll
unpack005/nabtsfec.sys
unpack005/ndisip.sys
unpack005/psisdecd.dll
unpack005/psisrndr.ax
unpack005/slip.sys
unpack005/streamip.sys
unpack005/vbisurf.ax
unpack005/wstcodec.sys
unpack005/wstdecod.dll
unpack002/DirectX9/DSETUP.dll
unpack006/amstream.dll
unpack006/d3d8.dll
unpack006/d3d9.dll
unpack006/d3dim.dll
unpack006/d3dim700.dll
unpack006/d3dpmesh.dll
unpack006/d3dramp.dll
unpack006/d3drm.dll
unpack006/d3dxof.dll
unpack006/ddhelp.exe
unpack006/ddraw.dll
unpack006/ddrawex.dll
unpack006/devenum.dll
unpack006/diactfrm.dll
unpack006/dimap.dll
unpack006/dinput.dll
unpack006/dinput8.dll
unpack006/dmband.dll
unpack006/dmcompos.dll
unpack006/dmime.dll
unpack006/dmloader.dll
unpack006/dmscript.dll
unpack006/dmstyle.dll
unpack006/dmsynth.dll
unpack006/dmusic.dll
unpack006/dmusic32.dll
unpack006/dplaysvr.exe
unpack006/dplayx.dll
unpack006/dpmodemx.dll
unpack006/dpnaddr.dll
unpack006/dpnet.dll
unpack006/dpnhpast.dll
unpack006/dpnhupnp.dll
unpack006/dpnlobby.dll
unpack006/dpnsvr.exe
unpack006/dpvacm.dll
unpack006/dpvoice.dll
unpack006/dpvsetup.exe
unpack006/dpvvox.dll
unpack006/dpwsockx.dll
unpack006/dsdmo.dll
unpack006/dsdmoprp.dll
unpack006/dsound.dll
unpack006/dsound3d.dll
unpack006/dswave.dll
unpack006/dx7vb.dll
unpack006/dx8vb.dll
unpack006/dxapi.sys
unpack006/dxdiag.exe
unpack006/dxdiagn.dll
unpack006/dxdllreg.exe
unpack006/dxtmsft.dll
unpack006/dxtrans.dll
unpack006/encapi.dll
unpack006/gameenum.sys
unpack006/gcdef.dll
unpack006/gchand.dll
unpack006/hidgame.sys
unpack006/joy.cpl
unpack006/ks.sys
unpack006/ks98.sys
unpack006/ksolay.ax
unpack006/ksproxy.ax
unpack006/ksse.sys
unpack006/ksuser.dll
unpack006/l3codecx.ax
unpack006/mciqtz32.dll
unpack006/migrate.dll
unpack006/mpg2splt.ax
unpack006/msdmo.dll
unpack006/mskssrv.sys
unpack006/mspclock.98
unpack006/mspclock.se
unpack006/mspclock.sys
unpack006/mstee.sys
unpack006/mswebdvd.dll
unpack006/pid.dll
unpack006/qasf.dll
unpack006/qcap.dll
unpack006/qdv.dll
unpack006/qdvd.dll
unpack006/qedit.dll
unpack006/qedwipes.dll
unpack006/quartz.dll
unpack006/stream.sys
unpack006/stream98.sys
unpack006/swenum.sys
unpack006/swenum98.sys
unpack006/swenumse.sys
unpack002/DirectX9/dsetup32.dll
unpack008/amstream.dll
unpack008/d3d8.dll
unpack008/d3d8thk.dll
unpack008/d3d8thk.w2k
unpack008/d3d9.dll
unpack008/d3dim.dll
unpack008/d3dim.xpg
unpack008/d3dim700.dll
unpack008/d3dpmesh.dll
unpack008/d3dpmesh.xpg
unpack008/d3dramp.dll
unpack008/d3dramp.xpg
unpack008/d3drm.dll
unpack008/d3drm.xpg
unpack008/d3dxof.dll
unpack008/d3dxof.xpg
unpack008/ddraw.dll
unpack008/ddrawex.dll
unpack008/devenum.dll
unpack008/diactfrm.dll
unpack008/diactfrm.xpg
unpack008/dimap.dll
unpack008/dimap.xpg
unpack008/dinput.dll
unpack008/dinput.xpg
unpack008/dinput8.dll
unpack008/dinput8.xpg
unpack008/dmband.dll
unpack008/dmcompos.dll
unpack008/dmime.dll
unpack008/dmloader.dll
unpack008/dmscript.dll
unpack008/dmstyle.dll
unpack008/dmsynth.dll
unpack008/dmusic.dll
unpack008/dplaysvr.exe
unpack008/dplayx.dll
unpack008/dpmodemx.dll
unpack008/dpnaddr.dll
unpack008/dpnet.dll
unpack008/dpnhpast.dll
unpack008/dpnhupnp.dll
unpack008/dpnlobby.dll
unpack008/dpnsvr.exe
unpack008/dpvacm.dll
unpack008/dpvoice.dll
unpack008/dpvsetup.exe
unpack008/dpvvox.dll
unpack008/dpwsockx.dll
unpack008/dsdmo.dll
unpack008/dsdmoprp.dll
unpack008/dsound.dll
unpack008/dsound3d.dll
unpack008/dswave.dll
unpack008/dx7vb.dll
unpack008/dx8vb.dll
unpack008/dxapi.sys
unpack008/dxapi.xpg
unpack008/dxdiag.exe
unpack008/dxdiagn.dll
unpack008/dxdllreg.exe
unpack008/encapi.dll
unpack008/gcdef.dll
unpack008/gcdef.xpg
unpack008/joy.w2k
unpack008/joy.xpg
unpack008/ks.sys
unpack008/ksolay.ax
unpack008/ksproxy.ax
unpack008/ksuser.dll
unpack008/l3codecx.ax
unpack008/mciqtz32.dll
unpack008/mpg2splt.ax
unpack008/msdmo.dll
unpack008/mskssrv.sys
unpack008/mspclock.sys
unpack008/mspqm.sys
unpack008/mstee.sys
unpack008/mswebdvd.dll
unpack008/pid.dll
unpack008/pid.xpg
unpack008/qasf.dll
unpack008/qcap.dll
unpack008/qdv.dll
unpack008/qdvd.dll
unpack008/qedit.dll
unpack008/qedwipes.dll
unpack008/quartz.dll
unpack008/quartz.w2k
unpack008/stream.sys
unpack008/swenum.sys
unpack002/DirectX9/dxsetup.exe
unpack002/Setup.exe
unpack002/autorun.exe

resource
unpack002/Acrobat/AcroReader51_ENU_full.exe

Ballance.iso

SHA256 251399f3c24c0dfb76887f698b478a5c5bb785c1677f71dd9444ee653ca3eefb
MD5 d7722340349157e1e5a39550a4dbfdc0
SHA1 cb60297fac9f046a0e17b0d91a45966a4a1b9583
SHA512 66a08eb509b130e41e5a8321a1aa72a5b36c9bdbb0c0b1a47280a7183987882627043baaf83aed55c945a0a1ef7c2bc5677d30471c3d4fbb68700e58cb53f425
SSDEEP 6291456:MK6EYTYJhNulL4yfN7UnS02M+uwDY8xFcVcBdo0Uym:v6VWueyfN7UnS02RuwDS4Uy
TLSH
T1BDA80187E152D828F5245E70DC53EFF142A2FD02CF198563B528BC0DBEF95A62E60396
MD5 SHA1 SHA512 SSDEEP TLSH

out.iso

SHA256 251399f3c24c0dfb76887f698b478a5c5bb785c1677f71dd9444ee653ca3eefb
MD5 d7722340349157e1e5a39550a4dbfdc0
SHA1 cb60297fac9f046a0e17b0d91a45966a4a1b9583
SHA512 66a08eb509b130e41e5a8321a1aa72a5b36c9bdbb0c0b1a47280a7183987882627043baaf83aed55c945a0a1ef7c2bc5677d30471c3d4fbb68700e58cb53f425
SSDEEP 6291456:MK6EYTYJhNulL4yfN7UnS02M+uwDY8xFcVcBdo0Uym:v6VWueyfN7UnS02RuwDS4Uy
TLSH
T1BDA80187E152D828F5245E70DC53EFF142A2FD02CF198563B528BC0DBEF95A62E60396
MD5 SHA1 SHA512 SSDEEP TLSH

AUTORUN.INF

SHA256 b94696b741ca3a13e7f5126cd5010b4b63f943b5e71c6833d8089b0655159c0f
MD5 6891f9b7019907b9d1666e1c60bb2ff9
SHA1 8f265c73035f07b3c37ab1689479e1f987709dab
SHA512 868515cfdd990b6a669b3561d5567cfc823e04af8dd940958381cce1f37219ada7a769c2638f11f1978d4d1fa324b4784a759160c460298827b17e0a5e9bb9f5
MD5 SHA1 SHA512

Acrobat/AcroReader51_ENU_full.exe

IMPHASH 4204e1fe9e2e0a7f6bec612446ce171b
SHA256 226513a2dee5989c664cbeac9f0d4531177e0677dc1ae6449a4f57f1bd6148f8
MD5 e34f81e8cb00a7d40eb2e2617697a443
SHA1 e17e0c6bc79b6b191d8addb54488302f0e81c5e9
SHA512 3134fd21adff11f287df59bfdab6976a9662714f4e952a27896a67046e426dfcbfcd1c1d5e8a8f4985ede099d22d41321dbf2b320c4ae01864ea18cd2463b36d
SSDEEP 393216:tfXAKsoR9k0ni3kt2XhCEJ2avXzHuCYn9Y8+xaCJUwV:tfXAsR9k0nqktwCS57HhY9Y8SakjV
TLSH
T15DD6334261656895F0F9887190A9DEBB8A5CFE091F34616BCE60E07F51F2F501C3AF8B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1f:06:6b:36:01:e5:8c:db:eb:98:c0:88:68:c5:cc:96

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems\, Incorporated,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Acrobat Engineering,O=VeriSign\, Inc.,L=Internet+L=San Jose,ST=CA,C=US

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

49424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointer CreateDirectoryA GetPrivateProfileStringA SetFileAttributesA SetFileTime LocalFileTimeToFileTime WriteFile DosDateTimeToFileTime GetProcAddress DeleteFileA FreeLibrary GetTempFileNameA LoadLibraryA GetTempPathA GetSystemDirectoryA FormatMessageA lstrcmpA lstrcpynA GetLastError ReadFile FindResourceA CompareStringA CreateProcessA WaitForSingleObject GetStartupInfoA RemoveDirectoryA FindNextFileA ExitProcess MulDiv GetSystemDefaultLCID GetModuleFileNameA lstrcatA GetFileAttributesA CreateFileA GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile Sleep GetDiskFreeSpaceA FindFirstFileA FindClose lstrcpyA lstrlenA LockResource LoadResource GetWindowsDirectoryA CloseHandle SetStdHandle LCMapStringW LCMapStringA RtlUnwind GetFileType GetStdHandle SetHandleCount FlushFileBuffers GetOEMCP GetACP GetCPInfo GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetCurrentProcess TerminateProcess MultiByteToWideChar GetStringTypeW GetStringTypeA WideCharToMultiByte VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersion GetCommandLineA GetModuleHandleA HeapFree HeapAlloc

user32

SendMessageA TranslateMessage MessageBoxA wsprintfA GetWindowLongA GetParent SetWindowTextA GetWindowTextA GetWindow SetDlgItemTextA EndDialog SendDlgItemMessageA CharNextA DialogBoxParamA GetClassNameA IsCharAlphaA GetDesktopWindow GetDlgItemTextA KillTimer EnableWindow SetTimer PostMessageA SetFocus CreateDialogParamA DestroyWindow GetDlgItem GetDC ReleaseDC ScreenToClient SetWindowLongA CreateWindowExA SystemParametersInfoA GetClientRect MapWindowPoints SetWindowPos LoadStringA MessageBeep GetSysColor DispatchMessageA PeekMessageA GetWindowRect

gdi32

CreateFontIndirectA TextOutA SetTextColor SelectObject SetBkMode GetTextExtentPointA GetDeviceCaps GetObjectA DeleteObject

comctl32

ord17 PropertySheetA

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA

lz32

LZOpenFileA LZCopy LZClose

DirectX9/BDA.cab

SHA256 47acfa0dd8b6697fe711f3c8ea17396fc9dfffa0ef996877fc3ddd75d4d20f5d
MD5 8900f15a6bb4e88a40e61dff0383904c
SHA1 31713f533548833af5e5b91ae9e87fde3e24a59c
SHA512 8f11a78654660e72e4f7c12dc2bef36fb76091c6216a75b4b3895664d9247680fbc2de02bc6429c8a30e1ae56b7871a04fe189fb4a31b43f67d2103ded0dee96
SSDEEP 12288:U8x3bZrT95c4NXJOdpOMBMqZP6MBTYZ7FlQxqCNKT43o5W9FJ788a+khcicB4K8O:U8xtrB5cOopBB1NYZFZEFoyFJmze/BwQ
TLSH
T11AE423B3A42F58127C2F39352E94EB100AF17686E688098F5EB4E37A302D4B33D76655
MD5 SHA1 SHA512 SSDEEP TLSH

MSDvbNP.ax

IMPHASH bd61e5a03c0af93c60b30cf39184a4a7
SHA256 3b6737deb5ff8e688ab0d4fdcad830ad59bb33dbc8ff2a92c5fb34b5dd3168d9
MD5 92aa046c550b641e0c88b8e34228699a
SHA1 4f5815b3a27295b7099523c70cdb7f990fad6a82
SHA512 6485a02003b187e8d37fdb4c9c76896b6746b648db4f7c9aafeab172b4eceec7123414388ce930cdf5c8e105c27a9225523ff7f91c1146d29fa1744ec2b211af
SSDEEP 768:gHanLi78wwyADfvpn1hD13+9R/zMlACDh1WZkiHcsgQ4w5gkPlG2e:5LQ8wwDfvpn1hDg9Rrmh1WZt8d0GkN
TLSH
T122332A5637F3C07AD2A322B2872AF7D97AB6D30905159D015B041E0A6F7428BD7BCB4B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37083

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

MSVidCtl.dll

IMPHASH 4cab68af3a9d463423ff5188da351b39
SHA256 d041ce868c0dd6271813d6eb37ade31da6bac6b9363aa418fb4ac0bf722bf425
MD5 c87caca611eddc4aa2cb6acf93441949
SHA1 a4aa2f7cac3a97ca1386968dd5130aeac79ef0a6
SHA512 540ae2d492f5703862e7999a70827161102a53efa5567a5d18cc25d417d45e5c77faeab86c08b97954eb3e9a22cc5bbdb08b46fa565a8a342e5b9aa7e6311061
SSDEEP 6144:pOnqJibxKYFhKIPX0DKm7+RNpBYXUC36gw7TUkJewWvCm:pOjbwoK4E1qNQO7g
TLSH
T10DA43C12BBC8C672D1A601354D37A7DE2BBDBD072F2286073388271E2FF2B885656755
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

192081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WideCharToMultiByte DisableThreadLibraryCalls lstrcpyA lstrcatA GetModuleFileNameA FreeLibrary GetProcAddress LoadLibraryA InterlockedIncrement InterlockedDecrement IsDBCSLeadByte lstrcmpiA lstrcpynA GetShortPathNameA GetModuleHandleA FormatMessageA CreateEventA WaitForSingleObject ReleaseMutex CloseHandle GetLastError LockResource LoadResource FindResourceA CreateMutexA SetEvent ResetEvent WaitForMultipleObjects CreateThread QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess VirtualQuery lstrlenA VirtualProtect GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA IsBadCodePtr IsBadReadPtr HeapSize IsBadWritePtr VirtualAlloc GetCPInfo GetOEMCP SetUnhandledExceptionFilter WriteFile VirtualFree HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree ExitProcess HeapReAlloc HeapFree MultiByteToWideChar DeleteCriticalSection HeapDestroy EnterCriticalSection LeaveCriticalSection InitializeCriticalSection lstrlenW GetVersionExA GetThreadLocale GetLocaleInfoA GetACP GetSystemInfo InterlockedExchange HeapAlloc RaiseException GetCommandLineA TlsSetValue Sleep

ntdll

RtlUnwind

ole32

StringFromCLSID CoCreateFreeThreadedMarshaler ProgIDFromCLSID CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CLSIDFromString CoUninitialize StringFromGUID2

oleaut32

LoadRegTypeLi VARIANT_UserMarshal VARIANT_UserSize SysAllocString LoadTypeLi RegisterTypeLi VariantClear VariantCopy SysAllocStringByteLen VarUI4FromStr SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate VariantChangeType SysStringByteLen SysStringLen SysAllocStringLen SetErrorInfo CreateErrorInfo VariantInit VARIANT_UserFree BSTR_UserSize SysFreeString BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal VARIANT_UserUnmarshal

user32

CharNextA LoadStringA TranslateMessage PeekMessageA MsgWaitForMultipleObjectsEx DispatchMessageA

advapi32

RegQueryValueA RegSetValueA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryValueExA

rpcrt4

NdrOleAllocate CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs NdrDllUnregisterProxy NdrDllRegisterProxy CStdStubBuffer_IsIIDSupported NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrStubForwardingFunction NdrStubCall2 CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke NdrOleFree

Mpeg2Data.ax

IMPHASH 244f9b8f61fbb054334418ba678d871c
SHA256 83fb90aa279a519fb55ddca9ea1b62f076f42e1a6d1d3cfa64b52fed7dff2a28
MD5 761b386810f361f2ba35fe2f915d889b
SHA1 bfb056270ca5493a37b5e4123bd4dd6a851f4aa6
SHA512 46bcff4a979c15ecc53edac419e684c9f7fa378fe705bb4f60c76018dc80f6deb6d3c33d844abe96a7405aa5b6ac486227bb0094dde12927130e061101807be1
SSDEEP 1536:We/9MIOf5FDSBBUvMGqrFRev8OADFlds0Fm+F1kDN:rkfn+BcvtADyim+PkDN
TLSH
T1EC437D427FD290B2C3523173DE793BA6F7FAEA480923DE265B0825865E71143B476B07
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

33590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ResetEvent WaitForMultipleObjects LocalAlloc LocalFree CreateThread LocalReAlloc Sleep QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess CreateEventA GetThreadPriority SetThreadPriority GetModuleFileNameA GetLastError MultiByteToWideChar SetEvent CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection WaitForSingleObject DeleteCriticalSection GetCurrentProcess lstrlenA LoadLibraryA InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExA GetCurrentThread

msvcrt

_purecall ??3@YAXPAX@Z ??2@YAPAXI@Z __CxxFrameHandler malloc free

winmm

timeKillEvent timeBeginPeriod timeEndPeriod timeSetEvent

advapi32

RegSetValueExA RegCreateKeyA RegSetValueA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA

user32

GetQueueStatus wsprintfA MsgWaitForMultipleObjects DispatchMessageA PeekMessageA PostThreadMessageA RegisterWindowMessageA

ole32

CoTaskMemAlloc CoInitialize CoFreeUnusedLibraries CoUninitialize StringFromGUID2 CoCreateInstance CoTaskMemFree

bda.inf

SHA256 8e12de31f46f9ea64ba2a235cba60c3a00fc8d67ea9cdab0a54b5107e9d83a7e
MD5 a9906b5145e151b6fcd89abe8d0cfe10
SHA1 e3ef77ca35166e22fce6a991f670f997dd591ca7
SHA512 22892195ad285c248f9df5d09b8db2cea1322089498b3eb71c8524df3addd6c64ec110aff9f78b28585cf42e9865230186384acc8666bd95fd12b6aca2dcc71b
SSDEEP 192:00a9Qh3X9Rsh3dkQ2J5s9Qh3VD9Rsh31flRlXodpxE4uHjNuxcr:M9U9RHa989RWflRlXodpxeCI
TLSH
T17222955E432F5923A391109DFBC12DC7B2B18464E4C6408F72BDCF196A5AC99011AFFB
MD5 SHA1 SHA512 SSDEEP TLSH

bdaplgin.ax

IMPHASH 1dbce2677ed0e9df3b7a82b88863a3d4
SHA256 7b51275a4e959f15b1436eef26835dcab7f4b9d7d72202712e0d0433b0e42bdb
MD5 ddd0da38c23b32b84f3d7e384960b5f5
SHA1 129d521d651e1a2debea5b2b53fa7060c0734387
SHA512 a67bda31a63bebef934aa9c71e8dc95bc927347836dcbdcd200183e9cab2eb607c2f5ca0f89bb969ff1578ad4d9c6ef7042dcca4ebda3ad3ed7cf423c79a7636
SSDEEP 384:aVUBot8PYxyMVm57zBK1TGter7igTVXfMkhKTKWNy/WKN:rB/PYx/VkhK1TkeKgCk0EJ
TLSH
T12A722B12EBE248B3E2D346325BF7268722FAD96863D5AC09974016071E765C3E17634F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bdasetup.inf

SHA256 5d53cd698232e64362e1197a90eabcbb3106857e3d272365a70d39bdfca54b31
MD5 bcc67174e5c0a8b8699ce39460a6e5f5
SHA1 db7e1c7a084159f53c01a449b82a97117d230b56
SHA512 e83215df70c2a34a54003b5ff3f38becc8397562dbc8c3dc896283835f7789e7f00b288465c0fd2e74089e3b07bfb620717ae67662f32e3ff96b72053cbcc267
SSDEEP 192:62pPXOFcssVHSVyVdwaVEegWa7za0myx0FDj2v6HJod+Cg:fpPXD4myxAPq6pod+H
TLSH
T17FD197444723D21BA9D8203C05A35BCBD6214079623AC85A79DAC98CDF0DC2E7B776BA
MD5 SHA1 SHA512 SSDEEP TLSH

bdasup.sys

IMPHASH 6b2b65bafa0dd0cf733b55e44cdea375
SHA256 90753b4fc2b47e1ed6805510b40d51875ab934e21e837b25a1b21b501baa0617
MD5 a9ebbf24a7801b101647dafae3875e1b
SHA1 2dec49095baa61b9efc3f4a932583658767839b6
SHA512 ab21d58a66a5473ba16b9a5edde84590a465488afe09a40323573a2d1d6681abc727c78faa24eeb1a76fab6e7dd551a49efe4bf5facdb264025649c2034807f9
SSDEEP 192:KEoUlGuDpAhrnzECZBgb3k5781k4oTSPZCyDg/qIYfWDvtWxU:2UGuDCLhTgLkx8ZoT0BfIYfWDvtWx
TLSH
T17E321B8076D44F36E4EF4DF0CD8711BE667FA2115875A35E063A164A3C65E903E3931B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BdaSup.pdb

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

211B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

896B

Virtual Size

834B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGECONS

Size

768B

Virtual Size

652B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

768B

Virtual Size

674B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

278B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ccdecode.inf

SHA256 01a55e7e46078b922d5acadf0dd523bf8dc0b5d911be9ec57d890f37c27ca1d0
MD5 72be12ea26bf6649482166af3fdd0cc6
SHA1 31ae26d3ecd44391bc93ff5ddce1d1b0f597d60e
SHA512 0476540cf9d54be6dddf961151cdd90b85b0893a3e373aa56cab3b1bb9c238446228faeb02deff98999ad2c0432101e9b659a7781d827585d2ef3395440e81ec
TLSH
T194716679CD0F91326386E12E7BD21EC2EA095CF2856A0510F55D860427BAD8C531FDDE
MD5 SHA1 SHA512 TLSH

ccdecode.sys

IMPHASH d5977c633dbdac9c68f7e446e09a0a9d
SHA256 c2f53f4e5636f1e742a601db006f735afdcc42d7c56b6a247094b4cd5e1a562b
MD5 3ad2f721d02d28d8f8c42f3c1145824d
SHA1 c3e27ad216f9ec57b02614e7c1e1de9a189e0d7a
SHA512 efde7da34eb0db5892dd3c81511857873299e4df74802d28cd401d3793581b3fb8c7bffd349a01081ff30626df02abf87e122f30b997ee32eda108c57f8ede27
SSDEEP 384:/iFWZsvzcfhWGR6/xPoH6ZhhiW75Xyn2VvnEsg2WIIW:/c+sgDjW975XfJEpg
TLSH
T119721B84B3C04DB1ED471CB1446B770927B3EB121B2693EB9110EDAA7C2B2D0AD7D6D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ccdecode.pdb

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

761B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

554B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dx9bda.cat

SHA256 0a30442fe1ef6688ee47bf22abc83b94c9f606cdb8b4820e216551f33d3a0f12
MD5 6fec0a32755386ff0a4c90c11da06a83
SHA1 81eb18a380054977c3ea3562646aa7e5c10d50f9
SHA512 99db6385da13c53c5fa175c9df516705ee2df257a8df1b7e17590118ace5291ffb8e3942629fbd9cd3e8cec25b56eb1d490c76cba7f99aeac4aa188c7523c10a
SSDEEP 192:bbaSONovuAQPQQHpA6SHScEEQQvuYpaErlnkTN2+goM8+J54Kn4dlIDnSm:brIbsnThe1MiDWnSm
TLSH
T1D232C58705AD0192E4678E7097E5F88BB832FBA7AC215D3E316373964883792F31D81D
MD5 SHA1 SHA512 SSDEEP TLSH

ipsink.ax

IMPHASH 9c828b85bafb7d0f5f2d6ab092d5473d
SHA256 a1fdbb9b976abd4b8d40259be09f5d3a1b6d954139e91c984d89caf8f1ee479f
MD5 98212069d4c937a397049c1a520be394
SHA1 ed88ecb565cab7281feae33ac489040b699afd96
SHA512 70310f2a431b948b17cc7df77966bfa360f4b9edc1ac6bb61fdc1d65c1ec9b5e428da79380878c963c8e12496a1248e6e09f012d4f3b0ea10d6159b9135d330c
SSDEEP 384:1CQH7RI/FGBxuzr+I/IrxCg8lucMkX6VWA6Wv:PbRI9YQzr+UIIglkX6Zr
TLSH
T16F623C1273D144A3D497863609F51A1AB7F9EB299A3DEE06C7050A0F29B9983D2F434F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9669

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle ReleaseMutex WaitForSingleObject GetVersionExA ResetEvent WaitForMultipleObjects CreateThread CreateMutexA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls SetEvent GetModuleHandleA TerminateProcess GetCurrentProcess WaitForSingleObjectEx CreateEventA GetLastError Sleep IsBadReadPtr IsBadWritePtr GetProcAddress MultiByteToWideChar GetModuleFileNameA lstrlenA InterlockedDecrement FreeLibrary InterlockedIncrement

msvcrt

rand ??3@YAXPAX@Z ??2@YAPAXI@Z free malloc _snprintf

advapi32

RegSetValueA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA RegCreateKeyA

user32

wsprintfA

ole32

CoCreateInstance CoInitialize StringFromGUID2 CoTaskMemAlloc CoFreeUnusedLibraries CoUninitialize

oleaut32

SysStringLen SysFreeString SysAllocStringLen

ksproxy.ax

KsSynchronousDeviceControl

iphlpapi

GetUniDirectionalAdapterInfo GetIpAddrTable

wsock32

htons WSAStartup ioctlsocket setsockopt bind closesocket

ws2_32

WSASocketA

kstvtune.ax

IMPHASH 373218214f1164b605815211c9b37c65
SHA256 d7cee0060dfb887138c5cf220e64eb1f853eb2b38ec09a1077ccca80f659bdd0
MD5 f9a890fd536d2aeb0d809c3a2f92eb3d
SHA1 18919330dca1d8c9d02d7fd90920084986cff917
SHA512 e12e9bc4a97464194b5a346499347292b1a295c22b56d2e49c490f4c19f05ef302af4048ff457a0ee5aca5f9ffd4ce47cdefade633c3871f79c3e5e47c5d7264
SSDEEP 6144:De5h7K/8OJMv9iixiiiCaaii66mizDDDDDDDDDDDDDDDDkkkkkkkkkkkkkkkkkVq:wh7a8D9iixiiiCaaii66mizDDDDDDDDP
TLSH
T14644F81093E24131FA739B7C2B729F92EB79F80867F741C635487666ADA1240AC36F71
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

28494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadResource FindResourceA GetLastError SizeofResource InterlockedCompareExchange Sleep CreateFileA InterlockedExchange GetProfileIntA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess LockResource GetACP MultiByteToWideChar CreateMutexA WaitForSingleObject ReleaseMutex CloseHandle IsBadWritePtr LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExA InitializeCriticalSection

msvcrt

_purecall ??2@YAPAXI@Z strtol ??3@YAXPAX@Z

advapi32

RegCreateKeyExA RegOpenKeyExA RegEnumValueA RegCloseKey RegQueryValueExA RegDeleteValueA RegSetValueExA

user32

DestroyWindow DefWindowProcA wvsprintfA LoadStringW GetWindowRect ShowWindow GetWindowLongA GetDlgItemInt wsprintfA KillTimer MessageBoxA LoadStringA CheckRadioButton SetDlgItemTextA SetDlgItemInt InvalidateRect SetWindowLongA MoveWindow CreateDialogParamA GetDesktopWindow SendMessageA GetDlgItem GetAsyncKeyState PostMessageA SetTimer EnableWindow SetWindowTextA UpdateWindow

comctl32

ord17

ole32

CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CoUninitialize CoFreeUnusedLibraries

oleaut32

VariantInit VariantClear

ksproxy.ax

KsSynchronousDeviceControl

kswdmcap.ax

IMPHASH 95d6690a876714b701968430fd31ed5a
SHA256 9e4e9600df4099ed9b09c69a612c54cc467b7f2a73a105db48506b7f6a19dd99
MD5 70d6bccb193de30c5ede4ad2fe1e88a0
SHA1 26f8ff5c3c80fbc19e29ac16747964b9bc50d3d5
SHA512 1b3e04833304d1ba38870c86b2aa6f73be8e1e08b272c2f8f89ce046a52f1253088a3b5cd22212f52753bc8dac7728c75f8e026cda5b2ead472323654f15e2e5
SSDEEP 3072:voMCye3+GyCzX3aR1s9XP9k/WsP438ZHbdEcGnnwM4fjqhi9T+zm:gMCyehFO1s9/9k
TLSH
T16D243E0053F5C511F0F70A745DB69BD26E6A7C966820C90EFEAD624F2870E04DD3AB7A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

52241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent WaitForMultipleObjects VirtualFree VirtualAlloc SetLastError CreateThread InitializeCriticalSection ExitThread WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA WaitForSingleObjectEx GetCurrentProcess InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA Sleep lstrcmpA lstrcpyA lstrcpynA CreateEventA GetLastError DeviceIoControl GetOverlappedResult MultiByteToWideChar lstrlenA GetVersionExA TerminateProcess CloseHandle

mfc42

ord823 ord825

msvcrt

sprintf _purecall _ftol __CxxFrameHandler _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ atoi strtod

advapi32

RegSetValueExA RegCreateKeyA RegSetValueA RegDeleteKeyA RegOpenKeyExA RegEnumKeyExA RegCloseKey

user32

SetTimer KillTimer wsprintfA LoadImageA ShowWindow SetDlgItemTextA GetWindowLongA SetWindowLongA CreateDialogParamA MoveWindow InvalidateRect DestroyWindow LoadStringA LoadStringW GetWindowRect GetDesktopWindow EnableWindow SetDlgItemInt MessageBoxA IsWindowEnabled GetDlgItemInt SetRect IsRectEmpty SendMessageA GetWindowTextA SetWindowTextA GetDlgItem

comctl32

InitCommonControlsEx

ole32

CoUninitialize CoFreeUnusedLibraries CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromGUID2

ksxbar.ax

IMPHASH 5116cc2556341d796c2a80b165186825
SHA256 807003d27df6650c1f25d599425861211deee6157a9b17063fa2ee33f5f2ce44
MD5 fb0f0963a85eab06cfd553d9627ccbc9
SHA1 f657642c3fcb5cdd7b776bb00e7761866d881e33
SHA512 404c72539fd5b7afe1849a9e7b2ac92278110007346fab77cca5345d2bd43e8631b84188a76ad55dc4e5a05768af5d16894a9fb03acf12f3dc6c565719c5a08b
SSDEEP 768:ATaLR3XyiRktV34p9/rEvNGIoHRGXz+gxpwD+LBuESF2JBFnuG:cSR3XyxzU/gNoHkzPq2uzF2n5B
TLSH
T1E6037DA137E28072D3B3E237897137B9B6FAF6141639E43A034469C92F7054AD57A307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mpe.inf

SHA256 162c1dd3539436eaaadbb008e3cd275369cdfb51382a04bf8889d9f2a9f0e10c
MD5 d866dd33fe0269cec6d201c35be34750
SHA1 4655d7a2e8ccc9b46b0c8ccd6fc5ffc6897cea1b
SHA512 ef076e9b9a1e8e945f3889f3e8125381de2103c6e6f8ab4635dc9c4327a7bdf49acb4eb2020863c734a11b7eee0817108f181f7297440973d09ee62bba2d96da
TLSH
T12361A56C8C4384B38356E36A5BCB1EC3EB165097C6660508316D4703A79AD1EF31E8EE
MD5 SHA1 SHA512 TLSH

mpe.sys

IMPHASH b709125e5196d69f577afdd8423729ff
SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
MD5 83eff7b976ae24f1a496ca94a8a19919
SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
TLSH
T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mpe.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

640B

Virtual Size

630B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msdv.sys

IMPHASH 86f2d51aaa296b59194197c28572822e
SHA256 bdb107d7eea2a0e77db9439c0a1d5e770d0b59c01c64c833e2cc1da80ad1be8b
MD5 348a7f225eb0253da62ec098bf19fa08
SHA1 6305094f100b95897d103cbda8cb435c7b4e9215
SHA512 802bcd03350bc0f7fa861c587efa22ac3d2a5f9fd4a27085fac78ddd1b8b42c5cec840e0a40fb8cb438be8bcaeeed654657ac26cc58dd842aeca81f7a851b461
SSDEEP 384:cCOT2GNkxNwcLPYSVaZUjBCq2Lj0bUmsVmaVDrOR/BLQjB6IVcvFlQ0WJGEWs:pKCpL5au2LrMODrOFBLQ96IV6MS+
TLSH
T12E236C01B790C871C11142B08E9BA3F467F7B6265F2AA76373B4572F1F39250BE616A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

MSDV.pdb

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

902B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msdv98se.sys

IMPHASH c44f46939591a6629aae6b9d01b9dae7
SHA256 9dbb45724a5136a6e7487660cbedf6051d1b398e1c4be20bc47c8426413d0c06
MD5 f75a35e8f4331a875d3ff8ab4eadef9b
SHA1 bfc3cf16e4765a597325342599d8facbe6d3df78
SHA512 a2cb07be4e28dae1b0d39ce8e8edaa8478f6173b57c8f2f634ec87834aee323bf24bcb628702f1de3b25e74ef8f6beef6369501fb7143d9d6617e5487324d261
SSDEEP 1536:j9krdmj4yXc50WJx7scHLvWbdGiAv1UN:jCdmj4ucxJ1HL06v2
TLSH
T17D436D0173508837C46F83708D5FB775A2B3B9365A2A66AB7F0067683E74551FF28263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

53376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msdv98se.pdb

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msyuv.dll

IMPHASH 317bb2a83416a509406d650a33ce001a
SHA256 34bf7e2c8072f7f74cd8f96ec6dcaf0cc1a2266752f28a01bfc3247ffd6dcab6
MD5 bf66ae458e457e425e7fbb0769ea0f39
SHA1 d98f187d9dd127107d93baa0bf9c384e984d0120
SHA512 0d340c11efd75a1ef030d0343ee3e4fe7949d25a6f85cc6a0e207da2b092bc5e6ae8ce97c5441083971044c1d5845438bafe05f2d71e12918ed40c5e5c23da4f
SSDEEP 192:8olj0Y6wnT1v08JzPLPdoKo9yTYlAU1Wo+Ijuo+Ijpo+Ij2JIGC7qIGC7tIGC7ET:8oV6gtzLL1jWyTYlAsDTZI1WactW
TLSH
T1517283827FAB1D52C0D1093548A7C63B53BE9F7052F7469A4F2515AEF820A61C63BF13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nabtsfec.inf

SHA256 eee3641785da56dd4646a4dc5aeb5827828a3218bd5635491da1ec70608ac604
MD5 187630b45b902dfa52d13f11c69d36e2
SHA1 5c2ca522286b99f8859f6c719d15468c89644a92
SHA512 2fc8220fe6bcdb99a874e3f80937f30aa1b7f733e7148a079a7db075b37005f5c862909d87f69dbfe940489f69456f4d3669cf063f482fce47a0b83c95be24b4
SSDEEP 48:xbcXc68yEhpOD8HK7k38O770g3kc4CqldXcZZx8+wu5S70xjUCdgn9WK13EdbsP2:t00pIfxcZZLiCApt1UhsP2
TLSH
T19E818419CE1B803663E9D11E5BD73E83DB2A30F28D6640C0379C5A08278798C932EDDE
MD5 SHA1 SHA512 SSDEEP TLSH

nabtsfec.sys

IMPHASH 49970d1ef884a17567a446f9fea4d52c
SHA256 c8221eea1a3da78c05de59b395642ca0f4ac97ddc77b0ca6915e8671a227ef81
MD5 7866b154e876bffbdb7d2351f1d5d6f7
SHA1 86e22a7ac075a4e8cba6c016c06ceeae65478335
SHA512 e5b0aff15f6908984978240d2575bf286c9b1a059ac1a6d977fc4cf349ac53c631bb5f8a68dd3f2795a56cfaa2f5e01f55b3dd66be197823f8a2e44ea3d988fb
SSDEEP 768:7oQ7ZoFgMU7KbBPYTDjujwIhkHZHVMV+mpY3jl6myuq2CeaGSOKWi+6mywyRE4Zu:kQ7kgMUiSTDjG9k8DFO3Us
TLSH
T1F2836B00E782BB7BF4EB50F691AB7A4E11B49F110B4982CB6AD47C46AF385D16F32153
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

nabtsfec.pdb

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

1007B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

896B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ndisip.inf

SHA256 6239cda249f35baa9ba1848ebe3df414afa27be38fb8fee79fcdd8dd00dbf907
MD5 3675a3e175c1b4a9a0397d80b6cdfafb
SHA1 5eb1d87943f40a205c9b1a65b880417d1c5ff8aa
SHA512 7ce64105634e7dcb4250a972bf303f4474622ccc61ef07e1742daee8e32ebaff6991bce31c68d782b8f0b31b9c069755548dfd80ac6e4a5c63adcd7484d74299
SSDEEP 96:4VNZ3J6Ep5c2cQHSsK1GMDSsKv/edvZ0EL6OjkiDk9ozMZ/XydUWb:EH3oEI27SsWtDSssedhTLFYig9ov
TLSH
T160D12E194F42AE352BCBD1799B030F43DA36029B891A154435AD5BC02B7F68E632DE8D
MD5 SHA1 SHA512 SSDEEP TLSH

ndisip.sys

IMPHASH 0a8485ddb79fcd7268b3706841e511d5
SHA256 3fde8e6902ddcd0cd2b8821a9faf38181a4ee155adea54077e78a3d3cc29ebc9
MD5 17919678746a35660a06ff329c08cf22
SHA1 d7e8acf345e46c6a74308bfeed2bd747f9877c53
SHA512 49dd42acc4126803e518ff78a36b753f3de33e475e3480316e25d5b27557f4c324d14a72ca8fae3547e2f56a20a9689ba874d751964b03a13c1be83b355dc7f5
SSDEEP 192:dVcVaJbQPAW52P/8Owb2cnFRXeTkrppOA5QPWgZFWd:dKVQSAfP/8gcnnCILMWgZFW
TLSH
T135021B0237D50A7BF0131DF685B7176F6436AA302F6B629B1211D88FAD359D0AA34B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ndisip.pdb

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

384B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

768B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

psisdecd.dll

IMPHASH a63eb4bfb67dc3602cfc27e862114741
SHA256 0e851dbd5a7a9cb0efd317ad169842263b3f1b97211dfbb3da9c89a6dabf9ba6
MD5 f548c2cee7755685d943ec9951067db7
SHA1 c1acf0470bf73d803aa2f97b3e2c2927957c1e0e
SHA512 6506e8eb1d8838d76c66107aa5571d50e71bb39bfacb19d6ec80708d6e1c2f3271e78a21c74a301a591e04f57430508dd045f50e107e42bcb8e06b68e5cc0db2
SSDEEP 6144:4djJAO5i8ux63PSnuc7lyunaq0sZLyXockJ6cXnEUjz/ZnCf5:4313KnuilyfsZGXocncXnEUjz/Znw5
TLSH
T1D8748E103FF6C036C7A56175CA7B6BAAF7B8DB094D600A670B0D162C6F38942D166B1F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

248870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA lstrcmpiA IsDBCSLeadByte lstrcpynA HeapDestroy lstrcpyA lstrcatA GetModuleFileNameA DisableThreadLibraryCalls FreeLibrary GetProcAddress LoadLibraryA SizeofResource LoadResource FindResourceA GetLastError LoadLibraryExA lstrlenW LockResource GetModuleHandleA CloseHandle QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess FlushFileBuffers WideCharToMultiByte MultiByteToWideChar Sleep InitializeCriticalSection InterlockedDecrement InterlockedIncrement DeleteCriticalSection LeaveCriticalSection GetShortPathNameA EnterCriticalSection SetStdHandle VirtualQuery GetSystemInfo VirtualProtect LCMapStringW LCMapStringA SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr GetCPInfo GetOEMCP GetACP LocalFree InterlockedExchange TlsSetValue GetCommandLineA GetVersionExA HeapFree HeapReAlloc HeapAlloc RaiseException ExitProcess TlsFree SetLastError TlsGetValue TlsAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree WriteFile VirtualAlloc IsBadWritePtr HeapSize SetUnhandledExceptionFilter

ntdll

RtlUnwind

winmm

timeGetTime

advapi32

RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA RegEnumKeyExA

user32

CharNextA

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoCreateFreeThreadedMarshaler

oleaut32

SysStringByteLen SysAllocStringByteLen RegisterTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantCopy VariantInit SysAllocString SysFreeString VariantChangeType

psisrndr.ax

IMPHASH 89452c43805800f5fc649a24f8bcf44d
SHA256 26d0258f5ca8b7c0012087bbbe59c1fc06e42564a05ab64f8d56b1a3ba2ea3d9
MD5 94869cee1dfc25f2749f0ed10a94437d
SHA1 94116e06dcbfb3866728ac229dbff640eb0082aa
SHA512 91064989414206585a66c285540ecf6ef7eceeb8099df6583b1c48a6e23d927dc50548ebcf1dc5d1b24c27599ece937ec1d307f883be068b737f03a09012af65
SSDEEP 768:TOQa4TlzjGJ96Jg//atAUutO8YmkEHCT:e4Rzjc96CKtAUuHTkYC
TLSH
T152D24B033BD660F2C6B35233C92137ABE7FEEA581A39DE145A0819452A71143F17A78F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

slip.inf

SHA256 418040f2b05a196c48fceae77afaa9e58ca87b10269dc084be493db377c82a31
MD5 a42a3419a484b82e752b850cd13bfdd3
SHA1 fdb7a19707b7ea6e349c6559152cb5f1c02483e4
SHA512 eda1f7ead98530284ee850dffae35073f22c3399cb98b6e25dd62d3ec175b4d160d1841ccde5c4261b76bf301feb5417446a30779cf276d778f5c2ba68a4acaa
TLSH
T1757186ACCD0B09636389D1558BE63DC3EF980053C19B0B89306D8A1663C9A9D5E1DDEF
MD5 SHA1 SHA512 TLSH

slip.sys

IMPHASH 3f9db7809b38aa51c5daad51c58fe7a9
SHA256 6abbd6a3398a8bf7f733730784cda73d94ef90cee9d17a344a758c9f6b82eb88
MD5 e9a03c85ae0000132f5e6815e054e66f
SHA1 f5e09359ba3321222596a6de38bfa864b14e186c
SHA512 160935db2bb55ec2ccc417618277e94fa4c483b115b1c3bae41de75cccec2f2fc57e00039bf4f448d8ef4d04ae33f559529e1d0fce08221b17d39936b3edf5b0
SSDEEP 192:EEYCqlIwfHkLPhw22AsALyp2rn4kY0FUSZVx4TWxzyWE:EPZImHkLPhw2H5x4krFUSZAWxzyW
TLSH
T163224A1137E40F75F0D74BB1AE8B27264677E81C9A11E33E02A53D891D3CD00BA2C7A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

slip.pdb

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

263B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

440B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

206B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

streamip.inf

SHA256 1e06c2c3eeb9cfd1938b73e70cb3b841b1da89b97ab6acadde5c136e0b336bf6
MD5 885e850809bc928ee802f13e28449efd
SHA1 39f8ff6d6cfc300b61e6a52f647b05382c4b365b
SHA512 1b660a1eb54b6e1bce2902a260ae95def2eec32af8c06a666138456ad85f5299d9286d588f90fa9c4d938ccee06960d19c2a3ecbed539e41811e89533526c6e8
SSDEEP 96:d0KuUqnZK8hQ+B8ljiFjZMaH1XNgaAgaPRIWKTAidudNjKJ:d0K4Yt+SljiFjSyGyVIKJ
TLSH
T141C173494D2B5473937FF23D9B870F92E6257813D18F414830BCCA161B9AD58922EF9E
MD5 SHA1 SHA512 SSDEEP TLSH

streamip.sys

IMPHASH 024e69c1aa1ed511e6751546ba958390
SHA256 d6844877e94eeb2da058ef304d826fc93de739eb2e76573508f7fc95b080367c
MD5 a44c9b312a08d5728d228bf3e6a57522
SHA1 94ec08f5d19b5e230cbaede6bec8ea941ea4df46
SHA512 fb33d94dfa03d12affaedcf9c37a58466c4f52bbc81444aa066f345c2069770d97b0d1373623025ab84d132bd449629c99290e72e4003ecac2006203f8af10a3
SSDEEP 384:BzjX998FhVnN5Jav/38cjQDu5WhcxLQVcSJcmcViQj/Wg1RW:FjX998Fhb5Ivk3RhcxpgcZi0
TLSH
T1DA52C38D62960473F63F01B41EB2E791EDAFEE156E12C2EA87F25DE50C0264279247F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

streamip.pdb

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

640B

Virtual Size

594B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vbisurf.ax

IMPHASH ae48a05a15c768aaec63afcf3810c760
SHA256 018887564193bb5630f794185fcd1ea4f2c4c35e79f8ff349746ad553cb80292
MD5 cfa4143beb81a867693ce22f95a68749
SHA1 f07b80522bc2eed677650d2d89ccae44615138a3
SHA512 6dae611eb56ef7eabe6e89a3331f796bfa6c0e58f300b969300fd7cf8dd3709c00c93657ac028cc59be2a76375cad0fc2def012bf67a96a9f6ea2ed31527829d
SSDEEP 384:ToCh/XXq0MS0FGt4qz25ilACjFhdkgdUt0VqPL+eGEpw2ygSuaBGMk0KJ8W1jWA7:ToiPoUuqzRlAChUgzM+1FQekNJfjW
TLSH
T1D1C26D12BBD780BADA6355334F793FAAE2B2DB141A3C9C160B1069463A611C3D1FB357
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15322

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wst_czec.fon

SHA256 29549f4d2e29b73200087e0484b31ca87dfa0cb22c7a1cfe1258d0750eb44027
MD5 554df997c4b3cd9c7ab9b4da17f1b9cb
SHA1 a321c7c1355e62d1bbb18512b93ec9399b415011
SHA512 40c7909fc84699a1ae971a0de87c5f47fb5dd2eddb012ff1f866faaf0b0a03f4595ad983210a2970da6c832709f6b8cc1b5d6271038e875074954962cb5308f4
SSDEEP 192:q3IojXHKiSpP/vH3f/3f68lrg83nXn3nX:q3IorypP/vH3f/3fprj3nXn3nX
TLSH
T11582F0455CBF7EE1C49409389E4B9B2448B06E82B852CD92DB712EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_engl.fon

SHA256 7ab2b68a88ac69c806df7bb5a1fb4220777233f80501afe64766b84b22d0a8dd
MD5 5a414bcd0da476df205db8941fd095fc
SHA1 d62e9dfafeb1b6d74b5d9aca9e1e1c9232068dd0
SHA512 13fd2b56b72302dfcff291927c1372eab267af07b730dd55f159688d34bc548cbb8e7a4580752c22b3e8c5ca144a1f16ff563bf5bcd0416ce3ff08240fcfe8e0
SSDEEP 192:qPIojXHjyCyP/vH3f/3fn8lDIg3nXn3nX:qPIor+CyP/vH3f/3fMD/3nXn3nX
TLSH
T1568214455CBF6EE2D49409388E4B9B2448B06E82B852CD92DF712DADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_fren.fon

SHA256 be473acc9c748899f906901dcc35adfb00f36d9d923052d991fa3f9042d7b3bf
MD5 f48eabb60de7a2d478c3e720337052f1
SHA1 11685c48a30b1da1b4679685fac1a616ff566891
SHA512 1b7b3aa5a516a8e159a3ef056d144a771082bfd286da63c8bc644592652515daba9c5dd9b4d4989b5176d51cd1ce18824762576f3dc9bbaaa6f00be9c543ef21
SSDEEP 192:45IojXHZvlXP/vH3f/3f88lX4a3nXn3nX:45Ior5lXP/vH3f/3fTXd3nXn3nX
TLSH
T11B82F0451CBF6EE1C49409388E4B9B2448B06E82B812CD92DF716EADEDF7350E297C5C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_germ.fon

SHA256 78002bc6f1780107f545ff8f9346478add8cc1907f620dec6fc780bde1e38c8c
MD5 96ab323e35f83a7f6cd47f3890906cae
SHA1 a2228a7d236c831e2a0827dd78bfc4ffc1515e90
SHA512 76dbffe05f17c43387005aca1bdc767a7ce830e7c46d3a824bc00997cee3da6a53fd102d017f99bf075a22f9bc319332d594e11f0d9eb6bc481f2326d68fef72
SSDEEP 192:ByIojXHOjNP/vH3f/3fu8lH2/m3nXn3nX:ByIor4NP/vH3f/3fNHD3nXn3nX
TLSH
T19782E0452CBF7DA1D49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_ital.fon

SHA256 a866dfd73415a75025625941c462d76e46ce980259eb0eefc8c4fb109e060c64
MD5 8faee3b19e9c365e383194b34b05de85
SHA1 8bf5d4687b1e5575c91eca0f0193971693889b4d
SHA512 162d27b32a4d7119eea673da80692a78c9a7cf00f17c1edfd6260ddeb378c69d98a633b817c3e4ef1a83a412d6fc0e56276de21bf792d89849bbaae544ab5d33
SSDEEP 192:NuIojXHITKnP/vH3f/3fz8lDSE3nXn3nX:NuIorYKnP/vH3f/3foDV3nXn3nX
TLSH
T10C8202455CBF7EE1C49409388A4B9B2448B06E82B852CD92DF716EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_span.fon

SHA256 d41768876a1ab65191001a2988f2e61bb44fb35b9ea8fa94d169893a3dab77e6
MD5 8d16c368d2e9dd5b0cb21ca6fe5820f5
SHA1 fdaf1425128d7095a3b2ef98f0367293bacbf400
SHA512 8f4a5529aa7dacb447610df0b6d0d1027e07c9d946c4120a9a23ad7c9754ab1f135d1940fadc30aabf35617b74164261ec0a48cd363043597f9e547801aeaf43
SSDEEP 192:vIIojXH7vkEP/vH3f/3fn8ljMO3nXn3nX:vIIor7sEP/vH3f/3fMj93nXn3nX
TLSH
T14182F0452CBF7EA1C49409389E4B9B2448706E82B852CD92DF716EADEDF7350E287C5C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_swed.fon

SHA256 adf1915b3faa31a5d0826d90f464bda32216b5ead9b5c6bd871df401c82a7c60
MD5 3d37c5768207c09dfaf20fb876a121d5
SHA1 f776e69aa0365ae692f6b16640a6aa6012fb6364
SHA512 9f6813b4d12b8c95794c232867c6164240a696091b4488af5e2f5d4657faca1394909b18f21c1c27326a150e0d2a883872664a7cf85f617be29c2c99b52d87a7
SSDEEP 192:+BBLIojXHBmkP/vH3f/3f48l/A+3nXn3nX:+bLIorUkP/vH3f/3fv/Z3nXn3nX
TLSH
T19E82EF455CBF7EA1C49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wstcodec.inf

SHA256 6edd2203dd2fae09442e9afec57738ebc37364d27c84d76bed633e122ca33313
MD5 d0ba27ccb5958090755e939a01ce8cd4
SHA1 7e9ec073086dda1d6bad3f572e041cd482877fc6
SHA512 583d43a959af8ca13d0a215143ddec8c78d0e079c06707dd23a093dcf0bf7039b60a802539c364db769ebe065a3f805d86fb3bae0a0f1b453325a0635e1a52cc
TLSH
T1857123CD8D0B87BF7344D11E7A522E82EB1971F281CE0A043D9D7E143796DC8621E89E
MD5 SHA1 SHA512 TLSH

wstcodec.sys

IMPHASH 5e94d6115bae4fe6e2b87706af1a8293
SHA256 c06580fb07bc31e4a7647fc14bf596840e854a84fa0423d51f82e67633ae1a2b
MD5 399530e6494bad5cd769eeddb1266ed1
SHA1 bc7ce4065ba7e3c78d9728e60bebc2b8d898d763
SHA512 bd3a004b4343c7dbe060cb29b98ff1f011069de0cbb5cfe648cea8c02c92382d18aa4eba0c9b1f23810e484917e948747153dab02fe9992601ad7bc404970ece
SSDEEP 384:1s+CEbgqEcQzr9wa8eiLXpYs9+7NPHeWQyWoS:u+pnQzEY80Qs
TLSH
T153827EC53BC02DBBE9254B355AFB23155BF7D7191662D3838210ED5C3D26E408DB6A23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wstcodec.pdb

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

512B

Virtual Size

484B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wstdecod.dll

IMPHASH af4f8f6981ea7fd495566925fe5b0cf2
SHA256 989afa7b916b81458420d7a66a6da44dacd21b2be4b5e8f548b32564d9e2ebff
MD5 44721c56391ae9a79e6e40a9f77d9d89
SHA1 e1b18acbb5365dfee5e6fcd58c0fcb267dbc65ee
SHA512 accca5ea55dd9c3d12477e37a2ef751b2779ed1cfa9fb9ab4c57ec6f44614e5d207bfd97c7a530bc0ea234625ead1bb98843c28d48bec6077fb721de9616818f
SSDEEP 768:cYDY8arY72ooeftaUnHzFFZ3gGFkO//mgTMvM95QK3DpCBfgJUtkR4+c6L:cm54YioRftvTFFZHFJ/6M9qw0B7tkeM
TLSH
T1AC237DF773D640F3C2E341725A3173A6B2F6E648192EA4235710394E2BA165AC63F637
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess TerminateProcess GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetLastError FreeLibrary InterlockedDecrement InterlockedIncrement GetModuleFileNameA MultiByteToWideChar lstrlenA GetVersionExA GetModuleHandleA MulDiv IsBadReadPtr IsBadWritePtr LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection

msvcrt

free malloc ??2@YAPAXI@Z sprintf sscanf ??3@YAXPAX@Z

gdi32

CreateCompatibleDC DeleteDC CreateFontIndirectA SetBkMode DeleteObject CreateDIBSection SelectObject SetTextColor ExtTextOutA SetBkColor GetTextMetricsA GetSystemPaletteEntries GetDeviceCaps GetTextColor

user32

LoadStringA LoadStringW GetWindowRect GetDesktopWindow DestroyWindow InvalidateRect CreateDialogParamA SetWindowLongA wsprintfA SetRect SetTimer KillTimer IsRectEmpty ReleaseDC GetDC UnregisterClassA SendMessageTimeoutA DefWindowProcA ShowWindow CreateWindowExA GetWindowLongA GetWindowTextA MessageBeep IsDlgButtonChecked GetDlgItem SendMessageA SetWindowTextA CheckDlgButton RegisterClassA MoveWindow

advapi32

RegCloseKey RegEnumKeyExA RegOpenKeyExA RegSetValueExA RegSetValueA RegCreateKeyA RegDeleteKeyA

ole32

CoTaskMemFree StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoInitialize CoTaskMemAlloc

DirectX9/BDANT.cab

SHA256 d83c0089cdfe14c1b008b27257c1950ac86b7df56c03803b84a3422928701eab
MD5 08938174a6e3174795d6f173da953e7c
SHA1 69d8da84ab833958aa4c5a7db3f717dc6599da0f
SHA512 e77148362aac19b82ddf91f329c0bbb4ee2b7759c5a01aea6dded866ca62352a08c549b600d760c57fd947152477e929f2b7820404b0543d7be8a4d4f9784a57
SSDEEP 24576:ZHDdj5+1THImM/OX92BwOnMOecgZ5KGjrIzaq28tgiK3eiKQtz7j9TS:Zj0tM/m9Z2MogLnIJRyehQtBe
TLSH
T1FF3533EAEA86D1351210F53F789F7B7333C7D220457A696B25AD13E882370F036B4995
MD5 SHA1 SHA512 SSDEEP TLSH

MSDvbNP.ax

IMPHASH 8d46331ee3af79cade97e0eb594f6089
SHA256 bf81f612413b69096874a6834c0286983f5440b0ec411120de28364aa0cb2de7
MD5 ddb9b5c1ce074274d74b8a7910c97208
SHA1 593bf280d571733cbfff9b79cbfba043f46de9ce
SHA512 fabe9ae67a1cd850cd36db58f9834b8fc35e1ad2d06ec5b5587e6dc1bacbcda0038c347721c18696fe215f3b0c0f9221c76a416e75e30b339556f89470dc716d
SSDEEP 768:UqC9FJqBx8YBYuPWAcsK6fxeC+AqbiJfeg6LFlixhA+tl7WwJ:ULF8n8YBXPWAe6sAqOdv0ixDJ
TLSH
T19733185733F7C17AD2A362B2862AF7D9BAB6D30906159D011B040E0A1F7468BD37DB4B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEvent CloseHandle CreateThread CreateEventW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA IsBadWritePtr GetCurrentProcess lstrcmpW IsBadReadPtr GetLastError ResetEvent WaitForSingleObject SleepEx LeaveCriticalSection EnterCriticalSection DeleteCriticalSection TerminateProcess InitializeCriticalSection lstrcpynW GetModuleFileNameA lstrlenA MultiByteToWideChar lstrlenW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW

msvcrt

wcscmp ??2@YAPAXI@Z swscanf memmove ??3@YAXPAX@Z

advapi32

RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegCloseKey RegCreateKeyExW RegCreateKeyW

user32

DispatchMessageW MsgWaitForMultipleObjectsEx wsprintfW PeekMessageW TranslateMessage

ole32

StringFromCLSID CoInitialize CoTaskMemAlloc StringFromGUID2 CoFreeUnusedLibraries CoTaskMemFree CoCreateInstance CoGetMalloc CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear

MSVidCtl.dll

IMPHASH 0467516a475941daa18bfa5b1573ef90
SHA256 940689990d3abc736654d4d4a4f3ad3b09e20b9c2e61de3e1bb6231f6d1e1ca2
MD5 f22f1f4f67597d5da36b9cecbbb9bc6e
SHA1 995552cfcd548aebdc3f3ed0f08d3395312b53eb
SHA512 6815328e6f4ad9faefffef2a4e6f9222d154f8fad244421f5261f6a059ec2b705aa3291f904a22e162f04d1c593669d861df8a99d80d7eaef2e9be5bb294d427
SSDEEP 24576:MhHKWxn2j5IH3LrCI/In2QGIlXaPHO0ayY:nQn2j503LGZn23GK
TLSH
T1C3454B0277F2C134CA6360328E6BEB9863BDEB155F11450727882B4E1FF1F498656FA9
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

676204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLocaleInfoW WideCharToMultiByte GetTickCount GetDriveTypeW GetSystemDirectoryW Sleep IsValidLocale FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId GlobalUnlock GlobalLock GlobalAlloc GetCurrentProcessId InterlockedCompareExchange LoadLibraryA QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetLocalTime GlobalMemoryStatus GetDiskFreeSpaceA GetComputerNameA LocalFree LocalAlloc CreateMutexA VirtualQuery GetSystemInfo VirtualProtect ReadFile SetStdHandle LCMapStringW SetThreadExecutionState FormatMessageW IsBadReadPtr GetOEMCP GetStringTypeW GetStringTypeA GetCPInfo FlushFileBuffers SetFilePointer HeapSize IsBadWritePtr VirtualAlloc SetUnhandledExceptionFilter WriteFile VirtualFree HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree ExitProcess HeapReAlloc RaiseException GetVersionExA GetCommandLineA TlsSetValue DelayLoadFailureHook CreateThread WaitForMultipleObjects ResetEvent SetEvent CreateMutexW FindResourceW LoadResource LockResource GetLastError lstrlenA MultiByteToWideChar CloseHandle ReleaseMutex WaitForSingleObject LCMapStringA CreateEventW GetModuleHandleW GetShortPathNameW lstrcpynW lstrcmpiW InterlockedDecrement InterlockedIncrement lstrlenW LoadLibraryW GetProcAddress DeviceIoControl FreeLibrary DisableThreadLibraryCalls GetModuleFileNameW lstrcatW DeleteCriticalSection HeapDestroy EnterCriticalSection LeaveCriticalSection InitializeCriticalSection lstrcpyW GetVersionExW GetThreadLocale GetLocaleInfoA GetACP IsBadCodePtr InterlockedExchange

ntdll

RtlUnwind

ole32

OleSaveToStream WriteClassStm OleLoadFromStream CreateDataAdviseHolder OleRegGetMiscStatus CreateOleAdviseHolder OleRegGetUserType OleRegEnumVerbs CoGetMalloc CoUninitialize ProgIDFromCLSID StringFromCLSID StringFromGUID2 GetRunningObjectTable CLSIDFromString CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance HDC_UserSize HDC_UserMarshal HDC_UserUnmarshal HDC_UserFree HWND_UserSize HWND_UserMarshal HWND_UserUnmarshal HWND_UserFree CreateItemMoniker CoCreateFreeThreadedMarshaler

oleaut32

SysFreeString VARIANT_UserFree VARIANT_UserUnmarshal VARIANT_UserMarshal VARIANT_UserSize BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize SysAllocString LoadTypeLi RegisterTypeLi VariantClear VariantCopy SysAllocStringByteLen VarUI4FromStr SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate VariantChangeType SysStringByteLen LoadRegTypeLi SysStringLen SysAllocStringLen SetErrorInfo CreateErrorInfo VariantInit OleCreatePictureIndirect OleCreatePropertyFrame

user32

LoadStringW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx MapWindowPoints EqualRect ReleaseDC GetDC IsWindow CopyRect SystemParametersInfoW FillRect SendMessageW PostMessageW GetWindowLongW GetClientRect SetTimer KillTimer GetKeyState SetCursor LoadImageW RegisterClassExW wsprintfW LoadCursorW PtInRect IntersectRect GetWindowRect ReleaseCapture SetCapture GetDesktopWindow DestroyWindow SetFocus IsChild GetFocus GetParent ShowWindow InvalidateRect DefWindowProcW SetWindowLongW CreateWindowExW BeginPaint EndPaint OffsetRect SetWindowRgn SetWindowPos UnionRect CallWindowProcW CharNextW GetClassInfoExW

advapi32

RegDeleteKeyW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegSetValueW RegQueryValueW RegQueryValueExW RegCreateKeyW CryptGetHashParam CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext CryptGenRandom CryptAcquireContextW GetUserNameA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegDeleteValueW

gdi32

CreateDIBitmap SelectObject CreateCompatibleDC GetDeviceCaps CreateSolidBrush DeleteObject DeleteMetaFile CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileW CreateRectRgnIndirect DeleteDC

rpcrt4

NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer2_Release NdrDllCanUnloadNow NdrDllGetClassObject CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrStubCall2 NdrStubForwardingFunction NdrCStdStubBuffer_Release

MSVidCtl.w2k

IMPHASH aa2c799825b6370b37645be920a8c847
SHA256 4ec7d7011c22ee0ed2eaa089a43c1e46bd14db36c9728c0763041d7825ffbcd4
MD5 9fde3d1ff660330702a339c3645bffb3
SHA1 b9e762f9f93eb29657b7111088037a7c5f4f817e
SHA512 4ed64b04bb067373f2c58182ec3bbb5552c6c2e88c58003a7f67c7efe51cc0b647c5ea43fee667be39aa558db17bfb2b29b3b44571e1df9947042bb684727e88
SSDEEP 6144:/H9T5zUAE5eMJQTxvb/D0XUC36gw7TUkJewWvCIkr:ltzUMRTxvbgO7gXk
TLSH
T15CA45C12BBD8C635D09641354DB7A7AD37BDBC061F16860733883B1E1EF2B885A537A8
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

191170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibrary GetProcAddress LoadLibraryW DisableThreadLibraryCalls lstrlenW InterlockedIncrement InterlockedDecrement lstrcmpiW lstrcpynW GetShortPathNameW GetModuleHandleW FormatMessageW CreateEventW WaitForSingleObject ReleaseMutex CloseHandle MultiByteToWideChar lstrlenA GetLastError LockResource LoadResource FindResourceW CreateMutexW SetEvent ResetEvent WaitForMultipleObjects CreateThread QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetCurrentProcess VirtualQuery GetModuleFileNameW VirtualProtect LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr LoadLibraryA GetCPInfo GetOEMCP HeapSize IsBadWritePtr VirtualAlloc SetUnhandledExceptionFilter WriteFile VirtualFree HeapCreate GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree lstrcatW DeleteCriticalSection HeapDestroy EnterCriticalSection LeaveCriticalSection InitializeCriticalSection lstrcpyW GetVersionExW GetThreadLocale GetLocaleInfoA GetACP GetSystemInfo InterlockedExchange ExitProcess HeapReAlloc HeapFree HeapAlloc RaiseException GetVersionExA GetCommandLineA TlsSetValue Sleep

ntdll

RtlUnwind

ole32

StringFromCLSID CoCreateFreeThreadedMarshaler ProgIDFromCLSID CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CLSIDFromString CoUninitialize StringFromGUID2

oleaut32

LoadRegTypeLi VARIANT_UserMarshal VARIANT_UserSize SysAllocString LoadTypeLi RegisterTypeLi VariantClear VariantCopy SysAllocStringByteLen VarUI4FromStr SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate VariantChangeType SysStringByteLen SysStringLen SysAllocStringLen SetErrorInfo CreateErrorInfo VariantInit VARIANT_UserFree BSTR_UserSize SysFreeString BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal VARIANT_UserUnmarshal

user32

CharNextW LoadStringW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx

advapi32

RegQueryValueW RegSetValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegQueryValueExW

rpcrt4

NdrOleAllocate CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke CStdStubBuffer_Disconnect CStdStubBuffer_AddRef CStdStubBuffer_Connect NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrStubForwardingFunction NdrStubCall2 CStdStubBuffer_QueryInterface NdrOleFree

Mpeg2Data.ax

IMPHASH fcd4181f9417f53d1b10aa6fcfd706a8
SHA256 886516c87c44b3f5724aca16e946b122a0527cc3177b3bf42ba1eba788f15b7a
MD5 c15a32f56e3fe83ad6ab9f0dedcaa9da
SHA1 53434fe6a7db9304b3f7d5d811f6f8591c268ddc
SHA512 d789854d9166674d6c835116ff4b03f0a401b6a4df604a5ee24ca31589d42123b4c9f6849d2dbdb02a5047ce681e92483f2926f08915c731d64c73f4bc83ee1b
SSDEEP 1536:P3dQ9MItf5FvSBB14TULwi2oKixe24dTKlwKwyoxlVBbO8:/sfnqBgoPe5ew1xlVBq
TLSH
T107437D427BD2A0B2C3523173DEB937A6F3BEE6081927DE225B0829455F31643B475B07
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

33657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ResetEvent WaitForMultipleObjects LocalAlloc LocalFree CreateThread LocalReAlloc Sleep QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess CreateEventW GetThreadPriority SetThreadPriority lstrcpynW lstrcpyW lstrcmpW SetEvent CloseHandle LeaveCriticalSection EnterCriticalSection WaitForSingleObject DeleteCriticalSection InitializeCriticalSection GetCurrentProcess GetModuleFileNameA GetLastError lstrlenA MultiByteToWideChar lstrlenW LoadLibraryW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW GetCurrentThread

msvcrt

malloc __CxxFrameHandler ??2@YAPAXI@Z ??3@YAXPAX@Z free _purecall

winmm

timeBeginPeriod timeEndPeriod timeSetEvent timeKillEvent

advapi32

RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW

user32

GetQueueStatus PostThreadMessageW wsprintfW MsgWaitForMultipleObjects PeekMessageW RegisterWindowMessageW DispatchMessageW

ole32

CoFreeUnusedLibraries CoInitialize CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize StringFromGUID2

bda.inf

SHA256 8e12de31f46f9ea64ba2a235cba60c3a00fc8d67ea9cdab0a54b5107e9d83a7e
MD5 a9906b5145e151b6fcd89abe8d0cfe10
SHA1 e3ef77ca35166e22fce6a991f670f997dd591ca7
SHA512 22892195ad285c248f9df5d09b8db2cea1322089498b3eb71c8524df3addd6c64ec110aff9f78b28585cf42e9865230186384acc8666bd95fd12b6aca2dcc71b
SSDEEP 192:00a9Qh3X9Rsh3dkQ2J5s9Qh3VD9Rsh31flRlXodpxE4uHjNuxcr:M9U9RHa989RWflRlXodpxeCI
TLSH
T17222955E432F5923A391109DFBC12DC7B2B18464E4C6408F72BDCF196A5AC99011AFFB
MD5 SHA1 SHA512 SSDEEP TLSH

bdaplgin.ax

IMPHASH 2d0c35dab4bdadc34717c640b941494f
SHA256 18870378c79d899d08e27fc15b189a390b5f6e945080fb2ca80088c7f3efed2c
MD5 fec7c0214fe562e4f844b1c9ad7b764e
SHA1 0a001e8930321000aada1ea4642d811d27cc0fad
SHA512 ae7fb745daa28b3a9739ee2f152237539b5b57691a398414e4bea7092eecc6b51e0411ea2a509167da89941c57d9f1bfbb9e5d683bebcc611b5e75be9f1d9eb8
SSDEEP 384:xbqT9AkpIxJfizW/zBKSZMItir5mg663xtKG7KWNy/WKN:xbqTXpIxJiaFKKMqisgrxYbJ
TLSH
T13F722C45E7E298B3E6D246335BF6268772BACA255386DC04174026072E37982F1B678F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bdasup.sys

IMPHASH 6b2b65bafa0dd0cf733b55e44cdea375
SHA256 2da3191b54c898c490533808dcc4b034af699ee25c18bdf08d76d27041f24fc0
MD5 ac3c7cbf6151d7b8db66357fbfad3f31
SHA1 359812a732b7c96114d68552631adf027c5620e4
SHA512 c79030267f6509bae3b857824510f8f0a400d2ee5f33eef1e9f54e8b466b1def838ff2a66d5ea7449420f3d6c6eb79b98c4580f537fcaa5a7aadc75ff69739db
SSDEEP 192:KbTUlGuDpAhrnzECZBgb3k5781k4oTSPm9aDg/qIYfWDvtWxU:AUGuDCLhTgLkx8ZoT0lfIYfWDvtWx
TLSH
T1A0321A80B6D44E36E5EF4DF0CD8711BE667FA2115875A36E063A164A3C25E803E3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BdaSup.pdb

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

210B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

896B

Virtual Size

834B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGECONS

Size

768B

Virtual Size

652B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

768B

Virtual Size

674B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

278B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ccdecode.inf

SHA256 01a55e7e46078b922d5acadf0dd523bf8dc0b5d911be9ec57d890f37c27ca1d0
MD5 72be12ea26bf6649482166af3fdd0cc6
SHA1 31ae26d3ecd44391bc93ff5ddce1d1b0f597d60e
SHA512 0476540cf9d54be6dddf961151cdd90b85b0893a3e373aa56cab3b1bb9c238446228faeb02deff98999ad2c0432101e9b659a7781d827585d2ef3395440e81ec
TLSH
T194716679CD0F91326386E12E7BD21EC2EA095CF2856A0510F55D860427BAD8C531FDDE
MD5 SHA1 SHA512 TLSH

ccdecode.sys

IMPHASH d5977c633dbdac9c68f7e446e09a0a9d
SHA256 7c38d16644c0e1ae93c4cb5222226b59c94b847033db0e69186467471062dff9
MD5 1478e6a09512235b9e119d2920477021
SHA1 6ee21c7cc6c007e317cdd5c3562219d1ec23230e
SHA512 e7beb36d455aa9af5e3feab6bb9d0b631efb4cf90d47c53cc14ff1b447c101f824b7e33fc7bc1c1058fa6e46a37cbe18410b7bbabfa26d9a9b9df8ff648b00d5
SSDEEP 384:/bFWZsvzcfhWGR6/xPoH6ZhhiW75XBn2VvnEsg2WIIW:/x+sgDjW975XoJEpg
TLSH
T198721B84B3C04DB1EC471CB1446B770927B3EB121B2693E75110EDAA7C2B6D0AD7D6D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ccdecode.pdb

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

554B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dx9bda.cat

SHA256 14f0ecaa25320bc1d3a717b16d09cb957f93618b581b57b3c93634955a4f8e70
MD5 c688dd507686c4d40b9068e08177fc86
SHA1 de4cf806ead56f36b3b04268968030611e9b3a3a
SHA512 018be6efd5a1144238ebfd5a0f2bdbca762ef2121023071232ffafd757a8d6698d739dc409a262e15a0634ff96299638d959982d6cce3d23189825f4cacd9e7b
SSDEEP 192:bMOBi/814ip9AJ+CejiwgrqNhdJf8Zn2Gw+N+nJc51NZIn3b4Jw501Nq6aErlnkL:6+gerk5n11wkLhe1OHrDS7J
TLSH
T1F182F05B09AC41635119D9B1CFF9EC8FB432E6B6A8125D3E105373D44683BA2738F92D
MD5 SHA1 SHA512 SSDEEP TLSH

dxbda.inf

SHA256 ced775d3dfef4ea699a5569cb0b62b036188ce8bb44705bb56afe31e15af3a2f
MD5 2d4646b7b32230944e5517963d4a0527
SHA1 cdc607dc34d13925407088bff1a526b51f844fbc
SHA512 5177e9ed6bf1bd2b2f4ad8bf1c04fcfcba2541e4307a36a9493d4461cd4ef6561c2ca54810b385b11f359352b030ffc7e93b0c768c3ccf4d1f1f3db6305c2919
SSDEEP 192:72+PXOFcssVHSVyVdwaVEegWa7za0myx02Dj2v6HJod+Qg:K+PXD4myxVPq6pod+p
TLSH
T195D1B8444723D20BA9D8203C05A35FC7D6220079627AC85A75EAC9CCDF5DC2E7B776BA
MD5 SHA1 SHA512 SSDEEP TLSH

ipsink.ax

IMPHASH 628f6874f78df4a7257166f9144f8a03
SHA256 2cb2c9a8dc6901528a757ae5f1908c2f189d449e9eedc2085a3e7f1c730dc804
MD5 9ec3f1b9a34e3ac4bffa6f99df0430dd
SHA1 a771d3248763873069c97f114bff602f43d53779
SHA512 e4efebe730cf377b6c1315dd5c665c4a45812cef2ba0da4dd4d5dfb4f1d9346fb66bed25cf3976d474cbe3d52f6b1b22469f7e2e9c615abc0a6e525638eb1abc
SSDEEP 384:ZfUMIj91qKGSSjPCm/Yrm6gTu53xkaFWA6W:Z83Z1vvSjqKYng+xkaJ
TLSH
T1F5623C1273D19453D4A383361AF92E6777FDEB24A6399E03C6041A4F3A79983E1B470B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9717

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle ReleaseMutex WaitForSingleObject GetVersionExA ResetEvent WaitForMultipleObjects CreateThread CreateMutexA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls SetEvent GetModuleHandleA TerminateProcess GetCurrentProcess WaitForSingleObjectEx CreateEventA GetLastError Sleep IsBadReadPtr IsBadWritePtr GetProcAddress MultiByteToWideChar GetModuleFileNameA lstrlenA lstrlenW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW

msvcrt

free _snprintf malloc ??3@YAXPAX@Z ??2@YAPAXI@Z rand

advapi32

RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW RegCreateKeyW

user32

wsprintfW

ole32

CoUninitialize CoCreateInstance CoInitialize CoFreeUnusedLibraries StringFromGUID2 CoTaskMemAlloc

oleaut32

SysFreeString SysStringLen SysAllocStringLen

ksproxy.ax

KsSynchronousDeviceControl

iphlpapi

GetUniDirectionalAdapterInfo GetIpAddrTable

wsock32

closesocket bind setsockopt htons WSAStartup ioctlsocket

ws2_32

WSASocketA

kstvtune.ax

IMPHASH ea59e0fa6299a58362f0aeae0af3aa43
SHA256 6f9fdf51a16d8a14b2d1194d336f53cb293f9010a4cb632e627e874e3769b754
MD5 f5a59e8905fc16a74d9e21cfe06fedd7
SHA1 193653935bbd202dad0a75ffa57aea48c0e6907c
SHA512 21ed1450323422a0edd3c1f9981cd508f2fa10580a7a293f9435c5b58f27d007808ec158dc42d3049e1f1d0f703e3f6c74de24cd9b33c3259f4635bf7b84ef73
SSDEEP 6144:A/ArOLmLDuB7v9iixiiiCaaii66mizDDDDDDDDDDDDDDDDkkkkkkkkkkkkkkkkkY:XGmLDE9iixiiiCaaii66mizDDDDDDDD5
TLSH
T16744081093E24131FB739B7C27729F92E779F80867FB41C625487666ADA1240AC36F71
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

29135

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadResource FindResourceW GetLastError SizeofResource InterlockedCompareExchange Sleep CreateFileW InterlockedExchange GetProfileIntW lstrcpyW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess LockResource CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle IsBadWritePtr LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrcmpW lstrlenW lstrcpynW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW InitializeCriticalSection

msvcrt

_purecall ??2@YAPAXI@Z wcstol ??3@YAXPAX@Z

advapi32

RegCreateKeyExW RegOpenKeyExW RegEnumValueW RegCloseKey RegQueryValueExW RegDeleteValueW RegSetValueExW

user32

GetWindowRect GetDesktopWindow MoveWindow CreateDialogParamW wsprintfW KillTimer MessageBoxW LoadStringW CheckRadioButton SetDlgItemTextW SetDlgItemInt DefWindowProcW DestroyWindow ShowWindow InvalidateRect SendMessageW GetDlgItem SetWindowLongW GetWindowLongW GetAsyncKeyState UpdateWindow PostMessageW SetTimer EnableWindow SetWindowTextW GetDlgItemInt

comctl32

ord17

ole32

CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CoUninitialize CoFreeUnusedLibraries

oleaut32

VariantInit VariantClear

ksproxy.ax

KsSynchronousDeviceControl

kswdmcap.ax

IMPHASH a4d2e6643818292a0d8fef1ab511db26
SHA256 432b3032901140f654cecb6a6617c166fd78db658fa4317833868f5b03338e9b
MD5 63087b5d39cedafaef62f9a885f4be6b
SHA1 4d18896b121bd994a1f83cece2b1560c3d8fb98e
SHA512 c0cfe5ea9d1b1515fd0ee6a745d74da1208cb0c1bb97eb0e2721221db8eea28dbbaf53aff231a687cd38707ab770ba1a278a066d51d03f614fe5fc8c11bedf86
SSDEEP 3072:tnkB8Em3HerCa0Nt3fHfBExZRkdhx9JsP438ZHbdEcGnnwM4fjqhi9T+za:qB8EmEKhExZCdhx
TLSH
T15F244E0053F5C515F0B70A745DB69BD26E2A7CA66830C90FBEAD624F2870E04DD3AB76
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

52638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObjectEx SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent WaitForMultipleObjects VirtualFree VirtualAlloc SetLastError CreateThread InitializeCriticalSection ExitThread WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA lstrlenW GetCurrentProcess InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA Sleep lstrcmpW lstrcpyW lstrcpynW CreateEventW GetLastError DeviceIoControl GetOverlappedResult lstrlenA MultiByteToWideChar GetVersionExW TerminateProcess CloseHandle

mfc42

ord823 ord825

msvcrt

swprintf _purecall _ftol __CxxFrameHandler _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ sprintf _wtoi wcstod

advapi32

RegSetValueExW RegCreateKeyW RegSetValueW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

user32

SetTimer KillTimer wsprintfW LoadImageW ShowWindow SetDlgItemTextW SetWindowTextA GetWindowTextA GetWindowLongW SetWindowLongW CreateDialogParamW MoveWindow InvalidateRect DestroyWindow LoadStringW GetWindowRect GetDesktopWindow EnableWindow SetDlgItemInt MessageBoxW IsWindowEnabled GetDlgItemInt SetRect IsRectEmpty SendMessageW GetWindowTextW GetDlgItem SetWindowTextW

comctl32

InitCommonControlsEx

ole32

CoUninitialize CoFreeUnusedLibraries CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromGUID2

ksxbar.ax

IMPHASH 86f7b1489e2283642a94ef3ffa08593e
SHA256 e3d6d38cbdf5f6449c9080e4ad9e12dfdae3239cafa7c6569b880b93447d7132
MD5 7c9cff0fbd4ac215f41cc5014f1da304
SHA1 9f14c465a87b2ee8940c87a15827f49b0d892bb1
SHA512 4a652cc0ba534060522b1cdcd4b2796b796a63608353281a3029782c28d56447c5e074c2a93fee6aacd930281c48a9e3719a5b09402e686e437e9b63ff00a725
SSDEEP 768:AoGUTKN7+j3JyR9EEw4PbAWgvnK66ZBgM7laOM:AoGJ7CZbEw0bAHYZOSlB
TLSH
T167036D6537E28072D3B3E2378E2533B976F6FA14167CE43A078465892E7058AE5B9307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mpe.inf

SHA256 162c1dd3539436eaaadbb008e3cd275369cdfb51382a04bf8889d9f2a9f0e10c
MD5 d866dd33fe0269cec6d201c35be34750
SHA1 4655d7a2e8ccc9b46b0c8ccd6fc5ffc6897cea1b
SHA512 ef076e9b9a1e8e945f3889f3e8125381de2103c6e6f8ab4635dc9c4327a7bdf49acb4eb2020863c734a11b7eee0817108f181f7297440973d09ee62bba2d96da
TLSH
T12361A56C8C4384B38356E36A5BCB1EC3EB165097C6660508316D4703A79AD1EF31E8EE
MD5 SHA1 SHA512 TLSH

mpe.sys

IMPHASH b709125e5196d69f577afdd8423729ff
SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
MD5 83eff7b976ae24f1a496ca94a8a19919
SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
TLSH
T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mpe.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

640B

Virtual Size

630B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msdv.sys

IMPHASH e105f7c92aa2bef9bddfa3b3765e6022
SHA256 f47115756bbae0c89074e6f7d561a7b8cf38fec6334ed686a69ba239ef8805ca
MD5 18f91db630124c26f147fd41ea68394e
SHA1 81694fb3a1d4f4446bad3af2292b25802f1389a5
SHA512 7f19b55f696ff32e3ea57953b455bfd0f236138aba93bcccaf24bc62fd3a2bc8b7af0b8180cfb96adfdc2c7b47f6ef35ff37013fe38d3ba6cdb4daf1e04584ba
SSDEEP 1536:f0k/kmjYyXtmWOnHs7F6LvWL6CihvxDi:f/kmjYutpOUF6LvnvJ
TLSH
T125435C0173508836C46F83B08D5FB375A2B3B9661A2AA65B7F006B683F74550FF28663
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

53376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msdv.pdb

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msyuv.dll

IMPHASH 317bb2a83416a509406d650a33ce001a
SHA256 34bf7e2c8072f7f74cd8f96ec6dcaf0cc1a2266752f28a01bfc3247ffd6dcab6
MD5 bf66ae458e457e425e7fbb0769ea0f39
SHA1 d98f187d9dd127107d93baa0bf9c384e984d0120
SHA512 0d340c11efd75a1ef030d0343ee3e4fe7949d25a6f85cc6a0e207da2b092bc5e6ae8ce97c5441083971044c1d5845438bafe05f2d71e12918ed40c5e5c23da4f
SSDEEP 192:8olj0Y6wnT1v08JzPLPdoKo9yTYlAU1Wo+Ijuo+Ijpo+Ij2JIGC7qIGC7tIGC7ET:8oV6gtzLL1jWyTYlAsDTZI1WactW
TLSH
T1517283827FAB1D52C0D1093548A7C63B53BE9F7052F7469A4F2515AEF820A61C63BF13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nabtsfec.inf

SHA256 eee3641785da56dd4646a4dc5aeb5827828a3218bd5635491da1ec70608ac604
MD5 187630b45b902dfa52d13f11c69d36e2
SHA1 5c2ca522286b99f8859f6c719d15468c89644a92
SHA512 2fc8220fe6bcdb99a874e3f80937f30aa1b7f733e7148a079a7db075b37005f5c862909d87f69dbfe940489f69456f4d3669cf063f482fce47a0b83c95be24b4
SSDEEP 48:xbcXc68yEhpOD8HK7k38O770g3kc4CqldXcZZx8+wu5S70xjUCdgn9WK13EdbsP2:t00pIfxcZZLiCApt1UhsP2
TLSH
T19E818419CE1B803663E9D11E5BD73E83DB2A30F28D6640C0379C5A08278798C932EDDE
MD5 SHA1 SHA512 SSDEEP TLSH

nabtsfec.sys

IMPHASH 49970d1ef884a17567a446f9fea4d52c
SHA256 5392c3c7129b4d7a16ed3d44cb33092f0faf92441b6181c0b042e2c07ad04d10
MD5 bb1c45d114b6dab0babf6b2fb0336db2
SHA1 0d7797a8e4f086cbf2cfc069ac69fd9d35316692
SHA512 16ef512d2a4b41379dcf31a8039782674c6e3db4c286e5fb166e400b360f6035eebde6b852fd14fa08879a122cef282537dee7ae52e1eea959937794d11e1dd7
SSDEEP 768:71Q7ZoFgMU7KbBPYTDjujwIhkHZHVMV+mpY3jl6myuq2CeaGSOKWi+6mywyRE4Fu:JQ7kgMUiSTDjG9kcDFO3Us
TLSH
T1A5836B00E782BB7BF4EB50F6916B764E11B49F110B4982CB6AD87C46AF385D16F32153
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

nabtsfec.pdb

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

1006B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

896B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ndisip.inf

SHA256 6239cda249f35baa9ba1848ebe3df414afa27be38fb8fee79fcdd8dd00dbf907
MD5 3675a3e175c1b4a9a0397d80b6cdfafb
SHA1 5eb1d87943f40a205c9b1a65b880417d1c5ff8aa
SHA512 7ce64105634e7dcb4250a972bf303f4474622ccc61ef07e1742daee8e32ebaff6991bce31c68d782b8f0b31b9c069755548dfd80ac6e4a5c63adcd7484d74299
SSDEEP 96:4VNZ3J6Ep5c2cQHSsK1GMDSsKv/edvZ0EL6OjkiDk9ozMZ/XydUWb:EH3oEI27SsWtDSssedhTLFYig9ov
TLSH
T160D12E194F42AE352BCBD1799B030F43DA36029B891A154435AD5BC02B7F68E632DE8D
MD5 SHA1 SHA512 SSDEEP TLSH

ndisip.sys

IMPHASH 85b9203fdd9c0bd977642878e7918927
SHA256 e880da5ddd381abed5bf2c3b8cb387842301b52ebf29173383d618f5961f36f7
MD5 abd7629cf2796250f315c1dd0b6cf7a0
SHA1 9baaba6e47ec06871d944f19961ca3cc8132c782
SHA512 a68483ac251df13566e48f202e9a6d305a90fbe69408aae232d4ebd399d53ed077de97ccc3c005f107dc560ee9bf6d4b070562761101d08858700865dee6aef2
SSDEEP 192:++BarPS1JL8yvpeA1SbVMsflIGywVVXXPWgZFW:RBOyJ8yvpgVMsflIQ/WgZFW
TLSH
T15522F90273D41B3FF0930FF559B317AAD527B9157F65624E021314CEAD39AC5AA38623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ndisip.pdb

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

331B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

384B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

896B

Virtual Size

890B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

358B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

psisdecd.dll

IMPHASH 030f2fd88c6befc4cc612bcee23289da
SHA256 5108a9179e2b042eac111d926431e8fe37562c9f4422861ca3120b506b409b98
MD5 5319bf20f48884e594f84097a600424b
SHA1 1e4014a1df18c5c743e5567d768f8e37a97f9f09
SHA512 a4a3b3127d5fb69fe1ba581d9051ae8d1d1626c38486abf1bc0e3b697e10f73127c97c7913cf6640ce6b937703cd18c600a021be5b1dc84fed078d4eba9cb4ee
SSDEEP 6144:zAOuiRizjJTRcHV+oGC+1dnLSCkFUnru89Fos5FkYAloEcXnEUjz/ZnC5W:zU+VO1dnLSk6kqs5qYAlDcXnEUjz/ZnT
TLSH
T1C1748D107FF6C136C7A56175CA7B6BEAF778D7054D600A670B0C162C6F38A82E162B1E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

248728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW lstrcpynW HeapDestroy lstrcatW GetModuleFileNameW DisableThreadLibraryCalls FreeLibrary GetProcAddress LoadLibraryW lstrlenA SizeofResource LoadResource FindResourceW GetLastError LoadLibraryExW GetShortPathNameW LockResource lstrcpyW CloseHandle QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetCurrentProcess FlushFileBuffers lstrlenW MultiByteToWideChar Sleep InitializeCriticalSection InterlockedDecrement InterlockedIncrement DeleteCriticalSection LeaveCriticalSection GetModuleHandleW EnterCriticalSection SetStdHandle VirtualQuery GetSystemInfo VirtualProtect LCMapStringW LCMapStringA SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr LoadLibraryA GetCPInfo GetOEMCP WideCharToMultiByte LocalFree InterlockedExchange TlsSetValue GetCommandLineA GetVersionExA HeapFree HeapReAlloc HeapAlloc RaiseException ExitProcess TlsFree SetLastError TlsGetValue TlsAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree WriteFile VirtualAlloc IsBadWritePtr HeapSize SetUnhandledExceptionFilter GetACP

ntdll

RtlUnwind

winmm

timeGetTime

advapi32

RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegCloseKey RegQueryValueExW RegEnumKeyExW

user32

CharNextW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoCreateFreeThreadedMarshaler

oleaut32

SysStringByteLen SysAllocStringByteLen RegisterTypeLi LoadTypeLi VariantClear VariantChangeType VariantCopy VariantInit SysAllocString SysFreeString VarUI4FromStr

psisrndr.ax

IMPHASH b3fabccc88441525f3d8a97e7abf70a5
SHA256 b0969c106bdd6e4b0ae2c252e9b4792532ca60b19eb04effba9e8adc1c41025f
MD5 e93d7d262a33d14aef13398ab83fe08b
SHA1 b7fb62de3c6521c3f71ff3a398cc6b97abe2392c
SHA512 26db7045c57faba96b96e4dc6da3667122398a4a3517065854c9114ff78cc25ba3116e010f9d45ee2d1de3f4935345a53f5f407a1538eb29f013458baac9c1c7
SSDEEP 768:F1mgRwKIvRcysV+ngpw1r8aQ4nMxBi7W:WVvRcVVDI8aTnMxg7W
TLSH
T1F1D22B137BE660B1C6A35233C92133A7B2BBEA586539DE154A1819462F32143F1BE74B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

slip.inf

SHA256 418040f2b05a196c48fceae77afaa9e58ca87b10269dc084be493db377c82a31
MD5 a42a3419a484b82e752b850cd13bfdd3
SHA1 fdb7a19707b7ea6e349c6559152cb5f1c02483e4
SHA512 eda1f7ead98530284ee850dffae35073f22c3399cb98b6e25dd62d3ec175b4d160d1841ccde5c4261b76bf301feb5417446a30779cf276d778f5c2ba68a4acaa
TLSH
T1757186ACCD0B09636389D1558BE63DC3EF980053C19B0B89306D8A1663C9A9D5E1DDEF
MD5 SHA1 SHA512 TLSH

slip.sys

IMPHASH 3f9db7809b38aa51c5daad51c58fe7a9
SHA256 a1d24658b8e0610b5651aec36ecc4be1a2a8faa0a7f2164bf19ecb816298bd9d
MD5 92723fbdd30771c293fe5ed266a31ca6
SHA1 b2e1b9822e9113ec0cb2c7e44e8826d47941d388
SHA512 2b563c98fc93db76ba2d1f05ba84121c2836f1c4e9a501460a17d46138449c95293f18345ce96838141a4618a83e6dca4d16947e5a09900b51e1c1995680c342
SSDEEP 192:i0pCqlIwfHkLPhw22AsALyp2rn4kY0FUjZVx4TWxzyWE:iGZImHkLPhw2H5x4krFUjZAWxzyW
TLSH
T12A224A1137E40F75F0D74BB1AE9B272A8677D81C9A11E37E02A53D991D3CD00BA2C7A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

slip.pdb

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

262B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

440B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

206B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

streamip.inf

SHA256 1e06c2c3eeb9cfd1938b73e70cb3b841b1da89b97ab6acadde5c136e0b336bf6
MD5 885e850809bc928ee802f13e28449efd
SHA1 39f8ff6d6cfc300b61e6a52f647b05382c4b365b
SHA512 1b660a1eb54b6e1bce2902a260ae95def2eec32af8c06a666138456ad85f5299d9286d588f90fa9c4d938ccee06960d19c2a3ecbed539e41811e89533526c6e8
SSDEEP 96:d0KuUqnZK8hQ+B8ljiFjZMaH1XNgaAgaPRIWKTAidudNjKJ:d0K4Yt+SljiFjSyGyVIKJ
TLSH
T141C173494D2B5473937FF23D9B870F92E6257813D18F414830BCCA161B9AD58922EF9E
MD5 SHA1 SHA512 SSDEEP TLSH

streamip.sys

IMPHASH 937c5c9480c457813996610d24c3ca2e
SHA256 34bce982e9d6dacec51f2c19bd5ac7ddc0fdc876eb4f910a1d667d3448d8f1d6
MD5 4544fd0db39cb7b385a5392c068162cd
SHA1 00a5b9b4a950bf52b02b9bed6a2e5bca0bd80746
SHA512 c46495efb0d4ae1981630a72e93b893c1a0ec3977064b75ea5f1112fd9a51fc90201ea01107dd0cc6bec95b18856435be5c8691ad5669aae8e41ad8585711e1e
SSDEEP 384:qBjX9oOlN5wQVEI7yjrDuL43KJpQVPk7cOe8NHiooytMWg1RW:2jX9oe5BVESSS46JsMcC9ioo0W
TLSH
T17262088DE3D50572F52F01B886829752E9BFDD056E1A82FA87FC8FE12C82552F4247E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

streamip.pdb

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

647B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

768B

Virtual Size

674B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

640B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vbisurf.ax

IMPHASH 4ea881e9bc4888403a5e8628308bf315
SHA256 3694636dd9a32923d5f7acfa84c53127ec6fa8d56b759e3ece41b204d251931c
MD5 1c4496b1780be155c2d8d1b260118959
SHA1 f5e4067171143c98de66efbf66bae07a5fa901f9
SHA512 7edcc92e99b4f280fc2639aa91db233275a8fec4673acf5f80d682e5fdf3a0c05076c5be44179ff08df73b08e1e55e654f05a4d299defef03036f60ac5496399
SSDEEP 384:if/mN0LqTy/FaX3Jq3en7CblOY5vgTRsceQ/L9ePFE0tpBL3x8KBW1jWVzG:iHEkn4HI3E7CJngvj/w1xVgoG
TLSH
T14CC25C12FBDB807ED6A355325F793FAAE2B2E7441A7C9C120B1059453A21183F2FA357
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wst_czec.fon

SHA256 29549f4d2e29b73200087e0484b31ca87dfa0cb22c7a1cfe1258d0750eb44027
MD5 554df997c4b3cd9c7ab9b4da17f1b9cb
SHA1 a321c7c1355e62d1bbb18512b93ec9399b415011
SHA512 40c7909fc84699a1ae971a0de87c5f47fb5dd2eddb012ff1f866faaf0b0a03f4595ad983210a2970da6c832709f6b8cc1b5d6271038e875074954962cb5308f4
SSDEEP 192:q3IojXHKiSpP/vH3f/3f68lrg83nXn3nX:q3IorypP/vH3f/3fprj3nXn3nX
TLSH
T11582F0455CBF7EE1C49409389E4B9B2448B06E82B852CD92DB712EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_engl.fon

SHA256 7ab2b68a88ac69c806df7bb5a1fb4220777233f80501afe64766b84b22d0a8dd
MD5 5a414bcd0da476df205db8941fd095fc
SHA1 d62e9dfafeb1b6d74b5d9aca9e1e1c9232068dd0
SHA512 13fd2b56b72302dfcff291927c1372eab267af07b730dd55f159688d34bc548cbb8e7a4580752c22b3e8c5ca144a1f16ff563bf5bcd0416ce3ff08240fcfe8e0
SSDEEP 192:qPIojXHjyCyP/vH3f/3fn8lDIg3nXn3nX:qPIor+CyP/vH3f/3fMD/3nXn3nX
TLSH
T1568214455CBF6EE2D49409388E4B9B2448B06E82B852CD92DF712DADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_fren.fon

SHA256 be473acc9c748899f906901dcc35adfb00f36d9d923052d991fa3f9042d7b3bf
MD5 f48eabb60de7a2d478c3e720337052f1
SHA1 11685c48a30b1da1b4679685fac1a616ff566891
SHA512 1b7b3aa5a516a8e159a3ef056d144a771082bfd286da63c8bc644592652515daba9c5dd9b4d4989b5176d51cd1ce18824762576f3dc9bbaaa6f00be9c543ef21
SSDEEP 192:45IojXHZvlXP/vH3f/3f88lX4a3nXn3nX:45Ior5lXP/vH3f/3fTXd3nXn3nX
TLSH
T11B82F0451CBF6EE1C49409388E4B9B2448B06E82B812CD92DF716EADEDF7350E297C5C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_germ.fon

SHA256 78002bc6f1780107f545ff8f9346478add8cc1907f620dec6fc780bde1e38c8c
MD5 96ab323e35f83a7f6cd47f3890906cae
SHA1 a2228a7d236c831e2a0827dd78bfc4ffc1515e90
SHA512 76dbffe05f17c43387005aca1bdc767a7ce830e7c46d3a824bc00997cee3da6a53fd102d017f99bf075a22f9bc319332d594e11f0d9eb6bc481f2326d68fef72
SSDEEP 192:ByIojXHOjNP/vH3f/3fu8lH2/m3nXn3nX:ByIor4NP/vH3f/3fNHD3nXn3nX
TLSH
T19782E0452CBF7DA1D49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_ital.fon

SHA256 a866dfd73415a75025625941c462d76e46ce980259eb0eefc8c4fb109e060c64
MD5 8faee3b19e9c365e383194b34b05de85
SHA1 8bf5d4687b1e5575c91eca0f0193971693889b4d
SHA512 162d27b32a4d7119eea673da80692a78c9a7cf00f17c1edfd6260ddeb378c69d98a633b817c3e4ef1a83a412d6fc0e56276de21bf792d89849bbaae544ab5d33
SSDEEP 192:NuIojXHITKnP/vH3f/3fz8lDSE3nXn3nX:NuIorYKnP/vH3f/3foDV3nXn3nX
TLSH
T10C8202455CBF7EE1C49409388A4B9B2448B06E82B852CD92DF716EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_span.fon

SHA256 d41768876a1ab65191001a2988f2e61bb44fb35b9ea8fa94d169893a3dab77e6
MD5 8d16c368d2e9dd5b0cb21ca6fe5820f5
SHA1 fdaf1425128d7095a3b2ef98f0367293bacbf400
SHA512 8f4a5529aa7dacb447610df0b6d0d1027e07c9d946c4120a9a23ad7c9754ab1f135d1940fadc30aabf35617b74164261ec0a48cd363043597f9e547801aeaf43
SSDEEP 192:vIIojXH7vkEP/vH3f/3fn8ljMO3nXn3nX:vIIor7sEP/vH3f/3fMj93nXn3nX
TLSH
T14182F0452CBF7EA1C49409389E4B9B2448706E82B852CD92DF716EADEDF7350E287C5C
MD5 SHA1 SHA512 SSDEEP TLSH

wst_swed.fon

SHA256 adf1915b3faa31a5d0826d90f464bda32216b5ead9b5c6bd871df401c82a7c60
MD5 3d37c5768207c09dfaf20fb876a121d5
SHA1 f776e69aa0365ae692f6b16640a6aa6012fb6364
SHA512 9f6813b4d12b8c95794c232867c6164240a696091b4488af5e2f5d4657faca1394909b18f21c1c27326a150e0d2a883872664a7cf85f617be29c2c99b52d87a7
SSDEEP 192:+BBLIojXHBmkP/vH3f/3f48l/A+3nXn3nX:+bLIorUkP/vH3f/3fv/Z3nXn3nX
TLSH
T19E82EF455CBF7EA1C49409389E4B9B2448B06E82B852CD92DF712EADEDF7350E297C1C
MD5 SHA1 SHA512 SSDEEP TLSH

wstcodec.inf

SHA256 6edd2203dd2fae09442e9afec57738ebc37364d27c84d76bed633e122ca33313
MD5 d0ba27ccb5958090755e939a01ce8cd4
SHA1 7e9ec073086dda1d6bad3f572e041cd482877fc6
SHA512 583d43a959af8ca13d0a215143ddec8c78d0e079c06707dd23a093dcf0bf7039b60a802539c364db769ebe065a3f805d86fb3bae0a0f1b453325a0635e1a52cc
TLSH
T1857123CD8D0B87BF7344D11E7A522E82EB1971F281CE0A043D9D7E143796DC8621E89E
MD5 SHA1 SHA512 TLSH

wstcodec.sys

IMPHASH 5e94d6115bae4fe6e2b87706af1a8293
SHA256 974d2c905f8093d4d5fb1e6ef46b4a3a4d25d9a93168b7febe8f27f99ddb48be
MD5 04aca6442e639a794293828e8dda7a44
SHA1 80bdb74d87ead65887331b38180d5f33c97f50de
SHA512 93d3b8da80e0801b5e77c876ab398bbd71702154d1c4f331927dc582af12c7ccb393fd781ed205494519278f11146552c1cd7c2701f0e27338f947ac9f00b0f9
SSDEEP 384:Gs+CEbgqEcQzr9wa8niLXpYs9+vNPHeWQyWoS:R+pnQzxY8kQs
TLSH
T147827EC57BC02DBBE9254B355AFB23145BF7DB191662D3838210ED5C3D26E408DB2A23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wstcodec.pdb

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

512B

Virtual Size

484B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wstdecod.dll

IMPHASH b773ed61e5f2f5b7c57feede58a7f58c
SHA256 34a4383b471143fa055062ca9484b98c5c3720d359c43abac4753105883b8be6
MD5 dd7181ceb93b83bb2eff43e615eaecac
SHA1 c1714ad48ca3b1fcaed2866bd031353a5aa5bc12
SHA512 8dedc4e1474ec60317e46ca16c4a0e3a074e6868931e9765fb0927f3550efcf7ff7edd45d822c79b7610a0ff485ea2d6462153e4aec14461f06b805d67077e53
SSDEEP 768:lY8V2X7YU3D90DlqEafnKYmTzTLGvj47cJBzgyUErCGZKLYphRxqh+cK+Lm:l5Vg820DoRfnsnTLGEiB0eDYYjRxQM+
TLSH
T122238EE573D240F3C2E30532AA3533A6B2F6F6181A2955234714760E6BA614ADA3F337
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess TerminateProcess GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetLastError FreeLibrary lstrcmpW InterlockedDecrement InterlockedIncrement lstrcpynW GetModuleFileNameA lstrlenA MultiByteToWideChar lstrlenW GetVersionExW GetModuleHandleA MulDiv IsBadReadPtr IsBadWritePtr LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection

msvcrt

free malloc ??2@YAPAXI@Z sprintf sscanf ??3@YAXPAX@Z

gdi32

CreateCompatibleDC DeleteDC CreateFontIndirectA SetBkMode DeleteObject CreateDIBSection SelectObject SetTextColor ExtTextOutA SetBkColor GetTextMetricsA GetSystemPaletteEntries GetDeviceCaps GetTextColor

user32

GetWindowRect GetDesktopWindow DefWindowProcW InvalidateRect LoadStringW SetRect SetTimer KillTimer IsRectEmpty ReleaseDC GetDC UnregisterClassA SendMessageTimeoutA DefWindowProcA ShowWindow CreateWindowExA MoveWindow CreateDialogParamW SetWindowLongW GetWindowLongW wsprintfW GetWindowTextA MessageBeep IsDlgButtonChecked GetDlgItem SendMessageA SetWindowTextA CheckDlgButton RegisterClassA DestroyWindow

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegSetValueW RegCreateKeyW RegDeleteKeyW

ole32

CoTaskMemFree StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoInitialize CoTaskMemAlloc

DirectX9/BDAXP.cab

SHA256 a027e84d33b1bcc5d534de2d088d2bbc7d2186347e5f38742b1964133b07b871
MD5 3d48496dd6669692bc69de5f1694b817
SHA1 b5e24e7364e4a56f90c1c85427175f44144928ba
SHA512 5da652fe597ff22f9faa30620f3a5c65de51d36212bed7fd64b718ef788ab6baec3a7d96444fe9e87f7e0c60ff3d6858d63e5a8d78144f4d7cf526c3408db69a
SSDEEP 24576:VHzOVwrKjBN3pJWtm/D9BzYjhTnAhnghepn9sSPDfxZp3H/S:VTOVwWjRktmbATAZghedTfDp3H/S
TLSH
T1E12533E6D2FF2A50F33600883250D964D6211C94E231327666FE375935C3B9BF7EA998
MD5 SHA1 SHA512 SSDEEP TLSH

BdaSup.sys

IMPHASH 6b2b65bafa0dd0cf733b55e44cdea375
SHA256 62e52129a2207cc610ee4e19312582a367f5a5e5fb8192feae432d2f6f375065
MD5 61f8f3126d39a7eb2775fb1505469ee3
SHA1 f5b564502d59cec39d831727d947d447beb29210
SHA512 ae1c7b7079c08db1b2f78a6e8cd9a617401e33b5d86444cc4affc08b11418049107b54bcc259df9578fabc9863d8548a9a5becdd9e7d77f465d5c5512b8a3056
SSDEEP 192:KsTUlGuDpAhrnzECZBgb3k5781k4oTSPo9JDg/qIYfWDvtWxU:RUGuDCLhTgLkx8ZoT0ufIYfWDvtWx
TLSH
T18F321A80B6D44F36F5EB4DF0CD8611BE667FA2115875A36E063A164A3C25E903E3931B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BdaSup.pdb

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

210B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

896B

Virtual Size

834B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGECONS

Size

768B

Virtual Size

652B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

768B

Virtual Size

674B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

278B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

MSDvbNP.ax

IMPHASH 8d46331ee3af79cade97e0eb594f6089
SHA256 bf81f612413b69096874a6834c0286983f5440b0ec411120de28364aa0cb2de7
MD5 ddb9b5c1ce074274d74b8a7910c97208
SHA1 593bf280d571733cbfff9b79cbfba043f46de9ce
SHA512 fabe9ae67a1cd850cd36db58f9834b8fc35e1ad2d06ec5b5587e6dc1bacbcda0038c347721c18696fe215f3b0c0f9221c76a416e75e30b339556f89470dc716d
SSDEEP 768:UqC9FJqBx8YBYuPWAcsK6fxeC+AqbiJfeg6LFlixhA+tl7WwJ:ULF8n8YBXPWAe6sAqOdv0ixDJ
TLSH
T19733185733F7C17AD2A362B2862AF7D9BAB6D30906159D011B040E0A1F7468BD37DB4B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEvent CloseHandle CreateThread CreateEventW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA IsBadWritePtr GetCurrentProcess lstrcmpW IsBadReadPtr GetLastError ResetEvent WaitForSingleObject SleepEx LeaveCriticalSection EnterCriticalSection DeleteCriticalSection TerminateProcess InitializeCriticalSection lstrcpynW GetModuleFileNameA lstrlenA MultiByteToWideChar lstrlenW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW

msvcrt

wcscmp ??2@YAPAXI@Z swscanf memmove ??3@YAXPAX@Z

advapi32

RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegCloseKey RegCreateKeyExW RegCreateKeyW

user32

DispatchMessageW MsgWaitForMultipleObjectsEx wsprintfW PeekMessageW TranslateMessage

ole32

StringFromCLSID CoInitialize CoTaskMemAlloc StringFromGUID2 CoFreeUnusedLibraries CoTaskMemFree CoCreateInstance CoGetMalloc CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear

MSVidCtl.dll

IMPHASH 0467516a475941daa18bfa5b1573ef90
SHA256 940689990d3abc736654d4d4a4f3ad3b09e20b9c2e61de3e1bb6231f6d1e1ca2
MD5 f22f1f4f67597d5da36b9cecbbb9bc6e
SHA1 995552cfcd548aebdc3f3ed0f08d3395312b53eb
SHA512 6815328e6f4ad9faefffef2a4e6f9222d154f8fad244421f5261f6a059ec2b705aa3291f904a22e162f04d1c593669d861df8a99d80d7eaef2e9be5bb294d427
SSDEEP 24576:MhHKWxn2j5IH3LrCI/In2QGIlXaPHO0ayY:nQn2j503LGZn23GK
TLSH
T1C3454B0277F2C134CA6360328E6BEB9863BDEB155F11450727882B4E1FF1F498656FA9
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

676204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLocaleInfoW WideCharToMultiByte GetTickCount GetDriveTypeW GetSystemDirectoryW Sleep IsValidLocale FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId GlobalUnlock GlobalLock GlobalAlloc GetCurrentProcessId InterlockedCompareExchange LoadLibraryA QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetLocalTime GlobalMemoryStatus GetDiskFreeSpaceA GetComputerNameA LocalFree LocalAlloc CreateMutexA VirtualQuery GetSystemInfo VirtualProtect ReadFile SetStdHandle LCMapStringW SetThreadExecutionState FormatMessageW IsBadReadPtr GetOEMCP GetStringTypeW GetStringTypeA GetCPInfo FlushFileBuffers SetFilePointer HeapSize IsBadWritePtr VirtualAlloc SetUnhandledExceptionFilter WriteFile VirtualFree HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree ExitProcess HeapReAlloc RaiseException GetVersionExA GetCommandLineA TlsSetValue DelayLoadFailureHook CreateThread WaitForMultipleObjects ResetEvent SetEvent CreateMutexW FindResourceW LoadResource LockResource GetLastError lstrlenA MultiByteToWideChar CloseHandle ReleaseMutex WaitForSingleObject LCMapStringA CreateEventW GetModuleHandleW GetShortPathNameW lstrcpynW lstrcmpiW InterlockedDecrement InterlockedIncrement lstrlenW LoadLibraryW GetProcAddress DeviceIoControl FreeLibrary DisableThreadLibraryCalls GetModuleFileNameW lstrcatW DeleteCriticalSection HeapDestroy EnterCriticalSection LeaveCriticalSection InitializeCriticalSection lstrcpyW GetVersionExW GetThreadLocale GetLocaleInfoA GetACP IsBadCodePtr InterlockedExchange

ntdll

RtlUnwind

ole32

OleSaveToStream WriteClassStm OleLoadFromStream CreateDataAdviseHolder OleRegGetMiscStatus CreateOleAdviseHolder OleRegGetUserType OleRegEnumVerbs CoGetMalloc CoUninitialize ProgIDFromCLSID StringFromCLSID StringFromGUID2 GetRunningObjectTable CLSIDFromString CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance HDC_UserSize HDC_UserMarshal HDC_UserUnmarshal HDC_UserFree HWND_UserSize HWND_UserMarshal HWND_UserUnmarshal HWND_UserFree CreateItemMoniker CoCreateFreeThreadedMarshaler

oleaut32

SysFreeString VARIANT_UserFree VARIANT_UserUnmarshal VARIANT_UserMarshal VARIANT_UserSize BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize SysAllocString LoadTypeLi RegisterTypeLi VariantClear VariantCopy SysAllocStringByteLen VarUI4FromStr SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate VariantChangeType SysStringByteLen LoadRegTypeLi SysStringLen SysAllocStringLen SetErrorInfo CreateErrorInfo VariantInit OleCreatePictureIndirect OleCreatePropertyFrame

user32

LoadStringW DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx MapWindowPoints EqualRect ReleaseDC GetDC IsWindow CopyRect SystemParametersInfoW FillRect SendMessageW PostMessageW GetWindowLongW GetClientRect SetTimer KillTimer GetKeyState SetCursor LoadImageW RegisterClassExW wsprintfW LoadCursorW PtInRect IntersectRect GetWindowRect ReleaseCapture SetCapture GetDesktopWindow DestroyWindow SetFocus IsChild GetFocus GetParent ShowWindow InvalidateRect DefWindowProcW SetWindowLongW CreateWindowExW BeginPaint EndPaint OffsetRect SetWindowRgn SetWindowPos UnionRect CallWindowProcW CharNextW GetClassInfoExW

advapi32

RegDeleteKeyW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegSetValueW RegQueryValueW RegQueryValueExW RegCreateKeyW CryptGetHashParam CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext CryptGenRandom CryptAcquireContextW GetUserNameA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegDeleteValueW

gdi32

CreateDIBitmap SelectObject CreateCompatibleDC GetDeviceCaps CreateSolidBrush DeleteObject DeleteMetaFile CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileW CreateRectRgnIndirect DeleteDC

rpcrt4

NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer2_Release NdrDllCanUnloadNow NdrDllGetClassObject CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrStubCall2 NdrStubForwardingFunction NdrCStdStubBuffer_Release

Mpeg2Data.ax

IMPHASH fcd4181f9417f53d1b10aa6fcfd706a8
SHA256 886516c87c44b3f5724aca16e946b122a0527cc3177b3bf42ba1eba788f15b7a
MD5 c15a32f56e3fe83ad6ab9f0dedcaa9da
SHA1 53434fe6a7db9304b3f7d5d811f6f8591c268ddc
SHA512 d789854d9166674d6c835116ff4b03f0a401b6a4df604a5ee24ca31589d42123b4c9f6849d2dbdb02a5047ce681e92483f2926f08915c731d64c73f4bc83ee1b
SSDEEP 1536:P3dQ9MItf5FvSBB14TULwi2oKixe24dTKlwKwyoxlVBbO8:/sfnqBgoPe5ew1xlVBq
TLSH
T107437D427BD2A0B2C3523173DEB937A6F3BEE6081927DE225B0829455F31643B475B07
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

33657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ResetEvent WaitForMultipleObjects LocalAlloc LocalFree CreateThread LocalReAlloc Sleep QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess CreateEventW GetThreadPriority SetThreadPriority lstrcpynW lstrcpyW lstrcmpW SetEvent CloseHandle LeaveCriticalSection EnterCriticalSection WaitForSingleObject DeleteCriticalSection InitializeCriticalSection GetCurrentProcess GetModuleFileNameA GetLastError lstrlenA MultiByteToWideChar lstrlenW LoadLibraryW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW GetCurrentThread

msvcrt

malloc __CxxFrameHandler ??2@YAPAXI@Z ??3@YAXPAX@Z free _purecall

winmm

timeBeginPeriod timeEndPeriod timeSetEvent timeKillEvent

advapi32

RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW

user32

GetQueueStatus PostThreadMessageW wsprintfW MsgWaitForMultipleObjects PeekMessageW RegisterWindowMessageW DispatchMessageW

ole32

CoFreeUnusedLibraries CoInitialize CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoUninitialize StringFromGUID2

bda.inf

SHA256 8e12de31f46f9ea64ba2a235cba60c3a00fc8d67ea9cdab0a54b5107e9d83a7e
MD5 a9906b5145e151b6fcd89abe8d0cfe10
SHA1 e3ef77ca35166e22fce6a991f670f997dd591ca7
SHA512 22892195ad285c248f9df5d09b8db2cea1322089498b3eb71c8524df3addd6c64ec110aff9f78b28585cf42e9865230186384acc8666bd95fd12b6aca2dcc71b
SSDEEP 192:00a9Qh3X9Rsh3dkQ2J5s9Qh3VD9Rsh31flRlXodpxE4uHjNuxcr:M9U9RHa989RWflRlXodpxeCI
TLSH
T17222955E432F5923A391109DFBC12DC7B2B18464E4C6408F72BDCF196A5AC99011AFFB
MD5 SHA1 SHA512 SSDEEP TLSH

bdaplgin.ax

IMPHASH 2d0c35dab4bdadc34717c640b941494f
SHA256 18870378c79d899d08e27fc15b189a390b5f6e945080fb2ca80088c7f3efed2c
MD5 fec7c0214fe562e4f844b1c9ad7b764e
SHA1 0a001e8930321000aada1ea4642d811d27cc0fad
SHA512 ae7fb745daa28b3a9739ee2f152237539b5b57691a398414e4bea7092eecc6b51e0411ea2a509167da89941c57d9f1bfbb9e5d683bebcc611b5e75be9f1d9eb8
SSDEEP 384:xbqT9AkpIxJfizW/zBKSZMItir5mg663xtKG7KWNy/WKN:xbqTXpIxJiaFKKMqisgrxYbJ
TLSH
T13F722C45E7E298B3E6D246335BF6268772BACA255386DC04174026072E37982F1B678F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ccdecode.inf

SHA256 01a55e7e46078b922d5acadf0dd523bf8dc0b5d911be9ec57d890f37c27ca1d0
MD5 72be12ea26bf6649482166af3fdd0cc6
SHA1 31ae26d3ecd44391bc93ff5ddce1d1b0f597d60e
SHA512 0476540cf9d54be6dddf961151cdd90b85b0893a3e373aa56cab3b1bb9c238446228faeb02deff98999ad2c0432101e9b659a7781d827585d2ef3395440e81ec
TLSH
T194716679CD0F91326386E12E7BD21EC2EA095CF2856A0510F55D860427BAD8C531FDDE
MD5 SHA1 SHA512 TLSH

ccdecode.sys

IMPHASH d5977c633dbdac9c68f7e446e09a0a9d
SHA256 94317dbe975a3ee918d3fc2c54b2d766fb4dbfec5f85dcba5f30baf449673ee0
MD5 fdc06e2ada8c468ebb161624e03976cf
SHA1 a030505ef28063fd9a2a97bc5de13286bca22f0b
SHA512 552e3373b7d23d04b6379da758737187d9890b60e201f072bac3cc1c6a03a2ba45fc1c2951572aeedd411ffd8bdb8d6ea885932fbd74fb47c0136adb1a7bc144
SSDEEP 384:/7FWZsvzcfhWGR6/xPoH6ZhhiW75Xfn2VvnEsg2WIIW:/R+sgDjW975XeJEpg
TLSH
T179721B84B3C04DB1EC471CB1446BB70927B3EB125B2693E79110EDAA7C2B2D0AD7D6D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ccdecode.pdb

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

554B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dx9bdaxp.cat

SHA256 0bec710d309abfbfb74c1cc04ece78e21e29a573b2cc66a578fc8d182932b8ed
MD5 fa1a462e2f79aa2ff28185e5c859835d
SHA1 fb4f6feb5be684c5bc539c321757e8aec1b2f965
SHA512 c9eb2fbe1d7e95f51f3d34a72a6f55a30f03c7cffb5928f78e800f7b24d73534de0ec84531bfd2f42d606a83fb7854544c52e0b53d7473ec16960e3f1f2306b5
SSDEEP 192:hR5ViO1HC983Dip9AXK+CI3n8jiwPhdhRMnZrHZ1NZI72w5ZNq6aErlnkTN2+goj:IhJ817w5Lhe1OHrD/LO
TLSH
T12262115B09AC4163552DD9B1CFF5EC8FB432D6B6A8125D3E109373940A83BA2738F92D
MD5 SHA1 SHA512 SSDEEP TLSH

dxbda.inf

SHA256 ced775d3dfef4ea699a5569cb0b62b036188ce8bb44705bb56afe31e15af3a2f
MD5 2d4646b7b32230944e5517963d4a0527
SHA1 cdc607dc34d13925407088bff1a526b51f844fbc
SHA512 5177e9ed6bf1bd2b2f4ad8bf1c04fcfcba2541e4307a36a9493d4461cd4ef6561c2ca54810b385b11f359352b030ffc7e93b0c768c3ccf4d1f1f3db6305c2919
SSDEEP 192:72+PXOFcssVHSVyVdwaVEegWa7za0myx02Dj2v6HJod+Qg:K+PXD4myxVPq6pod+p
TLSH
T195D1B8444723D20BA9D8203C05A35FC7D6220079627AC85A75EAC9CCDF5DC2E7B776BA
MD5 SHA1 SHA512 SSDEEP TLSH

ipsink.ax

IMPHASH 628f6874f78df4a7257166f9144f8a03
SHA256 2cb2c9a8dc6901528a757ae5f1908c2f189d449e9eedc2085a3e7f1c730dc804
MD5 9ec3f1b9a34e3ac4bffa6f99df0430dd
SHA1 a771d3248763873069c97f114bff602f43d53779
SHA512 e4efebe730cf377b6c1315dd5c665c4a45812cef2ba0da4dd4d5dfb4f1d9346fb66bed25cf3976d474cbe3d52f6b1b22469f7e2e9c615abc0a6e525638eb1abc
SSDEEP 384:ZfUMIj91qKGSSjPCm/Yrm6gTu53xkaFWA6W:Z83Z1vvSjqKYng+xkaJ
TLSH
T1F5623C1273D19453D4A383361AF92E6777FDEB24A6399E03C6041A4F3A79983E1B470B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9717

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle ReleaseMutex WaitForSingleObject GetVersionExA ResetEvent WaitForMultipleObjects CreateThread CreateMutexA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls SetEvent GetModuleHandleA TerminateProcess GetCurrentProcess WaitForSingleObjectEx CreateEventA GetLastError Sleep IsBadReadPtr IsBadWritePtr GetProcAddress MultiByteToWideChar GetModuleFileNameA lstrlenA lstrlenW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW

msvcrt

free _snprintf malloc ??3@YAXPAX@Z ??2@YAPAXI@Z rand

advapi32

RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW RegCreateKeyW

user32

wsprintfW

ole32

CoUninitialize CoCreateInstance CoInitialize CoFreeUnusedLibraries StringFromGUID2 CoTaskMemAlloc

oleaut32

SysFreeString SysStringLen SysAllocStringLen

ksproxy.ax

KsSynchronousDeviceControl

iphlpapi

GetUniDirectionalAdapterInfo GetIpAddrTable

wsock32

closesocket bind setsockopt htons WSAStartup ioctlsocket

ws2_32

WSASocketA

kstvtune.ax

IMPHASH ea59e0fa6299a58362f0aeae0af3aa43
SHA256 6f9fdf51a16d8a14b2d1194d336f53cb293f9010a4cb632e627e874e3769b754
MD5 f5a59e8905fc16a74d9e21cfe06fedd7
SHA1 193653935bbd202dad0a75ffa57aea48c0e6907c
SHA512 21ed1450323422a0edd3c1f9981cd508f2fa10580a7a293f9435c5b58f27d007808ec158dc42d3049e1f1d0f703e3f6c74de24cd9b33c3259f4635bf7b84ef73
SSDEEP 6144:A/ArOLmLDuB7v9iixiiiCaaii66mizDDDDDDDDDDDDDDDDkkkkkkkkkkkkkkkkkY:XGmLDE9iixiiiCaaii66mizDDDDDDDD5
TLSH
T16744081093E24131FB739B7C27729F92E779F80867FB41C625487666ADA1240AC36F71
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

29135

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadResource FindResourceW GetLastError SizeofResource InterlockedCompareExchange Sleep CreateFileW InterlockedExchange GetProfileIntW lstrcpyW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess LockResource CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle IsBadWritePtr LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrcmpW lstrlenW lstrcpynW InterlockedDecrement FreeLibrary InterlockedIncrement GetVersionExW InitializeCriticalSection

msvcrt

_purecall ??2@YAPAXI@Z wcstol ??3@YAXPAX@Z

advapi32

RegCreateKeyExW RegOpenKeyExW RegEnumValueW RegCloseKey RegQueryValueExW RegDeleteValueW RegSetValueExW

user32

GetWindowRect GetDesktopWindow MoveWindow CreateDialogParamW wsprintfW KillTimer MessageBoxW LoadStringW CheckRadioButton SetDlgItemTextW SetDlgItemInt DefWindowProcW DestroyWindow ShowWindow InvalidateRect SendMessageW GetDlgItem SetWindowLongW GetWindowLongW GetAsyncKeyState UpdateWindow PostMessageW SetTimer EnableWindow SetWindowTextW GetDlgItemInt

comctl32

ord17

ole32

CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CoUninitialize CoFreeUnusedLibraries

oleaut32

VariantInit VariantClear

ksproxy.ax

KsSynchronousDeviceControl

kswdmcap.ax

IMPHASH a4d2e6643818292a0d8fef1ab511db26
SHA256 432b3032901140f654cecb6a6617c166fd78db658fa4317833868f5b03338e9b
MD5 63087b5d39cedafaef62f9a885f4be6b
SHA1 4d18896b121bd994a1f83cece2b1560c3d8fb98e
SHA512 c0cfe5ea9d1b1515fd0ee6a745d74da1208cb0c1bb97eb0e2721221db8eea28dbbaf53aff231a687cd38707ab770ba1a278a066d51d03f614fe5fc8c11bedf86
SSDEEP 3072:tnkB8Em3HerCa0Nt3fHfBExZRkdhx9JsP438ZHbdEcGnnwM4fjqhi9T+za:qB8EmEKhExZCdhx
TLSH
T15F244E0053F5C515F0B70A745DB69BD26E2A7CA66830C90FBEAD624F2870E04DD3AB76
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

52638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObjectEx SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent WaitForMultipleObjects VirtualFree VirtualAlloc SetLastError CreateThread InitializeCriticalSection ExitThread WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA lstrlenW GetCurrentProcess InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA Sleep lstrcmpW lstrcpyW lstrcpynW CreateEventW GetLastError DeviceIoControl GetOverlappedResult lstrlenA MultiByteToWideChar GetVersionExW TerminateProcess CloseHandle

mfc42

ord823 ord825

msvcrt

swprintf _purecall _ftol __CxxFrameHandler _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ sprintf _wtoi wcstod

advapi32

RegSetValueExW RegCreateKeyW RegSetValueW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

user32

SetTimer KillTimer wsprintfW LoadImageW ShowWindow SetDlgItemTextW SetWindowTextA GetWindowTextA GetWindowLongW SetWindowLongW CreateDialogParamW MoveWindow InvalidateRect DestroyWindow LoadStringW GetWindowRect GetDesktopWindow EnableWindow SetDlgItemInt MessageBoxW IsWindowEnabled GetDlgItemInt SetRect IsRectEmpty SendMessageW GetWindowTextW GetDlgItem SetWindowTextW

comctl32

InitCommonControlsEx

ole32

CoUninitialize CoFreeUnusedLibraries CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree StringFromGUID2

ksxbar.ax

IMPHASH 86f7b1489e2283642a94ef3ffa08593e
SHA256 e3d6d38cbdf5f6449c9080e4ad9e12dfdae3239cafa7c6569b880b93447d7132
MD5 7c9cff0fbd4ac215f41cc5014f1da304
SHA1 9f14c465a87b2ee8940c87a15827f49b0d892bb1
SHA512 4a652cc0ba534060522b1cdcd4b2796b796a63608353281a3029782c28d56447c5e074c2a93fee6aacd930281c48a9e3719a5b09402e686e437e9b63ff00a725
SSDEEP 768:AoGUTKN7+j3JyR9EEw4PbAWgvnK66ZBgM7laOM:AoGJ7CZbEw0bAHYZOSlB
TLSH
T167036D6537E28072D3B3E2378E2533B976F6FA14167CE43A078465892E7058AE5B9307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mpe.inf

SHA256 162c1dd3539436eaaadbb008e3cd275369cdfb51382a04bf8889d9f2a9f0e10c
MD5 d866dd33fe0269cec6d201c35be34750
SHA1 4655d7a2e8ccc9b46b0c8ccd6fc5ffc6897cea1b
SHA512 ef076e9b9a1e8e945f3889f3e8125381de2103c6e6f8ab4635dc9c4327a7bdf49acb4eb2020863c734a11b7eee0817108f181f7297440973d09ee62bba2d96da
TLSH
T12361A56C8C4384B38356E36A5BCB1EC3EB165097C6660508316D4703A79AD1EF31E8EE
MD5 SHA1 SHA512 TLSH

mpe.sys

IMPHASH b709125e5196d69f577afdd8423729ff
SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
MD5 83eff7b976ae24f1a496ca94a8a19919
SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
TLSH
T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mpe.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

640B

Virtual Size

630B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msdv.sys

IMPHASH 9c8ab33b01f025da51e11dfc59464123
SHA256 43c355a0ae8f3104d27e2f60b4e4a234434a3f4bafcc6d8efbcf941005d1703d
MD5 8575d788395c4d6378d98d1ed7cdadb9
SHA1 68acc396009b0f4423d64ecb49591d785cf1c150
SHA512 8d4356dded57e33503a5810b3d94e27e07bdf7e11380b2f92d45c63e8a37e40335fa494541f6f80117e6cc35244de07618e73be0535b7af25188a9f0075dde1f
SSDEEP 768:aVsHDMhUfVQtTTxzS5kuDdIHXjM9reONtrgVveVKLc/LgC:aEoh8Uxzwk9CeOj80Amg
TLSH
T16F332A00B35088B1C05A0270CC1FB36562B3A91D1FDA67A3737427AE2E397507F66767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msdv.pdb

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

msyuv.dll

IMPHASH 317bb2a83416a509406d650a33ce001a
SHA256 3feff133489eca65922e1001885d3f98ad57e7d531b67b67c26027413b7fc95d
MD5 985d12554a9d51e989d1712e299f7655
SHA1 ed1300df0148fa3bbb754e384be09a98a1ee5664
SHA512 b44d17ed9314e0c80d078a6e4d037aae072d8495e80f4b5239162db69a7e631eba0e7afd2572a3dcd4cf72fb8d857088e6913f57902c055103f6dbabb5932cec
SSDEEP 192:8iNj0i6wnT1v08JzPLPdoKo9yTYlAU1Wo+Ijuo+Ijpo+Ij2JIGC7qIGC7tIGC7Eh:8ib6gtzLL1jWyTYlAsDTZK1WactW
TLSH
T1A07293827FAB1D52C0D1093548A7C63B53BE9F7056F7469A4F2511AEF820A61C63BF13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nabtsfec.inf

SHA256 eee3641785da56dd4646a4dc5aeb5827828a3218bd5635491da1ec70608ac604
MD5 187630b45b902dfa52d13f11c69d36e2
SHA1 5c2ca522286b99f8859f6c719d15468c89644a92
SHA512 2fc8220fe6bcdb99a874e3f80937f30aa1b7f733e7148a079a7db075b37005f5c862909d87f69dbfe940489f69456f4d3669cf063f482fce47a0b83c95be24b4
SSDEEP 48:xbcXc68yEhpOD8HK7k38O770g3kc4CqldXcZZx8+wu5S70xjUCdgn9WK13EdbsP2:t00pIfxcZZLiCApt1UhsP2
TLSH
T19E818419CE1B803663E9D11E5BD73E83DB2A30F28D6640C0379C5A08278798C932EDDE
MD5 SHA1 SHA512 SSDEEP TLSH

nabtsfec.sys

IMPHASH 49970d1ef884a17567a446f9fea4d52c
SHA256 fb000ea253475abc5b6938aaa3e7a0405e81d3a282485b7f74ea9a4e77563308
MD5 ac31b352ce5e92704056d409834beb74
SHA1 6164b8586598cef328a1d8d32e64622821340e55
SHA512 c9eaf6d00e1821411f647d36341626024357b5b9b589bd83a69d05579a5c818add9774dff98c629a5463af623fab595ced60e8a517f62a93ad9593a989ade532
SSDEEP 768:7NQ7ZoFgMU7KbBPYTDjujwIhkHZHVMV+mpY3jl6myuq2CeaGSOKWi+6mywyRE4Wu:BQ7kgMUiSTDjG9kDDFO3Us
TLSH
T158836B00E782BB3BF4EB50F6916B7A4E11B49F110B4982CB6AD87C46AF385D16F32153
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

37401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

nabtsfec.pdb

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

1006B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

256B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

896B

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ndisip.inf

SHA256 6239cda249f35baa9ba1848ebe3df414afa27be38fb8fee79fcdd8dd00dbf907
MD5 3675a3e175c1b4a9a0397d80b6cdfafb
SHA1 5eb1d87943f40a205c9b1a65b880417d1c5ff8aa
SHA512 7ce64105634e7dcb4250a972bf303f4474622ccc61ef07e1742daee8e32ebaff6991bce31c68d782b8f0b31b9c069755548dfd80ac6e4a5c63adcd7484d74299
SSDEEP 96:4VNZ3J6Ep5c2cQHSsK1GMDSsKv/edvZ0EL6OjkiDk9ozMZ/XydUWb:EH3oEI27SsWtDSssedhTLFYig9ov
TLSH
T160D12E194F42AE352BCBD1799B030F43DA36029B891A154435AD5BC02B7F68E632DE8D
MD5 SHA1 SHA512 SSDEEP TLSH

ndisip.sys

IMPHASH 85b9203fdd9c0bd977642878e7918927
SHA256 e880da5ddd381abed5bf2c3b8cb387842301b52ebf29173383d618f5961f36f7
MD5 abd7629cf2796250f315c1dd0b6cf7a0
SHA1 9baaba6e47ec06871d944f19961ca3cc8132c782
SHA512 a68483ac251df13566e48f202e9a6d305a90fbe69408aae232d4ebd399d53ed077de97ccc3c005f107dc560ee9bf6d4b070562761101d08858700865dee6aef2
SSDEEP 192:++BarPS1JL8yvpeA1SbVMsflIGywVVXXPWgZFW:RBOyJ8yvpgVMsflIQ/WgZFW
TLSH
T15522F90273D41B3FF0930FF559B317AAD527B9157F65624E021314CEAD39AC5AA38623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ndisip.pdb

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

331B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

384B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

896B

Virtual Size

890B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

358B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

psisdecd.dll

IMPHASH 030f2fd88c6befc4cc612bcee23289da
SHA256 5108a9179e2b042eac111d926431e8fe37562c9f4422861ca3120b506b409b98
MD5 5319bf20f48884e594f84097a600424b
SHA1 1e4014a1df18c5c743e5567d768f8e37a97f9f09
SHA512 a4a3b3127d5fb69fe1ba581d9051ae8d1d1626c38486abf1bc0e3b697e10f73127c97c7913cf6640ce6b937703cd18c600a021be5b1dc84fed078d4eba9cb4ee
SSDEEP 6144:zAOuiRizjJTRcHV+oGC+1dnLSCkFUnru89Fos5FkYAloEcXnEUjz/ZnC5W:zU+VO1dnLSk6kqs5qYAlDcXnEUjz/ZnT
TLSH
T1C1748D107FF6C136C7A56175CA7B6BEAF778D7054D600A670B0C162C6F38A82E162B1E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

248728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW lstrcpynW HeapDestroy lstrcatW GetModuleFileNameW DisableThreadLibraryCalls FreeLibrary GetProcAddress LoadLibraryW lstrlenA SizeofResource LoadResource FindResourceW GetLastError LoadLibraryExW GetShortPathNameW LockResource lstrcpyW CloseHandle QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetCurrentProcess FlushFileBuffers lstrlenW MultiByteToWideChar Sleep InitializeCriticalSection InterlockedDecrement InterlockedIncrement DeleteCriticalSection LeaveCriticalSection GetModuleHandleW EnterCriticalSection SetStdHandle VirtualQuery GetSystemInfo VirtualProtect LCMapStringW LCMapStringA SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr LoadLibraryA GetCPInfo GetOEMCP WideCharToMultiByte LocalFree InterlockedExchange TlsSetValue GetCommandLineA GetVersionExA HeapFree HeapReAlloc HeapAlloc RaiseException ExitProcess TlsFree SetLastError TlsGetValue TlsAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree WriteFile VirtualAlloc IsBadWritePtr HeapSize SetUnhandledExceptionFilter GetACP

ntdll

RtlUnwind

winmm

timeGetTime

advapi32

RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegCloseKey RegQueryValueExW RegEnumKeyExW

user32

CharNextW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoCreateFreeThreadedMarshaler

oleaut32

SysStringByteLen SysAllocStringByteLen RegisterTypeLi LoadTypeLi VariantClear VariantChangeType VariantCopy VariantInit SysAllocString SysFreeString VarUI4FromStr

psisrndr.ax

IMPHASH b3fabccc88441525f3d8a97e7abf70a5
SHA256 b0969c106bdd6e4b0ae2c252e9b4792532ca60b19eb04effba9e8adc1c41025f
MD5 e93d7d262a33d14aef13398ab83fe08b
SHA1 b7fb62de3c6521c3f71ff3a398cc6b97abe2392c
SHA512 26db7045c57faba96b96e4dc6da3667122398a4a3517065854c9114ff78cc25ba3116e010f9d45ee2d1de3f4935345a53f5f407a1538eb29f013458baac9c1c7
SSDEEP 768:F1mgRwKIvRcysV+ngpw1r8aQ4nMxBi7W:WVvRcVVDI8aTnMxg7W
TLSH
T1F1D22B137BE660B1C6A35233C92133A7B2BBEA586539DE154A1819462F32143F1BE74B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

slip.inf

SHA256 418040f2b05a196c48fceae77afaa9e58ca87b10269dc084be493db377c82a31
MD5 a42a3419a484b82e752b850cd13bfdd3
SHA1 fdb7a19707b7ea6e349c6559152cb5f1c02483e4
SHA512 eda1f7ead98530284ee850dffae35073f22c3399cb98b6e25dd62d3ec175b4d160d1841ccde5c4261b76bf301feb5417446a30779cf276d778f5c2ba68a4acaa
TLSH
T1757186ACCD0B09636389D1558BE63DC3EF980053C19B0B89306D8A1663C9A9D5E1DDEF
MD5 SHA1 SHA512 TLSH

slip.sys

IMPHASH 3f9db7809b38aa51c5daad51c58fe7a9
SHA256 96cc96eebaad2782d8143db2b8889e9249c89dfb90875412e5f105c0ffb3c728
MD5 1ffc44d6787ec1ea9a2b1440a90fa5c1
SHA1 244264547bbad19cfe6a8d5d057db281f92095a9
SHA512 c7ef4afd2af054452363bf082a2f2821c8944b24fc1c0f8f8ef97d96b3cafde20644f00985829bfbb7cd869d4a866d3f3fa39b93c050e3a27efaa258203addbe
SSDEEP 192:NApCqlIwfHkLPhw22AsALyp2rn4kY0FUjoZVx4TWxzyWE:N6ZImHkLPhw2H5x4krFUjoZAWxzyW
TLSH
T124224A1137E40F75F0D74BB1EE8B271A867BE81C5A11E33E02A53D891D38D00BA2C7A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

slip.pdb

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

262B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

440B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

206B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

streamip.inf

SHA256 1e06c2c3eeb9cfd1938b73e70cb3b841b1da89b97ab6acadde5c136e0b336bf6
MD5 885e850809bc928ee802f13e28449efd
SHA1 39f8ff6d6cfc300b61e6a52f647b05382c4b365b
SHA512 1b660a1eb54b6e1bce2902a260ae95def2eec32af8c06a666138456ad85f5299d9286d588f90fa9c4d938ccee06960d19c2a3ecbed539e41811e89533526c6e8
SSDEEP 96:d0KuUqnZK8hQ+B8ljiFjZMaH1XNgaAgaPRIWKTAidudNjKJ:d0K4Yt+SljiFjSyGyVIKJ
TLSH
T141C173494D2B5473937FF23D9B870F92E6257813D18F414830BCCA161B9AD58922EF9E
MD5 SHA1 SHA512 SSDEEP TLSH

streamip.sys

IMPHASH 937c5c9480c457813996610d24c3ca2e
SHA256 a06e4a105327fc76cf4697278d8144e83cad89fa4719fbe3f4c32f6027d802fd
MD5 a9f9fd0212e572b84edb9eb661f6bc04
SHA1 fa9de09db2df10e991588d2ab578251d11bcbbc7
SHA512 1aced7a2cc33e493bed83cc52ac2b68dfd752acd2261750393c1b22ff2f0396d9d73c42e3b14295d8416a123e7c43fc329e012a661d8b74e31e41c8e42b624ac
SSDEEP 384:mBjX9oOlN5wQVEI7yjrDuL43KJpQVPk7cOe8NHiboZtMWg1RW:yjX9oe5BVESSS46JsMcC9iboXW
TLSH
T18862F88DE3D50572F52F01B886929742E9BFDD056E1A82F987FC8FE12C82552F4247D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

streamip.pdb

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

647B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

640B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGECONS

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

768B

Virtual Size

674B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

640B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vbisurf.ax

IMPHASH 4ea881e9bc4888403a5e8628308bf315
SHA256 3694636dd9a32923d5f7acfa84c53127ec6fa8d56b759e3ece41b204d251931c
MD5 1c4496b1780be155c2d8d1b260118959
SHA1 f5e4067171143c98de66efbf66bae07a5fa901f9
SHA512 7edcc92e99b4f280fc2639aa91db233275a8fec4673acf5f80d682e5fdf3a0c05076c5be44179ff08df73b08e1e55e654f05a4d299defef03036f60ac5496399
SSDEEP 384:if/mN0LqTy/FaX3Jq3en7CblOY5vgTRsceQ/L9ePFE0tpBL3x8KBW1jWVzG:iHEkn4HI3E7CJngvj/w1xVgoG
TLSH
T14CC25C12FBDB807ED6A355325F793FAAE2B2E7441A7C9C120B1059453A21183F2FA357
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wstcodec.inf

SHA256 6edd2203dd2fae09442e9afec57738ebc37364d27c84d76bed633e122ca33313
MD5 d0ba27ccb5958090755e939a01ce8cd4
SHA1 7e9ec073086dda1d6bad3f572e041cd482877fc6
SHA512 583d43a959af8ca13d0a215143ddec8c78d0e079c06707dd23a093dcf0bf7039b60a802539c364db769ebe065a3f805d86fb3bae0a0f1b453325a0635e1a52cc
TLSH
T1857123CD8D0B87BF7344D11E7A522E82EB1971F281CE0A043D9D7E143796DC8621E89E
MD5 SHA1 SHA512 TLSH

wstcodec.sys

IMPHASH 5e94d6115bae4fe6e2b87706af1a8293
SHA256 68348cdfe255471191f8ee5b522174c8b9bed9162359ec180076e19dd78005b7
MD5 233cdd1c06942115802eb7ce6669e099
SHA1 9ee4a786785fc2676efe1935704a44bccfde121c
SHA512 7758c0c58939e90cc6a25c79bbd6fd5def9f1f2ede0d9063f2e707d033f91fc68cd8a5ec7674e180111963503e48a803a996ed4a0aaa0e3215274ec5131fcb0e
SSDEEP 384:Gs+CEbgqEcQzr9wa8miLXpYs9+WNPHeWQyWoS:R+pnQzYY8hQs
TLSH
T132828EC53BC02DBBE9254B355AFB23146BF7D7191662E3838210ED5C3D26E408DB2A23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wstcodec.pdb

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

512B

Virtual Size

484B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wstdecod.dll

IMPHASH b773ed61e5f2f5b7c57feede58a7f58c
SHA256 9e785280c35b9915281c40f849837aec6b82e30cfb39982fea953203cfc6c8f4
MD5 153f4ff0785753a1ad4985e41b3d6d00
SHA1 5a709d5e98633c796ded01977904cb9f3cf05055
SHA512 6e7e4e14793caa388922639ed86a9d411f4e3fed374a2a443806e78cc487ec80a2b705b5be75a1da6832b362e735a5351b0d43b56ab642789e1e1777ae33251d
SSDEEP 768:lY8V2X7EU3D90DlqEafnKYmTzTLGvj47cJBzgyUErCGZKLYphRxqH+cK+Lm:l5Vg420DoRfnsnTLGEiB0eDYYjRxKM+
TLSH
T1C0238EE573D240F3C2F30172AA3533A6B2F6F6181A2955234714760E6BA654ADA3F337
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess TerminateProcess GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetLastError FreeLibrary lstrcmpW InterlockedDecrement InterlockedIncrement lstrcpynW GetModuleFileNameA lstrlenA MultiByteToWideChar lstrlenW GetVersionExW GetModuleHandleA MulDiv IsBadReadPtr IsBadWritePtr LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection

msvcrt

free malloc ??2@YAPAXI@Z sprintf sscanf ??3@YAXPAX@Z

gdi32

CreateCompatibleDC DeleteDC CreateFontIndirectA SetBkMode DeleteObject CreateDIBSection SelectObject SetTextColor ExtTextOutA SetBkColor GetTextMetricsA GetSystemPaletteEntries GetDeviceCaps GetTextColor

user32

GetWindowRect GetDesktopWindow DefWindowProcW InvalidateRect LoadStringW SetRect SetTimer KillTimer IsRectEmpty ReleaseDC GetDC UnregisterClassA SendMessageTimeoutA DefWindowProcA ShowWindow CreateWindowExA MoveWindow CreateDialogParamW SetWindowLongW GetWindowLongW wsprintfW GetWindowTextA MessageBeep IsDlgButtonChecked GetDlgItem SendMessageA SetWindowTextA CheckDlgButton RegisterClassA DestroyWindow

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegSetValueW RegCreateKeyW RegDeleteKeyW

ole32

CoTaskMemFree StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoInitialize CoTaskMemAlloc

DirectX9/DSETUP.dll

IMPHASH f57b219515a7304b7cca4eea391181e3
SHA256 edc9c0bdd3e1e445c9bd57fe8141f93c0be53d61d1f8c6355e6d53565028001d
MD5 91865aec9c49bee70ed3ab5ec4365127
SHA1 f561888fb9ac1eca6ab82a987348c0391a21f2de
SHA512 bbbbc48cfaa16c66635f988e4e23726fbf83af001c2d111c8b3038ebf6ce5aa3a417ee671bb112cc0cbf9a58bbc3c1eccb84bf7380d908d017af7d3826c37cd5
SSDEEP 1536:9MYLA6vhzACiyKpkiKUlmMUoHLsYTK1WcOe3C8YHQkrI3ECu3+LJrxPP:9MIA6vhzACiyKpkiKURUyoF49ej3ECu2
TLSH
T18F435D43FF708076D8D222FC18485611B6BFE9681ABC846B930583D96EB2786B63D753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatA lstrcpyA IsBadWritePtr lstrlenA GetModuleFileNameA SetLastError MultiByteToWideChar LocalFree LocalAlloc lstrcmpiA WideCharToMultiByte lstrcmpA GetSystemDefaultLCID IsBadStringPtrA IsBadReadPtr IsBadStringPtrW lstrlenW lstrcpynA GetWindowsDirectoryA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetCurrentProcess TlsSetValue GetCommandLineA HeapFree HeapAlloc HeapReAlloc GetLocalTime ExitProcess TlsFree TlsGetValue TlsAlloc Sleep SetHandleCount GetStdHandle GetCurrentDirectoryA GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree WriteFile LeaveCriticalSection EnterCriticalSection VirtualAlloc GetACP GetOEMCP GetCPInfo InitializeCriticalSection SetFilePointer GetStringTypeA GetStringTypeW GetLocaleInfoA RtlUnwind SetStdHandle FlushFileBuffers CreateFileA LCMapStringA LCMapStringW VirtualProtect GetSystemInfo VirtualQuery SetEndOfFile GetProcessHeap ReadFile GetSystemDirectoryA SetCurrentDirectoryA GetVersionExA LoadLibraryA GetProcAddress OutputDebugStringA CreateMutexA GetLastError CloseHandle GetFileType FreeLibrary

user32

wsprintfW CharNextA wsprintfA GetKeyboardType DestroyWindow SetFocus CreateDialogParamA SetDlgItemTextA MessageBoxA PeekMessageA GetMessageA TranslateMessage DispatchMessageA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA RegSetValueExW RegCreateKeyExW RegQueryValueExA

winmm

mmioRead mmioDescend mmioOpenA mmioClose

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

ole32

StringFromGUID2

DirectX9/DirectX.cab

SHA256 e8497df7ed6b47e7ae6a4a78eb10fd3c279224b50bfc9084ab67996ecbeb9517
MD5 8395203fb63b22a35764e90868da5fd5
SHA1 382163a4469a6ba63251d78c2d09d7da81ebce4b
SHA512 4674f42d578e329b23cba994485f6f2321b5585a4893619b7a82f4c553370e80d6f55974626266aad8e0afbf893ce0b48bb5d2be76b1171bde13cb318f7ae37a
SSDEEP 393216:1aCNwZi1uqToX/2fsZGorVVV3SYkgM21q12/Yg00Dx:1Ui1uqTMufX273M2w1YV
TLSH
T126F63367B3541B80B8BFAC64B4C7C65BE1A5277A111D9C0BFACDBB085C4C6D0687386B
MD5 SHA1 SHA512 SSDEEP TLSH

ACTC094.ini

SHA256 8cea0baed4097534d19c36633bece9c8f0e9864174cb292021b31450074406d0
MD5 90e60c20df2541b20bb45811e024909d
SHA1 3e88a5e65dac8ef4b85f1ad3c8f2887184f75ff8
SHA512 8d922215411c8c0c4e6e4917203a691180adfcdfbb6996dcc05f53d51862bd3e97b89cdad1610dddc1526df03950c369266563cd35813f8be187bd2c40f22367
TLSH
T1F081ADAB857072BCF4BFB5BD324B00DD135124B789A2B067156731F8634385B3AB28E1
MD5 SHA1 SHA512 TLSH

ACT_RS.ini

SHA256 95de1d836d0b68a58dd459835c693da24503250304e8aa0bef58d27566843d35
MD5 61fe9c4bfc75fdbfdec4f60136ee6dce
SHA1 a9c6f2e21b4c129bea2a82415700f0f80fc05119
SHA512 5fb6416d823c8404c5b607b7dd4ca12c0b6b63693c8e90f877973109edd65bc71270babe97cd62343bccf179071bbdbafe40fb4e56e1355928dec96ce592d70b
TLSH
T14F5137CE6F75A2DCE9B231495807D6EC0EA11AB21FD63EB9504519E47CE01312B2B9C3
MD5 SHA1 SHA512 TLSH

ACT_RS.png

SHA256 3904a6ef7aea6c5535aa7ff6495ee965a6ccabf7d593eabfbe0449fa56e5ff07
MD5 7942a02676b8c1f40b2445a32ed30704
SHA1 3f57fa332966337276e662d3ef76a1f0df87d7b9
SHA512 e56555eeb01809c3ed71e0cc95e088b0adcd6a5da36ba61a94b6d7000e7d6023ef1d84fc4e8be92ca2af4bae9749b5db48e27617718af99fa0aad1e02e78d052
SSDEEP 1536:FoonWm5kMGiQzAiLaAFcPjw/AeTXz2GOMDLCeeWDaU1/8MROWk:MlLNFt/AoXzzlja5ek
TLSH
T18B9312CBD1EEFF22956D7B4780D1E112038B03793F494AA97118B68403AB5C8E73A56F
MD5 SHA1 SHA512 SSDEEP TLSH

GR3001.ini

SHA256 c5b79fb29e3489b3e1789403c2e0585c646287c9a61a756b8c9876e9d0f6d77b
MD5 47f6bce7d86f48f18ea82e97c10342a1
SHA1 88322d488cda74bd04a207a81d9ea9cc6ef5c87a
SHA512 d88582171208d686632e0d8f9845c9cd366cd3937b70f276de2be5f0f2114d919a9a0a0913fccc4dc07b844a365dadbf1d667d17a445734d86049da179cd0679
SSDEEP 96:JUXiR9HMeaO+WYwPgotSkEYrDPth/wX7r4sPX:aK0w9/1yLr4sPX
TLSH
T1CCA1884E9F3032AC940BB13A334788E83A6914B189FDB558000F15DA66A19B477FF9E2
MD5 SHA1 SHA512 SSDEEP TLSH

GR3001.png

SHA256 0799b81ff6267914c697734fdd9f25a2f8f12867d7465bc7d0defabd7891777b
MD5 1105dc7d16c1fc5712796441eb5c36ee
SHA1 afad00275a6a63c9943aa0bc182ff4de2b3a061d
SHA512 548de0bcc75eb4468f2800124bfd76d5659b256aa9d166091de619ecd6409b9403ac5f082da1e6556ffcd613a018a4fc7b80ad56c3437242aee439847f4cc17c
SSDEEP 768:HMQ1wu+eLtWJDuqMFcbdM2JIn+HaPpZDtlfkg65MluLnZatlwcXvpxtPWHBhHXSU:HMQS7ekJabFCInCaPp9Tn6HVorhWhB
TLSH
T1F803F1A43292E876A99DA03A9C86F4E07533BD003AADADF1EC4BA74FD51B03DE310515
MD5 SHA1 SHA512 SSDEEP TLSH

GR3001_G.ini

SHA256 e13de488155683970f388a754266c87999678437a8dc2d69e1db5fbd6e936e02
MD5 5ce0c65859ee3710ed9d9bb8f857a718
SHA1 ad8500f016725fb8d889892dfa5624b1d257aae6
SHA512 f6bf30bc0dc796f2882d0f10f97eacfe27f3746799a4797f5b9f5eda640cf858cfe70f52a8001fe9c4bf97207a047da9a36ee5311f9fa601660f210bde898f25
TLSH
T139819B4F2EA432ECD85BB16B374784E8266C10B188FDB4A8104F05DD9A5197477FFAC2
MD5 SHA1 SHA512 TLSH

GR4001.ini

SHA256 5961de03bf16540ffde3ef81be2834f16d7e8090482e91e5ae880576e07d0a4e
MD5 85aadb0caa6d7d0b7be6e8fb1368c3eb
SHA1 342355515af7b946083f3a1613c68896164d4e23
SHA512 8cd6879021c5c2b86b864efc9c5340d06b5d4104dd8a6c5acf58244dc1e4c993fa001e2c6e33cda9624d7b418cfb9b69a075b0b11fa9de1a5f7b46d06434e94b
SSDEEP 384:diSN6MbONlJ63d8Q4RZy6hD3xvGLRggrTNNERB/1Pz7+4x:d8
TLSH
T19172F06F1F6A76EC946AF577334DC4A0642C8291CCBDE4440A1F068D1A11A39A7FFEC6
MD5 SHA1 SHA512 SSDEEP TLSH

GR4001.png

SHA256 fb64f0cea878dda22d68633c4aa5b99e79247ab01abaf66117fe556972061406
MD5 25dbc13ffcc29a4cf1362ce8e9cf7e6b
SHA1 9f86377f3c11ca1d9e8626c21aaa654aebbed814
SHA512 4afff949318aef75103c449126f1ff0d1837164f02fd292fbda15424b441a465057fb6d7923d1fac421cb624f135621c654a580ed3ba37c3b010f456d2422b03
SSDEEP 768:V+AR34iHJnMZISaScg5zOKJFjXZH1GKKoC3xRzyoy4:MS31HJnKxaS/jZMKs3bzyw
TLSH
T1B1E2D0AA683EF13912E50EB8AD0A60DB18D4724753F63E135C2F4DA41A57B2DCC2F532
MD5 SHA1 SHA512 SSDEEP TLSH

GR4001_G.ini

SHA256 535a323d1001e57acf25021e96fbe132d56d284456a13c1d70cf478a98b99bfd
MD5 9c5a69fa046c74499ec0746bb392c3eb
SHA1 7663b1891f84c4e659e220e366988a55a2a4d4f3
SHA512 a8f59c84a90502f2159351b2af0942b88688d226a1255a9ce9154126a089e8ae56cc20b31caa2609fc495ab9077b07eb26202398b975e28379b765b0d44e70ab
SSDEEP 384:3Txu61k/lzwiPOYGjtG0D9DHfG/fCsXzndcFTTfPRdMM:3j
TLSH
T1DA52901F5F9AB2DA94A6F57B2709C5E0702C0162C1BDD8440D1F0B4E6A01A39E7FFAD6
MD5 SHA1 SHA512 SSDEEP TLSH

GR4001_G.png

SHA256 32ab1d768c3d328483911898e9aa5923ec86c93802883ad5d06a325d0e928d81
MD5 21116c9897067ae2059ad65a0b9ec7e5
SHA1 f9bee25b1c4eaeb984a8d241e1fc4d0d80eec934
SHA512 b98ce203949b2993c1d127d0a56ce0570582a7735ca92e050074d896184e0998a4ef061f1acbf9588d9dab6acf72d160f9ac44e9c89728b36f288a983dcbf6f6
SSDEEP 384:C7GZK4bboCHQBRrzLyQa0IreXCUM7Go+Iz+ZuYM2S8+/tBQkbt0fNLThH8jwEvCV:tZ/xmRn4UCUMtYp8zQG61H8jXCqnO
TLSH
T163C2F145A8F5AE3A148A81C631AD159DBA0CD2995F73D64C0D2B3062FD0AB17FDD28C3
MD5 SHA1 SHA512 SSDEEP TLSH

GR4003.ini

SHA256 fdf6288f43676c6c0567ebc33a525fdebf9d3a28eab4f25d5d1e03aac446ac34
MD5 e5379f226be44d716a1450f6f2494f35
SHA1 aa45f6875c80a2cc9cfb02b1e39bdd2a2a170034
SHA512 c193c35ef94197bd9770341840517336c74a192abbbf57a2a1ef301d66c3089a4befbe6c821f97e41f34113bdb179f3aeda4d18de2dd109bae99ab5698d4fade
TLSH
T182719F1D6BB037BC584B367A330784D8369418764DEAB968606B12E97762DB033F94D1
MD5 SHA1 SHA512 TLSH

GR4003.png

SHA256 efdb3810c8c1e9f2e474e1674530a9b8c8268e4f2ebe0322ab859c7590bb4673
MD5 11d4613e57c34fca41622e90c686c63d
SHA1 b6b3ca15f373cfa15100e174723a0c4a2207450a
SHA512 c9f7d874e3e62580d08e31cd2f38026e53369c3dd5ef707dd0ab7e2fcf89faedf098c1efb7e25f39f1e744a395c1319a72557aae37bac79cef2f5506fa6b58f8
SSDEEP 768:6dk/AD2oy+LOOBWAbgXMyL7kLttBqRCrMiqzsy0Hqwa/E6q:6iImtfAbgXrS+RCrMjNDR/Zq
TLSH
T12AD2E010AA5454F7C74A8E7C154FEB87EFC368B57F136E0E101A70069D6E22B3B23295
MD5 SHA1 SHA512 SSDEEP TLSH

GR4005.ini

SHA256 492614b01711e564a63d6d4084e1d8d9447d93eaf0c07f7cd053a7d1614a181b
MD5 cb059e53e8de48164f88d185dd4df925
SHA1 21766635ea8e3a1a97497aa38b4f03bb9190016c
SHA512 f9959d9d764cb20584c21d04458fcdb6c6aa1733f20f47da76dab05a2610c8e407943894c90cc0b08068738395d836447f4200435684e1859fd4e2694772ec4b
TLSH
T1D1415B5E62B536BC498B763A324780E827E455720DFA7464602712E97772DB033F61D1
MD5 SHA1 SHA512 TLSH

GR4005.png

SHA256 1e26e506d71d2c80ef1cda68881c981aca6d564723008da98ed5548f6c353a82
MD5 2784af4c286102874784b9ba0b999fe6
SHA1 631b57e90db5442a50ef0adb80c871ea22b6a9b9
SHA512 4dc2d3564acf0d484ee5b1cc60d27faea3adfe2994a0c8c9e0777bc432dadfd95f883106e9565d22252ad220e3af01d822d49fe524fc268d43039a2f65acdffe
SSDEEP 768:6NY5L06wpe16Xhb0l/zEoJkLjwSt7vImYYaTmWCjaAFuun/c5:fL06z6XKbEEkH+TDCjxpnU5
TLSH
T1E1E2E16EC28E1A86F6715A779CC36B8B5CC40089FED597EB3CB710403A3904998D2EF4
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDA.ini

SHA256 247c0041753ba2428dd8c9eaaa65b4807cde6a31a18685be4d05c27a712c3f4d
MD5 7e6f847ac4672ec7a6d3dd511a33d879
SHA1 1ed90dd3fcfe0f74170686756fd054326fb19b01
SHA512 3acde080697ad3359956669745637a652ff50fef4e9b550925f15057ea8f82054be739137f141fd904d94cf2d0517bfc1523dfbbd681707aaeb0883c49c897ff
SSDEEP 192:UbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:mo9CW3tf0TmABuOY8YqBPBPy55tf5N
TLSH
T18752DF9F2FA57088C879B4273B4AC4B8196C11B192BDFAA4111F09C94CC4679A6FFDC7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDA.png

SHA256 7bf774463f63147a90ba64c96da491eb835451b1cac4f31f20a24916c3a25312
MD5 3a35f6f58aa8a264ed26df136334df35
SHA1 f4fb5ba6425c9cbffd0b0886411849b5b352e416
SHA512 460fc73fd6562ec5ea10cc4d5dc200740f1ffcf63e8ec3dbf75037e8714a1f1423891710914b7be8e31afb76a3b5b321de977257279aec7936f4d562f382972e
SSDEEP 1536:FwmUklB5OinPEHIjFycH+Zu5chrbWDBUv4+1HwiluaG:rTzmIjzWfeALqJ
TLSH
T173730254057C19A8CDE26778223913974D2C6E8CF3C901EBCBE57EE512929529E43BCA
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDA_G.ini

SHA256 b6b6b1f262e25e6ac63ba79d454d44e6436dff796e7c4d88032dc3af04520b03
MD5 dd260f56cced7b21efe61d60bb7e11b7
SHA1 7e814ac17d6a47b3335c3b98d2d9b0f1fcb43026
SHA512 b83041c34c20f6a4c148a7caedac1a77ae2b9c543d82f36526088185e2f0d52f601bf89cd2f8913ce379668a5e786ed2be02147f209a22bd903d2d856849d0b3
SSDEEP 192:ylbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:ylo9CW3tf0TmABuOY8YqBPBPy55tf5N
TLSH
T1D752DF9B2FA57088C879B4273B4AC4B8196C11B192BDFAA4110F19C94CC4679A6FFDC7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDGP_G.ini

SHA256 b3984941869d1d3ecc73d0637de252da9da7ff02ed75f8fddbcb1c262d846dae
MD5 485627acbf6e063a4ae991b7e0268007
SHA1 2b88cfd2d830a4ff15e1f43a7c9ab04400ba063e
SHA512 4624841e68f4741052b169d4344d6fdfdcf206bd11139146fc37a793b98e6abab197e7cd848581dfe57f6c3360f5784903d2f1c48a875b38ce3b2170ed6b990d
SSDEEP 96:29d6UV/cqfS0jZzPk2rItsdn95PJGXIeJ9Kfw540hzDdKqBqH/Ke6SVSEmSu7o89:OQmo35jecytLeIhUx5Z3BkaZqKFEiN
TLSH
T1ED32E2AE1F25B4D9C876B136271BC2EA1928053182BCED45100F0BDE9E88535A7EF9D7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDigGP.ini

SHA256 ba2b1d325b81a8448720da625cdab6b44940dfc6a943036e7a7a30f6ecb44521
MD5 8229ecd9da72ef23734ad9be63541001
SHA1 ab557ab407a9a0ebc0806dd03dee45d08dbac6ec
SHA512 eca55a3065ffe49d6a53c410f82206878dfcbdc3c88c90239d97ff28e3c6535269a9fb294f37e97a91a91e4c3efb84cb6c612a793d2f3bb9cb05f3a3266024a5
SSDEEP 96:f9d6UV/cqfS0jZzPk2rItsdn95PJRIrlA9Jkp590CuWSK9GqHC8hSV1bm1/7o8j/:3QmoqLEcWk2UKTGJWcJwXYz427MAG
TLSH
T15332BF9F1FA57088C87AB4773A4BC0B9196C117192FDB9A4141F0ACC8C80639A6FBDC7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDigGP.png

SHA256 902cd892ab95892de9068ccf071cf68ecd79ac6d68cde2949967317b21be23d2
MD5 7630e7bd10d814f4f98df439adb2d8f1
SHA1 7eb1cf5d729dd4d1db301e17007553921955ec2d
SHA512 8de39d2dd11e9e4876c05696a0a36db82284b8fca1436a604d81ce83a67cb0caafb2706a95e8c56aeaffe653f36c8a4dcd52f6e09b7218ed0f056f55ca2a8887
SSDEEP 1536:ooG+cu4RChbnuwD6HmtuOagUdhZW0f/xrMq/WbztGl6R6L76i1w3zeAk:eCx+GtuOuhZW0hrMMQy6R6L75TT
TLSH
T17D7302B9E1EAB5F0F69A50323F3B61A7F12B7241F18007D7C9194068D0ABBF05694BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Hammer.ini

SHA256 a723b21a3b6e738e6b7dc2911ed01a002c0ba6365fcd130c6490aad426de3323
MD5 4936fa2204b885cff8b6db2dcf27d4c7
SHA1 b8a3005a38d02239a58fe9735a6c66571e9cd3b5
SHA512 75ff5497f40706df8f671cdb7eef3232bc0d9436535d6e92febc54568a4e7666197e0c34ea009bf2192eb1a61625f1af7f2d918b267b73acb48b3e0cf476eedc
SSDEEP 384:7iVqi3uakko3nc8m9+EZlwTY2wPqYFyARCRAIRHMJBQA78Xygp:2XTG
TLSH
T11482777F0E20B7B8F57E353D234A05EB262900E34264B1C3482E36F4E94B5575E6B6B6
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002.ini

SHA256 10500180ef412fc24d2eb6a9542e1830d9b3f87ac74b7c690afbdbe451d64f09
MD5 a094d1e54a0fa3888f93fe2c061cfa38
SHA1 a1bde9e1058960d355f73598b0e1598dda6e9e90
SHA512 46a0ea5b18075ae9830dd163dae90a4b6d2b3d7009834c5093d3dd96b76ee338c1d12ea6a12a8c13e511e7a6882e66d793928588590955b0ea754a279ae8f432
SSDEEP 192:62imXAQ5YnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKS:625w2YnRK/CkQcwpcQDiq20s3m7N7SU9
TLSH
T16332457F6E86BABD11A53678370A84F7BA3451E60075F0801B0E07C29E1B745AE7F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002_1.png

SHA256 a58404be8d6c04e7b046a9fd54c5d23825fc94bd3b0e7f740fdf3020329ab76b
MD5 b54d3bf03c0ef33ed4316106a936bcc0
SHA1 9d47dd81c303aa545bbd7bd4124ccd726b3c9557
SHA512 8815bf0e4e81f4503ff386ac4460d04c5b56f453b654f57332c4a1b4ebcbe1f1a7c91b7eb932fc5da75755aabd02fd34a3f106d193568df93fae913675ca3448
SSDEEP 1536:mqs+k3/AAsaetVomywW0GWWlkOJlA5o9n5c9NNQfNir:mqsjAASXomywWQeB7QNNkW
TLSH
T1A143F1809553A7CC1A1215DC3BF26EFEC87EADE5222B9C644E35558CB1D073AC61AD83
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002_2.png

SHA256 a8d7a0fecd335a48c9c75f95d79c8a7505ad4cb001b7a7139666dba4a812c67e
MD5 f11e210716300d4b24ff52126951fb5d
SHA1 bc29870f3b9fd83f77336a3d89b4d126fc44913f
SHA512 e44043447e83118c1a3291d665315324f12c4ff1d10a16d658ca269209cdb0861109d4c556435247a1a27559244a2c6e3c66f79e8a5428aff3ae257b05536e0a
SSDEEP 768:7ze+YkGM1l83NOJqb+6MXQQqqdyr8OF1NynVZITOi2QAsUzNG1Dl96J9KH85lii:6oQQJqL7zqdyFHNynXW8NnzKHUlii
TLSH
T1F533D04BD8AB425BFE9627F837A16EF4B67FBA31437904884710149DA1C0BE4A107F87
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002_G.ini

SHA256 d78a310fae1037240c38acf4d940a573844341f24143a0c8e1454eb36c1e5c35
MD5 c68e524c8a32c6ac0c4ebf07223c94f9
SHA1 61942728ff7f13ba2e9efe0d4ca8f2670491b33d
SHA512 bf55f39f083a17e10f3748d5b31e4308b1ffba2aa4477f253b5e4f68892f22b71134160f2096e262e8870480c8343340290b7655e9080f0bc5aadde32892076c
SSDEEP 192:Jg5okEUnnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKY:JgGkEUnnRK/CkQcwpcQDiq20s3m7N7S8
TLSH
T19F32367F6E86FABD11A536743B0684F7B93451EB0071A0811B0E07C29E2B745AE3F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

LGC202.ini

SHA256 425f87aa6a1f6b7b56509b87a9fa376552f71e0f125e44e7d67ce9ebcace1b51
MD5 b13bde4d5adf2bdb72cf04de4550185c
SHA1 c779952b9be141a0f984dcd645ab7127954423b3
SHA512 85e8da1fc79777a5aa57566e5457f0493acb881818f95473e5149a727f550ea8fa3a811be91d7390522ef6fbd566dc363e0e06697a539cc068a9d7a7ebf56d52
SSDEEP 48:llOatTQidSDej4WdzOGkdo7NiMlGbm+X7p67K8rF8rC8r/8rgZ84b8pXmNIYplz4:lthQidMszaePBEriW+XgVHP6t
TLSH
T19DC1A3C92F3EA24CC9B835542D2BD3EF5F600A3143CD7EA821050CD5DED6579219B9AB
MD5 SHA1 SHA512 SSDEEP TLSH

LGC202.png

SHA256 a99f9822c37a3b7dcc56a7cc4f90ee251363f5b162f37eec7c3ed3495c66ebe6
MD5 176ea571764cb4240d47bc35b36531ea
SHA1 d31cdbe2586abbabe92fefff519fe3cef135c8ce
SHA512 47acca501b8ee8a89df91492d39ddd1c8bee8c5fc82e329cef4fe074b98e09397afe16fca7029637f5b4b1d1e18c8555161bdbd0e1893e229d2ee4de4d522b8a
SSDEEP 384:3ujJhFFaJK6MfguJKZqq614nE+tfFo95v6oxcB+LMEEqUNVWvpMSR/35hwpOYYLS:aUKt14nDtwv6oxcBeqVWvSuA+WvA4x
TLSH
T185E2AEA2E06F85A93A5606FE37A20FF585BF7C24A3F92DE41B10388E6584B557047E43
MD5 SHA1 SHA512 SSDEEP TLSH

LGC207.ini

SHA256 31b0e2d176383519c2cd153f48b4730dbfdac007b68a04c2c8e94aa645ff9a6b
MD5 2cf5c969394e8419d9b32f2ebafa334e
SHA1 3eaa2a97532ddb3d44045d0e64daabab2a67e387
SHA512 7d3086adff8fab1d7448a84c3b9377e2f8e5a6b30ec6ee3c15401431ab5e83622f6c0e8b3282decae6e674d87aa2c7c5a4c2e31d76c913e08b2314708d6cecf6
SSDEEP 384:ub4EnwfDP/G3xLsDQ09ZdQR2pV0SO/1AWvzDuJ49xAr8LE2g:j
TLSH
T1EE52049F0F3974C894A9F2BB2B0A8095746D1462D4BEE580051F06DC9494539AFFFFCA
MD5 SHA1 SHA512 SSDEEP TLSH

LGC207.png

SHA256 7cb705bbe4982c6325fceba0512aa7cba2350b2fb5aa2baa10ab4b081072a441
MD5 caca23d40e779fd9c69cda7eb15c1aa2
SHA1 60d86efd64ef9026e3b6ac7515d4fed330f26779
SHA512 627e0951e8ec9216042c7061d83833cc6efe147be2af263db135a52f8f6568049e39865520cc1743343562e41eef90170f123809fce54a9e8cf77952fc5679e4
SSDEEP 384:3cJgM6fFybFncjYKcdxT6m0BscKF+kcb0Kq20y72a1+j1k7aAIeaKNxUFH34k1oS:sK9aFcjVcP63iIBVyLnhXubRP68i+Fqz
TLSH
T109F2D0E7C16F4A22BB5646E2ABE71DE9A17F7C34A3DF14C14A9354ABF040AF13180853
MD5 SHA1 SHA512 SSDEEP TLSH

LGC209.ini

SHA256 eb03234b6b2565db9d2153b4e1540e46596385c3dd9b57113fdecb6bdb569f9f
MD5 fb613fb07444c72427e8a2503a76ebd1
SHA1 d1d4aedce4acc215266db06fd718df6437228fe5
SHA512 d9151a4b77617d4c37c64618c2453542101317ef69e8a8663cb5bc05325a4dbf17106c6360b14cc388d3974c2865434e9116b8745db28787129939a921c3c278
TLSH
T13A81995F4B34369C859BB67B3B46C0EA1BA900B688FEB404101F15DD8A11D38ABFEDC5
MD5 SHA1 SHA512 TLSH

LGC209.png

SHA256 7958624dd4aceed4988caa07a504e965cb90670f9af7863341c7b17a2ec2dace
MD5 dbcf48114205d5e11a34cacf4b82cd2f
SHA1 712f53fa73b7031b480098c4cf0f05844cf8dc8d
SHA512 5f55667df2a52811d27c7c0707928459297cc2793b458afa32749ff84bdf7a555e4ce51ccf25b13207059a41a17ec25236d227676ab1a6d92bc9570a84d685b4
SSDEEP 768:xiPSxHP2dYOa74lm7WK7t7EcrDtPijuBCk0A27n:MAveLm7R7EAFCtA2j
TLSH
T1A103E094C46F82B51E2956F837001EF1D75F6E38A3BA0ED48B4474FAE1C1BDA7611A83
MD5 SHA1 SHA512 SSDEEP TLSH

LGC20A.ini

SHA256 079e82ea2421a686a1cfe35b556132b09deac5c33ee0e9ca7d4a20b680cbc96f
MD5 b4c63a57204d65ecc16587913c9b9282
SHA1 6139e8740c59390db606b5539c120956ddd50c79
SHA512 819821c5e8037cc5c41d415fbbbd2baf802480b04efc2e61199e71cbafe90066c63ec628d4a0f351b12bcaa24b0b760ea2de9e55da10f62c25b5dae985a2cefc
SSDEEP 96:M7oM6W5KZz5HydUojBtYCw4TuO8Px7gtcXAWHwrw82eels2xzb5KKdU0ot2EhtYp:M7mWtPtmAWp8tBXTRvRc
TLSH
T14CD1EB5F893033BCF1AB727E720B42DE235518BB88A970A2216734F95717C6936F50E9
MD5 SHA1 SHA512 SSDEEP TLSH

LGC20A.png

SHA256 316ce20315e1f97aa9c0648870f42225d9ffff5657688eabb755f7e6c388af7d
MD5 88e1024eb1d23a2324f1ed6b003c84cf
SHA1 212cadc2c71cef2889d4e8d33ed51e36962b688d
SHA512 73d85293b2af38bcc12b74f9f32a47ff631788de815db49329c58296e2618f344af43c01afd9aef29d7d276655d25a0029a2a396ce4cebd71a4b12a120aeb2a8
SSDEEP 768:E3tK1NjUpA4qM8NYgxiLyXKV8OR06jCkVJqkBP9S0:E9K1NjP4hyYgILyu1R06BVkGD
TLSH
T13203CF51C057EBA4992209FBBBF51FF5D27F786402BA5CD4135439EEA0403B5A026FA3
MD5 SHA1 SHA512 SSDEEP TLSH

LGC291.ini

SHA256 de95342dc49749cdcdde4b76984eba91668f67b3247cac2d05a1cb7ed692e74d
MD5 21e468f47c022da870dcd1b34464f652
SHA1 5f48c1833c904abe4dd566e9407f9e6f3c1eeb97
SHA512 85480acfaf25ede5145bf662d756df4cd6c79fb5b959b7ba1d6e9db442a888e5fbf2d70ece33fc0e0634efa57d89bb1b032e66a0815bd82a3dc668fcb2868bdc
TLSH
T1B841C94B4D3037BCE17F757E351705EE170610AB99A4B082196232F4924BC5A3EA61FA
MD5 SHA1 SHA512 TLSH

LGC291.png

SHA256 65b7a8fbb6f760af81fe65c694ab8bbf9a2604522856f4c098185ca396cec82c
MD5 a148633f9cf01a0c225ebae0964573ac
SHA1 216d1c2a0a14994489352c048f6297e6120e6417
SHA512 621d358c0b90f763a89e654037d30b3dd0855a0b1b04f830e9f2335e7bffbdadaa85c34ae17c71ef1e5a3f69febc011e1771a932a037b099f0f232b0b6d934d0
SSDEEP 384:34YLheOBKglgqyDl5re83QfcXz6nsYq2tJ66/hywG2f03M7F/qPhZrRuhS1/Y/C2:BNBKgCNiwCqYsYZHJVf2M7EJ7uhSq/d9
TLSH
T1E8D28C55D29F80DABBA505FE3BD15FF8926BBC2117BA2CD4A750249E6081BE4A143E03
MD5 SHA1 SHA512 SSDEEP TLSH

MS1B.ini

SHA256 8d9272635ed38767d18a7f7935f5a5d1db654a526a32903941523d305570e760
MD5 dd8d4a00c271c12f229b5aac8a79a2f6
SHA1 003ba733b109912fc3bd4f16cd1fb53902dda1d7
SHA512 2dfc8aa83295ce2f441a1283ab4e07ba7628537d03f74b961d524b62e564a05a59ed2b0c2b23f5d26f6fe58fdbffa797489855b6722ca453b121b9073331ca4d
SSDEEP 384:nosc8MidbNYG6HX6iSbuZc6BKsaMaHqqi1KgCeurNS2jSeL:oO
TLSH
T10B52E21F1E7670C990A6EABF7B49C4A2306D45A6E07EE5D0091F278C5520638A7FFEC1
MD5 SHA1 SHA512 SSDEEP TLSH

MS1B.png

SHA256 9cf4196499e5d248ab78baec2cf5cbd9aff7db2f84c0deac2074ee7a6dc0a7d6
MD5 5daf37520490b5ba9545b222ddbe5d9a
SHA1 c8e3c43a46eba15fb081b3a4bd254eba4c3b325a
SHA512 9acf69ef6cad1dde9f62fb5aba96db8f5f10a5862add433a05b5d4ff0ec16a038000cf3e57af25ddc7cd325a875ea7abebc8d087401dba7f22dce320ca65d68d
SSDEEP 1536:EZjmWv2bqpC9bGOdQEdCfUVqcSq6+lqnOytfqIwmU:EZbp6E+qHAlqOykmU
TLSH
T1523302BE4C090BEB6061BFEE727E546531CA42EDCD686DC0085EE04A59AE53BCC493D2
MD5 SHA1 SHA512 SSDEEP TLSH

MS1B_01.png

SHA256 a6186acb6712d5d5775d0627048c7eda59000eaf7795f2279bd5761f3ffae56a
MD5 cd7fe02631a1218c481c59c76f7fd8db
SHA1 2906acb04c557bfdefba3ae9ed2bc55daac972de
SHA512 795d7e2debebad2e2a6d596e193232ee7a494dd3d467c852c02b4e18e4bee843287d21ea7fd9c1c947886286df15277dd848025ef6a0aafcff4669e56bdb0d2c
TLSH
T1A0414C52A441CAB956DFB77923E10F05AC24E5B17C312024E8450C13F5E528715FF3CE
MD5 SHA1 SHA512 TLSH

MS1B_02.png

SHA256 d2f37ea24d23bbaff0b0ef66be9b29af37cf5c05d402b8c594185e3af4715ef6
MD5 303d50981c0e70766042bfbe9058c4c5
SHA1 ad5d55b6eb4d6d0e58cc1d8cd1784d6a66601f2f
SHA512 5b2808e82ce2eef66bf24490017860ff642df77f04247ae152dce97d6c511c0f114c8f7aa4da414743ea90b61ae47b62f34692801f5d2ad0873877ba91f296db
TLSH
T19B01E9F91620AD65C1076D80923BB332FC3EC54C8847030028950023DB12E8D8E90F37
MD5 SHA1 SHA512 TLSH

MS1B_03.png

SHA256 b93c8829a96c1f69a7751b2d089780cbf11d79ab27e5d2507c36ee2ad740ef08
MD5 d3e103a4ffab645547915858b0fe6c9d
SHA1 fd7374c5f90a0339b4a9eb185558ee1932cbb8e7
SHA512 a905e23ce116e886b8d1b8a1a42821f4d88d35971465a2053defc085b639824de6df273618a163565b8086b714bb4c1be91c1989e195fac2d82fbfcb89debdc3
TLSH
T168F096E767FDE51AF9B37F02054616B618581B81CE4D05412106C03DFE0B7C939E0198
MD5 SHA1 SHA512 TLSH

MS1B_04.png

SHA256 1f99db0a7f66f913774e61a334281b60333e0a231267abf3c61f54ce9834a8f7
MD5 020d6f6e6f9bbb45caa1fba1ef5f6179
SHA1 ca689caee8a2ea7b622ff39639e19118d42d9206
SHA512 9cc0bb6196391a8efec322f4c704bfc7a11c5b9b2df5416150b145e7878c66c428ebd4ee26cfa534d84dab7a16cb3c159e32e82d29b25ae058d149508f4001fd
TLSH
T18F01C5A39BD1CDC885AB0952682A292ECD245323C63A0EA4F2C20D5EB614109E9540B8
MD5 SHA1 SHA512 TLSH

MS1B_05.png

SHA256 43c182a3765a09368e09e6da8aaba45ff47798843605a32672eb1b7748eef5ec
MD5 f0359cf4f01f9b61f9b6eed337b48f6b
SHA1 6779e984e3627ac77a4ac1b24248826f88b76f20
SHA512 acf50f5d73c657473604230651388686057398d0ff47ab358f02cc08ada28e2ffa1cff1fc1912bf982005b70510716aa3602e3e04cd3dbfd6771f7df5414bcbd
TLSH
T17DE060A436BF0C27E7DB068210910BB8C0325D3465D61B042CF19CAE4CD74C4B516282
MD5 SHA1 SHA512 TLSH

MS1B_06.png

SHA256 b18af49a8c6949786ef39e40257f2d8c7b07339115155e591fbbda0321b4522b
MD5 90454d1e72dc7112c0665cf28d5c0f8e
SHA1 cc9b2cb91d7b2f9c627cfc47393b50adc3a9c5cb
SHA512 ff5ca00c767a11cf00912b1694632412011e4aa354f3e2fd6a202a175cda9c32bfc0b0150f73ca5d2529ce48dfab91440b9c93f2d1406d1dc3f64bd6191e1644
TLSH
T193E0F1D9251085B4C712B116115320AAAA33466E69677E9D236008568D7E6C89D8C1BF
MD5 SHA1 SHA512 TLSH

MS1B_07.png

SHA256 83d3a62a93cb1eb87c4a17b38c72cd01a809d9712394a443d17e5a99a78dbabe
MD5 f560a2d3775cc8e8975eaa4c64ada238
SHA1 cb0166c2fb38e413fd43f15a0a9cf064ae672a13
SHA512 8877fcb2ada1193862efae3d9399df9b91ceb32f02e80fccd24545d65c5e20a7d80a902ae220ae10cf57a4d8b5d24901e63b37566dc53e08726d9e225dbdcfac
TLSH
T168F041D31BF9756DC166485722C60CABB0131E3364924B6EBE08862CFB402DF81F03C2
MD5 SHA1 SHA512 TLSH

MS1B_08.png

SHA256 4837bb63409c66764a8bc0948018f5d0444edcfeec15ffd02dff4f6acf63c3b9
MD5 2b8b9e116228d8b35c126c0957fcb9b7
SHA1 13b68fe346a4cb3054cbaa233c3a4b69f9f8ee7f
SHA512 0d08fae681e17dcca46c0e3b4f0bbd121eb826b01f969841c8e80a19346f4b95ffb39e019180f693583afcb6f162827b092605bc045a7a1fdf3a6f97a1e390bc
TLSH
T144F041EBD7C023C927892221D28648B08C7C8F45C94E321C1CA2EE354C93AD4C39242A
MD5 SHA1 SHA512 TLSH

MS1B_09.png

SHA256 3ed70ae9480385da00e1ad6deec38951be66fde063431170f6294cba52dc1d98
MD5 ca9ca0b2774db7c44427a11ac2aaac01
SHA1 e4173e6f546fdc4e44b7fcc71a793bc21ac66607
SHA512 f4a2174c9d78570cd9bd43e5bc39748002732b515ff2320251ca4b031ceaf0fc794d347a36495268f9605a50ce85184380e6ec0512b5f51306037f7caa192395
TLSH
T1D7F02DFB63463B39D9A838AB7A28039B5A940445FF660A3CB33350498DC30A280067CD
MD5 SHA1 SHA512 TLSH

MS1B_10.png

SHA256 1868bfd5b49322eac0386b78f964ad3d649bdef6b479da46f0a91be5e840664a
MD5 379826d9e4f7dc62b185e48c3e56c398
SHA1 0b533c5a195860a5d89e75b3eabb9db9b61642c5
SHA512 1b11fce8b23a9a1137eb7bdbd9d8e9dbdebbccb3e4e2be7e755c9c5b53abbb3e57c882d4c3a912dbcb4dd689e746d6bcb6d1838b9332dc96aa0742ddc52536c5
TLSH
T1E5F0628342E1B89EE1BC3873000A1F7B9E7089EE8A646316E322C4A594C9E81D8C4A1D
MD5 SHA1 SHA512 TLSH

MS26.ini

SHA256 7a9feab7e0d241ca420934e6153b5db4d2db8b72b113fa5d010a6a417f06cf51
MD5 a0b84b5ddb4e4dc1973bb666a8aca7a7
SHA1 163df8af80d7c97a5659b83918b755566550be6d
SHA512 004bc5a6a2287dab279531ae7d62de08c0579ffc0b10d86b75a90389fa2da819b283bb538a26fd1b539e4fb2cdc7179f9c38f3ef011bac224242b3edf02a1af8
SSDEEP 96:/vhLw4RMr8MrzjLv+DlgzbzxNXhpCI4kJ8P0gew4fam:R45HRam
TLSH
T1150237C91F3AA14CD87234103D1BD2EE0F50257127DE3F9820201DE65CE46BA26ABDDB
MD5 SHA1 SHA512 SSDEEP TLSH

MS26.png

SHA256 752340a75972dbf504e3a9b7062dbb7670ac16ff32a837f7f1e82c630e39ec58
MD5 67ab9342fc9eb9da30606a61fcd32508
SHA1 f226347193ca2d72b3efcf870a3e67041fd25cc8
SHA512 bc40c14068af8294c6c8113f59e618636e9982c67ca7f348e27c813c800e0701e5e0862e6c58d5a89dea138c046625f0773b23e1927942b9add6caad22a9fb68
SSDEEP 1536:Iwfk/BApw7wp4U9H/ux3DO7ZESUIJelI0BT:IRmAwpHRmBDO9ESD+I0R
TLSH
T11853F186F30B8C59A598504E8AC09E6C352769FA442F2D2667C2BCD47FA5338FC156FC
MD5 SHA1 SHA512 SSDEEP TLSH

MS26_01.png

SHA256 ffceca61a0538931b531a1edbbcbe811a31c20a16f55fa84d7ded97c2fa4d81a
MD5 c5037809fb65e778fbf01db617b5897f
SHA1 31d9045253b945ce0abae30e6be5ec373774adbd
SHA512 3052f0f6f45b3ccd017bdde918d21dc5ec12ba347e4591cb7c3a19821f0d5a623c4a553bd3a12375ea0646a38029e47513041510c9adbd8406c89c5e7494f4fa
TLSH
T102517DFE1706056DD5D0EC5B5D60E08646787C3A841449351FB4BA136EBDD4FF29E481
MD5 SHA1 SHA512 TLSH

MS26_02.png

SHA256 73befde90d57a6b36b461932d83b76fd84946f823b031d4e65ac53620709737d
MD5 74d918030cb20094bddd02e674e99504
SHA1 7adc2be2e57c9138accac18f7967323629c94d8a
SHA512 4d4ba11a912efc5d4e1805a64dad751dd27248ab71706f4e75724e572aeb3b577091503fd8fcc807a195995ffc972a6971ae7e805aac697bbd00e54ea123d968
TLSH
T18831FC55AE8568B0833E0757173A1310FF675F2084609127262A35B2143DD58E2EF7ED
MD5 SHA1 SHA512 TLSH

MS26_03.png

SHA256 e1aafc9355bda37cfa4edaa3c1f03579103e4aa1869f07a1233613cc19c6a4dd
MD5 495d8ba62ea9c15ee2fc4a188102375f
SHA1 ce04324de77a02747e088a63d60d59ea2bceddb6
SHA512 135c21f701cb83a3d40047152dc470fc097c97e73d2527144a3da0b76507f95fb3af496372f5bd21342da02400d4eb41527a699bc48dd07672632b03fcbbc680
TLSH
T1B821DA56B4DCAA0EDDD7943E7B091D14F438DC0C13D186851206BC9EF27CD4625E465D
MD5 SHA1 SHA512 TLSH

MS26_04.png

SHA256 39cd128ea4f0587985349369ac7eed7aa87b857701f7c1c9c7dc8b360b245900
MD5 5edcbf8467793faa3ef7614b5c405447
SHA1 92fbdd9e40aea92b59589085f6af0c955c04f812
SHA512 83ecc14ca168a07df958d2fc4cf709379d292fd7e48e37b865fbd88a51f16fc74c07e783e7407307985475203f8dfac0175a31e2c510eddf4bbce2b4ec435bcf
TLSH
T13421B9B701883A559117A5D2B8B45A55DDB04D65A9F090B9F3DC7B91603FD30031B44F
MD5 SHA1 SHA512 TLSH

MS26_05.png

SHA256 5d0c5a14a4621b6120e632166eb55b8d73a81c3dec9afcc8a43a339a8b512e6f
MD5 1102215157388c178f034d4f1566eba9
SHA1 651c53f3a9ea9f07b37fff22ee54ecc367d5b9db
SHA512 2a7b97446cf6c70c69895474733487dfafc450b78091e37c729258779a5c6c31dd07f69887fe72d38508fd24e1de361c2d4ddc5e1a6086a0434e8ae6cbe2d899
TLSH
T11C21C6E47100FA6ECCA21D9075B2CB0C1431AD781CCA842A6F4938746CBAC39D09A5D6
MD5 SHA1 SHA512 TLSH

MS26_06.png

SHA256 d9eddbc7181a65f5d10f8e90f8b1734e2092964fb86b8dc4fb54e6007b9d6013
MD5 a7547e8b2f1b102c181beb8d0e2cf6af
SHA1 dbd3c15cfb64986a510021ee4d5c81cc3160dad4
SHA512 608ac200552444c36d5ef6379c277df6c070243b9dff7cbd6a64fd8f69aa038915c3cdac3ea4a4fb2aada6cc3f0ee188e849f8580aa55e98c654d3f8d0b08314
TLSH
T1C111E957A071895C0F08BC3849474C14B78FBE2D528AC0AABD9736B3387FE790424147
MD5 SHA1 SHA512 TLSH

MS26_07.png

SHA256 4613539063142a41048d99f58f3d7f097923fdcc6c96474938079250291cd767
MD5 b9ab37e35b23258018fe5b063eed4246
SHA1 2158912e4a816d45c7f685488ea2689aca0827c3
SHA512 a6d0030be7660c3e746554677448b7cfdb759c498d7734c6c68eb9f0de506a03d8ec587eb60b99fa86d45127b5c376afaac8aafbb6ac34a638868f63c3e0ba32
TLSH
T1E2115412BBE0982FF51C03A919FF10A59CC45F292521B5439C25F57347BC28B107D207
MD5 SHA1 SHA512 TLSH

MS26_08.png

SHA256 14e9925a703833e27e70fe85046715f811821d212bfd553dcaa1883c5011f113
MD5 fcf719597f25d7ef318f8e25152911aa
SHA1 b86cc0380a8b4add245d5d14f9a42376eff90ac7
SHA512 e27083f5c4b4a8d953bde3bd18e9bf4ef85e10354d4cb4674060990e14887929d27805ab0970a1c12635f5c2036db16d387640628f2bbf36770cb262c82ad612
TLSH
T1AF11E63CB006A97CF5A1786CFA894C023F481C2990D3204492A5FC249CFC1A48CB23AF
MD5 SHA1 SHA512 TLSH

MS27.ini

SHA256 8209765e68f761674e82f7e87ec2e08c7ca1ea229a1ee24168e00368c4e188dd
MD5 61bda012004b5d587133afd04f82cc85
SHA1 b48eaa593af3f605580fd8be42bd0089447b91d9
SHA512 4bf1a510fa661455516ec500e6d9155e093db86f5b266e81b7c800646fcdb647930e70f631e1d056a297f420723c53cf83d9f5d6b24b073b5ca878575abebc0f
SSDEEP 96:q1y6MGb/woTWV4jbMlf/ztEvifnL17MLyL17XL0L17hLTL17KLZ2L17NLkL17oLB:x78oCIBfN/qD684D5nM
TLSH
T166919D5F0B7930D9B5D7B12B334680A62A380877C8BDA49009AF06CD9D1163DA7FBDD9
MD5 SHA1 SHA512 SSDEEP TLSH

MS27.png

SHA256 558e50f1a9102bea5f7dcbbf585d4392e244ca9af0f0de3441ef61fb86066a57
MD5 73b92d93ee5e6fc01a3308aa2aef6148
SHA1 0ae0bfd93d30af1078fab02739984d2515ef46cb
SHA512 112a26fdbb7a0d2154cfd64872ff4074396fab98b59fb9ac63ba9dcea1f57ebc71d3acc513a8e6742590884bca21a55fd472e3f1a8f9d45dbf96ba10c9190044
SSDEEP 1536:/zzrDMD3VnTyCZRNNNtxIp7InZOCQuhMX08Ks1lxmjU2/GgVnA1G:/vrDMDRTycxiInUVuOX08Kem42/5VnYG
TLSH
T12253D054E631AE3E0EE44DAC3F92C8AD2984155ADB6B0F1477A18F40FEDD34B38146D9
MD5 SHA1 SHA512 SSDEEP TLSH

MS27_1.png

SHA256 028fd4ff11924c2fec0fc58eddb0e9f28a597cf704a1a09f893cf2abe273b762
MD5 648c89f1454e9f4803e184b4c889f478
SHA1 f2c0575009cb4b45a5f8ac5a00774808be818176
SHA512 f063c0dac7cf55d5a5f113fed651d15b7e217698208b13ec4ed7af2ae7bf7e0b5b6169d683f7a2e6884a5b5873c55c70e61bfd1ac360c85dfc0d6bc76553eb56
TLSH
T133615E40F9DBF02F877947EAA5A503C064E00D255451F8D74E4EB3511335B70E7E5D0A
MD5 SHA1 SHA512 TLSH

MS27_2.png

SHA256 ce44eec7fd195d839891e152f418dce15e896e9c62fe706bc605a99f060e184e
MD5 7d5870bad2ca0df89021cfc52df6b795
SHA1 5de6f2840a47ef7f3433a7d31062b8403c46c0f7
SHA512 60c3a582de8fc2ba3876f53151b71888bece64a60738c774928c45fbec34db2c73040ed3cb84bedc234833c5d883ff00ae9bb5bedf829701395d828d9ecef52f
TLSH
T14921D6DC1092E59DCE1AD2B8E6423F59A8224D0E462B8E2D6A18B6359EBD847C510386
MD5 SHA1 SHA512 TLSH

MS27_3.png

SHA256 51c4120a443c9b569faadf6a216276a6f7d95390e346bcbecb00ff041cd59b1f
MD5 4edf3fd9dcb36a54b84c194cf544c41d
SHA1 bcf58724140560262fa59258c75134f1ede86737
SHA512 10999c32b9fd1fc729445155b159f434261dd5beae2e22240c7c3b491df9aa8e4a88c5d317e59c56f25cfba4a7641a3a287f6cf31e20a0ef64d66198b3d092da
TLSH
T1EC21D588624470588A9F11F6B7CC73AC2CAC3E7689E48494F67D7E35807D6CD0086D48
MD5 SHA1 SHA512 TLSH

MS27_4.png

SHA256 a499bfbb17593289a266d20e68c059be139add1bcd589bc49d620ae4b4065f2a
MD5 eff1fee2e78d9d842f4432a47e97ba04
SHA1 79685398ecf02fea1cfa90768be640ddce2f694e
SHA512 f2cbb2cb1bc5da40f8028f3daa856078bb1eb0c5d48c50d45ee1d8d697f17890c89c8cfa2e22587634d006e67393b923c8ee3fa6328369c1a16eb7f1adb8c7ce
TLSH
T1EA21C6B3A255D14B15AC5C90FB892974925F8F15A035E52CC8CEF81C493F78048EB302
MD5 SHA1 SHA512 TLSH

MS27_5.png

SHA256 cc16974940e8dfdb41eeb863ae0e762ff38f890cd29c760aa8e67b882d5bbc27
MD5 9422ab118d09909207e3cad08cdd331c
SHA1 fda6c7ed94323c9215ffc052a00d7c3616fa8cb8
SHA512 c81200d3c7aa74d107d05ef6753ce082374a8e0097d4e51c70bd876ee07d94ea79a4738c2e9db825b13a078cb5899734ab3ca78f3dbf903b44c224b6773b83d6
TLSH
T1F621B6EBA3F1E40EB5A32608E7220D4D8DF42D3809593A09150975A7AD3594A4E1C30B
MD5 SHA1 SHA512 TLSH

MS28.ini

SHA256 26aeeec2b294da0f38f4e17bf1b83f171b43c4b7d9e6c573908c6d3e6be87e77
MD5 9626aaee7055048b8f2ab4d9dae14535
SHA1 c79ed983d7f0fb5c67c8c07b6a4b4cfa3183c45b
SHA512 6943d5a9ea10350a21ad890ea5b29f1c7f89ffd5798ae1be1ee5505f734e0da566a53e97f5ceaa45152ee7fe548dc271b86f39798deafb729e9160c0519f4484
TLSH
T1F361885F1739369C810B717A338780FA2B6805BA8CFDB848644F01DE2661D7477FA9C5
MD5 SHA1 SHA512 TLSH

MS28.png

SHA256 40bb262137fc58cae19519502e8e0f54ee0c1ea7105e725c4e2af1da4cb567b9
MD5 76d6e896af57fb68ad0248e68389bb84
SHA1 9683078d4ee9ee20232e29c94055870b877dc9a4
SHA512 2c382ec0159efe0196f12c43f0c4c2d08110cbb96c440d8e62cd56ac820e4181cade396e1bb34663b6719ff689aa1389c61a46622e657f49cec039ebebe83e03
SSDEEP 1536:FyB7Pakag0otsq0PDU0/3LOTFUx5vXZLPzW3RmUN6gjXf3VZQ:Fy4B1ryGbXRPzW3MUNbjXtZQ
TLSH
T1A963F1E4D321BE3A56C24F4D3EA3C8FD5D8615458F071910FB66AF10AEED21B3A140E5
MD5 SHA1 SHA512 SSDEEP TLSH

MS28_1.png

SHA256 f2532ff40b92ee29cc40c493c01213754ad832d4b4946a57119125e87fad0c87
MD5 941e9b92ba33340d850d98026f81e94e
SHA1 49c14658b73f025243971e9f228de2772bf50ad1
SHA512 8e7fe385d81183ec61b48127b4f22c7329dbc68433179919e198937e794e19cfb3353067b4e7697176d4c574ce1a385a380dda8564991d4da5f74aa714021e33
TLSH
T12A0175D2D49A2A21C756CCF1156580390D791E9F5683EB07B4687C5CD43CB8057E4190
MD5 SHA1 SHA512 TLSH

MS28_2.png

SHA256 da00768a714154c1b8272846005736e0d2f5744e2c9ae85c3d046b42ea27d874
MD5 d25057ec93265361cb4422704cf5a777
SHA1 01f9df14d15d55b151844c158553473888aefab1
SHA512 313c4eb373ab096eaeef98be165c29329ec7585ffd24c1d77ef07920f520de36e9eae14af065870a5d914e92909fde637e35c14667ac372903b267a2c6bdc3e2
TLSH
T1DF118873F114265BCA8D17558D1D15316EE58E0D25C0AFB82744B528CD391DD9426397
MD5 SHA1 SHA512 TLSH

MS28_3.png

SHA256 fd0404d5d5a1042d7930ce62a2f48e5c6f73e7811ad892b3096fca4429244fa1
MD5 0be6e65e38eedca6293c05617320ec6c
SHA1 a64bea3a89a0a7496891b9e66d307c4860714e4e
SHA512 71606a3bb56c6402eccdc4171b6d592591f2c2e1c2e152c15148bd9ddf0666cb9eb7ad17bd25c5bc2444bc7b43170761b5dbeb5ca461e7f9f593bffb5207595e
TLSH
T1491163C522E5B2B5CAC502E12383CE11DE074E0C2B718649C289FC1714382D2806B399
MD5 SHA1 SHA512 TLSH

MS28_4.png

SHA256 bc8b7faf235f3e1d2c2c2b2057ee55668ed357224be64bd20755a69adb4817fd
MD5 3114c453826aacc22f324aa0564e8ed0
SHA1 7a4e7e15f5c7a0850724128a6dd881e1c9a51413
SHA512 28f0e462ad055bf2d653c745a8fb9d1d0fb46cad3567114c0a5fd29915bd855d1c79a87fb366f39c6894b4becb97a2582a60d9ba3d9edcb53723b0817c13638b
TLSH
T18F1194842DC2EF56D50A49B86B16E5E1AD000C090D60EFCB9808B9769937153A64BADE
MD5 SHA1 SHA512 TLSH

MS28_5.png

SHA256 335d3ee9025661f7789640a834f1dead473fd364b1938be43383ba4b84af5f4d
MD5 996b6bc98f9ccd77db4f437f68c4a22e
SHA1 4e110358df6ea382076326f1980fda140a9a9aa2
SHA512 0d983138cd4773beb16e62097e094d0a28957c4035f4511fca6077136016c897824eee573c414212f003754ba056a4e3889ea2194d543310624a669ecd110aac
TLSH
T12011B59CD5BA8D5A493A52C6CF83B32478E16C0468F3A010AD54F52B603D60AFCF0AE1
MD5 SHA1 SHA512 TLSH

MS28_6.png

SHA256 07a5399e8f11e0678b88e34f41632e4e347d1904ef23e485aa9c4a9f80122ea4
MD5 c9c2783f5516396276745d0cbb417691
SHA1 a94fef86bdf4a33d7970034297540cb5adb07e9a
SHA512 dfcaa18bb6c5216342d80ef76a43ae21935136e05dba3881d75ee87dd5fbc55f745a47be5a05edda9059fc73315af8c0a7f2655df4abb77f27db9663946a2e10
TLSH
T1A1219353C314B821D85A9F5422877A2D45225E447C80A3DFA51C3D768BB66432B82B0A
MD5 SHA1 SHA512 TLSH

MS28_7.png

SHA256 33e96aba75cc0284d4dadc9b407810a717fe2dca54daa6bae1dfa9cf6ec6916f
MD5 4a53d451b5a858c20985282c15ed913f
SHA1 7a4ab80e20f525ee40b8c4dac7b6446ca3d3d10c
SHA512 bbecbecbd3ebbb39194725a417a6b87856ddd12b5c436d3f4553e4f163ca15356bd40e4048aa9b816cea39192574bac82c854e760d2ff8ec3697fd777127e14d
TLSH
T18D2184D2154083BD9D9D81F85E17C89938691E5E2C2FC316160CF599793AA09C12A796
MD5 SHA1 SHA512 TLSH

MS28_8.png

SHA256 2aaca7b9d072b7e724fa7806e351fc2fa2b8c3733d5b0e8c0584b4ec2753e5bd
MD5 65162b069a1f212d12e61076a8e3aded
SHA1 97e75501862f9452450482fea0bae4e0bbe24084
SHA512 ccf51630d8df4a3a0b7524fdf74e7b0b052864576b7c9245b735595e5f64b65ed73c8c5821a81d39c110236059400a3972c16a1ce765a389d353f704e32794a0
SSDEEP 96:8uszmoFgnCzkTnbv2qcsiZ+xRlMHeIax8IU7/BZ:8uboF2bv29siZ+jmWC
TLSH
T1BA918D639272F088A4DFB0914881499DB97107F8D478F4317807B9B2313CD4EB86790D
MD5 SHA1 SHA512 SSDEEP TLSH

MS34.ini

SHA256 9730d685ba1ed46d561209dad8c7c0dd2abd167b1d9e21d3d7b938377c81cca7
MD5 fdb35edd8e21e7ef2993e6bc22546d17
SHA1 919a8118bd25eb409ea904fd3b2025cad4f889dd
SHA512 5da6c75eaf1b81fb58059127089394829074b8bc61853dde836b20f04871694d8a5f2b4522be4486c523e9cb772b77ab1fab4062ec3654b5c97562d7b60f6e17
SSDEEP 96:8HSYv01jtz/R1DosXZWB/NqyDIsNJy7qpOv1xCtOT3BvqBIPqIvyhWIkT2Gsg127:4pJyGIv1xCQ3l7KhXLyi38RM7
TLSH
T1C3D1AE9E573A3ADCD417B26A324B80AB176A14778CFDB480182F01DE2A2197477FBDC5
MD5 SHA1 SHA512 SSDEEP TLSH

MS34.png

SHA256 37e91e01caf3864054f13f07cc779029687063b48f3834cf44f2918436df9fe0
MD5 d1b92cb9434cff56dde64ea44ae691bd
SHA1 3fddf253d875476c5926c6291c086f309768bda0
SHA512 6ad7aaac5f35b4374c807968aacf47655e13c356b5ca9dc94733e93637cf10c92c71286f5b4ae09ef0d6c3f96c5a50145a0eef4380c53396d74b1945c2b11722
SSDEEP 1536:Qxe9bGDcXb/Vy9CgBWk38EGOdupyNUhtpQA1Uz:7icXb9pPkx7xEUAGz
TLSH
T18843025BC351E79C7A1796F3D697848881FA1C1207AF0CDC02801EC7EA45EE6621DBCB
MD5 SHA1 SHA512 SSDEEP TLSH

MS34_01.png

SHA256 3afea7013ed838c9db2716d24fef8ab48224f496cc994b16f87d8b991f3d8cee
MD5 adef04e0fd11169c76ccc99419c61ae9
SHA1 3362a1c971858faa88bada4ea400ecb9bfb3ffe8
SHA512 35da7cec0cf08d0c034c1ec57b842c9795a8ad304a9e857654b36e6a90775af0d429f0443d1bdd9e13ad442982daf19f73bb361cfdc89930c9d27769969a181a
SSDEEP 96:flmQ0a1cdMxtMwFx8C1znHXQXpZ68dweQ+L/fNMXrvsw97c7vDxVM:fsVfCxF1HX8pZ68cC/fi7swAvNi
TLSH
T150A17CBE40EB00C3BE9ADDE89780899BAA71FF7F0B4A021D1144441915F58C992A0BCA
MD5 SHA1 SHA512 SSDEEP TLSH

MS34_02.png

SHA256 8af9390be5a6b935b59b3158b4b6bfb060e8b5ab03170b01d192a8c291af9bd5
MD5 871773f364edaf43b54d317b4d4ff05e
SHA1 88a16841cca60cad564bb7a4c254be5c07e11a90
SHA512 8efc283751a66e47b643a2a674c3df48d92d65a84ab6080f999ebd09c1cc363c841af2e2ec1baf21e7a6d3e4337873b9102698acd189a472aa560dc2164e678c
TLSH
T15A613AAF2A21547D6F800E78C94405E5BE8D4788AFFA5C0DAA344847BEAD8C012DD2BD
MD5 SHA1 SHA512 TLSH

MS34_03.png

SHA256 33204f34e250e08d3990e8a15b954fed0657b7701c3e9d96bc6d6dde4702bf85
MD5 6ca136338b1a53550d67efaf63ba6ee2
SHA1 15f91a5cdce3665dbbe5fdccc925efd9a5831498
SHA512 40c32bb9f8c31589829d164025dbc7f0d0615270037234be9dbc7a08ad260ecfc4aa83db30e12280a7d66cefd94b214267f88946668498773e100a6e443bd580
TLSH
T145F0479F1BC09F38C60C6B7153149E51F4B70F8919F64B9B4F3999E52E5135114C6351
MD5 SHA1 SHA512 TLSH

MS34_04.png

SHA256 54cb71b42aeacd3c613d8c78cb9a9f38d0a8cfadb2483da84fe7abab51902879
MD5 b53c3953169e6c7ea3ac3302a8874a73
SHA1 907cf4b1da550d75d3a3af48fe6686b779cc52c4
SHA512 a8a61e5f6d1a3813c2d45d9f0994f4cac7a70f4e2ba69fc8c9048e53a06b833887fa2cb9449f65084f366c38ebc594304d5f6b5d95823a0e2369684977180a0d
TLSH
T1C111C844E488C851E40E293939963CDF9AB6480B47A916423F025104CBC37FD6AC53C4
MD5 SHA1 SHA512 TLSH

MS34_05.png

SHA256 6c2275740bd15478767e2547f755aac86b5973d97807a9e318a50a2289330618
MD5 070e962a217453852a9a8d09f8cf9162
SHA1 a6c40de21c0f0562edf42db4a7ce23e80cb6545f
SHA512 c2878521521abc5837e8d0c5ee3d062a0d398f6b06856bd7fa2273fc8025adc89fe6638ddac5039d473b733adb42065c9013ba9e254729923f0a7cb9035d3a91
TLSH
T18221CAC896F99131E8743286619E4626AC2F855948D382577F371836EEE2F53044C7F1
MD5 SHA1 SHA512 TLSH

MS34_06.png

SHA256 0adf54dda35b7c5cee03b4557e0c7598a3a6bfd29a0e934ed4ae939b0e9fd819
MD5 3c104344c40bf9bd7075392a229f2383
SHA1 143d193cdcaff4df3a68bb1f1a999d267dd521a0
SHA512 8f9535780efc98650cb089f8c8a516c82d0156a5cfaf927afa88cfaa421dbdeab35d1a0c8e5208721d482a86dcc59f3133a967c02808c3c96c193f15d1c04dd1
TLSH
T148F0E1C1D5C9555DD5E84915B53B0AA3F0526998790246B9F50D88FE5E40075E163F02
MD5 SHA1 SHA512 TLSH

MS34_07.png

SHA256 1be7577f7d7365ae3bf4f479ea90fdd5c626e782035a27f292abf1fc5b6aac02
MD5 4b79b87e555e7fc65c2fed4ec4244c07
SHA1 af4545e8cf1aa94991418f238cfac5f82bfce54b
SHA512 6d0f72e9471cc8489a803042020d89d1db5061a494bf01a3ca0cb269bc3ceccb124665f827bfd0db4c09e2ee37793ad7535bf62a8903cd21996f3ef650f40db2
TLSH
T105F047D1C182A85B9574140C44491A55D3634AF7F6D336E7D12AB8341DC35B9BB04711
MD5 SHA1 SHA512 TLSH

MS34_08.png

SHA256 a19347eea0d56cfcd2400ce87559e263420251de67ee452b51263005df23dea8
MD5 6fa6e9aff4f37bf66cf56d4cbc0c1609
SHA1 0187c6ab914af176a6f3b97c7483e3c033d8bad6
SHA512 4ccf027effefc1d0d3191c1f5116cfc73569ee9c7769426553e9994542afb92d5dbf876e70e1c0485f78f89af79d5b83c5989226eac7d54c26a5b5f151093196
TLSH
T183F00C8FC1D48E7A89CC41D816CB9191F4B3010AA555551CA85FB62299B2E85218314D
MD5 SHA1 SHA512 TLSH

MS34_G.ini

SHA256 fff555b12942e6fba029f144be31f1a0d43573e98b3e197fd68bee945c55d1b4
MD5 7e2af9bee2b0d1ee10a237731a2e6c9b
SHA1 76ca0038b1e158eed46cd961e8850affe2211adc
SHA512 225e88f05ff372283ed7dcb1dcf40f8f8f13b23f77de78bde30ceddff507f0e2268a19420f99e7085b0653c91be9a9b8c039a1a076f9b787aa76839a9fd1ee98
TLSH
T1EA71D09E1B6935C8D052F6AB334784A3227A14ABCCFD54C0182F068D6A2063867FBDC9
MD5 SHA1 SHA512 TLSH

MS3B.ini

SHA256 a0566857ba12e8dac5a7bb9a6c2f40ed891427ae564f804a8c56714a273ea03f
MD5 b78e90af1507b7afa4c669e4216b9899
SHA1 737f5244065b8818a83bc316e61f0930e322818e
SHA512 cb40a0eb0e06c5088a57a0837e6abc70c99988b64515359ca208f29c7ceae50b0d28c1281bcfe67dae0a2bdc8a06131f0ed0c74dd2dc31cee8df354c64b407bb
TLSH
T105418448173E259DC1277739308744F72FE124BB8CEABD49586B08EE3661A313B690D9
MD5 SHA1 SHA512 TLSH

MS3B.png

SHA256 2ba74c876be7e2670e9bb71b62334b39fec2b629cc6ea80721fbbaad1f27b5e9
MD5 f0e8da1fad8c5f3972cd0014d90c1565
SHA1 0a53206dcdb59708e6920a11ed7b619ce89b7c69
SHA512 18f02470bbaa4a09d897476f1f43b6978ddeb4724e6a1629a1b7a8c4afe8f1a2a5d2a7ade97702dacf18b6d35b1e9c0accb73744f0bff86734abf8d2a737728d
SSDEEP 768:i/42yC8l81WlrudXTXPqqLMnKuwUVc+hSl6Kbw7UFljH05qv7:i3N8sWM7SrKwm+gwurAi7
TLSH
T15513D08AC46B862E7D1605FEB7F12FB9F06F6E6073DD05C51254A5DA3041BC8E11AA83
MD5 SHA1 SHA512 SSDEEP TLSH

MS3B_1.png

SHA256 a34a561345d915d1a23928267f91caa2a1fe1c04d9524e0033a53f1adbf90c75
MD5 e05370dfa01ee6b08030f6e44c1b1fc3
SHA1 4bb1073ab8c4ea8911973a1b800145599f6f51b4
SHA512 672f3218720b55d70aeff8088eb7d2378c2c32c0239fc06eac494988ec4d69ebf53cce68163c90abd524a1f3255d40ed7bea55adb8b2f6512706a7dfc1e33d95
TLSH
T141510AE1E201B868690A0461B60AE2EC61E31D746274503D6726B565C777BB980FD3EB
MD5 SHA1 SHA512 TLSH

MS3B_2.png

SHA256 49ced83d69e35115499c6bafe6572245d4683d07fb6a022511d70fe7f8c68d74
MD5 d2ed6bc530aaf5efe0d63c80dfcb4f73
SHA1 fa3ecd78612850405e7633ebc818349883acd819
SHA512 b3586fb007ac48d4f92812b49f300442afc246e85a633f8391e69115b6700414968815396afaf00c0e5cb511f5bbb88e80e48cb04a095d94a9454bc294abcf4d
TLSH
T17B512AF6A4B1DCEEC98D2AA8E190F8940FC81D96E1541C0CD58871A4AC36B07789C6D5
MD5 SHA1 SHA512 TLSH

MS3B_3.png

SHA256 ce77b1b83f497abc028a8ee604e62848c17249a886139e085b013e6cb40ee4b4
MD5 a81587ff7a0d8902df5c98cec14dd6da
SHA1 ffe14f6fc0fba91723d75f75bf138f45b14e3a50
SHA512 a686fac9fef5f416166f2da3a290c2480009183f8e8b0c534ff32c4371e770b2d559f0b441588a1068f5c45e9ac04b981635dc5124cc6c2a820cfeff1e43c177
TLSH
T1A7414B524F1E4E5BE85617E77A204E6BAF98CE9708637A60EEB4F225003661C1CCC765
MD5 SHA1 SHA512 TLSH

MS3B_4.png

SHA256 fdf05ef586988a54658de71548dc40b9dbf72735188346a688d38bc41994bce0
MD5 741d5b186663a67975f3ca67ede70e12
SHA1 e345f9a57dbde4b31370249de9a1b95f13e1b2af
SHA512 4491b3a61c8687d8a847ceb843f1014b87af5db9963144ef60f7884051a600b89519f01334a26471d58393734d5169161edb2e9dae6472d7d560630e8b474425
TLSH
T15B415D06EF584C19CE5FC12036F6E80559A05CE7987CA1CD470E782A13FF681C3E6107
MD5 SHA1 SHA512 TLSH

MS3B_a.png

SHA256 afdfc6afebd04bef63438f64bab07895bf26a44972d2a4ed8856c4c4f118e9d6
MD5 f59ba9c1a1dfa6a82c9b5e5a1aa41020
SHA1 e51622289d28f9cdd9fb5a8166c5845f32244d30
SHA512 d8561d5c037bff014eeba84edbf8274446a8dd51c55ea5f40d804faac938d45e6a9a503d1b3d258a862ea166f8573a19db86567d8d265c1f4cbcc014f593d4ec
SSDEEP 96:n7ZfPrhL2R8eMeiLFYcFnhyen7swqlrH5H3NuKYxu6ChWf:n7ZnrhL3/TBphy072VNuKYx5ChWf
TLSH
T158918E9701D5E078D801A8942AF77E12E71C9FE455F7D80B481372CE8D3BFE8166A047
MD5 SHA1 SHA512 SSDEEP TLSH

MS3B_c.png

SHA256 a149e8f2a7920225a53eeebe82a68e0fdfdf41502e70ee772c1ebbf91f445486
MD5 8be8ff94dcff80dc4fa29c500099d9b2
SHA1 eb67cbc97d0690ae1fa43e2ae9a01cf0ca7d6f5e
SHA512 26f294756062ebece1df00ed1380ec52e278539ea1e45614453166997883a84e5fa6c666c94c61ba39dfbf482f81d2b3759467abf32f6f5fb23fd15a3d86f65f
SSDEEP 192:4SrHxCmUSB6o9m5RuD36n95PZocfDy6Dh2y+Ioq:DrUZSB6SMQKn95PfW61Teq
TLSH
T149F19F1265E48A11874A3E9108B161A974730F02E72EE13D9BAFB8076A7F70E4DDA721
MD5 SHA1 SHA512 SSDEEP TLSH

MS3B_m.png

SHA256 08fd13231fed79786744a8bf04b2cfba8f5649cbbe39f4c8060f8d9304a503e1
MD5 4072fc451249b7679065741646a59d24
SHA1 4d098d1cd121ff57f91ee66a6f9b674f9073078b
SHA512 23829f26e466322ed8792f775fd1bbd4192e161506839f5c4dc937341ad3f3bcba5ef3d67a03be7558d0dde5b48e8ce00e3ea45b2c6218d7eadd2ab32b64ff3a
TLSH
T10F616DF60E5045F22256926980E3E27C3F772E100BF72367E46672ED943D94940C659B
MD5 SHA1 SHA512 TLSH

MS3B_t.png

SHA256 d4d62360c1c712ae6a5bba55e574b290d9c51f194b5f28b65f8f1a1628715f15
MD5 f637c77f01d40c56dbb2fed373cb3bc3
SHA1 ec310db383a8bee3712f2bf782a9a52852945963
SHA512 d62833979fe866bd233dbb6359de44ee540c9857672e9cc2ea1b15547f0f375c80088e0f92be7a62efa9892e8acccb4f6914d5c51aa6c52d9e82a915d603e8f4
TLSH
T18A715C597BF0C9A0E51586F134C3AF30DD050E5F844CC4E03E4ABF0358751F8D099628
MD5 SHA1 SHA512 TLSH

MS56.ini

SHA256 272364ea344ea3a5fded6e57573aa1b121c268bdc6b93f6f8ce056022785ab26
MD5 1d3b572d50f1f9d8d47455704db965c4
SHA1 93024c801163607dc7051123488a3578901df522
SHA512 839dcccd77f74bd92c9e3a968182b1ec5136ead159c082bf07c97054a7285590146a0520fdf77d934e8da905c82ce07246695a3b09c7c4d5e807aa676a8d3ff0
SSDEEP 96:4yJM49Iy0y1BtDq5AMmz3ae2x5l20ui/0XRx0tMl0Rv20SS0rNQ0WX05F0t1:wgnPcEFMbBshuGS9bgRF9Ev
TLSH
T19BC16B1F1E3634DC9056F2BB3709C4E562AC09AAC4BDBA94085F06C86561634B7FFDC1
MD5 SHA1 SHA512 SSDEEP TLSH

MS56.png

SHA256 82bc4b094017cca2f32831406bc37897ce48e0d594ede0d99c57820f50c28917
MD5 ab73e4f582d36b153ed92f6a51d6ba80
SHA1 e8a3d290cb81641ebf49b39b307ccd07d17f2ca7
SHA512 4f83e02c9ec195d69fab3c873737bcc756ed148de193256094523ae1cca80c9535acc8943be1bd19dfbda9d671dff52734539437f24da18d2b17462f3c60f40c
SSDEEP 768:CilhxuveN5cwVDXLd7EREiyS0834ClbS4CUNq1oRey9QS7pGL0LnXMcdv/8o7Avg:Cqzuvs5cw1x7ER13tNnNq1qnc0/TZh
TLSH
T1A843E128FE190EB4DEE54C807997D85D4448458EDF1F4F48ABC28A169F76AB2FF801E0
MD5 SHA1 SHA512 SSDEEP TLSH

MS56_1.png

SHA256 9c3d0f54a8f9d7f62256fdfa492950691e2c43a8c0179bad38105dbf892a0a1f
MD5 00196086731c19b2c10d279b2f964947
SHA1 b66c4ab07f44c03c9ea95de2db20ed7b2a5d3c97
SHA512 0b9f36cc6c1de9081e9bdbdfb35c5ccec0671253f7a53be72dc11d3c7810298d6fdec712efbf61218578c16d8ea2d000449d212f6e92b9a2dd270c2ac9db80ab
TLSH
T19A513B4DA9F5635DEF080CAA2C4F3382FCA0CC52260C031A18AFFE756939991A7E5750
MD5 SHA1 SHA512 TLSH

MS56_10.png

SHA256 1ef03914df89e5f3cbc127477fc9211862e14a8d8b1896d157bd69ce54641d18
MD5 fa5ce40289b17ab3aaa6f26059acb391
SHA1 c9158c54f4d7a3310ae41ab9c9bcc1cbbf0394f5
SHA512 8252985f23a347a463036eefe6858a5798ed5a38b28a1fa4911a2ae5cf6538d74dcb5ae1d525eb1c22ef4e2e729625d53f5f2c81a1e16aeaa36f14262fb68920
TLSH
T1F711EB6364945CF5C53010179313B53185D24CD1BEE52AA3613FB04D08B553E420C382
MD5 SHA1 SHA512 TLSH

MS56_2.png

SHA256 d21f87d0ceca2ec2a93fb92215c93c4ae11076f206068cf4baa7202d7179db6e
MD5 81ff19f82ab163cf83282e24f231534b
SHA1 3bccaf4e0cbbb640525f4fd6fb4e1f8a2d200c4a
SHA512 9014e398f9bab72c4b3d9a13f3f8b2c6584fdaa7a41809a8518597a7ab82165662abdaa09c7eea63f6e781947f06d5741e9a9ab48043fc576707ecdde6f15807
TLSH
T1261152CAB3039930FD684529929B70E0EA5C8E61716DD80D502AF85660B7968C484CD2
MD5 SHA1 SHA512 TLSH

MS56_3.png

SHA256 307079e3fd8143cf5b67d73a917ef033573589cb7ea38029a4b3fbda2eb9bbdc
MD5 d7da3d7e4ac7cd40e7bf46191586c941
SHA1 fd8fcd2a7f04a68d58744da869bfc0b23d08b932
SHA512 5605e062647861fd160d62170c694c404f2f72bac2e38fe16826b4696982e38c2aaafa799bd143e83eddc9214e08c88727a35ce166f775bd56e8d8442ea32617
TLSH
T1E911987D35C87AA94F1F0C3B8AF6D8036B479E9110128585084B776C49BBEF91A02714
MD5 SHA1 SHA512 TLSH

MS56_4.png

SHA256 4f4b68409dac618e180121846c31fde7872cf1cadc51a8f55ae5618769426f14
MD5 1a4dd2bd90e05416ba449abf30849cda
SHA1 ff4465299baf063e55ef454155f4128f74c9654d
SHA512 c702dcf46cabe6409ed05ddd8288e138fafa3c1d346c4b00f54838945a3011b2501de4b2f23e4502c77cacfe022d78166684ff4e9a18a426e2538a269a7c4f96
TLSH
T1D811B7A1510CB0E8CC8D1D650BCEC522EF387E2D67BA281C1748BDF0287C82952958C2
MD5 SHA1 SHA512 TLSH

MS56_5.png

SHA256 c17c8dceabc41b98e20268c86e79fd070f195151bab96e3f3640628001e14d39
MD5 df17d6abe8ab458760116b58c3996b74
SHA1 140e6d127fbb19b0e2994cfdfdc7a16ce68bdfca
SHA512 eb388a259f8222384aaf4f0abac68702526666950dce0ffa5b4e10ea20a523e55f90efc59398074f3d155d3ebefbf9a101fd72f0508867def035a1d3f5106356
TLSH
T102F005C23D8A3714D0AD589172068524E9034FF11781B37E514FFC3847B9D8464D22CD
MD5 SHA1 SHA512 TLSH

MS56_6.png

SHA256 1b71f84322a83a51ce23949058583c0673bda36d02d94f9246b57a0a730b73e5
MD5 5de958cbd5b8051b6dd732fda2659557
SHA1 aa717c0e787b2b21a76447bfe6a76c232f709979
SHA512 42762a77f3c82e34533002f5240bc5b683a797ca798e643370ff2c3f40f52fb303a0a9dde3d30ee24bbe910fdffe46242e54850088c22f88b5acf2667bd2ea18
TLSH
T1F4F054CAB6C05030C91AE5DA07332820FB57CDA38791620FDB0D371A003CD84EC61908
MD5 SHA1 SHA512 TLSH

MS56_7.png

SHA256 db626a5cc33b560ddd0acd96605bda16de04a946b1ec68c907aff931501cd09f
MD5 ac83ccd302e3e4f9a149a4ebc7954da2
SHA1 dd3cfe3f9bee0ec460ec8c8dd07937c73903d7cd
SHA512 9f9ddf3faaa0f62556d790870a61023d9e150323008e3fdaa8ea0e2dfca82f81aa8b5d3ff3866fa758daf2be633da2efeb2de247e4d7e58a02f3f24b2ac9e8f1
TLSH
T13F01968962970760AC1660CA720960A05FA44F5088840E953907F4EC2A3DA8C7B14399
MD5 SHA1 SHA512 TLSH

MS56_8.png

SHA256 c13168ec436c7c7ea30192b953a54466b0eeb08bb4cab5b3e53ef8c238d891c6
MD5 40db5fd87dd34e35a062a83d091b96da
SHA1 8314c3ac66dfd560f06d83d2e641d3904c65e1b1
SHA512 d2eb1e8f60d906e5715456a75835dff99b697cab5e91ff6dda0208fb9db895b6e7841c9b394c6ec15db58f3e1139d2b9efd04fd9bb643edb2bd7ed651628f774
TLSH
T1920165DA3B61CA20F95FA0E0AB2340519C750D927081C95C45487532A2376828D53FAE
MD5 SHA1 SHA512 TLSH

MS56_9.png

SHA256 397a3b956bb1bff3d638dcd4f7a07debb71b8ad181e97f075d9f12120a16c4c6
MD5 c58b2b59e7e5ba4cc7d4eba67e2af1ce
SHA1 6734a3cdae3e255ad6ee37a3d141376fa0269bd9
SHA512 064711137b378d34777d132b5d4fd174918a9843be7b4357956046fd92dec947a8810c15d088f6744209bfa3e8b537d7db1d70080f89aa14742b2c37a1b2016d
TLSH
T19D118A7492E047D74439217073870916A331FD7949856D5693DB3F15237D82B60457C1
MD5 SHA1 SHA512 TLSH

MS6.ini

SHA256 35f63ba6710372726a6a329e3bf9d1fea5ee84af095daa8d797eb5ae5e52185f
MD5 c089aad79a10d48b3b44914d5eb9e24a
SHA1 976c7178fe9943573f66d873fea092d552059e4d
SHA512 894251c37581de78271001f260b99ba7c6e92134106f9f5442a4637eea30d4731634e6732fbf95250fba6b20e7e6348120856ff17a05bb2cc33e2a4be09ac3d8
SSDEEP 96:qZutZAuhBvvh+oiOXwy7FEMqlwq2WXSBmcTh/JTh7MTKzVTNeLoToqETzMq:2uTmnqZV1AURoLMNYAq
TLSH
T150B1BC5F0B6035DCE016F46E330B84E72768446BC8FEA4E518AF05D96662A7867FB8C0
MD5 SHA1 SHA512 SSDEEP TLSH

MS6.png

SHA256 ca5c24cd52821570fa2c200b0275d0a701ca2f98ea1b4fc36ee7243ee6a25c4c
MD5 736a29dcd442eb97e79ba8beef3a5999
SHA1 ace88c81298efedfaa2dfdec57fa5334564df520
SHA512 23b5748c56dcfe4b30aa0474d1441b1113a236331c3ef0c744ac1db3656cdea47400e0ee8c35873492b51187aa8ee3859da5fe4605485039e7a47229cae2dec0
SSDEEP 1536:26m+h8nKkiNiGpowp8vQTsCE/6F/aYx3/RgXObYb5FoBTiQb:U+KKbwoHpsbCRF/13JBQWb
TLSH
T12943DF58F751DABE29E00E0A7F42982E3619586DDF1F2EA4E341F852D8FE90BF4241C4
MD5 SHA1 SHA512 SSDEEP TLSH

MS6_1.png

SHA256 a591254d73df9dd959e6cd5b2d3b44e44294af118a9f94850be590fdcaade693
MD5 c1dbebf3a704d69d654e10cbaea84c08
SHA1 9180b91319f7fe04ada26e4ab96e0c4ea1e186f0
SHA512 d5a6f24b3f7b4e516e54a14fada9fa8f679e89adcdae70a8931f84e982c898ea507bc1c5de850534fe1a46bf349c29956866aeaaf25de8e61dfa739b2a0d28da
TLSH
T13321B6E6517090AAE03A4C31834B44C8EA3D0DBC28E14C4DB1D97F9DB5FD2C0D84521A
MD5 SHA1 SHA512 TLSH

MS6_10.png

SHA256 840772c946e2e4d0dc92504827cc5f08389093e5da20d6a54fadea38d0381568
MD5 b5eefe9c0f0b68ac104410cdd1c859af
SHA1 6f379247181100b0df8e588c5e2569542bf33a4d
SHA512 bc58e353b2c83b16c397352723a86ce521a9a2a0363abc4075eb99634639ca91e8ebaa30078c36833a567f8732bc91f854313db424a25294b31bfd2a68ad472f
TLSH
T1CF21B9409ED15AA28B3B162B1207AC095C81CE94AB937535674F7183157728C9C4EEDE
MD5 SHA1 SHA512 TLSH

MS6_2.png

SHA256 3876b2091ef093babbf7470f4f802d33789dc5c27d8960ad9927860dc72e0afa
MD5 1ee4bd85860ce99c59b914a79acad2a2
SHA1 1555a5c274c91e7f9d1112f4eaaea091cdb3cdac
SHA512 10d8878d66318ea875574affdf14e13d0e193568c4243df2156f8079329718c7ca0f57a4981e21d12d192783a516285895cdb51f7b393ab995cdaa33a464785b
TLSH
T11401239113C14A13E459887A17EEAE605F909C4CD59F4808DB1579B1947EE8C952A2CC
MD5 SHA1 SHA512 TLSH

MS6_3.png

SHA256 59fec829f582d7c8b6adf47da5dacb2d44f249cfe7e3cb9bb52d5204afefa2b1
MD5 f4f62a5501cb40e47c3a19b5ae3cc79e
SHA1 452165b10a1627951b74f6c31b12fcc58d95a2f7
SHA512 4485b30ef400a121d2e6fd8fab5a7bb5843809f87368b6accdc5ec9f9a13a231aebb0dbd57eb9cfb21db66121f43048aadf0cd4c93690233eaab0f5601fd3954
TLSH
T15FF005DB6640C439DE6D16A45F5B514C85B14F2D104A502F9058FDA5937C04D661D280
MD5 SHA1 SHA512 TLSH

MS6_4.png

SHA256 5e468c3558235e888eca1e331368662e12872527b0a191caf2134d80d785d078
MD5 2997bda8d84e6b5fc18893d2a672ad46
SHA1 dba19a50bc144b65ffd84326699724fd84f8d8be
SHA512 4214c005d090998d22e0b3b43931902561a680ef57cce477ee33ea23ea2aab2430e0da6b8e1305b46917e0950ab50d6b273e87d810e40f68bd7cd18ff583ca80
TLSH
T18AF00EE3135D450D769E0DF89347F524E8001E220A6E8258B95DF81192FD0A0CAA63C1
MD5 SHA1 SHA512 TLSH

MS6_5.png

SHA256 fb501f6086105e189ececdd4120acf8d45258287f35e98689bf25dfe8b008880
MD5 2ed9f87326575180b8515d01c40c3dc7
SHA1 fefb7aed907cbd336493aec71e659015ba094acd
SHA512 fa976b55a69eb86b26c0487cc3dbc94f43556840290acc7f517b8bc252bc4d5c0f3a3dc6e38028132c5729d400a251e1731e75b4c4dbf084ac658a3e4468e4da
TLSH
T1650170E73081D359E82886EBCBF8F53C60E10E97D06BCC8C382638881030940E8D039E
MD5 SHA1 SHA512 TLSH

MS6_6.png

SHA256 2c5ce3624b0dc15f9359a5eb89fc61d6e4c33fe1b87bad8bc19ba243fc20dbfd
MD5 166b7955b7703a87f911d98d1203fe9f
SHA1 54447e6ea889887ee022a04cb63094ef229930bf
SHA512 3befa0cdb3aabceb614ddf353b9b11197a39dd74fb9b3811d9a484f7eb0094dcbf5c56a199ef4d0985ac5d65e9f18b12522ab5bf29b50b8e7ab0776886f4d786
TLSH
T195012047B29962A264A7755A47072D90B4860F62304F574C895FB83A473B0D5845B2DB
MD5 SHA1 SHA512 TLSH

MS6_7.png

SHA256 d89ab8c1de025651c71c1533aa1dcfdec71ef8470ba441452a965f7ff8a5df1c
MD5 64ebbea89dd905b34a02892735c147c4
SHA1 425e83ab23f0dd3a8d35e1135ba97b3becf409cd
SHA512 8c9c16f55967075cdcc5834b342fd75ac24d89a818ab8097842d77e3579bd71860c6155a4202799b1eb3be14071ff4fbaa6401ecc05583361258a6ddb3926fe7
TLSH
T1C50165F6C0145F4748DECBBC019F1834AB442EB14AB9C1DA6899B039AF7CD10A5732A5
MD5 SHA1 SHA512 TLSH

MS6_8.png

SHA256 544aade4f917a43ac28a899c328a1d0769459f2c8bc04e4a0461a4fbb12ce984
MD5 2a3e98879b65bfe0982ac7044147bf8c
SHA1 ac47f4cf900dbee7c870d7293227073d7b397ed7
SHA512 5616fffc5bb077365b50ecab96a715ea05859407907fb06faf23e799ce1c5e53c95bce1a7855f9ccd28a02741794cd8f4e09b1a8c61da8d69c109096c4e798c4
TLSH
T1640165D619C00DD9C6FD462A173C88115CE40E943536023CAD2B7A2CA63ED175AC8727
MD5 SHA1 SHA512 TLSH

MS6_9.png

SHA256 edca0b94d4017e55d73115457654cb92692c2821cc91e864177da3a954421a19
MD5 4e8f3df83c47ce9a9e5562c6b4a95dcc
SHA1 5ad5660573c923a4a897b62f4a6def3b21029bd4
SHA512 496747fc75a0e55c20830ac50de241b95bc582e42426b956b37e93650ccb34f8f1c25962677f5b133fcb82a98ba15374d8083d5f52606d5739b5443333899e16
TLSH
T155413AD223D09A35EE6517326B309F7474005C5F640C292B5EB8745D053D260BC9BF15
MD5 SHA1 SHA512 TLSH

MS6_G.ini

SHA256 566fcb4be4eeb8106e1f2a38d06aa678205b882f993cd884f7b5d0495c2c0897
MD5 b3984c4d5f59c7ad51e283b5275bc25a
SHA1 38b3ffb1e5263f77d9cba2d0515a7e357dbbe894
SHA512 f58b56dc511c8d2f91933d230c155815c55e5239f52795c1be7c8aab9afeac1131ab31d140c9187f5b13d6e8bce165352a9e4c9a1bb1f7dbf4d0a45687e3ea0d
SSDEEP 96:qZuOZr3FX2819iryBwTh/JTh7MTKzVTNeLoToqETzMq:gVWrdZV1AURoLMNYAq
TLSH
T145A1F25F0A6435C8E122F46A331BC4A32A7D405BC8FEA8E1189F05D966A137C67FBDC1
MD5 SHA1 SHA512 SSDEEP TLSH

MS7.ini

SHA256 3d9ebdd04ac5cd4a4e9379b68be5e0c45fe93dd404941551997232802ac612a2
MD5 12931a4a07d08a86119fa46ad59b3816
SHA1 805856e9bfd726a4cc87653c2c488d2239d3f7ec
SHA512 f49b7223f98bca232a2fd4f1a8e8984827ad7472adb1732b3706e9aa635a7ec67b893ed91a9f4501ae887d6431f54586926e93890d1ae07cf5bae6d68f10ddf8
TLSH
T10B71CD9E157626EC814776253257C0BB2B71047FCCF93D50246E01EE63A1E742BFA5CA
MD5 SHA1 SHA512 TLSH

MS7.png

SHA256 0898639590912f48e10e291ad0de92d889df98da5bbd956cb4f35a2e36b05645
MD5 f8d9e55466fd1c6439d95527b6b37333
SHA1 5bc7dcf3035189330e2cc9b08d8786a465762ce6
SHA512 c0c073c0c613f78354e02c7089f9c7e67e1434199bd420319cddb78fa5cc04e90a1028c2fe15870d1ae2f1fe39dfd71455a3053b030284943b42dc7b440533f1
SSDEEP 1536:nvAU2ZkoluxFwAHSo8YEw7FjDNF3A4AIn+2V:QkolurV35Ew7FXNFZY2V
TLSH
T15F53DF0291C69D1C96FD043E44E31A59C484AECFCCFA75299BBB2E904F35430BB6F684
MD5 SHA1 SHA512 SSDEEP TLSH

MS7_1.png

SHA256 878240473bc6acbb7650c5208c1100e716c7c500fc5b9ba9c5945b1b1c4016a4
MD5 2c2da7ad7eb4d0195708ca37cd81ba25
SHA1 7d1229e5dc9824c98878c0dd2235aba7ed25948c
SHA512 8c5315a4d3bac578d27fbcce8d94a32d6aaabe2080d9362f72cf1e69ae5f286ed56751c4f28a1dfc544bdc0d992646abd8f1b8b52d2fbc3ed1fc505be67ef83b
SSDEEP 96:2ESogOKtDs1NV5U3vqk7Fs8Xp2eEF2Y8gw9abf90:2E4U+vhFs8XpyFAQ0
TLSH
T1F9917D5BB72C4D6EC12AC3B9135D053CBCC64D6852A5074B5BBA78F6413CC9EFC41855
MD5 SHA1 SHA512 SSDEEP TLSH

MS7_2.png

SHA256 cb50d07e28903ff1bf96fb8ff8e12f6f494c2e6b1774aa971b56df76c6f89c3f
MD5 55eb364ddf2d21d034dab3f6b64b7ac7
SHA1 f16dca4f62f86c4a79afd6c99c1c754ce469fe18
SHA512 907700a453dda62c1f47ab9834d659666e25953e94c9559a971218f6ea5a9737f53b30a1c0f472ad95d2ed649b027fbe09eadb8f1787c7a7f9ac81e9cb2126b6
TLSH
T1D82117AA30884E4AAD5223CFCBA144532C167C3286401B23991A3D2A4ABC86CB0FF087
MD5 SHA1 SHA512 TLSH

MS7_3.png

SHA256 e89633f3bf9c24a6aefaf740ee2ee5a60eaa98026f353c8b41571ef20a5e3552
MD5 35fe919f0c199f1552bffae3d366f7a9
SHA1 e116dffd7c63fb1176bb278bce2d10b5d99b0b60
SHA512 e8bdc35ede28958385a4699d440cebc150adfc9477a8179a67db26f6597b531b7f754e17d0e73062bfe9627caef1c6451c01d5ea238391a89ff436774e2bc757
TLSH
T1BA2195D5D20795E1C6DEE9AD0ADA170C2C589E74984FA6EABD0934281C3D69EC308D26
MD5 SHA1 SHA512 TLSH

MS7_4.png

SHA256 d2bc15fc4a47b603ffe83128b1dc0704d14287f9239af173638e468aa0f64603
MD5 afef3f3b2e9e0b0cc6b9276d0ac8444b
SHA1 9bb1b917b62ac2626474d0e8d410c07084e72e62
SHA512 24ca5c681a2d93eed9f5b2b906dcd0b0925e1f7a38acd099832bbcee178c9361e0e9b9c70a8d2b086dabec9d324fb0cd8c91ee6eb4137be0b73c67f2ab64dc86
TLSH
T1732195A128184012CEED0876A6325211DADA8D1794F9CBCB5F2B7331413C3AAF9E66F5
MD5 SHA1 SHA512 TLSH

MS7_5.png

SHA256 0c192383c9800fbdd4095227117df9305d9c61265c66e1a2dcbc9c1cde3af1b7
MD5 494c8feb86dd9328ba819d16ecfe85fa
SHA1 2542375a2056a556db78353fcca847c269e68bdf
SHA512 eaa58a65a9668aeb476a70811193bd8d877c20dbe3e71912f0d4ea88be0c82887917533f1526270f17e56892340313fdd51cc4354c71466aff81644545bac48f
TLSH
T1F21194EDF5E67C1CCCAA709B4248665CF9649D06C82A4645608EF1EBEC3F80E2651040
MD5 SHA1 SHA512 TLSH

MS7_6.png

SHA256 c7b02a99a17461a6c8702b71495bde3185e9f264bd76363c39a3c2276fb643bf
MD5 28ce8bcd5b1bbf4a72cb965fdd845937
SHA1 c0f0205aab62445add7f982e90a94cf7f413afce
SHA512 c479ef894d4a49111a693a7cc6e457101e39bf7183515980fdb42c1d13e66a074ef031fc0df2b146f5088330b09ca2dddf15991ef3bdc8140ac42ad66e0a0d0a
TLSH
T17211C4D53D294A02484FB4705AF84CE7CCE42F376885C12A20AEB84040BE31EA0884EA
MD5 SHA1 SHA512 TLSH

MS7_7.png

SHA256 5778de84b17557b66270010b5bd40e36c4a8078dfec09406df050d7a6ddb95e5
MD5 889345d41eae04ed6a944954e88b7899
SHA1 bffa2c04054ca31e36eef66ed2477b6fa96863a1
SHA512 1078bd00dd776f9c500a0118fdc124c40fdf7eb4c1832d5f93205cd6d6c5835ded67cd29b0ce620239741175c328670ab32533a2c0af702a21ee9021f45ac1f6
TLSH
T14511E921BC106D58B4162A1FA7CF555688302C684164CC93E98930D0B2BDC0EAC84A87
MD5 SHA1 SHA512 TLSH

MS7_8.png

SHA256 0740f5310c8abd850910a3cc3ed8b52845957e9323c87b89abef797c0155ed9c
MD5 293cd67c3464223a6f119ffab1904998
SHA1 bf78125929e993184f4403334f2858a557a0be67
SHA512 87f7609f5e0990cb67fc80cb2988e0d670b42ef764e29a8b76ed1f05b8fa76b3ab7f069cf40036e907947b61534498485099af4834584a4eef103541440ab8f6
TLSH
T15301568723D829EE87931696D25A9EA0C0151E42069973913689FC76E57F594009E741
MD5 SHA1 SHA512 TLSH

MS7_9.png

SHA256 d0a2b6d3fecd083cbf8aace4abc8aa79e4e210dec1c2fd3fb223f45140f8ec0d
MD5 6261ee9c3cd24be1e6dbefd21c097cfe
SHA1 64bad37e437caef488434e99ac2a57ba9cd3b5c8
SHA512 c50ca4d64fdd82a0628305000a67552497d667d79712dd3a509714281471dadd70582c29bccb49b7f5c55201057c64657379e19e6d2daa18a38f9fe9d5503479
TLSH
T1F821B4E753D6CC6CBB02288641110F4DDF087C1874B72F2D8E8AB43AB079969828F282
MD5 SHA1 SHA512 TLSH

MS7_G.ini

SHA256 aac280cd90a9bd67e012a14a35027258a0bf76e8a4bce68253117869c82d53c4
MD5 acdbd50f8a3e06723ba5517acc9d3258
SHA1 435cd436510f7689b6796af8a0d39eff024e2801
SHA512 fcdc74cc6eb581eca92481482baa1d86ce97bba8361e3061c980f9e2000d62de327c7c850b22b46cf1518995433ddfc58f785a32cf990b8c74447a8fa6b749d2
TLSH
T1E851BC9E25B626AD915775253347C0BB2B62047FCCFD3D80241E01EE2771A742BFA5C9
MD5 SHA1 SHA512 TLSH

MS8.ini

SHA256 23b46dcd2fe1f19831aeb1e2df57441dcaa185f31794f1ba704789dd539ade33
MD5 d681d3c4f9d831e04ca4aab5271e99a3
SHA1 5eebcf69e4a52913ab9ebbc995be94bffcefaa23
SHA512 ecb04a424f4ceae1b574171a5c76bf1f7b6869ba95de89651d60bd676eb6bc8380bae06a2b0a525334afe9e7637e2c9200b4e17ab7d7222cc9a6bd796cc85621
SSDEEP 96:qNW490vn0y4JjM+J+nzvAUyj2JM3ei4WhBlWMdWXoWhyhWNFBWo4Wz8W0tWVS:S9Miii3pL03/YgLA037Q
TLSH
T10CC1965F1F2234D8A446B17F330A88E7266904A7C4FEA894486F05CD1915A38ABFFDC5
MD5 SHA1 SHA512 SSDEEP TLSH

MS8.png

SHA256 5020da4b2f1c798026bcb5b9156fe8345e2ec6efe17a36a4cb36e4afa1bcb4e2
MD5 b6e4629e00d7e1093cfe114e638a3705
SHA1 8185cdcfb098b505719dd2951621c303fc4e9b2c
SHA512 97007c58b661239b0098ee53ea145097c008cf837027dd3ed1276908f665e21cc512f32874ca218f0bbcf782d1ff1e51211e548d9adf9e3137f6f254639350d8
SSDEEP 1536:rbSYFWDKvr7+icVL1vqkAxLNyigCn65xXMX8:i4Wus1ykOKCnps
TLSH
T1CC43E066EB685C3929AD0C8CBF57C88D58085E49CF1F8C615B80CF68FDE83963C495E9
MD5 SHA1 SHA512 SSDEEP TLSH

MS8_1.png

SHA256 7361ea5d0a06cc6e55fda23eac1ad4137649d482de9836b7d26653dde12de2b1
MD5 235cabc5fc71a8a5a416d4387a9964c4
SHA1 3e2fb094d188548f5e326cbfe9b2bea631fe1a3a
SHA512 19e14463914331675b113ef0b9680860d13395167f5bcd6c335701e1f0b1313b565735585ce152af30db30db812a85f6647320af894b339b1c8ceef969b5acc3
TLSH
T1C1413D53309DE6111C6180384CA66763606BEFA6CA65A0F9A38A7E972E7502D68233A5
MD5 SHA1 SHA512 TLSH

MS8_10.png

SHA256 f7a97198811345bca7b030d0dee6253849033e6bee55837bd942599fcb99057c
MD5 80ab3f4129bc0503cdbc475c6b00cd97
SHA1 23bb12b06d1cf61b1a5f2e9e9c7b9e138fe2ce4c
SHA512 b21c908087942d796bf90a03afe6f1cb0a1efd95d9c4b56b5f878a1d42adcd9a7cc85172bb393d479bbdfe852b252d8f5ed87fdc7e79e1f37bc9db370ca79b6d
TLSH
T16A31FC46E3D99D31C34A84FCF3E2A427DDFD1C8953752A4947567076C1340042B5B45F
MD5 SHA1 SHA512 TLSH

MS8_2.png

SHA256 b51e3c17cf5ee6d384c560fedbb5466b206d88ffa85bedcf85473be59a64fa17
MD5 932c3e2bae8204951dd9f68a1ad72dbb
SHA1 d40d2e1bcb2ba1a6a62e6cee857ebf3e2ad0c88d
SHA512 a34bdfff5af3098c4dc87574727270c61c09933695a53712e88876cbfb256cb4da6de3eccb19a76b9ade10e8c5317ae794d2761e23fa85dbff38c073b00ef278
TLSH
T19801284153B1DCEC5A457034356314305D4D6DDE2660721C651EFF6571BA2494545BD3
MD5 SHA1 SHA512 TLSH

MS8_3.png

SHA256 91441dc66d0f315ae7426d87ec98db77dceb39c0a8e10e731fc7ce5afaa5841c
MD5 4e7be96be25c1168d9c04fb4a3260a76
SHA1 633bf6dace7253534870f395e712050b08eda8f7
SHA512 81f95635c10e58b350788ff1cbb01d5c6ced25e372264eb213f055a051b7016d7e2e6c0d38e0af8c5f7d3fe886d35d0edd3d2a0bb47a976e804d44d5bb0af4eb
TLSH
T17311B9C5B9507CD19BE450590327DA5D5C16AE563B89109DEC27F6A0183BB6CD302716
MD5 SHA1 SHA512 TLSH

MS8_4.png

SHA256 684414665c3e7df38aa21b918bada202ebed19e4899530c3afb4ae38896b1cd5
MD5 74d897f706c293adcdee66e8ca5a31da
SHA1 50fffb40a8e5ae121de89fe83c1f1ee27622b086
SHA512 aeb48fab7f75c9755b9d3774e3bdb3eac3451c551722ce52f0c94dada15736c3d78913cf2f310cf2c2c8701ca4b976d70579579455c80d2878c2cfd0391b7155
TLSH
T1EDF0A353264D642DE05FE73013DA4D7EDCF4EC4C285D990EF15A79B2447E583A190389
MD5 SHA1 SHA512 TLSH

MS8_5.png

SHA256 b500a6cfb5e645bd7d345caa38ecd37195f95c327ac244edf248fe25cc743533
MD5 7d94b85e2252f641bc320c32aaf9f31c
SHA1 519e6367ae217146fb6fa9234ce4d944ac4e4170
SHA512 e386d2b47cbcab235f6366696ee9e462e6d2dc329cc77764556500b229eb7f231eddf5328082fae72906c235d7479fee4c6c3234f77a7aaac9928b8a5c4647e1
TLSH
T111F00EC982809582242D906207158546DD292CD988E18782F16CFD320A3EACB92F82C8
MD5 SHA1 SHA512 TLSH

MS8_6.png

SHA256 360e1aae2d7dca2d31fad64fbe02de391b5c7d53d300995314674405d3dd0a40
MD5 076eab6cc0e809ee6d1c5660289a99af
SHA1 dbe2b15892a4831fe5658f3b0bc2012becde7e17
SHA512 433fb6b4b53af842e6bf0f64ffbaec501347252c3b1d5de8639d69cc48eecbd2e1446e9850403a52c600637951cb86e4de7e5bebb72a17e817195cb2e125815b
TLSH
T1040194E1AD00804DDC235466314D91C67070BF4FBA999B1C529EFA0D0E3A803B0AA38E
MD5 SHA1 SHA512 TLSH

MS8_7.png

SHA256 f64d65f08c85e465e2223d5c5407d4e9a5f951ef4bb86eaee25d104e752eb2df
MD5 37866ace0f1b6f36548840428c3f5e9a
SHA1 e33353b3ede89ec798c493c84f1628e9f6b3f389
SHA512 c465ee3865fdf2155b70227862bb7e76e6a24eef7ea4d38ff78e7cf0ad0100f5644baf1c9b9ba05f4acab60cac1662c1ddc9da509f6264e47959f78a4d2a8c2e
TLSH
T1D7016557A350EA55E02C8E3B1ACE9912EDD57E5F4165820C494CF90CA03A143BD0D392
MD5 SHA1 SHA512 TLSH

MS8_8.png

SHA256 32fa37ee459f5c9bf7c45da1d391d61b181a185aecf1d376230819f37fe44f31
MD5 3846a3c66cded3e6d691f8dc3e47c62a
SHA1 3e9127450a24a8ad1ffc38eeeb4efc65c96c3db0
SHA512 ec6a963251cb6e38372056b92bd7b03cb379079efb88419a76c33df8a9b8fab963c26df8ba65a84d41a886d91f51488085e45c6fe7aef583382390b394be1026
TLSH
T1070165C2F02E5C31DA4546758309FC1D6B538FBDEE8361A9E689389D00BC14AD0912EA
MD5 SHA1 SHA512 TLSH

MS8_9.png

SHA256 ce0718b4bf06c727765d1a593d70d96d54f055b3aa8384d8663fdc95a2b71c62
MD5 91635c9ab520f8dc9adbf1146f56b5f4
SHA1 97bf341dc8f2b0b92985b27c29e8d51e8c97be72
SHA512 fc6b03949ab377f1b5874fd408c2f9da7cfc473af6de8b38b62cf5632e9c85b7ef92d227a553c0adece6c0a97c78ccf32fadc7bd5ead5915d7a09b4b615176dd
TLSH
T14C016A9E20E192378519449D5307E1B0457C2D5217DEF476C775BC2F607E217F0C0754
MD5 SHA1 SHA512 TLSH

MS8_G.ini

SHA256 ddbf09826472c84dea57087df9b81e784a6775c6985e45ca83166101a7112de8
MD5 9c2e1c02a96f47778f7495d99adfb007
SHA1 76bd8be3da661a6ae43fe79f1c7601bc394b6ed4
SHA512 b754f049202b697b9b2a5ea4c4134b0401197d59154abee2b44ade87fbd6f3521f92eb938350abe9da66ea59dba89320b3afcad32e743c0e585609a35dccad47
SSDEEP 96:qEEmu8OBHgyoqlOU9FJLMk4z08DSt3/3G5XhrlXMKy5XXcTXh/3XK/VXNKEXoTg4:Lu8SF9N3K9FfyxsrRHWV0eAyURn
TLSH
T189C1BB5F0B2534DCA057F07B330A88E616AD046BC4FEE8A5486F08DD691663867FB9C5
MD5 SHA1 SHA512 SSDEEP TLSH

MSE.ini

SHA256 d7a9ef3712b81d4b0bc6f5140ff278fb323c94430b0846a4c78920105243cbf0
MD5 48f522e214adc4717def49388aeadf79
SHA1 6b698bf347444bf07efaae9b3b37a2575eedcdef
SHA512 9b179233b0840271837036f3e4ebcc750c42c21c846b1eb299fc33493f6f4ebae399fdf07a8b77cd8ecb84c01d4c4a6bf87f222a04ac9d81b1836695d74e276e
SSDEEP 96:qOITKFa2iRMTaac6cezRRsnFWyKlG1J9l83ur5hO5NCt5oR5VX:WWsAGT0uF00/Ql
TLSH
T10891A71F1B7539DCD457B53A734784A72B6904ABC8FEB894241F019E1B20A386BFB8C5
MD5 SHA1 SHA512 SSDEEP TLSH

MSE.png

SHA256 cfe0f506a5e5dedc90f3a544a74188b6ab743df8fe49da41c9d82b80367eb37c
MD5 49edc52c50f657e58105c9a87a3674ee
SHA1 c91c4ae04e8e841ae1ac026a36d6c02f6e18a5e6
SHA512 8e7383a53ee0c8538736310eeee78df96a8cef3b1c3d4864803703b7f42740ac87e455005bdf334adf883137035f1e81235fe7407db558de2d00448bcf1dc934
SSDEEP 1536:TjghwLwBPyEBLRBJe1rPu+q6RoFNExu+oyvMKDqEytWyT/:T2fBPPBLRBJIrGymFNEx9kAy4C/
TLSH
T1F263E050EA3DBE3B59D96CD93E9BCCED2E006495AF5F86819B809F10CDCC6863D001E9
MD5 SHA1 SHA512 SSDEEP TLSH

MSE_1.png

SHA256 5e7d9754924d461045b8c5e18195ac4721ca96a2e7ec5493ab27c236985cfc70
MD5 03e100b663f1666041a1d4df586228c8
SHA1 29a492dd29d4d070269f093ae933cfb77841f1f5
SHA512 f8fd1ad16ffba92a13c6f545fa7a9c94e0a354cf30bdae92519cda4e8de4761e171c42168fc8b786286a3c0611859df67a360890f608d9f6e6a54058aed8076f
TLSH
T11E816CE102EF51093E7AAC0426BAA8C5C1948C1D2CF115E1908CF878B2BDE6732F526A
MD5 SHA1 SHA512 TLSH

MSE_10.png

SHA256 daebc75e610324c13f81845cc27755c4b85687960aba5ecac0783407ab492005
MD5 13bd9c0ea52950d5194b701fed625a63
SHA1 7240e09d0dcd68857454df0d14737ad2dd57e2d5
SHA512 7a91616e6f5e82753de3584c6d1e4c402672d10a16aba7ad09b0df144ab8cfd054e42d69abc98f0fd70daee93fb9408ca7566e7d253abe5cd83cc19a07b930bb
TLSH
T1D8219392720B992D688FA2B9238A1484AA7B3D1ADC28104EE8047EA4353AD98E4C0F01
MD5 SHA1 SHA512 TLSH

MSE_2.png

SHA256 b4dc3b6dbdc547c374c7f9acb118dc2f50399514c1ff715f213ad92ace24b684
MD5 2fe28301cf8966f81a05790d4e4e6eca
SHA1 ff0ef57e241843896e527e2e545e1e06176bc028
SHA512 b422bd8f2fd79c92be76b6c033f75e1bb95e71de8ef259a6ceb3dfe8e7a380624e0899e3c4cc6aa7c8e3d842d8941fe02d2931b3c4d4b6383ea3247e2565bbad
TLSH
T12221DA6190B215168F0BB9A137C64EFAD8744EF63C4540956208F54DD63EB8DE016EC5
MD5 SHA1 SHA512 TLSH

MSE_3.png

SHA256 3a2ba30486cc8588a41a16204fb6bbd63659e0e55a7b919179298ab1b959e5da
MD5 9fc5950086c8f71b63e0852ae2e58eb5
SHA1 6ed21c3cabcd0c8b3522aa291d1f898175f1a50c
SHA512 9a03a63447801d4bca19431615d385fe268d49cb1f8d76d5854c8c3edcfc68769a66525b925c8703064d6656391193eed27ac2a53da039589ae7c3fd6ca0b408
TLSH
T1B721C5D334780C1DC68728E942A55F60BC316E9948437B98AA3CFE3E20B195A9A477D3
MD5 SHA1 SHA512 TLSH

MSE_4.png

SHA256 cbae8571363feac44160d07de7971052dabf6d3e182f42c6bc461de65d4b974b
MD5 2a7621d83ed9c7d2ffe9032e84d76937
SHA1 8b0c893f75f4d00e6d9459da03a0385835388b1c
SHA512 a87b81f94ba720b198a8f1f722950579c1d0b97851ddd0bc44e813ebb05c9eba9422cc9fb2e7e076e894b8cc99919a329b6c09a9d0c2ff1058598b3306351834
TLSH
T13121A77916926C60B349D8665B1F229F6895CC09E19BA308519CFC2110352814726EEB
MD5 SHA1 SHA512 TLSH

MSE_5.png

SHA256 8bd1ac0d31b67e1e473c367737f26bed89ce981f43b88a354f172d2deabe7cea
MD5 b03d902fcb14f45a39588e06a7ea7f9c
SHA1 ffd77b941ec4d88980c2de7af3a98f2b4f8c81ff
SHA512 4d053d2b65d97783f832b260e9ba5acec38604e17364e279beb338fe4d3edb2e1ab88ceac4d518ee0ca03432aa1680a82012f42408744ebae56ff0300a60ad19
TLSH
T17221A5DCA0FA3D3FC0166C51693A517849D90D1844D26204FE97BAB007374B39796995
MD5 SHA1 SHA512 TLSH

MSE_6.png

SHA256 a61223910e67bf775203e8bf68bf803c9567739e11f69804eb541c59a94a2933
MD5 3556f300a698daff7238e2be9cf18b5d
SHA1 0cfb874062632ad87216fda35258b7987bf388ff
SHA512 f6f97914ac8bc2f2e47e997ed1e924f999925e14ab72ebbe03a9296fb16fad5a00dfcaed0dfca67187cd1fe4a4890e3069c44ddf10c48246174c60f441c5515a
TLSH
T17721E7E73288BE64DA9CC17510D3C321CCD1ED782AF4891D502CF4BB9E7D0A8B222263
MD5 SHA1 SHA512 TLSH

MSE_7.png

SHA256 47273efe143dc48ffe13001bbcf66e544cc3f1584590d01c1f13aa140d060744
MD5 aadb9c710d90d0d3b5f235b9020495c9
SHA1 18330bb1c360a3a25d29c33433f95351c3af1f09
SHA512 9385524af898bf671f4f221159c376e484f53034cbf9d6ab633eb0bd041f8f2de799eb9bdeed113826d1fdf4fe0ba24c3c5b19a6639352a560c88797b5afe79a
TLSH
T19921B73052B2E2F9853BD19F33AAD4A664E00FF94BA24D43213ABD1542BA2003415799
MD5 SHA1 SHA512 TLSH

MSE_8.png

SHA256 d6d4386b815d221d14f30efe832f201002d74085689f58f6bc790d93b1c74ce3
MD5 cdefa7cb0b4bfb5fd2bbae6beaad41a4
SHA1 4017bb0f6d37db3c12bb55db3e7733a4b5e06e08
SHA512 cec500b493d4bdb6207d9375ad62417a2be23d48829e71d290aefdd27fbfd4a15faad184a866df71f60529e0e741e8502b63e01c623699d558a2873a85aaa465
TLSH
T145116376B90B7969E84543D1BB1B2E0199304E7508F34E9C82A874234AF957CCD16BD4
MD5 SHA1 SHA512 TLSH

MSE_9.png

SHA256 b9d03b81749663e74f309cd2b0128a5de6c6ea884ca3a48afd78ea23849cc76e
MD5 298aee8ebd545cd7a6762456b360bab1
SHA1 a90d36fb1dfaeedd15537040790b564b85b31c4a
SHA512 0dab82fb487f6cbab232cc1845b6288ef99f92415c9d559e71ceb43accf0e35b2335c78b7f0a6c360d077e9e1c3a6d2bbae798a669dc25395197b46f2536fd5f
TLSH
T1D031FAE170CAD65FDE7A15A07160CD040B6E7C15363B09074667F838957767FE104C27
MD5 SHA1 SHA512 TLSH

MSE_G.ini

SHA256 df28c935f0625d933a340bebbd686a21d57da94ebc949c917173718ae2799aeb
MD5 1c524b7015ce78fac21d5ff64f174037
SHA1 370544d5783491408a064a1f6c300953cee6bd33
SHA512 7a8b44b58429bbed9a04299a10594f64202949c4b18a097b41f7fae9e8dadb5ddaac4e62ec47ea11d87fc833aab0e3e5d599f1bbd931bac9aae13f16a6008eb9
SSDEEP 96:q7+SBHGBld6vSu6FTuojMKaHz2RsQGvkJo6tGs09lLEhM7eEMp7eEXFp2EKGpmES:AeuIsB0Grcmjkj1JDttaeddqU12
TLSH
T1A7C19B6F0B2535CCE192F12B374684E5276904A7C4FEB5A0286F049E1B6167CA7FF8C5
MD5 SHA1 SHA512 SSDEEP TLSH

MSF1F.ini

SHA256 f89a5db74fcd53eeed3557dd5e1a5a1b9a844bef3a1ecbbd0e9cb846ec659082
MD5 ab7e553420fc8008e32526628e6f7534
SHA1 1d39173f8099ef59626b852a1c2b34722f151444
SHA512 ac3a47711b25ffcf51b6ce4b74f21a09268ffa21dd51dff971bceafb57e71b9807fa92a3daf272bbc6814d6928361573acacf7b02cf909dc58759560da1cc86a
SSDEEP 96:qxzbHBtPsoteJhqFoUykgMdz0BYLHlNiKMbDKXzgKh+MKKIpKNdjKoANKzvxK0S+:WYnqmUXzLFRs2jxMdvYTW9MjAekwF
TLSH
T1E9C17A5F1B2438DCB447F66B370684E6262D046BC4FEE89449BF04895C616396BFF8D2
MD5 SHA1 SHA512 SSDEEP TLSH

MSF1F.png

SHA256 9470a1cf8baf775df9f7214d755a95131af9845a0bd2696e54d987b9ce87a648
MD5 3452fdfcf6aa4037008a060afae3cdc1
SHA1 517c75f9937bff0ea0ccfed6bfa8e6e0b4a88872
SHA512 a8cd359193a4737c5d94879431e475e2c5d2783ff17f3d1dc7f8e2f677ec5c57d6754966d11c8a558c04f1de849103da70a80c3caed44da2a574992176241c1a
SSDEEP 1536:sPZt1aQnVU6FbnbWwjHxF1sj7xqTgSOqS4ihwZr:sPZuQnVU0bTHPSVqTZshgr
TLSH
T11B43D0E4D1B7313D7AC92D0E7D62E6AC5A884268CD0F5B305B428E19B4AD7C3BB2D1D1
MD5 SHA1 SHA512 SSDEEP TLSH

MSF1F_1.png

SHA256 34636ca6f8be51021d0265cf5c671250e1f80e2899b4acc5a5e47a677702a8e8
MD5 38a2b03dc0bce46607a4139b5c60714e
SHA1 645de5d8b9e40838055292e2d458acdeaa5f2e95
SHA512 6bba1f3210ba815cf937371472467d977b9be5ec1bfa0aec3e363a46939b76de6a16b8b965e557a42a289bb33c1edc256ef48c35a9531a1aa560de9bb8001a95
TLSH
T1A721F8862B3615C0CF5208D047CB2B248A3A7E2D08878DD86613FC7A4CBF79DE54158C
MD5 SHA1 SHA512 TLSH

MSF1F_10.png

SHA256 4a4844f31b0147f0cd50668c4dacd44505ada5351772f6a7818beeac8607b03b
MD5 0c95abdb2284775517987e8d64157f73
SHA1 bdec485a0604344c50c366d2f4673b0e52efc301
SHA512 11fdd55b36c36d4e27a0896074ae1c0ef08c151522c469237d7678f82e4529cee04909fcc508f30b0a261dd95eace9c9301bdb506f2b3211201d1b859ba1faa1
TLSH
T1D3018611B714A188D61A84744A624D53C8992CA85FD045FE6CC974125CBC883E02D611
MD5 SHA1 SHA512 TLSH

MSF1F_2.png

SHA256 8c135a3ed0af4f79c2f485f384a3c69367cd8e2c2731decbe100ec6ad690f84c
MD5 b3b7e58146bda074c4710542ad4fca16
SHA1 3bc0d28863817226fe132ee1551061b431451907
SHA512 dd23d4f402d2103a5116799e4c0e6078833edf1041f86096623996e81d34475faef2462625133a2271c4767f2b503e94ef890e83bdd931444b6b1a3b00da34b8
TLSH
T18521C6B24ABCB681968584CE4DC593ACD3A30FC76737022A216CBA013CBB1808AE9245
MD5 SHA1 SHA512 TLSH

MSF1F_3.png

SHA256 530118c41fa694172b135acf5d0848431b4464a5193b29ff1573994aba69592a
MD5 a399972e01b79dabdd06f45b83492078
SHA1 1433595e6f44c1bb1481c6e0428aa8ecef3d45cc
SHA512 43315dca1f85a58ee34f3e1f5c7f6d3d211035ad08cab2f185287fd815fd0600fa1b1a3492a813a833ae1d0e2189a541a2a0d47ae67cc129b4d6ea8eafd68733
TLSH
T1C811B3C3C20A2CC4CD4FCBB22F5E541DAAB02CEA1E510B51641EF9201474242A8F0AC0
MD5 SHA1 SHA512 TLSH

MSF1F_4.png

SHA256 f19b6304143805a136324896e5062a9481d6a787ca24db44f0acc3b94e1c8ed3
MD5 c9265498630b9609bcf4fb394cda1501
SHA1 342cf73625908beab1e95a9e7b1bf877b1deff7e
SHA512 8d3e19eafe3f4d0d190a8c74fd06990a75ead8b52056a0f7f6233fb923376f943460adcf4c2fc05bf6c4a90e010a155d35b8104e34ba36ed31e22a67ac859601
TLSH
T122F0B7F47660540CCAAB94B8A78353B856718E712080730C622FF876B83EF0E9F413E1
MD5 SHA1 SHA512 TLSH

MSF1F_5.png

SHA256 3ab78a74b7820d43252f60881e5569643c7119930d7cfd57f3f580f4b2d168af
MD5 77bc008848e5e5cc9a27f7fca3e1b7d0
SHA1 42f2d0c7f6286acd2cdcef004bbcaef05cbd3583
SHA512 974c33c7df4be6946840c06405e99cb0912cfbf42a80d3f2f51cc81364dfc9a2bc6096fa1bd54f2ee08b3a6ec23fb7b0a70d74823e0506585cc1188a9417553c
TLSH
T149F062623AA18234E856E1BC8332A7500A2E4E014176004CD89CF6BB0E7F1F3848C247
MD5 SHA1 SHA512 TLSH

MSF1F_6.png

SHA256 ec52abae3eddfc4074d35ddcdf422a915572a9e7c870d720f1051b627d79596b
MD5 c3deaa2904f2acedfdd7650665088194
SHA1 111ab1056c3eca563557c8c16a4b3c361fd4a4e1
SHA512 d3d112c58bdfe5999900bcc09d0cdb58302845d5337c8ea881aba218e9819e33871e2818cf2bda009fc0d50c54e6822332175ef5ef74f223d91d5b6e269d73ad
TLSH
T14811C8A467EDAC42C6FF7F1446A7C8003FDA0FC14798053652983C21507E0CA41317B3
MD5 SHA1 SHA512 TLSH

MSF1F_7.png

SHA256 4c86a3eee3994061f52a20768ea6cb99ee95d814e264a738e5dbd2d369926c43
MD5 9c574212661b4cc831bcf3ae80e55465
SHA1 b1ef9e688e4469b7767c05e42762e0cc30bd986c
SHA512 04a7d50ea17b8d8a38548b6dc64fd91b375e8b7998659ccaaee55b7387d4cdbf1b9472def4b34f64a164b4dd4d6cabefffebe002c2aab202fe43663f474042bb
TLSH
T104018602A4796C11C8DE986BA3B7607C783E0E553E4A47C6ED07BCB2B0301528335F68
MD5 SHA1 SHA512 TLSH

MSF1F_8.png

SHA256 9ba437970712560e0500e75cd3238ae01a740e15747b7997756d74670a7ce31c
MD5 932e7ab5e585e1dafc764d6e6f6ad357
SHA1 32d9e8365698d5ec580bdfc11749ecc4e3d0a06a
SHA512 48864fa61c77c6468ec4320999319ce85178bcce032f2c1e12df06824a0e6222e78615627b2fcf4564d1b65ebb18d4b669dc599fc2824f256c2d6f0d9bf1ba9a
TLSH
T1401156D0F2E06608AD560B57034D0126FF85FE9562BD1D24C4AE7E790674B46C87A352
MD5 SHA1 SHA512 TLSH

MSF1F_9.png

SHA256 f0b42b5997ec7990dc1029d41f3ccd70552be9f8ddae1b26189d799d831e19ab
MD5 21c3aa26cb1f320ab680b15ff81f7eec
SHA1 6aa2ecd7bce1dc03d89b2429502db462d2cc1f1d
SHA512 c54e4624e8cbc0e5c86f50568eafc5fed14c7f2537c84ee57db54475aafa2e0600df17bd2f59fbbb6e1775ef5eecef5ecbe2db223aa3de1b25688a23fc093884
TLSH
T1310165DB34877C04D4664076564538754C6B9EA93C624D9D842EF47E313B3864585692
MD5 SHA1 SHA512 TLSH

MSPRW.ini

SHA256 19f038343e258c706d6aad9fe4adaeda07d3d0bf98f5fc8c49ded9dcba790e50
MD5 d85325278c3fead60703571047962d46
SHA1 ae33c1544836af9c21c8e059fac98a2c30ef03ec
SHA512 6035336a65f60a59baaf26ce01a763fb3b90aa17233861a69959cd29758705ed5921e866e00ced92d1fcb2d2f699a86fbbc12117cab6cd42de279b5c189a7f7c
TLSH
T10981DE4F1A2A75DC8117F57B338B80EB27A8057A8CBDA8C4585F06C91621A3467FFDC1
MD5 SHA1 SHA512 TLSH

MSPRW.png

SHA256 f68ec92cacf935c1cf509c1620fb91b4fb1207d6bfbe2f6aed8268c8586c1a1e
MD5 f4c6f2e296c3dd63c913fb4ddf2ec663
SHA1 7b5249d60a438264f6f48e1fa9ecd1ee1a361dc9
SHA512 6dfe0aeae9025abcecf58805002596d59c91a5296b2430bedda428186cc14cbc9f3925e66acb6d71f4c909ed59b246a6e0a9fafd6e30712206e3320eef183ab0
SSDEEP 768:B+qLBhIIQux4tAmYSvu8UrUE0towbKXd7JtdLcQudrTU8awItckc7G83qbgN6ySE:BVhhgt5Huazqd7zJcPdivc7Gtu/S0rl
TLSH
T12833F18AB1DFCB77F96085EB07738AE8119B7928167FABC1D381F4DE91027D11181163
MD5 SHA1 SHA512 SSDEEP TLSH

MSPRW_1.png

SHA256 5cf65277377a247c5cd28ac8efe56ca72e0cc6c139a1eb37dee0c993851f4855
MD5 a34131fb573d9fbfd13a2382d7bc0ca0
SHA1 a74c02530ad0255b997c55c686d933db2bf841f1
SHA512 7047dbba1aad635a0d02209a2e1e2b70ec4f08f76c40fa4f63d271120fa469ade6c720782bab3fd94d73af1ba6452ef65a774e62c136f70d77090757efe78cda
TLSH
T19F817D86F07CE3B5B893A8918646D01117794E2ED62FC9F56449B0563172B49CFC9A0A
MD5 SHA1 SHA512 TLSH

MSPRW_2.png

SHA256 941f5e6d8d8bfa6e5eb4c3caeb5ecf11a399d3e76d3f689d3abf8912254c9aea
MD5 19ca01a49090756388201845fe57bd0e
SHA1 3966fe344f398b316a35c2b9dec5f63b186a71d8
SHA512 e2f2bcc7113991e0ba0df1564a0f51df8a5bbe43cf9f7aea38002853ec49b08147ba376d59f299f2ad0695ba4ec37347ffa42b634f3c7b44bc51f227d4181fce
SSDEEP 96:cu7J7zzV8ZHCpjQiT8bNgPUNbQ42cB3BT1lSd0JGtjXd2T2nCVTkNTOZme6V1H8G:c67zpqHCOiT8uPUQey7t7d2injTox6wG
TLSH
T16AC19EC8B102FF7C644CA1D35DD15A7E45CC4CB41F965222898AB00B243B34AA83E315
MD5 SHA1 SHA512 SSDEEP TLSH

MSPRW_3.png

SHA256 f16ca151cadaaaea4af0f69a22f0365d3d21a5517646a062b733743ee033dda4
MD5 3da1b9efe546bcf4852c2c9d35ce6d94
SHA1 57ca7021cf1aef935bdc6ae5c54eb43a03229fcc
SHA512 80c05e2565d8c7687cb113f9c480d4ee208ec530d5fb54db1f6cb2c1c9fa33d8e57410c08b9c6582b64601debe3d8efaea300d4934ca9e207005a4e885f96070
TLSH
T1BF3119C723468819A74AECF28694C405F8295E57392500BC69F2F4B8E23C40092D12A0
MD5 SHA1 SHA512 TLSH

MSPRW_4.png

SHA256 64d5a9fd45b00f61f7ee6e4a13833f3488dccc7057709cb7ad1ca0c9a08ec185
MD5 21cf1daa6815a81825132c72f315d40a
SHA1 f8d8fa8f29200460733d971ae7daa2705a5b7dca
SHA512 20ad8c266712a1e66d34961f5bf5d9e29adeeac53763da9461eca0f26ab6bde4eaffa5ef9cdb879d39fb683f29e7d24aa9c24690d26eb3a968beaee1f0d872bb
TLSH
T1E321B8EB7D5A4C34558C76B92B3BE400A8554D4FB65E1D641C677819107C70378923D4
MD5 SHA1 SHA512 TLSH

MSPRW_5.png

SHA256 afa5bc7c2d947a3aba249b0f21c2e54ba27fb7ee9a1c81f8d6ee8084fcd84ed5
MD5 4a21aa9e84757af80171a759f2cb48a6
SHA1 920f111e2750445b8422fcbca51ba9ae06a8be85
SHA512 1fc604f5ee720de1de6caf9f8ae71481fb5840ffb7fbaa2f6b4d570b6c722451bbf0bd6351c231187cd782a9418038840a37002ea0ecb500dac739cb7a40fe64
TLSH
T16921E9E9B125D37E0C9260B6E34FD95606010D8D06EA841230B9F88487F5D15FE16159
MD5 SHA1 SHA512 TLSH

MSPRW_6.png

SHA256 6ea85e9ab7fe3041d3b01e7c2a41e414dcacfa9f20f1cd17b55626b16a03563d
MD5 8d5e0a32596501dadfdc8cdb3b5c4ba9
SHA1 e32dcd716d2bd0e05a67a1d7631d2e0e18a1bbe3
SHA512 056cd43196f4aa161119686e80bc8228c49d25d1ce409970aee14164c210a9da3d3d61b57d28c98c6524b227fe24bb58ef2784c76c04e81858a4ddf68f8ec56a
TLSH
T184212BB4B9A5E97C51EDE300402BF0FA5901BCCF4D9D0818409675B0F935647CD34F01
MD5 SHA1 SHA512 TLSH

MSPRW_7.png

SHA256 fcb8091f68f51a0a693359442384be49d61a585f99d9632fee6ef017bf78b1d9
MD5 d3b8648ba452365bcd1fe541ab3e71ba
SHA1 4a3e4955ee1c8adc0153556664852bba1c7ab888
SHA512 481a3ced2f7d0a5dcd0ef55c9e952856c877a77f263dcb73a59dbadd2679d905eb811b43f745db26b6a12e7e72d8a57305f98795a924ac7c1d22d78ae0d361a0
TLSH
T136311AEF77C224E5904F8914677130500CDECCAA874544602F2EFA4A9A78932890B498
MD5 SHA1 SHA512 TLSH

MSPRW_8.png

SHA256 e51050e4613e8ff833a094261ef6a763cdbb239b0cb65f9152cdf9af59d8c8c3
MD5 820777fcee84475f9965fd725ccfa90b
SHA1 e01109482e593894b26ba69bc9fe637e85c98c48
SHA512 947242c293e8ca2a6c4d05fdda9ccdd762a3ad4dbeabde505341d5ac4878b211298ba1a9139b6cb2cc0c5700495b157fcc18b277ddb71ab237ecab7f8e1d6385
TLSH
T1BC31E6AA7E9A2C63C8091071A4131EC87A39FC1EC5F0F80771AA31085872FBF064DDC0
MD5 SHA1 SHA512 TLSH

RaiderPD.ini

SHA256 dcc3ddde656f2f776569771aa74be69eddc5fc72ddc8f0edc036efdcc1c3e3cd
MD5 067998ce27e135acf653abe6e1891a46
SHA1 47ca350f7ba06f63186a613fedf862944c4f2a5c
SHA512 c444a082530c1241d633c43189d754bee7bae730043a39873b668950982ea7709847b71a65d3fe51ccacee55d80047a6e74104805f80b09502e056c163c91857
SSDEEP 384:gCTAqAT0Nj1djjSASgv7pfDTrFjUjAjWj0iHMAjiI6AxW6+qCGYcGx8GRClvXqvk:HAqo
TLSH
T1EFB26C7F5E6A74DA7A45E47F37C6C4E2682C14A2C0BEE942154F0A8DC94903687BFBC1
MD5 SHA1 SHA512 SSDEEP TLSH

SV-262E1.png

SHA256 56722850f46faccd86f27a01662a296d940d8b7e013867f66cfbc68019c3cd53
MD5 0e6993d1f4d8721fc3d3dd761730632c
SHA1 7348b5e71fbeac3d40c4edb770626ae6dc3ae2b5
SHA512 4fc0e361a9027f4bbefbb1a419f7a19b3bbcc1b8e79818bb7c286e7b5f2a1a53c6cd460a4601663b6e203a93e005a6b0c61b74dbe1ef39918d7da5077d568658
SSDEEP 768:U6Htxlds1wGKLPRlZ73fC5N487MT87WI7ngcasV/8Q7oV/+cnE0ovxpnxJVk98LF:JtGaGIL9Cf48oISI83sJRC4g8LxD3n
TLSH
T16633F1E3C1E755E89686C0ED7ACE0FF5677D39D897CC28990B406BAD58C0B814A93383
MD5 SHA1 SHA512 SSDEEP TLSH

SV-262E3.png

SHA256 5c17d224f226d25e7fdb447cd0baf9620d1329c700b3206845ae93a03ced9523
MD5 6ad87fe53aa23c9332758a88d41bc77e
SHA1 9e26d20a9e5ae9ae6e13cd9fd6cee2df136f69f9
SHA512 2f3b5129490be7cfb2f599a9fafca67858614f070fa535d460bd8514a8598cf41c548059d57adeb144d18660ec89629ddb2445a0c80856eb798388065491e9c2
SSDEEP 768:T2M/xzjIQuvy1fL6Z/5jyXZzKmpyVfMRbVa1eFOXjdKHeqqx1OdWV8v+DNl7Ti9:T2kjZuvyJL6ZgYm8p1TjdKHTqwXvObq
TLSH
T1B233D044C26BD8456B1562BC3B621FB1D77F382853391C8046A6749FE8F9FE8A243C97
MD5 SHA1 SHA512 SSDEEP TLSH

SV-262E4.png

SHA256 90944797a975e857f69934758e85cbbe258a7bf54be1d441e30e6f670d793f6e
MD5 bb766076a2ec26491323c5d3f38ca479
SHA1 d4a228493f1fb62b1aa39ee3a9bb3af9616e762a
SHA512 610b19b6b77ebe6beec1734f06fc8efc1dd101009bcb86dc859d98a9dfdefb82cac146b7f272231d6295e551850dd8706bf6ca065ba344d4c70f03c933d9494a
SSDEEP 1536:W2UzjPoLAd7WEqBnV+8wLPPa9+tiWY5FGg7ZNhjxxxCU2i:WNOAIEqxjw7Pa9EaVN9xxxD
TLSH
T13B9302E3832C2A60BDAC66E77FAD65B38774903A2113B05B300E60B64875ED857F9761
MD5 SHA1 SHA512 SSDEEP TLSH

SV2511.png

SHA256 4bac16344f6761b442acdc1e53debeca0679144007311bbbd3a047a4cc5302c9
MD5 c2ae4c3ba0ed3cbe6140695972c94c87
SHA1 bc22bc1ffc3b055f138e4317cdc1b17c063c649b
SHA512 15a217edabe6b71d4875ab2c2d366c3e71e746a08f724d73703f6c6cda311303e54d4e5dc32c8ccc7dcea3e188d65fc1632571aecb89257ba69a77c3f494c214
SSDEEP 768:eHX13Acz2+1AV5amIi/SVJTQpuXT1Iqb8DidlB/rfNS5:MXB/z2Frx/8RQAJ9bDTVbNS5
TLSH
T15F13D087D0F6DB6D33DE80F667720F939ABE1C5D544E25F78144A68F68266E168002C7
MD5 SHA1 SHA512 SSDEEP TLSH

SV2512.png

SHA256 e2e4db6858829b1f3bb0f006b3c7f009591f31e10770815b8fc95f1b2d9c805e
MD5 08b87000db2f990dfbf2d3a7572788fc
SHA1 42f00690944a7bc9eabd87c6a8b16a3727bb3dce
SHA512 b9506a06cf32248402175aeccd10475b9a97e1a457292abd815b14c92997558f88390d45e88a05117b8160d6a29f0a8fe7ce6a10dc9528f2a85917374d9e8bbd
SSDEEP 1536:A7MfDX8dI2Sjsi/okFhEddM48U9WUKePLf/pFeemikA6c/WXJE:9j8dRUrFMdMdSPDp4vi1z/F
TLSH
T1C093024C8AB2E698CC9D39D12A27AC83D7FD64E34979F7F5D188146E5406B71F09208B
MD5 SHA1 SHA512 SSDEEP TLSH

amstream.dll

IMPHASH daa0a1e803cad6b878538c4dbd14c8e3
SHA256 a08fcd2bb4d5c7990ccab8ea1a1bc6c8aa33c3edda59cfe2d8c082044a59ebaf
MD5 ca66998db59bdb94f2f277767d458f19
SHA1 f47b14dcebaf1ad738cbf6cea75cbed618daccf5
SHA512 f10f9a9b35a77f7ff83e035c7897baed8543e193c585c3dd03c33a23c9403ad388fb802a60e04ef01465c165b6b935d7a888098215bfdac86415a7d794442afb
SSDEEP 1536:ksbwOSm2mkN++/Oi1wlA3yB+SEcSH47J:B6SkN+MOiOB+SEcSH47
TLSH
T1AC535A0333EAC07AD6E392328D263B9E76F9EF06151B510262123E4A1F71146DBFE647
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress TerminateProcess QueryPerformanceCounter DuplicateHandle CreateThread MulDiv ReleaseSemaphore CreateSemaphoreA ResetEvent SetEvent lstrcmpW CreateEventA DisableThreadLibraryCalls GetModuleHandleA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary lstrcpynA GetCurrentThread GetModuleFileNameA lstrlenW lstrcatA lstrcpyA HeapDestroy WaitForSingleObject GetCurrentProcess CloseHandle GetLastError GetCurrentThreadId lstrlenA WideCharToMultiByte MultiByteToWideChar lstrcmpiA InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection QueueUserAPC

user32

IsRectEmpty CharNextA wsprintfA

advapi32

RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegQueryValueExA RegQueryInfoKeyA RegDeleteKeyA RegDeleteValueA

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance

oleaut32

VarI4FromStr LoadTypeLi RegisterTypeLi SetErrorInfo LoadRegTypeLi VariantChangeType SysAllocString VariantClear VariantInit SysAllocStringLen SysStringLen SysFreeString

ddraw

DirectDrawCreate

msvcrt

??3@YAXPAX@Z _purecall free ??2@YAPAXI@Z realloc malloc

d3d.inf

SHA256 7107d8f5e9fd0688ee10f6dbc0c499f95c958ee4db1cc03539fb33b21ab2326b
MD5 4bfc102ea72cd8de226bb36afaa4a563
SHA1 ee0554b01602782c15da1d0579a681fa8fd5c975
SHA512 a6459225f711b7551586c462f211ed5c4bdcccd72d92005c51d6b95cc0520fcf8c8b9f48ca2defed39641f6640ec758596af63ea198154ff37f1b9720c689077
TLSH
T16F318B42BBB2F217DDA1432780836B27F1ED5693A45FFB4D1ED1070E890D8C867A748A
MD5 SHA1 SHA512 TLSH

d3d8.dll

IMPHASH 3c40abb96bb64c93687561630db1cad9
SHA256 7e9c769b083334a393da27699b88b876885ab28359caba3dca66b802078cd9d4
MD5 b8f8f9a01df46e2b59b6812b7d3a23e2
SHA1 2263cb2c9dcade186ca9bf0ac8c304e5881f31e8
SHA512 021ed46317a8a73c999cce54eab3b81008f86e1780192cd965959cffa0ecfb60f5fd91e6cd618fbd096e68edfdf8dc0eb07e221b655d17bf2288cb1eebf1dea8
SSDEEP 24576:ZsNXP7oCa+k9oWalp26TxwenjKC03DF7G7sU:ZQzTaVoHlpVTxwenG2
TLSH
T190458D01EBF740F5D8831670109FF7FBF3359B55422189A3AAD4DC2BED7A692A076242
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

146531

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

SetCursor GetCursor CreateIconIndirect GetWindowDC GetDesktopWindow GetSystemMetrics GetIconInfo SetCursorPos GetCursorPos DestroyIcon SystemParametersInfoA GetClientRect SetForegroundWindow IsWindow IntersectRect wsprintfA GetDC ReleaseDC LoadStringA

advapi32

RegSetValueExA RegCreateKeyA RegOpenKeyExA RegOpenKeyA RegEnumKeyA RegQueryValueExA RegCloseKey

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

gdi32

GetNearestColor GetDeviceCaps CreateDCA CreateDIBitmap GetObjectA DeleteDC DeleteObject CreateCompatibleDC GetSystemPaletteEntries

ddraw

UnlockCB DdEntry21 DdEntry18 LockCB DdEntry19 DdEntry17 DdEntry7 DdEntry11 DdEntry12 DdEntry9 DdEntry10 DdEntry1 DdEntry6 DdEntry2 DdEntry3 DdEntry20 DdEntry8 DdEntry13 DdEntry16

kernel32

EnterCriticalSection LeaveCriticalSection GetLastError InterlockedIncrement lstrcatA GetSystemDirectoryA GetProcAddress GetModuleHandleA FreeLibrary LoadLibraryA lstrcpynA OutputDebugStringA GetCurrentProcess InterlockedDecrement CloseHandle CreateMutexA DisableThreadLibraryCalls GetCurrentProcessId LocalAlloc LocalFree lstrcpyA CreateFileA SetFilePointer ReadFile MoveFileA DebugBreak WriteFile GetFileSize SetErrorMode InitializeCriticalSection OpenFile WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcmpiA HeapAlloc GetProcessHeap ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe SetEndOfFile PeekNamedPipe GetCommandLineA GetVersionExA RtlUnwind HeapFree RaiseException HeapReAlloc ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA HeapDestroy HeapCreate VirtualFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW Sleep VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery LCMapStringA LCMapStringW IsBadWritePtr SetUnhandledExceptionFilter HeapSize GetACP GetOEMCP GetCPInfo GetStringTypeA GetStringTypeW GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetStdHandle QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime TerminateProcess DeleteCriticalSection GetCurrentThreadId _lclose DeleteFileA FlushFileBuffers

d3d9.dll

IMPHASH 8f4408a5bfa9b84d8d76deadf603d450
SHA256 ee8838a3526f20444ae162f4a41acf515a366e6bb7ec59159b232c42778b9ce9
MD5 acddb9f4108d05f30306d7500d24768f
SHA1 5edb452ff951bb0c76476fe61532a40c38a7d48c
SHA512 b6adeb7249d5983140e6d6699da9549440dd9a749d66eb7c44db354ce5fa32725834f5a03c6b2e31ce51a6c3d9b7ec50433089d2a871494c9a14b372319592a2
SSDEEP 24576:wHre6NuuXD0b9zTjCogccFVHfUY/imNwnFiqRMuP86exYj6PJv4mJMcxl9Q7w275:wHrR3D0b9PjCAY/imNa8hxYj6PJv4mF
TLSH
T13B759E42FABB44F1DC82257014AF777FB238EB0A47259AC3E6E0ED649D326915037297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

319267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

IsWindow GetCursorPos SetCursorPos GetCursor SetCursor DestroyIcon SystemParametersInfoA GetSystemMetrics GetDesktopWindow GetWindowDC CreateIconIndirect GetClientRect SetForegroundWindow IntersectRect wsprintfA ReleaseDC LoadStringA GetDC

advapi32

RegCreateKeyExA RegEnumKeyExA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

gdi32

GetNearestColor GetSystemPaletteEntries CreateCompatibleDC CreateDIBSection DeleteObject SelectObject DeleteDC CreateDCA CreateDIBitmap GetDeviceCaps

ddraw

DdEntry10 DdEntry19 DdEntry9 DdEntry21 LockCB DdEntry18 DdEntry17 DdEntry12 DdEntry5 DdEntry4 DdEntry7 DdEntry11 UnlockCB DdEntry20 DdEntry13 DdEntry16 DdEntry24 DdEntry8 DdEntry3 DdEntry22 DdEntry6 DdEntry23

kernel32

GetProcAddress LoadLibraryA InterlockedDecrement GetSystemDirectoryA GetModuleHandleA lstrcpynA OutputDebugStringA GetCurrentProcess CloseHandle CreateMutexA DisableThreadLibraryCalls GetCurrentProcessId LocalAlloc LocalFree SetErrorMode _lclose ReadFile OpenFile WideCharToMultiByte GetVersionExA CreateFileA MultiByteToWideChar SetFilePointer MoveFileA DeleteFileA WriteFile GetFileSize lstrcmpiA GetCommandLineA FreeLibrary RtlUnwind ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA HeapDestroy HeapCreate VirtualFree HeapFree FreeEnvironmentStringsA GetEnvironmentStrings LeaveCriticalSection GetEnvironmentStringsW GetProcessHeap Sleep VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery LCMapStringA LCMapStringW GetACP GetOEMCP GetCPInfo HeapAlloc HeapReAlloc IsBadWritePtr IsBadReadPtr IsBadCodePtr GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle FlushFileBuffers QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime TerminateProcess TlsAlloc CreateEventA CreateThread WaitForSingleObject ExitThread SetEvent WaitForMultipleObjects DebugBreak EnterCriticalSection InitializeCriticalSection GetEnvironmentVariableA TlsSetValue TlsGetValue GetTempPathA GetProcessAffinityMask SetThreadAffinityMask ResumeThread SetThreadPriority DeleteCriticalSection GetCurrentThreadId InterlockedIncrement GetLastError FreeEnvironmentStringsW GetCurrentThread SetEndOfFile RaiseException SetUnhandledExceptionFilter

winmm

timeBeginPeriod timeEndPeriod

d3dim.dll

IMPHASH a8d3a8f00f292ed95b4bdd305d1511e7
SHA256 bb954af553a3cfcdcf4a561647dfd93e263756bcb11a8cabc659734ff59d04ff
MD5 aa2bce30745884eff2a987953098eb87
SHA1 55a202047408dddabc457eab60b0fab475231fbd
SHA512 91b2e1eee4bc8ed287bca805883c36144067d9c98d6dc3591358c8692f71ff82532dbac6fd7927f70e109391782c2691e7f5b3d43533e28b8ff1b62a5bf467dc
SSDEEP 12288:QrCzjICYpX+ulw/4ZDg8R0hAQS7KtTnrvg:QA/6nR0hAEg
TLSH
T16FD4AE62E9E2C0FAD8875B33844E373EB67D438686118CE38FD42DA5AD50F91712625F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

132464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

user32

SetRect IntersectRect

advapi32

RegOpenKeyA RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyA RegQueryInfoKeyA RegEnumKeyExA RegSetValueExA

ddraw

DDInternalUnlock D3DParseUnknownCommand DDInternalLock GetAliasedVidMem

kernel32

GetCurrentProcess VirtualFree GetCPInfo HeapCreate OutputDebugStringA FreeLibrary DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection IsBadCodePtr IsBadReadPtr ord98 ord97 GetCurrentProcessId GetVersionExA GetSystemInfo ord93 DisableThreadLibraryCalls GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA GetCommandLineA GetVersion RaiseException ExitProcess TerminateProcess DebugBreak SetHandleCount GetStdHandle GetFileType GetStartupInfoA HeapDestroy HeapSize HeapReAlloc FlushFileBuffers GetACP GetOEMCP FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW WideCharToMultiByte WriteFile HeapFree HeapAlloc SetUnhandledExceptionFilter GetLastError SetFilePointer CloseHandle VirtualAlloc LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle CreateFileA ReadFile SetEndOfFile

d3dim700.dll

IMPHASH e3f2a1829330babefd2af5f7f12637dd
SHA256 6651cb81c461e60dd323129d8c239e140f2589ecef2a09fb319de61f491e70da
MD5 2d6910b215d7b114d4d991411dfa9491
SHA1 6cd45c57ed207d08271d91d74f4cd1cbe0ee2d0a
SHA512 da172d2e31729f217c5c92c70eff8cfe35aa7f1f091f4ed2689a2b2b3616847f73d5776e6acaa1f980500e4b7524466ab90c57f1e21ffd223cc683525f82d6b5
SSDEEP 12288:XRXjYb+EgHeyO0VUV3bHnx95k7LDJrpXrXKkIFWUZZ+l:Ri+/lCFQ7LD7r6kdS+
TLSH
T1AF159ED1EFF545B6C9930531942F2FEF7CBE8302C45104A799D02EAABEB0B96752121B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

156379

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

IntersectRect IsRectEmpty

advapi32

RegSetValueExA RegCreateKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA RegOpenKeyA

ddraw

DDInternalLock DDInternalUnlock GetAliasedVidMem D3DParseUnknownCommand

kernel32

LocalReAlloc GetEnvironmentStrings LocalFree EnterCriticalSection LeaveCriticalSection IsBadCodePtr FreeLibrary IsBadReadPtr ord98 ord97 GetCurrentProcessId GetVersionExA GetSystemInfo GetModuleFileNameA GetModuleHandleA ord93 DisableThreadLibraryCalls GetProcAddress LoadLibraryA GetCommandLineA RtlUnwind RaiseException ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree HeapFree FreeEnvironmentStringsA HeapSize FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW WriteFile SetUnhandledExceptionFilter HeapAlloc SetFilePointer FlushFileBuffers CloseHandle Sleep GetACP GetOEMCP GetCPInfo VirtualAlloc HeapReAlloc IsBadWritePtr SetStdHandle CreateFileA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap ReadFile GetLocaleInfoA VirtualProtect VirtualQuery QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess LocalAlloc

d3dpmesh.dll

IMPHASH b3086d42fa0bf235e36f93dd418c52d2
SHA256 1836cc752212d28d6f04baef79068934f7c491f4fff3158a2a68aaa66c5d7051
MD5 7f022ac4bea9683713ac385de6fbe576
SHA1 b85ed3158152cd0246b5b28069032bcf904c40fc
SHA512 1f9957533a8fa164e376da76df7a030298ad34b90908453334794677247d08650b268730933607ae54041879ed8245719bac8005eba4eae1c1a07413340cfb82
SSDEEP 1536:8bkg97En8YgxLFatvK5S3McMbQgvPM7QEmb6S70TokS44sacYfxhA:YL9c6xLFaZK5S3MnbQ+E7QEQ6S70kkZ3
TLSH
T1A6839D81A99050FDD083533C59FABFB19BF95B5214394DCAC7A0E9295C722A1F63C23B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

40704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dramp.dll

SHA256 7ea6c441cfbe9a293437a3abb1ce33c4fda5c8c90c7ce6af382f45923451cc13
MD5 e506608ea77e42b6102ee5f7013502f1
SHA1 1f97b93e30f154e5412bfe24b1f758f69094fc35
SHA512 86d4dbd2dccbea6a9cd8a1f45ffab3b8ff72d6c63a55c1683120ce548dad7e9081a26adc61ad2ee0f8be5ba178f6b31d8b03dca379394a27d260716937a7e480
SSDEEP 12288:8KADAXXzqwzqBw9djYJzKjENIZrDaFn8eMrk5ZUa60b6TtXkeg48UToD31zckANW:LyZZlzJpKQyrM
TLSH
T105C4C7A30F89C969CC52F67C642C3BD3E8DD17226514B8DCB6D824C66E1C293F5286DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

CSEG

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

512B

Virtual Size

453B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DSEG

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

d3drm.dll

IMPHASH 7d187e631558c60627782494fbf69e5c
SHA256 7191811425581d47015dc2a8cf8d4b459df9dd15a22e592cc31966bb4030424f
MD5 cb72d672a72fea16395cc78bbeb3aa7c
SHA1 c0cb0c7f30d5a80e76f97dd967761e60e8b87d8b
SHA512 3941e8e4e4ecb4f0109f6084c8ae95b8e179c5517fb8c401f41d4ab82bf66ef832a12955b7bac9f5391476de1119a62d7e9923febc65dd3f1fdbc7794f27f211
SSDEEP 12288:vBT4xQQGD3e5CA68dd/n+lpJP+aq9XInHrBY:vBTzQGD3gCsdd2lpJPdq9X2rBY
TLSH
T1E3947D1372D18039E0535372899777F9FBBA6B123875E48FAFCC89591F60542622E32B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

334464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

kernel32

DeleteCriticalSection GetSystemInfo IsBadReadPtr IsBadWritePtr CloseHandle GetProcAddress LoadLibraryA LocalFree lstrcpyA lstrlenA lstrcpynA lstrcatA CreateFileA UnmapViewOfFile GetFileSize MapViewOfFile CreateFileMappingA FreeLibrary GetLastError GlobalFree GlobalLock SetFilePointer ReadFile GetCurrentProcessId DeleteFileA SizeofResource FreeResource LockResource LoadResource GetTempFileNameA GetTempPathA FindResourceA lstrcmpA Sleep GetProfileIntA GlobalReAlloc GlobalUnlock GlobalAlloc InterlockedIncrement InterlockedDecrement MultiByteToWideChar HeapAlloc HeapFree HeapReAlloc HeapCreate HeapDestroy GetCommandLineA GetVersion GetLocalTime InterlockedExchange CreateEventA ResumeThread CreateThread TlsSetValue ExitThread ExitProcess TerminateProcess GetCurrentProcess InitializeCriticalSection TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA GetCPInfo GetACP GetOEMCP FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW WideCharToMultiByte VirtualFree WriteFile GetModuleHandleA VirtualAlloc GetStringTypeA GetStringTypeW RaiseException UnhandledExceptionFilter LCMapStringA LCMapStringW CompareStringA CompareStringW SetEnvironmentVariableA SetStdHandle FlushFileBuffers GetLocaleInfoA GetLocaleInfoW EnterCriticalSection SetEvent WaitForSingleObject LeaveCriticalSection GetTimeZoneInformation GetSystemTime GetCurrentThreadId

user32

GetDC SetRect ClientToScreen ReleaseDC wsprintfA GetSystemMetrics

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

gdi32

GetSystemPaletteEntries GetDeviceCaps

ddraw

DirectDrawCreate

msvfw32

ICImageDecompress

ole32

CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysFreeString SysAllocString

d3drm.inf

SHA256 9c3fc116dba3efef31876ea2e723d2743187e8fdfbe57bb88f50326551563d3f
MD5 eb0cefd4463bdbbbcccb6f90e495c8d4
SHA1 d52b1740441975014e281f477bc8244dafc62ea2
SHA512 d6bea354da713cba950832541639be82646bd4e56cf8b0d734479f299223a2c97a6becf23d5c7afe70dd64a9b509d28aa4784fd90568ee1b759cf768d45cfcae
TLSH
T11A01DB43F3E690CB64DCD60956ED0566A14D3D34B0C9ACBC17A5C300940DCBACD7E583
MD5 SHA1 SHA512 TLSH

d3dxof.dll

IMPHASH 16b7e072dd7adabb232ed23a07e8cada
SHA256 497696218f5b348e7393485895cb6a49e934f0c6c43853718a96a264ba7df4b5
MD5 b83454f89f85d169aec0f731273325a1
SHA1 b696108e159b41d29603a5057f638f4167bb8297
SHA512 8d29370e46737c2ad3fffa89e18a0336b14f911691c968e357177fa545e8864d91276ead4e79e9b10f7d5583ec6e6f268f901e9d4bb7b893c27d20e8b0825a36
SSDEEP 3072:LQLziOcLGpgwjNiyJCyPa+fN7oWRXE/SSlWcUuY2z7+:zYg6iCCl+fNcWRXE6H
TLSH
T141B39E2178F290F2E011027D04E7FB729F3F5A615516CB678354EEA19EBE1A0A23D94F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

45120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId WaitForSingleObject SetEvent EnterCriticalSection InitializeCriticalSection InterlockedExchange CreateEventA CloseHandle DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiA lstrcmpA IsBadReadPtr lstrlenA IsBadWritePtr FreeResource SizeofResource LockResource LoadResource FindResourceA UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize CreateFileA WaitForMultipleObjects CreateThread GetProcAddress LoadLibraryA DeleteFileA WriteFile GetTempFileNameA ReadFile SetFilePointer MoveFileA HeapAlloc HeapFree HeapReAlloc HeapCreate HeapDestroy GetCommandLineA GetVersion ExitProcess TerminateProcess GetCurrentProcess LeaveCriticalSection TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetLastError SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA GetCPInfo GetACP GetOEMCP FreeEnvironmentStringsA MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW WideCharToMultiByte VirtualFree GetModuleHandleA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW VirtualAlloc SetStdHandle GetLocaleInfoA FlushFileBuffers GetLocaleInfoW

ddhelp.exe

IMPHASH b1c26122ccb7b48ddd747c1bca82f205
SHA256 9776ee6d94a2c1c4745b59073723363a66c9fd574d6696d2c34cbfdb9d54ae0f
MD5 0b59a22eea45a9032a3c4eca40d3ba93
SHA1 93ea04a7ee1fcea68b83eab0df2edb0498458333
SHA512 6959c22548c528b05cf73c534bc5a22cf86a077e7c76b9af07ffe02e8bb111054f7a1ca0ee4da579865dc23cbf628bc9ccc2c37dff781199121c02962be24d88
SSDEEP 384:zFaAKTXn3hemY6G+pv2BR7wYpj+RiP13BIbzqc+Vrout65H+Sbs2WnZrW:TKTMmYrr13a/qcuMjbsR
TLSH
T155E25D017AE8D83FFC87413215B24B036736A90049B5A39F1BC4598B9F7BAF5A9343D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19133

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LeaveCriticalSection EnterCriticalSection CloseHandle WaitForSingleObject OpenProcess SetThreadPriority GetCurrentThread ResetEvent SetEvent CreateThread GetPriorityClass UnmapViewOfFile GetCurrentProcessId MapViewOfFile InitializeCriticalSection CreateMutexA ExitThread CreateEventA SetPriorityClass SetCurrentDirectoryA GetSystemDirectoryA HeapAlloc HeapFree HeapReAlloc HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA GetCurrentProcess TerminateProcess FreeLibrary CreateFileA LoadLibraryA GetProcAddress lstrcmpiA SetErrorMode lstrlenA CreateFileMappingA lstrcpyA GetSystemInfo VirtualProtect GetLocaleInfoA VirtualQuery GetStringTypeW GetStringTypeA RtlUnwind LCMapStringW MultiByteToWideChar LCMapStringA VirtualAlloc Sleep GetCPInfo GetOEMCP GetACP VirtualFree GetFileType SetHandleCount GetEnvironmentStringsW GetLastError WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetModuleFileNameA GetStdHandle WriteFile RegisterServiceProcess GetCommandLineA GetVersionExA GetStartupInfoA ExitProcess

gdi32

CreateFontA SetTextColor SetBkColor ExtTextOutA SelectObject GetTextExtentPoint32A GetStockObject CreateDCA DeleteDC DeleteObject

user32

ReleaseDC DefWindowProcA DispatchMessageA TranslateMessage CreateWindowExA RegisterClassA RegisterWindowMessageA GetSystemMetrics ShowWindow UpdateWindow GetDC GetClientRect ScrollWindowEx GetMessageA BeginPaint EndPaint FillRect KillTimer PostQuitMessage SetTimer wsprintfA

winmm

timeSetEvent waveOutClose waveOutSetVolume waveOutGetVolume waveOutOpen timeKillEvent

ddraw.dll

IMPHASH 994fa478b419c1ced312e16ef1cf95e6
SHA256 e8facaa20b0aa1a0c2d78cd8e225fa09e05f5a1aec66747a39d817be04b65f47
MD5 9d898120222f68daf6931c84ef5e54c5
SHA1 e11bb2b42d6adf376397c53efa6ac90b72e77176
SHA512 80c94b4f4cff1d4b3e974fa67a7776fcb3f23485fc14b2359e8ee3e273a43dea66d7e5ebe0d12e8a35b9a26fb97526988b4329518410df6d8285a71aece5d6ee
SSDEEP 6144:4eI5yze4QT7Lkcr0u9I7qB5pgun0cIbDjXvY3LZsHEjn331PyRqdsFItl:W5yzsT7LgqI7e0cGHfWZuELERqftl
TLSH
T18F849E21F7F09035E0F712F55A2D17693A7AFB208938999F3A450ED92E30B91BA31357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

92969

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

user32

GetForegroundWindow GetDC EqualRect IntersectRect ChangeDisplaySettingsA RedrawWindow UnionRect GetClassInfoA wsprintfA GetDCEx ClientToScreen GetClientRect GetWindowThreadProcessId SetCursor KillTimer SetWindowLongA SendMessageA IsIconic PostMessageA CallWindowProcA GetKeyState SetFocus OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetLastActivePopup GetAsyncKeyState keybd_event SystemParametersInfoA SetForegroundWindow SetWindowPos OffsetRect ShowWindow IsZoomed SetTimer ClipCursor GetDesktopWindow GetWindow GetWindowLongA IsWindowVisible IsWindowEnabled GetParent DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow UnregisterClassA GetKeyboardType MessageBoxIndirectA LoadStringA GetSystemMetrics EnumDisplaySettingsA IsRectEmpty CopyRect SetRect mouse_event IsWindow ReleaseDC

advapi32

RegCreateKeyA RegQueryValueExA RegOpenKeyA RegEnumKeyA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

GetStdHandle WriteFile GetCPInfo GetLocaleInfoA GetStringTypeW GetStringTypeA RaiseException ExitProcess LCMapStringW LCMapStringA VirtualQuery VirtualProtect VirtualFree VirtualAlloc GetACP GetOEMCP GetSystemTimeAsFileTime GetCurrentThreadId GetModuleFileNameA SetFilePointer lstrcmpiA GetPriorityClass LocalAlloc LocalFree GetCurrentProcessId GetLastError GetSystemInfo FreeLibrary GetProcAddress LoadLibraryA LeaveCriticalSection EnterCriticalSection MakeCriticalSectionGlobal ReinitializeCriticalSection InterlockedExchange ord93 DisableThreadLibraryCalls ord98 ord97 GetModuleHandleA lstrcpyA IsBadCodePtr GlobalMemoryStatus SetErrorMode lstrcpynA CloseHandle GetExitCodeThread WaitForSingleObject CreateThread IsBadWritePtr GetSystemDefaultLCID MapSLFix OpenVxDHandle UnMapLS MapLS IsBadReadPtr GetProfileIntA GetTickCount GlobalFree GlobalUnlock GlobalLock GlobalAlloc TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency Sleep GetPrivateProfileIntA DeviceIoControl OutputDebugStringA ThunkConnect32 FT_Thunk FT_Exit4 FT_Exit20 SMapLS SUnMapLS SMapLS_IP_EBP_8 SUnMapLS_IP_EBP_8 SMapLS_IP_EBP_12 SUnMapLS_IP_EBP_12 SMapLS_IP_EBP_16 SUnMapLS_IP_EBP_16 SMapLS_IP_EBP_20 SUnMapLS_IP_EBP_20 MapSL HeapFree HeapAlloc HeapSize HeapReAlloc HeapCreate GetVersionExA CreateFileA ReleaseMutex SetEvent UnmapViewOfFile OpenMutexA MapViewOfFile CreateFileMappingA CreateEventA CreateProcessA OpenEventA GetCurrentProcess lstrcatA _lclose ReadFile OpenFile WideCharToMultiByte MultiByteToWideChar GetSystemDirectoryA lstrlenA SetPriorityClass

gdi32

CreateDCA SetStretchBltMode StretchBlt SetBkColor ExtTextOutA PatBlt StretchDIBits SetObjectOwner GetObjectType SaveDC SetPaletteEntries SelectPalette RealizePalette GetNearestColor DeleteDC CreateCompatibleBitmap GetDIBits CreateDIBSection CreateCompatibleDC SelectObject GetSystemPaletteEntries SetDIBColorTable BitBlt RestoreDC GetDeviceCaps CreatePalette ResizePalette DeleteObject ExtEscape GetStockObject GetRegionData GetDeviceGammaRamp SetDeviceGammaRamp SetSystemPaletteUse

ddraw.inf

SHA256 7c01dd5b7aff7d677dc127b0d2a0123c999b8d02e724c8af4704a9ccceb79f51
MD5 7bd4ae62cfc4ccb7b47fb8fc8da733cb
SHA1 541b5f20e9803ac2093d77562b2e843c22ff3c49
SHA512 9d0c6d49928d08a46aba71625d814537a69ff9c9833532911e81886a79c4f364b81ab734e4d5df73c8e68be7165ff616fcadf8cbd09a9dcc48e8051b951c6565
SSDEEP 96:6UQBY65L1kF1kt1kN1k41kv1ky1ke1kz1ke1kP1k+1kW1kS1k91kr1km1k01kL1k:6UQBXJyU8zOPV6rQffrsOHLMJvX9sCF6
TLSH
T143A12541F365C103D44DB01A87947E12665C928724CAEF0E6DD6C7B88617EF9A33C94F
MD5 SHA1 SHA512 SSDEEP TLSH

ddraw.vxd

SHA256 42c17f57eacc22f5c57d195678d1f48717c69c11d510c51518f047a9bd2a6fe8
MD5 ba327b445954d746c4b4f5d60c759baf
SHA1 11020782e11b90b0e3ec1dc83c1a28f1421f4e38
SHA512 d78e5cc276a08c7556c5f5823f920453813479032d57bea292ad5add876b398b55f085a2afb37ec4d0ab7db70c4979e000ec7c01501f363deb15833df8068455
SSDEEP 384:x9i9UTTik9PS4THA7lmpK16NGeP+n0IS6U6f2XoeFlsldqVcQ:+9NJ47+lmp6UUZK6zeclYVcQ
TLSH
T132D23BD1A8B3D07BD8CA8371964FA70DCE3FAB3A0837551B733266913EB1956E501835
MD5 SHA1 SHA512 SSDEEP TLSH

ddraw16.dll

SHA256 b1563c5dae78ed18cf2561086523b1b6007e8a3edd4a18ef88f0cad1bcfb65d9
MD5 687f775a9f1525cf2c371c82ff4ca553
SHA1 2280c187d7e2fd093da22b33da98dac27b4fb03b
SHA512 e1dc2477286c44a95523666aabb92da8489068a267e063f4ac3ce055ffab58e0adccbc922820d99dd2841455a1061a661ff312fddd584b04de01d0419934619c
SSDEEP 384:YanygHn/L1yF9zVy8IKF95roCG5qybYUcPfUMqtHXk1uu39Ympcm7Opv0K:1hL1yDj95rWEBUYe5X8uu39Bpcmgs
TLSH
T1F4D25B23745DC1F1C969427082BAEB5687EFEF4A2B4925338F781A5F3D60796872F024
MD5 SHA1 SHA512 SSDEEP TLSH

ddrawex.dll

IMPHASH 84cac4e75ecba882b130d19c35d1f7bb
SHA256 417875a29c9a51780bfac940992b5f12d6de7b7f820caa91133b6011ce69f0cd
MD5 aa124e42bdf12becd03dd91bcff6cf80
SHA1 e02173bb93958090c7c086a632e06146a1c386d7
SHA512 08c47771a23740f2759aeffe69045dc3bf18c29e9b66d440af13c024846bac76be20a08df9f04a380fab8d9b5bfcfa173f640b4c00218b1293ec5dc716805b06
SSDEEP 384:wf6xqK4R+yv5sdKqysXNA8UCKrOOwq3YevvKsekdjixz1+Esxd5uuTcUV7hr+2vl:wCEKje5sdBysXG8UXOzq3YjsFjix5Rsz
TLSH
T179B21B5333D32079C1EB73778D65754FF3A49F1418309A0A8BE65A0327F260AD998B6B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

devenum.dll

IMPHASH 6b6b7f1fca7e48432d882e6d001c1d9b
SHA256 117443ca187736e4cdb19cca188e0570cd6255790149ab95760015ab7892aad8
MD5 f77515bef113d6a3a51d48fa7b43b198
SHA1 beedab29b9fb916d746375242ad004531fa98a91
SHA512 cd2bcbcf0a3280a9221e3d91460388141d3226885324c1a5f8b9d4d24c2d9e8d08687f67986cb5943654ebcb96c71b2376c1a69bf486033d12a65c41a9348fcb
SSDEEP 3072:hzTHhQp4BXcrpBZLIijHGZbhiWU7tdVDd5ZnnKzs:xKKerp3NDA
TLSH
T1A5D3648177EF0559E5EE42B0297511E7856FE892C9F006F8A6AD9210A1F8F00E73CF97
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24319

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatW CreateMutexA lstrcmpA TerminateProcess LoadLibraryA GetProcAddress DisableThreadLibraryCalls GetVersionExA ReleaseMutex GetModuleHandleA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary lstrcpynA GetModuleFileNameA lstrcatA lstrcpyA HeapDestroy WaitForSingleObject GetCurrentProcess CloseHandle GetLastError lstrcmpiA lstrlenA WideCharToMultiByte MultiByteToWideChar InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrlenW

msvcrt

_purecall free ??2@YAPAXI@Z realloc ??3@YAXPAX@Z _except_handler3 malloc

user32

LoadStringA CharNextA wsprintfA

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteKeyA RegQueryInfoKeyA RegEnumKeyExA RegDeleteValueA RegEnumKeyA

ole32

CoCreateInstance CreateBindCtx StringFromGUID2 CLSIDFromString CreateAntiMoniker CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VarI4FromStr LoadTypeLi RegisterTypeLi SysAllocString VariantClear SysFreeString

winmm

midiOutGetDevCapsA waveInGetDevCapsA waveOutGetDevCapsA waveInMessage waveOutMessage waveInGetNumDevs midiOutGetNumDevs

diactfrm.dll

IMPHASH 4858d3a4a4c5fc3b1e759ad75d7ca259
SHA256 3510d00f14e60a4159c1ffb8e9af0e2324d56925158811ea965964ecca9edc73
MD5 5f8c883e4c4d210d1eb855620353561f
SHA1 3a55578c115e5df51420137ee2aeaeb1affce077
SHA512 1912a951ba2273d5104e03a5eece398b27ff7ee0822a9a64478f87c16be5a401391a6a0514890a1e4e6a293e66847fe4d6b4b9881cf5b7c26354c1a1d6d14793
SSDEEP 6144:b/SAOtN2pWJktzgNkt1sI9D22Mou3fgn2dvZKs6mLfQQeewQee2QeesQee2hQeep:mT2JDtH2XJ3kur6mdhTWcKB
TLSH
T11DA47C01B7F88136F0F36B3069BA276A6A7BBE429938C55F1B94056E1D30A45CE35373
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

114761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapReAlloc GetACP GetOEMCP GetCPInfo RaiseException HeapSize InitializeCriticalSection LCMapStringA LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW SetFilePointer SetUnhandledExceptionFilter VirtualProtect GetSystemInfo VirtualAlloc SetStdHandle IsBadCodePtr FlushFileBuffers CloseHandle EnterCriticalSection LeaveCriticalSection WriteFile VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW IsProcessorFeaturePresent UnmapViewOfFile CreateFileW CreateFileA CreateFileMappingA MapViewOfFile GetFileSize GetEnvironmentStrings lstrlenA FreeEnvironmentStringsA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree ExitProcess MultiByteToWideChar GetLastError RtlUnwind HeapFree HeapAlloc GetVersionExA GetCommandLineA TlsSetValue GetCurrentThreadId GetModuleFileNameA Sleep WideCharToMultiByte IsBadReadPtr IsBadWritePtr lstrcmpA GetTickCount MulDiv lstrcpyA GetModuleHandleA InterlockedDecrement InterlockedIncrement lstrcmpiA LoadLibraryA GetProcAddress FreeLibrary VirtualQuery

advapi32

RegOpenKeyA RegCloseKey RegQueryValueA RegOpenKeyExA RegDeleteKeyA RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA

ole32

CoTaskMemFree StringFromCLSID

user32

WindowFromPoint EndPaint BeginPaint IsWindowVisible SetPropA GetPropA RegisterClassExA EnumChildWindows DispatchMessageA TranslateMessage GetMessageA DefWindowProcA ReleaseCapture SetCapture GetWindow UnregisterClassA GetClientRect InvalidateRect CreateWindowExA DestroyWindow LoadImageA GetDesktopWindow GetWindowDC SetCursor ValidateRect LoadCursorA GetIconInfo DrawIcon PostQuitMessage ClipCursor GetSystemMetrics GetWindowRect FillRect GetUpdateRect GetDoubleClickTime SetFocus SetParent LoadStringA IsWindow MoveWindow OffsetRect GetDC ReleaseDC GetCursorPos ScreenToClient ClientToScreen KillTimer SetTimer PtInRect DrawTextA InflateRect ShowWindow SendMessageA SetWindowPos GetParent wsprintfA PostMessageA

gdi32

SetBkColor GetBkMode GetBkColor GetTextColor CreateFontIndirectA GetDeviceCaps SetViewportOrgEx OffsetViewportOrgEx RestoreDC SaveDC CreateDIBSection Polyline DPtoLP GetStockObject GetObjectA GetCurrentObject LPtoDP CreateCompatibleBitmap StretchBlt SetBrushOrgEx SetStretchBltMode GetBrushOrgEx GetStretchBltMode Polygon ExcludeClipRect IntersectClipRect DeleteDC CreateCompatibleDC CreatePen SelectObject CreateSolidBrush Rectangle MoveToEx LineTo SetTextColor SetBkMode BitBlt DeleteObject

dinput8

DirectInput8Create

diactfrm.inf

SHA256 0fa10ec8733140fd48bd763e195c866029acfcc58869dc9b250f75d8ba080b30
MD5 c981a5e3a834ae2f7be9b24fa12064c2
SHA1 17ffd4b002fed95c17222aae988926e7cce502a5
SHA512 5a039c0145c18ecc1f3f5bb638e27ad89c2cd8a2af27e80d144b640e691ad32a4948b27d21585b200ce6ebc3abe6cb1a2ecd8d02773db4c590465f576fcfbf20
TLSH
T13C1199BBCF3E4A9F19DD534FD8BA323241AC952AA0C1E18561D06102D84F4FCE45C5D9
MD5 SHA1 SHA512 TLSH

dijoy.hlp

SHA256 5fd8d8aa0201478bab648bc238bd62acb285fc6920093099b723f1bacbfa180f
MD5 137415567983464456676fd31e6062cf
SHA1 e3761e725a08fb9dc41484096c8efc163335cf71
SHA512 eab0c78188fe7c8cb3f3705888d7c3fec80e72f18debf0e0f2431d011d752acac8cfe05f980af6fb60977c8447b15740fee33bea4b6e8cb40c1a06622b9199e1
SSDEEP 192:rn86i/9CHs32dZd1xE9clDqjRmwMClDHpXF+r:rzs9sm2dZdvE9clKMClDHpXF+r
TLSH
T13A92316F395FC612D754CCB9D6F2B9B98E28DCE1EC704507F9023A0C94B1BA6D293648
MD5 SHA1 SHA512 SSDEEP TLSH

dijoybrz.hlp

SHA256 ab933cd613b713ce5812db9832957d03a4aca976ba3e0b7cc1ca6dfd3d8d335d
MD5 e56c0c19b188bc93bad580c9789a1ca9
SHA1 d905fff0a3c4938636167e94f4da4a519c70d01c
SHA512 cc12d77873c6cebf517d78a7a2f71484920013c8989c5a83298618b6b2f6b7d0a65e8e80e1e4be5e452f764ed98b3d8d4d05a59854b199357a72570ba2241eea
SSDEEP 96:gZVmb1PBLJ3+NtFJvVzcxrDx+XDN0vUzO2VMSxXDb0uwJmIPtFC3kAtcv9MMMMJ:qsNJu51Od+bzbbxX30vXtNAtSj
TLSH
T11D42D540BD94CE73C9954B38DDEAA9ED2162BE4ADC544B43704D3F8C3C32149AA5A97C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoychs.hlp

SHA256 a989146607cca03659d3e5cadee3fd9f92675e7f49233c9c926dd641d8323f49
MD5 e2b12a7212974b373fb5cef7c16e2910
SHA1 253503674d0078dfa80bcfd687190c30a339ea56
SHA512 b54399cef70dccd029f20bb872ec1826cbce8b0de4ee34f12660aaa448f1a379174e29a249dc031a881550f09951c246c16be8a7d6286899f094d16c192467e7
SSDEEP 96:bwZ02kGSkC2LZc6HjYa/4Ky+4sxnLCvEIafedWLajezW5/bSnUMMMMJ:blh2LZcCj31y+NLCM2WLER5/Ic
TLSH
T1D9329251BC54EA57E8410AB4ED96FBE9F426BC45CD508367380C3B1C7C33145AB5A87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoycht.hlp

SHA256 1a9eee00c310a19ceba3b867873350b2fd657fb5ad0a17f7dd897c4170816363
MD5 4b068dac56444fe69c0a29f58593c414
SHA1 d94da6d175e9c417dc7a32d2be499105e42e4551
SHA512 4b1cfde3bff6a2bb0ed6dc222392fc280f0d3b110041e288d7d57ce578c39301936bddb84bcee30d33b8967e2e5408a99010ec75d5290083283cf27c1bb75995
SSDEEP 192:sEDppRgEuwkafEorxNs9ZzmK6wMClDHpXF+r:skpvuwkafEorxNAzhfMClDHpXF+r
TLSH
T19DA202AA5D50865AE165E83DD5EB73FD4A30ED11ADE0460F761F2A4D24F3FC280A360E
MD5 SHA1 SHA512 SSDEEP TLSH

dijoycze.hlp

SHA256 e54b683561ded2a33a9cb8ac880ca9d16bb3e9a385a7419547914937af7dccfe
MD5 b24f65363c41999f491c42dfaaf68006
SHA1 bb600555568ee35726694031f4608528e47b2551
SHA512 b5dbec06cba3dd57dcfa5638e65f92bb86daa8364bc979802bdb27abd3433fc362472e4697c57d275f43673ebf856b7c4f01282d083f40c4395d70c5dbdffd28
SSDEEP 192:2zlYYzxIvU58MqbFpvSLc0hVSIPgERX49zXqmwMClDHpXF+r:bY68NguLc0hV3g064MClDHpXF+r
TLSH
T18CA2AE1EAAD1C513E254EE3EEED772FA6E10DC41AD80C4077F66274E24F39978063A18
MD5 SHA1 SHA512 SSDEEP TLSH

dijoydut.hlp

SHA256 3c6e39b2150de576234eabd114386b7e0c590344e478e5f466ddf9e6eba1e7de
MD5 9cd3263bf30d9a8ee30e4c67b4618920
SHA1 3cc9fda099838283b2069838e71b659eebc70351
SHA512 5a54d4eeedc47516a1aab18ddeb2fc5f53faaa186df56db6e6e3182ee24839072a6ac80bed6b93499855e9b66040d7ddbe29cf9d3906d0364c80efcbf71bfbb0
SSDEEP 192:aYchIP+0T5aBH4KWYe6jkm7n4SsA8h7wmhhx:aYcmmRBH42Jjkm7psB7F
TLSH
T1AA4208553D51DE13C9A80B38DCEA72ED35B2BC0A8E65474B345D3B2D3D32914B90A87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyfrn.hlp

SHA256 420a39d13d76208fb4945fbb50765f86a21a10a52636f2e6c9090ff2b4e80f5a
MD5 bc2602451a67cd71e3235fee03a80e1d
SHA1 04ac95bdf73a103a213151da1f5be2a9e4f3ff2c
SHA512 0ef376aa4328952af14acad024d2c36692ec042b93e028b0ea0d0a8db0370cbc68ddeeaf3146793d9a1dcbb05886abf24aa953bef4ed4be9b797dc6145dd9385
SSDEEP 192:sDiDSyd0l7T81cWesLa1gs6u/YdeUzRe0Z7+:sDEpGWP2196efUzReIK
TLSH
T1B642E4413D6AD6A3D5840A74DEE2B9ED2071BD08ED504F8374497B6C2C32359AA4F87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyger.hlp

SHA256 79f5403200d668c28eb612cf427399b675ca5e7dddc9ed6950f3d6d37ece8327
MD5 a0b7f28be23af3fb2408fe16e129194b
SHA1 c4c090b356ac72d27afd7e284cd961b860ff6353
SHA512 a119fbc294a9fcf790b290507315280a8bc30ca15db60baa6128d4b9b131e09ee2fdb36dc373aa4212802557764ab29d1d3aa6d1761b9b06c12e06255d77a514
SSDEEP 192:qbLEH4huJ9ytDTfuW5BGfCRsjFDI0FnJRh0g4qvCwMClDHpXF+r:qb7c7EmOkFDrn9v3MClDHpXF+r
TLSH
T17092101EBD94C913E164DD7ADEEB71DD5B21EC42ED80C00B76267B4E28F2A429053B5C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyitn.hlp

SHA256 3d8fe49c80fc3c95944db5c3a2981ad6185b65005466d44115a38e5545daedca
MD5 790a63022358d88838b75fdcebe0d117
SHA1 d7bf4afe54bec452929c0c8bf7bfd865ac0f827d
SHA512 ebf2d39bba567f67419d7abf1385b751e9d2b8df313a052f1d7f87f7dd99d2fe8e44240e4953661ce1ca6805717fa68865a1f784539f9ad01e2a70df54d32562
SSDEEP 96:c/x8jt76wJu0owCknzvSjFS9YICxwKX1c7xUBzjhXsb9voBrVdMi9LkkSyT5mSL1:GejBQeqbQKX+7xUBzjhXEv2DMgF/Vv
TLSH
T111420710BDA9DE27CD9A0A749E9678EE3231FC85CC964B1735283B1CBC77090A61C87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyjpn.hlp

SHA256 82c877015c2991c295c91587cc72110bd5d60b82b395436bfe3f03378e3d651f
MD5 860d56f398918504f7bf635cac90b1a8
SHA1 0f9bf97ec06c6a9d6446b43d6b80e422bd12e172
SHA512 b51057746685d8b6e2b128cda719fdbe89391f03d0404f7be1e96361e31635c05a38c59c4c477e9f2b2c82333cdb27c81b40c44aa056d90f678d21c0bca783b2
SSDEEP 96:GjcNBGLt1TpRMijFlynTkQgZ8Mo9Swyi3Uw/7diN6LgOuma/BYHOutk1CBzh4oZH:7vWX3aTk31ISxikw/7GJ1KSYHWvqp
TLSH
T1974207543CA5DE23C8584AB5CCE9F9E9346BFE82CD128F4335253B0C6E72484568B9BC
MD5 SHA1 SHA512 SSDEEP TLSH

dijoykor.hlp

SHA256 37c89ff5eb05509bb94fd65b07f7a00e797c0f0ca74a5dd3c7df5942739fb5ff
MD5 7c71777a3efa0749bb57b29e2f696674
SHA1 7f6b8c7d8bd35de23c957a30ca09f5ec80d0dfe7
SHA512 ba0bb13635eef016153e6d06b9566c9a9701dfae0bae88f3a9d9b258e1340b0c098c7afd479e7f044ed5e6b2edb0c0d80feb27168df7f4c2467e09d9de56618f
SSDEEP 192:Y6eF9MbwmylCRkwjwJdD1DfpNWJxfObB3J+Lk1CocwMClDHpXF+r:sMJyl3SwJdDxpIXfOt5FMClDHpXF+r
TLSH
T105925F1EADD1C513E6649C7AE9DBB1A95E21EC41FC80C40B371A3B4E28F2E966053F5C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoypol.hlp

SHA256 78f5386903c55ce3e668ea6b1951d083f6b966d0bd7732def083f796bb5fc440
MD5 eaa0f6e7220f0becb4f03d13a94898db
SHA1 bf517524e7aac53108d623bd2f4b3a63e1221ec6
SHA512 b65cae32346503ac1e54ab31484091debcf864b55bdb493cf6efa508fa88536867572a696e81fa9a0f58554766ab9372f6ae2f3f3a8de00a8d58485ccd2c6b4b
SSDEEP 384:prpyZc0K4D1KJeUtAXknfPXUhMClDHpXF+r:prpyZdK4D1KJ1tAXkfPXx
TLSH
T12D92311E7D80C513E564AD3ADBEBB6ED5B24EC41FD80C40B37267B4E28F2A82605365C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyrus.hlp

SHA256 83300151382c642a5c923429504ede2a9f5b85c1c90cf448db6f0d81e86fc3e8
MD5 e24d0e58df91ba9dc49d3fa72705c431
SHA1 f2cfb7faf7de946a95ed2a362fa15f03130a18d0
SHA512 347250adfa27cb7585d0e8803e59062320aa7dfd8a1fbbfa2899e90f63f853fc421e2f31ff93915be3a2b9570bf0c6a3d8d91b0c6c3476fc371641422041f8d4
SSDEEP 96:nZB9zpCtbqw4coli8GWF1HfXwHO4sM7h54+932Arm41YGvvRbzdES5BTJEw/MMMw:nZB99iqYAgEMoCI4mgFdEuJjN
TLSH
T14D42E755FCA8EAA7C8940E74ECD7A6ED3815FC51BC418B2375113F4D7C3204A6A1A47C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyspa.hlp

SHA256 5708c8d5b7f66788501b41e95072bdcfc4f4a870669bed72522caf07f3e8ff32
MD5 cc6fe8fb75fc04c142a555be4d58b045
SHA1 8e42720e2b74afd73500e487c224ed27c26a77c1
SHA512 985ebe210fd27170b76e94e6a5c151a0eb9ec2c30425b8a2f8813605f2104bb42e521e7f271fc4192f8b35c892a0c24b03ccab601901ad157dbea7699d3e4848
SSDEEP 192:R0KBPPZApLQiMI/gUZOQT8KABedBowZsgq+4Z6x8:R0KBPPaBQiEQgQ1b8
TLSH
T122420846BD96EA7BC4944774CDEA69EC3072FC0AEC06478371193F2C7C76180AA2993C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyswe.hlp

SHA256 24b9ccb7cbfdd39808025c1e40e39f73459419ab32a23f53e8f1b7411f90c030
MD5 3939643e42362724cc79b10cbfed090d
SHA1 78522d750ebac38913092eb91813fd694da58157
SHA512 38b165e6642576f17dee54c733f1811f214d65475b3f0c82bfad0eec08ae891e50f91e319a97f1b785dbdaae5710ed16fc798c35ee3326293f4e56f3a1b18cb8
SSDEEP 96:PUypMNALLx8G6paLKss/7bWxr/JOBHVinQtxTmpusARZX5ecZkJtPjAlkQ89WhMq:MyeNK9D7Ln47CxzcuQrCtA7tutLHfQ
TLSH
T1B342D650BC18ED57D4990678EEAFB9FD64667C89EE520B9332183B1C3C31049B58E17C
MD5 SHA1 SHA512 SSDEEP TLSH

dimap.dll

IMPHASH 4e9166a531644c5def658b728c82a383
SHA256 ed5d8e59d1df84cdcaafd88680575c9d031296f07250abdec9a23ecf6a751d1b
MD5 8427edc4bcaf087f78acc7c8ae787e3c
SHA1 340dc00e89d5eab47a9021c3777fc1223b405585
SHA512 a352d9718b5602a73a9373c69b83d94c647d1587ec24a9276e4feee795b59edd698293ad8e740b88861c4d1b16407fc829609a6ac14b2d06146d1820fb665d17
SSDEEP 1536:Pb+/9PosvgraGUrGOr72/6a/QQMQKxeTtLcGAsoDvYyVJjcGEh:zCBeraGUrGO+/6ac6tLJb2VJjcGEh
TLSH
T1FA938C2370E0C6B2D5520534DAC47768BABAF4214D328DA7371CAA8D3F76A83F526357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MultiByteToWideChar WideCharToMultiByte GetPrivateProfileIntA CreateDirectoryA GetPrivateProfileStringA GetVersion GetSystemTimeAsFileTime GetModuleHandleA GetCurrentThreadId TlsSetValue GetCommandLineA GetVersionExA RaiseException RtlUnwind ExitProcess GetProcAddress TlsFree SetLastError TlsGetValue TlsAlloc HeapFree HeapAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree WriteFile LeaveCriticalSection WritePrivateProfileStringA SetUnhandledExceptionFilter GetACP GetOEMCP GetCPInfo HeapReAlloc HeapSize VirtualAlloc IsBadWritePtr LoadLibraryA GetStringTypeA GetStringTypeW GetLocaleInfoA IsBadReadPtr IsBadCodePtr VirtualProtect GetSystemInfo VirtualQuery LCMapStringA LCMapStringW SetFilePointer ReadFile SetStdHandle FlushFileBuffers CloseHandle GetLastError DeleteCriticalSection DisableThreadLibraryCalls InitializeCriticalSection InterlockedDecrement EnterCriticalSection InterlockedIncrement

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc

advapi32

GetUserNameA RegQueryValueExA RegOpenKeyExA RegCloseKey

user32

wsprintfA CharUpperBuffA

ole32

StringFromGUID2

dinput8

DirectInput8Create

dimaps.inf

SHA256 b762ccc6087e6089a923ac09134e19311e57d60e1cbdc4d1525576395d283c8d
MD5 0545bc83300356cc68fdb44e0f90b774
SHA1 0ea39abe3b95a3a4c73ac80ae1c5e36b13acd6bc
SHA512 3557fae927a47db1293f50834236cc9bd1300902541eb742190a9d1695cb53d4363f482d40f1832af4271eed22dd86398d9b85a69b64d2f8f6b2fdcc2ba62621
SSDEEP 192:D1XXRJO0FxTG5Q0U+y0J9zgR1FRPvdbxyNgBTTQai3a6ANIKZfZW8dvm/188OX63:DlhNxTG5Q0UGkOMs4BBKGS1V
TLSH
T13B62B9FA5D1ACE73D4E3D0C2E202AD17F54B9859D2A55DC4E8F1118ACB462A8803CBDA
MD5 SHA1 SHA512 SSDEEP TLSH

dinput.dll

IMPHASH 046ef65faa60d37c1d924c46c847304f
SHA256 2a4774441b479dff353971f035cae61135ff7057f46b2a440ebf21d1b22bfccd
MD5 a191f2f06e38852399395c3a967f9ea4
SHA1 eceb766a856f01c5bb426f2afa4c9e25f809f628
SHA512 4343bf709b524761ff4218729d52c1d6b66ebd83cd26d204916e0ca15206e22b5110bc17c200ae63eef58affd158140b3aa13defa671a86ab712a6924eb6d064
SSDEEP 6144:o029v/CETjQks7tWBg/rrX6n1d121egnnnnnnnnnnnnnnnn:otnXsAS
TLSH
T127E40A01B3FD5629F2F3BB746EB916914E7BBDA2AA36C10D0250254E1D31F94DA20B73
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

110019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId EnterCriticalSection LeaveCriticalSection SetEvent DeleteCriticalSection ResetEvent GetCurrentProcessId IsBadReadPtr IsBadWritePtr WideCharToMultiByte FreeLibraryAndExitThread FreeLibrary GetLastError WaitForMultipleObjects SetThreadPriority CreateThread CreateEventA LoadLibraryA GetTickCount lstrcmpiA ReadFileEx DuplicateHandle GetCurrentProcess MultiByteToWideChar lstrlenW GetVersion Sleep ReleaseMutex WaitForSingleObject MulDiv DeviceIoControl LocalAlloc LocalReAlloc SleepEx ResumeThread GetProcAddress DisableThreadLibraryCalls UnmapViewOfFile lstrcmpA lstrcpyW GetSystemTimeAsFileTime SystemTimeToFileTime GetLocalTime MapViewOfFile CreateFileMappingA CreateMutexA LoadResource FindResourceA CreateProcessA InitializeCriticalSection GetVersionExA IsBadCodePtr GetCommandLineA ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree HeapFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapAlloc GetACP GetOEMCP GetCPInfo VirtualAlloc HeapReAlloc RtlUnwind LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualProtect GetSystemInfo VirtualQuery lstrlenA CreateFileA ReadFile SetFilePointer GetFileSize lstrcpyA CloseHandle GetModuleHandleA GetModuleFileNameA GetFullPathNameA InterlockedExchange LocalFree InterlockedDecrement WriteFileEx InterlockedIncrement

advapi32

RegCreateKeyExA RegEnumKeyExA RegQueryValueA RegCreateKeyA RegOpenKeyA RegDeleteKeyA RegQueryValueExA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyA RegOpenKeyExA RegSetValueExA RegCloseKey

user32

wsprintfA CharUpperA UnhookWindowsHookEx GetWindowThreadProcessId IsIconic GetForegroundWindow GetWindowLongA CallNextHookEx SetWindowsHookExA PostThreadMessageA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage PeekMessageA GetInputState SystemParametersInfoA IntersectRect GetWindowRect GetDesktopWindow MapWindowPoints GetClientRect ReleaseCapture SetCursorPos mouse_event GetAsyncKeyState SetCapture ClipCursor ShowCursor GetMessageTime SendNotifyMessageA GetCursorPos GetSystemMetrics MapVirtualKeyA LoadStringA keybd_event GetKeyboardType IsRectEmpty SubtractRect SendMessageA RegisterWindowMessageA FindWindowA SetWindowLongA DefWindowProcA GetPropA SetPropA RemovePropA CallWindowProcA IsWindow

winmm

mmioDescend mmioCreateChunk mmioRead mmioWrite mmioClose mmioOpenA mmioAscend

dinput.inf

SHA256 b457f9d6bdc0319e9d25bfdf45894a2ff15450d4d9c15f9c7440d03bcce06c9f
MD5 ccb9a9be27aff07fb568e8590337e530
SHA1 f114e3d8ab09613d9005680b5b44006a75d9a09c
SHA512 e64e41208546ec15e472c32815c96ac6c0cfeeed1663292beb35310e425bc8ee6229c3ec851561eab9f3781d4a0e1c6f3264b1def93555e32c3e7e83690e583b
SSDEEP 384:ljp4nYxTmr/xHz79a/Yh7hjN7D0gt9z7lQv2l6noRV7R7pz7j:ljp4npF3U/ghjtQIplS2l531j
TLSH
T1ACB22486DF1C0611D0C3AB09BB06BD06D12E7B5951A0941FEA9C6F0EF7CE62484F6D2B
MD5 SHA1 SHA512 SSDEEP TLSH

dinput.vxd

SHA256 bdf76be51f51af6dd26818a14001fd98dab38b00034cef928aa52b018fbf4339
MD5 8ed144298add39d9dbbe1f42e05c78d5
SHA1 706e67d8f9818c9f97f26c78dcc5592e6fb7ad86
SHA512 14094f4bb99c8fef99ff21474f2b891a92c574974710798e127476086374a1a8dd11055d94fbc2e0d32c0a58893ae86fced0627d5e38ac908772fadebe2f32a3
SSDEEP 96:t+lIUUp/5BCquU6VsMC7ooolrdizxei50BSjDczOjiBaGgDW+71DMg:wfUp/rCqF6VsydwQSnHi2d
TLSH
T12322C855DC219065C86052F086A7CF1D9E7CBAC64563020FB3B8771E2CFA2C67E971AC
MD5 SHA1 SHA512 SSDEEP TLSH

dinput8.dll

IMPHASH a54f5f32094867d71f38152da5912e90
SHA256 b7ebba47de76ddd5011cdd119e09a35679b78f34bd192668a774b2a807454eda
MD5 aeb78246ab62157ebc647fafcc70352f
SHA1 9d3be2438b085c5aa26e79b9e637ec5983b8d724
SHA512 816dc26a260b2b2daff4032fac2bfdb3c2dfb1b15a4db979e93ae6eca4567ce68102496a5012980078bf015ad4d7456218e78aa1caec45610bd20d8b22309989
SSDEEP 6144:iZOgl5Jt2aoqo1l2iT1FuLiCCj+1r45zW1t121qARnnnnnnnnnnnnnnnnM:mju6mzoMj+1
TLSH
T1CBE41C01B3F95629F6F3BF746EB912954E3BBDA2AA35C10E4250254E1D31F94DA20B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

131870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LeaveCriticalSection SetEvent DeleteCriticalSection ResetEvent WideCharToMultiByte GetCurrentProcessId IsBadReadPtr IsBadWritePtr lstrlenW FreeLibraryAndExitThread FreeLibrary GetLastError WaitForMultipleObjects SetThreadPriority CreateThread CreateEventA LoadLibraryA GetTickCount lstrcmpiA ReadFileEx DuplicateHandle GetCurrentProcess MultiByteToWideChar GetVersion Sleep ReleaseMutex WaitForSingleObject MulDiv DeviceIoControl LocalAlloc LocalReAlloc SleepEx ResumeThread GetProcAddress DisableThreadLibraryCalls UnmapViewOfFile IsBadCodePtr CompareFileTime lstrcpyA lstrcmpA lstrcpyW EnterCriticalSection SystemTimeToFileTime GetLocalTime lstrcmpW MapViewOfFile CreateFileMappingA CreateMutexA LoadResource FindResourceA CreateProcessA InitializeCriticalSection GetVersionExA GetCommandLineA ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree HeapFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW HeapAlloc GetACP GetOEMCP GetCPInfo VirtualAlloc HeapReAlloc RtlUnwind VirtualProtect GetSystemInfo VirtualQuery GetLocaleInfoA GetCurrentThreadId lstrlenA GetSystemTimeAsFileTime CreateFileA ReadFile SetFilePointer GetFileSize CloseHandle GetModuleHandleA GetModuleFileNameA GetFullPathNameA InterlockedExchange LocalFree InterlockedDecrement WriteFileEx InterlockedIncrement

advapi32

RegCreateKeyExA RegEnumKeyExA GetUserNameA RegCreateKeyA RegOpenKeyA RegDeleteKeyA RegQueryValueA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyA RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCloseKey

user32

PostMessageA wsprintfA CharUpperA UnhookWindowsHookEx GetWindowThreadProcessId IsIconic GetForegroundWindow GetWindowLongA CallNextHookEx SetWindowsHookExA PostThreadMessageA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage PeekMessageA GetInputState SystemParametersInfoA IntersectRect GetWindowRect GetDesktopWindow MapWindowPoints GetClientRect ReleaseCapture SetCursorPos mouse_event GetAsyncKeyState SetCapture ClipCursor ShowCursor GetMessageTime SendNotifyMessageA GetCursorPos GetSystemMetrics MapVirtualKeyA LoadStringA keybd_event GetKeyboardType IsRectEmpty SubtractRect SendMessageA RegisterWindowMessageA FindWindowA SetWindowLongA DefWindowProcA GetPropA SetPropA RemovePropA CallWindowProcA IsWindow ToAsciiEx MapVirtualKeyExA GetKeyboardLayout GetActiveWindow GetKeyNameTextA GetKeyNameTextW

directx.inf

SHA256 25c5a1a86bac23e511bf64c875ca6b9d6a6c802f1da8f94cff0e4b2c55c764f9
MD5 e07937647bb67a8bf3dab3f10ec4e95e
SHA1 d090c66fd6b5e23caa95eb094d888a9727aa56f0
SHA512 3426fe36849b046cc1970e924ce0fbe05921f41999b8aed3d85a8cf2c82e991be8de61cc8cbba0857413d31c296a2901cd0c42d3af3300691632fea39fafac82
SSDEEP 384:Mc4AP8UNj1NjReQPIYvFWOPOFrM9KMoGJAbK5kRez242v2T252Q2L2h2Z2MG:MaNj1NjjlvFWiOFrM9mGJAbK5kRez24c
TLSH
T168A2728DE1A245A1D0C871459A613E8E194DF26236DAFF4C61F8D2C401779FBD1A9E33
MD5 SHA1 SHA512 SSDEEP TLSH

dmband.dll

IMPHASH 2dd98eee91901e42aced29ca5eefb08b
SHA256 beb2b89bb4d656489ea2515cb2d656660604e9c50f5214bed6bcaadcfe507a1d
MD5 57afb20a5a2a646d539feda0e48f1f15
SHA1 67730a8fe198363e08a435727603029bec7552e5
SHA512 6f894d85345666075f14bf6c1070ca30bae8d17a3147bd10cba831b7063f33f9ab22d692ba4ae95f8707a83839f7560d4c2e4b9824c33d4cc417d85c1dadd746
SSDEEP 384:Z+RFs49fj7nR2QbX8K8Iv9YFQNKaOb8CIvuV2A8dPCrofD7+pWIWhoeWD:Z+bHBnLv/iFmKrb8CIvuAA0PWa7ixD
TLSH
T1FCC23B63B3E1807AE96A1235EF65276933FBD720895A554213551F8E37B08C2E23EF07
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmcompos.dll

IMPHASH 968421b7ed4e42ca13de160c864b4ae6
SHA256 2067ae35e1e64b8a79f9f97397888808666ceefb712d1bb8a50d64b33d70eaa4
MD5 dae162392717b891e6253dfeede5bec9
SHA1 1a6b68205b0c3eabebd1251217285ea4bbeeb376
SHA512 0db45d3f61a42fac46b04dce83ba9d1cf433e2fe0587b40b56b56f998a8d7a546d0b98e5253f3426353bbbdc82abf1e16e0b9930231f09f404f655c29e5eae73
SSDEEP 768:rpjWekfKuZSXp4aVPKRORsyHicwjoE2yjMdGtW7EQj274AMHezbMiHDzam:5kFSZZVPK4Rsya92TMQ7EQjpe5H3/
TLSH
T1C8436C53B3E3C0F6D1632172DA08A7EA17F99B2D583B858A67180F4E7B609C5973C50B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

53673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmime.dll

IMPHASH e84f92ef3e04403f433866f3a97f487c
SHA256 7c214d5a1dfdf1632b14294d119970ddd1e1d1c71fdbf8221b510d76286d5d86
MD5 9430c0c51facfe7b54684a36469418de
SHA1 4a1dd226d778febe0375880790eb33a891ac02b8
SHA512 1d3e8bb4d4877a1d408411b39047747c9b10ed9ae7080e7aa364b478f09bb2e34c96418c5d2bb5531a663a02a1d812dec89d031e215723b7044e99ef8b6b9e5b
SSDEEP 3072:S4FYkXv4moqzj59neGyWi8M+43UXJVKBU5I/0qdOESz:VWqvcqzj59e1WNX97KBU5y
TLSH
T1F0F36C61B3E2C036D883A2328A0973BAF3F9DB291637565312541F1DFBB0596A73D607
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

157705

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmloader.dll

IMPHASH 8332206d5778356b1110b44f2e3cfdef
SHA256 a55107fd8b5d263c0a4b908cab34ae2b80926eed23b1ee39f5e6b135b981eb9e
MD5 d6fced04186f7418666117c651fd2d2d
SHA1 3a6cfe7586d035489b25da95a190570b27a2c1c6
SHA512 40b9be3790ad81a59764307ed486992e4dfc891bb461206c0a4c55364c83a7aaeba8b85c35a5e3e8b433c12a74fa9c2040dc8241cdb6be99bfd32f1b01242b95
SSDEEP 768:53D/xJStMm6UB4kyVkxPzrueihLGP6/zUKpmMtfm/:t/xJKMU+87rXPQ4K8MA/
TLSH
T1A0E28C93B7E3D4BAE7939630A95A73DA23B997744A2810165B410B0F3E71A52E33C703
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmscript.dll

IMPHASH 903e24e172a63cf62c8720d3d4074255
SHA256 f8acba6ff2074e8eed00f7f618bab9fa5be7001a276f4ed5c563ef582d255c46
MD5 2b31b719bd08bd650c8131abbc9a5437
SHA1 044c6f7cb2cd235aac281ce28f6db628d4986cc0
SHA512 9b9bfd4c6c58b179bde235091b853d55dafbe3c9a72328f3ca3838df82c15e92696eabb6f6943373bcbee1048a5111faff9c72c534a5419f2bbf9368a45b8a92
SSDEEP 1536:eqnzhvqQa+ekgfjpNdvI4b7HYgRsqwCJhzVVXf4Kl3pBR:vSVD9pN9ZbdRs+hMK5pv
TLSH
T122736C2277E58032F77276764A307269A3FA99142D3ADE1613140B4D3EB1E83EA7C347
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

69597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmstyle.dll

IMPHASH 9b9b56669a52debf1b2dccbc03819e5c
SHA256 ee281503a73a98239b3dd7f2ac2c3f313f2d1e2ec0f3ba39d6d177e97d9894ea
MD5 6f6e5c08b164f4350b0f1c5110af3963
SHA1 7ccbb74150f8bdf7b74e438e06cbff949d44c648
SHA512 4ae3d4d0f5d889ee4c43bc808732c0cadc9a1d74bca47647dfddcffef8eae1695e916f23f438c75277c2d348c53fcc09de0b086e07d87352e1f0f52bb28377e5
SSDEEP 1536:HgKTQGLwfvrhCqa7KcCiOIHzZtxwDl0L/pgupbATi7mV9FX2/FNm/+:HvTQG0fUKcMIvCDlsqCbQrVfG6/+
TLSH
T1F6A37C52B3DAC037E65651319A18B3EA73FAC718282AB5077B145E8DBBB04C1D3BD607
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

91279

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmsynth.dll

IMPHASH 7bc002e7c5147c1079569ca2d742d33d
SHA256 f76ec4ae6e81cef2d0099d897f1424ce813d8a655a58f064c7a572b740119b91
MD5 415235edaa4cee387bea7903847b1530
SHA1 8d503ad58bcc233f97b2c9b067ae022cff04c60a
SHA512 8de274ceb44412e4c177b4f74f941c9f124833b72b0a32d41c746253302e83733c6e9e8ca54df190e756cf1314ad282b675e79fa8a23526922bc9769a8334504
SSDEEP 1536:tGjsOAIBRqtvWRbr6QsndNgL1ciyZR7TpbFcE8VfZ9roux2srOpaGOSk:t7IusJrNsnduL1KxOwwOpaGOSk
TLSH
T117A37E52FEA641FAEC82EA35940B73B397769F158515818393A0FF7C69302C1B97D322
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

76374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmusic.dll

IMPHASH 77d2d936f6cd1eebccc76f28df624f39
SHA256 80c9b618e67db7863dfba6895d7873b723224041335a04dcfce2e637d4650330
MD5 5a0704e543161b977575cd7eff8af9cc
SHA1 3680aae7054fee9e6ec0edf9bed41492c83f0735
SHA512 8c16b3a7b3b6e15b18e28566d98efc6f5004dd161ad64317ba6674dc9fdcf5b9e091839f7e6f1230183681c9a8e54ac0b4d403cdba3b02346d6b6fb99825d5e7
SSDEEP 3072:bvlmdkC70r6ln/Yn4/iq5PGNoVSyPs5+zNx1KdwrLT:jxhr6tYcfJb
TLSH
T186B33B4033F6503AF9E32A7059A663AB66BEFF255D36926E07000B0D3DF4941D539BA3
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

80166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection LoadLibraryA GetVersionExA DisableThreadLibraryCalls IsBadCodePtr InterlockedExchange FreeLibrary GetProcAddress lstrlenA lstrcatA lstrcpyA GetModuleFileNameA ResetEvent SetEvent PulseEvent MultiByteToWideChar GetLastError CreateEventA DeviceIoControl CreateFileA LocalFree LocalAlloc GetOverlappedResult SetLastError GetCurrentProcessId DuplicateHandle GetCurrentProcess OpenProcess QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess WaitForMultipleObjects CreateFileMappingA MapViewOfFile CreateMutexA WaitForSingleObject Sleep ReleaseMutex CloseHandle UnmapViewOfFile InterlockedDecrement InterlockedIncrement IsBadReadPtr CreateThread IsBadWritePtr

msvcrt

_stricmp wcscmp mbstowcs wcstombs wcscpy _purecall _strnicmp free memmove __CxxFrameHandler _adjust_fdiv malloc _initterm _wcsicmp

winmm

waveOutMessage timeGetTime timeBeginPeriod waveOutGetNumDevs timeEndPeriod waveOutGetDevCapsA

user32

wsprintfA LoadStringA IsWindow GetDesktopWindow GetForegroundWindow wsprintfW

advapi32

RegCloseKey RegOpenKeyA RegOpenKeyExA RegSetValueExA RegCreateKeyW RegCreateKeyA RegEnumKeyA RegCreateKeyExA RegDeleteKeyA RegQueryValueExA

rpcrt4

UuidCreate

ole32

StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromString

msacm32

acmStreamOpen acmStreamConvert acmStreamUnprepareHeader acmStreamClose acmStreamSize acmFormatSuggest acmStreamPrepareHeader

dsound

ord11

dmusic.inf

SHA256 d93e8faf798cd31f44d2ceb42506e00d26b2834aad77fe0915e906aaf543cbf6
MD5 6e5ed8816a6182d57502b63c91a833af
SHA1 7bd69ac6bb9d08756f00e34f4638b9b4f2cfdd8c
SHA512 77efc0c1607a438ed273bbc2bbb2d5d87810606949255cc0e75f4feb3a09f0f947a7d225f731b227f87fb306cec9e732b62a00251269947a6e31a505c15a861f
SSDEEP 384:b7reL4Pzs+0QMswKMAoyGtP5tD1nCfeCbmhvOzvqz0s7gs3kp70P7eRO+O2q+rZe:2W3r1oHE7yo6SfjctgW2h/ey+UG4q
TLSH
T195136A19FECEE09AEFDBE18558D41A61675C06A310CFFF6812DDA7680D0B9F5E02A053
MD5 SHA1 SHA512 SSDEEP TLSH

dmusic16.dll

SHA256 434177a11449014a0bf96fea458851b6aa268aaeef3bd09dd74a293fe42804dc
MD5 3de0f0fe027c0347613e43850f01ebde
SHA1 68c61d3fe7c4072df5f70bba4a2e39b6f05d97e6
SHA512 b0997c630db2298b8748e3c01fedcf499a4d65019add64fb0c36eea4d7cbbaea9c4bf6ccb9c7a0a49e6e69d4ed0ae91fb2917a0e511ca9ff9935e090f1bf61c7
SSDEEP 192:eG2ailZqZPJmBFshBqSPaBsoTEorTUiOp3nf39Dp4c3G1ZmF3:eG2aLdM6PaUorj6/va14J
TLSH
T1E932091B1885E0F9C8AF97B681A2D791A2B3EA504307D93B426C763F1D637DE63F1006
MD5 SHA1 SHA512 SSDEEP TLSH

dmusic32.dll

IMPHASH 1ccfadb4dbe74682899ff87a8270931e
SHA256 d92b6406970df79d4fcf6aff341e3db02f4014768d09afc18c4132f5594edf39
MD5 68167673b65d9f93eb3a693ecd9edc2d
SHA1 4b3c6dad3371ed408475ec088619216020fbfd09
SHA512 5e7eb07bee89c80f95fd967ffbfff2e75b4286391aaab8de647e19ab7cd65036c65bfcff44cf2cde0d855c5fa03dfbc5ba29ef6d7aa8c73f73823fbb82ae83b0
SSDEEP 192:CivkCwh+a57Fnf+r3kLfK/c/478xmhdtm5dabCNaAwB9L46/fyVgKWae6CWSA:7Q+a5xnA0VQxm5EbUaAQcgKWa7CW
TLSH
T193D21A1263A98037E8E2013506E67B467775E634EF2166A309053B5DBD72BD1C93AB43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12461

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dplay.inf

SHA256 89a14e722647aef89e8b5a36b8ac7e2b27f1398d35e4e401d411f823a5dfd1de
MD5 798d1b276d1ed717bb32666141cab716
SHA1 894a84a567bda05eb324f6d88e209677f72546ce
SHA512 3433fd995e9e6268ad9c4b8fbdace4faaab8f0ecfa5d694955796eb276f937866faa68c1f6132874c598e96e970529f34c72396b7f3a765c920f934936d1d602
SSDEEP 384:L09jzsEAqQCXXg8ouCR5zB7Bo0nRKBhBkRYTKB:vxQ4
TLSH
T12A62AB60BCDEB11131E275C07576A041687640F3580E82AC296643A7B39E6DEE3FE79F
MD5 SHA1 SHA512 SSDEEP TLSH

dplaysvr.exe

IMPHASH 0e2d56d5ee03e5e670b2f35982dccb42
SHA256 097996391cc9526350fef83a619ff6e123a14bde4fe96dfdaa22dbdfb63c2d2f
MD5 95b3e92debc8ce21f9be4a1aad5abecd
SHA1 c6ed2aecc3726eae54a4f9620385fbc4a838363a
SHA512 d59047e73443b6fd59ed56cc67e07e3d31357bfec79cf1130a31dd04ac710262f1d0ace55920174bb2e73a2d1cb2c6416795f2bd9662eb58174f9781efde6c6a
SSDEEP 384:U6cqBAsuftzYypZXBEOZqaEg440qmcG7qknkdigoJUr+7bIGiJhT8i6j9g3AlG2l:Eq2swn/Ia+qmc7oJ4MxiJhuWwl3OYo
TLSH
T190036B0174A8C83FE1534674C574AB16D7BA5E000BB5B7CF8B84A85BAB363D4EA39353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree DeleteCriticalSection UnmapViewOfFile GetCurrentProcessId MapViewOfFile SetEvent InitializeCriticalSection CreateMutexA CreateFileMappingA CreateEventA GetLastError GetCurrentProcess SetCurrentDirectoryA GetSystemDirectoryA HeapReAlloc QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetProcessHeap HeapAlloc LoadLibraryA GetProcAddress FreeLibrary CreateThread OpenProcess WaitForSingleObject ExitThread EnterCriticalSection LeaveCriticalSection CloseHandle GetVersionExA GetSystemInfo VirtualProtect GetLocaleInfoA RtlUnwind GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetCommandLineA GetStartupInfoA ExitProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapDestroy HeapCreate VirtualFree GetACP GetOEMCP GetCPInfo Sleep VirtualAlloc VirtualQuery

advapi32

RegEnumKeyExA FreeSid RegOpenKeyExA RegQueryValueExA RegCloseKey InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl

gdi32

GetStockObject

user32

DefWindowProcA RegisterClassA CreateWindowExA GetMessageA TranslateMessage DispatchMessageA

winmm

timeGetTime

dplayx.dll

IMPHASH f7fb5ea3bc53027ead16ead96f019707
SHA256 7b34ec8fe12ec73464176451f7e3805e9fea811bd325c796aaeeb69de3e3ceab
MD5 29b06eee0438ee7d5aba9bd077a71dbc
SHA1 8d22b5e12c61df8ed1f3a8d47bcd53acb5e6476f
SHA512 98c524b9af9de566e95cbc6c10d03fc741674cde02e1033942c787594d58e69acb1b749007541e82279d912c8f1f017b5b8c18afc2dcbcec86e8ceaa31a71339
SSDEEP 3072:y4F9P3vuhsq0BUjd0vTGNf3hP9TQK09AveWb/SfrKLt4U5T6Oh/T3u7:j9P/u+KlRB9w4tjT5u
TLSH
T17F245B02BBE00871CC571AB9899D335563A8CB8E4975D31B0B39187F2B15CF25BB9B1E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

74728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ReleaseMutex SetEvent WaitForSingleObject GetTickCount CreateThread ResetEvent lstrlenA Sleep FreeLibrary GetVersionExA DuplicateHandle GetCurrentProcess LoadLibraryW LoadLibraryA GetProcAddress CreateEventW CreateMutexW CreateFileMappingW OpenFileMappingW OpenFileMappingA CreateProcessW CreateProcessA CreateFileMappingA GetCurrentDirectoryA CompareStringW CompareStringA GetProfileIntA InterlockedIncrement InterlockedExchange DisableThreadLibraryCalls LocalFree DebugBreak WaitForMultipleObjects HeapAlloc HeapFree HeapReAlloc GetProcessHeap WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime TerminateProcess GetStringTypeA VirtualQuery GetSystemInfo VirtualProtect GetCPInfo GetLastError MapViewOfFile CreateEventA CreateMutexA GetCurrentProcessId UnmapViewOfFile IsBadCodePtr IsBadReadPtr GetModuleHandleA GetModuleFileNameA CreateFileA CloseHandle SetFilePointer ReadFile InterlockedDecrement IsBadWritePtr InitializeCriticalSection DeleteCriticalSection EnterCriticalSection GetCurrentDirectoryW LeaveCriticalSection GetLocaleInfoA LCMapStringW LCMapStringA RtlUnwind GetCommandLineW GetCommandLineA ExitThread OpenProcess ResumeThread GlobalFree GlobalAlloc ReleaseSemaphore CreateSemaphoreA VirtualFree VirtualAlloc GetStringTypeW

rpcrt4

UuidCreate

user32

wsprintfW wsprintfA

advapi32

RegDeleteKeyA RegDeleteKeyW RegCreateKeyExA RegCreateKeyExW RegDeleteValueA RegDeleteValueW RegEnumValueA RegEnumValueW RegSetValueExA RegSetValueExW RegEnumKeyExA RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyA RegQueryValueExA RegOpenKeyA RegCloseKey RegQueryInfoKeyW

winmm

timeSetEvent timeKillEvent timeGetDevCaps timeGetTime

dpmodemx.dll

IMPHASH 11047f92afa1f1e11ff8e095545a3dd4
SHA256 d534784f662aa9931720b0e98033ace7524c7bef57d5ccc8ab7b4dd19efd64f1
MD5 8b2252f3f84baa481821d25f94561eba
SHA1 73d427c5abcbdac7970fa9b7c21c37d7d12a7812
SHA512 35381452f6b19aa9a74af22840be3dc179a3f76af459a3b2a1ce5bb8a235b8878e727ead84726d9dc01bd5ab0c092490f6caa6779d2bb63b430c40fcae425b6c
SSDEEP 1536:zCyuZtSYke5V1Ct4pGRVWRs32dLzDGWjeWzohhYut/E:TuZAYkQi4pG721zDGWjeWzohhYut/E
TLSH
T1CD93011563F54612F0B39F7498F643E36A7EBC51BE36C31F9A40670E2831A949A20B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls LeaveCriticalSection EnterCriticalSection PurgeComm EscapeCommFunction WaitForSingleObject SetCommMask SetEvent CloseHandle GetOverlappedResult GetLastError ReadFile ClearCommError WriteFile GetCommState ExitThread WaitForMultipleObjects WaitCommEvent CreateEventA ResumeThread SetThreadPriority CreateThread InitializeCriticalSection SetupComm SetCommState CreateFileA lstrlenA Sleep GetTickCount HeapAlloc HeapFree HeapReAlloc GetProcessHeap WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess SetCommTimeouts DeleteCriticalSection

user32

DispatchMessageA KillTimer PeekMessageA SetDlgItemTextA GetParent wsprintfA SetTimer GetWindowRect GetDesktopWindow SetWindowPos GetDlgItemTextA EnableWindow GetForegroundWindow DialogBoxParamA GetWindowLongA EndDialog SetWindowLongA GetDlgItem SetFocus TranslateMessage SendDlgItemMessageA LoadStringA

tapi32

lineInitialize lineShutdown lineDeallocateCall lineOpen lineNegotiateAPIVersion lineGetID lineGetCallInfo lineGetDevCaps lineAnswer lineDrop lineMakeCall lineClose lineConfigDialog

dplayx

gdwDPlaySPRefCount

dpnaddr.dll

IMPHASH 641a2dc94ce0a0b96209bc3eec8d3983
SHA256 9cfe5ddb7e75abcf519d7154e1342d41ee6c7a4d0cfd6c5f85995ebdd2e66ec1
MD5 0241a6a1d283bff0a322cf8898bf0d73
SHA1 a9aa624be8bc5074a1d466d41db579bccd35ca28
SHA512 f3e1ad9eaf8dbc5ebd7bdf571f68542c3a5bba18a84513a027cc8008079f6e19b4886b00b06f56182107147ae81a949e7da30e0f9a08c0948503dc887a2681bf
SSDEEP 24:ev1GSMXLf0Rl+UEiU2FSlGa844ehJmlbZW0VMHG9NFfPoKC35Wgr9PYPNV:qMXFUEiDFSl1GeiBZWNHMtoB5WSPg
TLSH
T18572A901A7F84579F4B70B7019E60B2B617EBC20AEBAC61E0E68525D2D71A65CD30F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpnet.dll

IMPHASH e360be635b983f3aa711f451096754da
SHA256 5a81c4be82aefca0a3bd90f946b78434cced4e3328fb5a83cbc54798e9633a5f
MD5 8b880d82126d8c56fae18458216e4262
SHA1 29dd6500eaf32c82b39a12fdf169b56b31a9c719
SHA512 c1353abb24b33363dd31f85e2e2170543e8a438fcdb10f8fcf5ecc256efa8d9cfb3c7636de22e1eca696f28fa39f0c5855a4978fc4830e0ebd461a517fbe3748
SSDEEP 6144:45mvyNFq928DvFgkO6VZX2LQ+bkttC3fwjxJ3nOT+u85+BKjgdxNFzXJmOrSRvse:45tqckFg5bwooxhOT+R5TjgdZzipt
TLSH
T183E4810267F84219F6F37B306AB813655E7ABD91AD39C94E0281249D1DB0E42DFB4B73
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

124626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA DisableThreadLibraryCalls QueryPerformanceCounter GetTickCount IsBadReadPtr GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess IsBadWritePtr Sleep GetCurrentThreadId ResetEvent InterlockedDecrement SetEvent InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection HeapFree GetProcessHeap GetCurrentProcessId HeapAlloc CreatePipe InitializeCriticalSection IsBadStringPtrA GetLastError GetVersionExA FreeLibrary LoadLibraryA lstrlenA WideCharToMultiByte MultiByteToWideChar TlsFree CreateSemaphoreA TlsAlloc TlsSetValue WaitForSingleObject TlsGetValue WaitForMultipleObjects ReleaseSemaphore InterlockedExchange WaitForSingleObjectEx SetThreadPriority GetCurrentThread CreateThread CancelIo SetWaitableTimer CreateWaitableTimerA InterlockedExchangeAdd InterlockedCompareExchange GetModuleFileNameA SetLastError OpenEventA CreateProcessA GetSystemDirectoryA ReleaseMutex UnmapViewOfFile MapViewOfFile CreateFileMappingA CreateMutexA GetCommandLineA OpenProcess GetExitCodeProcess Process32Next Process32First CreateToolhelp32Snapshot CreateFileA SleepEx GetOverlappedResult WaitForMultipleObjectsEx SetCommMask PurgeComm SetCommTimeouts SetCommState ReadFile FlushFileBuffers WriteFile lstrcpynA FormatMessageA GetStdHandle DuplicateHandle

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoCreateGuid StringFromGUID2 CLSIDFromString

msvcrt

malloc _adjust_fdiv _initterm free wcscpy wcslen _stricmp wcsncpy wcsrchr _wcsnicmp sprintf strstr strncpy swprintf srand _ftol wcscat _wcsicmp wcscmp wcstoul wcsncmp _splitpath memmove strtol _except_handler3

wsock32

WSASetLastError sendto setsockopt shutdown recvfrom inet_ntoa gethostbyaddr inet_addr bind getsockname select WSAGetLastError __WSAFDIsSet socket getsockopt closesocket ioctlsocket gethostbyname htons ntohs WSAStartup WSACleanup gethostname

user32

CharNextA wsprintfA PostMessageA DialogBoxParamA GetWindowLongA EndDialog SetWindowLongA GetWindowTextA GetDlgItem SendMessageA SetWindowTextA LoadStringA

advapi32

CryptReleaseContext RegCloseKey RegEnumKeyExA RegEnumValueA RegSetValueExA RegQueryValueExA RegQueryInfoKeyA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA RegCreateKeyExA CryptGenRandom CryptAcquireContextA

dpnhpast.dll

IMPHASH e688c48d8f962e056917b777bb5f3f5c
SHA256 862751dd9a31bdaea59bac1b200f72b5d6c80964ff9c57211ad2fb38a90653a0
MD5 c57592a4b6bd657f25b732488d51a933
SHA1 d39380dc6c66859e04fc20628bf560a21aba37ca
SHA512 511ed84cb07cd3017b6cd4445b61a5da86d41cb055fcb442ee796dc522c6a96a6d9326b13fbe398dcebb523ef53d586e23513d18c461ec7a0723c875351f776d
SSDEEP 768:gKL21So71f0rSP2GmxjPoQ25YQ181BhE2Te:gKL2WA2Gmx7LUYQ181vXTe
TLSH
T1F6135C01EAE0C475D0A363F06D6C7352E6FBEA721A648D6B63012D892934793F3BD746
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpnhupnp.dll

IMPHASH 60ed152f260b1eac811f86cb69dc678d
SHA256 2f0a5d4e64dba93cbe70a4651129832dcd4a0b015489e49af7f5a9bcfff7c0a9
MD5 3c5c23b14969bad864adbebc8b2ba2d1
SHA1 b5305b1b2f6b86e38bded03aa821b9c0144cd64a
SHA512 5b174211d882875b6a29b3088501a0d257093f9e21b38187a9c1f61fb7919f0c78874ce1c3877461fe2f0997f642d47e5d4166b2df11e32ee3f61d0bd55a8162
SSDEEP 1536:7p/XKy9vK3bCUVYVYB4OEdzsWyyTaLo/dF7:VluYVdOuO1o/dF7
TLSH
T1BA734AA6E9F15475EDB213B014283345F6F7BA151B209C9B3B015E8B077A6C3F2B921B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

54606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId ReleaseSemaphore OpenEventA IsBadWritePtr DuplicateHandle GetCurrentProcess CreateIoCompletionPort GetModuleFileNameA Sleep InterlockedDecrement PostQueuedCompletionStatus SetEvent CreateEventA FreeLibrary GetVersionExA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetProcessHeap HeapFree GetProcAddress LoadLibraryA WaitForSingleObject CloseHandle CreateSemaphoreA IsBadReadPtr LeaveCriticalSection EnterCriticalSection MultiByteToWideChar InterlockedIncrement DisableThreadLibraryCalls DeleteCriticalSection WideCharToMultiByte GetLastError InitializeCriticalSection lstrlenA HeapAlloc

user32

wsprintfA

winmm

timeGetTime

advapi32

CryptReleaseContext RegQueryValueExA RegSetValueExA RegEnumValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegCreateKeyExA CryptAcquireContextA CryptGenRandom RegDeleteKeyA

ole32

CoInitializeEx CoUninitialize StringFromGUID2 CoTaskMemFree CoCreateInstance CoSetProxyBlanket

msvcrt

_initterm _adjust_fdiv malloc free wcslen _stricmp _strnicmp atoi strncpy swprintf srand _except_handler3 strstr strtok strchr _splitpath

dpnlobby.dll

IMPHASH 641a2dc94ce0a0b96209bc3eec8d3983
SHA256 55546d20ab72753e0cc4bb53009c87d4a4a68e5293ce2f4cfb5848ade70535a8
MD5 d8f07b526c2161b410ed55c9ac020299
SHA1 73c018def2fde4ec99155f66b8b8ffe86bc54982
SHA512 e4710c6c3c96b521392ab46d293c28e417223854cfafb72d62a57eaad2c61a589573c10d2714f5a6e0b3aa34a2883048162b72c0e10e12e1d58d01bc05ab2d11
SSDEEP 24:ev1GSMXLf09lsiEvUJDqylGBlsuZ4uehJmlbZW0DHG5NfPRFC35Wgr9PYPNV:qMX0Ev4DqylO+ceiBZWAHI3RG5WSPg
TLSH
T1FA72AB01A3F84A79F4A70B7518E70F6B617EBC20ADA6826D0F54134D2C759258E30F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpnsvr.exe

IMPHASH baae137c778bcc5dcc0dd2e891a5e245
SHA256 ae6fa382de9599b20de1241b2c3a58b51f56dec7989287f2f03b86895950dbb6
MD5 a2b4bd6ed35827a0bee28f87513c0852
SHA1 62b7baf523a7446cfc99ab14d290ee7807b38cfd
SHA512 98b97997495db00fadf825a24d58d466574c7b8522e3eb9aebcbaddb4ca1cab484eaa59c96d4c062513aee09de5d3ab9bbba8ccad21872e90211b01c5127655a
SSDEEP 384:oV1KKLMnvsylHuI2gWOX1GVMUx7NwGB6MWrYXW:M1lMvsI52g7KwGX
TLSH
T15ED25C42B7F688BFF49687300E962B1AF2FCA6904870971E5F444D8F1A7E5909535B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection CreateMutexA CreateEventA ReleaseMutex WaitForSingleObject UnmapViewOfFile MapViewOfFile CreateFileMappingA InterlockedDecrement QueryPerformanceCounter GetCurrentThreadId SetEvent GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess GetTickCount LeaveCriticalSection EnterCriticalSection OpenProcess GetLastError CloseHandle InterlockedIncrement OpenEventA lstrlenA CompareStringA HeapFree GetProcessHeap GetCurrentProcessId HeapAlloc CreateSemaphoreA ReleaseSemaphore GetStartupInfoA InitializeCriticalSection GetVersionExA FreeLibrary LoadLibraryA WideCharToMultiByte MultiByteToWideChar

ole32

CoCreateInstance StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx

msvcrt

_except_handler3 _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv _initterm __getmainargs _acmdln exit _cexit _XcptFilter _exit _c_exit srand __setusermatherr wcslen

advapi32

CryptReleaseContext RegCloseKey RegQueryValueExA RegOpenKeyExA RegCreateKeyExA CryptAcquireContextA

user32

wsprintfA

winmm

timeGetTime

dpvacm.dll

IMPHASH f981406e3d1ad54dccf4fecf9e46a444
SHA256 0bd629d05fd0795c470e39ee317c578186f3979d6378c1c5491e19880e8bf945
MD5 5a4295f7b02b5e0e9a7e5df2aa9224ab
SHA1 6467da1566e19fdbcf82c03a8b7666c7986f81fd
SHA512 05955a838daa03f63a8f194ea6be5d18b6df6d23bdcd46c8508a3337fda0b2b9183cbad79e78f024a2a9299c5b661915cd7d5bab5b5ffdf3509194ec54302beb
SSDEEP 384:DzCYBmeq8qmjN4qHuSTbRUJJJ6LL97XhF0I/wUNpdEoKreWkTzWWhy1:DzCYBxq8hj5zZUJ761VF1/D+oKrmVy1
TLSH
T174E23B46BBE24577F4B246B009783762DAFEE6A16EA4CD0E530168C51871B03D9FDB23
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16985

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpvoice.dll

IMPHASH 5aee207477294953954c51dc722e6c2a
SHA256 408ece801253a05c86465e08aed1a12d3c59c9863c5e7475bdde1a41ee6904b4
MD5 10de4a08f6cc0edd48d1ae1f336c83c0
SHA1 71772f91716c6c01024be19ed28ba0a8c055b2e1
SHA512 7348c8e962270cbc0053507363dad2d94f5fcdb780f8353729b23e9bb6cdf5be2b3f04112338798d614a86f10d6c059a4d595a267b74b47d15d58333598da364
SSDEEP 3072:qMEVwFPzhKCUyuV/4SR2gAcCtqZwfqGSjIkX7oKnOE5knUic+CqDEN57Eg88UakV:W54pgdZhGSj1oHslYCS4dh
TLSH
T150849211E7F98221F8F37B7C6DB817926E367D529E34C50E6644228E1DF4A52EA20733
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

71844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess QueryPerformanceCounter InterlockedCompareExchange InterlockedExchange SetThreadPriority ResetEvent IsBadReadPtr Sleep IsBadWritePtr GetSystemInfo CreateSemaphoreA CreateEventA GetProfileIntA SetLastError GetSystemDirectoryA ReleaseMutex CreateFileMappingA MapViewOfFile UnmapViewOfFile lstrcpyA DeleteCriticalSection GetTickCount WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement ReleaseSemaphore CloseHandle SetEvent WaitForSingleObject CreateMutexA TerminateThread GetExitCodeThread GetWindowsDirectoryA GetExitCodeProcess CreateProcessA HeapFree GetProcessHeap CreateThread InitializeCriticalSection GetLastError GetVersionExA lstrlenA FreeLibrary LoadLibraryA WideCharToMultiByte MultiByteToWideChar HeapAlloc

msvcrt

swprintf __dllonexit _onexit malloc wcslen _strnicmp strncat strncpy _ftol wcscat _CIpow _except_handler3 ?terminate@@YAXXZ _adjust_fdiv _initterm free _beginthreadex _endthreadex sprintf _purecall wcscpy __CxxFrameHandler fclose fflush _vsnprintf fputs vfprintf fopen srand

user32

LoadStringA MessageBoxA LoadCursorA GetSysColorBrush RegisterClassA InvalidateRgn DefWindowProcA IsWindow GetClientRect BeginPaint EndPaint UnregisterClassA GetWindowLongA EnableWindow DialogBoxParamA GetParent GetDlgItem EndDialog LoadIconA SendDlgItemMessageA PostMessageA SetWindowLongA SystemParametersInfoA GetDC ReleaseDC SendMessageA EnumWindows GetWindowRect GetSystemMetrics SetForegroundWindow SetWindowPos GetClassNameA GetWindowThreadProcessId

winmm

mixerSetControlDetails waveInGetDevCapsA PlaySoundA waveOutGetDevCapsA waveOutSetVolume waveOutGetVolume mixerGetID waveInGetDevCapsW mixerGetControlDetailsA mixerGetLineControlsA mixerGetLineInfoA timeGetTime waveOutGetDevCapsW

advapi32

RegFlushKey RegEnumKeyExA RegCreateKeyExA RegOpenKeyExA RegDeleteKeyA RegQueryValueExA RegSetValueExA RegCloseKey

ole32

CoUninitialize CLSIDFromString StringFromGUID2 CoInitializeEx CoCreateInstance

comctl32

CreatePropertySheetPageA PropertySheetA

gdi32

DeleteObject LineTo CreateFontIndirectA GetDeviceCaps CreatePen CreateSolidBrush GetStockObject Rectangle MoveToEx SelectObject

dpvoice.inf

SHA256 6842ec89b0453e1ace1b62cac39a550abb8cc014136db7926388e19fd9921f15
MD5 25887d6e6f3931813cab4ce5a9979b5d
SHA1 048bc6aa7d3a297c1d91f66fa9d0420b035b1f65
SHA512 d5212ad9a22f36bf07c2de4514e87df421232195a0f4fe64a14fdd2d66b42132f6a3d34f9593826e0cb9e09ca4c1c1574f45fd919501d03c0fce42871086552a
TLSH
T192B09294A98765242125A9388EA30299B6AA482192A8A14CBA9121288366608E15DBAF
MD5 SHA1 SHA512 TLSH

dpvsetup.exe

IMPHASH 10089713ee9a30e6ce6391ce7f2f267f
SHA256 271e5fac1db07d6c9c739158298b80999b625fa2e312bbe9e401b79db5f511e3
MD5 763017348c8c27c1e264d403c91e9ebd
SHA1 76fe9a22b304fb9b00cf87a7da1b7c54a2189de2
SHA512 71caf0d322b2fdd847fe07eb2f223e6f8c16ad446c7d77afd3a506581bd884172e2fd778c87842bdc702ec9c5f281fec0df2790d52bb1d0f90edc5334a1dbecf
SSDEEP 1536:W5XB7N7fzj88/vUoWu2mMkOHccMQv0GCuKqEhYLYywBu3PB:4BZ7fzj88/vUoIc40HuKh72PB
TLSH
T101834902378486BFC14102344429CB79C6B9AD110B2593EF77A8BE1BBD786D3A93F756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetCommandLineA FreeLibrary LoadLibraryA HeapFree GetProcessHeap HeapAlloc SetLastError GetStartupInfoA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetVersionExA WideCharToMultiByte MultiByteToWideChar Sleep CreateProcessA CloseHandle GetExitCodeProcess GetWindowsDirectoryA GetExitCodeThread TerminateThread WaitForSingleObject SetEvent CreateMutexA lstrcpyA WaitForMultipleObjects CreateThread CreateEventA UnmapViewOfFile MapViewOfFile CreateFileMappingA ReleaseMutex GetSystemDirectoryA OpenFileMappingA OpenEventA

msvcrt

__set_app_type _except_handler3 _controlfp __dllonexit _onexit __p__fmode __p__commode _XcptFilter _exit _c_exit fopen vfprintf fputs _vsnprintf fflush fclose strncpy strncat sprintf _strnicmp wcslen srand _stricmp _adjust_fdiv __setusermatherr _initterm __getmainargs _cexit exit strtok _acmdln

user32

GetSystemMetrics LoadStringA LoadCursorA GetSysColorBrush RegisterClassA InvalidateRgn DefWindowProcA GetClientRect BeginPaint EndPaint UnregisterClassA GetDesktopWindow GetWindowLongA EnableWindow DialogBoxParamA IsWindow GetParent GetDlgItem EndDialog LoadIconA SendDlgItemMessageA MessageBoxA PostMessageA SetWindowLongA SystemParametersInfoA GetDC ReleaseDC SendMessageA EnumWindows GetWindowRect SetForegroundWindow GetWindowThreadProcessId GetClassNameA SetWindowPos

winmm

waveInGetDevCapsW waveInGetDevCapsA PlaySoundA waveOutGetDevCapsA waveOutSetVolume waveOutGetVolume mixerGetID waveOutGetDevCapsW timeGetTime

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2

advapi32

RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegFlushKey

gdi32

CreateFontIndirectA DeleteObject GetDeviceCaps CreatePen SelectObject MoveToEx LineTo Rectangle GetStockObject CreateSolidBrush

dsound

ord1

comctl32

PropertySheetA CreatePropertySheetPageA ord17

dpvvox.dll

IMPHASH 9ca221c3a877565ad9bffec04d44c52e
SHA256 b55a7babc9f61c41b681fa1d737f26beab08455033463b8d0c3391133f8cd422
MD5 bd85e25caca6b99dbe5256a27afee494
SHA1 cc84b4e9837d9b7db435a3df0ddd7b233eb27a1d
SHA512 aeb260698bb9f668587b34ab53a8bb7864f7daf8b3a36791af6ef4e67336ed5fa488a0de3fe79b78f1acf7d3ff9fbdb59713490fff12ccd7e537e3476c93667f
SSDEEP 3072:Z95+SLEHm5akkiAvqPKKsoD2JVaQCFMtkB:T5lfa1iAvBK92qw
TLSH
T14CC3AF427CD00079E7974738BD7632A4A3F89A226D74AE4DDF5818432D64987E2EDF0B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

107803

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpwsockx.dll

IMPHASH 09addee8b7ec4821384d561a5e591c40
SHA256 3b080e509a75171b82b39b7e932239cce4f116f88ca7d6e8958207f3318d4594
MD5 b8b466d78f1f455162d9be1ccde1aeb8
SHA1 406d1a50abbc70d4f445d10193fc538881b64022
SHA512 b009b3a86be9859a81f491ba4b66e914573f7cef18b4de53a42d57ef6573a6a3e518a6c0e0f1c71004647c5ef3d92e2ac0576abb1a06e77697e10b104acf0dc0
SSDEEP 1536:XXC0ncastiEHj10W4pDqoId/MdugRAPQXOeCPOdPKhM0DdfK9mVefoxes:XutuW4RIdeeeCPORKhM0DdfK9mVefoxe
TLSH
T16D83E71177F50036F4A35B70D9F51BA2AA7EFD226A7A925F4B50264D2870D00EB30B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

38198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

InterlockedExchange Sleep ResetEvent SetEvent SetThreadPriority CreateThread WaitForSingleObject GetVersionExA DisableThreadLibraryCalls HeapAlloc GetProcessHeap ReleaseMutex UnmapViewOfFile OpenMutexA MapViewOfFile CreateFileMappingA HeapFree CreateProcessA GetSystemDirectoryA OpenEventA GetCurrentProcessId HeapReAlloc WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA LoadLibraryA GetCurrentProcess GetSystemInfo VirtualProtect GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA RtlUnwind VirtualAlloc GetCPInfo GetOEMCP GetACP GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings VirtualQuery FreeEnvironmentStringsA VirtualFree HeapCreate HeapDestroy GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess GetCommandLineA FreeLibrary GetProcAddress ExitThread WaitForMultipleObjectsEx InterlockedDecrement GetLastError InterlockedIncrement InitializeCriticalSection CreateEventA CloseHandle DeleteCriticalSection EnterCriticalSection TerminateProcess LeaveCriticalSection

user32

SetWindowLongA GetForegroundWindow SendMessageA SetFocus GetDlgItem GetWindowLongA GetDlgItemTextA EndDialog DialogBoxParamA

wsock32

select __WSAFDIsSet getpeername recvfrom gethostname gethostbyname send sendto listen accept getsockname connect setsockopt inet_ntoa WSAGetLastError closesocket inet_addr getsockopt WSACleanup WSAStartup socket ntohs bind ioctlsocket htons recv

winmm

timeGetTime

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey SetSecurityDescriptorDacl FreeSid AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor RegEnumKeyExA

dplayx

gdwDPlaySPRefCount

dsdmo.dll

IMPHASH 320f45a32628b35d761b69e505a2c544
SHA256 d60164f66f45a3ee692180cf957f275ca8d32eea980aae48146524def9126d4b
MD5 c10c18f0240b68e109f7105182bc4a36
SHA1 34122ce596c5fae2d0d8befe4fcac9b51b102310
SHA512 0212cb872fd21ad2c813ece9cfc5035328674feb408e1b42d30bede09da7184014a321414dd8aedff9519a0d7e6b6e4475a9dc1ed55f728fa0af851c1ea3018b
SSDEEP 3072:UsyqAITGF1KTvloaTcHWCXV4BHJQtuVQt1GkBqBxrj19cJIYxIMOUmSx76klU3VQ:DyqAITGF1KTcZSj19cJIlMOUmStjxAeN
TLSH
T1A1042A52670B5CE2EB5A38F055BCBBFAD2348B41622158036EB0DF757167079B8AD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

110994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dsdmoprp.dll

IMPHASH 44c532b5aea3995196546902607fa520
SHA256 27dc4a5fd56b26d5435d72e3a0248e101dc13c057b158fa7d873891d8ab59670
MD5 811a253931005eaa806b86e97e90b466
SHA1 88446b3a2421c362a2f316a91e5f57c50fe2315d
SHA512 f0d9347198bf73652188d732fadd595978017bfe8d70efefdfb7ed83f39073865cd358012c8ce59dca992d74a7a0c409f1413ab74a117d143018e20327c4f4c9
SSDEEP 3072:fdoLmLDLOOikjGGMHCfq14jQx1Y2ers2Eqq2T4duGgFp2:NDLOOlEx
TLSH
T1BEA40C653BD8C09AF1A746722DF01FD3AC66BC41AE18CE4FEE55730EA839900EF51619
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatA GetModuleFileNameA FreeLibrary GetProcAddress LoadLibraryA DisableThreadLibraryCalls SizeofResource LoadResource FindResourceA GetLastError LoadLibraryExA GetShortPathNameA lstrcpyA MulDiv GetCurrentThreadId HeapAlloc FlushInstructionCache GetCurrentProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess HeapDestroy EnterCriticalSection LeaveCriticalSection lstrcpynA IsDBCSLeadByte lstrcmpiA lstrlenA InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection Sleep GetProcessHeap HeapFree lstrlenW WideCharToMultiByte LockResource MultiByteToWideChar

msvcrt

_initterm malloc free ??3@YAXPAX@Z realloc ??2@YAPAXI@Z atoi atof _ftol _vsnprintf _purecall _adjust_fdiv

gdi32

GetDeviceCaps CreateFontIndirectA SelectObject GetTextMetricsA GetTextExtentPointA DeleteObject

oleaut32

SysFreeString SysStringLen SysAllocStringLen RegisterTypeLi LoadTypeLi SysAllocString VarUI4FromStr

user32

CheckDlgButton IsDlgButtonChecked GetDlgItem GetDC SendMessageA CharNextA ShowWindow MoveWindow IsDialogMessageA SetWindowLongA DestroyWindow IsWindow LoadStringA GetDialogBaseUnits ReleaseDC CreateDialogParamA WinHelpA

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance

advapi32

RegCloseKey RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCreateKeyExA

dsetup.inf

SHA256 43d98a55b040eae4db199ac050522b733d02a299e3be2b05fffacbfd9770ab31
MD5 a06b5275c3c861c55792b211b395f89b
SHA1 a9c4acbc2c6d4087cd95172bd0cf29241b245a75
SHA512 5fb77346484e19a237efd526ec1d94659f30bafdb5ba86faf7e49d003ac1d63e3f2a50452a25a474c4d3435b5fdc7517ef847a9fef3b11ccd426beb43d0eab47
TLSH
T14A313AA69115D45751AD6386E88D8806DE674E0B3500EFCC0C5C0A4CF76ADCBB6DE0FA
MD5 SHA1 SHA512 TLSH

dsound.dll

IMPHASH 126b58900e8d9ef3e39cf2dcd1f2d31e
SHA256 c0306da0740cbfb32c36d12f824a59229c307ef99dbc431953ea0d5d3c057739
MD5 4c0a02d02cc4ab2bc1d4808856c7abd9
SHA1 aff2d62f15efcd4467297480d17a17fe21d8b392
SHA512 a369b528fd12b9d8fd59c7d3c4c5e6a844f8fd82ad5f7efdca1785953419b8400429e93973326d8468e811557bb1428dec2ef44c5d0af561159c4162c5355dc0
SSDEEP 6144:Wi5RZLLfsEAO6O229FYOuGfBmn/o/KS/8q3TSa7YZSZghD6We24hkj+Xy3m0UQ:75zsE029cG++JbSa7wG86WDAw+Q4
TLSH
T11FA47DA3BDE2C0F5F6B752F186257F1972EE9F90C9F9CD4A02D91C852926111F239223
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

160212

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapCreate HeapDestroy HeapAlloc HeapFree DuplicateHandle GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryA GetLastError MultiByteToWideChar WideCharToMultiByte GetVersionExA SetThreadPriority SetPriorityClass GetThreadPriority GetPriorityClass GetCurrentProcessId GetCurrentThread DeviceIoControl ReleaseMutex SetEvent WaitForSingleObject UnmapViewOfFile OpenMutexA MapViewOfFile CreateFileMappingA CreateEventA lstrcpyA CreateProcessA OpenEventA SetLastError GetWindowsDirectoryA FindResourceA CreateMutexA DisableThreadLibraryCalls GetCurrentThreadId Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InterlockedIncrement InterlockedDecrement CreateThread GetExitCodeThread ReadFile GetSystemDirectoryA GetOverlappedResult ResetEvent GetTickCount WaitForMultipleObjects OpenFileMappingA GetPrivateProfileStringA MulDiv QueryPerformanceCounter GetSystemTimeAsFileTime TerminateProcess OpenVxDHandle ConvertToGlobalHandle RtlUnwind ExitProcess HeapSize RaiseException LCMapStringA LCMapStringW HeapReAlloc VirtualFree VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr GetLocaleInfoA GetCPInfo VirtualProtect GetSystemInfo VirtualQuery GetStringTypeA GetStringTypeW UnhandledExceptionFilter SetConsoleCtrlHandler WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA GetACP GetOEMCP SetFilePointer GetFileSize GetCommandLineA GetFullPathNameA CreateFileA GetModuleHandleA GetModuleFileNameA OpenProcess CloseHandle

user32

LoadStringA EnumWindows GetWindowThreadProcessId IsWindow GetForegroundWindow GetParent wsprintfA CharUpperA GetWindowPlacement CharLowerBuffA

advapi32

RegCreateKeyA RegCreateKeyW RegOpenKeyExW RegQueryValueExA RegSetValueExA RegSetValueExW RegCloseKey RegOpenKeyExA

ole32

CoCreateInstance

winmm

waveOutGetDevCapsA waveInGetDevCapsA waveOutGetVolume waveOutSetVolume waveOutMessage waveInMessage waveOutGetNumDevs waveInGetNumDevs waveOutOpen waveOutClose waveInOpen waveInClose mmioOpenA timeGetTime waveInUnprepareHeader waveInReset waveInGetPosition waveInAddBuffer waveInPrepareHeader waveInStart waveOutUnprepareHeader waveOutReset waveOutRestart waveOutPause waveOutWrite waveOutPrepareHeader waveOutGetPosition mixerClose mixerGetControlDetailsA mixerGetLineControlsA mixerGetLineInfoA mixerOpen mixerSetControlDetails timeEndPeriod timeBeginPeriod waveInStop

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

rpcrt4

UuidFromStringA

dsound.inf

SHA256 2e4258ad5fda79156740519a994d2f1bad2e0ce2bc50097b8091dffff662bf78
MD5 7c9a09e48a3567f85d6856805c9f0bc2
SHA1 c3fd6bd20b47dcd1102c415b6e2dbe49cdf29627
SHA512 3d552d12a1953f261baf32b0a67369524ee5b513c70f18d44938258dca7b5971b4ea856e31f188f9d21ff819287b29c52a4025b0c35153136d29db0f4059370e
SSDEEP 768:au1SdfDzvtiMAe0V1ZUrBNBCBsBgB+AVB1BVB5UnBhB2BoBcBiAxBJBhBlxO/nxs:mtDSoEdrLrGBPOMYRf3P3ZW7Wh3vpX
TLSH
T1D6F2D0AE378DA2D2A3CCC5E8ADD0BB19558C44B1E0C6BD5D36A0DED4190D1A423BC7DB
MD5 SHA1 SHA512 SSDEEP TLSH

dsound.vxd

SHA256 31fde40f0309d3e16c09b43f23c6ff4eb7b0fcd87037759c84a40d39d1fc1b04
MD5 8e8c14918a5736f78211680c3c970476
SHA1 f0a8d94cb4c0c22f22ee0e4f22b7ff1ad39a765e
SHA512 bc875a5f0e66914ecc5d24313e19609ffe200632f77fe92cb8e6701f3160a62c149546342c0c67d620b8dffda77e2e7934979410d579f0f35cc48b0bd99d52b2
SSDEEP 768:QHPvEvvRl9jcHR1JLlt5Gdjx+n/czgKGTfJMjJpFyAWdZ0sbn7g/XqQQdi2C:QHnEXRl9jcHR1JLlt5Ijx+n/czgPytrF
TLSH
T1DA236C522CB3E5B6D0677173551FA24BAFAE1B625E220B3D83182D145330230DBEE7DA
MD5 SHA1 SHA512 SSDEEP TLSH

dsound3d.dll

IMPHASH 03deea28c2baec368335052cd61db3aa
SHA256 d258030efabc5d048700b029422ccff5a9bb87ffa204c9cdcd9105ab985b5469
MD5 cbcaa27f84a4cc5257d2545859c91c7e
SHA1 712d94699ed15fe31b20fe7c3e90b19f1e0e86cd
SHA512 f72429d47f5a94f55ace397893bc9c821a30a3c05f80915dae072340ac875efa9f3326ed379eca8e86d61a60adb73841aa6b1cfe1a1fdc67f9b72539a96c499f
SSDEEP 12288:c9gU5I4qC5iFvSLAJYEAg17b1F0UQyHhnBJn5uoMnQCH6BRURa15rm/VixUn3O0F:xvSLAJYEAg17b1F0U3xiMfQedyG9
TLSH
T132555BC8843F58AEFA9824FA50FDB88FA1FC19DD65F43B55808913897D7620076E90F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1297015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dswave.dll

IMPHASH 53dde5acafd181deae6d47482f150b5b
SHA256 86d8604ba2889e87e30fb183497e4dc23ac8d260cf161033651dcb9c85bfe6a1
MD5 bbaa3fdf2438841dffc4580e194b0f20
SHA1 bdbb6959f67dfa40e300233d9c2a0d2f071a1dcf
SHA512 8f5d47ad5e504f6b6bb7d84e1be85e01f1f477b0aa5ee1bceb9a333ee54f488bce35a5e6025b59d708deaeaea0ec164d9952a43a76d3f010f5475c4de6251d39
SSDEEP 384:QFP3nusjsTdybx6/KmH46S0KsidPygv10LRsAnnkpVWhyUW:y/usjwybaSBXdPygN0L6AIJ
TLSH
T1C4824B4177F148FAC453A7304AD6735323A2DB681D1C9D1A06201F593EB89D3EAFD647
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dx7vb.dll

IMPHASH 1075cfd402ecf012fa24c5ee66bf0f31
SHA256 f270c9de7da2627cb6984b44fc67022c183d8613c9aed6ab9b1d0c2c0fbdc0c2
MD5 78d1da9a3e3f427755c9773d8192e52e
SHA1 79223653ed1f10da7938139e55ff272515c4d55e
SHA512 fc54f8df7d9986c396ed5da1402caaf299c1c3a7a7e25589a770ed9d62dd01fba298f47cb5468cca5d1910da4fc74399a59a06518a15c0dcc8083718383aa888
SSDEEP 12288:rLpS9GAJhSDocJH0OsyUmScvjvA2/r1JHBp8HxGdlWsr+O1p3fRKKWdlqq1SCgnY:rGN4HG
TLSH
T192D4D5637381C9E3C9491630A817A74A9FF560063F06E7877385135E2E623D6BF0E6DA
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter LockResource _lopen _lread _lclose WriteFile FindResourceW OutputDebugStringA GetModuleHandleA CreateFileA GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile FindResourceA LoadResource SizeofResource GetModuleFileNameA lstrcatA lstrcpyA HeapDestroy GetCurrentProcess GetLastError lstrlenA GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar LocalReAlloc lstrcmpiA LeaveCriticalSection EnterCriticalSection CreateEventA CreateThread ResumeThread GetSystemDefaultLCID WaitForSingleObject CloseHandle SetEvent GetTickCount GetProcAddress lstrlenW GetVersionExA DisableThreadLibraryCalls FreeLibrary GetSystemDirectoryA LoadLibraryA LocalFree LocalAlloc InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection

msvcrt

_except_handler3 wcslen _wcsicmp wcsncmp _wcsupr wcscpy

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyA RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA RegEnumKeyExA RegSetValueExA

ole32

CoCreateGuid OleInitialize CoGetInterfaceAndReleaseStream OleUninitialize CoCreateInstance CoMarshalInterThreadInterfaceInStream CoTaskMemFree StringFromCLSID

gdi32

SetBkMode SetBkColor Polyline CreateBrushIndirect CreateSolidBrush CreateHatchBrush CreatePen GetObjectA CreateCompatibleDC SelectObject StretchBlt DeleteObject GetSystemPaletteEntries CreateHalftonePalette GetPaletteEntries CreateICA GetDeviceCaps Rectangle RoundRect Ellipse ExtTextOutW SetTextColor GetTextAlign SetTextAlign DeleteDC

msacm32

acmStreamSize acmStreamUnprepareHeader acmStreamConvert acmStreamPrepareHeader acmStreamOpen acmStreamClose

user32

LoadStringA CharNextA GetWindowRect GetDC ReleaseDC LoadImageA wsprintfA

oleaut32

VariantChangeType SysStringByteLen VariantInit VariantClear SysFreeString SysAllocString RegisterTypeLi LoadTypeLi SysStringLen

dx8vb.dll

IMPHASH d7478ded6c8775462f2d7c0c8f58d1d9
SHA256 8fa336594a3282822338dcbe7e3b0ddcc44e89bc584c9e0b502c9eacceec32f8
MD5 ca7c40cafe9cfb722545adf137cba0fc
SHA1 7a13abbb74193a78bdccc0e00bc485c7ff6d9786
SHA512 aad4edd8dae252dc4db10f20f83832ceeceb48e38874b9b05998a358d3907665765c7a3b344bd1be70a80a5200163885e46ece515642fe8f08e1871fc8b4b134
SSDEEP 12288:5LoAAp8bHeb7fcoz3NcB23tKGCV6Hj2j7exFGnixvkNstVkEmakJTW/K9dCsGB+o:5cKtX9zqIKS/2eLGqeX+r7MoQ+/T
TLSH
T11B455B03B395D8E7C8071630A957A399AAF166437F06A6C77388172F5E633D07F2634A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

67726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetFilePointer ReadFile SetThreadPriority GetTickCount Sleep lstrcmpA WriteFile FindResourceW OutputDebugStringA GetModuleHandleA HeapValidate LockResource CreateFileA GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile FindResourceA LoadResource lstrlenA SizeofResource GetCurrentThread GetModuleFileNameA lstrcatA lstrcpyA HeapDestroy GetCurrentProcess GetLastError GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar lstrcmpiA CreateEventA CreateThread ResumeThread GetSystemDefaultLCID WaitForSingleObject CloseHandle SetEvent GetProcAddress EnterCriticalSection LeaveCriticalSection lstrlenW DisableThreadLibraryCalls FreeLibrary LoadLibraryA InterlockedDecrement InterlockedIncrement DeleteCriticalSection GetProcessHeap HeapFree CreateFileW IsProcessorFeaturePresent GetVersionExA IsDBCSLeadByte GetTempPathA GetTempFileNameA DeleteFileA InitializeCriticalSection TerminateProcess

msvcrt

malloc ??3@YAXPAX@Z ??2@YAPAXI@Z _purecall realloc free _CIacos _finite _ftol wcslen sprintf wcscpy ceil ?terminate@@YAXXZ exit floor _CIpow _setjmp3 longjmp sscanf isspace isalnum _except_handler3 _snprintf __CxxFrameHandler qsort _controlfp _wcsicmp _strdup setlocale calloc _vsnprintf atoi isdigit isalpha

advapi32

RegQueryValueExA RegOpenKeyA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegDeleteKeyA RegSetValueExA RegCloseKey

ole32

CoGetInterfaceAndReleaseStream OleInitialize CoCreateGuid CoCreateInstance CoMarshalInterThreadInterfaceInStream CoTaskMemFree CoReleaseMarshalData CoMarshalInterface CreateStreamOnHGlobal CoUnmarshalInterface StringFromCLSID CoUninitialize CoInitializeEx CoInitialize OleUninitialize

gdi32

GetDeviceCaps CreateICA GetObjectA SelectObject CreateFontIndirectA GetCurrentObject GetOutlineTextMetricsA DeleteObject GetGlyphOutlineA GetGlyphOutlineW SetTextColor SetBkColor SetBkMode CreateDIBSection CreateCompatibleDC DeleteDC

msacm32

acmStreamPrepareHeader acmStreamOpen acmStreamSize acmStreamConvert acmStreamUnprepareHeader acmStreamClose

user32

DispatchMessageA TranslateMessage LoadStringA CharNextA wsprintfA DrawTextA DrawTextW PeekMessageA

oleaut32

SafeArrayCreate RegisterTypeLi LoadTypeLi SafeArrayDestroy SysFreeString SysAllocString

d3dxof

DirectXFileCreate

D3DIndexBuffer8GetData D3DIndexBuffer8SetData D3DVertexBuffer8GetData D3DVertexBuffer8SetData D3DXMeshIndexBuffer8GetData D3DXMeshIndexBuffer8SetData D3DXMeshVertexBuffer8GetData D3DXMeshVertexBuffer8SetData DXCopyMemory DXLockArray8 DXUnlockArray8 DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer VB_AddDataToBuffer VB_AddStringToBuffer VB_D3DColorARGB VB_D3DColorMake VB_D3DColorRGBA VB_D3DColorXRGB VB_D3DXColorAdd VB_D3DXColorAdjustContrast VB_D3DXColorAdjustSaturation VB_D3DXColorLerp VB_D3DXColorModulate VB_D3DXColorNegative VB_D3DXColorScale VB_D3DXColorSubtract VB_D3DXMatrixAffineTransformation VB_D3DXMatrixIdentity VB_D3DXMatrixInverse VB_D3DXMatrixIsIdentity VB_D3DXMatrixLookAtLH VB_D3DXMatrixLookAtRH VB_D3DXMatrixMultiply VB_D3DXMatrixOrthoLH VB_D3DXMatrixOrthoOffCenterLH VB_D3DXMatrixOrthoOffCenterRH VB_D3DXMatrixOrthoRH VB_D3DXMatrixPerspectiveFovLH VB_D3DXMatrixPerspectiveFovRH VB_D3DXMatrixPerspectiveLH VB_D3DXMatrixPerspectiveOffCenterLH VB_D3DXMatrixPerspectiveOffCenterRH VB_D3DXMatrixPerspectiveRH VB_D3DXMatrixReflect VB_D3DXMatrixRotationAxis VB_D3DXMatrixRotationQuaternion VB_D3DXMatrixRotationX VB_D3DXMatrixRotationY VB_D3DXMatrixRotationYawPitchRoll VB_D3DXMatrixRotationZ VB_D3DXMatrixScaling VB_D3DXMatrixShadow VB_D3DXMatrixTransformation VB_D3DXMatrixTranslation VB_D3DXMatrixTranspose VB_D3DXMatrixfDeterminant VB_D3DXPlaneDot VB_D3DXPlaneDotCoord VB_D3DXPlaneDotNormal VB_D3DXPlaneFromPointNormal VB_D3DXPlaneFromPoints VB_D3DXPlaneIntersectLine VB_D3DXPlaneNormalize VB_D3DXPlaneTransform VB_D3DXQuaternionBaryCentric VB_D3DXQuaternionConjugate VB_D3DXQuaternionDot VB_D3DXQuaternionExp VB_D3DXQuaternionIdentity VB_D3DXQuaternionInverse VB_D3DXQuaternionIsIdentity VB_D3DXQuaternionLength VB_D3DXQuaternionLengthSq VB_D3DXQuaternionLn VB_D3DXQuaternionMultiply VB_D3DXQuaternionNormalize VB_D3DXQuaternionRotationAxis VB_D3DXQuaternionRotationMatrix VB_D3DXQuaternionRotationYawPitchRoll VB_D3DXQuaternionSlerp VB_D3DXQuaternionSquad VB_D3DXQuaternionToAxisAngle VB_D3DXVec2Add VB_D3DXVec2BaryCentric VB_D3DXVec2CCW VB_D3DXVec2CatmullRom VB_D3DXVec2Dot VB_D3DXVec2Hermite VB_D3DXVec2Length VB_D3DXVec2LengthSq VB_D3DXVec2Lerp VB_D3DXVec2Maximize VB_D3DXVec2Minimize VB_D3DXVec2Normalize VB_D3DXVec2Scale VB_D3DXVec2Subtract VB_D3DXVec2Transform VB_D3DXVec2TransformCoord VB_D3DXVec2TransformNormal VB_D3DXVec3Add VB_D3DXVec3BaryCentric VB_D3DXVec3CatmullRom VB_D3DXVec3Cross VB_D3DXVec3Dot VB_D3DXVec3Hermite VB_D3DXVec3Length VB_D3DXVec3LengthSq VB_D3DXVec3Lerp VB_D3DXVec3Maximize VB_D3DXVec3Minimize VB_D3DXVec3Normalize VB_D3DXVec3Project VB_D3DXVec3Scale VB_D3DXVec3Subtract VB_D3DXVec3Transform VB_D3DXVec3TransformCoord VB_D3DXVec3TransformNormal VB_D3DXVec3Unproject VB_D3DXVec4Add VB_D3DXVec4BaryCentric VB_D3DXVec4CatmullRom VB_D3DXVec4Cross VB_D3DXVec4Dot VB_D3DXVec4Hermite VB_D3DXVec4Length VB_D3DXVec4LengthSq VB_D3DXVec4Lerp VB_D3DXVec4Maximize VB_D3DXVec4Minimize VB_D3DXVec4Normalize VB_D3DXVec4Scale VB_D3DXVec4Subtract VB_D3DXVec4Transform VB_GetDataFromBuffer VB_GetStringFromBuffer VB_NewBuffer

dx9w9x.cat

SHA256 d1ce7289c997c0fbba52a52a98b9a87ff6fcd13a761266fdc8bb10f1693fd776
MD5 42bdc7102bf0bbfe9f28408697264fe6
SHA1 b36ea4a0796ecbb2b70c08c96634efa93de49830
SHA512 9a1c95c5f13ac3e43f5677c9be7ab1bb4f6485181b1c39fe06d54a75d71e02864a97e384950fc97fd0190b0ce3bb87ca4937f6762b40b238a1bffd6cbf30241d
SSDEEP 384:1K6StMMssRd+dmwwrXnjdBQxj5Akmhe1OHrD8:s6SjssBcj5AkmC
TLSH
T1A5130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxapi.sys

SHA256 493d22d2aa1363f2372dbc53d79c09ea9d4f21284fd31baf03db744f5763225f
MD5 48eead1da71ad8462f9f5911b7b94184
SHA1 4a1082989b8e586ef68e357aa7401a13066548d9
SHA512 0c19f639d00a552146fda846859520c3771921080d0366a8d96012636949eba9fb80914289705f11cdd581a9dbc6f1a63bd79cf86173ac4c068e9a51bdf78962
TLSH
T112419911BBF81E6AF4B30F7469B727276679B8709B31D61E0690211D3C32E60D9B1B72
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

256B

Virtual Size

242B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

32B

Virtual Size

1B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

32B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

128B

Virtual Size

99B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

960B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

32B

Virtual Size

14B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dxdiabrz.chm

SHA256 9ca5aee16796d8bcc7b8b540e5e205001ed8f9a83dc4a4a75da813048dd73838
MD5 53c73ef6daffdb7c3730c1608777e1d5
SHA1 4f26b1ccb0b2250377b848da5950bc10bf2f55cb
SHA512 d69cb7fdad285c8da0c7d4a99a868b966eb31252f86534eeafbfa928ae15c0ce3a91c1d1bca2b077385c3e48d3c979a61eb892d0d38db4b28970ea130a18043e
SSDEEP 384:6Dg65cgcal9pVJsRDy5vzPctpT5EMpkvRDja3etj5kk/CS:6Dg2cgx33sBmPctZSMpUi0bCS
TLSH
T1BAB2CFFB0590C02FC1C346F22EE542C6751D3D56DA921ACB12A9163D9BB368C8FB2D27
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiachs.chm

SHA256 ae5417657ca355416d9d12e90f1e543c7518880e695c2cbfda7a15423c52349f
MD5 73e82b73df5fadafad4b6769e629f785
SHA1 b394d6d6e3dc8266710df5f36b35c308db7f03d7
SHA512 8a4c80f3db5ac3171eea8dae5d9aa3d734b9fbfc26b8977b27527853b092c8373ba7d8b1f6c5e76ce53d816eaf64dd203d4a074a6d299775f3d14aae33d853e2
SSDEEP 384:Lx9c2X4IusikWoiEAC/40BoYH5VAdUZxav5srqSCA+z6pISlXx0Vw3zxdT:Lx9Fssiih44oYH5VHVrSuXx0VE1V
TLSH
T1F8C2CF9133904420E685D83E7A858A43F04A3F17E2DAAA0DF052BBAD1673F0767619B7
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiacht.chm

SHA256 5bbb6a9b1bdb2ec80f8c5fc4a373ec5c2539081e146decd35183bd2ff50b64f2
MD5 024ad44006f8913db27a6dbf9914ca25
SHA1 7201b5d91e77be5a893a9492a37d4c7d75dea054
SHA512 75325fe6b535d26cfbc4d7804fa8623dd07c48f6c3c3b5b7a78cc697ac2e90de46d1337c55d702e455d2284f7e19aac6517b43b10ea8b6398dfc50104f177321
SSDEEP 384:P0rp30rPMPpJild4RO1UfTA5613+IC1Gyjkumtx1MrMxSTuK1743RLmN:P0rpkwpJ+iO1X5e3iGypmtx1Mrf7743m
TLSH
T137C2C0E9636AA95BD80217B65AB8130A92633C08CC5063EFA274332F14F5F641F7495B
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiacze.chm

SHA256 6d77211a660b988c5119b48003db33e990676d32633a37e93ff3f0b1d3e431f3
MD5 144b2198a88cecece732e1ff04b4e124
SHA1 47f84621c0721a8e94453fe5afa5e388edb87ed1
SHA512 00a9e91ae54d1754ce25bf97d1af794ecba87f3945c6986d3ad4a5997f892d8385f9cdc9670492da01e1caa7255c7eb6b80c21b1fa84e01b98d9acfccff8bf9f
SSDEEP 384:oFe5DsecRkWn7/VufDeH/9llasr/37n2wsgy/8bHCVvNuDZan4sgv:oFe5Lc+W79E293P/a5/8bO1uDZanRu
TLSH
T188C2E0B4BBE6A51DE215463153B0F1DFA70CECC4E568D4FC21AAD7A8372E246432C636
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiadut.chm

SHA256 11f25e59793a2fb3860f27223dc8a981b49f4b154a28b4cf63d540ef22ed4d2c
MD5 b0eef1fda652b64c59b113236bdaeea4
SHA1 a5851331a3b2e791a6d5de4a426952ef8168d9c5
SHA512 cf59892252684690608a45fd5e995cad07627afea9053cc88a6a6c7d5829a14b39d936fd837eb448d7b00ef47a49f230d0042f9bb8c304ecf376f632cb86f867
SSDEEP 768:1pFUiogyVdft7K9rRoELdKKbtAWeXDYqEl63oN/ojrHX:1pFUi3wdF7KFRoEL1bCWeOlL/Ub
TLSH
T130F2D1ED3FC599D1D3021A3AA2C91EC57138E63829CB839FE110FD657B67D9C2A2140D
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiafrn.chm

SHA256 05c1747926daad44bfc8e05f54b0d921e9690515c6898430aa665b629225ddc6
MD5 5a14a2abef5adaa08c025365ef47faab
SHA1 3f78e2c9ccc7d9ba62f41300bf197d8f05095daf
SHA512 4936ee5f1cc1bde9dc211d2ca46e7186e533e58629faf179dbb8d6ab1f10f52c52e8c960e9978c8d57effa96ac5db39b7891497774fd9f21545a20847286cb90
SSDEEP 384:JlgmbaNEcvpsUXk0Epc1LqY5kU9ahYxTIsALhKPkVF:JSmb3Up9k0NPkhKaLh0kT
TLSH
T1C7B2C07A23238314F4594A39BF9113A7A234AE5A8575D3D5F31BC6FC5BA7E88BB00061
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiag.chm

SHA256 aa50e05ccb8ded699db5a8da1068afd8bfef1f8717e6004419d89f2cf5e5e506
MD5 e4985c0c04a05d83da060409408d005a
SHA1 6b61a545a26fcfbe7b92bcb2e5490f981c285e90
SHA512 a0dbabf8db99d3603f12366ef0e2792cfbcfb4cf6504241b264e3a5504548a799f946a40fa387a5ef6ddf5e34b613301c4836951551126a8dbf93e5923c01da8
SSDEEP 384:HZjB8bflvUSUP0BsEq6hglFidAEeJvmezSXMgUfe7t:HZjBGBBspHOwJvVCme7t
TLSH
T12EB2C0F05AA02B49DA4526708B600657346F5843D2B19985F63BA21E1EBAD5CCEF23F1
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiag.exe

IMPHASH 6afdc72c2fb75b9c57b1310aa15524ec
SHA256 118ded435d8fc3d11c68690e47c0492a967eddb48dca9f78786a9bee14797129
MD5 4f3162002a3134b2a992e6c8b51e4482
SHA1 a122169e1cc5098ed668b8b409dc28b4aa3979b7
SHA512 eb2ca9ffac40e53cbbf6c0d34334a89e69f2d265fda7620453dac084b33ccb0f01a440ea905053f985c265766a3bd702ee48e48bc98e64ac7f0d7581f15914b6
SSDEEP 12288:F9EPfJdRJ8APNjUyYjEtP2U1cLioZ1XvL/QQZq4vObhmwYC/YvvDIJmhnpxlTBPB:F9EPfJdRJhVj+Mm
TLSH
T13B15E91067FD962AF1F36B346EB912924E37BD55AE39C54F9A14314E4932F80DB20B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

139924

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersionExA WaitForMultipleObjects SetEvent GetCurrentThreadId FreeLibrary LoadLibraryA Sleep WaitForSingleObject GetCommandLineA CreateEventA GetSystemInfo MultiByteToWideChar GetFullPathNameA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CompareFileTime GetModuleHandleA TerminateProcess GetCurrentProcess lstrcmpA lstrcpyA GetProcessHeap HeapAlloc HeapFree CloseHandle DeleteCriticalSection GetModuleFileNameA GetFileAttributesA InitializeCriticalSection WideCharToMultiByte GetCurrentDirectoryA GetSystemDirectoryA lstrlenW GetProcAddress GetWindowsDirectoryA SetEndOfFile ReadFile CreateFileA FlushFileBuffers SetStdHandle LCMapStringW LCMapStringA GetLocaleInfoA SetFilePointer IsBadCodePtr IsBadReadPtr RaiseException SetUnhandledExceptionFilter VirtualQuery VirtualProtect GetStringTypeW GetStringTypeA GetCPInfo GetOEMCP GetACP HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy TlsAlloc SetLastError TlsFree GetFileType SetHandleCount GetEnvironmentStringsW InterlockedDecrement LeaveCriticalSection InterlockedIncrement EnterCriticalSection lstrlenA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle WriteFile ExitProcess CreateThread GetLastError TlsGetValue TlsSetValue ExitThread RtlUnwind HeapReAlloc GetStartupInfoA

advapi32

RegDeleteValueA RegSetValueExA RegCreateKeyExA RegEnumValueA RegQueryInfoKeyA RegNotifyChangeKeyValue RegOpenKeyExA RegFlushKey RegDeleteKeyA RegEnumKeyExA RegEnumKeyA RegQueryValueExA RegCloseKey

gdi32

GetTextExtentPointA

user32

MessageBoxA LoadStringA EnableWindow SendMessageA GetDlgItem wsprintfA EndDialog GetDesktopWindow MsgWaitForMultipleObjects PeekMessageA IsDialogMessageA TranslateMessage DispatchMessageA SetWindowsHookExA UnhookWindowsHookEx PostQuitMessage UpdateWindow GetClientRect GetWindowRect AdjustWindowRectEx SetWindowPos GetFocus SetFocus SetTimer KillTimer SetForegroundWindow LoadIconA CheckRadioButton GetDlgItemTextA GetDlgItemInt SetDlgItemInt GetDC ReleaseDC SetWindowTextA CheckDlgButton ShowWindow SetDlgItemTextA DestroyWindow GetKeyState IsWindowEnabled PostMessageA CallNextHookEx GetWindowLongA DialogBoxParamA CreateDialogParamA

comctl32

ImageList_ReplaceIcon ImageList_Create ord17 ImageList_Destroy

comdlg32

GetSaveFileNameA

shell32

ShellExecuteA

ole32

CoCreateInstance CoUninitialize CoInitialize CoInitializeSecurity

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

dxdiager.chm

SHA256 ecf4dc10f45af9ca9276d45aaa783b68df0e0450533c3993042ef3e530244dad
MD5 8eddacb09e28fddf68c1d19fd20a7e39
SHA1 944aff3867b30abb7a6b3b588a7766a7a88f0169
SHA512 d228300471abe6eae963e34e49141f44cdfd286730d7ae3fdca7ce7017a061a3284e274a5234caa3ebdc4f5c6c86025f828e23c1c15e93dff5c6a47d64791973
SSDEEP 768:LpuQJ5RzN2PXp4CblEsv655v7Cd6z7BEuim4:LpuQJzQh4Gv6zo6X+uim4
TLSH
T19BE2E0F002AE1111E8959C379BA269CAF2631EC6EF40DD87E0F63B188296C525FD50B7
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiagn.dll

IMPHASH a438fabad246286c07f450a1005a2cb7
SHA256 11347c58564a4cd96b8e82432985dea61675d5093600e9be591f9b31ca21e463
MD5 005506ef420431ba1a25c083da22618e
SHA1 d2e7cadd3c09fd2abed7f7f4fd26a0c6349b8d89
SHA512 207cd9d3046f7e612944021ce3ee1e4f43b9903fdf69c935184900015eeb694578f7923f59b263ae5af2e0941d6123a219ecfa4ae552b1ee41e478d2704b51b7
SSDEEP 12288:mFYsHYnWiBQPbyf7tN0LpA5znYqJt9qrZdlfC3e8p5DT5DCf6d1kf6d1EAqe:mF3HZXbyf0MkgqjZYDlDCf6fkf6fEAt
TLSH
T18D752802A3FD5225F5F36F306E7922A55A7ABD92AD38C00E1284755E1D72F90DA70B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

355244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetDateFormatA FileTimeToSystemTime FileTimeToLocalFileTime FindClose FindFirstFileA CloseHandle CreateFileA GetFullPathNameA ExpandEnvironmentStringsA lstrcmpiA GetPrivateProfileStringA CompareStringA GetSystemInfo Sleep SetPriorityClass GetPriorityClass GetCurrentProcess GetProfileIntA GlobalMemoryStatus GetSystemDefaultLCID GetLocalTime WriteFile LockResource LoadResource SizeofResource FindResourceA GetTempPathA DeleteFileA LeaveCriticalSection EnterCriticalSection SetEvent ResetEvent WaitForSingleObject DeleteCriticalSection CreateEventA InitializeCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime SystemTimeToFileTime TerminateProcess GetLocaleInfoA GetCurrentDirectoryA GetWindowsDirectoryA OutputDebugStringA GetModuleFileNameA GetFileAttributesA InterlockedIncrement InterlockedDecrement MultiByteToWideChar WideCharToMultiByte lstrlenW GetProcessHeap FindResourceW IsProcessorFeaturePresent FlushFileBuffers ReadFile SetStdHandle SetFilePointer IsBadCodePtr IsBadReadPtr RaiseException SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA VirtualQuery VirtualProtect GetCPInfo GetOEMCP GetACP HeapSize SetEndOfFile IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle GetSystemDirectoryA lstrcpyA GetModuleHandleA GetVersionExA lstrcmpA CompareStringW GetLastError lstrlenA FreeLibrary LoadLibraryA GetProcAddress SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree ExitProcess RtlUnwind HeapFree HeapAlloc HeapReAlloc GetCommandLineA TlsSetValue

advapi32

RegOpenKeyExA RegQueryValueExA RegSetValueExA RegDeleteValueA RegEnumKeyA RegQueryValueExW RegCreateKeyExA RegDeleteKeyA RegOpenKeyA RegCloseKey

user32

GetWindowRect GetSystemMetrics CharNextA GetDlgItemTextA SystemParametersInfoA IntersectRect OffsetRect EnumDisplaySettingsA ReleaseDC GetDC CharLowerBuffA LoadStringA FindWindowA GetKeyboardType LoadImageA ShowWindow DialogBoxParamA SetForegroundWindow PostMessageA KillTimer SetTimer EndDialog IsDlgButtonChecked GetWindowTextA InvalidateRect SetWindowTextA CheckRadioButton EnableWindow GetDlgItem InflateRect SetWindowPos GetCursorPos SetCursorPos ShowCursor SendMessageA MessageBoxA SetRect PeekMessageA GetWindowLongA DefWindowProcA RegisterClassA CreateWindowExA

gdi32

GetDCOrgEx GetClipBox DeleteDC CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleDC GetObjectA GetStockObject

winmm

waveOutMessage mmioOpenA mmioDescend mmioClose mmioRead timeGetTime waveOutGetDevCapsA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ole32

CLSIDFromString CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantInit SafeArrayAccessData SysFreeString SafeArrayUnaccessData SysAllocString VariantCopy VariantClear

dxdiaitn.chm

SHA256 38281c3e17b2d9c0485012ea200022d0036d3a68873d828f03ec1fa825314f81
MD5 dafc6ee570887cefae4debe72b49650e
SHA1 b1da18985d246b4aabf2872ebf70180afb821484
SHA512 d8e1ed5f61625491d4a53dad42b1d18f60594f314f19a75dc1049ef601ff8cee8a17a62e1c6da345f518caba9cbe28ecf93c8a6f1c57271d9398d59ee106c874
SSDEEP 384:ZxAkR2OekdPNjEePStyBDd5W/OTl9XKijfvIqe60Kf:ZxAUdPNwdcDd5z9XKi7Aqe6V
TLSH
T1FCC2D0C437108E0CCD0499F3F185E1887AB63F42AC50DF5AFB2D6E48BAB5F895B56152
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiajpn.chm

SHA256 da682d976eaa8f066a4cd6ca96dc67abcddbff2715c7998f8a18298423c29370
MD5 81f4ee6ba91a82ef3b435d93911a6873
SHA1 8d4425cdc1f62eb6432cabe0dc4f497ecad6fab6
SHA512 ddb0e4350b6f7e02b5c39ebe6271c8d41b83ae1b2fa8f74f06a5a8e9607386fe4e5f4abd5d4c3673b897489e96e4fcd307bf1c6039a97a5fbc0e2be228339ace
SSDEEP 384:dVZvmyl49vMl/EMtxlGtU86d1uwI02PRyLIf6Ch75bdvLypkX8O4dtmmrJ:dzOyaulXlGtV6C02PRIISApvLfMORml
TLSH
T1DEC2D0831F210332E4266F35B99F2DC6BB594C06FC69BB168EA2B57C0EB7D491015A73
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiakor.chm

SHA256 d9e0d7fcbb6210a8eb8675a37c72dd7fba95a0daa3dcd5eb06baae57bf5ff79a
MD5 b49cd05759b11df66a9f6fd74e04b1a0
SHA1 ddd408554d9701afdcc41b99e65a04ab71eda3af
SHA512 5ba2df5370d2e39e4a9eaf10619f943646ced896c97bb3cc42f633566286fc9544a1493d8e3b1ededc530eb2d6988bdf46c5a2b59644cd967d729c55280f6f17
SSDEEP 384:iGmCZvXVmIlW7kLXXzfkSbf5KdvDP0O+xYEXR3AHxh4o00qpYOs8i772N:iGmI8I5jfkSbfk0O6mHxhO0ELsN2N
TLSH
T15CC2D0745742D193E14E4533AFDE29E239127C107E3866D6F417DB3E8B77E5848E1421
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiapol.chm

SHA256 7015d193adeace0a781ce065c7a53b11c1dbc54caa26e2c14b29ce9c857d5685
MD5 e82515e43e735747d1953e61f02be720
SHA1 1837c25922728ec14c47d75fd6fd39756aa3b988
SHA512 9dfcebfaf8bfa11dc742bf833b5e3d7c0b70a5a9a188b77cc738a7540442cc1e078cfd6bb9437df01f695023c137a34ab4f75bbe122fe16320fffada2cfb8fd8
SSDEEP 384:+TMeBMvZlZ0aASIkUm8orxybF14PtXjcRW2ta3pGTbhkBo2m+6pr:+TruZw7o8/5ktXjO+Gfhuoh+U
TLSH
T1C8C2C0C33302490CC5225F39B4E8EAE1F8E4AC37A150C25EF15CB5DDBB9BE1553459AA
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiarus.chm

SHA256 7526376dcc365dd1e0f23ed1ea915e599005d153c64a6527edfb2b292ef1dae4
MD5 b414edc29df6de61f3fce33b29a91b35
SHA1 b1953e743ee41ffe255de89e4c4f6759f90ff52b
SHA512 f40702046eedb885f13367362fcce7cb497df36cb349a6f710753977351b4a5c5e84e4753f8a23880f0b42f336bbe85a17b2e5d6b281fd66a976aaa934ddb737
SSDEEP 384:jNLm8bF3tITeSD4equLmug7zMCddq6i9A6WdeOraN8qvo/xU:jNL33t0DDxmusACHXi9A6WwOr/7pU
TLSH
T186C2D1F036D6156FD2B49A71F99A24C0805B3E659862B2CF51548F2CE6F80164FF4F92
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiaspa.chm

SHA256 e74077db52d39759c80ccbe7c79714c045e91d43917c2493259f1bbe98d729a3
MD5 d7eb8554de9524e080fd9228e25e71c5
SHA1 21a0cdd2da963b64ed2461a35db5018bc5035c69
SHA512 65a768d19e3be7856ccf05d5e4da25151e1085856abd789643525c32421de2e218c9c19cc0524a8ade5458e9e6b241dc36700a29567df2d5b20386b2ede79f83
SSDEEP 384:Qtoi5o60JWWIBPxzffOOvCQ+23H6BJOra5p90LlnuOUh+g:QtoewJWdvTfOe+wH6Ia8ndUf
TLSH
T152B2D0B823A1454CEC5046711BA886D7A4637E86A45CE196928CF33C1AB8F8F4384E72
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiaswe.chm

SHA256 42f60e3ac4651d996cdfa14b2c869b41595ece1bf04ee47ba684c0fbb0846531
MD5 b1acf7038845805fcf0d504d851429e9
SHA1 6f48f1449b28a939e7be8dfc697b34da2a570c56
SHA512 6b6831e801a57d008edfdf7f97ff87f589009bc92cd3a891e7f8f65c130d3b9f076e46b8c1c4f5c303bfab82b411931708ab8d33982ffcf18e723ce4812bbd14
SSDEEP 384:UOOgdCUxJuREySovd1MoQbCJ/Ag6Ru7jMrlxxaUz4W:UOOgdCUxJlb4MoPJ6Rvrlxx7z4W
TLSH
T10EB2C0BCF7A0126DE1866E3A73E1E0D7B486BC43D060D947755A17232FF498E239A022
MD5 SHA1 SHA512 SSDEEP TLSH

dxdllreg.exe

IMPHASH 7808fd325bf451cda117496280bd1fac
SHA256 81aefdb0459c6cc4c26ff98a3ee8e3a858aaa9eb9f53026d3f8c269a324e6fcf
MD5 5081f2fd42a97c2d8885f1de109f7b39
SHA1 e5531a7eb27e14f92ac7c4c6686ba90b1bba7b9d
SHA512 77a4cef3e8727d6b074f97d7d2338aedb5009119d326ee3c314bd8191cb9bbca1c8b44de1dede5df1366ca39670234de3e6ba35120de19a0c27b1d1b3e497b0b
SSDEEP 768:I42N/LzVSpZQ5zfovWKIvT5dI33zDIP75z0DiCbBkHunij6Ja6OVC/:J2N/LzVSpoZKITazG75QDiCbBkHuFJjv
TLSH
T192137D027360C17FD0C567780576CB25ABB6F4101AB1578F5B548A8EAFA37D0AF39392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError FindClose FindFirstFileA lstrcpyA lstrlenA GetPrivateProfileSectionA FreeLibrary GetProcAddress LoadLibraryExA GetPrivateProfileStringA GetSystemDirectoryA lstrcmpiA CreateMutexA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetCurrentProcess GetVersionExA GetWindowsDirectoryA OutputDebugStringA lstrcmpA lstrcpynA VirtualQuery GetSystemInfo VirtualProtect ReadFile GetProcessHeap SetEndOfFile RtlUnwind GetCommandLineA GetStartupInfoA GetLocalTime HeapFree HeapReAlloc HeapAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsFree SetLastError TlsSetValue TlsGetValue TlsAlloc HeapDestroy HeapCreate VirtualFree CloseHandle EnterCriticalSection LeaveCriticalSection VirtualAlloc LoadLibraryA GetACP GetOEMCP GetCPInfo Sleep InitializeCriticalSection SetStdHandle FlushFileBuffers CreateFileA SetFilePointer LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

advapi32

RegQueryValueExA RegDeleteValueA RegCloseKey RegOpenKeyExA

setupapi

SetupCloseInfFile SetupFindNextLine SetupGetLineTextA SetupFindFirstLineA SetupOpenInfFileA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

ole32

CoInitialize

dxdllreg.inf

SHA256 a424ebc884e0c9bb227c1e58d205b1aaf4d5495a5f50fc38e7e6c323e619fa6c
MD5 22e034aff6264e9ae75d57caac38a2c7
SHA1 7a89a59e0b629d1f08c8ca448c39f17003664bab
SHA512 5fe42a0c0b339e6d9dd4923e439042715ebad9ce5b77cb0f6a9e203be6857998106145ebe107ffea0d4ebb35dd6b735ad657cdd6cb74e6a525bce2f5a019b78f
TLSH
T12451AA9EE5B2402658D7B04DB810ACCF641224063B5EB7D9B39937D43AB394FACA403E
MD5 SHA1 SHA512 TLSH

dxmigr.dll

SHA256 493aa1fd4f2b508cfef2e465312d49a6f9282bdfb07c576d11f9cf29dd6f08ad
MD5 5856b96199c3db16faed3fa5f00fddd6
SHA1 05f9ff2ebc0993b374bd24bac8d5ca85de64e4ea
SHA512 228f4c26221605cc41fbf9133529f5f23cf41e709cd290f9194dcd1cce71b3598f460655ace803f5750169ca144ac33de42fdf9078a7d83c1e5eb06e018d3c6c
SSDEEP 384:4tL3+Z3SYIU85wkVpmQnK16tioa+z/kAuJQ:E383SxVorUsg7uJ
TLSH
T1E7625B8B27108AEFE21CBEB00F47C55BA9DFCD0A15B04B1358C1C55FD65D16B912ABB2
MD5 SHA1 SHA512 SSDEEP TLSH

dxtmsft.dll

IMPHASH c9cd26ae7abe9c1c280dbbd1211522a6
SHA256 9216b072c445c33b029f5c458277f3ba55e917ece96b098d17cf73590dcfa429
MD5 5226f5200dcf5ca0d5be361b19cbd272
SHA1 fd4f06ee86df3d62c597f53626b9c52337048efd
SHA512 0d35f4c748571a2a9e6d88e074b4df2f4d983effc3f818cca0088d9a6b5762fd4e34113bac8440c322eda4134691dfe42779eb85a2a698eea9d3d55440ec5817
SSDEEP 6144:sd8rKvpaLGrBdIXiYjSy9YZ+sNrRFaaP5zkMMssVfi7kimUmb9:48QIy1y9YZ+mnLT7kBb
TLSH
T12C747D8373C580F4E59716B249662FBB672DAB014C38D1A67B99C30F2FF2795A10DB06
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

164274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_purecall _onexit __dllonexit _adjust_fdiv _initterm labs sqrt _wcsicmp wcslen strcmp _controlfp malloc pow _ftol sin cos free ??2@YAPAXI@Z realloc ??3@YAXPAX@Z memcpy memcmp _clearfp _CIasin _CIpow _CIacos wcscmp memmove

kernel32

LoadResource FindResourceA SizeofResource FreeLibrary LoadLibraryExA GetLastError CloseHandle GetVersion GetSystemInfo GetProcessHeap GlobalFree GlobalHandle GlobalSize GlobalAlloc IsBadWritePtr IsBadCodePtr lstrcatA IsBadReadPtr GetModuleFileNameA lstrcpyA HeapDestroy lstrlenA DisableThreadLibraryCalls WideCharToMultiByte MultiByteToWideChar InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrlenW lstrcmpiA CreateEventA lstrcpynA

user32

CharNextA GetSystemMetrics GetAsyncKeyState GetSysColor GetDC ReleaseDC IntersectRect

ole32

CoCreateInstance CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemRealloc

oleaut32

VariantChangeType LoadRegTypeLi SetErrorInfo RegisterTypeLi LoadTypeLi VarI4FromStr SysStringByteLen SysAllocString SafeArrayAccessData SafeArrayCreate UnRegisterTypeLi VariantCopyInd VariantClear VariantInit SafeArrayUnaccessData

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegQueryInfoKeyA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA

gdi32

GetDeviceCaps

dxtrans

?DXDitherArray@@YGXPBUDXDITHERDESC@@@Z ?DXOverArrayMMX@@YGXPAVDXPMSAMPLE@@PBV1@K@Z ?DXOverArray@@YGXPAVDXPMSAMPLE@@PBV1@K@Z

shell32

ShellExecuteA

dxtrans.dll

IMPHASH d82b48d8792288ce391cff15677c8590
SHA256 8f65be7d10279ca7ddb91f7c4cd08312868d9e6d40b72e3abdb7c30da4ffd0dc
MD5 fcd4a19736956f437283f2835c1c94c1
SHA1 3aca57c15e924fa8caaf2f591e02b6f530fa048e
SHA512 96b09e13d09f66d609b940f13ae3d4469537f86965a1198b5ec8290f033b02629f727849f9b56931bcd7d9b2b18691cd1a3abca2e03ab64e77b9f9341ecc16fb
SSDEEP 3072:7QYrBVQ75R7hvTyN5Qa4bOMjdjh2fbjFTyz6zWmgMkzDiZw276GTwIY:7QYrw5XyTQDbO986zWmZkzDiewL
TLSH
T11314AF12B3E390F0D4872679841A7737D13D9F0A872FD7936BA8DD922E21621D07DE1A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

141993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError TlsGetValue TlsFree TlsAlloc SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetStdHandle GetEnvironmentStrings GetEnvironmentVariableA HeapCreate VirtualFree WriteFile VirtualAlloc HeapSize ExitProcess TerminateProcess CreateThread GetEnvironmentStringsW ExitThread GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW TlsSetValue RtlUnwind RaiseException HeapAlloc GetProcAddress lstrcmpiA UnhandledExceptionFilter HeapFree InterlockedIncrement DisableThreadLibraryCalls HeapReAlloc GetCurrentDirectoryA GetVersion GetCommandLineA ResetEvent GetSystemInfo CreateIoCompletionPort QueueUserAPC GetQueuedCompletionStatus SetEvent GetCPInfo GetVersionExA PostQueuedCompletionStatus CreateSemaphoreA WaitForMultipleObjects GetACP GetOEMCP LoadLibraryA InterlockedDecrement MultiByteToWideChar WideCharToMultiByte lstrlenA GetCurrentThreadId GetLastError CloseHandle GetCurrentProcess WaitForSingleObject HeapDestroy lstrcpyA lstrcatA GetModuleFileNameA IsBadReadPtr lstrlenW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleA IsBadWritePtr FreeLibrary LoadLibraryExA FindResourceA LoadResource SizeofResource lstrcpynA ReleaseSemaphore CreateEventA GetCurrentThread IsBadCodePtr

ole32

CreateBindCtx CreateFileMoniker CoCreateFreeThreadedMarshaler CoInitialize CoUninitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc

oleaut32

SysFreeString SysAllocString UnRegisterTypeLi VarI4FromStr LoadTypeLi RegisterTypeLi

user32

GetDesktopWindow GetDC ReleaseDC IntersectRect LoadStringA CharNextA

advapi32

RegDeleteValueA RegEnumKeyExA RegQueryInfoKeyA RegDeleteKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

gdi32

DeleteDC GetGlyphOutlineA PolyBezierTo LineTo MoveToEx DeleteObject BeginPath GetPaletteEntries StrokePath StrokeAndFillPath FillPath CreateBrushIndirect SelectObject SetPolyFillMode CreateFontIndirectA GetObjectA ExtCreatePen GetKerningPairsA GetTextMetricsA SetMapMode CreateCompatibleDC BitBlt EndPath

ddraw

DirectDrawCreate

dxver.inf

SHA256 e89e0edd20bda7b55fa98c0fea8a30bb3d8608f16435f2a82a1045fcb949a950
MD5 9930742214dec401f16fb01e91fee8c7
SHA1 7a50594af260080a34934e05ec2f8137ec0d8d3f
SHA512 0d5e03f5782f14567ca63cc07036a2de594dbf1e7468d9c6ed2af23e2c1a13f03e6a94148ef3cb428be7c5ee9eaeda2adb156c705c3bbffc8e5b29338e1ca88b
TLSH
T141D0A754A855F223E4149332CA070A57FFEDCE53114AF34CBAD439164612584A21E6AA
MD5 SHA1 SHA512 TLSH

dxw9xbrz.cat

SHA256 cb670be74338e39801dce7694bcf868c88be92a3993418ef98f7b6090decdd88
MD5 d9e67d9a2cf9b127bf4b3814a718dd99
SHA1 6c01a9be84ac05adfb2480f10317a1c761b2b11c
SHA512 38d5e60e75acf033301643c409994dc5dfd422a5c4c8e00c34a9abbe943d704eacf8dc7196787b3fb14735c818b4f98a6d35ff775a30fc64a0d4478e384e3044
SSDEEP 384:jK6StMMssh+dmwwrQnjdBQxj5Akmhe1OHrD6f:W6SjsgWcj5AkmC
TLSH
T102130D6715ED02629037C8B09FF5E44FE112FAABA8112DBD325333618543A52F3ADD2E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xchs.cat

SHA256 3e6807433eca494812110dad6dc802847e214c5c6804757a5caebc6701ab7aaf
MD5 26234355ffe75157dbe6da09dcec86c7
SHA1 56273c33a849c13b7014891b82dd90d2b63a70da
SHA512 65e2647cf9789485f8da9425babd95b4b42c938417bfadd7b626070b46864ea3a1ae9f7309a151eae6ca3171d18c813ab418b914772454c1e57a639cd433f232
SSDEEP 384:WK6StMMssh+dmwwrXnjdBQxj55kmhe1OHrDQ:b6SjsgBcj55kmy
TLSH
T1D1130D6715ED0262D037C8B09FF5E49FE112FAABA8112D7D325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xcht.cat

SHA256 e96ec8088d3819c0b91c9454cb8410ec4323bf03c45f60474a5b548a9f60df3a
MD5 abf84cd3e2322d1569a5afc577246b31
SHA1 e1053b162f759c7e7b406b43c4427632d8f0da63
SHA512 2f43879403e1d313d44911861ca6833723ccd081b348ec9041145c110ec724ccddb29553f78467155a4609fdc1ceaaca731f9f505e076b9d590040cc57cb73aa
SSDEEP 384:KqK6StMMssh+dmwwrXnjdBQxj5AImhe1OHrD2h:K/6SjsgBcj5AImg
TLSH
T1EC130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xcze.cat

SHA256 0cbb7bfbb78444832ac21b5333506e115986961dc880ccae6c4be13df0b983c9
MD5 08755d16da879194a2154e17a7e940e5
SHA1 fcbdd4f4e0fd508f67ea830dc1d34201f4d89e20
SHA512 f998373bcba6b7a86e9abecbf728888d6875964467f5f3e6e44fd4b76d43bc10edd3138fa4105fe7b836473d0f4d0119ab80dd049b22d26c3693570528c7ad2f
SSDEEP 384:kK6StMMCsh+dmwwrXnjdBQxj5Akmhe1OHrDCX82+:V6SjCgBcj5Akm8+
TLSH
T1FE130D6715ED0262D037C8B09FF9E45FE112FAABA8112D7D325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xdut.cat

SHA256 94780125dba0665f8c02df035d93d1cc702bf15924d36725a92c761d867bd915
MD5 e46a603851abc19d4aa2494ce8d27ca6
SHA1 885f762dd8bb3e0ea1fa615e483a679ad379030b
SHA512 831fe0585af3ee9d7d533240cf0ba9a7d76a75c64b14e838f401508cea590bf647039eb48e7a8243696a991096af595ad47fcb72bd93714328613b0eb6995db7
SSDEEP 384:hK6StMMssh+dmwwrXnjdBFxj5Akmhe1OHrDW:I6SjsgBPj5AkmY
TLSH
T147130D6715ED02629037C8B09FF5E45FE112FEABA8112DBD325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xfrn.cat

SHA256 f2d0835b590147d3c45f16c83a4421bc8b7d82e278eeb18e077948fe281de186
MD5 f80c9a5b529507b0c47e85a883f6878f
SHA1 efd2031905e9db4a18e7092ca50fa591f89647e5
SHA512 84c0ed63b9dc8df96d1def65edabc1b8e353b40b7a7f3cecb004e7c1cd7868b217a24e817afaec6d942e130a6859a06fcd4f2ed41aa5643e602a3caec30e6ece
SSDEEP 384:hK6StMMssh+dmww8XnjdBQxj5Akmhe1OHrDhR:I6Sjsg8cj5AkmV
TLSH
T12A130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xger.cat

SHA256 2331a6d677c934e0b67b0cbd733b780e5686f0faa7602415a05816692f55bcbb
MD5 a0eaf912b5a7c76a1782f17ea1147258
SHA1 591fcaa360a250ed7f03955d98fc942034c9d5ad
SHA512 7ad3721d08c807d923ca01875a1ba0c7222279dd8bdd8f3e50cacd0e8834741525f9f6cd2a71cdba7ad417fae704c35241a630665ef58fd0f39147c1f0449f88
SSDEEP 384:NK6StMMssh+dmwwrXzjdBQxj5Akmhe1OHrDyCrqn:U6SjsgB4j5AkmRq
TLSH
T101130D6715ED02629037C8B09FF5E45FE112FEABA8112DBD325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xitn.cat

SHA256 1d9f5b8a625f8b9b6cf1b7940c14032c253ac2a7350241ce48f4476de0044218
MD5 9d29b172b0beca576856abf3c74b4a2c
SHA1 5a24a90c62801a42390a48c9e1afe4119384fff1
SHA512 6b5a55b1f1373ecdc79525ddae9abd04ac5ef9034951dde30cd2308bb5358c698e3f92ce0888302b9488c496dcae213c09b8c9fa6603135a23454a36efb2a651
SSDEEP 384:+K6StMMssh+dmwwrMnjdBQxj5Akmhe1OHrDEgkN:z6Sjsg2cj5AkmKN
TLSH
T131130D6715ED0262D037C8B09FF9E45FE112FAABA8112D7D325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xjpn.cat

SHA256 c79bf3529bc79b7da38bed8b15c44cae985e9f42d8a7e496194ea1a1f5a0f435
MD5 a2a780b6004628f50e6da87c841c8fb5
SHA1 dfc5cfb1fa6c6c1a460836c2e9e3ef5ff2cf925b
SHA512 469436c08f882fd8e20cd56c19dd387afe34b14c4751da1f848727ab14611dbefa1d01f4d5817307f56a640a9b0f86b81fd3474637ebcb0bbb58536f981e60a1
SSDEEP 384:rK6StMM0sh+dmwwrXnjdBQxj5Akmhe1OHrDPgg:u6Sj0gBcj5Akmp
TLSH
T117130D6715ED02629037C8B09FF5E45FE112FEABA8112D7D325333618543A52F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xkor.cat

SHA256 a8e77bb8e165f7adc5fec30088ba6555a75c9764e617d4a79b11da0d3aec8ca3
MD5 bb6727f5edbd83817aff8f13a5392f23
SHA1 14893cb8a600e81dd22af67ef879f9a52acbc17e
SHA512 039bf51ff9aedb434eb6af69a54220fb054e6e702ddf95542180199f7fe91dc466aa6ca8daa29409aec359eb8b0c48799ae83601d427b7fd92d2d64aadd0ae5d
SSDEEP 384:iK6StMMssh+dmwwrXejdBQxj5Akmhe1OHrDdN:H6SjsgBNj5Akmh
TLSH
T137130D6715ED0262D037C8B09FF5E45FE112FAABA8112D7D325333618543A12F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xmig.inf

SHA256 7646e6ca3eb2359367bee35bb20792e67d5fab09ea5053add41b9402f28bcd5d
MD5 6669cd12a456fb6e1591c4728e5e3ab3
SHA1 91bcd3fc170c63b569d3dea180ac45b7f262ee66
SHA512 d9f440b36b2087db1baf79f57e7a4d4f4fb922021b86b2833353c3fb5edba652c411ba929adecdc6434a044153a543d646f6d3c9a8c308ba724817e8c67b158d
TLSH
T1B37101DDCE92486331AA7DC105480ECFE96B68547B3A1B6D54AF68C9802753F87A0939
MD5 SHA1 SHA512 TLSH

dxw9xpol.cat

SHA256 39e834a14cf3b90d115b2975cfe6711675d164374d025f6a4e6430ed83bbf28f
MD5 19baab004f2ffef5637092ea8245cd63
SHA1 c0ae8e2dfd574def657580b59f3f036404100a78
SHA512 61bfa30578041fcdabb92aeccf3492fe85e38950eef6a579015c81cef65b4de4c5e0bf43b15da8e0faef838573acc45bae9b2f2394fa6d8e6a88de8597533efa
SSDEEP 384:hK6StMMssh+d7wwrXnjdBQxj5Akmhe1OHrDCbc:I6SjsNBcj5Akm4c
TLSH
T124130E6715ED0262D037C8B09FF5E49FE112FAABA8112D7D325333618543A12F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xrus.cat

SHA256 70b1831f7418f3be3109d9fd4c176f4d067dd18aa96b39c0f728d6bf1480a429
MD5 2c9a3e62df85bfd6049afff313b0169f
SHA1 98aaa4e00a158700ddc1ff1767417293a2126ced
SHA512 9fe8f3cdf52ca45a1b951e0b95e4a4ae52fc96f8612e08015770a922f4701aeec5c57426b19c7893ff1c90dcaf2fc8c40521d353570b4d81281f9bb5d1a54caa
SSDEEP 384:zK6StMMssh+dmwwrXnjdBQ2Tj5Akmhe1OHrDmt:m6SjsgBhj5Akmot
TLSH
T1A2130D6715ED02629037C8B09FF9E45FE112FEABA8112D7D325333618543A12F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xspa.cat

SHA256 8d5d62923411c8df3eb99246407b0be366a6e1b49df6edaee1e4475db89100e7
MD5 adc54e6add6a432579766f8a2b5d0e2c
SHA1 e2688d33bbdd8f6c3a5878a2f08bf7f7542bd6bc
SHA512 2523e736ebf2711c83da3aef1e2402b215b66054a22fc4a4bde9c4e81fec13160af10bdb9deb0ec6394fb92ba009e259643bf7d68711bf37f8a00894c2f60933
SSDEEP 384:5K6StMMWsh+dmwwrXnjdBQxj5Akmhe1OHrDO:Q6SjWgBcj5Akmk
TLSH
T15D130E6715ED0262D037C8B09FF9E45FE112FAABA8112DBD325333618543652F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

dxw9xswe.cat

SHA256 598f18168a4020d741da27362ad51cbf8c6c2c50ccb66e1aebfac79a2bcfe61a
MD5 5a50af15c08c1588c6885c9b5a3b95cf
SHA1 0733272abd71321f2f2af9e6f7e48ad566959634
SHA512 3ad1a445615d0d42a6ce4f4033ec6c9350fa8646934c51139fcec89e751496ea58077c7f9ed01430b285f118cac3e2af0e001e94781a8a96fddbfa3a976f018d
SSDEEP 384:ZK6StMMssh+dmwwrXnh9dBQxj5Akmhe1OHrDg:w6SjsgBhij5Akmi
TLSH
T1CE130D6715ED0262D037C8B09FF5E45FE112FAABA8112DBD325333618583652F3AD92E
MD5 SHA1 SHA512 SSDEEP TLSH

encapi.dll

IMPHASH 7b51e9d3677f401a528065d95fdb10ee
SHA256 7bcad0821a0a296bf3fb1003b366f5b7f1120040cc87d6469a134f3896ed413d
MD5 932f661280ad438b1afa6623754edf0d
SHA1 6480a8f64fe91041fdb40a48827cd4f2ff7b80b4
SHA512 a96cceb542b34d8ec2a76509659749bd42a77f3750ec2cefea8a955175b23cd56ff42fae296c74c5a42cf9d6955259bd67d303b9fc5358ff77b1b6d65f3d645d
SSDEEP 384:YZEXbgyptTRxHVf7i1wnrCggwx4MkdquWVZWi:YZqbgyppRFd7i+n1gUkAln
TLSH
T1CC822A433FE19837D2A243B20EB03A1563FEEA294A75CE5587541D4A2DFD9C382B9713
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gameenum.sys

IMPHASH 6ec049c91ee0bab4ea8f0a7d19b52943
SHA256 4395af0b45946afc70730797e01dee4c5100aa9f0f89e1ce37b297f2a4996f40
MD5 cd12549b7c6399c2f4df0d12b0d98547
SHA1 7b8220d0e5eafaaaef19586bf1cd68af0f0f5b65
SHA512 7d20e22b824334a84d959befc808c2253eb0ee0490a194a55226588dec45da843880b911f37be899b181bf5fd9f43dfeb62c2cfd18645e57d2f0ae70bb697914
SSDEEP 192:vcY0P/A+everAWaqvOFqq9iVbO9FSR+0c3eEgeEHWWSzWk:Zj0AWa0qgN2sR8JgeE2WSzW
TLSH
T10E22284327F65476E9A307F248061B596177B7348B30D77B06BC881E2A3EE21B81A727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gcdef.dll

IMPHASH 658a2c8d831730c6656a96194ef0fa1d
SHA256 c418adc86fbb7495694b1812af031cac82977ca2c19665cff336bce66070db60
MD5 07c6d6b3e0ee85c8fa2e2b379a897dea
SHA1 2ff23ba31a8bc03dbbb87abc08c8198c38666062
SHA512 d20840582351b01637b37c8ef105c8a020d56cb85e0a8baa04c5d7d72cd753df58004f36733635bae1d3b7e64f46624474cc23f4068ee59de9fb9eae9446b5b3
SSDEEP 3072:2EGK94sk0w6CVnhg5WqlxtVmSPB9SDxhcftc8NTfzo7V6SGswoB78POmHOoz/YHb:tGe4t6CA/nB0uqWY
TLSH
T180A42011A3F8D229F1F32B30997647A54F3ABC51AE39820E67443A5E6D70B44DE61B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

38510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

BringWindowToTop IsIconic UnpackDDElParam ReuseDDElParam SetMenu LoadMenuA ReleaseCapture TranslateAcceleratorA LoadAcceleratorsA SetRectEmpty FindWindowA DestroyMenu GetSysColorBrush PostQuitMessage GrayStringA DrawTextA TabbedTextOutA SetCursor ShowOwnedPopups GetDesktopWindow ClientToScreen PtInRect GetClassNameA GetMenuCheckMarkDimensions GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem SystemParametersInfoA MapWindowPoints PeekMessageA DispatchMessageA GetFocus AdjustWindowRectEx EqualRect DeferWindowPos BeginDeferWindowPos CopyRect EndDeferWindowPos IsWindowVisible ScreenToClient ScrollWindow SetScrollInfo ShowScrollBar SetScrollRange GetScrollPos SetScrollPos GetTopWindow IsChild GetCapture GetClassInfoA RegisterClassA GetMenuItemCount GetSubMenu GetMenuItemID GetMenu GetWindowTextA GetDlgCtrlID GetKeyState CreateWindowExA SetWindowsHookExA CallNextHookEx SetPropA GetLastActivePopup GetForegroundWindow SetForegroundWindow GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetWindow GetWindowRect SetWindowPos RegisterWindowMessageA GetNextDlgTabItem GetActiveWindow SetActiveWindow IsWindow GetSystemMetrics DestroyWindow IsWindowEnabled UnhookWindowsHookEx SendDlgItemMessageA IsDlgButtonChecked CheckDlgButton LoadCursorA RegisterClassExA DefWindowProcA BeginPaint EndPaint LoadBitmapA GetSysColor GetDC GetClientRect FillRect ReleaseDC LoadIconA DestroyIcon MessageBoxA DialogBoxParamA GetParent GetWindowLongA PostMessageA KillTimer EndDialog WinHelpA SetWindowLongA SetTimer LoadStringA wsprintfA ShowWindow EnableWindow SetFocus SetWindowTextA GetDlgItem UpdateWindow InvalidateRect SendMessageA

gdi32

Escape ExtTextOutA TextOutA RectVisible PtVisible GetClipBox ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx RestoreDC SaveDC GetDeviceCaps CreateBitmap SetBkColor SetTextColor SetWindowExtEx SetViewportExtEx SetViewportOrgEx Ellipse CreateSolidBrush PaintRgn GetRgnBox CreatePolygonRgn CreateCompatibleDC GetMapMode SetMapMode GetObjectA DPtoLP BitBlt DeleteDC CreatePen GetStockObject SelectObject MoveToEx LineTo DeleteObject

kernel32

WriteFile GetVersionExA GetProcessVersion LoadLibraryA GetProcAddress FreeLibrary GlobalFlags MulDiv TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalAlloc GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection lstrcpynA GetLastError GetModuleFileNameA GlobalAddAtomA GlobalGetAtomNameA GetCommandLineA RtlUnwind HeapAlloc HeapFree RaiseException HeapSize HeapReAlloc ExitProcess GetModuleHandleA GetACP GetOEMCP GetCPInfo SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr LCMapStringA LCMapStringW SetUnhandledExceptionFilter GlobalUnlock GetStringTypeA GetStringTypeW VirtualProtect GetSystemInfo VirtualQuery IsBadReadPtr IsBadCodePtr GetLocaleInfoA GlobalLock GetCurrentThreadId lstrcatA GetVersion lstrlenA lstrcpyA FormatMessageA OutputDebugStringA InterlockedDecrement InterlockedIncrement LocalAlloc LocalFree lstrcmpiA lstrcmpA WideCharToMultiByte MultiByteToWideChar GlobalFree SetLastError

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyA RegSetValueExA RegCreateKeyA RegEnumKeyA RegQueryInfoKeyA RegOpenKeyExA RegDeleteValueA

comctl32

ord17 ImageList_Destroy

winmm

joyGetPosEx joyGetDevCapsA joyGetNumDevs joyConfigChanged

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

shell32

DragFinish DragQueryFileA

gchand.dll

IMPHASH b94d3cce6eac29903c18cbe135eaf1e2
SHA256 c0a9a90dc70841cf7099d89390d8033a1092366c8aa89e6ebefadc011032a898
MD5 2c847e43683c47ad2cf097c0ee15a321
SHA1 6057b11a0fee8ee364abff562bafcbd344bd93d1
SHA512 951ff18046f953d16d233da1e2c46d03c55c04ce4a8a5b6be0bceabddeb2f77730c8099e24411d66780860539840b19bae9cafa0034356f993e8bd688c2c9aeb
SSDEEP 96:8xhMMxphF4i8ENpAYzuF/TjlgoPKCkDMRL3CJ9MLPW7bJ+lWWyx:GMS5/N3zuF/KbXDMRr3WHslWW
TLSH
T13CD1C74373F4567EF36B5A3426A616079276B820CBB8E24F570507296E3B900D731B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gm16.dls

SHA256 3229b09b9d7d9f3f4793b0d9b34fe6abc75cfa4a2503c0c90f43ff651ba7f2c0
MD5 7f29903cb8f5590d52db0c9f97049a25
SHA1 57145f5f449624a10a357d64c982c6eaa7ebc1d9
SHA512 98f3e9de9ac17d8397e59a37accf102f2e4e76ddd1bab0c0452518098c2fd91e4b8e4a956cab2e4134a0e4a80f1ac1c8475a4fddad2fb8371102cbc0b1a74fce
SSDEEP 49152:kl98eiQV5ekZQQNgW3F+IEANa58DrQaPdqsL3/tdEguV+kGgnq1q:kfvTEc7SrIEPCIsL3Fdt3tWH
TLSH
T17BF5F122F7930E62E86D9137D5CD97C22132F8987BC2C70776B69E54BC8A7604E43939
MD5 SHA1 SHA512 SSDEEP TLSH

gmreadme.txt

SHA256 ca6ce6a87482434d985f1b375a1cc2c3ec95329a96bef508b4d9d1b8fa906d0d
MD5 d5ed4c6de9dfa4bfe85384efa0c25392
SHA1 e62fa8f703c3e21714436c61e9e21337862f17a3
SHA512 20ca63a489d3e7abe9ce6c1b4e5cad6bc7a06feedc91a92e6339158065d1ec5d68772bc244562f20334e63db6ca9b50000225dd32a76417193f8b70e5528fd3b
TLSH
T1CEF05CAF8FDF805E15B0C9F6558C8C08E22E575214668B18AC59D0480E4A21557DF175
MD5 SHA1 SHA512 TLSH

hidgame.sys

IMPHASH 94c56b96139675e3e5ea28d6ec4d6e0e
SHA256 4378ead90ac12f4a910714c74bbf6a2fe0ab7cfa394c8c4a97d7cdcff1edc205
MD5 253c6f5fb9c4009e56ee54f80a501b1b
SHA1 406444f8406a70e2e9b61a2c5012a0a0ae618c4a
SHA512 cfc4b21e5ec93d6ec6b93b27226aa3184d1e4324f138e28f567f40d3f2b5e9663aa2fc92d0eb0cea655aefa3e4187489c076461c8c7d2242a6229289752bf47f
SSDEEP 192:yK7OX3A7n28/lQ6HM4Ee4YucbTqrmBb0W3oiwWv:3uYbHM4EBQqrm+W3oiwWv
TLSH
T17C021B8343E94BFAE8EB1B72B8AA1F67406F7910EB34C16E44B4401536BA741B932F51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

96B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

832B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

960B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

joy.cpl

IMPHASH c9a6a8528ed9c23f72acaa44d74df204
SHA256 816810b8116386c8805f45ee5404d333f5825db7af6dcd99aa224da5e2fd7a35
MD5 ae196c1a5407bdd44bbe206b299b3c3c
SHA1 b8e2e69b8e9a859d090155c15d480a4e99b82b75
SHA512 b5f736ac69369b63c03e60ff233dd2babb6d95088c091d8f1a8ac1fe0cc3e167b2dd0ba52efd84cdc07e3042c3ad85b0d48c65cb414974273f9b1e60f439c6e2
SSDEEP 3072:SBZnouHavSFnzM56bqgjIZcXV5ihxzkYNshcyRTsWUxXu6fYEXj9SRG+ViGsCRe/:DKFnw505ihprNsBsTxExaU5VRvCiGz
TLSH
T12A943D21B3F98219F1F3AB34AEB917915E7ABC52AE35C60E5740624E1C70E54DE24B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

55225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ole32

CoCreateInstance CoInitialize CoGetClassObject CoFreeUnusedLibraries CoUninitialize

advapi32

RegEnumKeyExA RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyA RegSetValueExA RegEnumKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExA RegCreateKeyExA

dinput

DirectInputCreateA

kernel32

GetCommandLineA HeapFree RtlUnwind HeapAlloc RaiseException HeapSize HeapReAlloc ExitProcess GetModuleHandleA GlobalGetAtomNameA GetOEMCP GetCPInfo SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr LCMapStringA LCMapStringW SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW VirtualProtect GetSystemInfo VirtualQuery GetLocaleInfoA IsBadReadPtr IsBadCodePtr SetStdHandle GlobalAddAtomA GetModuleFileNameA FlushFileBuffers SetFilePointer WriteFile lstrcpyA GetProcessVersion TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection Sleep GlobalAlloc GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc GlobalFlags lstrcmpA lstrcmpiA lstrcpynA SetLastError GlobalFree GlobalLock GlobalUnlock MulDiv lstrcatA GetCurrentThreadId InterlockedDecrement InterlockedIncrement lstrcpyW MultiByteToWideChar WideCharToMultiByte GetVersionExA LoadLibraryA GetProcAddress FreeLibrary CreateMutexA GetLastError GetVersion ReleaseMutex DisableThreadLibraryCalls CreateProcessA CloseHandle lstrlenA lstrlenW GetACP

user32

GetTopWindow SetScrollPos GetScrollPos SetScrollRange ShowScrollBar SetScrollInfo ScrollWindow EndDeferWindowPos CopyRect BeginDeferWindowPos DeferWindowPos EqualRect AdjustWindowRectEx SetActiveWindow DispatchMessageA PeekMessageA GetSysColor SystemParametersInfoA BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetActiveWindow GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions GetClassNameA PtInRect GetDesktopWindow PostQuitMessage GetSysColorBrush ShowOwnedPopups FindWindowA SetRectEmpty LoadAcceleratorsA TranslateAcceleratorA ReleaseCapture LoadMenuA SetMenu ReuseDDElParam UnpackDDElParam IsIconic BringWindowToTop IsChild GetCapture GetClassInfoA RegisterClassA GetMenuItemCount GetSubMenu GetMenuItemID GetMenu DefWindowProcA CreateWindowExA SetWindowsHookExA CallNextHookEx SetPropA UnhookWindowsHookEx GetLastActivePopup GetForegroundWindow GetPropA RemovePropA GetMessageTime GetMessagePos GetWindow ShowWindow MoveWindow GetDlgCtrlID SetWindowTextA SetDlgItemTextA LoadIconA GetWindowTextA EnableWindow GetDC ScreenToClient SetForegroundWindow GetKeyState MessageBeep UpdateWindow RegisterWindowMessageA KillTimer SetTimer IsWindowEnabled ExitWindowsEx MapWindowPoints IsDlgButtonChecked GetSystemMetrics GetWindowRect CreatePopupMenu AppendMenuA GetClientRect ClientToScreen TrackPopupMenu DestroyMenu WinHelpA GetParent DialogBoxParamA IsWindowVisible DestroyWindow InvalidateRect CheckRadioButton SetWindowPos GetDlgItemTextA SetFocus LoadImageA EndDialog DestroyIcon GetWindowDC ReleaseDC GetWindowLongA SetWindowLongA RedrawWindow IsWindow PostMessageA SendDlgItemMessageA GetDlgItem SendMessageA LoadCursorA SetCursor LoadStringA wsprintfA MessageBoxA CallWindowProcA GetFocus

gdi32

GetStockObject SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox SaveDC SelectObject GetDeviceCaps PtVisible RectVisible TextOutA ExtTextOutA Escape CreateBitmap DeleteDC GetObjectA SetBkColor DeleteObject RestoreDC SetTextColor GetTextMetricsA GetTextExtentPointA GetTextExtentPoint32A

comctl32

ord17 ImageList_Create ImageList_ReplaceIcon ImageList_Destroy CreatePropertySheetPageA PropertySheetA

shell32

DragFinish DragQueryFileA ExtractIconExA

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

joyhid.vxd

SHA256 9d0d77fc545ff837f2a568e1a7b2ac42c888e5c25579ee030780f78451b6415b
MD5 9d9d3ca8ff4718d13b44bc9bc0fc4acd
SHA1 d047ac766b38e412caea34e25e799b1beb58c55b
SHA512 3bfbe44472ae5505fc6c2028c4a2dd324b438722972a48e366f7f012e5595a8e7d96443a16de622b5a5d195da64feb9651801151b7653ab8592a5b6840774a0b
SSDEEP 384:nAT/npxPc6OuHNad0nKAjhX8v6Ye/uxkp+nDA06:ATPpxPXOuHC0nNN8vi/uA+kt
TLSH
T19E422951E9A0C978C4919B7DB24E1B0CD83C956439B34E5BF3A43EC02C305B4EB9B58C
MD5 SHA1 SHA512 SSDEEP TLSH

joystick.inf

SHA256 af7ac7057a13906b3d5f76bc6fb62864bf2af17fda12c03206c6d3f48d815ebf
MD5 c3ddc7d0084996d5e14db8451e875165
SHA1 7deda8f5abebc439193009129e08373172c235b3
SHA512 457a2e90754c9bee92f476261603838eadaa0f91c1cef6451f74cda5f6792e1a11d5ee32519cf47045055b2de5955285430c3017dd9fe8957f14e621cdedd2e8
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zaYrjC4Lf:J1KT2Eh2T+KPCuz0zntHl99zCCf
TLSH
T1E391232B978881936B6671D6CCD383A417CD85D4D439F9132A0FA2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkbrz.inf

SHA256 0b39060c6314185bac8cf29fff5296bfb23a7bbdb0d4d34218e7fdf2b45c5c96
MD5 dca49d7bf62bf295a4538c0aa2e999b1
SHA1 a2328c9624670abd44078576255fe46d5e905baf
SHA512 73be0238fbf0b735044f75e2ef838d9a292de58dacf9f0545f1dd4be884ae4d3a9842b46843708e53ad91634d739f7ed3b07e3b68739fa379eb9efa283a8a032
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99ztXGEYb0Cr:J1KT2Eh2T+KPCuz0zntHl99zt2rr
TLSH
T15991212B978881936B6671DBCCD783A417CD85D4D438F9122A0BA2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkchs.inf

SHA256 ce2c1d4df85b6e93c8ea7b01e30bb5632cf3840b552acbe272c7c9d7ff37138d
MD5 3a70a732e238b81b6b104dd401c79b05
SHA1 f165e6ac3d377770a71c69e24020ddc684c5aa0b
SHA512 e250c174f6cca98fb560661ea649bf81614c5b0468f7edab13a8398607d19c4a9ac9055cbf225bb46a2135c4b7b7b35a140744cd2f2b8d992f9568e13c7aa00f
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zibYyOwd:J1KT2Eh2T+KPCuz0zntHl99ziawd
TLSH
T13F91202B978880936B6671DBCCD783A417CD85D4D439A9032A0BA2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkcht.inf

SHA256 0bfb92e53b1ba23c2e099ed6dd6a00109da2be4bbdaa2750e664a49a72df3e4c
MD5 fc103cec0985fce8dc7d2558f9e3c7e2
SHA1 fef5b5d770757d0ccaa1fdec810a4669c1d2af37
SHA512 5eab24cdb7fe841c1275c96e153c5551cd3feed182e5a02f9d82501a6c963f1e1311235735fdb51d6bfab2c97071ba16126450de44244c6d118d830a4ab07f83
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zNYxzmAn:J1KT2Eh2T+KPCuz0zntHl99zC
TLSH
T10891312B978881D36B6671DBCCD743A417CD85D4D439BA022A0BA2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkcze.inf

SHA256 4a48403729ac3861ce8f8f21b39ef69c4aea4715e21035e5b5b51b4c2d4b0184
MD5 c1dd3f255b8a85544a9bfc3596124f78
SHA1 328e8e446553366d9f8e4bd9e0d6abbb5d954348
SHA512 6cd600feea1a32be25141d922d4b70597acbf1a4ca5140079d27755b96c6e2fed83573152108ac664af9f160dbd2ec2b4c19e106ef68d3ac01ce8c6289248cda
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zfYwk6y:J1KT2Eh2T+KPCuz0zntHl99z9y
TLSH
T1A59123279788C0936B6671EBCCD783A417CD85D4D439B9122A0BA3614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkdut.inf

SHA256 8d4213360fa40bea3ce8d8183026878a5f9a6fd6847c0f3a5a6caa309ed4d0de
MD5 50cab236dab17ab83ee772d723d305f5
SHA1 bd261ea94992d1f1cb6690d42b9b8d4b4de1ba38
SHA512 f0dc6916c835464bc150f3c666672ef95de52b32ff7f4f92b1853ec8b5f4c3208508f984094c27510994dcdccf87312b66addcbc4aad512ea3bfd59cdf49adec
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99z3YAnKB/:J1KT2Eh2T+KPCuz0zntHl99zmh
TLSH
T19591322B978980936B6671DBCCD383A417CD85D4D439B9032A0BB2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkfrn.inf

SHA256 3aca8fa41d730da5054dd6811b12dd0c246341a2922de47b1f522c2789e23b0a
MD5 538d929bac0e92a4fe87c1e00f8d0bb6
SHA1 a020b38b8c0b6b7a9042753706dde3f2dbf2143b
SHA512 0c5680de0807bce006292aa79cf5be8dc790969087272c6bcf8fb3f5ecde2a6930320682d45a17f05a4835beea9ae075ee5934532c172bfa5ba13bcc85f8ae74
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zuYEED:J1KT2Eh2T+KPCuz0zntHl99zB
TLSH
T1C491332B978881936B6671E7CCD383A417CD85D4D439FA132A0BA2614F8D7DCB6C9C36
MD5 SHA1 SHA512 SSDEEP TLSH

jystkger.inf

SHA256 e4055a3ea4d33794cc5f730d0776a497e216743d1dbb3d2f4d675bfa50f36468
MD5 1a99ac54797010f5418e93775d174e14
SHA1 75254a95ede5d418bc2038437df73615c87dd571
SHA512 b2a04bde8ad0ef13ed78618b4cb27ba5551b8a3b98b104a397097d9a259e79406f45dd7ca098554c780adb35f1ba094152cfcfe47e7663133bf5cd19cfea6c73
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zmiYYdjv:J1KT2Eh2T+KPCuz0zntHl99zb
TLSH
T1DD91322B978880936B6671DBCCD783A417CD85D4D439BA032A0BA2614F8D7DCB6C9C36
MD5 SHA1 SHA512 SSDEEP TLSH

jystkitn.inf

SHA256 a662029b968f27236253add2b47e7a02489cfadaf661178813b6b57d911e6612
MD5 7847ecbbf3181542e7fc244bc92b4eaa
SHA1 a641dbde089ce14bada800ca87dc356ec0e31586
SHA512 4104f46a260ee519092bc7d607508ef605ec845ea3b3a143c24e8dd229fa9a57e0397dc7aac8061f1b862aeacee1fa29dcd9efa05c8ecea6e1da7b2cd7648692
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zIYCzvS:J1KT2Eh2T+KPCuz0zntHl99zGvS
TLSH
T1C091232B978881936B6771D7CCD743A417CD85D4D439BA032A0BA2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkjpn.inf

SHA256 eaf469ce5522f70a108d15f752998aa48d0cad0431d0559f1c9ae16ccd4f4f92
MD5 a7e30514a22bdf88158c9feb4d076890
SHA1 41b5bbccb86a5ba48fecd6f09e5be657e97af6f6
SHA512 24e291e4aae446b49fef1d71adc04ae23b4299bc33a96ae4af3277d5ea1d40a76635a74a39e867ac3428a608d58c321ca0893a70aca6627f5ca76e5d0ba984ef
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zZzY6s:J1KT2Eh2T+KPCuz0zntHl99zZE
TLSH
T1DD91312B978881D36F6772D7CCC383A417DD85D4D439BA122A0BA2614F4D79CB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkkor.inf

SHA256 1285a92e4c53cafcb4326abec7ec2822f5bcf5e98970b87a0e5188d54f091146
MD5 a69ecbc1802761838b24a6196ece492e
SHA1 ccfee6402eb2c26cc5e1afc018b16530a542b6bb
SHA512 6783b91db090fedb724c353d32ae1a7912a7048538ea64372234fea84f97778dcbbf8b3aa901ba8c49ff5827dd8aeea7831e51a98b2746ea353be1be4924047a
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zcuSYVf:J1KT2Eh2T+KPCuz0zntHl99zcw
TLSH
T13791222B978880D36B6671D7CCD743A417CD85D4D439FA122A0BA2614F4D7DCB6C9C36
MD5 SHA1 SHA512 SSDEEP TLSH

jystkpol.inf

SHA256 97d58ac78cb0d445b4ec5cbc091825637cbd72cf9d328d765e82d51430496a1d
MD5 6cfc6ff3a448ea52639a3dc53d4929fa
SHA1 8fda30c3a4e7ddb1574ba0572be01b740972aabb
SHA512 fa2bb2aa20ec6a76ea563556f658f5fe5cedd2659dd414e65601d471aabc451f17b78ac8df26e926f6b6f7f4a2a301e9dbddd10604e59d6a3cd8b81272753f85
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zC9Yi4:J1KT2Eh2T+KPCuz0zntHl99zCk
TLSH
T1B9912417978881936B6671D7CCD743A417CD85D4D438B9132A0BA2614F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkrus.inf

SHA256 0ef0de5995e9eda33a7a4f34ecec334baee2fc05b186313cf0775f3ce8eed259
MD5 d41d9a465db8efccde5ac188a179a3fb
SHA1 ef69742e8262d29db021de5441cbb036836208a5
SHA512 c4500eef8a7f9ad3b1bc91e5de959a8454ed2d511bd4cc4a359dc7aebfd4215da3fd93b5b1e780b6f94a6d001625b908c7811710a14203b45960702fc143d669
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99z/TYAkS:J1KT2Eh2T+KPCuz0zntHl99z/Hl
TLSH
T11291221B9788C1936B6A71D7CCD743A417CD85D4D438BA132A0BA2624F8D7DCB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkspa.inf

SHA256 ee0cdec1d51793134f7b78a2991355c984c348367b285702e2e2da35fd22de27
MD5 4069deb9ddec09d0d011784294d49655
SHA1 65e186e4b9cf451b376a12c31d3814332b14a46d
SHA512 2fd5aab861d8a44ad2e20d5acb71c918517579e87ba2141b949457d1dc7b0d28f82a4e4d7840071f41fe0e291da8797878d4a6d6f65d757c50f5fda4e2978688
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99ztWYs2F:J1KT2Eh2T+KPCuz0zntHl99zth
TLSH
T1AB91225B978880936B6671DBCCD783A417CD85D4D438F9032A0BB2614F8D79CB6C9C3A
MD5 SHA1 SHA512 SSDEEP TLSH

jystkswe.inf

SHA256 e935e346be56186caf463d65945f499461179f78e439020739b0003fae11ca78
MD5 9000d2dff493b883380ce0a9b92c50a0
SHA1 d03fc0ebf930870d8131a7f69ce9e1fd38bbefc3
SHA512 a2ae3d0436636546100bde9554d07594d955be9d7d986b99b16fa35dd84e9b58a2143a8113d954cf7bb167cfb9aa371ff1849e2e486f301c894aa805b9ea03f4
SSDEEP 96:J1KQY2qobYbt2T+KPoVOViuz0znekHl99zAYFhG:J1KT2Eh2T+KPCuz0zntHl99zVG
TLSH
T16591212B978880D36B6671DBCCD343A417CD85D4D438BA132A0BA6614F8D7DCB6C9C36
MD5 SHA1 SHA512 SSDEEP TLSH

ks.inf

SHA256 bbde11d65bd385aa0a428c077ce38977edca633eeebd63e6f940d9e2b78855a1
MD5 258faf25cb76e6ddeb70749502ebe204
SHA1 7cc0dbe040988f10e8b4157008acd496917cdd0f
SHA512 c575d928860b440bd8eb3acc5ecae775d2cac1fd7f70312cd9697242e4e42aa3c2b42c2651336e4023439515807fd6add55e0eaeb1b0116378746559900b94e6
SSDEEP 384:3AEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntoLswYOV8Wzzpbt3KD/uO5E1BBeyQQ:3ATGMDhX1eJZjMLswJHRGuJP0yF
TLSH
T1EDF2C01E930D8913E20C32C0F7D12DC7709A509ED4E052AE7B26DA9E685ED96451CFBF
MD5 SHA1 SHA512 SSDEEP TLSH

ks.sys

IMPHASH 21a59e474a5dc891708dc0b0ea65fe46
SHA256 e5cb82d9b6ec8abcad0a11e89ed50623d92e82d416292daee47abff4a48ff83e
MD5 cdf73dddf71475d1c3bc249304751983
SHA1 577d666c9aacd928c9fea98c0c37a0f7e38901ae
SHA512 0d8adb6a46060b4aed5f991a33f566b29ca8cf9f67cdd2f1191bbbd5935026e535347dbacfca94b1fbd5e278e65a3b4e78db77eac462f10c7951c8f6251701b3
SSDEEP 3072:93WrRRvmrpzVP6iJaOsd2JQL+IkRnS/WhHpcb92xwrUl7:RDrpdEiJiIFZJG9KwrU
TLSH
T13AC3AD22B2C1447AD58B12F1CF0F772FB37722231766B6574A60AE912B78910FA2D357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

117543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ks.pdb

ntoskrnl.exe

KeInitializeEvent ExDeleteNPagedLookasideList ExInitializeNPagedLookasideList ExDeletePagedLookasideList ExFreeToPagedLookasideList ExAllocateFromPagedLookasideList ExInitializePagedLookasideList KeInitializeSpinLock ProbeForRead IofCallDriver IoBuildSynchronousFsdRequest ZwClose ZwQueryValueKey ZwOpenKey RtlInitUnicodeString RtlFreeUnicodeString wcscat wcscpy RtlStringFromGUID IoGetRelatedDeviceObject ObfReferenceObject IoBuildDeviceIoControlRequest ExGetPreviousMode ZwEnumerateValueKey ZwSetValueKey RtlCompareMemory RtlIntegerToUnicodeString RtlAppendUnicodeStringToString ZwCreateKey RtlAppendUnicodeToString RtlCopyUnicodeString ExQueueWorkItem swprintf wcslen ExReleaseFastMutexUnsafe ExAcquireFastMutexUnsafe IoSetDeviceInterfaceState InterlockedExchange KeSetTimer IoInvalidateDeviceRelations ExAllocatePoolWithQuotaTag ProbeForWrite IoGetDeviceProperty DbgBreakPoint DbgPrint ZwEnumerateKey ZwQueryKey IoRegisterDeviceInterface RtlGUIDFromString _wcsicmp IoDeleteDevice IoCreateDevice ZwDeleteKey IoDetachDevice IoAttachDeviceToDeviceStack KeInitializeDpc KeSetEvent _wcsnicmp KeCancelTimer KeSetTimerEx ExInterlockedCompareExchange64 KefReleaseSpinLockFromDpcLevel KefAcquireSpinLockAtDpcLevel KeQueryTimeIncrement KeInitializeTimerEx KeReleaseMutex KeSynchronizeExecution ObfDereferenceObject KeRemoveQueueDpc InterlockedCompareExchange KeReleaseSemaphore KeInsertQueueDpc ExEventObjectType ObReferenceObjectByHandle ExSemaphoreObjectType KeBugCheckEx PoCallDriver PoStartNextPowerIrp KeGetCurrentThread RtlCompareUnicodeString IoCreateFile MmMapLockedPages KeClearEvent ExRaiseStatus IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl IoReleaseCancelSpinLock IoAcquireCancelSpinLock ExfInterlockedRemoveHeadList ExfInterlockedInsertTailList KeInitializeMutex IoFileObjectType IoGetDeviceInterfaces IoAllocateDriverObjectExtension IoGetDriverObjectExtension IoOpenDeviceRegistryKey IoFreeIrp IoAllocateIrp _snwprintf PoUnregisterSystemState PoRegisterSystemState IoIsWdmVersionAvailable PoRequestPowerIrp PoSetPowerState IoOpenDeviceInterfaceRegistryKey memmove KeResetEvent KeQuerySystemTime _except_handler3 KeTickCount KeWaitForSingleObject IofCompleteRequest InterlockedIncrement InterlockedDecrement ExFreePool ExAllocatePoolWithTag ExInterlockedPushEntrySList KeInitializeTimer ExInterlockedPopEntrySList

hal

KfLowerIrql KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter KfRaiseIrql

??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z ??0CBaseUnknown@@QAE@PAUIUnknown@@@Z ??1CBaseUnknown@@UAE@XZ ??_FCBaseUnknown@@QAEXXZ ?IndirectedAddRef@CBaseUnknown@@UAGKXZ ?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?IndirectedRelease@CBaseUnknown@@UAGKXZ ?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ ?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?NonDelegatedRelease@CBaseUnknown@@UAGKXZ DllInitialize KoCreateInstance KoDeviceInitialize KoDriverInitialize KoRelease KsAcquireControl KsAcquireDevice KsAcquireDeviceSecurityLock KsAcquireResetValue KsAddDevice KsAddEvent KsAddIrpToCancelableQueue KsAddItemToObjectBag KsAddObjectCreateItemToDeviceHeader KsAddObjectCreateItemToObjectHeader KsAllocateDefaultClock KsAllocateDefaultClockEx KsAllocateDeviceHeader KsAllocateExtraData KsAllocateObjectBag KsAllocateObjectCreateItem KsAllocateObjectHeader KsCacheMedium KsCancelIo KsCancelRoutine KsCompletePendingRequest KsCopyObjectBagItems KsCreateAllocator KsCreateBusEnumObject KsCreateClock KsCreateDefaultAllocator KsCreateDefaultAllocatorEx KsCreateDefaultClock KsCreateDefaultSecurity KsCreateDevice KsCreateFilterFactory KsCreatePin KsCreateTopologyNode KsDecrementCountedWorker KsDefaultAddEventHandler KsDefaultDeviceIoCompletion KsDefaultDispatchPnp KsDefaultDispatchPower KsDefaultForwardIrp KsDereferenceBusObject KsDereferenceSoftwareBusObject KsDeviceGetBusData KsDeviceRegisterAdapterObject KsDeviceSetBusData KsDisableEvent KsDiscardEvent KsDispatchFastIoDeviceControlFailure KsDispatchFastReadFailure KsDispatchInvalidDeviceRequest KsDispatchIrp KsDispatchQuerySecurity KsDispatchSetSecurity KsDispatchSpecificMethod KsDispatchSpecificProperty KsEnableEvent KsEnableEventWithAllocator KsFastMethodHandler KsFastPropertyHandler KsFilterAcquireProcessingMutex KsFilterAddTopologyConnections KsFilterAttemptProcessing KsFilterCreateNode KsFilterCreatePinFactory KsFilterFactoryAddCreateItem KsFilterFactoryGetSymbolicLink KsFilterFactorySetDeviceClassesState KsFilterFactoryUpdateCacheData KsFilterGetAndGate KsFilterGetChildPinCount KsFilterGetFirstChildPin KsFilterRegisterPowerCallbacks KsFilterReleaseProcessingMutex KsForwardAndCatchIrp KsForwardIrp KsFreeDefaultClock KsFreeDeviceHeader KsFreeEventList KsFreeObjectBag KsFreeObjectCreateItem KsFreeObjectCreateItemsByContext KsFreeObjectHeader KsGenerateDataEvent KsGenerateEvent KsGenerateEventList KsGenerateEvents KsGetBusEnumIdentifier KsGetBusEnumParentFDOFromChildPDO KsGetBusEnumPnpDeviceObject KsGetDefaultClockState KsGetDefaultClockTime KsGetDevice KsGetDeviceForDeviceObject KsGetFilterFromIrp KsGetFirstChild KsGetNextSibling KsGetNodeIdFromIrp KsGetObjectFromFileObject KsGetObjectTypeFromFileObject KsGetObjectTypeFromIrp KsGetOuterUnknown KsGetParent KsGetPinFromIrp KsHandleSizedListQuery KsIncrementCountedWorker KsInitializeDevice KsInitializeDriver KsInstallBusEnumInterface KsIsBusEnumChildDevice KsMergeAutomationTables KsMethodHandler KsMethodHandlerWithAllocator KsMoveIrpsOnCancelableQueue KsNullDriverUnload KsPinAcquireProcessingMutex KsPinAttachAndGate KsPinAttachOrGate KsPinAttemptProcessing KsPinDataIntersection KsPinGetAndGate KsPinGetAvailableByteCount KsPinGetConnectedFilterInterface KsPinGetConnectedPinDeviceObject KsPinGetConnectedPinFileObject KsPinGetConnectedPinInterface KsPinGetCopyRelationships KsPinGetFirstCloneStreamPointer KsPinGetLeadingEdgeStreamPointer KsPinGetNextSiblingPin KsPinGetParentFilter KsPinGetReferenceClockInterface KsPinGetTrailingEdgeStreamPointer KsPinPropertyHandler KsPinRegisterFrameReturnCallback KsPinRegisterHandshakeCallback KsPinRegisterIrpCompletionCallback KsPinRegisterPowerCallbacks KsPinReleaseProcessingMutex KsPinSetPinClockTime KsPinSubmitFrame KsPinSubmitFrameMdl KsProbeStreamIrp KsProcessPinUpdate KsPropertyHandler KsPropertyHandlerWithAllocator KsQueryDevicePnpObject KsQueryInformationFile KsQueryObjectAccessMask KsQueryObjectCreateItem KsQueueWorkItem KsReadFile KsRecalculateStackDepth KsReferenceBusObject KsReferenceSoftwareBusObject KsRegisterAggregatedClientUnknown KsRegisterCountedWorker KsRegisterFilterWithNoKSPins KsRegisterWorker KsReleaseControl KsReleaseDevice KsReleaseDeviceSecurityLock KsReleaseIrpOnCancelableQueue KsRemoveBusEnumInterface KsRemoveIrpFromCancelableQueue KsRemoveItemFromObjectBag KsRemoveSpecificIrpFromCancelableQueue KsServiceBusEnumCreateRequest KsServiceBusEnumPnpRequest KsSetDefaultClockState KsSetDefaultClockTime KsSetDevicePnpAndBaseObject KsSetInformationFile KsSetMajorFunctionHandler KsSetPowerDispatch KsSetTargetDeviceObject KsSetTargetState KsStreamIo KsStreamPointerAdvance KsStreamPointerAdvanceOffsets KsStreamPointerAdvanceOffsetsAndUnlock KsStreamPointerCancelTimeout KsStreamPointerClone KsStreamPointerDelete KsStreamPointerGetIrp KsStreamPointerGetMdl KsStreamPointerGetNextClone KsStreamPointerLock KsStreamPointerScheduleTimeout KsStreamPointerSetStatusCode KsStreamPointerUnlock KsSynchronousIoControlDevice KsTerminateDevice KsTopologyPropertyHandler KsUnregisterWorker KsUnserializeObjectPropertiesFromRegistry KsValidateAllocatorCreateRequest KsValidateAllocatorFramingEx KsValidateClockCreateRequest KsValidateConnectRequest KsValidateTopologyNodeCreateRequest KsWriteFile KsiDefaultClockAddMarkEvent KsiPropertyDefaultClockGetCorrelatedPhysicalTime KsiPropertyDefaultClockGetCorrelatedTime KsiPropertyDefaultClockGetFunctionTable KsiPropertyDefaultClockGetPhysicalTime KsiPropertyDefaultClockGetResolution KsiPropertyDefaultClockGetState KsiPropertyDefaultClockGetTime KsiQueryObjectCreateItemsPresent _KsEdit

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ks98.inf

SHA256 eb32a8d0e9a6708b5d0d9d323a6ef80de30efb760b7b5711d7f56f788a9b92c2
MD5 67febf0d2bea724f472128f4d448204c
SHA1 72bb3a96b6fff2bb9f11d6a48ecca1788e07865f
SHA512 fd308c5ef9f739aee1a8e159f67a727e1a88eb82e85da9df318401932b893d52d0229008554e0ffa1e6c73a5d4988774ceb2b5c66be97423272fe5dcfb6becf3
SSDEEP 384:3AEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntoDwYOV8Wzzpbt3KD/uO5E1BBeyQQ:3ATGMDhX1eJZjMDwJHRGuJP0yF
TLSH
T1A0F2C11E930D8913E20C32C0F7D12DC7709A509ED0E052AEBB26DA9E685ED96451CF7F
MD5 SHA1 SHA512 SSDEEP TLSH

ks98.sys

IMPHASH 35f91fb82ef1dedbe8e11940592e982b
SHA256 eb45ccb9fec740807b8d1fc422017a3882f22236d11d92373f9d8c19ec58f92b
MD5 0fd481c5a18b05be839941e3c7ed0d15
SHA1 2019660f8b2278e6f2f842753201862b06fd24b6
SHA512 e3317c914a548d0f76e07712c68af3d91030479cf69e72022d988cd3b31f3d87866d1e0d743ce4ac021835a3926547019bc7d383e2a7d008b114fea20580bc87
SSDEEP 3072:wZva7uUTvbloVPCe12XNru+KOf6wk1SeVRyMpprlo3Lz0IraXW6:wVkbl409zKUcogpybz0Ir0
TLSH
T1EAC39D23B2C1447AD58B22F1CF0A772FB37722235769B6874A249E652BB4840F93D357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

117132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ks.pdb

ntoskrnl.exe

KeInitializeEvent ExDeleteNPagedLookasideList ExInitializeNPagedLookasideList ExDeletePagedLookasideList ExFreeToPagedLookasideList ExAllocateFromPagedLookasideList ExInitializePagedLookasideList KeInitializeSpinLock ProbeForRead IofCallDriver IoBuildSynchronousFsdRequest ZwClose ZwQueryValueKey ZwOpenKey RtlInitUnicodeString RtlFreeUnicodeString wcscat wcscpy RtlStringFromGUID IoGetRelatedDeviceObject ObfReferenceObject IoBuildDeviceIoControlRequest ExGetPreviousMode ZwEnumerateValueKey ZwSetValueKey RtlCompareMemory RtlIntegerToUnicodeString RtlAppendUnicodeStringToString ZwCreateKey RtlAppendUnicodeToString RtlCopyUnicodeString ExQueueWorkItem swprintf wcslen ExReleaseFastMutexUnsafe ExAcquireFastMutexUnsafe IoSetDeviceInterfaceState InterlockedExchange KeSetTimer IoInvalidateDeviceRelations ExAllocatePoolWithQuotaTag ProbeForWrite IoGetDeviceProperty DbgPrint ZwEnumerateKey ZwQueryKey IoRegisterDeviceInterface RtlGUIDFromString _wcsicmp IoDeleteDevice IoCreateDevice ZwDeleteKey IoDetachDevice IoAttachDeviceToDeviceStack KeSetEvent KeInitializeTimer _wcsnicmp KeCancelTimer KeSetTimerEx ExInterlockedCompareExchange64 KefReleaseSpinLockFromDpcLevel KefAcquireSpinLockAtDpcLevel KeQueryTimeIncrement KeInitializeTimerEx KeReleaseMutex KeSynchronizeExecution ObfDereferenceObject KeRemoveQueueDpc InterlockedCompareExchange KeReleaseSemaphore KeInsertQueueDpc ExEventObjectType ObReferenceObjectByHandle ExSemaphoreObjectType KeBugCheckEx PoCallDriver PoStartNextPowerIrp KeGetCurrentThread RtlCompareUnicodeString IoCreateFile MmMapLockedPages KeClearEvent ExRaiseStatus IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl IoReleaseCancelSpinLock IoAcquireCancelSpinLock ExfInterlockedRemoveHeadList ExfInterlockedInsertTailList KeInitializeMutex IoFileObjectType IoGetDeviceInterfaces IoAllocateDriverObjectExtension IoGetDriverObjectExtension IoOpenDeviceRegistryKey IoFreeIrp IoAllocateIrp _snwprintf IoIsWdmVersionAvailable PoRequestPowerIrp PoSetPowerState IoOpenDeviceInterfaceRegistryKey memmove KeResetEvent KeQuerySystemTime _except_handler3 KeTickCount KeWaitForSingleObject IofCompleteRequest InterlockedIncrement InterlockedDecrement ExFreePool ExAllocatePoolWithTag ExInterlockedPushEntrySList KeInitializeDpc ExInterlockedPopEntrySList

hal

KfLowerIrql KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter KfRaiseIrql

??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z ??0CBaseUnknown@@QAE@PAUIUnknown@@@Z ??1CBaseUnknown@@UAE@XZ ??_FCBaseUnknown@@QAEXXZ ?IndirectedAddRef@CBaseUnknown@@UAGKXZ ?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?IndirectedRelease@CBaseUnknown@@UAGKXZ ?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ ?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?NonDelegatedRelease@CBaseUnknown@@UAGKXZ DllInitialize KoCreateInstance KoDeviceInitialize KoDriverInitialize KoRelease KsAcquireControl KsAcquireDevice KsAcquireDeviceSecurityLock KsAcquireResetValue KsAddDevice KsAddEvent KsAddIrpToCancelableQueue KsAddItemToObjectBag KsAddObjectCreateItemToDeviceHeader KsAddObjectCreateItemToObjectHeader KsAllocateDefaultClock KsAllocateDefaultClockEx KsAllocateDeviceHeader KsAllocateExtraData KsAllocateObjectBag KsAllocateObjectCreateItem KsAllocateObjectHeader KsCacheMedium KsCancelIo KsCancelRoutine KsCompletePendingRequest KsCopyObjectBagItems KsCreateAllocator KsCreateBusEnumObject KsCreateClock KsCreateDefaultAllocator KsCreateDefaultAllocatorEx KsCreateDefaultClock KsCreateDefaultSecurity KsCreateDevice KsCreateFilterFactory KsCreatePin KsCreateTopologyNode KsDecrementCountedWorker KsDefaultAddEventHandler KsDefaultDeviceIoCompletion KsDefaultDispatchPnp KsDefaultDispatchPower KsDefaultForwardIrp KsDereferenceBusObject KsDereferenceSoftwareBusObject KsDeviceGetBusData KsDeviceRegisterAdapterObject KsDeviceSetBusData KsDisableEvent KsDiscardEvent KsDispatchFastIoDeviceControlFailure KsDispatchFastReadFailure KsDispatchInvalidDeviceRequest KsDispatchIrp KsDispatchQuerySecurity KsDispatchSetSecurity KsDispatchSpecificMethod KsDispatchSpecificProperty KsEnableEvent KsEnableEventWithAllocator KsFastMethodHandler KsFastPropertyHandler KsFilterAcquireProcessingMutex KsFilterAddTopologyConnections KsFilterAttemptProcessing KsFilterCreateNode KsFilterCreatePinFactory KsFilterFactoryAddCreateItem KsFilterFactoryGetSymbolicLink KsFilterFactorySetDeviceClassesState KsFilterFactoryUpdateCacheData KsFilterGetAndGate KsFilterGetChildPinCount KsFilterGetFirstChildPin KsFilterRegisterPowerCallbacks KsFilterReleaseProcessingMutex KsForwardAndCatchIrp KsForwardIrp KsFreeDefaultClock KsFreeDeviceHeader KsFreeEventList KsFreeObjectBag KsFreeObjectCreateItem KsFreeObjectCreateItemsByContext KsFreeObjectHeader KsGenerateDataEvent KsGenerateEvent KsGenerateEventList KsGenerateEvents KsGetBusEnumIdentifier KsGetBusEnumParentFDOFromChildPDO KsGetBusEnumPnpDeviceObject KsGetDefaultClockState KsGetDefaultClockTime KsGetDevice KsGetDeviceForDeviceObject KsGetFilterFromIrp KsGetFirstChild KsGetNextSibling KsGetNodeIdFromIrp KsGetObjectFromFileObject KsGetObjectTypeFromFileObject KsGetObjectTypeFromIrp KsGetOuterUnknown KsGetParent KsGetPinFromIrp KsHandleSizedListQuery KsIncrementCountedWorker KsInitializeDevice KsInitializeDriver KsInstallBusEnumInterface KsIsBusEnumChildDevice KsMergeAutomationTables KsMethodHandler KsMethodHandlerWithAllocator KsMoveIrpsOnCancelableQueue KsNullDriverUnload KsPinAcquireProcessingMutex KsPinAttachAndGate KsPinAttachOrGate KsPinAttemptProcessing KsPinDataIntersection KsPinGetAndGate KsPinGetAvailableByteCount KsPinGetConnectedFilterInterface KsPinGetConnectedPinDeviceObject KsPinGetConnectedPinFileObject KsPinGetConnectedPinInterface KsPinGetCopyRelationships KsPinGetFirstCloneStreamPointer KsPinGetLeadingEdgeStreamPointer KsPinGetNextSiblingPin KsPinGetParentFilter KsPinGetReferenceClockInterface KsPinGetTrailingEdgeStreamPointer KsPinPropertyHandler KsPinRegisterFrameReturnCallback KsPinRegisterHandshakeCallback KsPinRegisterIrpCompletionCallback KsPinRegisterPowerCallbacks KsPinReleaseProcessingMutex KsPinSetPinClockTime KsPinSubmitFrame KsPinSubmitFrameMdl KsProbeStreamIrp KsProcessPinUpdate KsPropertyHandler KsPropertyHandlerWithAllocator KsQueryDevicePnpObject KsQueryInformationFile KsQueryObjectAccessMask KsQueryObjectCreateItem KsQueueWorkItem KsReadFile KsRecalculateStackDepth KsReferenceBusObject KsReferenceSoftwareBusObject KsRegisterAggregatedClientUnknown KsRegisterCountedWorker KsRegisterFilterWithNoKSPins KsRegisterWorker KsReleaseControl KsReleaseDevice KsReleaseDeviceSecurityLock KsReleaseIrpOnCancelableQueue KsRemoveBusEnumInterface KsRemoveIrpFromCancelableQueue KsRemoveItemFromObjectBag KsRemoveSpecificIrpFromCancelableQueue KsServiceBusEnumCreateRequest KsServiceBusEnumPnpRequest KsSetDefaultClockState KsSetDefaultClockTime KsSetDevicePnpAndBaseObject KsSetInformationFile KsSetMajorFunctionHandler KsSetPowerDispatch KsSetTargetDeviceObject KsSetTargetState KsStreamIo KsStreamPointerAdvance KsStreamPointerAdvanceOffsets KsStreamPointerAdvanceOffsetsAndUnlock KsStreamPointerCancelTimeout KsStreamPointerClone KsStreamPointerDelete KsStreamPointerGetIrp KsStreamPointerGetMdl KsStreamPointerGetNextClone KsStreamPointerLock KsStreamPointerScheduleTimeout KsStreamPointerSetStatusCode KsStreamPointerUnlock KsSynchronousIoControlDevice KsTerminateDevice KsTopologyPropertyHandler KsUnregisterWorker KsUnserializeObjectPropertiesFromRegistry KsValidateAllocatorCreateRequest KsValidateAllocatorFramingEx KsValidateClockCreateRequest KsValidateConnectRequest KsValidateTopologyNodeCreateRequest KsWriteFile KsiDefaultClockAddMarkEvent KsiPropertyDefaultClockGetCorrelatedPhysicalTime KsiPropertyDefaultClockGetCorrelatedTime KsiPropertyDefaultClockGetFunctionTable KsiPropertyDefaultClockGetPhysicalTime KsiPropertyDefaultClockGetResolution KsiPropertyDefaultClockGetState KsiPropertyDefaultClockGetTime KsiQueryObjectCreateItemsPresent _KsEdit

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kscaptur.inf

SHA256 8e277c581c0562401fb8551875a11b5498fcf41b98e27d592c14ae5e6b75bfb4
MD5 d9eee85cf7e9d861c91ba68fba82e3c7
SHA1 01cdae51360a2c2f0c6d29cccf6d119862819870
SHA512 e06c8ae3f79230b79484ed8466114181367d5e29b3ee196c1f127a0e0bc1e977f624f5307179dafc658dd20211bba1a5d7386b809f2874097cbac327b337c873
SSDEEP 384:tbPDGYVv871qlvsuPrk1agj6o5aOO0Bs9Ck3omF8Fw7tvy0AeSyaLQ:tbPDGulvsuDk0ZOO0Bswsh6cSy+Q
TLSH
T1DDA2660B831B8963D18592B8F7931EC77084719B41F1916E3B75CA1A34DFDF4882E9EA
MD5 SHA1 SHA512 SSDEEP TLSH

ksfilt98.inf

SHA256 bec9d8662fbe96b83303d668e00cc98bae53f1acbc276a2c5ba5d5b9018e0987
MD5 e2d3e266bb2f48f8988c61d13464abd8
SHA1 3c12a99b8a348c8271938ece69c0c8405677ac64
SHA512 f8b2352162d88d024048d146cca7f0dfd347f079b95323a95c4cf02a475699472b5b9c0daec4fff9af801cf31b9d7e933f8f8427d339a9b0b5187b55ad2bab7f
SSDEEP 192:s0fk0Qo80OcIMNOwSltwd76wgolFwrYKynddTylQwtXsLUhI:2o80OcIMNOZ7Q76UbCYlnddTyCOsLUhI
TLSH
T15E12025E4E570876B149E3BC98D72BD3E6053063B2CC09143C4AE9457DCA9D8A23DAFD
MD5 SHA1 SHA512 SSDEEP TLSH

ksfilter.inf

SHA256 adb323c722db57e00e6154812d989ebd96210fa1f38bcac261fa608f0f4316c8
MD5 1a7ab501fe7b9054c7f7649239260dc3
SHA1 c11efd706ea9105d427260ec0ab89361b5e5c44a
SHA512 3676b551f24275ba771d4c4ea86af48e13041f03e7a94dcfa6e2af9dda38a177099fdf9499f59e3e3eb34937037e800f03e340fff3596cf045f42852875e2baf
SSDEEP 192:s0fo0Qo80OcIMNOwSltw3/RwN76wgolFwrYKynddTylQwtXsLBhI:Ko80OcIMNOZ72/RC76UbCYlnddTyCOs0
TLSH
T10222125E4E870876B148E7ACA8D76BC3E6053063B2CC09143D4BE9457DCA9D8623DAFC
MD5 SHA1 SHA512 SSDEEP TLSH

ksolay.ax

IMPHASH 96a838db2ca9c5febf5b77f383b5f7ab
SHA256 d5f765cfd0c40d47e21a47f0ecd59dbc8770fe13e64e95a98d8d2085a2efd132
MD5 a47a7a5fcfba3f278d970347fe326586
SHA1 8a519c67f4b0571d4f0ed24f52ea3a3c8b25ec72
SHA512 c6b011ce689504a58a433a56b566e0830fe2667691c704893ce5789bd9e1965e805488afdb96fc9ce32a9bee94aa15a10a4aac10d4576234761973e3449e5ebf
SSDEEP 192:nDXtk7UINJJnDnMqG2uwtTudv1W6jRg8M/NMk+l12ZCAeWWfWGUgq:xo1nG0RudXgf/NMk6c8WWfWGUgq
TLSH
T152421B1263DD48B2E3734A7199F11BAB32A9A93C5F7F73468910050E2EF4D56C93171B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7363

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ksproxy.ax

IMPHASH 8a9244974f0e29124f9a788299082510
SHA256 64217ea53d50a04f256ec0e29fa681f6c74145530cf493e866be8237527bbe69
MD5 faa856908340dcf6d936ed7128bc2119
SHA1 8a929b52241c20e5898241ccb34d4c813559306a
SHA512 7adfc78da2a51245666b013dfc82fdc7b0b4323ed0a07a32cda70e0d002f8bd20ea9b47e62e89a3bd429efd64d1f76364eef2a7030f632c013713d7f1bf9c99a
SSDEEP 3072:VmjKuN04JipzMwH8eH4/9+M7uMOz9y/pCkRH:A1N0guzf8eY/4iOzkYkN
TLSH
T176B34C0373FB80F7C25302B299B5B3F9B2FAD215197A960657150F093F61852EB39A1B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

85667

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

??3@YAXPAX@Z wcslen _CIpow swscanf swprintf _ftol sprintf _purecall _except_handler3 ??2@YAPAXI@Z memmove wcscpy

kernel32

GetACP InterlockedCompareExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetLastError CreateEventA CloseHandle WaitForMultipleObjectsEx WaitForSingleObjectEx CreateThread CreateFileA WideCharToMultiByte ReleaseSemaphore InterlockedExchange CreateSemaphoreA InterlockedDecrement DeviceIoControl InterlockedIncrement ResetEvent GetOverlappedResult MultiByteToWideChar CreateMutexA ReleaseMutex GetHandleInformation GetVersionExA DisableThreadLibraryCalls FreeLibrary LoadLibraryA lstrlenA GetModuleFileNameA WaitForMultipleObjects WaitForSingleObject GetSystemInfo VirtualFree VirtualAlloc GetProcAddress ResumeThread SetThreadPriority

advapi32

RegEnumKeyExA RegQueryValueExA RegCreateKeyA RegSetValueA RegSetValueExA RegCloseKey RegDeleteKeyA RegOpenKeyExA RegEnumKeyA

user32

wsprintfA wvsprintfA

ole32

CoUninitialize IIDFromString CoCreateInstance CoTaskMemAlloc CoFreeUnusedLibraries CoInitialize CoTaskMemFree StringFromGUID2

oleaut32

SysFreeString

setupapi

SetupDiOpenDeviceInterfaceA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceInterfaceAlias SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiOpenDeviceInterfaceRegKey SetupDiCreateDeviceInfoListExA SetupDiGetClassDevsA

ksuser

KsCreatePin KsCreateTopologyNode KsCreateAllocator KsCreateClock

ntdll

RtlNtStatusToDosError

ksse.sys

IMPHASH 21a59e474a5dc891708dc0b0ea65fe46
SHA256 ccb128d5ca835cf4b097d857134f7ac3d241c0304f566869e3d61a3ae958e941
MD5 5bf76f7aaf92df4bd77c3fabca2038e5
SHA1 797e8b79d55590cc97e8ae134b29ecbee5829e9d
SHA512 9de00308294471da885f11c6b3f6015e0f50934d18f5b50c1ecaa5f8944ed4f2b0920ec070ae10614a37183d29590b6c4b1653d38a86bb8a4dbbdbfa720828ee
SSDEEP 3072:nBZWrShRa3pJVP6kJaFVYMQy+ITZ9RsGeoMgzwTBUIre7XlL:nLW3pD20MTXZ9mecdUIreR
TLSH
T118C39E23B2C1447AD58726F1CF0F372FB37722231726A6574A606E912B79901FE29367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

117031

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ks.pdb

ntoskrnl.exe

KeInitializeEvent ExDeleteNPagedLookasideList ExInitializeNPagedLookasideList ExDeletePagedLookasideList ExFreeToPagedLookasideList ExAllocateFromPagedLookasideList ExInitializePagedLookasideList KeInitializeSpinLock ProbeForRead IofCallDriver IoBuildSynchronousFsdRequest ZwClose ZwQueryValueKey ZwOpenKey RtlInitUnicodeString RtlFreeUnicodeString wcscat wcscpy RtlStringFromGUID IoGetRelatedDeviceObject ObfReferenceObject IoBuildDeviceIoControlRequest ExGetPreviousMode ZwEnumerateValueKey ZwSetValueKey RtlCompareMemory RtlIntegerToUnicodeString RtlAppendUnicodeStringToString ZwCreateKey RtlAppendUnicodeToString RtlCopyUnicodeString ExQueueWorkItem swprintf wcslen ExReleaseFastMutexUnsafe ExAcquireFastMutexUnsafe IoSetDeviceInterfaceState InterlockedExchange KeSetTimer IoInvalidateDeviceRelations ExAllocatePoolWithQuotaTag ProbeForWrite IoGetDeviceProperty DbgBreakPoint DbgPrint ZwEnumerateKey ZwQueryKey IoRegisterDeviceInterface RtlGUIDFromString _wcsicmp IoDeleteDevice IoCreateDevice ZwDeleteKey IoDetachDevice IoAttachDeviceToDeviceStack KeInitializeDpc KeSetEvent _wcsnicmp KeCancelTimer KeSetTimerEx ExInterlockedCompareExchange64 KefReleaseSpinLockFromDpcLevel KefAcquireSpinLockAtDpcLevel KeQueryTimeIncrement KeInitializeTimerEx KeReleaseMutex KeSynchronizeExecution ObfDereferenceObject KeRemoveQueueDpc InterlockedCompareExchange KeReleaseSemaphore KeInsertQueueDpc ExEventObjectType ObReferenceObjectByHandle ExSemaphoreObjectType KeBugCheckEx PoCallDriver PoStartNextPowerIrp KeGetCurrentThread RtlCompareUnicodeString IoCreateFile MmMapLockedPages KeClearEvent ExRaiseStatus IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl IoReleaseCancelSpinLock IoAcquireCancelSpinLock ExfInterlockedRemoveHeadList ExfInterlockedInsertTailList KeInitializeMutex IoFileObjectType IoGetDeviceInterfaces IoAllocateDriverObjectExtension IoGetDriverObjectExtension IoOpenDeviceRegistryKey IoFreeIrp IoAllocateIrp _snwprintf PoUnregisterSystemState PoRegisterSystemState IoIsWdmVersionAvailable PoRequestPowerIrp PoSetPowerState IoOpenDeviceInterfaceRegistryKey memmove KeResetEvent KeQuerySystemTime _except_handler3 KeTickCount KeWaitForSingleObject IofCompleteRequest InterlockedIncrement InterlockedDecrement ExFreePool ExAllocatePoolWithTag ExInterlockedPushEntrySList KeInitializeTimer ExInterlockedPopEntrySList

hal

KfLowerIrql KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter KfRaiseIrql

??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z ??0CBaseUnknown@@QAE@PAUIUnknown@@@Z ??1CBaseUnknown@@UAE@XZ ??_FCBaseUnknown@@QAEXXZ ?IndirectedAddRef@CBaseUnknown@@UAGKXZ ?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?IndirectedRelease@CBaseUnknown@@UAGKXZ ?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ ?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?NonDelegatedRelease@CBaseUnknown@@UAGKXZ DllInitialize KoCreateInstance KoDeviceInitialize KoDriverInitialize KoRelease KsAcquireControl KsAcquireDevice KsAcquireDeviceSecurityLock KsAcquireResetValue KsAddDevice KsAddEvent KsAddIrpToCancelableQueue KsAddItemToObjectBag KsAddObjectCreateItemToDeviceHeader KsAddObjectCreateItemToObjectHeader KsAllocateDefaultClock KsAllocateDefaultClockEx KsAllocateDeviceHeader KsAllocateExtraData KsAllocateObjectBag KsAllocateObjectCreateItem KsAllocateObjectHeader KsCacheMedium KsCancelIo KsCancelRoutine KsCompletePendingRequest KsCopyObjectBagItems KsCreateAllocator KsCreateBusEnumObject KsCreateClock KsCreateDefaultAllocator KsCreateDefaultAllocatorEx KsCreateDefaultClock KsCreateDefaultSecurity KsCreateDevice KsCreateFilterFactory KsCreatePin KsCreateTopologyNode KsDecrementCountedWorker KsDefaultAddEventHandler KsDefaultDeviceIoCompletion KsDefaultDispatchPnp KsDefaultDispatchPower KsDefaultForwardIrp KsDereferenceBusObject KsDereferenceSoftwareBusObject KsDeviceGetBusData KsDeviceRegisterAdapterObject KsDeviceSetBusData KsDisableEvent KsDiscardEvent KsDispatchFastIoDeviceControlFailure KsDispatchFastReadFailure KsDispatchInvalidDeviceRequest KsDispatchIrp KsDispatchQuerySecurity KsDispatchSetSecurity KsDispatchSpecificMethod KsDispatchSpecificProperty KsEnableEvent KsEnableEventWithAllocator KsFastMethodHandler KsFastPropertyHandler KsFilterAcquireProcessingMutex KsFilterAddTopologyConnections KsFilterAttemptProcessing KsFilterCreateNode KsFilterCreatePinFactory KsFilterFactoryAddCreateItem KsFilterFactoryGetSymbolicLink KsFilterFactorySetDeviceClassesState KsFilterFactoryUpdateCacheData KsFilterGetAndGate KsFilterGetChildPinCount KsFilterGetFirstChildPin KsFilterRegisterPowerCallbacks KsFilterReleaseProcessingMutex KsForwardAndCatchIrp KsForwardIrp KsFreeDefaultClock KsFreeDeviceHeader KsFreeEventList KsFreeObjectBag KsFreeObjectCreateItem KsFreeObjectCreateItemsByContext KsFreeObjectHeader KsGenerateDataEvent KsGenerateEvent KsGenerateEventList KsGenerateEvents KsGetBusEnumIdentifier KsGetBusEnumParentFDOFromChildPDO KsGetBusEnumPnpDeviceObject KsGetDefaultClockState KsGetDefaultClockTime KsGetDevice KsGetDeviceForDeviceObject KsGetFilterFromIrp KsGetFirstChild KsGetNextSibling KsGetNodeIdFromIrp KsGetObjectFromFileObject KsGetObjectTypeFromFileObject KsGetObjectTypeFromIrp KsGetOuterUnknown KsGetParent KsGetPinFromIrp KsHandleSizedListQuery KsIncrementCountedWorker KsInitializeDevice KsInitializeDriver KsInstallBusEnumInterface KsIsBusEnumChildDevice KsMergeAutomationTables KsMethodHandler KsMethodHandlerWithAllocator KsMoveIrpsOnCancelableQueue KsNullDriverUnload KsPinAcquireProcessingMutex KsPinAttachAndGate KsPinAttachOrGate KsPinAttemptProcessing KsPinDataIntersection KsPinGetAndGate KsPinGetAvailableByteCount KsPinGetConnectedFilterInterface KsPinGetConnectedPinDeviceObject KsPinGetConnectedPinFileObject KsPinGetConnectedPinInterface KsPinGetCopyRelationships KsPinGetFirstCloneStreamPointer KsPinGetLeadingEdgeStreamPointer KsPinGetNextSiblingPin KsPinGetParentFilter KsPinGetReferenceClockInterface KsPinGetTrailingEdgeStreamPointer KsPinPropertyHandler KsPinRegisterFrameReturnCallback KsPinRegisterHandshakeCallback KsPinRegisterIrpCompletionCallback KsPinRegisterPowerCallbacks KsPinReleaseProcessingMutex KsPinSetPinClockTime KsPinSubmitFrame KsPinSubmitFrameMdl KsProbeStreamIrp KsProcessPinUpdate KsPropertyHandler KsPropertyHandlerWithAllocator KsQueryDevicePnpObject KsQueryInformationFile KsQueryObjectAccessMask KsQueryObjectCreateItem KsQueueWorkItem KsReadFile KsRecalculateStackDepth KsReferenceBusObject KsReferenceSoftwareBusObject KsRegisterAggregatedClientUnknown KsRegisterCountedWorker KsRegisterFilterWithNoKSPins KsRegisterWorker KsReleaseControl KsReleaseDevice KsReleaseDeviceSecurityLock KsReleaseIrpOnCancelableQueue KsRemoveBusEnumInterface KsRemoveIrpFromCancelableQueue KsRemoveItemFromObjectBag KsRemoveSpecificIrpFromCancelableQueue KsServiceBusEnumCreateRequest KsServiceBusEnumPnpRequest KsSetDefaultClockState KsSetDefaultClockTime KsSetDevicePnpAndBaseObject KsSetInformationFile KsSetMajorFunctionHandler KsSetPowerDispatch KsSetTargetDeviceObject KsSetTargetState KsStreamIo KsStreamPointerAdvance KsStreamPointerAdvanceOffsets KsStreamPointerAdvanceOffsetsAndUnlock KsStreamPointerCancelTimeout KsStreamPointerClone KsStreamPointerDelete KsStreamPointerGetIrp KsStreamPointerGetMdl KsStreamPointerGetNextClone KsStreamPointerLock KsStreamPointerScheduleTimeout KsStreamPointerSetStatusCode KsStreamPointerUnlock KsSynchronousIoControlDevice KsTerminateDevice KsTopologyPropertyHandler KsUnregisterWorker KsUnserializeObjectPropertiesFromRegistry KsValidateAllocatorCreateRequest KsValidateAllocatorFramingEx KsValidateClockCreateRequest KsValidateConnectRequest KsValidateTopologyNodeCreateRequest KsWriteFile KsiDefaultClockAddMarkEvent KsiPropertyDefaultClockGetCorrelatedPhysicalTime KsiPropertyDefaultClockGetCorrelatedTime KsiPropertyDefaultClockGetFunctionTable KsiPropertyDefaultClockGetPhysicalTime KsiPropertyDefaultClockGetResolution KsiPropertyDefaultClockGetState KsiPropertyDefaultClockGetTime KsiQueryObjectCreateItemsPresent _KsEdit

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kssetup.inf

SHA256 d94726e6f8d519a5f445084f154da0da79eaff3721e82eff83d531155756e86d
MD5 df574e8bd81430a095b7bd6edc5fadc8
SHA1 5996a7c76fa35541119432a0d28e041de0de9ed1
SHA512 6f3f69b21f0c00bf746f6b8bad38dc400025c4c8e815e964036152ef21957f6d58a5df2ba78f18956cb2483bbdd3d72c4a46e313ab6f960a0ad822a39788c2f8
TLSH
T19741AF5AE771C24B60DEF599160CCED3D15C61768A39447C39AED594EA8DD0C833AB30
MD5 SHA1 SHA512 TLSH

ksuser.dll

IMPHASH 407f14f3ab3229ce994109fc31901c00
SHA256 62ee25b5739eda45156d4232843a696a5bf638202a203908f360957e04159686
MD5 3b90d72e2acb62c39e064ed5b4362cf6
SHA1 b6d4efba2ff8a2bd57f20f623883beef0d9f9da8
SHA512 62453182ebf2fb0299e85baf990036640d8ba953c23497b40941c96f09fc5637c6e6e58309cfd2800cb04f30965ee0a1ca724054bed926cf401c1143749ec022
TLSH
T11181621953F80536F0FB8B30DAF20757A17A7C10AA698A590590171B3C76A15CA31F2A
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

l3codecx.ax

IMPHASH d7e8a0cc68dc418d56e7942bed824e2d
SHA256 b5c87e6604585feff04e67f82a5a2e562f51efbf21d49841e6077790cd4ab2c7
MD5 938b396850b318cae7ffb7380091ccbe
SHA1 469403f7cb3b35ae1bc6944d874ec5cb19bcce06
SHA512 8af1f6a5ead49176590daaaa1ad7d63bcab4fd7d6cc039f191b5e85bd1082d8d32e90018017a7c38c3122e19ad03b95656f127a8a635963c360e350401acf145
SSDEEP 1536:znO7U7L8+AkxhnMOejOIOAZM2nrREegqB7v9lCDLU:DiUE+hnMOejOIOAGMrRHgqN9lULU
TLSH
T1D5836B42BAC346B1EABF65B504EB2237E738EA412514CD277B1CC5663833160ABD735E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36687

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

license.txt

SHA256 e76173bcf900501328a990f5ec03ee55a2e5ab98d23b44512c5335c669d298a0
MD5 17c6063103ec787cb3d9e76b8f1cb6e9
SHA1 70694ff93d8750b1536684754050e1cf174d4aa7
SHA512 e8044140d7edbbdefa4ed51bfcfd7ad1a84b55e430a3b39d564ecb5754011e3ef18d4f52fed16573f066941a7b1c4dde1f40b03ba03278d079bed92bbd293d61
TLSH
T19A2145FEE1055BF65EE01595384DAEE2A5AC40AE1D219AB004F5C0CC661F16DC27FE70
MD5 SHA1 SHA512 TLSH

mciqtz.drv

SHA256 ba7edc45da2b5433077185762ae7ca3103bcb69730139a25c83f4de88780b853
MD5 b5d7471e38ed6d03145d5e6dcb368715
SHA1 fb10eec2eb24b3ecb7c0f1c3e83d08c28982941e
SHA512 f819eb4d1881eadbd01691bf7619ba4cd1ed18c3905b1ecdcf122721450199c757fdf437b905fc07b36847245ad51f96eac55271287ad9143dbb6a366cc4bdf2
SSDEEP 192:VF59Tv6AaBuwiDuid/Xy92sd+80KnsQDoKqzXXbkmFQi5O:VF5/aB/BipX82sdlsQ0KiJc
TLSH
T15932710BC7B59A86C1CC0B31DFC24B017975E9FD93BBDE0ABD86106D1A057881B607E6
MD5 SHA1 SHA512 SSDEEP TLSH

mciqtz32.dll

IMPHASH 6f7fd37396bca471f8c746fbbf6b8d0b
SHA256 87b518179b2bbca11d9ece65dba01e76112dd67e459d8bb2e12b981a0e628a30
MD5 0baf3df01fd34ed1ee9ae92f67cbd683
SHA1 9ad1c86156066d66ddca3f02c501410473e90534
SHA512 5d74b2289cc34007d279fe2a20b3866c2c80935e8bf4c30c23a698a960376802532d581a6d7f9bba15777e266618a76be58acaf97c392a23efc56d19f5bc1cca
SSDEEP 768:NGo1b250zLcJnlIWZeOfeO6p2ioNx9X5:i5IcJlV5feNgDRX5
TLSH
T163F26052A7F84637F1F30F718876662132BABCB5AA37D24F1A45024D1E727818E74B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

20047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LocalAlloc GetProcAddress MulDiv MultiByteToWideChar lstrlenA GetModuleHandleA LocalFree TerminateProcess GetCurrentProcess QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime CreateEventA CreateThread WaitForMultipleObjects CloseHandle SetEvent WideCharToMultiByte ResetEvent DisableThreadLibraryCalls WaitForSingleObject

user32

GetWindowLongA GetSystemMetrics SetWindowTextA SetForegroundWindow UnregisterClassA DestroyWindow WindowFromDC EndPaint BeginPaint DefWindowProcA SetWindowLongA RegisterClassA LoadCursorA SetRectEmpty PostMessageA LoadStringW InSendMessage GetWindowTextA PostQuitMessage DispatchMessageA TranslateMessage GetMessageA GetClientRect CreateWindowExA GetWindowRect AdjustWindowRect IsWindow IsIconic IsZoomed ShowWindow IsWindowVisible SetWindowPos SendMessageA ScreenToClient

winmm

mciFreeCommandResource GetDriverModuleHandle DefDriverProc mciGetDriverData mciLoadCommandResource mciSetDriverData mciDriverYield

ole32

CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance

gdi32

CreatePalette GetObjectType SetStretchBltMode SelectPalette RealizePalette StretchDIBits GetStockObject DeleteObject

quartz

DBToAmpFactor AmpFactorToDB

migrate.dll

IMPHASH e568bbf24d2aa3e154a6757caa3c62f4
SHA256 e762246f4bf64e7e066cf09276d5e50087311ea26f3e04cf2a9a2b5d89df5987
MD5 7d162d4625ea26e2a103c365b02bf512
SHA1 118c91478d51ef4706e0b2ec875a7a20fbaca1a6
SHA512 e80dfd8242b46330956b94465264959d9ca1474eb416db64eea36abbf60510ed2c039a076c4cfce5236b781ba05bade008c7f268dde3b33e8fee69daa3313f7e
SSDEEP 768:7X6sQ5ZcnZwfyWHuYTZFiMJNOmRpPFzqdxw8gq8rX9uMGxG3s:y5BzHu8NJNOGFzqdxw8gq8rX9uMGxG3
TLSH
T1FA735F056BFA0226F0F35E3456F027965A7EBE23AD35D26E8B50224D1970F158AB0F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_DLL

PDB paths

kernel32

lstrcpynA GetWindowsDirectoryA lstrcmpiA DeleteFileA lstrlenA GetLastError GetFileAttributesA HeapFree GetPrivateProfileSectionA HeapReAlloc HeapAlloc HeapCreate FindClose FindNextFileA WritePrivateProfileStringA FindFirstFileA GetSystemDirectoryA MoveFileA lstrcatA lstrcpyA HeapDestroy DisableThreadLibraryCalls GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess VirtualQuery GetSystemInfo VirtualProtect GetLocaleInfoA RtlUnwind GetCommandLineA GetVersionExA ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW WriteFile CloseHandle GetACP GetOEMCP GetCPInfo VirtualAlloc Sleep LoadLibraryA SetStdHandle FlushFileBuffers SetFilePointer LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

LoadStringA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

shell32

SHFileOperationA

mpg2splt.ax

IMPHASH 7506cadb3101234ca71464cd166661ff
SHA256 e6c49ffcd011c26da76ca764b741395807dfd5d56d42e4736b9e56fccce835b8
MD5 f4c9e40fada73a7c7325640b11544926
SHA1 27d147dc5e20bfecaaa6cc26ee72fc5e37b0554a
SHA512 bd148325c8b509bbca9d37ca24b842b05d79ab90cef53bb36d827c27f48a2405d1224ebf4415075b89507ff0f7b52076869bded066534588be7475e6d64f7358
SSDEEP 3072:iGm2Wa0prDKtLsM1xVzauO1IfkFL9cM7sv4u1k6/:iGmpaCMbsze46k
TLSH
T168D39DA773D680B6C39332324E39377AA3EAC711093D966747213C495B6542AE33FA53
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12783

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapAlloc HeapReAlloc HeapFree GetProcessHeap CreateFileMappingA MapViewOfFile UnmapViewOfFile MulDiv CreateThread SetThreadPriority InterlockedExchange GetACP WideCharToMultiByte VirtualAlloc CreateSemaphoreA VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects GetCurrentProcess TerminateProcess GetModuleHandleA GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter ResetEvent SetEvent CreateEventA CloseHandle LeaveCriticalSection EnterCriticalSection QueryPerformanceFrequency DeleteCriticalSection InitializeCriticalSection InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA GetLastError MultiByteToWideChar GetVersionExA lstrlenA

msvcrt

free ??2@YAPAXI@Z _purecall wcscpy wcslen _wcsicmp _except_handler3 _itow malloc ??3@YAXPAX@Z _ftol qsort memmove

user32

wvsprintfA wsprintfA

advapi32

RegCreateKeyExA RegQueryValueExA RegCreateKeyA RegSetValueA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA

ole32

CoTaskMemAlloc CoInitialize CoCreateInstance CoFreeUnusedLibraries CoUninitialize StringFromGUID2 CoTaskMemFree

winmm

timeBeginPeriod timeGetDevCaps timeGetTime

msanalog.vxd

SHA256 fd0dcf9f8d049386f5e221277e1962607508f95339157ba9cc4d2e189fd14aa5
MD5 014cec45fa7b59ce0b4639ae613a9fd3
SHA1 529d950aa425f4711e0de89056235f1b9c9219d5
SHA512 61e8ccce8773d60fa87ab6091bc5b002ac22b94571fa8287376626dcaae5eb6d2456dbc33678c31340d4c4700ae9ac18d54673a9104e383f5048a50aff2e336c
SSDEEP 192:Vci1WypnW9TFeN7C7fI1ymoXvxIw+AbsAhr4:VciMypW9TFw7CDITzAhk
TLSH
T16A4219E0DC60D371C74522B35EFE0F1D69BC87DE0A678A07E685294238A194245CBDFC
MD5 SHA1 SHA512 SSDEEP TLSH

msdmo.dll

IMPHASH 9dc9c166118bb224232425dd36ebb31e
SHA256 d03764bfbd888c0c52e4b3d182f7be655283b983aff37e3c8784bfb5062206a2
MD5 19c1fdfd3c4ac6146f4a50aad64a115f
SHA1 4673f8cfa510facf5ede9af6d5b7c170b4e7ec3a
SHA512 fb04f3abd3fbdd277464564ba0dbf1d52447039b1038acdee924063cf1e0c51615220f6c53bf24f594876e7ab3fdfc52e740db26b5dce7a018a4c5b5e425a356
SSDEEP 384:+qNkbyKUwWmjLtaN7fAlYbUKVxL8kdZuJXCVjX/kOKWVY:+qN+bWaLc4MUKUkdZuJXKvk0Y
TLSH
T132420942B7E402ABD1E34D74A6B1136BA3BDC110CC32CD56C611094F3AB5A93ABF5B03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msjstick.drv

SHA256 7384681819baf9a3ad1056ad560df7eefe94441b04074d6e9fcedabea18c5f91
MD5 39d11f5783891a92dfd15ab7da2b7204
SHA1 6327f381c51b8cc7c07a790b05fc7879da2de204
SHA512 337ee0e692516e9c6aa2dd7bae1162c22e6aa1383b175a3fcb64709f15308581890235510fa84fdecd90f4e6ac4ab3bbec1e3293da4420d44e4260ba511c7e11
TLSH
T19841C903CB64F8C3D93D06751553A762B3FEEB45130B2F0B45D49B1B4ED1180CB56495
MD5 SHA1 SHA512 TLSH

mskssrv.sys

IMPHASH ae7af65c91def368b78cf6daaa295831
SHA256 56bf6e6f9353f51e72508b6bf9d54163d797508b0136fbfc161e259c7d9cb912
MD5 9e85272966c72ea3be6762e015f9f683
SHA1 d118fd57259bfffc4e0bef8a5a7c7d6ec60eb070
SHA512 15d104b4618c1c6432f17725acffb9a11d2a42377cade5f86d1cd531e0bdf9411a8bd09ece6687eb12894fd6098d9ce3eaab214d26860d2e4d82d9f8f786486a
SSDEEP 192:MoZtI70NLd7mWoaSFI9NJ5ca13xHO1IIl5bymoWPJWdW:MoUWmvaSFIvJya1t25WFWPJW
TLSH
T1E3E1B952F7F85626E0B20AF49997452BD2E3A91199B0870E59501B4E29BCB04BF32F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4949

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mskssrv.pdb

Name

.text

Size

384B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mspclock.98

IMPHASH a38e3fcf8a1b447f8cb1c7fe185f87bf
SHA256 a30cff767f3c21b89b5b092288a8bf0da8c4f4b11ae95ced8c1e63df72da71cf
MD5 7526a982f686abaed3c35f3dbbcdb436
SHA1 66a93076e659a6aed3d5628e648283df9d658fd1
SHA512 fdedc77df17297788c238e8a15b5b562516ae232ba883ffe3a4b47c04a9e53f7b6ac794f0bfb4d371e87e420b0b78b155314d2a7ac42316cc9cdf2bfd59bb2e7
SSDEEP 96:zE+0dwJpQ6K6wF5BcklFraJowKOW3GWiQ:jncr6wvD52W3GWiQ
TLSH
T130B1629273EC2E51E0FA25B04D9F671762772C128D34EB0603845BAD2D2A810BE59B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mspclock.pdb

Name

.text

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mspclock.se

IMPHASH 80ceafa87487c2a1e5e0a913df0055d1
SHA256 0f663036bde76e786e3b069dff27d6a6e544cbc97a02ba22ef1fcb17f8b11859
MD5 942eb6ee5fd88da98e742cf07f996311
SHA1 0cbfbd61eea0db95d0269f9c2ec982774a65f416
SHA512 c5c1f02d2201dfbbcef81dafdedcc730c3208d47f0ec601fc81f34cdeb0d9a7558065b187b78770c083f9cd777f4a03c7c9733c254c6b804b63a511f77fdc165
SSDEEP 96:Hi0d6JH2pXqLumCF5BcklFraJowqOW3GWqos7:C9Ep6LumevD52W3GWqr7
TLSH
T1BDB174A2B3E86E05E0B62AB14CDF6617A2373C119D74EB020744477D3D2A910BD95B7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mspclock.pdb

Name

.text

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mspclock.sys

IMPHASH 80ceafa87487c2a1e5e0a913df0055d1
SHA256 0f663036bde76e786e3b069dff27d6a6e544cbc97a02ba22ef1fcb17f8b11859
MD5 942eb6ee5fd88da98e742cf07f996311
SHA1 0cbfbd61eea0db95d0269f9c2ec982774a65f416
SHA512 c5c1f02d2201dfbbcef81dafdedcc730c3208d47f0ec601fc81f34cdeb0d9a7558065b187b78770c083f9cd777f4a03c7c9733c254c6b804b63a511f77fdc165
SSDEEP 96:Hi0d6JH2pXqLumCF5BcklFraJowqOW3GWqos7:C9Ep6LumevD52W3GWqr7
TLSH
T1BDB174A2B3E86E05E0B62AB14CDF6617A2373C119D74EB020744477D3D2A910BD95B7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mspclock.pdb

Name

.text

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mstee.sys

IMPHASH ba17250f7c9c0536bc777562ff599d7c
SHA256 80ca6e69a8cc523b7920b2cff39c69e206fcf0393f3df5bd9cc45beed6ecbccd
MD5 153781f3de3bafc3bad1db4da12206f4
SHA1 7435bff27c6322ffba034cfb0c70dde27019ca3d
SHA512 d251dd85e704ace4c99cb0ee5e01d695dd885f409f4ab091fb5ea540807b197b4bfa9214bf0d3bca73c2058fb2e46f57fb8fdc375cb220c1fba5e57428f5ded6
SSDEEP 96:T/bd1iILzpAjlDG3Dp7eG8AvC7RTXiWJCW:rB1iILzpAjlDG3Dp7eG8AvKeWJCW
TLSH
T18FB17213B7F91E14F8E34A701CAB4B86A376FE615D32CB0B1554165E1E36984FC34B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mstee.pdb

Name

.rdata

Size

256B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

190B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mswebdvd.dll

IMPHASH 4d11507e5097e6d710ceb3f05f186072
SHA256 f48981b54f788ca26791ac697191fe6204fe2de14fba8d6a7baa030142054065
MD5 4bf36b57a5007ee3ab091580f3f5ee20
SHA1 40e7ef92103bfa9e50d2937de90e167bc6422058
SHA512 e8e497f7848b443dac728ceaaa7454b57f5423febe291aae96f6b5d2a2dfce7bf0b7c27f62ebcec7e3215d885820e8628fbcd162678a8b0b6b477b348f1f30b5
SSDEEP 6144:qxhukzppcWReZks4eNkh2XWuV7FgxzszEH:VkzXcW8KsDNkh2m3h
TLSH
T1B864C301B3E9C226F1F32B345EBA539A5A77FD409E36811F2688131D1D72E84EA24777
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

82583

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceCounter GetCurrentProcessId WaitForSingleObject TerminateProcess lstrcpynA GetModuleHandleA GetUserDefaultLangID IsValidLocale GetCurrentThreadId GetShortPathNameA CloseHandle lstrcpyA MultiByteToWideChar lstrlenA InterlockedDecrement GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary InterlockedIncrement HeapAlloc GetProcessHeap HeapFree GetCurrentProcess LoadLibraryExA GetLastError FindResourceA LoadResource SizeofResource DisableThreadLibraryCalls GlobalAlloc GlobalLock GlobalUnlock GetModuleFileNameA lstrcatA HeapDestroy IsDBCSLeadByte lstrcmpiA DeleteCriticalSection InitializeCriticalSection CreateEventA lstrlenW EnterCriticalSection LeaveCriticalSection Sleep GetVersionExA GetSystemDirectoryA SetEvent ResetEvent GetDriveTypeA GetTickCount FlushInstructionCache WideCharToMultiByte GetSystemTimeAsFileTime

msvcrt

_except_handler3 ??1type_info@@UAE@XZ ?terminate@@YAXXZ _vsnprintf fwrite fclose _ui64tow malloc realloc ??3@YAXPAX@Z ??2@YAPAXI@Z _CxxThrowException wcslen _ftol __CxxFrameHandler free fopen _purecall

gdi32

GetClipBox GetDCOrgEx CreateMetaFileA SetWindowExtEx CloseMetaFile DeleteMetaFile CreateDCA LPtoDP SaveDC SetMapMode SetWindowOrgEx SetTextColor DeleteDC RestoreDC CreateSolidBrush SelectObject Rectangle DeleteObject GetNearestColor GetDeviceCaps GetSystemPaletteEntries CreateRectRgnIndirect SetBkColor SetViewportOrgEx

user32

SetTimer CharNextA GetDC PtInRect UnionRect GetKeyState DestroyAcceleratorTable SetWindowLongA CallWindowProcA EndPaint BeginPaint IsChild GetFocus RegisterClassExA wsprintfA GetClassInfoExA SetFocus ShowWindow GetParent SystemParametersInfoA SetRect GetSystemMetrics IsIconic GetWindowRect InvalidateRgn RegisterClassA GetClassInfoA PostMessageA IsWindowVisible GetWindowDC ReleaseDC KillTimer DestroyCursor DestroyWindow LoadStringA InvalidateRect ShowCursor GetWindow CreateWindowExA GetClientRect IsWindow GetDesktopWindow MapWindowPoints ClipCursor LoadCursorA IntersectRect EqualRect DrawTextA SetCursor DefWindowProcA GetWindowLongA SendMessageA SetWindowPos SetWindowRgn OffsetRect

advapi32

RegDeleteKeyA CryptAcquireContextA CryptGenRandom CryptReleaseContext CryptCreateHash CryptDestroyHash CryptHashData CryptGetHashParam RegCreateKeyA RegQueryValueExA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA

ole32

CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc OleRegEnumVerbs OleRegGetUserType CreateOleAdviseHolder OleSaveToStream WriteClassStm OleLoadFromStream CreateDataAdviseHolder OleRegGetMiscStatus ProgIDFromCLSID

oleaut32

SysAllocString SysFreeString SysAllocStringLen SysStringLen VariantClear VariantCopy VariantInit SetErrorInfo CreateErrorInfo OleTranslateColor VariantChangeTypeEx LoadRegTypeLi VarUI4FromStr LoadTypeLi RegisterTypeLi VariantChangeType SysStringByteLen OleCreatePropertyFrame SysAllocStringByteLen

comctl32

ord17

comdlg32

GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

winmm

mixerSetControlDetails mixerGetLineControlsA mixerGetLineInfoA mciSendCommandA mixerGetControlDetailsA mixerGetNumDevs mixerOpen mixerClose

ddraw

DirectDrawCreate

quartz

AMGetErrorTextA

pid.dll

IMPHASH c187922ee464a7248fc84c24ac38332b
SHA256 77a43acfab4facb9cb2b007fd9728fbbf3d3b2eaa40de49d09ad65b954830821
MD5 fd482c36948bf9c3a771df499db42ccd
SHA1 9d28d35436aad5fa8937ff1f0beaa7d2821077b4
SHA512 a419f4778c621ff486768c3b5a5ef958bdecde499ea8e21dded6c170319346ea27a3ca5893b20154740eae62bda3446b1b25a90e798a4f231cfa79818de3d1f5
SSDEEP 384:wFThZ3AECW5r6vxw5ky9yD5/jQdTZsf+bxgOQ1Mw5FUClfTNDGpOWuCeW:uT/3vt5rWxwbI6s2UJDDat
TLSH
T117033B00FDFD95F7E2B2567059C27BB2B37C46280634A98A57D41C467CB0DA1A73B683
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7233

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEvent ResetEvent WaitForMultipleObjects MulDiv ReleaseMutex WaitForSingleObject FreeLibrary LoadLibraryA CreateThread CreateEventA WriteFile CreateFileA Sleep GetVersionExA GetVersion IsBadReadPtr WriteFileEx ReadFileEx FreeLibraryAndExitThread RtlUnwind GetLastError UnmapViewOfFile DeleteCriticalSection GetModuleHandleA GetProcAddress DisableThreadLibraryCalls InitializeCriticalSection CreateMutexA CreateFileMappingA CloseHandle MapViewOfFile LeaveCriticalSection EnterCriticalSection WideCharToMultiByte InterlockedDecrement InterlockedIncrement lstrlenA lstrcpyA LocalReAlloc LocalAlloc GetModuleFileNameA LocalFree

advapi32

RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA

user32

PeekMessageA TranslateMessage DispatchMessageA PostThreadMessageA wsprintfA MsgWaitForMultipleObjectsEx

hid

HidP_GetSpecificValueCaps HidP_GetSpecificButtonCaps HidP_SetUsageValueArray HidP_GetUsages HidP_SetUsageValue HidP_GetCaps HidD_GetPreparsedData HidD_GetAttributes HidD_FreePreparsedData HidP_SetScaledUsageValue HidD_SetFeature HidP_GetScaledUsageValue HidD_GetFeature HidP_GetLinkCollectionNodes HidP_SetUsages

qasf.dll

IMPHASH 8f4c83c3afc22965cc8f4de6d7a2646e
SHA256 dbe75bc63d87a31400eda171474a77184cb3e2a63a29d25890cc3ab63a867945
MD5 1ed1d6f8ebbfea5dfa67c132d1ee4de0
SHA1 95be91a97cd57f01ef0a1a8b4eb1e687e4643517
SHA512 eb4670f4463b5cc9c7c97a75e00a6cfb10c16bb8285a8d61e5fa61e93e63ceb1e6db1ddadd46c4f9bc9967e7fe606a5e7be7bcafef62a230f5cc87f612a9ce70
SSDEEP 3072:Ief8RCkl8QrkCLJUc6mxbgS5hPrjDlXuo83e7wpVrmVepAZ/NRFJkgzef8BOaQec:IDziQrkmVgS5FjDlXBeWwpYVeInJk6u
TLSH
T199045C02B3F6B075E1F3623ADA79B33FB379BB255621D61A06044F192E71680E92C717
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetDiskFreeSpaceA TerminateProcess GetSystemTimeAsFileTime GlobalMemoryStatus QueryPerformanceCounter CreateThread GetTickCount GetLocalTime GetComputerNameA DeviceIoControl GetModuleHandleW LocalAlloc LocalFree GetCurrentProcessId DisableThreadLibraryCalls SetThreadPriority InterlockedExchange GetACP WideCharToMultiByte GetModuleHandleA GetProcAddress VirtualAlloc CreateSemaphoreA GetCurrentThreadId GetCurrentProcess VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject ResetEvent SetEvent CreateEventA CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection LoadLibraryA InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA GetLastError MultiByteToWideChar lstrlenA GetVersionExA RaiseException

msvcrt

wcslen wcscpy wcscat _purecall swprintf _ftol _except_handler3 ??2@YAPAXI@Z _wtoi ??3@YAXPAX@Z

gdi32

GetTextExtentPointA

user32

wsprintfA wvsprintfA GetDesktopWindow GetWindowRect LoadStringW DefWindowProcA DestroyWindow ShowWindow InvalidateRect MoveWindow CreateDialogParamA SetWindowLongA GetWindowLongA GetDlgItem GetDC ReleaseDC SendMessageA LoadStringA

advapi32

RegCreateKeyExA RegCreateKeyA RegSetValueA RegSetValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey RegDeleteKeyA RegQueryValueExA GetUserNameA

ole32

CoTaskMemFree CoTaskMemAlloc CoInitialize CoCreateInstance CoFreeUnusedLibraries CoUninitialize StringFromGUID2

oleaut32

SysAllocStringLen

qcap.dll

IMPHASH 3337a976f7a833f6793dfd25785c3a1b
SHA256 c1904469e7205e5b4df76852fc9d19a6ca0a5f4027b80b189687ffd73b77a14c
MD5 cd010950bfcdc2d8e54aaeb6ad9a883a
SHA1 1d426c8b5d0fc95ead0ebeeb0b2b15b7f8190a50
SHA512 8532a4041b121b3bdbdd4fbf54d66f3d4a27422c4263242067b44e13ac52e8910f921b26e5c437fa41658193a0e4654b8a9a405309e375b3301eaa537cd93387
SSDEEP 6144:KzsODAYsFv9ts0Ya2o8eGorvMExxKog6/s:zODA719tlYgrvMEz8
TLSH
T135443A01A3F5C03BF1F31B355EF977A65A7AFD005A28C80F9A82278D1975A04DA29737
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GetCurrentProcess GetProcAddress GetDiskFreeSpaceA ReadFile GetFileSize DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter CreateIoCompletionPort DeleteFileA GetFullPathNameA PostQueuedCompletionStatus GetQueuedCompletionStatus CreateFileA GetModuleHandleA WriteFile SetEndOfFile lstrcmpA IsBadCodePtr IsBadHugeReadPtr lstrcpynW GetFileAttributesW IsBadWritePtr HeapFree GetProcessHeap HeapAlloc lstrcmpiW lstrcpyW GetPrivateProfileStringW IsBadReadPtr GlobalMemoryStatus GetProfileIntA GlobalAlloc GlobalLock GlobalHandle GlobalFree GlobalUnlock MulDiv GetModuleFileNameA lstrcpyA DeleteCriticalSection InitializeCriticalSection WaitForSingleObject GetCurrentThreadId EnterCriticalSection LeaveCriticalSection lstrlenA WideCharToMultiByte SetFilePointer MultiByteToWideChar VirtualAlloc VirtualFree GetSystemInfo ReleaseSemaphore InterlockedDecrement FreeLibrary InterlockedIncrement CreateSemaphoreA CreateThread GetLastError WaitForMultipleObjects GetCurrentThread GetThreadPriority SetThreadPriority InterlockedExchange ResetEvent SetEvent GetACP CloseHandle CreateEventA GetVersionExA

msvcrt

_ftol ??3@YAXPAX@Z ??2@YAPAXI@Z _purecall _except_handler3

gdi32

GetObjectA GetPaletteEntries GetStockObject SelectObject PatBlt GetTextExtentPoint32A

user32

GetDlgItemInt GetDesktopWindow IsRectEmpty SetDlgItemTextA EnableWindow GetDlgItem SetDlgItemInt ReleaseDC ClientToScreen GetClientRect GetDC IsWindowVisible IsWindow wsprintfW SetCursor LoadCursorA GetAsyncKeyState CheckRadioButton CheckDlgButton SendMessageA wsprintfA wvsprintfA GetWindowRect LoadStringW DefWindowProcA DestroyWindow ShowWindow InvalidateRect MoveWindow CreateDialogParamA SetWindowLongA GetWindowLongA PeekMessageA DispatchMessageA TranslateMessage LoadStringA

advapi32

RegEnumKeyW RegOpenKeyW RegCreateKeyW RegCreateKeyA RegSetValueA RegEnumKeyExA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegQueryValueExW

ole32

CoCreateInstance CoTaskMemAlloc CoUninitialize CoInitialize StringFromGUID2 CoFreeUnusedLibraries CoTaskMemFree

oleaut32

SafeArrayAccessData VariantClear SysAllocString SafeArrayUnaccessData SysFreeString SysStringLen

msvfw32

ICCompress ICDecompress ICGetInfo ICOpen ICClose ICSendMessage ICLocate

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

mixerOpen mixerClose waveInStop waveInStart waveInAddBuffer waveInPrepareHeader waveInUnprepareHeader mixerSetControlDetails mixerGetID mixerGetLineInfoA mixerGetLineControlsA waveInGetDevCapsA waveInReset waveInClose waveInOpen CloseDriver OpenDriver SendDriverMessage mixerGetControlDetailsA

qdv.dll

IMPHASH 97b9a2e3ba597b131681d3171e64a371
SHA256 47260a466e2707d7ccbaf19af3da194d6e1204686f370381259d067efe2fbe3a
MD5 447e0133931b0f3add968778eabfc749
SHA1 f2e560d9abd86da9d8b1cf2e4d84a726eaee2d2d
SHA512 a80b9ef489d6a22ddb896600d4c3b00238076bd44bdc09cdfa4c5e2412399c1128449723083f4bbc3fa48b90195073ccc49e2819062ae1b1bec55cc3e440988b
SSDEEP 6144:22dbHypRQkaUGpjN0koa+ASweo2wbItweo1weorB3LzlwF1IXuZJyzOGk1hPFqBI:22tHypCKkkB3OI+f+6N
TLSH
T1D5648E6363A6D62BE0A1447A95FF237D2AB9BF20C615988787C1357D3C706428B3335B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10397

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

??2@YAPAXI@Z _purecall _ftol _except_handler3 ??3@YAXPAX@Z

user32

LoadStringW GetDesktopWindow GetWindowLongA LoadStringA IsRectEmpty IsDlgButtonChecked SendDlgItemMessageA CheckRadioButton wvsprintfA wsprintfA SetWindowLongA CreateDialogParamA MoveWindow InvalidateRect ShowWindow DestroyWindow DefWindowProcA GetWindowRect

advapi32

RegEnumKeyExA RegQueryValueExA RegCreateKeyExA RegCreateKeyA RegSetValueA RegSetValueExA RegOpenKeyExA RegCloseKey RegDeleteKeyA

ole32

CoInitialize CoFreeUnusedLibraries CoUninitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoTaskMemAlloc

msvfw32

StretchDIB

winmm

timeGetTime

kernel32

GetACP TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetVersionExA DisableThreadLibraryCalls lstrlenA MultiByteToWideChar GetLastError GetModuleFileNameA InterlockedIncrement FreeLibrary InterlockedDecrement LoadLibraryA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CloseHandle CreateEventA SetEvent ResetEvent WaitForSingleObject ReleaseSemaphore GetCurrentProcess GetCurrentThreadId CreateSemaphoreA GetProcAddress GetModuleHandleA WideCharToMultiByte InterlockedExchange SetThreadPriority GetTickCount CreateThread MulDiv lstrcpyA

qdvd.dll

IMPHASH a260af3493591a91b9363a8954d4c9a7
SHA256 f35494be95ef2d5fd010812d74e610bddb1d1a76361e985c52d2242c70cf4d63
MD5 12b5dd2309b2f3b8f81f1dad4c377cfe
SHA1 9b5e4993afa4855de8d5691d824c5be0c68a0171
SHA512 6e73d9245e8d5a8ce7f64193f4b154031dbc3012ec4fd67db196db4a1ed9e639b90af9cebe188422eb2a5681637514bea038415b73ad987f01b3080235c6a1e2
SSDEEP 6144:zD1iTijdQqnQspPn98cmYlKyxkd5iJBacLMvD/6zK/8PJfnwVprYdbF:fbXQsE9YGi7ac4vDSC8Kh
TLSH
T17D947D22B3FAD036E5F323348D7D677666BAB910163C8809B3450A4D3A71A11D62F7B7
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

41438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetVolumeInformationA SetWaitableTimer CreateWaitableTimerA SetFilePointer ReadFile FindCloseChangeNotification GetLocaleInfoA IsValidLocale FindNextFileA DeviceIoControl GetOverlappedResult TerminateProcess GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime FindFirstFileA FindClose GetDriveTypeA GetFileAttributesA GetUserDefaultLCID GetComputerNameA VirtualAlloc VirtualFree GetSystemInfo ReleaseSemaphore CreateSemaphoreA CreateThread GetThreadPriority SetThreadPriority InterlockedExchange GetACP IsBadReadPtr IsBadWritePtr HeapFree SetLastError GetVersionExA WaitForMultipleObjects ResetEvent CreateEventA lstrcmpA SetEvent Sleep GetFullPathNameA SetErrorMode LoadLibraryA MulDiv GetCurrentProcessId GetTickCount QueryPerformanceCounter GetModuleHandleA CreateFileA GetFileSize CreateFileMappingA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary lstrcpynA GlobalAlloc GlobalLock GlobalUnlock GetCurrentThread GetModuleFileNameA lstrcatA lstrcpyA GlobalFree HeapDestroy WaitForSingleObject CloseHandle GetLastError GetCurrentThreadId lstrlenA WideCharToMultiByte MultiByteToWideChar lstrcmpiA GetProcessHeap HeapAlloc GetCurrentProcess FlushInstructionCache InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection

msvcrt

??3@YAXPAX@Z realloc ??2@YAPAXI@Z free _purecall _ftol qsort _except_handler3 malloc

gdi32

CreateCompatibleBitmap GetDIBits SetBkMode ExtTextOutW CreateFontIndirectA GetTextMetricsA EnumFontFamiliesExA GetSystemPaletteEntries SetBkColor CreateRectRgnIndirect CreateDCA GetDeviceCaps DeleteMetaFile CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileA DeleteDC SetViewportOrgEx SetMapMode LPtoDP SetPixel GetPixel GetStockObject GetObjectA CreateDIBSection DeleteObject StretchBlt BitBlt SelectObject StretchDIBits SetDIBitsToDevice GetRegionData FillRgn OffsetRgn CreateSolidBrush CombineRgn GdiFlush SetStretchBltMode CreateCompatibleDC CreateRectRgn GetDCOrgEx GetClipBox SetTextColor

user32

SetDlgItemInt SetDlgItemTextA CheckRadioButton EnableWindow DrawTextA IsIconic GetWindowPlacement GetQueueStatus PostThreadMessageA SetRectEmpty RegisterWindowMessageA PostMessageA ScreenToClient FillRect SetRect ClientToScreen IsWindowVisible IsRectEmpty InvalidateRect IsWindow DestroyWindow ShowWindow SetFocus LoadStringA UnionRect PtInRect CheckDlgButton CreateWindowExA GetWindowLongA CallWindowProcA CharNextA PeekMessageA DispatchMessageA TranslateMessage MsgWaitForMultipleObjects SetWindowPos SetWindowRgn OffsetRect EqualRect IntersectRect EndPaint GetClientRect BeginPaint ReleaseDC GetDC GetDlgItem SendMessageA MapWindowPoints SystemParametersInfoA GetWindowRect GetParent GetSystemMetrics GetDlgItemInt IsDlgButtonChecked KillTimer SetTimer GetWindowThreadProcessId UnregisterClassA SendMessageTimeoutA RegisterClassA GetClassInfoA wvsprintfA GetDesktopWindow LoadStringW MoveWindow DefWindowProcA CreateDialogParamA SetWindowLongA RegisterClassExA wsprintfA LoadCursorA GetClassInfoExA

advapi32

RegDeleteKeyA RegQueryInfoKeyA RegQueryValueExA RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegEnumKeyExA RegDeleteValueA RegCreateKeyA RegSetValueA GetUserNameA RegOpenKeyA

ole32

CoCreateInstance CreateOleAdviseHolder WriteClassStm OleLoadFromStream CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateDataAdviseHolder StringFromCLSID IIDFromString CoUninitialize CoInitialize StringFromGUID2 CoFreeUnusedLibraries OleSaveToStream

oleaut32

VarI4FromStr SetErrorInfo LoadRegTypeLi VariantChangeType SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear VariantInit SysFreeString GetActiveObject

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

winmm

timeKillEvent timeSetEvent timeGetTime timeEndPeriod timeBeginPeriod

qedit.dll

IMPHASH 51e14b0e14b99f0d308a0f89a9c28b0f
SHA256 49119166b29bd381f1fc032493a53e6d5cc1a8820c8a74f69e15613788b44fd9
MD5 8f32b2b0a0949d6d1d2edf94ff484037
SHA1 fcafbf4e36cf2d61833e73aa1a167f30caeb2403
SHA512 f336a7a13b822b145587e2208bd57a728fad32d75fcb5c01f2db9f6afe1741cd0d0ba6e7cb8f5e214d5f6687d8ee4fb0a66eab617f656d093d4a55846338ea45
SSDEEP 12288:8Q2if/l89jLqQdJRM6Mh8IN1mk/3EyY5svTd7m+BBBBBBBBBBBBBBBBSoJNWjOV:z3SRL7V3I1l/3EyisvT0LoJUi
TLSH
T17D850952F3C6C5A3C05E02304C7B6BD62F71B9015E26AB1B7B09578E2EB23D5B6057E2
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

52978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA GetSystemDirectoryA GetFileTime GetFileType GetCurrentDirectoryA TerminateProcess GetProcAddress GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter MulDiv LockResource GetModuleHandleA CreateFileA GetFileSize GetFullPathNameA WriteFile GlobalFree CompareStringA SetFilePointer ReadFile Sleep lstrcatW VirtualAlloc VirtualFree GetSystemInfo ReleaseSemaphore LoadLibraryA CreateSemaphoreA CreateThread GetVersionExA WaitForMultipleObjects GetThreadPriority SetThreadPriority InterlockedExchange ResetEvent SetEvent GetACP LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary lstrcpynA CreateMutexA DisableThreadLibraryCalls CreateEventA GlobalAlloc GlobalLock GlobalUnlock GetCurrentThread ReleaseMutex GetModuleFileNameA lstrcatA lstrcpyA HeapDestroy WaitForSingleObject CloseHandle GetLastError GetCurrentThreadId lstrlenA WideCharToMultiByte MultiByteToWideChar lstrcmpiA HeapAlloc GetProcessHeap HeapFree GetCurrentProcess FlushInstructionCache IsBadCodePtr IsBadWritePtr IsBadReadPtr InterlockedDecrement InterlockedIncrement InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection

msvcrt

??2@YAPAXI@Z malloc wcspbrk wcstoul wcsncmp wcscat srand rand _vsnwprintf _splitpath _wsplitpath wcscmp sprintf _iob fprintf exit fread _setjmp3 fopen fclose longjmp _purecall free _wtoi realloc ??3@YAXPAX@Z atof _ftol wcscpy wcslen

gdi32

DeleteObject CreateCompatibleDC SetStretchBltMode StretchBlt CreateDIBSection GetObjectA CreateFontIndirectA SelectObject GetTextMetricsA GetTextExtentPointA DeleteDC GetDeviceCaps

user32

LoadStringA EndDialog DefWindowProcA wsprintfA GetWindowTextLengthA GetWindowTextA SetWindowLongA GetWindowRect GetDesktopWindow LoadStringW GetWindowLongA CharNextA ShowWindow DispatchMessageA MsgWaitForMultipleObjects SetWindowPos ReleaseDC GetDC GetDlgItem DestroyWindow IsWindow InvalidateRect MoveWindow WinHelpA IsDialogMessageA CreateDialogParamA GetDialogBaseUnits wvsprintfA PostThreadMessageA RegisterWindowMessageA GetQueueStatus MessageBoxA GetDlgItemTextA SetDlgItemTextA SetDlgItemInt GetDlgItemInt CheckRadioButton IsDlgButtonChecked IsRectEmpty CharPrevA PeekMessageA

advapi32

RegCreateKeyExA RegCloseKey RegQueryValueExA RegQueryInfoKeyA RegDeleteKeyA RegSetValueExA RegEnumKeyExA RegDeleteValueA RegSetValueA RegCreateKeyA RegQueryValueA RegOpenKeyA RegEnumValueA RegOpenKeyExA

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc OleLoadFromStream CreateStreamOnHGlobal CreateBindCtx StringFromGUID2 StringFromCLSID CoUninitialize CoInitialize CoFreeUnusedLibraries CLSIDFromString StgCreateDocfile CoCreateFreeThreadedMarshaler StgOpenStorage

oleaut32

VariantChangeTypeEx VarI4FromStr LoadTypeLi SetErrorInfo LoadRegTypeLi SysAllocString VariantCopy VariantClear VariantInit SysAllocStringLen SysFreeString RegisterTypeLi

msvfw32

DrawDibOpen DrawDibDraw DrawDibClose

winmm

timeGetTime timeSetEvent timeEndPeriod timeBeginPeriod timeKillEvent

comdlg32

GetOpenFileNameA

qedwipes.dll

SHA256 d8e42d2bd31683d65590bd0ecfd20ec922d5a880165971ea3f6a035be7659db8
MD5 ac7f9f480735199ccaeb1ad627de39f7
SHA1 ece73ce8d1f5ddc1a355245a9dd2d2e36c52a308
SHA512 6b866bf265e627a2e7252b3e6148ebe04c51ebf3783ef76bb7d309581753747246876efa1c76cd6ddd93a55f9bdc0146bb2c7811e1ef7db9144abb2972816bd8
SSDEEP 12288:SHHhsO4j/aBz5ge6BbeZ2gnzM6MNCTs17pfST8iypSovFLBs5nrSi/7F:SHH6GzaD5Fi5rSi/7F
TLSH
T1B6F4CF0FAF725C56CCE8433006A93275D7189A76AFEFD68C7469AB3E5C1044B947A02E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

quartz.dll

IMPHASH 362d13b1fcdff8b6b203ca20e4836ecd
SHA256 a37c3091e59e7665350750984bd3212b18ea33b5ad86f295a482cab7e4b33610
MD5 4bbc9e6c937b7a2655a0b9ad7db5fb88
SHA1 19c2a5cde492886b9eec42e7b69ab697153ff085
SHA512 5bbea8666774f067df0e6ebe766bb4160f96b5f1cd49867f7f1281da029e5fd9e03c5fcfbfab472b775d01d70f27ebc38aae8e627f25fa2ee1d51eee78c58fb8
SSDEEP 24576:HVWdrcT/FiqYpmb4EgitdR2JWbW3K0NkISLtT:1WGTNiqYY8ditgK0y5pT
TLSH
T17885D60237FA8166F1F36B35687953A25E3A7D91A939D20D5380A25E2DB1E50CE31F33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

343617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileMappingA MapViewOfFile UnmapViewOfFile GetShortPathNameA GetExitCodeProcess GetFullPathNameA WriteFile QueryPerformanceFrequency ReleaseMutex CreateMutexA HeapDestroy FreeLibraryAndExitThread Sleep CreateFileA lstrcpyA lstrcatA MulDiv ReadFile FormatMessageA FormatMessageW CreateThread GetCurrentThread GetThreadPriority SetThreadPriority InterlockedExchange GetACP WideCharToMultiByte LoadLibraryA FreeLibrary GetLastError lstrlenA GetVersionExA VirtualAlloc CreateSemaphoreA VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects ResetEvent SetEvent CreateEventA CloseHandle InterlockedDecrement InterlockedIncrement LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MapViewOfFileEx GetProfileIntA GetProfileStringA GetPrivateProfileStringA GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalAlloc LocalAlloc LocalFree RaiseException HeapAlloc GetProcessHeap HeapFree WriteProfileStringA GetDiskFreeSpaceA CompareStringA lstrcmpA lstrcpynA IsBadWritePtr IsBadReadPtr GetDriveTypeA GetFileSize SetErrorMode LocalUnlock LocalLock LocalReAlloc SetFilePointer DeviceIoControl GetCurrentProcess TerminateProcess GetModuleHandleA GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleFileNameA MultiByteToWideChar OpenProcess lstrcmpiA

msvcrt

??3@YAXPAX@Z _ftol free _initterm ??2@YAPAXI@Z _adjust_fdiv __dllonexit _ltow wcslen towupper memmove atoi getenv sscanf _except_handler3 sprintf wcscpy malloc _onexit _wtoi _strdup

gdi32

GdiFlush SetPixel GetPixel ExtTextOutA SetBkColor SelectPalette FillRgn CombineRgn CreateRectRgnIndirect CreatePalette GetStockObject GetTextExtentPoint32A SetTextColor SetBkMode BitBlt CreateDIBSection EnumFontFamiliesExA ExtTextOutW SetTextCharacterExtra StretchBlt RealizePalette GetObjectA StretchDIBits SetDIBColorTable SetStretchBltMode GetDeviceCaps DeleteObject GetDCOrgEx EqualRgn ExtCreateRegion CreateRectRgn CreateFontIndirectA GetSystemPaletteEntries GetDIBits PatBlt CreateSolidBrush SelectObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC CreateDCA SetDIBitsToDevice GetClipBox

user32

SendMessageA GetWindowThreadProcessId LoadStringA SetTimer KillTimer IsWindow InSendMessage SetRect GetDC GetSystemMetrics IsWindowVisible IsRectEmpty SendDlgItemMessageA EndDialog DialogBoxParamA GetDlgItem MessageBoxA SystemParametersInfoA GetDlgItemInt EnableWindow GetWindowRect UnhookWindowsHookEx InvalidateRect SetWindowsHookExA GetWindowPlacement IsIconic IntersectRect OffsetRect ClientToScreen GetClientRect SetRectEmpty MapWindowPoints ScreenToClient GetParent GetWindowLongA GetDesktopWindow EndPaint BeginPaint SetCursor DestroyCursor ReleaseDC GetMessageA TranslateMessage DestroyWindow PostMessageA ReplyMessage CharNextA DispatchMessageA GetQueueStatus RegisterWindowMessageA PostThreadMessageA wvsprintfA MsgWaitForMultipleObjects PeekMessageA wsprintfA AdjustWindowRectEx DefWindowProcA CreateWindowExA RegisterClassA LoadCursorA GetClassInfoA LoadStringW EqualRect CreateDialogParamA SetDlgItemTextA SetParent IsZoomed SetWindowLongA FillRect ChangeDisplaySettingsExA GetWindowTextA SetWindowTextA MoveWindow SetForegroundWindow ShowWindow GetForegroundWindow SetWindowPos UpdateWindow GetKeyboardState SetKeyboardState LoadImageA

advapi32

RegFlushKey RegCreateKeyExA RegQueryInfoKeyA RegCreateKeyA RegSetValueA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegEnumValueA RegEnumKeyExA RegDeleteKeyA RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueA

ole32

CLSIDFromString CreateBindCtx CoCreateFreeThreadedMarshaler MkParseDisplayName CreateStreamOnHGlobal StgOpenStorage StgIsStorageFile CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoTaskMemAlloc CoInitialize CoFreeUnusedLibraries CoUninitialize CoCreateInstance

oleaut32

LoadRegTypeLi VariantChangeType VariantCopy VariantInit SysAllocStringLen SysStringLen SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData VariantClear VARIANT_UserSize VARIANT_UserMarshal VARIANT_UserUnmarshal VARIANT_UserFree SysFreeString SysAllocString LoadTypeLi RegisterTypeLi SysReAllocString SetErrorInfo

winmm

waveOutGetVolume waveOutSetVolume waveOutWrite waveOutUnprepareHeader waveOutRestart waveOutReset waveOutPrepareHeader waveOutPause waveOutOpen waveOutGetPosition waveOutGetErrorTextA waveOutGetDevCapsA waveOutClose waveOutGetNumDevs midiOutReset midiStreamOpen midiStreamProperty midiOutGetNumDevs mixerGetNumDevs mixerGetLineInfoA mixerGetDevCapsA mixerGetLineControlsA mixerSetControlDetails mixerGetControlDetailsA midiStreamOut midiOutUnprepareHeader midiStreamRestart midiOutPrepareHeader midiStreamPause midiStreamPosition midiOutGetErrorTextA midiStreamClose timeKillEvent timeGetDevCaps timeBeginPeriod timeEndPeriod timeSetEvent timeGetTime

rpcrt4

NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer_Release NdrCStdStubBuffer2_Release NdrDllRegisterProxy NdrDllUnregisterProxy NdrStubCall2 NdrStubForwardingFunction CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke CStdStubBuffer_Disconnect CStdStubBuffer_Connect CStdStubBuffer_AddRef CStdStubBuffer_QueryInterface IUnknown_Release_Proxy IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleAllocate NdrClientCall2 NdrOleFree

quartz.vxd

SHA256 6a9c8114aec8c5030ba843ca06c802f91fbe2201e492dd844b67f92ebb3c2a3f
MD5 f318e151801f7eb505894718e03bc438
SHA1 7e5127e0e188d33f1010710381121c4b7b103fe0
SHA512 53f72e9f6e6709bde2a53ac12902198eb23db9ad14f018673a64dc733324249ee96866dd1851f48f25260f0d03ae95bc6e8d162684096160c75afac3125afc4b
SSDEEP 24:etGSf+r0totnjnnSfj/PfWjwxdADCRmDXojRzNIjiZfNm:6mwtqjcDPKwxWDCRmDcZIjKVm
TLSH
T12FC1F095B324AD5BC10E53BA06E35B407B30FB4A0707CFCB5481D2646E316D89BB647E
MD5 SHA1 SHA512 SSDEEP TLSH

stream.sys

IMPHASH c1134fdb9e503ad5d0b7e607ebcafde9
SHA256 3799b51c0e3047d42e614f93e80e95d46b8f4afa9d4ed6fe60b2a664a804787c
MD5 e2e88ac2200da5b39d97dc5adc862ddb
SHA1 7b39819afc077a15c777e64740cb723bf1601d3b
SHA512 cc3fc33d84229cc331df3cf861db749322952a905bc21e4510f709996e3a1fffd8354b4543871ada45cbea58e394018498a3a06649607bfe21e8bb6c532c1cc0
SSDEEP 768:yam5moq9Zwo36rJhuhf9bTZ7ZrKMiU2w9VNFJ8UbXLfjtspK6R1m:y5k9GM6V0B9BZn2qVvJr/5spB1m
TLSH
T1F3236D13B3D404B6D5E312F0AA1A272BF37B3F03561EE77B42704D652B69950BD292A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

39429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

stream.pdb

ntoskrnl.exe

MmMapLockedPages KefAcquireSpinLockAtDpcLevel IoFreeMdl ExAllocatePoolWithTag IoAllocateMdl IoWriteErrorLogEntry IoAllocateErrorLogEntry KeSetEvent InterlockedDecrement IoFreeIrp IofCompleteRequest IoCancelIrp ZwQueryValueKey RtlInitUnicodeString KeWaitForSingleObject ExFreePool IoBuildSynchronousFsdRequest KeInitializeEvent MmResetDriverPaging KeSetTimer KeCancelTimer ExQueueWorkItem PoRequestPowerIrp InterlockedIncrement PoCallDriver MmMapIoSpace ZwClose RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString sprintf IoOpenDeviceRegistryKey IoAllocateIrp MmBuildMdlForNonPagedPool InterlockedExchange IofCallDriver MmPageEntireDriver IoGetDriverObjectExtension IoBuildDeviceIoControlRequest KeResetEvent PoStartNextPowerIrp ZwSetValueKey IoOpenDeviceInterfaceRegistryKey IoSetDeviceInterfaceState IoRegisterDeviceInterface IoStopTimer MmUnmapIoSpace IoDisconnectInterrupt wcscpy wcslen IoCreateDevice ObfReferenceObject ZwEnumerateKey ZwOpenKey _snwprintf swprintf IoGetDeviceProperty RtlIntegerToUnicodeString IoStartTimer IoConnectInterrupt KeSynchronizeExecution IoGetDmaAdapter KeInitializeTimer KeInitializeDpc KeInitializeSpinLock IoDetachDevice IoDeleteDevice IoInitializeTimer IoAttachDeviceToDeviceStack IoAllocateDriverObjectExtension DbgBreakPoint IoGetDeviceInterfaces KeDelayExecutionThread ObfDereferenceObject ProbeForRead KeInsertQueueDpc IoReleaseCancelSpinLock memmove ObReferenceObjectByHandle IoFileObjectType ExGetPreviousMode IoGetRelatedDeviceObject KeTickCount KeBugCheckEx KefReleaseSpinLockFromDpcLevel RtlUnwind

hal

KfLowerIrql KeQueryPerformanceCounter KfRaiseIrql KfAcquireSpinLock KfReleaseSpinLock

ks.sys

KsUnserializeObjectPropertiesFromRegistry KsDiscardEvent KsAllocateExtraData KsProbeStreamIrp KsFreeObjectHeader KsAllocateObjectHeader KsUnregisterWorker KsRegisterWorker KsDispatchIrp KsAddIrpToCancelableQueue KsRemoveIrpFromCancelableQueue KsFreeDeviceHeader KsAllocateDeviceHeader KsNullDriverUnload KsGenerateEventList KsGenerateEvent KsCacheMedium KsDispatchFastReadFailure KsDispatchFastIoDeviceControlFailure KsDispatchInvalidDeviceRequest KsPropertyHandler KsEnableEvent KsDisableEvent KsMethodHandler KsPinPropertyHandler KsCreateDefaultAllocator KsSynchronousIoControlDevice KsTopologyPropertyHandler KsStreamIo KsQueueWorkItem KsSetTargetDeviceObject KsFreeEventList KsValidateClockCreateRequest KsValidateConnectRequest KsPinDataIntersection

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

680B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

896B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

stream98.sys

IMPHASH c1134fdb9e503ad5d0b7e607ebcafde9
SHA256 d36075272be0910a5c82b853528ccb8b31a904bd4d52dd1579cdb54986392437
MD5 921f01b01aee083e9979b4738441c314
SHA1 64459a521edf7abd5c13f47e7bdd02d3439070c3
SHA512 b45a6c3bad62064fb7c829b0349b91b2c2f3dc75d4a87189fd6aaa474a4c523b92e656b1d11eb5ae6b1fd47ab3a2170163a544ecfa628e21553a290d36556105
SSDEEP 768:lqm5Wo9pwo36UDOJmJ69bbZKrKMiX2Y9VNt23UpDHwfDPspK6Rc4z:D5X92M6CO0Q90U2SVn2EpcrspBd
TLSH
T16B237D12B3D404B6D5E302F0AA1A272BF3BB7F03561EE77B42704D652B699507D292A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

39429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

stream.pdb

ntoskrnl.exe

MmMapLockedPages KefAcquireSpinLockAtDpcLevel IoFreeMdl ExAllocatePoolWithTag IoAllocateMdl IoWriteErrorLogEntry IoAllocateErrorLogEntry KeSetEvent InterlockedDecrement IoFreeIrp IofCompleteRequest IoCancelIrp ZwQueryValueKey RtlInitUnicodeString KeWaitForSingleObject ExFreePool IoBuildSynchronousFsdRequest KeInitializeEvent MmResetDriverPaging KeSetTimer KeCancelTimer ExQueueWorkItem PoRequestPowerIrp InterlockedIncrement PoCallDriver MmMapIoSpace ZwClose RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString sprintf IoOpenDeviceRegistryKey IoAllocateIrp MmBuildMdlForNonPagedPool InterlockedExchange IofCallDriver MmPageEntireDriver IoGetDriverObjectExtension IoBuildDeviceIoControlRequest KeResetEvent PoStartNextPowerIrp ZwSetValueKey IoOpenDeviceInterfaceRegistryKey IoSetDeviceInterfaceState IoRegisterDeviceInterface IoStopTimer MmUnmapIoSpace IoDisconnectInterrupt wcscpy wcslen IoCreateDevice ObfReferenceObject ZwEnumerateKey ZwOpenKey _snwprintf swprintf IoGetDeviceProperty RtlIntegerToUnicodeString IoStartTimer IoConnectInterrupt KeSynchronizeExecution IoGetDmaAdapter KeInitializeTimer KeInitializeDpc KeInitializeSpinLock IoDetachDevice IoDeleteDevice IoInitializeTimer IoAttachDeviceToDeviceStack IoAllocateDriverObjectExtension DbgBreakPoint IoGetDeviceInterfaces KeDelayExecutionThread ObfDereferenceObject ProbeForRead KeInsertQueueDpc IoReleaseCancelSpinLock memmove ObReferenceObjectByHandle IoFileObjectType ExGetPreviousMode IoGetRelatedDeviceObject KeTickCount KeBugCheckEx KefReleaseSpinLockFromDpcLevel RtlUnwind

hal

KfLowerIrql KeQueryPerformanceCounter KfRaiseIrql KfAcquireSpinLock KfReleaseSpinLock

ks.sys

KsUnserializeObjectPropertiesFromRegistry KsDiscardEvent KsAllocateExtraData KsProbeStreamIrp KsFreeObjectHeader KsAllocateObjectHeader KsUnregisterWorker KsRegisterWorker KsDispatchIrp KsAddIrpToCancelableQueue KsRemoveIrpFromCancelableQueue KsFreeDeviceHeader KsAllocateDeviceHeader KsNullDriverUnload KsGenerateEventList KsGenerateEvent KsCacheMedium KsDispatchFastReadFailure KsDispatchFastIoDeviceControlFailure KsDispatchInvalidDeviceRequest KsPropertyHandler KsEnableEvent KsDisableEvent KsMethodHandler KsPinPropertyHandler KsCreateDefaultAllocator KsSynchronousIoControlDevice KsTopologyPropertyHandler KsStreamIo KsQueueWorkItem KsSetTargetDeviceObject KsFreeEventList KsValidateClockCreateRequest KsValidateConnectRequest KsPinDataIntersection

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

681B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

896B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

swenum.sys

IMPHASH 2b29cc5a8e62f78b659fb1c44e574507
SHA256 7f499111dc4b863113ddea34e89cfc4b7d5c0ab9e7444a26b30e8fff4fb112b8
MD5 96ef0a67d073871301fd3dcaac47073b
SHA1 5c8339a36a7faa1bfc2735c139d3c6b54d7a5698
SHA512 b440a10650e2c10d5d84f975cfba33ec9a54f0774e1db2af8d77a165bee37a3293823c3f23e0451f3af2d72606f55ba8278963e20f2116d231adc0712947fd2d
TLSH
T17F81751283F81976F1BB1B312CA35A23627BB8109871CA1D7628479F1C6AE40F986723
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2253

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

swenum.pdb

Name

.text

Size

384B

Virtual Size

298B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

640B

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

128B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

swenum98.sys

IMPHASH 09fe4b4792d84920852bac7bb5c7981f
SHA256 3c528e8a715eb2d82020adf9264eb8a46209abd793599e62e5a22faeb52095b5
MD5 a974c877e4e212a8bcbb149bff5f1236
SHA1 0914c1654a58565f7f377f9241965452d6d217c7
SHA512 5877c2aa8d9ee3fc75c7816ca6e8e69d1b3d3286a4b1a1ade03e67f2d5885cd9a1af0f052fe4665ee51e507c0077d0733fd2cca20f376044dbbfae767a752c09
SSDEEP 48:SSzLVvos33sF/KJwSua1BfImFsxSRp5PFTt4zYYTZWX8pws8ehp5WDAJo:f57sF/8JHfPldFOdW63W8Jo
TLSH
T12F91840283F91E76F4BB2F356CE34A13527BB8108D75CB5D62654A8F1CAAA10F941B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2359

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

swenum.pdb

Name

.text

Size

384B

Virtual Size

298B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

203B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

640B

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

768B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

128B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

swenumse.sys

IMPHASH 2b29cc5a8e62f78b659fb1c44e574507
SHA256 7f499111dc4b863113ddea34e89cfc4b7d5c0ab9e7444a26b30e8fff4fb112b8
MD5 96ef0a67d073871301fd3dcaac47073b
SHA1 5c8339a36a7faa1bfc2735c139d3c6b54d7a5698
SHA512 b440a10650e2c10d5d84f975cfba33ec9a54f0774e1db2af8d77a165bee37a3293823c3f23e0451f3af2d72606f55ba8278963e20f2116d231adc0712947fd2d
TLSH
T17F81751283F81976F1BB1B312CA35A23627BB8109871CA1D7628479F1C6AE40F986723
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2253

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

swenum.pdb

Name

.text

Size

384B

Virtual Size

298B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

640B

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

128B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vidx16.dll

SHA256 dda333e15d7bae20e0b24f4f2f42f566c6a148b3d1770b7c50c193ded2433c76
MD5 550ba20df6c08e628ca9abd0f6e917b8
SHA1 f08997db0ade4d7bc1e621e27f19a90b037eedbd
SHA512 c6bf8448e8f9d397a2f7553fb008b546c5f7027c2b51e969dd504fc2f6b24ceafd92d0afb4ad9baf48e22e3401d9e90fdc157466f005f60ed7b6b4a2559c4041
SSDEEP 96:92BdUXI5O5ywVJEZsos4Z+ZB4SYAG9bg6aAKspjyvvEIgWQD5Vyd8BYdXmMl/n95:04I8usnMHSBoq4WQibFdOvzuU2b
TLSH
T1BA22F7B75688F2AFC0AD6DB94CD5C6AB92ADDD4F9EC1271B07D012032E8F0F025178A5
MD5 SHA1 SHA512 SSDEEP TLSH

vjoyd.vxd

SHA256 91d32e3d1321381a0aa9c5b6468ce734a0e13dcbabde8ab3347c6aa8e8b7bfaa
MD5 cce0cbf20b83db0412af588084f2e834
SHA1 1416dbd268db8ff1155dee3deb7c26bb655075f6
SHA512 83589e1b0c5b6d96aaa3f032d1c88f8a965d0737b1e878e442d569d333e5a19c92153ffab2be744828bb677475ba01122103a1f2164813bf057596d10e9130dd
SSDEEP 768:6rwEd4BFWVraFM8yBw1Wt+Ycf0LK1kXBnTT5x:6k64T9FM8+/w3kRn7
TLSH
T1A5E22B50ECB5C0B2DED55371606F0F2CDDB59B9990B7884BD3392CA12AB0661CB6363E
MD5 SHA1 SHA512 SSDEEP TLSH

DirectX9/ManagedDX.CAB

SHA256 a05cde5ab21d65c6040b3183f8ac493548cf1456ce792fc44377fb97b305b86f
MD5 4f35b8a97ecb14ee8bda8e8b7aa626fd
SHA1 ec1d45664ad98215c8c1288f555341194b455e6b
SHA512 09b53ad15beedac9613283486ba8fa9376c01f0066b109a0278ae404c9c1980fd9dea60d428b18460c492684aebb432fc173d7ac70739ac84cda80d70f00fbe9
SSDEEP 24576:6UB18Psveu+t5t+BFR0hzE0BaTx7ar7fNodQXNj3f3T7GQEV1qpm6j+Q4://8EvvmtE0ETxK7f6+NTHG1gk6j+Q4
TLSH
T1083533B24DE3335FD6A1F7BE54F231727B9116318E53C26D30559CEC1CA24A8BA7AA40
MD5 SHA1 SHA512 SSDEEP TLSH

mdxredist.msi

SHA256 896805fa53c890615d12c6476af8baf4ee95088a6c3f63b61adf6fbd8cbb50be
MD5 ff9252312b1a32ee095060878d9e67e8
SHA1 c5c21bb7612c7a9838ebda81c896fe5e4b2993cf
SHA512 5799afc9a2b99e52b20abda13743f6f43454db9cb2658c4b09e4d1c9490be67d00754f48b1b862ba7a70f972310df9f72ee482beba6efbd77d18fd710491c028
SSDEEP 24576:haJqkP0NJeAgOT+tpt+BmR8hz60B4SshrqrOfeoLTXL2Z9HLzebxUSo:haJqkP06A9Es60eSshCOfZjLm1ubeV
TLSH
T18B3523D6FDD10B27C4C3F93C05A3277823BA1C52AB9A901B115AB790387DAF560BB9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned MSI

Checks for missing Authenticode signature.

DirectX9/dsetup32.dll

IMPHASH 826e66365e06d75f7914f0ec89b4d2f9
SHA256 8957cca723307720687283fa50df6b06883a90bac350be8d599544320b405c65
MD5 54a2e8e8b8672ab0921017b704d0eec7
SHA1 e50a789a57c3cbff71237d8f3fed98a8f053396d
SHA512 b996da13757ed86e1bd46e08b931a4484c9657d730cd4ba200da79f1b5afe25a13a827437d703abc278e9a3792482fbf69ae876c08c974ad322fa6d490c45237
SSDEEP 12288:3nXmBDofbzEWv/GGGGGGGGGGGGGGGGzUUUUUUUUUUUUUUUUt222222222222222w:GWDUUUUUUUUUUUUUUUU
TLSH
T163959F7D9AC201D4FB1AAFB217313ED7393C914BB826DE2071B5528841B779CC36AB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

87753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA lstrlenA GetLastError GetFileAttributesA FindClose FindFirstFileA lstrcpyA GetPrivateProfileSectionA CloseHandle CreateFileA SetFileAttributesA CreateDirectoryA lstrcatA GetSystemDefaultLCID GetCurrentProcess GetSystemDirectoryA GetShortPathNameA GetModuleFileNameA GetPrivateProfileSectionNamesA GetSystemInfo GetPrivateProfileStringA WideCharToMultiByte GetDiskFreeSpaceA GetModuleHandleA CopyFileA ReadFile GetFileSize SystemTimeToTzSpecificLocalTime FileTimeToSystemTime LocalFileTimeToFileTime SystemTimeToFileTime FindNextFileA WaitForSingleObject CreateProcessA LoadLibraryExA lstrcmpA GetTempFileNameA GetDriveTypeA GetCurrentDirectoryA ExpandEnvironmentStringsA GetTempPathA MultiByteToWideChar MoveFileExA CompareStringA SetFileTime GetFileTime Sleep CreateMutexA LoadResource FindResourceA IsBadWritePtr LockResource SizeofResource SetLastError QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId lstrcmpiA TerminateProcess TlsSetValue GetCommandLineA GetLocalTime HeapFree HeapReAlloc HeapAlloc ExitProcess TlsFree TlsGetValue TlsAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree WriteFile EnterCriticalSection LeaveCriticalSection VirtualAlloc VirtualProtect VirtualQuery LCMapStringA LCMapStringW GetACP GetOEMCP GetCPInfo InitializeCriticalSection SetStdHandle FlushFileBuffers SetFilePointer GetStringTypeA GetStringTypeW GetLocaleInfoA RtlUnwind SetEndOfFile GetProcessHeap LoadLibraryA GetVersionExA GetProcAddress FreeLibrary GetWindowsDirectoryA OutputDebugStringA GetSystemTimeAsFileTime lstrcpynA

gdi32

GetDeviceCaps

user32

SetDlgItemTextA ShowWindow GetDlgItem SendMessageA wsprintfA MessageBoxA CreateDialogParamA SetFocus DestroyWindow DialogBoxParamA SetWindowPos PeekMessageA GetDC GetWindowRect GetDesktopWindow SendDlgItemMessageA EndDialog TranslateMessage DispatchMessageA LoadStringA GetKeyboardType CharLowerA CharNextA ReleaseDC GetMessageA

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA

winmm

mmioOpenA mmioRead mmioClose mmioDescend

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

shell32

SHFileOperationA

ole32

StringFromGUID2

DirectX9/dxnt.cab

SHA256 7f5236c8ed91e5b7c08045e309e3679b01bec42921fcecccb99be83ca7010f77
MD5 1451b2aa63243bc6639694b6d472c41e
SHA1 8fbea73a9e94d0bd2bb01fa37294f859787f6bb2
SHA512 18e9eec9f42d5f03a0f394b275b9b0c000d40538ef8773bf226a3411fb18873c90ac5f4a95edc1a8d2e8eac80c6e46394a7bb32b65be3c742c669b59f129659d
SSDEEP 393216:+J4XLRqXIP0EGh1GWS4m+JWokaFrvKRwQ0Sp11xNTofAmij:+J4ug0Pha41pk4RQ0QnjT/j
TLSH
T13AD63382E984E7836CA51307D6F98C9335912DF8B60BDD17E9AE13C631D3392167CE4A
MD5 SHA1 SHA512 SSDEEP TLSH

ACTC094.ini

SHA256 8cea0baed4097534d19c36633bece9c8f0e9864174cb292021b31450074406d0
MD5 90e60c20df2541b20bb45811e024909d
SHA1 3e88a5e65dac8ef4b85f1ad3c8f2887184f75ff8
SHA512 8d922215411c8c0c4e6e4917203a691180adfcdfbb6996dcc05f53d51862bd3e97b89cdad1610dddc1526df03950c369266563cd35813f8be187bd2c40f22367
TLSH
T1F081ADAB857072BCF4BFB5BD324B00DD135124B789A2B067156731F8634385B3AB28E1
MD5 SHA1 SHA512 TLSH

ACT_RS.ini

SHA256 95de1d836d0b68a58dd459835c693da24503250304e8aa0bef58d27566843d35
MD5 61fe9c4bfc75fdbfdec4f60136ee6dce
SHA1 a9c6f2e21b4c129bea2a82415700f0f80fc05119
SHA512 5fb6416d823c8404c5b607b7dd4ca12c0b6b63693c8e90f877973109edd65bc71270babe97cd62343bccf179071bbdbafe40fb4e56e1355928dec96ce592d70b
TLSH
T14F5137CE6F75A2DCE9B231495807D6EC0EA11AB21FD63EB9504519E47CE01312B2B9C3
MD5 SHA1 SHA512 TLSH

ACT_RS.png

SHA256 3904a6ef7aea6c5535aa7ff6495ee965a6ccabf7d593eabfbe0449fa56e5ff07
MD5 7942a02676b8c1f40b2445a32ed30704
SHA1 3f57fa332966337276e662d3ef76a1f0df87d7b9
SHA512 e56555eeb01809c3ed71e0cc95e088b0adcd6a5da36ba61a94b6d7000e7d6023ef1d84fc4e8be92ca2af4bae9749b5db48e27617718af99fa0aad1e02e78d052
SSDEEP 1536:FoonWm5kMGiQzAiLaAFcPjw/AeTXz2GOMDLCeeWDaU1/8MROWk:MlLNFt/AoXzzlja5ek
TLSH
T18B9312CBD1EEFF22956D7B4780D1E112038B03793F494AA97118B68403AB5C8E73A56F
MD5 SHA1 SHA512 SSDEEP TLSH

GR3001.ini

SHA256 c5b79fb29e3489b3e1789403c2e0585c646287c9a61a756b8c9876e9d0f6d77b
MD5 47f6bce7d86f48f18ea82e97c10342a1
SHA1 88322d488cda74bd04a207a81d9ea9cc6ef5c87a
SHA512 d88582171208d686632e0d8f9845c9cd366cd3937b70f276de2be5f0f2114d919a9a0a0913fccc4dc07b844a365dadbf1d667d17a445734d86049da179cd0679
SSDEEP 96:JUXiR9HMeaO+WYwPgotSkEYrDPth/wX7r4sPX:aK0w9/1yLr4sPX
TLSH
T1CCA1884E9F3032AC940BB13A334788E83A6914B189FDB558000F15DA66A19B477FF9E2
MD5 SHA1 SHA512 SSDEEP TLSH

GR3001.png

SHA256 0799b81ff6267914c697734fdd9f25a2f8f12867d7465bc7d0defabd7891777b
MD5 1105dc7d16c1fc5712796441eb5c36ee
SHA1 afad00275a6a63c9943aa0bc182ff4de2b3a061d
SHA512 548de0bcc75eb4468f2800124bfd76d5659b256aa9d166091de619ecd6409b9403ac5f082da1e6556ffcd613a018a4fc7b80ad56c3437242aee439847f4cc17c
SSDEEP 768:HMQ1wu+eLtWJDuqMFcbdM2JIn+HaPpZDtlfkg65MluLnZatlwcXvpxtPWHBhHXSU:HMQS7ekJabFCInCaPp9Tn6HVorhWhB
TLSH
T1F803F1A43292E876A99DA03A9C86F4E07533BD003AADADF1EC4BA74FD51B03DE310515
MD5 SHA1 SHA512 SSDEEP TLSH

GR3001_G.ini

SHA256 e13de488155683970f388a754266c87999678437a8dc2d69e1db5fbd6e936e02
MD5 5ce0c65859ee3710ed9d9bb8f857a718
SHA1 ad8500f016725fb8d889892dfa5624b1d257aae6
SHA512 f6bf30bc0dc796f2882d0f10f97eacfe27f3746799a4797f5b9f5eda640cf858cfe70f52a8001fe9c4bf97207a047da9a36ee5311f9fa601660f210bde898f25
TLSH
T139819B4F2EA432ECD85BB16B374784E8266C10B188FDB4A8104F05DD9A5197477FFAC2
MD5 SHA1 SHA512 TLSH

GR4001.ini

SHA256 5961de03bf16540ffde3ef81be2834f16d7e8090482e91e5ae880576e07d0a4e
MD5 85aadb0caa6d7d0b7be6e8fb1368c3eb
SHA1 342355515af7b946083f3a1613c68896164d4e23
SHA512 8cd6879021c5c2b86b864efc9c5340d06b5d4104dd8a6c5acf58244dc1e4c993fa001e2c6e33cda9624d7b418cfb9b69a075b0b11fa9de1a5f7b46d06434e94b
SSDEEP 384:diSN6MbONlJ63d8Q4RZy6hD3xvGLRggrTNNERB/1Pz7+4x:d8
TLSH
T19172F06F1F6A76EC946AF577334DC4A0642C8291CCBDE4440A1F068D1A11A39A7FFEC6
MD5 SHA1 SHA512 SSDEEP TLSH

GR4001.png

SHA256 fb64f0cea878dda22d68633c4aa5b99e79247ab01abaf66117fe556972061406
MD5 25dbc13ffcc29a4cf1362ce8e9cf7e6b
SHA1 9f86377f3c11ca1d9e8626c21aaa654aebbed814
SHA512 4afff949318aef75103c449126f1ff0d1837164f02fd292fbda15424b441a465057fb6d7923d1fac421cb624f135621c654a580ed3ba37c3b010f456d2422b03
SSDEEP 768:V+AR34iHJnMZISaScg5zOKJFjXZH1GKKoC3xRzyoy4:MS31HJnKxaS/jZMKs3bzyw
TLSH
T1B1E2D0AA683EF13912E50EB8AD0A60DB18D4724753F63E135C2F4DA41A57B2DCC2F532
MD5 SHA1 SHA512 SSDEEP TLSH

GR4001_G.ini

SHA256 535a323d1001e57acf25021e96fbe132d56d284456a13c1d70cf478a98b99bfd
MD5 9c5a69fa046c74499ec0746bb392c3eb
SHA1 7663b1891f84c4e659e220e366988a55a2a4d4f3
SHA512 a8f59c84a90502f2159351b2af0942b88688d226a1255a9ce9154126a089e8ae56cc20b31caa2609fc495ab9077b07eb26202398b975e28379b765b0d44e70ab
SSDEEP 384:3Txu61k/lzwiPOYGjtG0D9DHfG/fCsXzndcFTTfPRdMM:3j
TLSH
T1DA52901F5F9AB2DA94A6F57B2709C5E0702C0162C1BDD8440D1F0B4E6A01A39E7FFAD6
MD5 SHA1 SHA512 SSDEEP TLSH

GR4001_G.png

SHA256 32ab1d768c3d328483911898e9aa5923ec86c93802883ad5d06a325d0e928d81
MD5 21116c9897067ae2059ad65a0b9ec7e5
SHA1 f9bee25b1c4eaeb984a8d241e1fc4d0d80eec934
SHA512 b98ce203949b2993c1d127d0a56ce0570582a7735ca92e050074d896184e0998a4ef061f1acbf9588d9dab6acf72d160f9ac44e9c89728b36f288a983dcbf6f6
SSDEEP 384:C7GZK4bboCHQBRrzLyQa0IreXCUM7Go+Iz+ZuYM2S8+/tBQkbt0fNLThH8jwEvCV:tZ/xmRn4UCUMtYp8zQG61H8jXCqnO
TLSH
T163C2F145A8F5AE3A148A81C631AD159DBA0CD2995F73D64C0D2B3062FD0AB17FDD28C3
MD5 SHA1 SHA512 SSDEEP TLSH

GR4003.ini

SHA256 fdf6288f43676c6c0567ebc33a525fdebf9d3a28eab4f25d5d1e03aac446ac34
MD5 e5379f226be44d716a1450f6f2494f35
SHA1 aa45f6875c80a2cc9cfb02b1e39bdd2a2a170034
SHA512 c193c35ef94197bd9770341840517336c74a192abbbf57a2a1ef301d66c3089a4befbe6c821f97e41f34113bdb179f3aeda4d18de2dd109bae99ab5698d4fade
TLSH
T182719F1D6BB037BC584B367A330784D8369418764DEAB968606B12E97762DB033F94D1
MD5 SHA1 SHA512 TLSH

GR4003.png

SHA256 efdb3810c8c1e9f2e474e1674530a9b8c8268e4f2ebe0322ab859c7590bb4673
MD5 11d4613e57c34fca41622e90c686c63d
SHA1 b6b3ca15f373cfa15100e174723a0c4a2207450a
SHA512 c9f7d874e3e62580d08e31cd2f38026e53369c3dd5ef707dd0ab7e2fcf89faedf098c1efb7e25f39f1e744a395c1319a72557aae37bac79cef2f5506fa6b58f8
SSDEEP 768:6dk/AD2oy+LOOBWAbgXMyL7kLttBqRCrMiqzsy0Hqwa/E6q:6iImtfAbgXrS+RCrMjNDR/Zq
TLSH
T12AD2E010AA5454F7C74A8E7C154FEB87EFC368B57F136E0E101A70069D6E22B3B23295
MD5 SHA1 SHA512 SSDEEP TLSH

GR4005.ini

SHA256 492614b01711e564a63d6d4084e1d8d9447d93eaf0c07f7cd053a7d1614a181b
MD5 cb059e53e8de48164f88d185dd4df925
SHA1 21766635ea8e3a1a97497aa38b4f03bb9190016c
SHA512 f9959d9d764cb20584c21d04458fcdb6c6aa1733f20f47da76dab05a2610c8e407943894c90cc0b08068738395d836447f4200435684e1859fd4e2694772ec4b
TLSH
T1D1415B5E62B536BC498B763A324780E827E455720DFA7464602712E97772DB033F61D1
MD5 SHA1 SHA512 TLSH

GR4005.png

SHA256 1e26e506d71d2c80ef1cda68881c981aca6d564723008da98ed5548f6c353a82
MD5 2784af4c286102874784b9ba0b999fe6
SHA1 631b57e90db5442a50ef0adb80c871ea22b6a9b9
SHA512 4dc2d3564acf0d484ee5b1cc60d27faea3adfe2994a0c8c9e0777bc432dadfd95f883106e9565d22252ad220e3af01d822d49fe524fc268d43039a2f65acdffe
SSDEEP 768:6NY5L06wpe16Xhb0l/zEoJkLjwSt7vImYYaTmWCjaAFuun/c5:fL06z6XKbEEkH+TDCjxpnU5
TLSH
T1E1E2E16EC28E1A86F6715A779CC36B8B5CC40089FED597EB3CB710403A3904998D2EF4
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDA.ini

SHA256 247c0041753ba2428dd8c9eaaa65b4807cde6a31a18685be4d05c27a712c3f4d
MD5 7e6f847ac4672ec7a6d3dd511a33d879
SHA1 1ed90dd3fcfe0f74170686756fd054326fb19b01
SHA512 3acde080697ad3359956669745637a652ff50fef4e9b550925f15057ea8f82054be739137f141fd904d94cf2d0517bfc1523dfbbd681707aaeb0883c49c897ff
SSDEEP 192:UbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:mo9CW3tf0TmABuOY8YqBPBPy55tf5N
TLSH
T18752DF9F2FA57088C879B4273B4AC4B8196C11B192BDFAA4111F09C94CC4679A6FFDC7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDA.png

SHA256 7bf774463f63147a90ba64c96da491eb835451b1cac4f31f20a24916c3a25312
MD5 3a35f6f58aa8a264ed26df136334df35
SHA1 f4fb5ba6425c9cbffd0b0886411849b5b352e416
SHA512 460fc73fd6562ec5ea10cc4d5dc200740f1ffcf63e8ec3dbf75037e8714a1f1423891710914b7be8e31afb76a3b5b321de977257279aec7936f4d562f382972e
SSDEEP 1536:FwmUklB5OinPEHIjFycH+Zu5chrbWDBUv4+1HwiluaG:rTzmIjzWfeALqJ
TLSH
T173730254057C19A8CDE26778223913974D2C6E8CF3C901EBCBE57EE512929529E43BCA
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDA_G.ini

SHA256 b6b6b1f262e25e6ac63ba79d454d44e6436dff796e7c4d88032dc3af04520b03
MD5 dd260f56cced7b21efe61d60bb7e11b7
SHA1 7e814ac17d6a47b3335c3b98d2d9b0f1fcb43026
SHA512 b83041c34c20f6a4c148a7caedac1a77ae2b9c543d82f36526088185e2f0d52f601bf89cd2f8913ce379668a5e786ed2be02147f209a22bd903d2d856849d0b3
SSDEEP 192:ylbFe910LiM23tf0TmABuOY8YqBPBPy55tf5N:ylo9CW3tf0TmABuOY8YqBPBPy55tf5N
TLSH
T1D752DF9B2FA57088C879B4273B4AC4B8196C11B192BDFAA4110F19C94CC4679A6FFDC7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDGP_G.ini

SHA256 b3984941869d1d3ecc73d0637de252da9da7ff02ed75f8fddbcb1c262d846dae
MD5 485627acbf6e063a4ae991b7e0268007
SHA1 2b88cfd2d830a4ff15e1f43a7c9ab04400ba063e
SHA512 4624841e68f4741052b169d4344d6fdfdcf206bd11139146fc37a793b98e6abab197e7cd848581dfe57f6c3360f5784903d2f1c48a875b38ce3b2170ed6b990d
SSDEEP 96:29d6UV/cqfS0jZzPk2rItsdn95PJGXIeJ9Kfw540hzDdKqBqH/Ke6SVSEmSu7o89:OQmo35jecytLeIhUx5Z3BkaZqKFEiN
TLSH
T1ED32E2AE1F25B4D9C876B136271BC2EA1928053182BCED45100F0BDE9E88535A7EF9D7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDigGP.ini

SHA256 ba2b1d325b81a8448720da625cdab6b44940dfc6a943036e7a7a30f6ecb44521
MD5 8229ecd9da72ef23734ad9be63541001
SHA1 ab557ab407a9a0ebc0806dd03dee45d08dbac6ec
SHA512 eca55a3065ffe49d6a53c410f82206878dfcbdc3c88c90239d97ff28e3c6535269a9fb294f37e97a91a91e4c3efb84cb6c612a793d2f3bb9cb05f3a3266024a5
SSDEEP 96:f9d6UV/cqfS0jZzPk2rItsdn95PJRIrlA9Jkp590CuWSK9GqHC8hSV1bm1/7o8j/:3QmoqLEcWk2UKTGJWcJwXYz427MAG
TLSH
T15332BF9F1FA57088C87AB4773A4BC0B9196C117192FDB9A4141F0ACC8C80639A6FBDC7
MD5 SHA1 SHA512 SSDEEP TLSH

GlmDigGP.png

SHA256 902cd892ab95892de9068ccf071cf68ecd79ac6d68cde2949967317b21be23d2
MD5 7630e7bd10d814f4f98df439adb2d8f1
SHA1 7eb1cf5d729dd4d1db301e17007553921955ec2d
SHA512 8de39d2dd11e9e4876c05696a0a36db82284b8fca1436a604d81ce83a67cb0caafb2706a95e8c56aeaffe653f36c8a4dcd52f6e09b7218ed0f056f55ca2a8887
SSDEEP 1536:ooG+cu4RChbnuwD6HmtuOagUdhZW0f/xrMq/WbztGl6R6L76i1w3zeAk:eCx+GtuOuhZW0hrMMQy6R6L75TT
TLSH
T17D7302B9E1EAB5F0F69A50323F3B61A7F12B7241F18007D7C9194068D0ABBF05694BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Hammer.ini

SHA256 a723b21a3b6e738e6b7dc2911ed01a002c0ba6365fcd130c6490aad426de3323
MD5 4936fa2204b885cff8b6db2dcf27d4c7
SHA1 b8a3005a38d02239a58fe9735a6c66571e9cd3b5
SHA512 75ff5497f40706df8f671cdb7eef3232bc0d9436535d6e92febc54568a4e7666197e0c34ea009bf2192eb1a61625f1af7f2d918b267b73acb48b3e0cf476eedc
SSDEEP 384:7iVqi3uakko3nc8m9+EZlwTY2wPqYFyARCRAIRHMJBQA78Xygp:2XTG
TLSH
T11482777F0E20B7B8F57E353D234A05EB262900E34264B1C3482E36F4E94B5575E6B6B6
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002.ini

SHA256 10500180ef412fc24d2eb6a9542e1830d9b3f87ac74b7c690afbdbe451d64f09
MD5 a094d1e54a0fa3888f93fe2c061cfa38
SHA1 a1bde9e1058960d355f73598b0e1598dda6e9e90
SHA512 46a0ea5b18075ae9830dd163dae90a4b6d2b3d7009834c5093d3dd96b76ee338c1d12ea6a12a8c13e511e7a6882e66d793928588590955b0ea754a279ae8f432
SSDEEP 192:62imXAQ5YnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKS:625w2YnRK/CkQcwpcQDiq20s3m7N7SU9
TLSH
T16332457F6E86BABD11A53678370A84F7BA3451E60075F0801B0E07C29E1B745AE7F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002_1.png

SHA256 a58404be8d6c04e7b046a9fd54c5d23825fc94bd3b0e7f740fdf3020329ab76b
MD5 b54d3bf03c0ef33ed4316106a936bcc0
SHA1 9d47dd81c303aa545bbd7bd4124ccd726b3c9557
SHA512 8815bf0e4e81f4503ff386ac4460d04c5b56f453b654f57332c4a1b4ebcbe1f1a7c91b7eb932fc5da75755aabd02fd34a3f106d193568df93fae913675ca3448
SSDEEP 1536:mqs+k3/AAsaetVomywW0GWWlkOJlA5o9n5c9NNQfNir:mqsjAASXomywWQeB7QNNkW
TLSH
T1A143F1809553A7CC1A1215DC3BF26EFEC87EADE5222B9C644E35558CB1D073AC61AD83
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002_2.png

SHA256 a8d7a0fecd335a48c9c75f95d79c8a7505ad4cb001b7a7139666dba4a812c67e
MD5 f11e210716300d4b24ff52126951fb5d
SHA1 bc29870f3b9fd83f77336a3d89b4d126fc44913f
SHA512 e44043447e83118c1a3291d665315324f12c4ff1d10a16d658ca269209cdb0861109d4c556435247a1a27559244a2c6e3c66f79e8a5428aff3ae257b05536e0a
SSDEEP 768:7ze+YkGM1l83NOJqb+6MXQQqqdyr8OF1NynVZITOi2QAsUzNG1Dl96J9KH85lii:6oQQJqL7zqdyFHNynXW8NnzKHUlii
TLSH
T1F533D04BD8AB425BFE9627F837A16EF4B67FBA31437904884710149DA1C0BE4A107F87
MD5 SHA1 SHA512 SSDEEP TLSH

IA3002_G.ini

SHA256 d78a310fae1037240c38acf4d940a573844341f24143a0c8e1454eb36c1e5c35
MD5 c68e524c8a32c6ac0c4ebf07223c94f9
SHA1 61942728ff7f13ba2e9efe0d4ca8f2670491b33d
SHA512 bf55f39f083a17e10f3748d5b31e4308b1ffba2aa4477f253b5e4f68892f22b71134160f2096e262e8870480c8343340290b7655e9080f0bc5aadde32892076c
SSDEEP 192:Jg5okEUnnRK/CkQcwpcFuhliquR0s3mw0e07SUCl+PjKY:JgGkEUnnRK/CkQcwpcQDiq20s3m7N7S8
TLSH
T19F32367F6E86FABD11A536743B0684F7B93451EB0071A0811B0E07C29E2B745AE3F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

LGC202.ini

SHA256 425f87aa6a1f6b7b56509b87a9fa376552f71e0f125e44e7d67ce9ebcace1b51
MD5 b13bde4d5adf2bdb72cf04de4550185c
SHA1 c779952b9be141a0f984dcd645ab7127954423b3
SHA512 85e8da1fc79777a5aa57566e5457f0493acb881818f95473e5149a727f550ea8fa3a811be91d7390522ef6fbd566dc363e0e06697a539cc068a9d7a7ebf56d52
SSDEEP 48:llOatTQidSDej4WdzOGkdo7NiMlGbm+X7p67K8rF8rC8r/8rgZ84b8pXmNIYplz4:lthQidMszaePBEriW+XgVHP6t
TLSH
T19DC1A3C92F3EA24CC9B835542D2BD3EF5F600A3143CD7EA821050CD5DED6579219B9AB
MD5 SHA1 SHA512 SSDEEP TLSH

LGC202.png

SHA256 a99f9822c37a3b7dcc56a7cc4f90ee251363f5b162f37eec7c3ed3495c66ebe6
MD5 176ea571764cb4240d47bc35b36531ea
SHA1 d31cdbe2586abbabe92fefff519fe3cef135c8ce
SHA512 47acca501b8ee8a89df91492d39ddd1c8bee8c5fc82e329cef4fe074b98e09397afe16fca7029637f5b4b1d1e18c8555161bdbd0e1893e229d2ee4de4d522b8a
SSDEEP 384:3ujJhFFaJK6MfguJKZqq614nE+tfFo95v6oxcB+LMEEqUNVWvpMSR/35hwpOYYLS:aUKt14nDtwv6oxcBeqVWvSuA+WvA4x
TLSH
T185E2AEA2E06F85A93A5606FE37A20FF585BF7C24A3F92DE41B10388E6584B557047E43
MD5 SHA1 SHA512 SSDEEP TLSH

LGC207.ini

SHA256 31b0e2d176383519c2cd153f48b4730dbfdac007b68a04c2c8e94aa645ff9a6b
MD5 2cf5c969394e8419d9b32f2ebafa334e
SHA1 3eaa2a97532ddb3d44045d0e64daabab2a67e387
SHA512 7d3086adff8fab1d7448a84c3b9377e2f8e5a6b30ec6ee3c15401431ab5e83622f6c0e8b3282decae6e674d87aa2c7c5a4c2e31d76c913e08b2314708d6cecf6
SSDEEP 384:ub4EnwfDP/G3xLsDQ09ZdQR2pV0SO/1AWvzDuJ49xAr8LE2g:j
TLSH
T1EE52049F0F3974C894A9F2BB2B0A8095746D1462D4BEE580051F06DC9494539AFFFFCA
MD5 SHA1 SHA512 SSDEEP TLSH

LGC207.png

SHA256 7cb705bbe4982c6325fceba0512aa7cba2350b2fb5aa2baa10ab4b081072a441
MD5 caca23d40e779fd9c69cda7eb15c1aa2
SHA1 60d86efd64ef9026e3b6ac7515d4fed330f26779
SHA512 627e0951e8ec9216042c7061d83833cc6efe147be2af263db135a52f8f6568049e39865520cc1743343562e41eef90170f123809fce54a9e8cf77952fc5679e4
SSDEEP 384:3cJgM6fFybFncjYKcdxT6m0BscKF+kcb0Kq20y72a1+j1k7aAIeaKNxUFH34k1oS:sK9aFcjVcP63iIBVyLnhXubRP68i+Fqz
TLSH
T109F2D0E7C16F4A22BB5646E2ABE71DE9A17F7C34A3DF14C14A9354ABF040AF13180853
MD5 SHA1 SHA512 SSDEEP TLSH

LGC209.ini

SHA256 eb03234b6b2565db9d2153b4e1540e46596385c3dd9b57113fdecb6bdb569f9f
MD5 fb613fb07444c72427e8a2503a76ebd1
SHA1 d1d4aedce4acc215266db06fd718df6437228fe5
SHA512 d9151a4b77617d4c37c64618c2453542101317ef69e8a8663cb5bc05325a4dbf17106c6360b14cc388d3974c2865434e9116b8745db28787129939a921c3c278
TLSH
T13A81995F4B34369C859BB67B3B46C0EA1BA900B688FEB404101F15DD8A11D38ABFEDC5
MD5 SHA1 SHA512 TLSH

LGC209.png

SHA256 7958624dd4aceed4988caa07a504e965cb90670f9af7863341c7b17a2ec2dace
MD5 dbcf48114205d5e11a34cacf4b82cd2f
SHA1 712f53fa73b7031b480098c4cf0f05844cf8dc8d
SHA512 5f55667df2a52811d27c7c0707928459297cc2793b458afa32749ff84bdf7a555e4ce51ccf25b13207059a41a17ec25236d227676ab1a6d92bc9570a84d685b4
SSDEEP 768:xiPSxHP2dYOa74lm7WK7t7EcrDtPijuBCk0A27n:MAveLm7R7EAFCtA2j
TLSH
T1A103E094C46F82B51E2956F837001EF1D75F6E38A3BA0ED48B4474FAE1C1BDA7611A83
MD5 SHA1 SHA512 SSDEEP TLSH

LGC20A.ini

SHA256 079e82ea2421a686a1cfe35b556132b09deac5c33ee0e9ca7d4a20b680cbc96f
MD5 b4c63a57204d65ecc16587913c9b9282
SHA1 6139e8740c59390db606b5539c120956ddd50c79
SHA512 819821c5e8037cc5c41d415fbbbd2baf802480b04efc2e61199e71cbafe90066c63ec628d4a0f351b12bcaa24b0b760ea2de9e55da10f62c25b5dae985a2cefc
SSDEEP 96:M7oM6W5KZz5HydUojBtYCw4TuO8Px7gtcXAWHwrw82eels2xzb5KKdU0ot2EhtYp:M7mWtPtmAWp8tBXTRvRc
TLSH
T14CD1EB5F893033BCF1AB727E720B42DE235518BB88A970A2216734F95717C6936F50E9
MD5 SHA1 SHA512 SSDEEP TLSH

LGC20A.png

SHA256 316ce20315e1f97aa9c0648870f42225d9ffff5657688eabb755f7e6c388af7d
MD5 88e1024eb1d23a2324f1ed6b003c84cf
SHA1 212cadc2c71cef2889d4e8d33ed51e36962b688d
SHA512 73d85293b2af38bcc12b74f9f32a47ff631788de815db49329c58296e2618f344af43c01afd9aef29d7d276655d25a0029a2a396ce4cebd71a4b12a120aeb2a8
SSDEEP 768:E3tK1NjUpA4qM8NYgxiLyXKV8OR06jCkVJqkBP9S0:E9K1NjP4hyYgILyu1R06BVkGD
TLSH
T13203CF51C057EBA4992209FBBBF51FF5D27F786402BA5CD4135439EEA0403B5A026FA3
MD5 SHA1 SHA512 SSDEEP TLSH

LGC291.ini

SHA256 de95342dc49749cdcdde4b76984eba91668f67b3247cac2d05a1cb7ed692e74d
MD5 21e468f47c022da870dcd1b34464f652
SHA1 5f48c1833c904abe4dd566e9407f9e6f3c1eeb97
SHA512 85480acfaf25ede5145bf662d756df4cd6c79fb5b959b7ba1d6e9db442a888e5fbf2d70ece33fc0e0634efa57d89bb1b032e66a0815bd82a3dc668fcb2868bdc
TLSH
T1B841C94B4D3037BCE17F757E351705EE170610AB99A4B082196232F4924BC5A3EA61FA
MD5 SHA1 SHA512 TLSH

LGC291.png

SHA256 65b7a8fbb6f760af81fe65c694ab8bbf9a2604522856f4c098185ca396cec82c
MD5 a148633f9cf01a0c225ebae0964573ac
SHA1 216d1c2a0a14994489352c048f6297e6120e6417
SHA512 621d358c0b90f763a89e654037d30b3dd0855a0b1b04f830e9f2335e7bffbdadaa85c34ae17c71ef1e5a3f69febc011e1771a932a037b099f0f232b0b6d934d0
SSDEEP 384:34YLheOBKglgqyDl5re83QfcXz6nsYq2tJ66/hywG2f03M7F/qPhZrRuhS1/Y/C2:BNBKgCNiwCqYsYZHJVf2M7EJ7uhSq/d9
TLSH
T1E8D28C55D29F80DABBA505FE3BD15FF8926BBC2117BA2CD4A750249E6081BE4A143E03
MD5 SHA1 SHA512 SSDEEP TLSH

MS1B.ini

SHA256 8d9272635ed38767d18a7f7935f5a5d1db654a526a32903941523d305570e760
MD5 dd8d4a00c271c12f229b5aac8a79a2f6
SHA1 003ba733b109912fc3bd4f16cd1fb53902dda1d7
SHA512 2dfc8aa83295ce2f441a1283ab4e07ba7628537d03f74b961d524b62e564a05a59ed2b0c2b23f5d26f6fe58fdbffa797489855b6722ca453b121b9073331ca4d
SSDEEP 384:nosc8MidbNYG6HX6iSbuZc6BKsaMaHqqi1KgCeurNS2jSeL:oO
TLSH
T10B52E21F1E7670C990A6EABF7B49C4A2306D45A6E07EE5D0091F278C5520638A7FFEC1
MD5 SHA1 SHA512 SSDEEP TLSH

MS1B.png

SHA256 9cf4196499e5d248ab78baec2cf5cbd9aff7db2f84c0deac2074ee7a6dc0a7d6
MD5 5daf37520490b5ba9545b222ddbe5d9a
SHA1 c8e3c43a46eba15fb081b3a4bd254eba4c3b325a
SHA512 9acf69ef6cad1dde9f62fb5aba96db8f5f10a5862add433a05b5d4ff0ec16a038000cf3e57af25ddc7cd325a875ea7abebc8d087401dba7f22dce320ca65d68d
SSDEEP 1536:EZjmWv2bqpC9bGOdQEdCfUVqcSq6+lqnOytfqIwmU:EZbp6E+qHAlqOykmU
TLSH
T1523302BE4C090BEB6061BFEE727E546531CA42EDCD686DC0085EE04A59AE53BCC493D2
MD5 SHA1 SHA512 SSDEEP TLSH

MS1B_01.png

SHA256 a6186acb6712d5d5775d0627048c7eda59000eaf7795f2279bd5761f3ffae56a
MD5 cd7fe02631a1218c481c59c76f7fd8db
SHA1 2906acb04c557bfdefba3ae9ed2bc55daac972de
SHA512 795d7e2debebad2e2a6d596e193232ee7a494dd3d467c852c02b4e18e4bee843287d21ea7fd9c1c947886286df15277dd848025ef6a0aafcff4669e56bdb0d2c
TLSH
T1A0414C52A441CAB956DFB77923E10F05AC24E5B17C312024E8450C13F5E528715FF3CE
MD5 SHA1 SHA512 TLSH

MS1B_02.png

SHA256 d2f37ea24d23bbaff0b0ef66be9b29af37cf5c05d402b8c594185e3af4715ef6
MD5 303d50981c0e70766042bfbe9058c4c5
SHA1 ad5d55b6eb4d6d0e58cc1d8cd1784d6a66601f2f
SHA512 5b2808e82ce2eef66bf24490017860ff642df77f04247ae152dce97d6c511c0f114c8f7aa4da414743ea90b61ae47b62f34692801f5d2ad0873877ba91f296db
TLSH
T19B01E9F91620AD65C1076D80923BB332FC3EC54C8847030028950023DB12E8D8E90F37
MD5 SHA1 SHA512 TLSH

MS1B_03.png

SHA256 b93c8829a96c1f69a7751b2d089780cbf11d79ab27e5d2507c36ee2ad740ef08
MD5 d3e103a4ffab645547915858b0fe6c9d
SHA1 fd7374c5f90a0339b4a9eb185558ee1932cbb8e7
SHA512 a905e23ce116e886b8d1b8a1a42821f4d88d35971465a2053defc085b639824de6df273618a163565b8086b714bb4c1be91c1989e195fac2d82fbfcb89debdc3
TLSH
T168F096E767FDE51AF9B37F02054616B618581B81CE4D05412106C03DFE0B7C939E0198
MD5 SHA1 SHA512 TLSH

MS1B_04.png

SHA256 1f99db0a7f66f913774e61a334281b60333e0a231267abf3c61f54ce9834a8f7
MD5 020d6f6e6f9bbb45caa1fba1ef5f6179
SHA1 ca689caee8a2ea7b622ff39639e19118d42d9206
SHA512 9cc0bb6196391a8efec322f4c704bfc7a11c5b9b2df5416150b145e7878c66c428ebd4ee26cfa534d84dab7a16cb3c159e32e82d29b25ae058d149508f4001fd
TLSH
T18F01C5A39BD1CDC885AB0952682A292ECD245323C63A0EA4F2C20D5EB614109E9540B8
MD5 SHA1 SHA512 TLSH

MS1B_05.png

SHA256 43c182a3765a09368e09e6da8aaba45ff47798843605a32672eb1b7748eef5ec
MD5 f0359cf4f01f9b61f9b6eed337b48f6b
SHA1 6779e984e3627ac77a4ac1b24248826f88b76f20
SHA512 acf50f5d73c657473604230651388686057398d0ff47ab358f02cc08ada28e2ffa1cff1fc1912bf982005b70510716aa3602e3e04cd3dbfd6771f7df5414bcbd
TLSH
T17DE060A436BF0C27E7DB068210910BB8C0325D3465D61B042CF19CAE4CD74C4B516282
MD5 SHA1 SHA512 TLSH

MS1B_06.png

SHA256 b18af49a8c6949786ef39e40257f2d8c7b07339115155e591fbbda0321b4522b
MD5 90454d1e72dc7112c0665cf28d5c0f8e
SHA1 cc9b2cb91d7b2f9c627cfc47393b50adc3a9c5cb
SHA512 ff5ca00c767a11cf00912b1694632412011e4aa354f3e2fd6a202a175cda9c32bfc0b0150f73ca5d2529ce48dfab91440b9c93f2d1406d1dc3f64bd6191e1644
TLSH
T193E0F1D9251085B4C712B116115320AAAA33466E69677E9D236008568D7E6C89D8C1BF
MD5 SHA1 SHA512 TLSH

MS1B_07.png

SHA256 83d3a62a93cb1eb87c4a17b38c72cd01a809d9712394a443d17e5a99a78dbabe
MD5 f560a2d3775cc8e8975eaa4c64ada238
SHA1 cb0166c2fb38e413fd43f15a0a9cf064ae672a13
SHA512 8877fcb2ada1193862efae3d9399df9b91ceb32f02e80fccd24545d65c5e20a7d80a902ae220ae10cf57a4d8b5d24901e63b37566dc53e08726d9e225dbdcfac
TLSH
T168F041D31BF9756DC166485722C60CABB0131E3364924B6EBE08862CFB402DF81F03C2
MD5 SHA1 SHA512 TLSH

MS1B_08.png

SHA256 4837bb63409c66764a8bc0948018f5d0444edcfeec15ffd02dff4f6acf63c3b9
MD5 2b8b9e116228d8b35c126c0957fcb9b7
SHA1 13b68fe346a4cb3054cbaa233c3a4b69f9f8ee7f
SHA512 0d08fae681e17dcca46c0e3b4f0bbd121eb826b01f969841c8e80a19346f4b95ffb39e019180f693583afcb6f162827b092605bc045a7a1fdf3a6f97a1e390bc
TLSH
T144F041EBD7C023C927892221D28648B08C7C8F45C94E321C1CA2EE354C93AD4C39242A
MD5 SHA1 SHA512 TLSH

MS1B_09.png

SHA256 3ed70ae9480385da00e1ad6deec38951be66fde063431170f6294cba52dc1d98
MD5 ca9ca0b2774db7c44427a11ac2aaac01
SHA1 e4173e6f546fdc4e44b7fcc71a793bc21ac66607
SHA512 f4a2174c9d78570cd9bd43e5bc39748002732b515ff2320251ca4b031ceaf0fc794d347a36495268f9605a50ce85184380e6ec0512b5f51306037f7caa192395
TLSH
T1D7F02DFB63463B39D9A838AB7A28039B5A940445FF660A3CB33350498DC30A280067CD
MD5 SHA1 SHA512 TLSH

MS1B_10.png

SHA256 1868bfd5b49322eac0386b78f964ad3d649bdef6b479da46f0a91be5e840664a
MD5 379826d9e4f7dc62b185e48c3e56c398
SHA1 0b533c5a195860a5d89e75b3eabb9db9b61642c5
SHA512 1b11fce8b23a9a1137eb7bdbd9d8e9dbdebbccb3e4e2be7e755c9c5b53abbb3e57c882d4c3a912dbcb4dd689e746d6bcb6d1838b9332dc96aa0742ddc52536c5
TLSH
T1E5F0628342E1B89EE1BC3873000A1F7B9E7089EE8A646316E322C4A594C9E81D8C4A1D
MD5 SHA1 SHA512 TLSH

MS26.ini

SHA256 7a9feab7e0d241ca420934e6153b5db4d2db8b72b113fa5d010a6a417f06cf51
MD5 a0b84b5ddb4e4dc1973bb666a8aca7a7
SHA1 163df8af80d7c97a5659b83918b755566550be6d
SHA512 004bc5a6a2287dab279531ae7d62de08c0579ffc0b10d86b75a90389fa2da819b283bb538a26fd1b539e4fb2cdc7179f9c38f3ef011bac224242b3edf02a1af8
SSDEEP 96:/vhLw4RMr8MrzjLv+DlgzbzxNXhpCI4kJ8P0gew4fam:R45HRam
TLSH
T1150237C91F3AA14CD87234103D1BD2EE0F50257127DE3F9820201DE65CE46BA26ABDDB
MD5 SHA1 SHA512 SSDEEP TLSH

MS26.png

SHA256 752340a75972dbf504e3a9b7062dbb7670ac16ff32a837f7f1e82c630e39ec58
MD5 67ab9342fc9eb9da30606a61fcd32508
SHA1 f226347193ca2d72b3efcf870a3e67041fd25cc8
SHA512 bc40c14068af8294c6c8113f59e618636e9982c67ca7f348e27c813c800e0701e5e0862e6c58d5a89dea138c046625f0773b23e1927942b9add6caad22a9fb68
SSDEEP 1536:Iwfk/BApw7wp4U9H/ux3DO7ZESUIJelI0BT:IRmAwpHRmBDO9ESD+I0R
TLSH
T11853F186F30B8C59A598504E8AC09E6C352769FA442F2D2667C2BCD47FA5338FC156FC
MD5 SHA1 SHA512 SSDEEP TLSH

MS26_01.png

SHA256 ffceca61a0538931b531a1edbbcbe811a31c20a16f55fa84d7ded97c2fa4d81a
MD5 c5037809fb65e778fbf01db617b5897f
SHA1 31d9045253b945ce0abae30e6be5ec373774adbd
SHA512 3052f0f6f45b3ccd017bdde918d21dc5ec12ba347e4591cb7c3a19821f0d5a623c4a553bd3a12375ea0646a38029e47513041510c9adbd8406c89c5e7494f4fa
TLSH
T102517DFE1706056DD5D0EC5B5D60E08646787C3A841449351FB4BA136EBDD4FF29E481
MD5 SHA1 SHA512 TLSH

MS26_02.png

SHA256 73befde90d57a6b36b461932d83b76fd84946f823b031d4e65ac53620709737d
MD5 74d918030cb20094bddd02e674e99504
SHA1 7adc2be2e57c9138accac18f7967323629c94d8a
SHA512 4d4ba11a912efc5d4e1805a64dad751dd27248ab71706f4e75724e572aeb3b577091503fd8fcc807a195995ffc972a6971ae7e805aac697bbd00e54ea123d968
TLSH
T18831FC55AE8568B0833E0757173A1310FF675F2084609127262A35B2143DD58E2EF7ED
MD5 SHA1 SHA512 TLSH

MS26_03.png

SHA256 e1aafc9355bda37cfa4edaa3c1f03579103e4aa1869f07a1233613cc19c6a4dd
MD5 495d8ba62ea9c15ee2fc4a188102375f
SHA1 ce04324de77a02747e088a63d60d59ea2bceddb6
SHA512 135c21f701cb83a3d40047152dc470fc097c97e73d2527144a3da0b76507f95fb3af496372f5bd21342da02400d4eb41527a699bc48dd07672632b03fcbbc680
TLSH
T1B821DA56B4DCAA0EDDD7943E7B091D14F438DC0C13D186851206BC9EF27CD4625E465D
MD5 SHA1 SHA512 TLSH

MS26_04.png

SHA256 39cd128ea4f0587985349369ac7eed7aa87b857701f7c1c9c7dc8b360b245900
MD5 5edcbf8467793faa3ef7614b5c405447
SHA1 92fbdd9e40aea92b59589085f6af0c955c04f812
SHA512 83ecc14ca168a07df958d2fc4cf709379d292fd7e48e37b865fbd88a51f16fc74c07e783e7407307985475203f8dfac0175a31e2c510eddf4bbce2b4ec435bcf
TLSH
T13421B9B701883A559117A5D2B8B45A55DDB04D65A9F090B9F3DC7B91603FD30031B44F
MD5 SHA1 SHA512 TLSH

MS26_05.png

SHA256 5d0c5a14a4621b6120e632166eb55b8d73a81c3dec9afcc8a43a339a8b512e6f
MD5 1102215157388c178f034d4f1566eba9
SHA1 651c53f3a9ea9f07b37fff22ee54ecc367d5b9db
SHA512 2a7b97446cf6c70c69895474733487dfafc450b78091e37c729258779a5c6c31dd07f69887fe72d38508fd24e1de361c2d4ddc5e1a6086a0434e8ae6cbe2d899
TLSH
T11C21C6E47100FA6ECCA21D9075B2CB0C1431AD781CCA842A6F4938746CBAC39D09A5D6
MD5 SHA1 SHA512 TLSH

MS26_06.png

SHA256 d9eddbc7181a65f5d10f8e90f8b1734e2092964fb86b8dc4fb54e6007b9d6013
MD5 a7547e8b2f1b102c181beb8d0e2cf6af
SHA1 dbd3c15cfb64986a510021ee4d5c81cc3160dad4
SHA512 608ac200552444c36d5ef6379c277df6c070243b9dff7cbd6a64fd8f69aa038915c3cdac3ea4a4fb2aada6cc3f0ee188e849f8580aa55e98c654d3f8d0b08314
TLSH
T1C111E957A071895C0F08BC3849474C14B78FBE2D528AC0AABD9736B3387FE790424147
MD5 SHA1 SHA512 TLSH

MS26_07.png

SHA256 4613539063142a41048d99f58f3d7f097923fdcc6c96474938079250291cd767
MD5 b9ab37e35b23258018fe5b063eed4246
SHA1 2158912e4a816d45c7f685488ea2689aca0827c3
SHA512 a6d0030be7660c3e746554677448b7cfdb759c498d7734c6c68eb9f0de506a03d8ec587eb60b99fa86d45127b5c376afaac8aafbb6ac34a638868f63c3e0ba32
TLSH
T1E2115412BBE0982FF51C03A919FF10A59CC45F292521B5439C25F57347BC28B107D207
MD5 SHA1 SHA512 TLSH

MS26_08.png

SHA256 14e9925a703833e27e70fe85046715f811821d212bfd553dcaa1883c5011f113
MD5 fcf719597f25d7ef318f8e25152911aa
SHA1 b86cc0380a8b4add245d5d14f9a42376eff90ac7
SHA512 e27083f5c4b4a8d953bde3bd18e9bf4ef85e10354d4cb4674060990e14887929d27805ab0970a1c12635f5c2036db16d387640628f2bbf36770cb262c82ad612
TLSH
T1AF11E63CB006A97CF5A1786CFA894C023F481C2990D3204492A5FC249CFC1A48CB23AF
MD5 SHA1 SHA512 TLSH

MS27.ini

SHA256 8209765e68f761674e82f7e87ec2e08c7ca1ea229a1ee24168e00368c4e188dd
MD5 61bda012004b5d587133afd04f82cc85
SHA1 b48eaa593af3f605580fd8be42bd0089447b91d9
SHA512 4bf1a510fa661455516ec500e6d9155e093db86f5b266e81b7c800646fcdb647930e70f631e1d056a297f420723c53cf83d9f5d6b24b073b5ca878575abebc0f
SSDEEP 96:q1y6MGb/woTWV4jbMlf/ztEvifnL17MLyL17XL0L17hLTL17KLZ2L17NLkL17oLB:x78oCIBfN/qD684D5nM
TLSH
T166919D5F0B7930D9B5D7B12B334680A62A380877C8BDA49009AF06CD9D1163DA7FBDD9
MD5 SHA1 SHA512 SSDEEP TLSH

MS27.png

SHA256 558e50f1a9102bea5f7dcbbf585d4392e244ca9af0f0de3441ef61fb86066a57
MD5 73b92d93ee5e6fc01a3308aa2aef6148
SHA1 0ae0bfd93d30af1078fab02739984d2515ef46cb
SHA512 112a26fdbb7a0d2154cfd64872ff4074396fab98b59fb9ac63ba9dcea1f57ebc71d3acc513a8e6742590884bca21a55fd472e3f1a8f9d45dbf96ba10c9190044
SSDEEP 1536:/zzrDMD3VnTyCZRNNNtxIp7InZOCQuhMX08Ks1lxmjU2/GgVnA1G:/vrDMDRTycxiInUVuOX08Kem42/5VnYG
TLSH
T12253D054E631AE3E0EE44DAC3F92C8AD2984155ADB6B0F1477A18F40FEDD34B38146D9
MD5 SHA1 SHA512 SSDEEP TLSH

MS27_1.png

SHA256 028fd4ff11924c2fec0fc58eddb0e9f28a597cf704a1a09f893cf2abe273b762
MD5 648c89f1454e9f4803e184b4c889f478
SHA1 f2c0575009cb4b45a5f8ac5a00774808be818176
SHA512 f063c0dac7cf55d5a5f113fed651d15b7e217698208b13ec4ed7af2ae7bf7e0b5b6169d683f7a2e6884a5b5873c55c70e61bfd1ac360c85dfc0d6bc76553eb56
TLSH
T133615E40F9DBF02F877947EAA5A503C064E00D255451F8D74E4EB3511335B70E7E5D0A
MD5 SHA1 SHA512 TLSH

MS27_2.png

SHA256 ce44eec7fd195d839891e152f418dce15e896e9c62fe706bc605a99f060e184e
MD5 7d5870bad2ca0df89021cfc52df6b795
SHA1 5de6f2840a47ef7f3433a7d31062b8403c46c0f7
SHA512 60c3a582de8fc2ba3876f53151b71888bece64a60738c774928c45fbec34db2c73040ed3cb84bedc234833c5d883ff00ae9bb5bedf829701395d828d9ecef52f
TLSH
T14921D6DC1092E59DCE1AD2B8E6423F59A8224D0E462B8E2D6A18B6359EBD847C510386
MD5 SHA1 SHA512 TLSH

MS27_3.png

SHA256 51c4120a443c9b569faadf6a216276a6f7d95390e346bcbecb00ff041cd59b1f
MD5 4edf3fd9dcb36a54b84c194cf544c41d
SHA1 bcf58724140560262fa59258c75134f1ede86737
SHA512 10999c32b9fd1fc729445155b159f434261dd5beae2e22240c7c3b491df9aa8e4a88c5d317e59c56f25cfba4a7641a3a287f6cf31e20a0ef64d66198b3d092da
TLSH
T1EC21D588624470588A9F11F6B7CC73AC2CAC3E7689E48494F67D7E35807D6CD0086D48
MD5 SHA1 SHA512 TLSH

MS27_4.png

SHA256 a499bfbb17593289a266d20e68c059be139add1bcd589bc49d620ae4b4065f2a
MD5 eff1fee2e78d9d842f4432a47e97ba04
SHA1 79685398ecf02fea1cfa90768be640ddce2f694e
SHA512 f2cbb2cb1bc5da40f8028f3daa856078bb1eb0c5d48c50d45ee1d8d697f17890c89c8cfa2e22587634d006e67393b923c8ee3fa6328369c1a16eb7f1adb8c7ce
TLSH
T1EA21C6B3A255D14B15AC5C90FB892974925F8F15A035E52CC8CEF81C493F78048EB302
MD5 SHA1 SHA512 TLSH

MS27_5.png

SHA256 cc16974940e8dfdb41eeb863ae0e762ff38f890cd29c760aa8e67b882d5bbc27
MD5 9422ab118d09909207e3cad08cdd331c
SHA1 fda6c7ed94323c9215ffc052a00d7c3616fa8cb8
SHA512 c81200d3c7aa74d107d05ef6753ce082374a8e0097d4e51c70bd876ee07d94ea79a4738c2e9db825b13a078cb5899734ab3ca78f3dbf903b44c224b6773b83d6
TLSH
T1F621B6EBA3F1E40EB5A32608E7220D4D8DF42D3809593A09150975A7AD3594A4E1C30B
MD5 SHA1 SHA512 TLSH

MS28.ini

SHA256 26aeeec2b294da0f38f4e17bf1b83f171b43c4b7d9e6c573908c6d3e6be87e77
MD5 9626aaee7055048b8f2ab4d9dae14535
SHA1 c79ed983d7f0fb5c67c8c07b6a4b4cfa3183c45b
SHA512 6943d5a9ea10350a21ad890ea5b29f1c7f89ffd5798ae1be1ee5505f734e0da566a53e97f5ceaa45152ee7fe548dc271b86f39798deafb729e9160c0519f4484
TLSH
T1F361885F1739369C810B717A338780FA2B6805BA8CFDB848644F01DE2661D7477FA9C5
MD5 SHA1 SHA512 TLSH

MS28.png

SHA256 40bb262137fc58cae19519502e8e0f54ee0c1ea7105e725c4e2af1da4cb567b9
MD5 76d6e896af57fb68ad0248e68389bb84
SHA1 9683078d4ee9ee20232e29c94055870b877dc9a4
SHA512 2c382ec0159efe0196f12c43f0c4c2d08110cbb96c440d8e62cd56ac820e4181cade396e1bb34663b6719ff689aa1389c61a46622e657f49cec039ebebe83e03
SSDEEP 1536:FyB7Pakag0otsq0PDU0/3LOTFUx5vXZLPzW3RmUN6gjXf3VZQ:Fy4B1ryGbXRPzW3MUNbjXtZQ
TLSH
T1A963F1E4D321BE3A56C24F4D3EA3C8FD5D8615458F071910FB66AF10AEED21B3A140E5
MD5 SHA1 SHA512 SSDEEP TLSH

MS28_1.png

SHA256 f2532ff40b92ee29cc40c493c01213754ad832d4b4946a57119125e87fad0c87
MD5 941e9b92ba33340d850d98026f81e94e
SHA1 49c14658b73f025243971e9f228de2772bf50ad1
SHA512 8e7fe385d81183ec61b48127b4f22c7329dbc68433179919e198937e794e19cfb3353067b4e7697176d4c574ce1a385a380dda8564991d4da5f74aa714021e33
TLSH
T12A0175D2D49A2A21C756CCF1156580390D791E9F5683EB07B4687C5CD43CB8057E4190
MD5 SHA1 SHA512 TLSH

MS28_2.png

SHA256 da00768a714154c1b8272846005736e0d2f5744e2c9ae85c3d046b42ea27d874
MD5 d25057ec93265361cb4422704cf5a777
SHA1 01f9df14d15d55b151844c158553473888aefab1
SHA512 313c4eb373ab096eaeef98be165c29329ec7585ffd24c1d77ef07920f520de36e9eae14af065870a5d914e92909fde637e35c14667ac372903b267a2c6bdc3e2
TLSH
T1DF118873F114265BCA8D17558D1D15316EE58E0D25C0AFB82744B528CD391DD9426397
MD5 SHA1 SHA512 TLSH

MS28_3.png

SHA256 fd0404d5d5a1042d7930ce62a2f48e5c6f73e7811ad892b3096fca4429244fa1
MD5 0be6e65e38eedca6293c05617320ec6c
SHA1 a64bea3a89a0a7496891b9e66d307c4860714e4e
SHA512 71606a3bb56c6402eccdc4171b6d592591f2c2e1c2e152c15148bd9ddf0666cb9eb7ad17bd25c5bc2444bc7b43170761b5dbeb5ca461e7f9f593bffb5207595e
TLSH
T1491163C522E5B2B5CAC502E12383CE11DE074E0C2B718649C289FC1714382D2806B399
MD5 SHA1 SHA512 TLSH

MS28_4.png

SHA256 bc8b7faf235f3e1d2c2c2b2057ee55668ed357224be64bd20755a69adb4817fd
MD5 3114c453826aacc22f324aa0564e8ed0
SHA1 7a4e7e15f5c7a0850724128a6dd881e1c9a51413
SHA512 28f0e462ad055bf2d653c745a8fb9d1d0fb46cad3567114c0a5fd29915bd855d1c79a87fb366f39c6894b4becb97a2582a60d9ba3d9edcb53723b0817c13638b
TLSH
T18F1194842DC2EF56D50A49B86B16E5E1AD000C090D60EFCB9808B9769937153A64BADE
MD5 SHA1 SHA512 TLSH

MS28_5.png

SHA256 335d3ee9025661f7789640a834f1dead473fd364b1938be43383ba4b84af5f4d
MD5 996b6bc98f9ccd77db4f437f68c4a22e
SHA1 4e110358df6ea382076326f1980fda140a9a9aa2
SHA512 0d983138cd4773beb16e62097e094d0a28957c4035f4511fca6077136016c897824eee573c414212f003754ba056a4e3889ea2194d543310624a669ecd110aac
TLSH
T12011B59CD5BA8D5A493A52C6CF83B32478E16C0468F3A010AD54F52B603D60AFCF0AE1
MD5 SHA1 SHA512 TLSH

MS28_6.png

SHA256 07a5399e8f11e0678b88e34f41632e4e347d1904ef23e485aa9c4a9f80122ea4
MD5 c9c2783f5516396276745d0cbb417691
SHA1 a94fef86bdf4a33d7970034297540cb5adb07e9a
SHA512 dfcaa18bb6c5216342d80ef76a43ae21935136e05dba3881d75ee87dd5fbc55f745a47be5a05edda9059fc73315af8c0a7f2655df4abb77f27db9663946a2e10
TLSH
T1A1219353C314B821D85A9F5422877A2D45225E447C80A3DFA51C3D768BB66432B82B0A
MD5 SHA1 SHA512 TLSH

MS28_7.png

SHA256 33e96aba75cc0284d4dadc9b407810a717fe2dca54daa6bae1dfa9cf6ec6916f
MD5 4a53d451b5a858c20985282c15ed913f
SHA1 7a4ab80e20f525ee40b8c4dac7b6446ca3d3d10c
SHA512 bbecbecbd3ebbb39194725a417a6b87856ddd12b5c436d3f4553e4f163ca15356bd40e4048aa9b816cea39192574bac82c854e760d2ff8ec3697fd777127e14d
TLSH
T18D2184D2154083BD9D9D81F85E17C89938691E5E2C2FC316160CF599793AA09C12A796
MD5 SHA1 SHA512 TLSH

MS28_8.png

SHA256 2aaca7b9d072b7e724fa7806e351fc2fa2b8c3733d5b0e8c0584b4ec2753e5bd
MD5 65162b069a1f212d12e61076a8e3aded
SHA1 97e75501862f9452450482fea0bae4e0bbe24084
SHA512 ccf51630d8df4a3a0b7524fdf74e7b0b052864576b7c9245b735595e5f64b65ed73c8c5821a81d39c110236059400a3972c16a1ce765a389d353f704e32794a0
SSDEEP 96:8uszmoFgnCzkTnbv2qcsiZ+xRlMHeIax8IU7/BZ:8uboF2bv29siZ+jmWC
TLSH
T1BA918D639272F088A4DFB0914881499DB97107F8D478F4317807B9B2313CD4EB86790D
MD5 SHA1 SHA512 SSDEEP TLSH

MS34.ini

SHA256 9730d685ba1ed46d561209dad8c7c0dd2abd167b1d9e21d3d7b938377c81cca7
MD5 fdb35edd8e21e7ef2993e6bc22546d17
SHA1 919a8118bd25eb409ea904fd3b2025cad4f889dd
SHA512 5da6c75eaf1b81fb58059127089394829074b8bc61853dde836b20f04871694d8a5f2b4522be4486c523e9cb772b77ab1fab4062ec3654b5c97562d7b60f6e17
SSDEEP 96:8HSYv01jtz/R1DosXZWB/NqyDIsNJy7qpOv1xCtOT3BvqBIPqIvyhWIkT2Gsg127:4pJyGIv1xCQ3l7KhXLyi38RM7
TLSH
T1C3D1AE9E573A3ADCD417B26A324B80AB176A14778CFDB480182F01DE2A2197477FBDC5
MD5 SHA1 SHA512 SSDEEP TLSH

MS34.png

SHA256 37e91e01caf3864054f13f07cc779029687063b48f3834cf44f2918436df9fe0
MD5 d1b92cb9434cff56dde64ea44ae691bd
SHA1 3fddf253d875476c5926c6291c086f309768bda0
SHA512 6ad7aaac5f35b4374c807968aacf47655e13c356b5ca9dc94733e93637cf10c92c71286f5b4ae09ef0d6c3f96c5a50145a0eef4380c53396d74b1945c2b11722
SSDEEP 1536:Qxe9bGDcXb/Vy9CgBWk38EGOdupyNUhtpQA1Uz:7icXb9pPkx7xEUAGz
TLSH
T18843025BC351E79C7A1796F3D697848881FA1C1207AF0CDC02801EC7EA45EE6621DBCB
MD5 SHA1 SHA512 SSDEEP TLSH

MS34_01.png

SHA256 3afea7013ed838c9db2716d24fef8ab48224f496cc994b16f87d8b991f3d8cee
MD5 adef04e0fd11169c76ccc99419c61ae9
SHA1 3362a1c971858faa88bada4ea400ecb9bfb3ffe8
SHA512 35da7cec0cf08d0c034c1ec57b842c9795a8ad304a9e857654b36e6a90775af0d429f0443d1bdd9e13ad442982daf19f73bb361cfdc89930c9d27769969a181a
SSDEEP 96:flmQ0a1cdMxtMwFx8C1znHXQXpZ68dweQ+L/fNMXrvsw97c7vDxVM:fsVfCxF1HX8pZ68cC/fi7swAvNi
TLSH
T150A17CBE40EB00C3BE9ADDE89780899BAA71FF7F0B4A021D1144441915F58C992A0BCA
MD5 SHA1 SHA512 SSDEEP TLSH

MS34_02.png

SHA256 8af9390be5a6b935b59b3158b4b6bfb060e8b5ab03170b01d192a8c291af9bd5
MD5 871773f364edaf43b54d317b4d4ff05e
SHA1 88a16841cca60cad564bb7a4c254be5c07e11a90
SHA512 8efc283751a66e47b643a2a674c3df48d92d65a84ab6080f999ebd09c1cc363c841af2e2ec1baf21e7a6d3e4337873b9102698acd189a472aa560dc2164e678c
TLSH
T15A613AAF2A21547D6F800E78C94405E5BE8D4788AFFA5C0DAA344847BEAD8C012DD2BD
MD5 SHA1 SHA512 TLSH

MS34_03.png

SHA256 33204f34e250e08d3990e8a15b954fed0657b7701c3e9d96bc6d6dde4702bf85
MD5 6ca136338b1a53550d67efaf63ba6ee2
SHA1 15f91a5cdce3665dbbe5fdccc925efd9a5831498
SHA512 40c32bb9f8c31589829d164025dbc7f0d0615270037234be9dbc7a08ad260ecfc4aa83db30e12280a7d66cefd94b214267f88946668498773e100a6e443bd580
TLSH
T145F0479F1BC09F38C60C6B7153149E51F4B70F8919F64B9B4F3999E52E5135114C6351
MD5 SHA1 SHA512 TLSH

MS34_04.png

SHA256 54cb71b42aeacd3c613d8c78cb9a9f38d0a8cfadb2483da84fe7abab51902879
MD5 b53c3953169e6c7ea3ac3302a8874a73
SHA1 907cf4b1da550d75d3a3af48fe6686b779cc52c4
SHA512 a8a61e5f6d1a3813c2d45d9f0994f4cac7a70f4e2ba69fc8c9048e53a06b833887fa2cb9449f65084f366c38ebc594304d5f6b5d95823a0e2369684977180a0d
TLSH
T1C111C844E488C851E40E293939963CDF9AB6480B47A916423F025104CBC37FD6AC53C4
MD5 SHA1 SHA512 TLSH

MS34_05.png

SHA256 6c2275740bd15478767e2547f755aac86b5973d97807a9e318a50a2289330618
MD5 070e962a217453852a9a8d09f8cf9162
SHA1 a6c40de21c0f0562edf42db4a7ce23e80cb6545f
SHA512 c2878521521abc5837e8d0c5ee3d062a0d398f6b06856bd7fa2273fc8025adc89fe6638ddac5039d473b733adb42065c9013ba9e254729923f0a7cb9035d3a91
TLSH
T18221CAC896F99131E8743286619E4626AC2F855948D382577F371836EEE2F53044C7F1
MD5 SHA1 SHA512 TLSH

MS34_06.png

SHA256 0adf54dda35b7c5cee03b4557e0c7598a3a6bfd29a0e934ed4ae939b0e9fd819
MD5 3c104344c40bf9bd7075392a229f2383
SHA1 143d193cdcaff4df3a68bb1f1a999d267dd521a0
SHA512 8f9535780efc98650cb089f8c8a516c82d0156a5cfaf927afa88cfaa421dbdeab35d1a0c8e5208721d482a86dcc59f3133a967c02808c3c96c193f15d1c04dd1
TLSH
T148F0E1C1D5C9555DD5E84915B53B0AA3F0526998790246B9F50D88FE5E40075E163F02
MD5 SHA1 SHA512 TLSH

MS34_07.png

SHA256 1be7577f7d7365ae3bf4f479ea90fdd5c626e782035a27f292abf1fc5b6aac02
MD5 4b79b87e555e7fc65c2fed4ec4244c07
SHA1 af4545e8cf1aa94991418f238cfac5f82bfce54b
SHA512 6d0f72e9471cc8489a803042020d89d1db5061a494bf01a3ca0cb269bc3ceccb124665f827bfd0db4c09e2ee37793ad7535bf62a8903cd21996f3ef650f40db2
TLSH
T105F047D1C182A85B9574140C44491A55D3634AF7F6D336E7D12AB8341DC35B9BB04711
MD5 SHA1 SHA512 TLSH

MS34_08.png

SHA256 a19347eea0d56cfcd2400ce87559e263420251de67ee452b51263005df23dea8
MD5 6fa6e9aff4f37bf66cf56d4cbc0c1609
SHA1 0187c6ab914af176a6f3b97c7483e3c033d8bad6
SHA512 4ccf027effefc1d0d3191c1f5116cfc73569ee9c7769426553e9994542afb92d5dbf876e70e1c0485f78f89af79d5b83c5989226eac7d54c26a5b5f151093196
TLSH
T183F00C8FC1D48E7A89CC41D816CB9191F4B3010AA555551CA85FB62299B2E85218314D
MD5 SHA1 SHA512 TLSH

MS34_G.ini

SHA256 fff555b12942e6fba029f144be31f1a0d43573e98b3e197fd68bee945c55d1b4
MD5 7e2af9bee2b0d1ee10a237731a2e6c9b
SHA1 76ca0038b1e158eed46cd961e8850affe2211adc
SHA512 225e88f05ff372283ed7dcb1dcf40f8f8f13b23f77de78bde30ceddff507f0e2268a19420f99e7085b0653c91be9a9b8c039a1a076f9b787aa76839a9fd1ee98
TLSH
T1EA71D09E1B6935C8D052F6AB334784A3227A14ABCCFD54C0182F068D6A2063867FBDC9
MD5 SHA1 SHA512 TLSH

MS3B.ini

SHA256 a0566857ba12e8dac5a7bb9a6c2f40ed891427ae564f804a8c56714a273ea03f
MD5 b78e90af1507b7afa4c669e4216b9899
SHA1 737f5244065b8818a83bc316e61f0930e322818e
SHA512 cb40a0eb0e06c5088a57a0837e6abc70c99988b64515359ca208f29c7ceae50b0d28c1281bcfe67dae0a2bdc8a06131f0ed0c74dd2dc31cee8df354c64b407bb
TLSH
T105418448173E259DC1277739308744F72FE124BB8CEABD49586B08EE3661A313B690D9
MD5 SHA1 SHA512 TLSH

MS3B.png

SHA256 2ba74c876be7e2670e9bb71b62334b39fec2b629cc6ea80721fbbaad1f27b5e9
MD5 f0e8da1fad8c5f3972cd0014d90c1565
SHA1 0a53206dcdb59708e6920a11ed7b619ce89b7c69
SHA512 18f02470bbaa4a09d897476f1f43b6978ddeb4724e6a1629a1b7a8c4afe8f1a2a5d2a7ade97702dacf18b6d35b1e9c0accb73744f0bff86734abf8d2a737728d
SSDEEP 768:i/42yC8l81WlrudXTXPqqLMnKuwUVc+hSl6Kbw7UFljH05qv7:i3N8sWM7SrKwm+gwurAi7
TLSH
T15513D08AC46B862E7D1605FEB7F12FB9F06F6E6073DD05C51254A5DA3041BC8E11AA83
MD5 SHA1 SHA512 SSDEEP TLSH

MS3B_1.png

SHA256 a34a561345d915d1a23928267f91caa2a1fe1c04d9524e0033a53f1adbf90c75
MD5 e05370dfa01ee6b08030f6e44c1b1fc3
SHA1 4bb1073ab8c4ea8911973a1b800145599f6f51b4
SHA512 672f3218720b55d70aeff8088eb7d2378c2c32c0239fc06eac494988ec4d69ebf53cce68163c90abd524a1f3255d40ed7bea55adb8b2f6512706a7dfc1e33d95
TLSH
T141510AE1E201B868690A0461B60AE2EC61E31D746274503D6726B565C777BB980FD3EB
MD5 SHA1 SHA512 TLSH

MS3B_2.png

SHA256 49ced83d69e35115499c6bafe6572245d4683d07fb6a022511d70fe7f8c68d74
MD5 d2ed6bc530aaf5efe0d63c80dfcb4f73
SHA1 fa3ecd78612850405e7633ebc818349883acd819
SHA512 b3586fb007ac48d4f92812b49f300442afc246e85a633f8391e69115b6700414968815396afaf00c0e5cb511f5bbb88e80e48cb04a095d94a9454bc294abcf4d
TLSH
T17B512AF6A4B1DCEEC98D2AA8E190F8940FC81D96E1541C0CD58871A4AC36B07789C6D5
MD5 SHA1 SHA512 TLSH

MS3B_3.png

SHA256 ce77b1b83f497abc028a8ee604e62848c17249a886139e085b013e6cb40ee4b4
MD5 a81587ff7a0d8902df5c98cec14dd6da
SHA1 ffe14f6fc0fba91723d75f75bf138f45b14e3a50
SHA512 a686fac9fef5f416166f2da3a290c2480009183f8e8b0c534ff32c4371e770b2d559f0b441588a1068f5c45e9ac04b981635dc5124cc6c2a820cfeff1e43c177
TLSH
T1A7414B524F1E4E5BE85617E77A204E6BAF98CE9708637A60EEB4F225003661C1CCC765
MD5 SHA1 SHA512 TLSH

MS3B_4.png

SHA256 fdf05ef586988a54658de71548dc40b9dbf72735188346a688d38bc41994bce0
MD5 741d5b186663a67975f3ca67ede70e12
SHA1 e345f9a57dbde4b31370249de9a1b95f13e1b2af
SHA512 4491b3a61c8687d8a847ceb843f1014b87af5db9963144ef60f7884051a600b89519f01334a26471d58393734d5169161edb2e9dae6472d7d560630e8b474425
TLSH
T15B415D06EF584C19CE5FC12036F6E80559A05CE7987CA1CD470E782A13FF681C3E6107
MD5 SHA1 SHA512 TLSH

MS3B_a.png

SHA256 afdfc6afebd04bef63438f64bab07895bf26a44972d2a4ed8856c4c4f118e9d6
MD5 f59ba9c1a1dfa6a82c9b5e5a1aa41020
SHA1 e51622289d28f9cdd9fb5a8166c5845f32244d30
SHA512 d8561d5c037bff014eeba84edbf8274446a8dd51c55ea5f40d804faac938d45e6a9a503d1b3d258a862ea166f8573a19db86567d8d265c1f4cbcc014f593d4ec
SSDEEP 96:n7ZfPrhL2R8eMeiLFYcFnhyen7swqlrH5H3NuKYxu6ChWf:n7ZnrhL3/TBphy072VNuKYx5ChWf
TLSH
T158918E9701D5E078D801A8942AF77E12E71C9FE455F7D80B481372CE8D3BFE8166A047
MD5 SHA1 SHA512 SSDEEP TLSH

MS3B_c.png

SHA256 a149e8f2a7920225a53eeebe82a68e0fdfdf41502e70ee772c1ebbf91f445486
MD5 8be8ff94dcff80dc4fa29c500099d9b2
SHA1 eb67cbc97d0690ae1fa43e2ae9a01cf0ca7d6f5e
SHA512 26f294756062ebece1df00ed1380ec52e278539ea1e45614453166997883a84e5fa6c666c94c61ba39dfbf482f81d2b3759467abf32f6f5fb23fd15a3d86f65f
SSDEEP 192:4SrHxCmUSB6o9m5RuD36n95PZocfDy6Dh2y+Ioq:DrUZSB6SMQKn95PfW61Teq
TLSH
T149F19F1265E48A11874A3E9108B161A974730F02E72EE13D9BAFB8076A7F70E4DDA721
MD5 SHA1 SHA512 SSDEEP TLSH

MS3B_m.png

SHA256 08fd13231fed79786744a8bf04b2cfba8f5649cbbe39f4c8060f8d9304a503e1
MD5 4072fc451249b7679065741646a59d24
SHA1 4d098d1cd121ff57f91ee66a6f9b674f9073078b
SHA512 23829f26e466322ed8792f775fd1bbd4192e161506839f5c4dc937341ad3f3bcba5ef3d67a03be7558d0dde5b48e8ce00e3ea45b2c6218d7eadd2ab32b64ff3a
TLSH
T10F616DF60E5045F22256926980E3E27C3F772E100BF72367E46672ED943D94940C659B
MD5 SHA1 SHA512 TLSH

MS3B_t.png

SHA256 d4d62360c1c712ae6a5bba55e574b290d9c51f194b5f28b65f8f1a1628715f15
MD5 f637c77f01d40c56dbb2fed373cb3bc3
SHA1 ec310db383a8bee3712f2bf782a9a52852945963
SHA512 d62833979fe866bd233dbb6359de44ee540c9857672e9cc2ea1b15547f0f375c80088e0f92be7a62efa9892e8acccb4f6914d5c51aa6c52d9e82a915d603e8f4
TLSH
T18A715C597BF0C9A0E51586F134C3AF30DD050E5F844CC4E03E4ABF0358751F8D099628
MD5 SHA1 SHA512 TLSH

MS56.ini

SHA256 272364ea344ea3a5fded6e57573aa1b121c268bdc6b93f6f8ce056022785ab26
MD5 1d3b572d50f1f9d8d47455704db965c4
SHA1 93024c801163607dc7051123488a3578901df522
SHA512 839dcccd77f74bd92c9e3a968182b1ec5136ead159c082bf07c97054a7285590146a0520fdf77d934e8da905c82ce07246695a3b09c7c4d5e807aa676a8d3ff0
SSDEEP 96:4yJM49Iy0y1BtDq5AMmz3ae2x5l20ui/0XRx0tMl0Rv20SS0rNQ0WX05F0t1:wgnPcEFMbBshuGS9bgRF9Ev
TLSH
T19BC16B1F1E3634DC9056F2BB3709C4E562AC09AAC4BDBA94085F06C86561634B7FFDC1
MD5 SHA1 SHA512 SSDEEP TLSH

MS56.png

SHA256 82bc4b094017cca2f32831406bc37897ce48e0d594ede0d99c57820f50c28917
MD5 ab73e4f582d36b153ed92f6a51d6ba80
SHA1 e8a3d290cb81641ebf49b39b307ccd07d17f2ca7
SHA512 4f83e02c9ec195d69fab3c873737bcc756ed148de193256094523ae1cca80c9535acc8943be1bd19dfbda9d671dff52734539437f24da18d2b17462f3c60f40c
SSDEEP 768:CilhxuveN5cwVDXLd7EREiyS0834ClbS4CUNq1oRey9QS7pGL0LnXMcdv/8o7Avg:Cqzuvs5cw1x7ER13tNnNq1qnc0/TZh
TLSH
T1A843E128FE190EB4DEE54C807997D85D4448458EDF1F4F48ABC28A169F76AB2FF801E0
MD5 SHA1 SHA512 SSDEEP TLSH

MS56_1.png

SHA256 9c3d0f54a8f9d7f62256fdfa492950691e2c43a8c0179bad38105dbf892a0a1f
MD5 00196086731c19b2c10d279b2f964947
SHA1 b66c4ab07f44c03c9ea95de2db20ed7b2a5d3c97
SHA512 0b9f36cc6c1de9081e9bdbdfb35c5ccec0671253f7a53be72dc11d3c7810298d6fdec712efbf61218578c16d8ea2d000449d212f6e92b9a2dd270c2ac9db80ab
TLSH
T19A513B4DA9F5635DEF080CAA2C4F3382FCA0CC52260C031A18AFFE756939991A7E5750
MD5 SHA1 SHA512 TLSH

MS56_10.png

SHA256 1ef03914df89e5f3cbc127477fc9211862e14a8d8b1896d157bd69ce54641d18
MD5 fa5ce40289b17ab3aaa6f26059acb391
SHA1 c9158c54f4d7a3310ae41ab9c9bcc1cbbf0394f5
SHA512 8252985f23a347a463036eefe6858a5798ed5a38b28a1fa4911a2ae5cf6538d74dcb5ae1d525eb1c22ef4e2e729625d53f5f2c81a1e16aeaa36f14262fb68920
TLSH
T1F711EB6364945CF5C53010179313B53185D24CD1BEE52AA3613FB04D08B553E420C382
MD5 SHA1 SHA512 TLSH

MS56_2.png

SHA256 d21f87d0ceca2ec2a93fb92215c93c4ae11076f206068cf4baa7202d7179db6e
MD5 81ff19f82ab163cf83282e24f231534b
SHA1 3bccaf4e0cbbb640525f4fd6fb4e1f8a2d200c4a
SHA512 9014e398f9bab72c4b3d9a13f3f8b2c6584fdaa7a41809a8518597a7ab82165662abdaa09c7eea63f6e781947f06d5741e9a9ab48043fc576707ecdde6f15807
TLSH
T1261152CAB3039930FD684529929B70E0EA5C8E61716DD80D502AF85660B7968C484CD2
MD5 SHA1 SHA512 TLSH

MS56_3.png

SHA256 307079e3fd8143cf5b67d73a917ef033573589cb7ea38029a4b3fbda2eb9bbdc
MD5 d7da3d7e4ac7cd40e7bf46191586c941
SHA1 fd8fcd2a7f04a68d58744da869bfc0b23d08b932
SHA512 5605e062647861fd160d62170c694c404f2f72bac2e38fe16826b4696982e38c2aaafa799bd143e83eddc9214e08c88727a35ce166f775bd56e8d8442ea32617
TLSH
T1E911987D35C87AA94F1F0C3B8AF6D8036B479E9110128585084B776C49BBEF91A02714
MD5 SHA1 SHA512 TLSH

MS56_4.png

SHA256 4f4b68409dac618e180121846c31fde7872cf1cadc51a8f55ae5618769426f14
MD5 1a4dd2bd90e05416ba449abf30849cda
SHA1 ff4465299baf063e55ef454155f4128f74c9654d
SHA512 c702dcf46cabe6409ed05ddd8288e138fafa3c1d346c4b00f54838945a3011b2501de4b2f23e4502c77cacfe022d78166684ff4e9a18a426e2538a269a7c4f96
TLSH
T1D811B7A1510CB0E8CC8D1D650BCEC522EF387E2D67BA281C1748BDF0287C82952958C2
MD5 SHA1 SHA512 TLSH

MS56_5.png

SHA256 c17c8dceabc41b98e20268c86e79fd070f195151bab96e3f3640628001e14d39
MD5 df17d6abe8ab458760116b58c3996b74
SHA1 140e6d127fbb19b0e2994cfdfdc7a16ce68bdfca
SHA512 eb388a259f8222384aaf4f0abac68702526666950dce0ffa5b4e10ea20a523e55f90efc59398074f3d155d3ebefbf9a101fd72f0508867def035a1d3f5106356
TLSH
T102F005C23D8A3714D0AD589172068524E9034FF11781B37E514FFC3847B9D8464D22CD
MD5 SHA1 SHA512 TLSH

MS56_6.png

SHA256 1b71f84322a83a51ce23949058583c0673bda36d02d94f9246b57a0a730b73e5
MD5 5de958cbd5b8051b6dd732fda2659557
SHA1 aa717c0e787b2b21a76447bfe6a76c232f709979
SHA512 42762a77f3c82e34533002f5240bc5b683a797ca798e643370ff2c3f40f52fb303a0a9dde3d30ee24bbe910fdffe46242e54850088c22f88b5acf2667bd2ea18
TLSH
T1F4F054CAB6C05030C91AE5DA07332820FB57CDA38791620FDB0D371A003CD84EC61908
MD5 SHA1 SHA512 TLSH

MS56_7.png

SHA256 db626a5cc33b560ddd0acd96605bda16de04a946b1ec68c907aff931501cd09f
MD5 ac83ccd302e3e4f9a149a4ebc7954da2
SHA1 dd3cfe3f9bee0ec460ec8c8dd07937c73903d7cd
SHA512 9f9ddf3faaa0f62556d790870a61023d9e150323008e3fdaa8ea0e2dfca82f81aa8b5d3ff3866fa758daf2be633da2efeb2de247e4d7e58a02f3f24b2ac9e8f1
TLSH
T13F01968962970760AC1660CA720960A05FA44F5088840E953907F4EC2A3DA8C7B14399
MD5 SHA1 SHA512 TLSH

MS56_8.png

SHA256 c13168ec436c7c7ea30192b953a54466b0eeb08bb4cab5b3e53ef8c238d891c6
MD5 40db5fd87dd34e35a062a83d091b96da
SHA1 8314c3ac66dfd560f06d83d2e641d3904c65e1b1
SHA512 d2eb1e8f60d906e5715456a75835dff99b697cab5e91ff6dda0208fb9db895b6e7841c9b394c6ec15db58f3e1139d2b9efd04fd9bb643edb2bd7ed651628f774
TLSH
T1920165DA3B61CA20F95FA0E0AB2340519C750D927081C95C45487532A2376828D53FAE
MD5 SHA1 SHA512 TLSH

MS56_9.png

SHA256 397a3b956bb1bff3d638dcd4f7a07debb71b8ad181e97f075d9f12120a16c4c6
MD5 c58b2b59e7e5ba4cc7d4eba67e2af1ce
SHA1 6734a3cdae3e255ad6ee37a3d141376fa0269bd9
SHA512 064711137b378d34777d132b5d4fd174918a9843be7b4357956046fd92dec947a8810c15d088f6744209bfa3e8b537d7db1d70080f89aa14742b2c37a1b2016d
TLSH
T19D118A7492E047D74439217073870916A331FD7949856D5693DB3F15237D82B60457C1
MD5 SHA1 SHA512 TLSH

MS6.ini

SHA256 35f63ba6710372726a6a329e3bf9d1fea5ee84af095daa8d797eb5ae5e52185f
MD5 c089aad79a10d48b3b44914d5eb9e24a
SHA1 976c7178fe9943573f66d873fea092d552059e4d
SHA512 894251c37581de78271001f260b99ba7c6e92134106f9f5442a4637eea30d4731634e6732fbf95250fba6b20e7e6348120856ff17a05bb2cc33e2a4be09ac3d8
SSDEEP 96:qZutZAuhBvvh+oiOXwy7FEMqlwq2WXSBmcTh/JTh7MTKzVTNeLoToqETzMq:2uTmnqZV1AURoLMNYAq
TLSH
T150B1BC5F0B6035DCE016F46E330B84E72768446BC8FEA4E518AF05D96662A7867FB8C0
MD5 SHA1 SHA512 SSDEEP TLSH

MS6.png

SHA256 ca5c24cd52821570fa2c200b0275d0a701ca2f98ea1b4fc36ee7243ee6a25c4c
MD5 736a29dcd442eb97e79ba8beef3a5999
SHA1 ace88c81298efedfaa2dfdec57fa5334564df520
SHA512 23b5748c56dcfe4b30aa0474d1441b1113a236331c3ef0c744ac1db3656cdea47400e0ee8c35873492b51187aa8ee3859da5fe4605485039e7a47229cae2dec0
SSDEEP 1536:26m+h8nKkiNiGpowp8vQTsCE/6F/aYx3/RgXObYb5FoBTiQb:U+KKbwoHpsbCRF/13JBQWb
TLSH
T12943DF58F751DABE29E00E0A7F42982E3619586DDF1F2EA4E341F852D8FE90BF4241C4
MD5 SHA1 SHA512 SSDEEP TLSH

MS6_1.png

SHA256 a591254d73df9dd959e6cd5b2d3b44e44294af118a9f94850be590fdcaade693
MD5 c1dbebf3a704d69d654e10cbaea84c08
SHA1 9180b91319f7fe04ada26e4ab96e0c4ea1e186f0
SHA512 d5a6f24b3f7b4e516e54a14fada9fa8f679e89adcdae70a8931f84e982c898ea507bc1c5de850534fe1a46bf349c29956866aeaaf25de8e61dfa739b2a0d28da
TLSH
T13321B6E6517090AAE03A4C31834B44C8EA3D0DBC28E14C4DB1D97F9DB5FD2C0D84521A
MD5 SHA1 SHA512 TLSH

MS6_10.png

SHA256 840772c946e2e4d0dc92504827cc5f08389093e5da20d6a54fadea38d0381568
MD5 b5eefe9c0f0b68ac104410cdd1c859af
SHA1 6f379247181100b0df8e588c5e2569542bf33a4d
SHA512 bc58e353b2c83b16c397352723a86ce521a9a2a0363abc4075eb99634639ca91e8ebaa30078c36833a567f8732bc91f854313db424a25294b31bfd2a68ad472f
TLSH
T1CF21B9409ED15AA28B3B162B1207AC095C81CE94AB937535674F7183157728C9C4EEDE
MD5 SHA1 SHA512 TLSH

MS6_2.png

SHA256 3876b2091ef093babbf7470f4f802d33789dc5c27d8960ad9927860dc72e0afa
MD5 1ee4bd85860ce99c59b914a79acad2a2
SHA1 1555a5c274c91e7f9d1112f4eaaea091cdb3cdac
SHA512 10d8878d66318ea875574affdf14e13d0e193568c4243df2156f8079329718c7ca0f57a4981e21d12d192783a516285895cdb51f7b393ab995cdaa33a464785b
TLSH
T11401239113C14A13E459887A17EEAE605F909C4CD59F4808DB1579B1947EE8C952A2CC
MD5 SHA1 SHA512 TLSH

MS6_3.png

SHA256 59fec829f582d7c8b6adf47da5dacb2d44f249cfe7e3cb9bb52d5204afefa2b1
MD5 f4f62a5501cb40e47c3a19b5ae3cc79e
SHA1 452165b10a1627951b74f6c31b12fcc58d95a2f7
SHA512 4485b30ef400a121d2e6fd8fab5a7bb5843809f87368b6accdc5ec9f9a13a231aebb0dbd57eb9cfb21db66121f43048aadf0cd4c93690233eaab0f5601fd3954
TLSH
T15FF005DB6640C439DE6D16A45F5B514C85B14F2D104A502F9058FDA5937C04D661D280
MD5 SHA1 SHA512 TLSH

MS6_4.png

SHA256 5e468c3558235e888eca1e331368662e12872527b0a191caf2134d80d785d078
MD5 2997bda8d84e6b5fc18893d2a672ad46
SHA1 dba19a50bc144b65ffd84326699724fd84f8d8be
SHA512 4214c005d090998d22e0b3b43931902561a680ef57cce477ee33ea23ea2aab2430e0da6b8e1305b46917e0950ab50d6b273e87d810e40f68bd7cd18ff583ca80
TLSH
T18AF00EE3135D450D769E0DF89347F524E8001E220A6E8258B95DF81192FD0A0CAA63C1
MD5 SHA1 SHA512 TLSH

MS6_5.png

SHA256 fb501f6086105e189ececdd4120acf8d45258287f35e98689bf25dfe8b008880
MD5 2ed9f87326575180b8515d01c40c3dc7
SHA1 fefb7aed907cbd336493aec71e659015ba094acd
SHA512 fa976b55a69eb86b26c0487cc3dbc94f43556840290acc7f517b8bc252bc4d5c0f3a3dc6e38028132c5729d400a251e1731e75b4c4dbf084ac658a3e4468e4da
TLSH
T1650170E73081D359E82886EBCBF8F53C60E10E97D06BCC8C382638881030940E8D039E
MD5 SHA1 SHA512 TLSH

MS6_6.png

SHA256 2c5ce3624b0dc15f9359a5eb89fc61d6e4c33fe1b87bad8bc19ba243fc20dbfd
MD5 166b7955b7703a87f911d98d1203fe9f
SHA1 54447e6ea889887ee022a04cb63094ef229930bf
SHA512 3befa0cdb3aabceb614ddf353b9b11197a39dd74fb9b3811d9a484f7eb0094dcbf5c56a199ef4d0985ac5d65e9f18b12522ab5bf29b50b8e7ab0776886f4d786
TLSH
T195012047B29962A264A7755A47072D90B4860F62304F574C895FB83A473B0D5845B2DB
MD5 SHA1 SHA512 TLSH

MS6_7.png

SHA256 d89ab8c1de025651c71c1533aa1dcfdec71ef8470ba441452a965f7ff8a5df1c
MD5 64ebbea89dd905b34a02892735c147c4
SHA1 425e83ab23f0dd3a8d35e1135ba97b3becf409cd
SHA512 8c9c16f55967075cdcc5834b342fd75ac24d89a818ab8097842d77e3579bd71860c6155a4202799b1eb3be14071ff4fbaa6401ecc05583361258a6ddb3926fe7
TLSH
T1C50165F6C0145F4748DECBBC019F1834AB442EB14AB9C1DA6899B039AF7CD10A5732A5
MD5 SHA1 SHA512 TLSH

MS6_8.png

SHA256 544aade4f917a43ac28a899c328a1d0769459f2c8bc04e4a0461a4fbb12ce984
MD5 2a3e98879b65bfe0982ac7044147bf8c
SHA1 ac47f4cf900dbee7c870d7293227073d7b397ed7
SHA512 5616fffc5bb077365b50ecab96a715ea05859407907fb06faf23e799ce1c5e53c95bce1a7855f9ccd28a02741794cd8f4e09b1a8c61da8d69c109096c4e798c4
TLSH
T1640165D619C00DD9C6FD462A173C88115CE40E943536023CAD2B7A2CA63ED175AC8727
MD5 SHA1 SHA512 TLSH

MS6_9.png

SHA256 edca0b94d4017e55d73115457654cb92692c2821cc91e864177da3a954421a19
MD5 4e8f3df83c47ce9a9e5562c6b4a95dcc
SHA1 5ad5660573c923a4a897b62f4a6def3b21029bd4
SHA512 496747fc75a0e55c20830ac50de241b95bc582e42426b956b37e93650ccb34f8f1c25962677f5b133fcb82a98ba15374d8083d5f52606d5739b5443333899e16
TLSH
T155413AD223D09A35EE6517326B309F7474005C5F640C292B5EB8745D053D260BC9BF15
MD5 SHA1 SHA512 TLSH

MS6_G.ini

SHA256 566fcb4be4eeb8106e1f2a38d06aa678205b882f993cd884f7b5d0495c2c0897
MD5 b3984c4d5f59c7ad51e283b5275bc25a
SHA1 38b3ffb1e5263f77d9cba2d0515a7e357dbbe894
SHA512 f58b56dc511c8d2f91933d230c155815c55e5239f52795c1be7c8aab9afeac1131ab31d140c9187f5b13d6e8bce165352a9e4c9a1bb1f7dbf4d0a45687e3ea0d
SSDEEP 96:qZuOZr3FX2819iryBwTh/JTh7MTKzVTNeLoToqETzMq:gVWrdZV1AURoLMNYAq
TLSH
T145A1F25F0A6435C8E122F46A331BC4A32A7D405BC8FEA8E1189F05D966A137C67FBDC1
MD5 SHA1 SHA512 SSDEEP TLSH

MS7.ini

SHA256 3d9ebdd04ac5cd4a4e9379b68be5e0c45fe93dd404941551997232802ac612a2
MD5 12931a4a07d08a86119fa46ad59b3816
SHA1 805856e9bfd726a4cc87653c2c488d2239d3f7ec
SHA512 f49b7223f98bca232a2fd4f1a8e8984827ad7472adb1732b3706e9aa635a7ec67b893ed91a9f4501ae887d6431f54586926e93890d1ae07cf5bae6d68f10ddf8
TLSH
T10B71CD9E157626EC814776253257C0BB2B71047FCCF93D50246E01EE63A1E742BFA5CA
MD5 SHA1 SHA512 TLSH

MS7.png

SHA256 0898639590912f48e10e291ad0de92d889df98da5bbd956cb4f35a2e36b05645
MD5 f8d9e55466fd1c6439d95527b6b37333
SHA1 5bc7dcf3035189330e2cc9b08d8786a465762ce6
SHA512 c0c073c0c613f78354e02c7089f9c7e67e1434199bd420319cddb78fa5cc04e90a1028c2fe15870d1ae2f1fe39dfd71455a3053b030284943b42dc7b440533f1
SSDEEP 1536:nvAU2ZkoluxFwAHSo8YEw7FjDNF3A4AIn+2V:QkolurV35Ew7FXNFZY2V
TLSH
T15F53DF0291C69D1C96FD043E44E31A59C484AECFCCFA75299BBB2E904F35430BB6F684
MD5 SHA1 SHA512 SSDEEP TLSH

MS7_1.png

SHA256 878240473bc6acbb7650c5208c1100e716c7c500fc5b9ba9c5945b1b1c4016a4
MD5 2c2da7ad7eb4d0195708ca37cd81ba25
SHA1 7d1229e5dc9824c98878c0dd2235aba7ed25948c
SHA512 8c5315a4d3bac578d27fbcce8d94a32d6aaabe2080d9362f72cf1e69ae5f286ed56751c4f28a1dfc544bdc0d992646abd8f1b8b52d2fbc3ed1fc505be67ef83b
SSDEEP 96:2ESogOKtDs1NV5U3vqk7Fs8Xp2eEF2Y8gw9abf90:2E4U+vhFs8XpyFAQ0
TLSH
T1F9917D5BB72C4D6EC12AC3B9135D053CBCC64D6852A5074B5BBA78F6413CC9EFC41855
MD5 SHA1 SHA512 SSDEEP TLSH

MS7_2.png

SHA256 cb50d07e28903ff1bf96fb8ff8e12f6f494c2e6b1774aa971b56df76c6f89c3f
MD5 55eb364ddf2d21d034dab3f6b64b7ac7
SHA1 f16dca4f62f86c4a79afd6c99c1c754ce469fe18
SHA512 907700a453dda62c1f47ab9834d659666e25953e94c9559a971218f6ea5a9737f53b30a1c0f472ad95d2ed649b027fbe09eadb8f1787c7a7f9ac81e9cb2126b6
TLSH
T1D82117AA30884E4AAD5223CFCBA144532C167C3286401B23991A3D2A4ABC86CB0FF087
MD5 SHA1 SHA512 TLSH

MS7_3.png

SHA256 e89633f3bf9c24a6aefaf740ee2ee5a60eaa98026f353c8b41571ef20a5e3552
MD5 35fe919f0c199f1552bffae3d366f7a9
SHA1 e116dffd7c63fb1176bb278bce2d10b5d99b0b60
SHA512 e8bdc35ede28958385a4699d440cebc150adfc9477a8179a67db26f6597b531b7f754e17d0e73062bfe9627caef1c6451c01d5ea238391a89ff436774e2bc757
TLSH
T1BA2195D5D20795E1C6DEE9AD0ADA170C2C589E74984FA6EABD0934281C3D69EC308D26
MD5 SHA1 SHA512 TLSH

MS7_4.png

SHA256 d2bc15fc4a47b603ffe83128b1dc0704d14287f9239af173638e468aa0f64603
MD5 afef3f3b2e9e0b0cc6b9276d0ac8444b
SHA1 9bb1b917b62ac2626474d0e8d410c07084e72e62
SHA512 24ca5c681a2d93eed9f5b2b906dcd0b0925e1f7a38acd099832bbcee178c9361e0e9b9c70a8d2b086dabec9d324fb0cd8c91ee6eb4137be0b73c67f2ab64dc86
TLSH
T1732195A128184012CEED0876A6325211DADA8D1794F9CBCB5F2B7331413C3AAF9E66F5
MD5 SHA1 SHA512 TLSH

MS7_5.png

SHA256 0c192383c9800fbdd4095227117df9305d9c61265c66e1a2dcbc9c1cde3af1b7
MD5 494c8feb86dd9328ba819d16ecfe85fa
SHA1 2542375a2056a556db78353fcca847c269e68bdf
SHA512 eaa58a65a9668aeb476a70811193bd8d877c20dbe3e71912f0d4ea88be0c82887917533f1526270f17e56892340313fdd51cc4354c71466aff81644545bac48f
TLSH
T1F21194EDF5E67C1CCCAA709B4248665CF9649D06C82A4645608EF1EBEC3F80E2651040
MD5 SHA1 SHA512 TLSH

MS7_6.png

SHA256 c7b02a99a17461a6c8702b71495bde3185e9f264bd76363c39a3c2276fb643bf
MD5 28ce8bcd5b1bbf4a72cb965fdd845937
SHA1 c0f0205aab62445add7f982e90a94cf7f413afce
SHA512 c479ef894d4a49111a693a7cc6e457101e39bf7183515980fdb42c1d13e66a074ef031fc0df2b146f5088330b09ca2dddf15991ef3bdc8140ac42ad66e0a0d0a
TLSH
T17211C4D53D294A02484FB4705AF84CE7CCE42F376885C12A20AEB84040BE31EA0884EA
MD5 SHA1 SHA512 TLSH

MS7_7.png

SHA256 5778de84b17557b66270010b5bd40e36c4a8078dfec09406df050d7a6ddb95e5
MD5 889345d41eae04ed6a944954e88b7899
SHA1 bffa2c04054ca31e36eef66ed2477b6fa96863a1
SHA512 1078bd00dd776f9c500a0118fdc124c40fdf7eb4c1832d5f93205cd6d6c5835ded67cd29b0ce620239741175c328670ab32533a2c0af702a21ee9021f45ac1f6
TLSH
T14511E921BC106D58B4162A1FA7CF555688302C684164CC93E98930D0B2BDC0EAC84A87
MD5 SHA1 SHA512 TLSH

MS7_8.png

SHA256 0740f5310c8abd850910a3cc3ed8b52845957e9323c87b89abef797c0155ed9c
MD5 293cd67c3464223a6f119ffab1904998
SHA1 bf78125929e993184f4403334f2858a557a0be67
SHA512 87f7609f5e0990cb67fc80cb2988e0d670b42ef764e29a8b76ed1f05b8fa76b3ab7f069cf40036e907947b61534498485099af4834584a4eef103541440ab8f6
TLSH
T15301568723D829EE87931696D25A9EA0C0151E42069973913689FC76E57F594009E741
MD5 SHA1 SHA512 TLSH

MS7_9.png

SHA256 d0a2b6d3fecd083cbf8aace4abc8aa79e4e210dec1c2fd3fb223f45140f8ec0d
MD5 6261ee9c3cd24be1e6dbefd21c097cfe
SHA1 64bad37e437caef488434e99ac2a57ba9cd3b5c8
SHA512 c50ca4d64fdd82a0628305000a67552497d667d79712dd3a509714281471dadd70582c29bccb49b7f5c55201057c64657379e19e6d2daa18a38f9fe9d5503479
TLSH
T1F821B4E753D6CC6CBB02288641110F4DDF087C1874B72F2D8E8AB43AB079969828F282
MD5 SHA1 SHA512 TLSH

MS7_G.ini

SHA256 aac280cd90a9bd67e012a14a35027258a0bf76e8a4bce68253117869c82d53c4
MD5 acdbd50f8a3e06723ba5517acc9d3258
SHA1 435cd436510f7689b6796af8a0d39eff024e2801
SHA512 fcdc74cc6eb581eca92481482baa1d86ce97bba8361e3061c980f9e2000d62de327c7c850b22b46cf1518995433ddfc58f785a32cf990b8c74447a8fa6b749d2
TLSH
T1E851BC9E25B626AD915775253347C0BB2B62047FCCFD3D80241E01EE2771A742BFA5C9
MD5 SHA1 SHA512 TLSH

MS8.ini

SHA256 23b46dcd2fe1f19831aeb1e2df57441dcaa185f31794f1ba704789dd539ade33
MD5 d681d3c4f9d831e04ca4aab5271e99a3
SHA1 5eebcf69e4a52913ab9ebbc995be94bffcefaa23
SHA512 ecb04a424f4ceae1b574171a5c76bf1f7b6869ba95de89651d60bd676eb6bc8380bae06a2b0a525334afe9e7637e2c9200b4e17ab7d7222cc9a6bd796cc85621
SSDEEP 96:qNW490vn0y4JjM+J+nzvAUyj2JM3ei4WhBlWMdWXoWhyhWNFBWo4Wz8W0tWVS:S9Miii3pL03/YgLA037Q
TLSH
T10CC1965F1F2234D8A446B17F330A88E7266904A7C4FEA894486F05CD1915A38ABFFDC5
MD5 SHA1 SHA512 SSDEEP TLSH

MS8.png

SHA256 5020da4b2f1c798026bcb5b9156fe8345e2ec6efe17a36a4cb36e4afa1bcb4e2
MD5 b6e4629e00d7e1093cfe114e638a3705
SHA1 8185cdcfb098b505719dd2951621c303fc4e9b2c
SHA512 97007c58b661239b0098ee53ea145097c008cf837027dd3ed1276908f665e21cc512f32874ca218f0bbcf782d1ff1e51211e548d9adf9e3137f6f254639350d8
SSDEEP 1536:rbSYFWDKvr7+icVL1vqkAxLNyigCn65xXMX8:i4Wus1ykOKCnps
TLSH
T1CC43E066EB685C3929AD0C8CBF57C88D58085E49CF1F8C615B80CF68FDE83963C495E9
MD5 SHA1 SHA512 SSDEEP TLSH

MS8_1.png

SHA256 7361ea5d0a06cc6e55fda23eac1ad4137649d482de9836b7d26653dde12de2b1
MD5 235cabc5fc71a8a5a416d4387a9964c4
SHA1 3e2fb094d188548f5e326cbfe9b2bea631fe1a3a
SHA512 19e14463914331675b113ef0b9680860d13395167f5bcd6c335701e1f0b1313b565735585ce152af30db30db812a85f6647320af894b339b1c8ceef969b5acc3
TLSH
T1C1413D53309DE6111C6180384CA66763606BEFA6CA65A0F9A38A7E972E7502D68233A5
MD5 SHA1 SHA512 TLSH

MS8_10.png

SHA256 f7a97198811345bca7b030d0dee6253849033e6bee55837bd942599fcb99057c
MD5 80ab3f4129bc0503cdbc475c6b00cd97
SHA1 23bb12b06d1cf61b1a5f2e9e9c7b9e138fe2ce4c
SHA512 b21c908087942d796bf90a03afe6f1cb0a1efd95d9c4b56b5f878a1d42adcd9a7cc85172bb393d479bbdfe852b252d8f5ed87fdc7e79e1f37bc9db370ca79b6d
TLSH
T16A31FC46E3D99D31C34A84FCF3E2A427DDFD1C8953752A4947567076C1340042B5B45F
MD5 SHA1 SHA512 TLSH

MS8_2.png

SHA256 b51e3c17cf5ee6d384c560fedbb5466b206d88ffa85bedcf85473be59a64fa17
MD5 932c3e2bae8204951dd9f68a1ad72dbb
SHA1 d40d2e1bcb2ba1a6a62e6cee857ebf3e2ad0c88d
SHA512 a34bdfff5af3098c4dc87574727270c61c09933695a53712e88876cbfb256cb4da6de3eccb19a76b9ade10e8c5317ae794d2761e23fa85dbff38c073b00ef278
TLSH
T19801284153B1DCEC5A457034356314305D4D6DDE2660721C651EFF6571BA2494545BD3
MD5 SHA1 SHA512 TLSH

MS8_3.png

SHA256 91441dc66d0f315ae7426d87ec98db77dceb39c0a8e10e731fc7ce5afaa5841c
MD5 4e7be96be25c1168d9c04fb4a3260a76
SHA1 633bf6dace7253534870f395e712050b08eda8f7
SHA512 81f95635c10e58b350788ff1cbb01d5c6ced25e372264eb213f055a051b7016d7e2e6c0d38e0af8c5f7d3fe886d35d0edd3d2a0bb47a976e804d44d5bb0af4eb
TLSH
T17311B9C5B9507CD19BE450590327DA5D5C16AE563B89109DEC27F6A0183BB6CD302716
MD5 SHA1 SHA512 TLSH

MS8_4.png

SHA256 684414665c3e7df38aa21b918bada202ebed19e4899530c3afb4ae38896b1cd5
MD5 74d897f706c293adcdee66e8ca5a31da
SHA1 50fffb40a8e5ae121de89fe83c1f1ee27622b086
SHA512 aeb48fab7f75c9755b9d3774e3bdb3eac3451c551722ce52f0c94dada15736c3d78913cf2f310cf2c2c8701ca4b976d70579579455c80d2878c2cfd0391b7155
TLSH
T1EDF0A353264D642DE05FE73013DA4D7EDCF4EC4C285D990EF15A79B2447E583A190389
MD5 SHA1 SHA512 TLSH

MS8_5.png

SHA256 b500a6cfb5e645bd7d345caa38ecd37195f95c327ac244edf248fe25cc743533
MD5 7d94b85e2252f641bc320c32aaf9f31c
SHA1 519e6367ae217146fb6fa9234ce4d944ac4e4170
SHA512 e386d2b47cbcab235f6366696ee9e462e6d2dc329cc77764556500b229eb7f231eddf5328082fae72906c235d7479fee4c6c3234f77a7aaac9928b8a5c4647e1
TLSH
T111F00EC982809582242D906207158546DD292CD988E18782F16CFD320A3EACB92F82C8
MD5 SHA1 SHA512 TLSH

MS8_6.png

SHA256 360e1aae2d7dca2d31fad64fbe02de391b5c7d53d300995314674405d3dd0a40
MD5 076eab6cc0e809ee6d1c5660289a99af
SHA1 dbe2b15892a4831fe5658f3b0bc2012becde7e17
SHA512 433fb6b4b53af842e6bf0f64ffbaec501347252c3b1d5de8639d69cc48eecbd2e1446e9850403a52c600637951cb86e4de7e5bebb72a17e817195cb2e125815b
TLSH
T1040194E1AD00804DDC235466314D91C67070BF4FBA999B1C529EFA0D0E3A803B0AA38E
MD5 SHA1 SHA512 TLSH

MS8_7.png

SHA256 f64d65f08c85e465e2223d5c5407d4e9a5f951ef4bb86eaee25d104e752eb2df
MD5 37866ace0f1b6f36548840428c3f5e9a
SHA1 e33353b3ede89ec798c493c84f1628e9f6b3f389
SHA512 c465ee3865fdf2155b70227862bb7e76e6a24eef7ea4d38ff78e7cf0ad0100f5644baf1c9b9ba05f4acab60cac1662c1ddc9da509f6264e47959f78a4d2a8c2e
TLSH
T1D7016557A350EA55E02C8E3B1ACE9912EDD57E5F4165820C494CF90CA03A143BD0D392
MD5 SHA1 SHA512 TLSH

MS8_8.png

SHA256 32fa37ee459f5c9bf7c45da1d391d61b181a185aecf1d376230819f37fe44f31
MD5 3846a3c66cded3e6d691f8dc3e47c62a
SHA1 3e9127450a24a8ad1ffc38eeeb4efc65c96c3db0
SHA512 ec6a963251cb6e38372056b92bd7b03cb379079efb88419a76c33df8a9b8fab963c26df8ba65a84d41a886d91f51488085e45c6fe7aef583382390b394be1026
TLSH
T1070165C2F02E5C31DA4546758309FC1D6B538FBDEE8361A9E689389D00BC14AD0912EA
MD5 SHA1 SHA512 TLSH

MS8_9.png

SHA256 ce0718b4bf06c727765d1a593d70d96d54f055b3aa8384d8663fdc95a2b71c62
MD5 91635c9ab520f8dc9adbf1146f56b5f4
SHA1 97bf341dc8f2b0b92985b27c29e8d51e8c97be72
SHA512 fc6b03949ab377f1b5874fd408c2f9da7cfc473af6de8b38b62cf5632e9c85b7ef92d227a553c0adece6c0a97c78ccf32fadc7bd5ead5915d7a09b4b615176dd
TLSH
T14C016A9E20E192378519449D5307E1B0457C2D5217DEF476C775BC2F607E217F0C0754
MD5 SHA1 SHA512 TLSH

MS8_G.ini

SHA256 ddbf09826472c84dea57087df9b81e784a6775c6985e45ca83166101a7112de8
MD5 9c2e1c02a96f47778f7495d99adfb007
SHA1 76bd8be3da661a6ae43fe79f1c7601bc394b6ed4
SHA512 b754f049202b697b9b2a5ea4c4134b0401197d59154abee2b44ade87fbd6f3521f92eb938350abe9da66ea59dba89320b3afcad32e743c0e585609a35dccad47
SSDEEP 96:qEEmu8OBHgyoqlOU9FJLMk4z08DSt3/3G5XhrlXMKy5XXcTXh/3XK/VXNKEXoTg4:Lu8SF9N3K9FfyxsrRHWV0eAyURn
TLSH
T189C1BB5F0B2534DCA057F07B330A88E616AD046BC4FEE8A5486F08DD691663867FB9C5
MD5 SHA1 SHA512 SSDEEP TLSH

MSE.ini

SHA256 d7a9ef3712b81d4b0bc6f5140ff278fb323c94430b0846a4c78920105243cbf0
MD5 48f522e214adc4717def49388aeadf79
SHA1 6b698bf347444bf07efaae9b3b37a2575eedcdef
SHA512 9b179233b0840271837036f3e4ebcc750c42c21c846b1eb299fc33493f6f4ebae399fdf07a8b77cd8ecb84c01d4c4a6bf87f222a04ac9d81b1836695d74e276e
SSDEEP 96:qOITKFa2iRMTaac6cezRRsnFWyKlG1J9l83ur5hO5NCt5oR5VX:WWsAGT0uF00/Ql
TLSH
T10891A71F1B7539DCD457B53A734784A72B6904ABC8FEB894241F019E1B20A386BFB8C5
MD5 SHA1 SHA512 SSDEEP TLSH

MSE.png

SHA256 cfe0f506a5e5dedc90f3a544a74188b6ab743df8fe49da41c9d82b80367eb37c
MD5 49edc52c50f657e58105c9a87a3674ee
SHA1 c91c4ae04e8e841ae1ac026a36d6c02f6e18a5e6
SHA512 8e7383a53ee0c8538736310eeee78df96a8cef3b1c3d4864803703b7f42740ac87e455005bdf334adf883137035f1e81235fe7407db558de2d00448bcf1dc934
SSDEEP 1536:TjghwLwBPyEBLRBJe1rPu+q6RoFNExu+oyvMKDqEytWyT/:T2fBPPBLRBJIrGymFNEx9kAy4C/
TLSH
T1F263E050EA3DBE3B59D96CD93E9BCCED2E006495AF5F86819B809F10CDCC6863D001E9
MD5 SHA1 SHA512 SSDEEP TLSH

MSE_1.png

SHA256 5e7d9754924d461045b8c5e18195ac4721ca96a2e7ec5493ab27c236985cfc70
MD5 03e100b663f1666041a1d4df586228c8
SHA1 29a492dd29d4d070269f093ae933cfb77841f1f5
SHA512 f8fd1ad16ffba92a13c6f545fa7a9c94e0a354cf30bdae92519cda4e8de4761e171c42168fc8b786286a3c0611859df67a360890f608d9f6e6a54058aed8076f
TLSH
T11E816CE102EF51093E7AAC0426BAA8C5C1948C1D2CF115E1908CF878B2BDE6732F526A
MD5 SHA1 SHA512 TLSH

MSE_10.png

SHA256 daebc75e610324c13f81845cc27755c4b85687960aba5ecac0783407ab492005
MD5 13bd9c0ea52950d5194b701fed625a63
SHA1 7240e09d0dcd68857454df0d14737ad2dd57e2d5
SHA512 7a91616e6f5e82753de3584c6d1e4c402672d10a16aba7ad09b0df144ab8cfd054e42d69abc98f0fd70daee93fb9408ca7566e7d253abe5cd83cc19a07b930bb
TLSH
T1D8219392720B992D688FA2B9238A1484AA7B3D1ADC28104EE8047EA4353AD98E4C0F01
MD5 SHA1 SHA512 TLSH

MSE_2.png

SHA256 b4dc3b6dbdc547c374c7f9acb118dc2f50399514c1ff715f213ad92ace24b684
MD5 2fe28301cf8966f81a05790d4e4e6eca
SHA1 ff0ef57e241843896e527e2e545e1e06176bc028
SHA512 b422bd8f2fd79c92be76b6c033f75e1bb95e71de8ef259a6ceb3dfe8e7a380624e0899e3c4cc6aa7c8e3d842d8941fe02d2931b3c4d4b6383ea3247e2565bbad
TLSH
T12221DA6190B215168F0BB9A137C64EFAD8744EF63C4540956208F54DD63EB8DE016EC5
MD5 SHA1 SHA512 TLSH

MSE_3.png

SHA256 3a2ba30486cc8588a41a16204fb6bbd63659e0e55a7b919179298ab1b959e5da
MD5 9fc5950086c8f71b63e0852ae2e58eb5
SHA1 6ed21c3cabcd0c8b3522aa291d1f898175f1a50c
SHA512 9a03a63447801d4bca19431615d385fe268d49cb1f8d76d5854c8c3edcfc68769a66525b925c8703064d6656391193eed27ac2a53da039589ae7c3fd6ca0b408
TLSH
T1B721C5D334780C1DC68728E942A55F60BC316E9948437B98AA3CFE3E20B195A9A477D3
MD5 SHA1 SHA512 TLSH

MSE_4.png

SHA256 cbae8571363feac44160d07de7971052dabf6d3e182f42c6bc461de65d4b974b
MD5 2a7621d83ed9c7d2ffe9032e84d76937
SHA1 8b0c893f75f4d00e6d9459da03a0385835388b1c
SHA512 a87b81f94ba720b198a8f1f722950579c1d0b97851ddd0bc44e813ebb05c9eba9422cc9fb2e7e076e894b8cc99919a329b6c09a9d0c2ff1058598b3306351834
TLSH
T13121A77916926C60B349D8665B1F229F6895CC09E19BA308519CFC2110352814726EEB
MD5 SHA1 SHA512 TLSH

MSE_5.png

SHA256 8bd1ac0d31b67e1e473c367737f26bed89ce981f43b88a354f172d2deabe7cea
MD5 b03d902fcb14f45a39588e06a7ea7f9c
SHA1 ffd77b941ec4d88980c2de7af3a98f2b4f8c81ff
SHA512 4d053d2b65d97783f832b260e9ba5acec38604e17364e279beb338fe4d3edb2e1ab88ceac4d518ee0ca03432aa1680a82012f42408744ebae56ff0300a60ad19
TLSH
T17221A5DCA0FA3D3FC0166C51693A517849D90D1844D26204FE97BAB007374B39796995
MD5 SHA1 SHA512 TLSH

MSE_6.png

SHA256 a61223910e67bf775203e8bf68bf803c9567739e11f69804eb541c59a94a2933
MD5 3556f300a698daff7238e2be9cf18b5d
SHA1 0cfb874062632ad87216fda35258b7987bf388ff
SHA512 f6f97914ac8bc2f2e47e997ed1e924f999925e14ab72ebbe03a9296fb16fad5a00dfcaed0dfca67187cd1fe4a4890e3069c44ddf10c48246174c60f441c5515a
TLSH
T17721E7E73288BE64DA9CC17510D3C321CCD1ED782AF4891D502CF4BB9E7D0A8B222263
MD5 SHA1 SHA512 TLSH

MSE_7.png

SHA256 47273efe143dc48ffe13001bbcf66e544cc3f1584590d01c1f13aa140d060744
MD5 aadb9c710d90d0d3b5f235b9020495c9
SHA1 18330bb1c360a3a25d29c33433f95351c3af1f09
SHA512 9385524af898bf671f4f221159c376e484f53034cbf9d6ab633eb0bd041f8f2de799eb9bdeed113826d1fdf4fe0ba24c3c5b19a6639352a560c88797b5afe79a
TLSH
T19921B73052B2E2F9853BD19F33AAD4A664E00FF94BA24D43213ABD1542BA2003415799
MD5 SHA1 SHA512 TLSH

MSE_8.png

SHA256 d6d4386b815d221d14f30efe832f201002d74085689f58f6bc790d93b1c74ce3
MD5 cdefa7cb0b4bfb5fd2bbae6beaad41a4
SHA1 4017bb0f6d37db3c12bb55db3e7733a4b5e06e08
SHA512 cec500b493d4bdb6207d9375ad62417a2be23d48829e71d290aefdd27fbfd4a15faad184a866df71f60529e0e741e8502b63e01c623699d558a2873a85aaa465
TLSH
T145116376B90B7969E84543D1BB1B2E0199304E7508F34E9C82A874234AF957CCD16BD4
MD5 SHA1 SHA512 TLSH

MSE_9.png

SHA256 b9d03b81749663e74f309cd2b0128a5de6c6ea884ca3a48afd78ea23849cc76e
MD5 298aee8ebd545cd7a6762456b360bab1
SHA1 a90d36fb1dfaeedd15537040790b564b85b31c4a
SHA512 0dab82fb487f6cbab232cc1845b6288ef99f92415c9d559e71ceb43accf0e35b2335c78b7f0a6c360d077e9e1c3a6d2bbae798a669dc25395197b46f2536fd5f
TLSH
T1D031FAE170CAD65FDE7A15A07160CD040B6E7C15363B09074667F838957767FE104C27
MD5 SHA1 SHA512 TLSH

MSE_G.ini

SHA256 df28c935f0625d933a340bebbd686a21d57da94ebc949c917173718ae2799aeb
MD5 1c524b7015ce78fac21d5ff64f174037
SHA1 370544d5783491408a064a1f6c300953cee6bd33
SHA512 7a8b44b58429bbed9a04299a10594f64202949c4b18a097b41f7fae9e8dadb5ddaac4e62ec47ea11d87fc833aab0e3e5d599f1bbd931bac9aae13f16a6008eb9
SSDEEP 96:q7+SBHGBld6vSu6FTuojMKaHz2RsQGvkJo6tGs09lLEhM7eEMp7eEXFp2EKGpmES:AeuIsB0Grcmjkj1JDttaeddqU12
TLSH
T1A7C19B6F0B2535CCE192F12B374684E5276904A7C4FEB5A0286F049E1B6167CA7FF8C5
MD5 SHA1 SHA512 SSDEEP TLSH

MSF1F.ini

SHA256 f89a5db74fcd53eeed3557dd5e1a5a1b9a844bef3a1ecbbd0e9cb846ec659082
MD5 ab7e553420fc8008e32526628e6f7534
SHA1 1d39173f8099ef59626b852a1c2b34722f151444
SHA512 ac3a47711b25ffcf51b6ce4b74f21a09268ffa21dd51dff971bceafb57e71b9807fa92a3daf272bbc6814d6928361573acacf7b02cf909dc58759560da1cc86a
SSDEEP 96:qxzbHBtPsoteJhqFoUykgMdz0BYLHlNiKMbDKXzgKh+MKKIpKNdjKoANKzvxK0S+:WYnqmUXzLFRs2jxMdvYTW9MjAekwF
TLSH
T1E9C17A5F1B2438DCB447F66B370684E6262D046BC4FEE89449BF04895C616396BFF8D2
MD5 SHA1 SHA512 SSDEEP TLSH

MSF1F.png

SHA256 9470a1cf8baf775df9f7214d755a95131af9845a0bd2696e54d987b9ce87a648
MD5 3452fdfcf6aa4037008a060afae3cdc1
SHA1 517c75f9937bff0ea0ccfed6bfa8e6e0b4a88872
SHA512 a8cd359193a4737c5d94879431e475e2c5d2783ff17f3d1dc7f8e2f677ec5c57d6754966d11c8a558c04f1de849103da70a80c3caed44da2a574992176241c1a
SSDEEP 1536:sPZt1aQnVU6FbnbWwjHxF1sj7xqTgSOqS4ihwZr:sPZuQnVU0bTHPSVqTZshgr
TLSH
T11B43D0E4D1B7313D7AC92D0E7D62E6AC5A884268CD0F5B305B428E19B4AD7C3BB2D1D1
MD5 SHA1 SHA512 SSDEEP TLSH

MSF1F_1.png

SHA256 34636ca6f8be51021d0265cf5c671250e1f80e2899b4acc5a5e47a677702a8e8
MD5 38a2b03dc0bce46607a4139b5c60714e
SHA1 645de5d8b9e40838055292e2d458acdeaa5f2e95
SHA512 6bba1f3210ba815cf937371472467d977b9be5ec1bfa0aec3e363a46939b76de6a16b8b965e557a42a289bb33c1edc256ef48c35a9531a1aa560de9bb8001a95
TLSH
T1A721F8862B3615C0CF5208D047CB2B248A3A7E2D08878DD86613FC7A4CBF79DE54158C
MD5 SHA1 SHA512 TLSH

MSF1F_10.png

SHA256 4a4844f31b0147f0cd50668c4dacd44505ada5351772f6a7818beeac8607b03b
MD5 0c95abdb2284775517987e8d64157f73
SHA1 bdec485a0604344c50c366d2f4673b0e52efc301
SHA512 11fdd55b36c36d4e27a0896074ae1c0ef08c151522c469237d7678f82e4529cee04909fcc508f30b0a261dd95eace9c9301bdb506f2b3211201d1b859ba1faa1
TLSH
T1D3018611B714A188D61A84744A624D53C8992CA85FD045FE6CC974125CBC883E02D611
MD5 SHA1 SHA512 TLSH

MSF1F_2.png

SHA256 8c135a3ed0af4f79c2f485f384a3c69367cd8e2c2731decbe100ec6ad690f84c
MD5 b3b7e58146bda074c4710542ad4fca16
SHA1 3bc0d28863817226fe132ee1551061b431451907
SHA512 dd23d4f402d2103a5116799e4c0e6078833edf1041f86096623996e81d34475faef2462625133a2271c4767f2b503e94ef890e83bdd931444b6b1a3b00da34b8
TLSH
T18521C6B24ABCB681968584CE4DC593ACD3A30FC76737022A216CBA013CBB1808AE9245
MD5 SHA1 SHA512 TLSH

MSF1F_3.png

SHA256 530118c41fa694172b135acf5d0848431b4464a5193b29ff1573994aba69592a
MD5 a399972e01b79dabdd06f45b83492078
SHA1 1433595e6f44c1bb1481c6e0428aa8ecef3d45cc
SHA512 43315dca1f85a58ee34f3e1f5c7f6d3d211035ad08cab2f185287fd815fd0600fa1b1a3492a813a833ae1d0e2189a541a2a0d47ae67cc129b4d6ea8eafd68733
TLSH
T1C811B3C3C20A2CC4CD4FCBB22F5E541DAAB02CEA1E510B51641EF9201474242A8F0AC0
MD5 SHA1 SHA512 TLSH

MSF1F_4.png

SHA256 f19b6304143805a136324896e5062a9481d6a787ca24db44f0acc3b94e1c8ed3
MD5 c9265498630b9609bcf4fb394cda1501
SHA1 342cf73625908beab1e95a9e7b1bf877b1deff7e
SHA512 8d3e19eafe3f4d0d190a8c74fd06990a75ead8b52056a0f7f6233fb923376f943460adcf4c2fc05bf6c4a90e010a155d35b8104e34ba36ed31e22a67ac859601
TLSH
T122F0B7F47660540CCAAB94B8A78353B856718E712080730C622FF876B83EF0E9F413E1
MD5 SHA1 SHA512 TLSH

MSF1F_5.png

SHA256 3ab78a74b7820d43252f60881e5569643c7119930d7cfd57f3f580f4b2d168af
MD5 77bc008848e5e5cc9a27f7fca3e1b7d0
SHA1 42f2d0c7f6286acd2cdcef004bbcaef05cbd3583
SHA512 974c33c7df4be6946840c06405e99cb0912cfbf42a80d3f2f51cc81364dfc9a2bc6096fa1bd54f2ee08b3a6ec23fb7b0a70d74823e0506585cc1188a9417553c
TLSH
T149F062623AA18234E856E1BC8332A7500A2E4E014176004CD89CF6BB0E7F1F3848C247
MD5 SHA1 SHA512 TLSH

MSF1F_6.png

SHA256 ec52abae3eddfc4074d35ddcdf422a915572a9e7c870d720f1051b627d79596b
MD5 c3deaa2904f2acedfdd7650665088194
SHA1 111ab1056c3eca563557c8c16a4b3c361fd4a4e1
SHA512 d3d112c58bdfe5999900bcc09d0cdb58302845d5337c8ea881aba218e9819e33871e2818cf2bda009fc0d50c54e6822332175ef5ef74f223d91d5b6e269d73ad
TLSH
T14811C8A467EDAC42C6FF7F1446A7C8003FDA0FC14798053652983C21507E0CA41317B3
MD5 SHA1 SHA512 TLSH

MSF1F_7.png

SHA256 4c86a3eee3994061f52a20768ea6cb99ee95d814e264a738e5dbd2d369926c43
MD5 9c574212661b4cc831bcf3ae80e55465
SHA1 b1ef9e688e4469b7767c05e42762e0cc30bd986c
SHA512 04a7d50ea17b8d8a38548b6dc64fd91b375e8b7998659ccaaee55b7387d4cdbf1b9472def4b34f64a164b4dd4d6cabefffebe002c2aab202fe43663f474042bb
TLSH
T104018602A4796C11C8DE986BA3B7607C783E0E553E4A47C6ED07BCB2B0301528335F68
MD5 SHA1 SHA512 TLSH

MSF1F_8.png

SHA256 9ba437970712560e0500e75cd3238ae01a740e15747b7997756d74670a7ce31c
MD5 932e7ab5e585e1dafc764d6e6f6ad357
SHA1 32d9e8365698d5ec580bdfc11749ecc4e3d0a06a
SHA512 48864fa61c77c6468ec4320999319ce85178bcce032f2c1e12df06824a0e6222e78615627b2fcf4564d1b65ebb18d4b669dc599fc2824f256c2d6f0d9bf1ba9a
TLSH
T1401156D0F2E06608AD560B57034D0126FF85FE9562BD1D24C4AE7E790674B46C87A352
MD5 SHA1 SHA512 TLSH

MSF1F_9.png

SHA256 f0b42b5997ec7990dc1029d41f3ccd70552be9f8ddae1b26189d799d831e19ab
MD5 21c3aa26cb1f320ab680b15ff81f7eec
SHA1 6aa2ecd7bce1dc03d89b2429502db462d2cc1f1d
SHA512 c54e4624e8cbc0e5c86f50568eafc5fed14c7f2537c84ee57db54475aafa2e0600df17bd2f59fbbb6e1775ef5eecef5ecbe2db223aa3de1b25688a23fc093884
TLSH
T1310165DB34877C04D4664076564538754C6B9EA93C624D9D842EF47E313B3864585692
MD5 SHA1 SHA512 TLSH

MSPRW.ini

SHA256 19f038343e258c706d6aad9fe4adaeda07d3d0bf98f5fc8c49ded9dcba790e50
MD5 d85325278c3fead60703571047962d46
SHA1 ae33c1544836af9c21c8e059fac98a2c30ef03ec
SHA512 6035336a65f60a59baaf26ce01a763fb3b90aa17233861a69959cd29758705ed5921e866e00ced92d1fcb2d2f699a86fbbc12117cab6cd42de279b5c189a7f7c
TLSH
T10981DE4F1A2A75DC8117F57B338B80EB27A8057A8CBDA8C4585F06C91621A3467FFDC1
MD5 SHA1 SHA512 TLSH

MSPRW.png

SHA256 f68ec92cacf935c1cf509c1620fb91b4fb1207d6bfbe2f6aed8268c8586c1a1e
MD5 f4c6f2e296c3dd63c913fb4ddf2ec663
SHA1 7b5249d60a438264f6f48e1fa9ecd1ee1a361dc9
SHA512 6dfe0aeae9025abcecf58805002596d59c91a5296b2430bedda428186cc14cbc9f3925e66acb6d71f4c909ed59b246a6e0a9fafd6e30712206e3320eef183ab0
SSDEEP 768:B+qLBhIIQux4tAmYSvu8UrUE0towbKXd7JtdLcQudrTU8awItckc7G83qbgN6ySE:BVhhgt5Huazqd7zJcPdivc7Gtu/S0rl
TLSH
T12833F18AB1DFCB77F96085EB07738AE8119B7928167FABC1D381F4DE91027D11181163
MD5 SHA1 SHA512 SSDEEP TLSH

MSPRW_1.png

SHA256 5cf65277377a247c5cd28ac8efe56ca72e0cc6c139a1eb37dee0c993851f4855
MD5 a34131fb573d9fbfd13a2382d7bc0ca0
SHA1 a74c02530ad0255b997c55c686d933db2bf841f1
SHA512 7047dbba1aad635a0d02209a2e1e2b70ec4f08f76c40fa4f63d271120fa469ade6c720782bab3fd94d73af1ba6452ef65a774e62c136f70d77090757efe78cda
TLSH
T19F817D86F07CE3B5B893A8918646D01117794E2ED62FC9F56449B0563172B49CFC9A0A
MD5 SHA1 SHA512 TLSH

MSPRW_2.png

SHA256 941f5e6d8d8bfa6e5eb4c3caeb5ecf11a399d3e76d3f689d3abf8912254c9aea
MD5 19ca01a49090756388201845fe57bd0e
SHA1 3966fe344f398b316a35c2b9dec5f63b186a71d8
SHA512 e2f2bcc7113991e0ba0df1564a0f51df8a5bbe43cf9f7aea38002853ec49b08147ba376d59f299f2ad0695ba4ec37347ffa42b634f3c7b44bc51f227d4181fce
SSDEEP 96:cu7J7zzV8ZHCpjQiT8bNgPUNbQ42cB3BT1lSd0JGtjXd2T2nCVTkNTOZme6V1H8G:c67zpqHCOiT8uPUQey7t7d2injTox6wG
TLSH
T16AC19EC8B102FF7C644CA1D35DD15A7E45CC4CB41F965222898AB00B243B34AA83E315
MD5 SHA1 SHA512 SSDEEP TLSH

MSPRW_3.png

SHA256 f16ca151cadaaaea4af0f69a22f0365d3d21a5517646a062b733743ee033dda4
MD5 3da1b9efe546bcf4852c2c9d35ce6d94
SHA1 57ca7021cf1aef935bdc6ae5c54eb43a03229fcc
SHA512 80c05e2565d8c7687cb113f9c480d4ee208ec530d5fb54db1f6cb2c1c9fa33d8e57410c08b9c6582b64601debe3d8efaea300d4934ca9e207005a4e885f96070
TLSH
T1BF3119C723468819A74AECF28694C405F8295E57392500BC69F2F4B8E23C40092D12A0
MD5 SHA1 SHA512 TLSH

MSPRW_4.png

SHA256 64d5a9fd45b00f61f7ee6e4a13833f3488dccc7057709cb7ad1ca0c9a08ec185
MD5 21cf1daa6815a81825132c72f315d40a
SHA1 f8d8fa8f29200460733d971ae7daa2705a5b7dca
SHA512 20ad8c266712a1e66d34961f5bf5d9e29adeeac53763da9461eca0f26ab6bde4eaffa5ef9cdb879d39fb683f29e7d24aa9c24690d26eb3a968beaee1f0d872bb
TLSH
T1E321B8EB7D5A4C34558C76B92B3BE400A8554D4FB65E1D641C677819107C70378923D4
MD5 SHA1 SHA512 TLSH

MSPRW_5.png

SHA256 afa5bc7c2d947a3aba249b0f21c2e54ba27fb7ee9a1c81f8d6ee8084fcd84ed5
MD5 4a21aa9e84757af80171a759f2cb48a6
SHA1 920f111e2750445b8422fcbca51ba9ae06a8be85
SHA512 1fc604f5ee720de1de6caf9f8ae71481fb5840ffb7fbaa2f6b4d570b6c722451bbf0bd6351c231187cd782a9418038840a37002ea0ecb500dac739cb7a40fe64
TLSH
T16921E9E9B125D37E0C9260B6E34FD95606010D8D06EA841230B9F88487F5D15FE16159
MD5 SHA1 SHA512 TLSH

MSPRW_6.png

SHA256 6ea85e9ab7fe3041d3b01e7c2a41e414dcacfa9f20f1cd17b55626b16a03563d
MD5 8d5e0a32596501dadfdc8cdb3b5c4ba9
SHA1 e32dcd716d2bd0e05a67a1d7631d2e0e18a1bbe3
SHA512 056cd43196f4aa161119686e80bc8228c49d25d1ce409970aee14164c210a9da3d3d61b57d28c98c6524b227fe24bb58ef2784c76c04e81858a4ddf68f8ec56a
TLSH
T184212BB4B9A5E97C51EDE300402BF0FA5901BCCF4D9D0818409675B0F935647CD34F01
MD5 SHA1 SHA512 TLSH

MSPRW_7.png

SHA256 fcb8091f68f51a0a693359442384be49d61a585f99d9632fee6ef017bf78b1d9
MD5 d3b8648ba452365bcd1fe541ab3e71ba
SHA1 4a3e4955ee1c8adc0153556664852bba1c7ab888
SHA512 481a3ced2f7d0a5dcd0ef55c9e952856c877a77f263dcb73a59dbadd2679d905eb811b43f745db26b6a12e7e72d8a57305f98795a924ac7c1d22d78ae0d361a0
TLSH
T136311AEF77C224E5904F8914677130500CDECCAA874544602F2EFA4A9A78932890B498
MD5 SHA1 SHA512 TLSH

MSPRW_8.png

SHA256 e51050e4613e8ff833a094261ef6a763cdbb239b0cb65f9152cdf9af59d8c8c3
MD5 820777fcee84475f9965fd725ccfa90b
SHA1 e01109482e593894b26ba69bc9fe637e85c98c48
SHA512 947242c293e8ca2a6c4d05fdda9ccdd762a3ad4dbeabde505341d5ac4878b211298ba1a9139b6cb2cc0c5700495b157fcc18b277ddb71ab237ecab7f8e1d6385
TLSH
T1BC31E6AA7E9A2C63C8091071A4131EC87A39FC1EC5F0F80771AA31085872FBF064DDC0
MD5 SHA1 SHA512 TLSH

RaiderPD.ini

SHA256 dcc3ddde656f2f776569771aa74be69eddc5fc72ddc8f0edc036efdcc1c3e3cd
MD5 067998ce27e135acf653abe6e1891a46
SHA1 47ca350f7ba06f63186a613fedf862944c4f2a5c
SHA512 c444a082530c1241d633c43189d754bee7bae730043a39873b668950982ea7709847b71a65d3fe51ccacee55d80047a6e74104805f80b09502e056c163c91857
SSDEEP 384:gCTAqAT0Nj1djjSASgv7pfDTrFjUjAjWj0iHMAjiI6AxW6+qCGYcGx8GRClvXqvk:HAqo
TLSH
T1EFB26C7F5E6A74DA7A45E47F37C6C4E2682C14A2C0BEE942154F0A8DC94903687BFBC1
MD5 SHA1 SHA512 SSDEEP TLSH

SV-262E1.png

SHA256 56722850f46faccd86f27a01662a296d940d8b7e013867f66cfbc68019c3cd53
MD5 0e6993d1f4d8721fc3d3dd761730632c
SHA1 7348b5e71fbeac3d40c4edb770626ae6dc3ae2b5
SHA512 4fc0e361a9027f4bbefbb1a419f7a19b3bbcc1b8e79818bb7c286e7b5f2a1a53c6cd460a4601663b6e203a93e005a6b0c61b74dbe1ef39918d7da5077d568658
SSDEEP 768:U6Htxlds1wGKLPRlZ73fC5N487MT87WI7ngcasV/8Q7oV/+cnE0ovxpnxJVk98LF:JtGaGIL9Cf48oISI83sJRC4g8LxD3n
TLSH
T16633F1E3C1E755E89686C0ED7ACE0FF5677D39D897CC28990B406BAD58C0B814A93383
MD5 SHA1 SHA512 SSDEEP TLSH

SV-262E3.png

SHA256 5c17d224f226d25e7fdb447cd0baf9620d1329c700b3206845ae93a03ced9523
MD5 6ad87fe53aa23c9332758a88d41bc77e
SHA1 9e26d20a9e5ae9ae6e13cd9fd6cee2df136f69f9
SHA512 2f3b5129490be7cfb2f599a9fafca67858614f070fa535d460bd8514a8598cf41c548059d57adeb144d18660ec89629ddb2445a0c80856eb798388065491e9c2
SSDEEP 768:T2M/xzjIQuvy1fL6Z/5jyXZzKmpyVfMRbVa1eFOXjdKHeqqx1OdWV8v+DNl7Ti9:T2kjZuvyJL6ZgYm8p1TjdKHTqwXvObq
TLSH
T1B233D044C26BD8456B1562BC3B621FB1D77F382853391C8046A6749FE8F9FE8A243C97
MD5 SHA1 SHA512 SSDEEP TLSH

SV-262E4.png

SHA256 90944797a975e857f69934758e85cbbe258a7bf54be1d441e30e6f670d793f6e
MD5 bb766076a2ec26491323c5d3f38ca479
SHA1 d4a228493f1fb62b1aa39ee3a9bb3af9616e762a
SHA512 610b19b6b77ebe6beec1734f06fc8efc1dd101009bcb86dc859d98a9dfdefb82cac146b7f272231d6295e551850dd8706bf6ca065ba344d4c70f03c933d9494a
SSDEEP 1536:W2UzjPoLAd7WEqBnV+8wLPPa9+tiWY5FGg7ZNhjxxxCU2i:WNOAIEqxjw7Pa9EaVN9xxxD
TLSH
T13B9302E3832C2A60BDAC66E77FAD65B38774903A2113B05B300E60B64875ED857F9761
MD5 SHA1 SHA512 SSDEEP TLSH

SV2511.png

SHA256 4bac16344f6761b442acdc1e53debeca0679144007311bbbd3a047a4cc5302c9
MD5 c2ae4c3ba0ed3cbe6140695972c94c87
SHA1 bc22bc1ffc3b055f138e4317cdc1b17c063c649b
SHA512 15a217edabe6b71d4875ab2c2d366c3e71e746a08f724d73703f6c6cda311303e54d4e5dc32c8ccc7dcea3e188d65fc1632571aecb89257ba69a77c3f494c214
SSDEEP 768:eHX13Acz2+1AV5amIi/SVJTQpuXT1Iqb8DidlB/rfNS5:MXB/z2Frx/8RQAJ9bDTVbNS5
TLSH
T15F13D087D0F6DB6D33DE80F667720F939ABE1C5D544E25F78144A68F68266E168002C7
MD5 SHA1 SHA512 SSDEEP TLSH

SV2512.png

SHA256 e2e4db6858829b1f3bb0f006b3c7f009591f31e10770815b8fc95f1b2d9c805e
MD5 08b87000db2f990dfbf2d3a7572788fc
SHA1 42f00690944a7bc9eabd87c6a8b16a3727bb3dce
SHA512 b9506a06cf32248402175aeccd10475b9a97e1a457292abd815b14c92997558f88390d45e88a05117b8160d6a29f0a8fe7ce6a10dc9528f2a85917374d9e8bbd
SSDEEP 1536:A7MfDX8dI2Sjsi/okFhEddM48U9WUKePLf/pFeemikA6c/WXJE:9j8dRUrFMdMdSPDp4vi1z/F
TLSH
T1C093024C8AB2E698CC9D39D12A27AC83D7FD64E34979F7F5D188146E5406B71F09208B
MD5 SHA1 SHA512 SSDEEP TLSH

amstream.dll

IMPHASH e81416c998ec81e16a6187579974e55b
SHA256 0e87db588c7740c7c8e9d19af9b4843e497759300888445388ff915c5ccd145c
MD5 f193d381bb6e9ef51c6bb581786aa3e9
SHA1 0ec4660ea9cdf8c5565da9bbea5f0c2881932e33
SHA512 4b792e63fce45fbe095a1e851cc1509625310ac132710e361176628665834b1bf504e142bc86928056ed5d14266dcd6bb7028869d02006910fdae1496cb55b2a
SSDEEP 1536:NsocrtDASJV15DlF/rEtAeLtFjolD+SrBT:Nsr5DlNrwARD+SrB
TLSH
T1B9536C1333EAC07EC6F39232892B379A76EAEF16151B511562113E4E1F71182DBFD24A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA QueryPerformanceCounter ResetEvent DuplicateHandle CreateThread MulDiv ReleaseSemaphore CreateSemaphoreW TerminateProcess SetEvent lstrcmpW CreateEventW DisableThreadLibraryCalls LoadLibraryExW FindResourceW LoadResource SizeofResource FreeLibrary GetCurrentThread lstrcpynW GetModuleFileNameW lstrlenW lstrcatW HeapDestroy WaitForSingleObject GetCurrentProcess CloseHandle GetLastError GetCurrentThreadId lstrlenA MultiByteToWideChar lstrcmpiW InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW QueueUserAPC

user32

IsRectEmpty CharNextW wsprintfW

advapi32

RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance

oleaut32

VarI4FromStr LoadTypeLi RegisterTypeLi SetErrorInfo LoadRegTypeLi VariantChangeType SysAllocString VariantClear VariantInit SysAllocStringLen SysStringLen SysFreeString

ddraw

DirectDrawCreate

msvcrt

??3@YAXPAX@Z _purecall free ??2@YAPAXI@Z realloc malloc

d3d8.dll

IMPHASH 501fa1e56f916a9f948d746c479772ef
SHA256 0a619df77235a3974ecdfc304558d78b7d376af879bed7b14f0b2afc840ac468
MD5 cb1f190ceec0d7d2de02bfefa6931b4b
SHA1 73a3feee9bcd7dd2d03c8662ac1282c0c066925b
SHA512 f96dd6ee58df6e7c83d33da0a5cf7581149815cf18adbdeabda8a388fa4564391e47c1b9cd29aac1c9e8d4c07a9f69a34638b9262852f8460be89769f06e4e6c
SSDEEP 24576:4IMhieJVAygtsF4x79Gy75Y9yO/2qWgxSx:4lgQVBrF4l9GyBzXx
TLSH
T182459E11E7AB00F5D8831670109FF7FBF3399F55822085A79AD4ED2FED7A692A035242
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

161257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3d8thk

OsThunkDdQueryDirectDrawObject OsThunkDdBlt OsThunkDdReenableDirectDrawObject OsThunkDdReleaseDC OsThunkDdGetDC OsThunkDdDeleteDirectDrawObject OsThunkDdGetDriverInfo OsThunkDdGetAvailDriverMemory OsThunkDdFlipToGDISurface OsThunkDdSetExclusiveMode OsThunkDdGetScanLine OsThunkDdWaitForVerticalBlank OsThunkDdGetFlipStatus OsThunkDdGetBltStatus OsThunkDdUnlock OsThunkDdDestroyD3DBuffer OsThunkDdLock OsThunkDdLockD3D OsThunkDdResetVisrgn OsThunkDdFlip OsThunkD3dDrawPrimitives2 OsThunkD3dValidateTextureStageState OsThunkDdGetDriverState OsThunkD3dContextDestroyAll OsThunkD3dContextDestroy OsThunkD3dContextCreate OsThunkDdCreateSurfaceEx OsThunkDdCanCreateD3DBuffer OsThunkDdCanCreateSurface OsThunkDdCreateSurfaceObject OsThunkDdAttachSurface OsThunkDdCreateD3DBuffer OsThunkDdCreateSurface OsThunkDdSetGammaRamp OsThunkDdDeleteSurfaceObject OsThunkDdDestroySurface OsThunkDdUnlockD3D

msvcrt

_except_handler3 _onexit __dllonexit ??1type_info@@UAE@XZ ?terminate@@YAXXZ _adjust_fdiv _initterm realloc _CIpow _CxxThrowException free malloc _ftol sscanf sprintf _vsnprintf __CxxFrameHandler _purecall _stricmp _strlwr wcsrchr atoi _snprintf pow memmove fflush fwrite fprintf fclose fopen exp _errno floor

user32

IntersectRect wsprintfA OpenInputDesktop GetUserObjectInformationA CloseDesktop IsWindow GetWindowThreadProcessId SetWindowLongA CallWindowProcA SendMessageA IsIconic GetCursorPos PostMessageA GetWindowLongA SetCursorPos GetIconInfo GetDesktopWindow GetWindowDC GetKeyState SetWindowPos GetForegroundWindow IsWindowVisible ShowWindow IsZoomed SystemParametersInfoA SetRect GetClientRect ClientToScreen OffsetRect EnumDisplaySettingsA GetSystemMetrics GetMonitorInfoA GetDC ReleaseDC LoadStringA DefWindowProcA SetForegroundWindow DestroyIcon SetCursor GetCursor CreateIconIndirect GetThreadDesktop

advapi32

GetSidLengthRequired RegQueryValueExA RegEnumKeyA RegOpenKeyA SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid GetSidSubAuthority InitializeSid RegOpenKeyExA RegCloseKey RegSetValueExA RegCreateKeyA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

gdi32

DeleteDC GetNearestColor CreateDCA GdiEntry13 GetRegionData DeleteObject GetRandomRgn CreateRectRgn GetDIBits CreateCompatibleBitmap GdiEntry1 GetDeviceGammaRamp StretchBlt SetStretchBltMode BitBlt GetDeviceCaps GetSystemPaletteEntries CreateCompatibleDC CreateDIBitmap GetObjectA

kernel32

lstrcpynA DebugBreak GetModuleFileNameA GetVersionExA GetSystemInfo IsProcessorFeaturePresent OutputDebugStringA GetCurrentProcess InterlockedDecrement CloseHandle MultiByteToWideChar lstrlenA WaitForSingleObject OpenMutexA FreeLibrary GetModuleHandleA GetProcAddress GetSystemDirectoryA lstrcatA InterlockedIncrement ReleaseMutex GetLastError TerminateProcess GetSystemTimeAsFileTime QueryPerformanceCounter PeekNamedPipe LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId CreateMutexA DisableThreadLibraryCalls GetCurrentProcessId LocalAlloc LocalFree lstrcpyA CreateFileA SetFilePointer ReadFile MoveFileA DeleteFileA WriteFile GetFileSize SetErrorMode WideCharToMultiByte InterlockedCompareExchange VerifyVersionInfoA VerSetConditionMask Sleep GetTickCount InterlockedExchange lstrcmpA HeapAlloc FlushFileBuffers GetProcessHeap ConnectNamedPipe SetNamedPipeHandleState DisconnectNamedPipe LoadLibraryA

d3d8thk.dll

IMPHASH 65917657454922a46020cb10d9070c23
SHA256 af4159a2d8241ed398c677ec806762e049561e0d6bf45bc036b19552ad3e83a7
MD5 d6e38d3cde17a05ba6304917c80d6d3c
SHA1 2e82a8df5668747ce1e66acba8f0e553ca6ecf09
SHA512 a81c7585afad495002d123126e90cf3cd081e6e9735f06679b54b26053ad58abbae065bd60d9deae23cb6fd19fb20173ccee88d8d15b3c4225b3ae88afa8848e
SSDEEP 192:E6vssJydHabRDNL4Rm0NSy1Wak6dWXWakudW:Eess4dHad52m0Iy1Wak6dWXWakudW
TLSH
T163F102C1B6E4BB2AE159C730C7BB050B77393412DC25C9F56C6C4B6925B270D87E0B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

OsThunkD3dContextCreate OsThunkD3dContextDestroy OsThunkD3dContextDestroyAll OsThunkD3dDrawPrimitives2 OsThunkD3dValidateTextureStageState OsThunkDdAddAttachedSurface OsThunkDdAlphaBlt OsThunkDdAttachSurface OsThunkDdBeginMoCompFrame OsThunkDdBlt OsThunkDdCanCreateD3DBuffer OsThunkDdCanCreateSurface OsThunkDdColorControl OsThunkDdCreateD3DBuffer OsThunkDdCreateDirectDrawObject OsThunkDdCreateMoComp OsThunkDdCreateSurface OsThunkDdCreateSurfaceEx OsThunkDdCreateSurfaceObject OsThunkDdDeleteDirectDrawObject OsThunkDdDeleteSurfaceObject OsThunkDdDestroyD3DBuffer OsThunkDdDestroyMoComp OsThunkDdDestroySurface OsThunkDdEndMoCompFrame OsThunkDdFlip OsThunkDdFlipToGDISurface OsThunkDdGetAvailDriverMemory OsThunkDdGetBltStatus OsThunkDdGetDC OsThunkDdGetDriverInfo OsThunkDdGetDriverState OsThunkDdGetDxHandle OsThunkDdGetFlipStatus OsThunkDdGetInternalMoCompInfo OsThunkDdGetMoCompBuffInfo OsThunkDdGetMoCompFormats OsThunkDdGetMoCompGuids OsThunkDdGetScanLine OsThunkDdLock OsThunkDdLockD3D OsThunkDdQueryDirectDrawObject OsThunkDdQueryMoCompStatus OsThunkDdReenableDirectDrawObject OsThunkDdReleaseDC OsThunkDdRenderMoComp OsThunkDdResetVisrgn OsThunkDdSetColorKey OsThunkDdSetExclusiveMode OsThunkDdSetGammaRamp OsThunkDdSetOverlayPosition OsThunkDdUnattachSurface OsThunkDdUnlock OsThunkDdUnlockD3D OsThunkDdUpdateOverlay OsThunkDdWaitForVerticalBlank

d3d8thk.w2k

IMPHASH 423fd2aec57d2beb55ba046748fc0345
SHA256 f85120b62cf8137ee414e470245fbffe2f80c88641cb10b7b8738880764407b6
MD5 1ca0c329e7ad6bce089a1f08eb368353
SHA1 5f0cf35c192efb7d94c612686446fed53d3983f2
SHA512 5669764181126c18c558760f8016a9674029b069fb43a4e9e4bbaee052582feec36c9c395b84141e77cc99d8d44ce61f3ed03bf93211168c3faca1f5e52423fb
SSDEEP 96:jrJBQjLoFjYL4R/fYAF35mqE0FHuZyYLEWak6dWwclWakudWw:vJBQ/o+L4R/3U0NSylWak6dWXWakudW
TLSH
T1CAE1BB41A3E57516F053E6320FBD150BB7F93403FD26C599E860AB281921B1D8FAEB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

OsThunkD3dContextCreate OsThunkD3dContextDestroy OsThunkD3dContextDestroyAll OsThunkD3dDrawPrimitives2 OsThunkD3dValidateTextureStageState OsThunkDdAddAttachedSurface OsThunkDdAlphaBlt OsThunkDdAttachSurface OsThunkDdBeginMoCompFrame OsThunkDdBlt OsThunkDdCanCreateD3DBuffer OsThunkDdCanCreateSurface OsThunkDdColorControl OsThunkDdCreateD3DBuffer OsThunkDdCreateDirectDrawObject OsThunkDdCreateMoComp OsThunkDdCreateSurface OsThunkDdCreateSurfaceEx OsThunkDdCreateSurfaceObject OsThunkDdDeleteDirectDrawObject OsThunkDdDeleteSurfaceObject OsThunkDdDestroyD3DBuffer OsThunkDdDestroyMoComp OsThunkDdDestroySurface OsThunkDdEndMoCompFrame OsThunkDdFlip OsThunkDdFlipToGDISurface OsThunkDdGetAvailDriverMemory OsThunkDdGetBltStatus OsThunkDdGetDC OsThunkDdGetDriverInfo OsThunkDdGetDriverState OsThunkDdGetDxHandle OsThunkDdGetFlipStatus OsThunkDdGetInternalMoCompInfo OsThunkDdGetMoCompBuffInfo OsThunkDdGetMoCompFormats OsThunkDdGetMoCompGuids OsThunkDdGetScanLine OsThunkDdLock OsThunkDdLockD3D OsThunkDdQueryDirectDrawObject OsThunkDdQueryMoCompStatus OsThunkDdReenableDirectDrawObject OsThunkDdReleaseDC OsThunkDdRenderMoComp OsThunkDdResetVisrgn OsThunkDdSetColorKey OsThunkDdSetExclusiveMode OsThunkDdSetGammaRamp OsThunkDdSetOverlayPosition OsThunkDdUnattachSurface OsThunkDdUnlock OsThunkDdUnlockD3D OsThunkDdUpdateOverlay OsThunkDdWaitForVerticalBlank

d3d9.dll

IMPHASH 73d6655fde8a7f7d4855db21d50a427c
SHA256 9f3c68a594c7f7b6894db388218a44f0954f1f91b8c308b83aa5017993e0f705
MD5 7ba80564f369a96af84e3aa27e75e90b
SHA1 2df7d2c4da063aa3d2521d81a9480c87135f1e7e
SHA512 ad75977dd6896383b8185c1b3174cc01273af701f0f0289a34ec7a82a2ce7dec5eee6d83c4ef876efc81bdcd6ad59f7844e506ed0aa9b0c72a7ebc1a081bd7d8
SSDEEP 49152:jHr7KWKVqD0b/0D9mKqL3QABykkWHNv5+8w:PD0b/26
TLSH
T1EE759D42F7AF04F2D8821970146F777FB238EB0A47259AC7E6E0ED54AD326919037297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

449957

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3d8thk

OsThunkDdSetGammaRamp OsThunkDdCreateSurfaceEx OsThunkDdCreateSurface OsThunkDdCreateD3DBuffer OsThunkDdAttachSurface OsThunkDdCreateSurfaceObject OsThunkDdCanCreateSurface OsThunkDdCanCreateD3DBuffer OsThunkD3dContextCreate OsThunkD3dContextDestroy OsThunkD3dContextDestroyAll OsThunkDdGetDriverState OsThunkDdDestroySurface OsThunkDdQueryDirectDrawObject OsThunkDdBlt OsThunkDdReenableDirectDrawObject OsThunkDdReleaseDC OsThunkDdGetDC OsThunkD3dValidateTextureStageState OsThunkDdGetDriverInfo OsThunkDdQueryMoCompStatus OsThunkDdRenderMoComp OsThunkDdEndMoCompFrame OsThunkDdBeginMoCompFrame OsThunkDdDestroyMoComp OsThunkDdCreateMoComp OsThunkDdGetMoCompBuffInfo OsThunkDdGetInternalMoCompInfo OsThunkDdGetMoCompFormats OsThunkDdGetMoCompGuids OsThunkDdGetAvailDriverMemory OsThunkDdFlipToGDISurface OsThunkDdSetExclusiveMode OsThunkDdWaitForVerticalBlank OsThunkDdGetFlipStatus OsThunkDdGetBltStatus OsThunkDdUnlock OsThunkDdUnlockD3D OsThunkDdLock OsThunkDdLockD3D OsThunkDdResetVisrgn OsThunkDdFlip OsThunkDdGetScanLine OsThunkD3dDrawPrimitives2 OsThunkDdDeleteDirectDrawObject OsThunkDdDeleteSurfaceObject OsThunkDdDestroyD3DBuffer

msvcrt

realloc calloc malloc ?terminate@@YAXXZ ??1type_info@@UAE@XZ _adjust_fdiv _initterm free _purecall _strlwr wcsrchr atoi ceil _stricmp _vsnprintf floor _CIpow __CxxFrameHandler _ftol _snprintf memmove qsort ?what@exception@@UBEPBDXZ ??0exception@@QAE@ABQBD@Z ??1exception@@UAE@XZ fflush fwrite ??0exception@@QAE@ABV0@@Z fopen sprintf strchr ??0exception@@QAE@XZ fclose _CxxThrowException _except_handler3

user32

mouse_event CreateIconIndirect GetWindowDC GetDesktopWindow DestroyIcon SetCursor GetCursor SetCursorPos GetCursorPos SetForegroundWindow OpenInputDesktop GetUserObjectInformationA CloseDesktop GetThreadDesktop IsWindow GetWindowThreadProcessId KillTimer SetWindowLongA CallWindowProcA SendMessageA IsIconic PostMessageA GetWindowLongA GetKeyState GetForegroundWindow IsWindowVisible ShowWindow IsZoomed SetTimer SetRect GetClientRect EnumDisplaySettingsA OffsetRect IntersectRect GetSystemMetrics LoadStringA GetMonitorInfoA GetDC ReleaseDC SetWindowPos SystemParametersInfoA DefWindowProcA wsprintfA ClientToScreen

advapi32

InitializeAcl RegCreateKeyExA RegSetValueExA GetSidLengthRequired InitializeSid GetSidSubAuthority GetLengthSid RegOpenKeyA AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyExA RegQueryValueExA RegCloseKey

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

winmm

timeEndPeriod timeBeginPeriod

gdi32

GetSystemPaletteEntries CreateDIBitmap DeleteDC GetDeviceCaps GetNearestColor CreateDCA GdiEntry13 GetRegionData DeleteObject GetRandomRgn CreateRectRgn GetDIBits CreateCompatibleBitmap GetDeviceGammaRamp SelectObject CreateDIBSection CreateCompatibleDC StretchBlt SetStretchBltMode BitBlt GdiEntry1

kernel32

LocalFree LocalAlloc GetCurrentProcessId DisableThreadLibraryCalls CreateMutexA OpenMutexA CloseHandle GetCurrentProcess OutputDebugStringA InterlockedCompareExchange GetCurrentThread SetThreadPriority ResumeThread SetThreadAffinityMask GetProcessAffinityMask VerifyVersionInfoA TlsGetValue TlsSetValue GetEnvironmentVariableA TlsAlloc CreateEventA CreateThread ExitThread SetEvent WaitForMultipleObjects VirtualProtect VirtualAlloc VirtualFree GetSystemInfo IsProcessorFeaturePresent DebugBreak lstrcpynA VerSetConditionMask GetTickCount QueryPerformanceCounter QueryPerformanceFrequency Sleep lstrcmpA WideCharToMultiByte GetVersionExA CreateFileA MultiByteToWideChar SetFilePointer ReadFile MoveFileA DeleteFileA WriteFile GetFileSize GetModuleFileNameA GetSystemTimeAsFileTime TerminateProcess GetTempPathA GetLastError ReleaseMutex InterlockedIncrement GetCurrentThreadId DeleteCriticalSection InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedExchange SetErrorMode WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryA InterlockedDecrement GetSystemDirectoryA GetModuleHandleA

d3dim.dll

IMPHASH aaf084b5ca64e225bdea4fd61bc7dfac
SHA256 03ad13e2f3a4026e76b960fa37b7800c2abe8d9c0a212a52f98035f8ed2f29c7
MD5 cd4b00be972220d8b7da69d81ef3cd21
SHA1 055923868e6cb4cbe85ca473ca7b60671309f00d
SHA512 87678f11b75ae85f23ce5ea0908cea1b67c181b87df4ea5c3ca6ebeb0fac7776c1c0af9af4e8ca75ac4ae55ad24300c6fd9d93c98f65f3b53f5535d50803be0d
SSDEEP 6144:bGn/r7udzoQwOwjq3PWsd4Y+uXEP3DGJxUprSDs+bBMarCG9KNVcM6:SuBwbG3D+uXEPIxUprSDs+bB/f
TLSH
T13394BF61AEB2C07AC4874A73CD9E673D75FE5342C9068CD78FC80D766B60EA1712612E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

110960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

d3dim.xpg

IMPHASH 0a250d2a7f2aabed9156e96aafc6c5f9
SHA256 1d5044e3f4b6f9b333b0c8ea4d91e85df7ef0b6ed85d1e12d5d2a085e90b43fa
MD5 79e4ec1d4b6b9a80543b13958ac773d0
SHA1 76b581265322dba078466b5ac3d07ef0d4dfc998
SHA512 65b5cb47c0db3977aed53026a66484c1216557b45da72b80c69386a08fb7df501d79483bc51792843fda2ed817b1663c692374cbfa4052d651fbbb8055e98205
SSDEEP 6144:iNN1LWbptJTxe0aLDaY+uYt7A4iLDmd9Ht43O7r1HWzSXvwRkRIsYvMuA6:yWbpt3e3+uS7A4iLDmdpt430HWznq6
TLSH
T1A894BFD3FAB1C076C8D74A72C59E277E39FE9381D94248D79EC40CA73A60A91701962F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

108409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dim700.dll

IMPHASH 44012ae2f104a644e715dfc96a041b0a
SHA256 66b7986eef185648a3dfd319adeb68926bcc613c3bd1f82c0f3ae98c7d799d10
MD5 0a738df2ac9dda22d9a4058f8fd6d7f2
SHA1 4e5abcf8c9b5e32d01a814e4eb65711d9ae4724d
SHA512 ef5f598616c53e550cfc689b0004a45f1fc31ae04e6521c5f817ccc6957854f2b4734c7e819e9c5d21ecafb857aaa4e8f8d220f3fa06f35c63c6b6e5e795fe22
SSDEEP 12288:k6k4uan+KBeUg1V6A3xnUxoZz7LDXCISrhZ5JQ7UZZ6+:kD4N3Be/tMq7LDTS1z6S6
TLSH
T14B059E92EFB945B2C9930131551F2FFBB8FE9712C41104A399D16EFABEB0B963520217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

123052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dpmesh.dll

IMPHASH 11fe7b7a647f9d7f932a13447062b9ec
SHA256 0fa81e6b37946f358292c077983fa31532e8a0e4e409e9b8e8a13aa0f60e04b5
MD5 2ee4f61345ee644a6af25ae1b81b1a64
SHA1 786af22410233d8efd021f866ea2663d349e974d
SHA512 e5bcc8a86d798cd514fd430b5fa2dcee366bd98db0297541609a022c23d529617d73defb46ffcad40b984a8a77403de650af6d3d5f8ca6cc3ae405e1e6fc3d96
SSDEEP 768:GyWwx2xURbaLVYmTh3t9FElRlvryLNnq0/sz:GZwVgYmTL9SlvrIoOsz
TLSH
T104F25DE0AEE220FDC0C307356E7A6B61A2FD6B460CB90DE987953D1C5D70951E62873B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

35680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

d3dpmesh.xpg

IMPHASH bf37aaa95d3ffb6ec33700abef7bde7f
SHA256 7b3b8e9329300369e92dcf079bebe307ac942484760c1091ec761dfe5ee38a5e
MD5 a023d0c8897ee721a54b125c3c0c9d1b
SHA1 397c870bb052853fb933c2b319f4a95f0b87f946
SHA512 504458a0e0c3b77184a7fbe63e07556d335bb3e605eeb3f97e5a7f105453954b36a8fb2a0bdc0e03874225a4383d0d4da6597d008161578e01433ea5227fe763
SSDEEP 768:qQVblWWSnXr1aHt8XPVmtdQuVI37myMiqjB81lVg:qHWI7MtmPsHQWICyMixlVg
TLSH
T148F23BD09FE261F9D0531B7BAE5AABB536FA170608791CCD87903E0D5A60D81D13CA3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

34536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dramp.dll

SHA256 9760c57666b2a2a88911ea60a24fc0cacc1094dfb5fe10c839856f326ed3a392
MD5 f3a0f7e3e571ef7d08f49702f6554e1e
SHA1 b01abefa93e0321aea9818bc61ef1bd804cfad39
SHA512 8714f265ea2925399ac51926af7e9e3dfc474922d54846501b263365bd7f1c99cba3f1b0c523d90d95ceebcf86de18b2c240215968716b429f105973f70f9529
SSDEEP 12288:+MwBzU24uRfaZHStoHYFy2Xiui4eiysi3L+aDdImaa9JONIoIc4fyfpKbxWKdqi8:+J/ySftKQyr
TLSH
T1E6C4E4C2899F4D4AC4077ABC682D7B9384DD5B167580F29CBFC5548A0CA9F13F49E82E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

CSEG

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

512B

Virtual Size

453B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DSEG

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

d3dramp.xpg

SHA256 b51a4bbf2c4cefe6ed0c8d317d8c45029b2d80c6cdb4bc14bc7af53ecf721f61
MD5 f3fb1edda3d4d38a03f6669dd9f5657a
SHA1 19924e5fd6616eeff3f73c7521a6c0649515e90a
SHA512 2e040c94ab38d79cdf94b6ba1339de442c8c211a77626d80eafc5043f79428f962cf6b8f20e54664d6760ac1340b23549ba025a09bb47c5c0a6d6b6629faf7c0
SSDEEP 12288:UWozibvZx7c1fiD8Z49vs386vBjLQYHYtwLqvBfEyIg0UTYzzNPIOOYifJqAJ/UB:4386vB5JgY/PC0JhHKQyr
TLSH
T165C4D7CDCC6D149FE00B6ABC683637E3859D2B12D750FA1C6AAC789B4E0C656742C47B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

CSEG

Size

419KB

Virtual Size

419KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

512B

Virtual Size

389B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DSEG

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

d3drm.dll

IMPHASH 2e99249d0177976ed8ca94ec21bdcca3
SHA256 e2f13f6d88b32aa2f17c1fc88b4ba471cfe32c74db237b822dd5faed501b55c7
MD5 aecd31520ec41b7f162f71d2ff879889
SHA1 01e7efac08806bc25c9edcfd391b642cca93badc
SHA512 7a7fd43c0f6fc8d07950dbf29fb8666ff42e0b5e6d8c540c9041e302a70bd9d1a1fc503bf49f389e8b8bd16f7ef7666ba19a6d90dde71b2ee4a90a6d3a6734f8
SSDEEP 6144:V0KhtHyXUuPR+81UbKjOXsikqVkOEo4LMGb249feAPyY:V0KhkkA+81yKjOXs/ON4LMGb2499yY
TLSH
T1B7744C1BB3F2A42DD457137609B66BEEBE786E920C36F5468B5A4E481B61101F33F207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

330144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

msvcrt

_except_handler3 getc _initterm _adjust_fdiv ??2@YAPAXI@Z _beginthread _endthread _CIfmod ??3@YAXPAX@Z floor fread time srand isdigit fseek isspace qsort _CIacos _strdup wcscmp getenv realloc rand memmove malloc free _ftol

kernel32

GetLastError GetCurrentProcessId DeleteFileA lstrcatA CreateFileA HeapCreate HeapReAlloc HeapDestroy HeapAlloc HeapFree InterlockedDecrement InterlockedIncrement MultiByteToWideChar GlobalUnlock GlobalReAlloc GlobalAlloc Sleep lstrcmpA GetProfileIntA LeaveCriticalSection WaitForSingleObject SetEvent EnterCriticalSection InitializeCriticalSection InterlockedExchange CreateEventA CloseHandle DeleteCriticalSection GetSystemInfo IsBadReadPtr IsBadWritePtr GetProcAddress LoadLibraryA LocalFree lstrcpyA lstrlenA lstrcpynA SetFilePointer ReadFile UnmapViewOfFile GetFileSize MapViewOfFile CreateFileMappingA FreeLibrary SizeofResource GlobalFree GlobalLock FreeResource LockResource GetTempPathA GetTempFileNameA LoadResource FindResourceA

user32

wsprintfA ReleaseDC GetDC ClientToScreen SetRect GetSystemMetrics

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

gdi32

GetSystemPaletteEntries GetDeviceCaps

ddraw

DirectDrawCreate

msvfw32

ICImageDecompress

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysAllocString

d3drm.xpg

IMPHASH 036abd03779827a82c766078826c93be
SHA256 e04e3781e7ff3466723565da8413b08b705533acda257773874f2f8166b3d4d6
MD5 dde9e3b8c264957ae0a017d371293123
SHA1 af25767f425fa7877b996e5d29a54cab29b5ecfb
SHA512 824b938383ce5e826c2abdc1065c24b6d8c3f781f9e44b6530a4c68423130a0d88fd5c631bd9f52bb4b07531f04e2f321c7aca3532d9d8825ca1c51670258dce
SSDEEP 6144:gWZ2zQlXqEGzRXoJGfMnMMxzF+bnat9qqdpBnhwo6rbxOv:gWZ2zQ6YJGkX8cXHzwo6rbxOv
TLSH
T197745B1371F6533AF04312B9C66B67B97BE9B702502A958667880B5E072E643933F337
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

316593

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_endthread ??2@YAPAXI@Z ??3@YAXPAX@Z floor _beginthread time srand fread fseek _initterm _adjust_fdiv _except_handler3 _CIfmod isspace isdigit getc qsort memmove malloc realloc free _strdup getenv _CIacos rand wcscmp _ftol

kernel32

GetTempFileNameA GetTempPathA GetCurrentProcessId FreeLibrary LoadResource HeapDestroy HeapCreate HeapReAlloc HeapFree HeapAlloc MultiByteToWideChar InterlockedDecrement InterlockedIncrement GlobalReAlloc GlobalAlloc GlobalUnlock GetProfileIntA Sleep FindResourceA LeaveCriticalSection WaitForSingleObject SetEvent EnterCriticalSection InitializeCriticalSection InterlockedExchange CreateEventA CloseHandle DeleteCriticalSection GetSystemInfo IsBadReadPtr IsBadWritePtr GetProcAddress LoadLibraryA LocalFree lstrcpyA lstrlenA lstrcpynA UnmapViewOfFile GetFileSize MapViewOfFile CreateFileMappingA lstrcatA CreateFileA lstrcmpA LockResource GetLastError GlobalFree GlobalLock SetFilePointer ReadFile SizeofResource FreeResource DeleteFileA

user32

wsprintfA ClientToScreen SetRect GetDC ReleaseDC GetSystemMetrics

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

gdi32

GetSystemPaletteEntries GetDeviceCaps

ddraw

DirectDrawCreate

msvfw32

ICImageDecompress

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysAllocString SysFreeString

d3dxof.dll

IMPHASH 2a5a73044e09ce5262a6a38d104ae40e
SHA256 9bf244d82d32fc2759cefceb1975cd2184bf122d9dd27ac29b85b0c76154e0ee
MD5 8259cd86a1fa746bc5c97abbf2db53c3
SHA1 a5922de309f682545c1495f2ebedfaddfad76eda
SHA512 d1ccda68d36d7dc15b84620d96b8961e2fc83f9f23d2b14ab4a3bd33d390e3b7a433fd2dea3d811e94a13aa70854ea18fe1056069a36c1cf0c2408a11e24056e
SSDEEP 1536:7Kiuovp9G3lTKI0DKahzKwi96Iwo6tlN:7KiuoR9UKI0D9hE6IwntlN
TLSH
T1AE239E13A7E0F7B7D01243310A1A772267FF6ED16A009A7AC3D0B9D55EF0981A73C65A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

41744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

d3dxof.xpg

IMPHASH 9e292ef8a851106689587dd3bcf4e9b3
SHA256 dffb9e97277964353041b84f57f89c169502a9172067563feba98db4b1b25f77
MD5 9bb566d2992a94caa25b2a886b0fb53b
SHA1 50bcdb44cc705460c3ba95ba67894b58d5eceb97
SHA512 8f17d6092140ee1989627758f01274473d65dc2a01f90b0950d61f620982a14573929f8adc59b87764c1d58dbd3735b69c36f84383e67c7f20b5068a6a0663c2
SSDEEP 768:FTAW7hD5l8j7r0D6QeZyXo/uMNqZkGRexgTSAnpctQPqaaPE:d83r0D6Q3XW/NqiGeI5npc+PqaGE
TLSH
T116238E03AAFC7038E76141760BEE732327FEF9108A358A26439D65695E715CD923D363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

40586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ddraw.dll

IMPHASH 4c2e62100e8951673b1b2ac56ddbd9f0
SHA256 e3ec130b154ff12ebfe9936cc4d779975dd7e84ed7a0ff3a4b15101bfe5da8d3
MD5 61cc64c43bec193100e3722f6cf4b1e1
SHA1 5378474cc1b0d0e795f9558f6376189643dbc55e
SHA512 c6a7fbd081b1c697a174676a70d8b0b8f123fae3b597783be1cfa5072d05051f1a05371950a483060ae4d9a6e448cb25ff56418f4a6aa913978f9100796d66df
SSDEEP 3072:T/gEgCIUyjyoTWM0b+5hx9sopTXdJhFvFSI3rpemVBFMROahJPpL9UgPXTIK1uim:76UyjrsETdJzFSYrb3a1NMK1ut9K3A
TLSH
T113547B03B3E3E232F077127A9564179A25AA7B608C3EF5CB065D699C6E34F40B636713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

232881

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_initterm _ftol malloc _except_handler3 _adjust_fdiv memmove free qsort bsearch _strlwr wcsrchr atoi _stricmp floor

ntdll

VerSetConditionMask

user32

RedrawWindow ChangeDisplaySettingsExA EnumDisplayDevicesA wsprintfA DestroyWindow GetClassInfoA RegisterClassA CreateWindowExA GetClientRect ClientToScreen GetWindowThreadProcessId SetCursor KillTimer SetWindowLongA SendMessageA IsIconic PostMessageA CallWindowProcA GetAsyncKeyState GetKeyState SetFocus DefWindowProcA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard OpenInputDesktop GetUserObjectInformationA CloseDesktop GetThreadDesktop GetLastActivePopup SystemParametersInfoA mouse_event SetForegroundWindow SetWindowPos GetForegroundWindow ShowWindow IsZoomed SetTimer ClipCursor GetWindowLongA IsWindowVisible GetSystemMetrics IsRectEmpty GetMonitorInfoA ChangeDisplaySettingsA LoadStringA CopyRect EnumDisplaySettingsA IsWindow ScreenToClient OffsetRect SetRect GetDC ReleaseDC IntersectRect EqualRect

dciman32

DCIBeginAccess DCICloseProvider DCIDestroy DCICreatePrimary DCIOpenProvider DCIEndAccess

advapi32

RegQueryValueExA RegEnumKeyA RegCloseKey RegOpenKeyA SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid GetSidSubAuthority InitializeSid GetSidLengthRequired RegOpenKeyExA RegSetValueExA RegCreateKeyA

gdi32

SaveDC DeleteDC RestoreDC GdiEntry8 StretchBlt GdiEntry7 SelectPalette SetDIBColorTable GetSystemPaletteEntries SelectObject CreateCompatibleDC CreateDIBSection GetDIBits CreateCompatibleBitmap DeleteObject ResizePalette CreatePalette GetDeviceCaps GdiEntry5 BitBlt RealizePalette SetPaletteEntries AnimatePalette GetObjectType GdiEntry4 GdiEntry2 GdiEntry10 PatBlt ExtTextOutA SetBkColor StretchDIBits GdiEntry13 GdiEntry6 GdiEntry11 GdiEntry14 GetDeviceGammaRamp GdiEntry15 GetStockObject GetRgnBox CreateRectRgn GetRandomRgn GetRegionData GdiEntry12 GdiEntry1 GdiEntry3 CreateDCA GetNearestColor SetSystemPaletteUse

kernel32

LocalFree GetCurrentProcessId GetLastError GetSystemInfo IsBadWritePtr LeaveCriticalSection EnterCriticalSection IsBadReadPtr GetProcAddress GetModuleHandleA IsBadCodePtr FreeLibrary LoadLibraryA ReleaseMutex WaitForSingleObject lstrcpyA lstrcpynA CloseHandle SetErrorMode GetProfileIntA lstrcmpA GetCurrentThreadId GlobalFree GlobalUnlock GlobalLock GlobalAlloc InterlockedExchange lstrcmpiA GetTickCount OutputDebugStringA LocalReAlloc DeleteCriticalSection OpenMutexA InitializeCriticalSection CreateMutexA DisableThreadLibraryCalls GetCurrentProcess lstrcatA WideCharToMultiByte CreateFileA MultiByteToWideChar GetSystemDirectoryA lstrlenA ReadFile SetFilePointer GetModuleFileNameA VerifyVersionInfoA Sleep QueryPerformanceCounter GetSystemTimeAsFileTime TerminateProcess LocalAlloc

ddrawex.dll

IMPHASH 40193c37e36853f13b55eb16686bbe8d
SHA256 a21e6529fe4ab7efbf70bf2728b3daf96fbf58734f0a4ba191df3a02efc24469
MD5 8a4936ea4b8a234a41c6037329087c13
SHA1 ffd55bd6f217feabf7ef315ce16752e1102f5bc3
SHA512 1c3c122299d281baee710c59345a6f8ddbbdff4882f1d5affadf64da2d97619a7f0f34d7e52fd7ede723f922b886cbae508313a22585926f04bc40e86d578eb5
SSDEEP 384:ZkMIB21BthF3OsHj/MdOsupU592r9oirLjufuReXigTqmTnSMnfPRcaUK8XyuyWB:SMIA1ZFBj/MdHup89g9RLjjeihmTnSa+
TLSH
T173B21A5333F79178C0EB33334C69929FB3996B285472A80A83EA934317B5A15D52973F
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

devenum.dll

IMPHASH f773868e6cb462194b004b94abddb0dc
SHA256 16bfa9ed6a2ac204868266aa6675107f1162adac972eb492d597264c774105fd
MD5 15ab547237e05740634d300e67853730
SHA1 20f8b1ea3301ac4d358d8e1581915f8fc73374ad
SHA512 dc61b009c468863beecc1927399a7b8dd54cc22dadce88394688aaa84a02ab8d6ebb3332571800fc98ab6e86f181aa5957b2b25234b8b98e08f5d9dc5195afcb
SSDEEP 3072:5FLUnMTp2tyfKHfeENUiWUHtdVDd5ZnnKzsb:6PGENB
TLSH
T1A3D3638177EF0559E1EA42B129B511A7866FF853C9F006F8A6AD921091F8F00E73CF97
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryW CreateMutexW TerminateProcess GetProcAddress lstrcmpW DisableThreadLibraryCalls GetVersionExW ReleaseMutex GetModuleHandleW LoadLibraryExW FindResourceW LoadResource SizeofResource FreeLibrary lstrcpynW GetModuleFileNameW lstrcatW HeapDestroy WaitForSingleObject GetCurrentProcess CloseHandle GetLastError lstrlenA WideCharToMultiByte lstrcmpiW MultiByteToWideChar InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW lstrlenW

msvcrt

_except_handler3 _purecall free ??2@YAPAXI@Z realloc malloc ??3@YAXPAX@Z

user32

wsprintfW LoadStringW CharNextW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegEnumKeyW

ole32

CoCreateInstance StringFromGUID2 CreateBindCtx CLSIDFromString CreateAntiMoniker CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData VarI4FromStr LoadTypeLi RegisterTypeLi SysAllocString VariantClear SysFreeString

winmm

midiOutGetNumDevs waveInGetDevCapsW waveOutGetDevCapsW waveInMessage waveOutMessage waveInGetNumDevs midiOutGetDevCapsW

diactfrm.dll

IMPHASH 7ccc752422fb8b9373bf78f44fa203ed
SHA256 d8262ac8465f08b5fecfdd2cae8fb99a89ce0cdbc4dde28a9c8d8ac5b177df66
MD5 548f65df7a2af723c1d29349ffb8ad98
SHA1 115935bac9300e8b1f93e3211cf78d3eabf5b07f
SHA512 11ed2f1d7dc0d39f076792fac0ac87178ff66c4d1091e10c6c752778e1eb7f13a540c3c8da89010b2d751f3f844224f8c11a4d7282b9d7851ab872e560dfcd67
SSDEEP 6144:fIeeeeeeeeHeeeeeeee8/NAOVx9pu/v6NPhMFSoB29rQYpkBoKIL6iCa5zpmUNeM:Nzw+6FKZQY2hIGa5QUNe36hko
TLSH
T1D1A47C01B3F8813AF0F36B306C7A2B6A6A7BBE519938C55F1794066E1D30A55CE71363
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

115017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

kernel32

EnterCriticalSection VirtualAlloc HeapReAlloc RaiseException HeapSize GetACP GetOEMCP GetCPInfo InitializeCriticalSection LoadLibraryA LCMapStringA LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW SetFilePointer SetUnhandledExceptionFilter GetSystemInfo VirtualQuery SetStdHandle IsBadCodePtr FlushFileBuffers CloseHandle LeaveCriticalSection WriteFile VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsProcessorFeaturePresent UnmapViewOfFile CreateFileW CreateFileA CreateFileMappingA MapViewOfFile GetFileSize GetModuleFileNameA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree GetModuleHandleA ExitProcess MultiByteToWideChar GetLastError HeapFree HeapAlloc GetVersionExA GetCommandLineA TlsSetValue GetCurrentThreadId GetModuleFileNameW Sleep WideCharToMultiByte IsBadReadPtr IsBadWritePtr lstrcmpW GetTickCount MulDiv lstrcpyW InterlockedDecrement InterlockedIncrement lstrcmpiW LoadLibraryW GetProcAddress FreeLibrary lstrlenW VirtualProtect

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueW RegOpenKeyExW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW

ole32

CoTaskMemFree StringFromCLSID

user32

DefWindowProcW WindowFromPoint EndPaint BeginPaint IsWindowVisible SetPropW GetPropW RegisterClassExW EnumChildWindows DispatchMessageW TranslateMessage GetMessageW ReleaseCapture SetCapture GetWindow UnregisterClassW GetClientRect InvalidateRect CreateWindowExW DestroyWindow LoadImageW GetDesktopWindow GetWindowDC SetCursor ValidateRect LoadCursorW GetIconInfo DrawIcon PostQuitMessage ClipCursor GetSystemMetrics GetWindowRect FillRect GetUpdateRect GetDoubleClickTime SetFocus SetParent LoadStringW IsWindow MoveWindow OffsetRect GetDC ReleaseDC GetCursorPos ScreenToClient ClientToScreen PostMessageW KillTimer SetTimer PtInRect InflateRect ShowWindow SendMessageW SetWindowPos GetParent wsprintfW DrawTextW

gdi32

SetBkColor GetBkMode GetBkColor GetTextColor CreateFontIndirectW GetDeviceCaps SetViewportOrgEx OffsetViewportOrgEx RestoreDC SaveDC CreateDIBSection Polyline DeleteDC GetStockObject GetObjectW GetCurrentObject LPtoDP CreateCompatibleBitmap StretchBlt SetBrushOrgEx SetStretchBltMode GetBrushOrgEx GetStretchBltMode Polygon ExcludeClipRect IntersectClipRect BitBlt CreateCompatibleDC CreatePen SelectObject CreateSolidBrush Rectangle MoveToEx LineTo SetTextColor SetBkMode DPtoLP DeleteObject

dinput8

DirectInput8Create

diactfrm.inf

SHA256 0fa10ec8733140fd48bd763e195c866029acfcc58869dc9b250f75d8ba080b30
MD5 c981a5e3a834ae2f7be9b24fa12064c2
SHA1 17ffd4b002fed95c17222aae988926e7cce502a5
SHA512 5a039c0145c18ecc1f3f5bb638e27ad89c2cd8a2af27e80d144b640e691ad32a4948b27d21585b200ce6ebc3abe6cb1a2ecd8d02773db4c590465f576fcfbf20
TLSH
T13C1199BBCF3E4A9F19DD534FD8BA323241AC952AA0C1E18561D06102D84F4FCE45C5D9
MD5 SHA1 SHA512 TLSH

diactfrm.xpg

IMPHASH 7ccc752422fb8b9373bf78f44fa203ed
SHA256 3060393e0818340397fe714adb913aa40a96d3c077bdbc94c1c0d396d441b78b
MD5 28226b16860c2a0ceb1a26e5de905171
SHA1 f4f7c28f3a9c68769a1d8e411c9527cb8f590a25
SHA512 689aaf07437a715a1b2567a01d082481b7f52904b5b50b3c8479df2423678b378fba9b0efac013bd99f69b3dc89d03cc0b3fe4bba8b2a7c109b24866663c7fd6
SSDEEP 6144:4naS/KAOe5FpU39e9s4bmoNyrZJdlQxVFoWuUfRpxkjqVBKkQeewQeeIQeesQee3:4aLsWWXbsZNQHF1uUf5YqVnhWlD
TLSH
T10DA46B01B3F88139F0F36B30697A97AA6A7BBE11CD38D15F179416AE1D30A55CA31363
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

118988

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

kernel32

EnterCriticalSection VirtualAlloc HeapReAlloc RaiseException HeapSize GetACP GetOEMCP GetCPInfo InitializeCriticalSection LoadLibraryA LCMapStringA LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW SetFilePointer SetUnhandledExceptionFilter GetSystemInfo VirtualQuery SetStdHandle IsBadCodePtr FlushFileBuffers CloseHandle LeaveCriticalSection WriteFile VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsProcessorFeaturePresent UnmapViewOfFile CreateFileW CreateFileA CreateFileMappingA MapViewOfFile GetFileSize GetModuleFileNameA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree GetModuleHandleA ExitProcess MultiByteToWideChar GetLastError HeapFree HeapAlloc GetVersionExA GetCommandLineA TlsSetValue GetCurrentThreadId GetModuleFileNameW Sleep WideCharToMultiByte IsBadReadPtr IsBadWritePtr lstrcmpW GetTickCount MulDiv lstrcpyW InterlockedDecrement InterlockedIncrement lstrcmpiW LoadLibraryW GetProcAddress FreeLibrary lstrlenW VirtualProtect

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueW RegOpenKeyExW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW

ole32

CoTaskMemFree StringFromCLSID

user32

DefWindowProcW WindowFromPoint EndPaint BeginPaint IsWindowVisible SetPropW GetPropW RegisterClassExW EnumChildWindows DispatchMessageW TranslateMessage GetMessageW ReleaseCapture SetCapture GetWindow UnregisterClassW GetClientRect InvalidateRect CreateWindowExW DestroyWindow LoadImageW GetDesktopWindow GetWindowDC SetCursor ValidateRect LoadCursorW GetIconInfo DrawIcon PostQuitMessage ClipCursor GetSystemMetrics GetWindowRect FillRect GetUpdateRect GetDoubleClickTime SetFocus SetParent LoadStringW IsWindow MoveWindow OffsetRect GetDC ReleaseDC GetCursorPos ScreenToClient ClientToScreen PostMessageW KillTimer SetTimer PtInRect InflateRect ShowWindow SendMessageW SetWindowPos GetParent wsprintfW DrawTextW

gdi32

SetBkColor GetBkMode GetBkColor GetTextColor CreateFontIndirectW GetDeviceCaps SetViewportOrgEx OffsetViewportOrgEx RestoreDC SaveDC CreateDIBSection Polyline DeleteDC GetStockObject GetObjectW GetCurrentObject LPtoDP CreateCompatibleBitmap StretchBlt SetBrushOrgEx SetStretchBltMode GetBrushOrgEx GetStretchBltMode Polygon ExcludeClipRect IntersectClipRect BitBlt CreateCompatibleDC CreatePen SelectObject CreateSolidBrush Rectangle MoveToEx LineTo SetTextColor SetBkMode DPtoLP DeleteObject

dinput8

DirectInput8Create

dijoy.hlp

SHA256 5fd8d8aa0201478bab648bc238bd62acb285fc6920093099b723f1bacbfa180f
MD5 137415567983464456676fd31e6062cf
SHA1 e3761e725a08fb9dc41484096c8efc163335cf71
SHA512 eab0c78188fe7c8cb3f3705888d7c3fec80e72f18debf0e0f2431d011d752acac8cfe05f980af6fb60977c8447b15740fee33bea4b6e8cb40c1a06622b9199e1
SSDEEP 192:rn86i/9CHs32dZd1xE9clDqjRmwMClDHpXF+r:rzs9sm2dZdvE9clKMClDHpXF+r
TLSH
T13A92316F395FC612D754CCB9D6F2B9B98E28DCE1EC704507F9023A0C94B1BA6D293648
MD5 SHA1 SHA512 SSDEEP TLSH

dijoybrz.hlp

SHA256 ab933cd613b713ce5812db9832957d03a4aca976ba3e0b7cc1ca6dfd3d8d335d
MD5 e56c0c19b188bc93bad580c9789a1ca9
SHA1 d905fff0a3c4938636167e94f4da4a519c70d01c
SHA512 cc12d77873c6cebf517d78a7a2f71484920013c8989c5a83298618b6b2f6b7d0a65e8e80e1e4be5e452f764ed98b3d8d4d05a59854b199357a72570ba2241eea
SSDEEP 96:gZVmb1PBLJ3+NtFJvVzcxrDx+XDN0vUzO2VMSxXDb0uwJmIPtFC3kAtcv9MMMMJ:qsNJu51Od+bzbbxX30vXtNAtSj
TLSH
T11D42D540BD94CE73C9954B38DDEAA9ED2162BE4ADC544B43704D3F8C3C32149AA5A97C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoychs.hlp

SHA256 a989146607cca03659d3e5cadee3fd9f92675e7f49233c9c926dd641d8323f49
MD5 e2b12a7212974b373fb5cef7c16e2910
SHA1 253503674d0078dfa80bcfd687190c30a339ea56
SHA512 b54399cef70dccd029f20bb872ec1826cbce8b0de4ee34f12660aaa448f1a379174e29a249dc031a881550f09951c246c16be8a7d6286899f094d16c192467e7
SSDEEP 96:bwZ02kGSkC2LZc6HjYa/4Ky+4sxnLCvEIafedWLajezW5/bSnUMMMMJ:blh2LZcCj31y+NLCM2WLER5/Ic
TLSH
T1D9329251BC54EA57E8410AB4ED96FBE9F426BC45CD508367380C3B1C7C33145AB5A87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoycht.hlp

SHA256 1a9eee00c310a19ceba3b867873350b2fd657fb5ad0a17f7dd897c4170816363
MD5 4b068dac56444fe69c0a29f58593c414
SHA1 d94da6d175e9c417dc7a32d2be499105e42e4551
SHA512 4b1cfde3bff6a2bb0ed6dc222392fc280f0d3b110041e288d7d57ce578c39301936bddb84bcee30d33b8967e2e5408a99010ec75d5290083283cf27c1bb75995
SSDEEP 192:sEDppRgEuwkafEorxNs9ZzmK6wMClDHpXF+r:skpvuwkafEorxNAzhfMClDHpXF+r
TLSH
T19DA202AA5D50865AE165E83DD5EB73FD4A30ED11ADE0460F761F2A4D24F3FC280A360E
MD5 SHA1 SHA512 SSDEEP TLSH

dijoycze.hlp

SHA256 e54b683561ded2a33a9cb8ac880ca9d16bb3e9a385a7419547914937af7dccfe
MD5 b24f65363c41999f491c42dfaaf68006
SHA1 bb600555568ee35726694031f4608528e47b2551
SHA512 b5dbec06cba3dd57dcfa5638e65f92bb86daa8364bc979802bdb27abd3433fc362472e4697c57d275f43673ebf856b7c4f01282d083f40c4395d70c5dbdffd28
SSDEEP 192:2zlYYzxIvU58MqbFpvSLc0hVSIPgERX49zXqmwMClDHpXF+r:bY68NguLc0hV3g064MClDHpXF+r
TLSH
T18CA2AE1EAAD1C513E254EE3EEED772FA6E10DC41AD80C4077F66274E24F39978063A18
MD5 SHA1 SHA512 SSDEEP TLSH

dijoydut.hlp

SHA256 3c6e39b2150de576234eabd114386b7e0c590344e478e5f466ddf9e6eba1e7de
MD5 9cd3263bf30d9a8ee30e4c67b4618920
SHA1 3cc9fda099838283b2069838e71b659eebc70351
SHA512 5a54d4eeedc47516a1aab18ddeb2fc5f53faaa186df56db6e6e3182ee24839072a6ac80bed6b93499855e9b66040d7ddbe29cf9d3906d0364c80efcbf71bfbb0
SSDEEP 192:aYchIP+0T5aBH4KWYe6jkm7n4SsA8h7wmhhx:aYcmmRBH42Jjkm7psB7F
TLSH
T1AA4208553D51DE13C9A80B38DCEA72ED35B2BC0A8E65474B345D3B2D3D32914B90A87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyfrn.hlp

SHA256 420a39d13d76208fb4945fbb50765f86a21a10a52636f2e6c9090ff2b4e80f5a
MD5 bc2602451a67cd71e3235fee03a80e1d
SHA1 04ac95bdf73a103a213151da1f5be2a9e4f3ff2c
SHA512 0ef376aa4328952af14acad024d2c36692ec042b93e028b0ea0d0a8db0370cbc68ddeeaf3146793d9a1dcbb05886abf24aa953bef4ed4be9b797dc6145dd9385
SSDEEP 192:sDiDSyd0l7T81cWesLa1gs6u/YdeUzRe0Z7+:sDEpGWP2196efUzReIK
TLSH
T1B642E4413D6AD6A3D5840A74DEE2B9ED2071BD08ED504F8374497B6C2C32359AA4F87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyger.hlp

SHA256 79f5403200d668c28eb612cf427399b675ca5e7dddc9ed6950f3d6d37ece8327
MD5 a0b7f28be23af3fb2408fe16e129194b
SHA1 c4c090b356ac72d27afd7e284cd961b860ff6353
SHA512 a119fbc294a9fcf790b290507315280a8bc30ca15db60baa6128d4b9b131e09ee2fdb36dc373aa4212802557764ab29d1d3aa6d1761b9b06c12e06255d77a514
SSDEEP 192:qbLEH4huJ9ytDTfuW5BGfCRsjFDI0FnJRh0g4qvCwMClDHpXF+r:qb7c7EmOkFDrn9v3MClDHpXF+r
TLSH
T17092101EBD94C913E164DD7ADEEB71DD5B21EC42ED80C00B76267B4E28F2A429053B5C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyitn.hlp

SHA256 3d8fe49c80fc3c95944db5c3a2981ad6185b65005466d44115a38e5545daedca
MD5 790a63022358d88838b75fdcebe0d117
SHA1 d7bf4afe54bec452929c0c8bf7bfd865ac0f827d
SHA512 ebf2d39bba567f67419d7abf1385b751e9d2b8df313a052f1d7f87f7dd99d2fe8e44240e4953661ce1ca6805717fa68865a1f784539f9ad01e2a70df54d32562
SSDEEP 96:c/x8jt76wJu0owCknzvSjFS9YICxwKX1c7xUBzjhXsb9voBrVdMi9LkkSyT5mSL1:GejBQeqbQKX+7xUBzjhXEv2DMgF/Vv
TLSH
T111420710BDA9DE27CD9A0A749E9678EE3231FC85CC964B1735283B1CBC77090A61C87C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyjpn.hlp

SHA256 82c877015c2991c295c91587cc72110bd5d60b82b395436bfe3f03378e3d651f
MD5 860d56f398918504f7bf635cac90b1a8
SHA1 0f9bf97ec06c6a9d6446b43d6b80e422bd12e172
SHA512 b51057746685d8b6e2b128cda719fdbe89391f03d0404f7be1e96361e31635c05a38c59c4c477e9f2b2c82333cdb27c81b40c44aa056d90f678d21c0bca783b2
SSDEEP 96:GjcNBGLt1TpRMijFlynTkQgZ8Mo9Swyi3Uw/7diN6LgOuma/BYHOutk1CBzh4oZH:7vWX3aTk31ISxikw/7GJ1KSYHWvqp
TLSH
T1974207543CA5DE23C8584AB5CCE9F9E9346BFE82CD128F4335253B0C6E72484568B9BC
MD5 SHA1 SHA512 SSDEEP TLSH

dijoykor.hlp

SHA256 37c89ff5eb05509bb94fd65b07f7a00e797c0f0ca74a5dd3c7df5942739fb5ff
MD5 7c71777a3efa0749bb57b29e2f696674
SHA1 7f6b8c7d8bd35de23c957a30ca09f5ec80d0dfe7
SHA512 ba0bb13635eef016153e6d06b9566c9a9701dfae0bae88f3a9d9b258e1340b0c098c7afd479e7f044ed5e6b2edb0c0d80feb27168df7f4c2467e09d9de56618f
SSDEEP 192:Y6eF9MbwmylCRkwjwJdD1DfpNWJxfObB3J+Lk1CocwMClDHpXF+r:sMJyl3SwJdDxpIXfOt5FMClDHpXF+r
TLSH
T105925F1EADD1C513E6649C7AE9DBB1A95E21EC41FC80C40B371A3B4E28F2E966053F5C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoypol.hlp

SHA256 78f5386903c55ce3e668ea6b1951d083f6b966d0bd7732def083f796bb5fc440
MD5 eaa0f6e7220f0becb4f03d13a94898db
SHA1 bf517524e7aac53108d623bd2f4b3a63e1221ec6
SHA512 b65cae32346503ac1e54ab31484091debcf864b55bdb493cf6efa508fa88536867572a696e81fa9a0f58554766ab9372f6ae2f3f3a8de00a8d58485ccd2c6b4b
SSDEEP 384:prpyZc0K4D1KJeUtAXknfPXUhMClDHpXF+r:prpyZdK4D1KJ1tAXkfPXx
TLSH
T12D92311E7D80C513E564AD3ADBEBB6ED5B24EC41FD80C40B37267B4E28F2A82605365C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyrus.hlp

SHA256 83300151382c642a5c923429504ede2a9f5b85c1c90cf448db6f0d81e86fc3e8
MD5 e24d0e58df91ba9dc49d3fa72705c431
SHA1 f2cfb7faf7de946a95ed2a362fa15f03130a18d0
SHA512 347250adfa27cb7585d0e8803e59062320aa7dfd8a1fbbfa2899e90f63f853fc421e2f31ff93915be3a2b9570bf0c6a3d8d91b0c6c3476fc371641422041f8d4
SSDEEP 96:nZB9zpCtbqw4coli8GWF1HfXwHO4sM7h54+932Arm41YGvvRbzdES5BTJEw/MMMw:nZB99iqYAgEMoCI4mgFdEuJjN
TLSH
T14D42E755FCA8EAA7C8940E74ECD7A6ED3815FC51BC418B2375113F4D7C3204A6A1A47C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyspa.hlp

SHA256 5708c8d5b7f66788501b41e95072bdcfc4f4a870669bed72522caf07f3e8ff32
MD5 cc6fe8fb75fc04c142a555be4d58b045
SHA1 8e42720e2b74afd73500e487c224ed27c26a77c1
SHA512 985ebe210fd27170b76e94e6a5c151a0eb9ec2c30425b8a2f8813605f2104bb42e521e7f271fc4192f8b35c892a0c24b03ccab601901ad157dbea7699d3e4848
SSDEEP 192:R0KBPPZApLQiMI/gUZOQT8KABedBowZsgq+4Z6x8:R0KBPPaBQiEQgQ1b8
TLSH
T122420846BD96EA7BC4944774CDEA69EC3072FC0AEC06478371193F2C7C76180AA2993C
MD5 SHA1 SHA512 SSDEEP TLSH

dijoyswe.hlp

SHA256 24b9ccb7cbfdd39808025c1e40e39f73459419ab32a23f53e8f1b7411f90c030
MD5 3939643e42362724cc79b10cbfed090d
SHA1 78522d750ebac38913092eb91813fd694da58157
SHA512 38b165e6642576f17dee54c733f1811f214d65475b3f0c82bfad0eec08ae891e50f91e319a97f1b785dbdaae5710ed16fc798c35ee3326293f4e56f3a1b18cb8
SSDEEP 96:PUypMNALLx8G6paLKss/7bWxr/JOBHVinQtxTmpusARZX5ecZkJtPjAlkQ89WhMq:MyeNK9D7Ln47CxzcuQrCtA7tutLHfQ
TLSH
T1B342D650BC18ED57D4990678EEAFB9FD64667C89EE520B9332183B1C3C31049B58E17C
MD5 SHA1 SHA512 SSDEEP TLSH

dimap.dll

IMPHASH 469e31fbcb0cceedc5dbfe00ddb0c612
SHA256 d0558fc713d47d0135f456a6660d809c4c6b6baf303fb96e5795e2cedd51ba1a
MD5 163d4da9294255ce948ff2f8f4380fb0
SHA1 00708c5fb2f6fdb7b6b8fab7bb347356539c03e4
SHA512 0d4bc6802a905e5e495c6c7d0ad1d70966969f1e746d27ca390be5b9e409c49dd5be6b7c145b0e4d713ae07b9cdd7572fb2f01668bb69349a60205a841950d72
SSDEEP 768:Dc2m0ufNky9EZa1sSb0NBXc86m26t4LxOq5HVL+a3IP9bpb:LbufPEZ+sSoBs85GLEqCCIPzb
TLSH
T163135C03B9D4C071E66219389FA467287AFBE0308C129E576368664F6F32B47FC55B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

32892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dimap.xpg

IMPHASH 469e31fbcb0cceedc5dbfe00ddb0c612
SHA256 9aff1e5a20742bd47c384e294091f6063241bc1c10e3a5d731c3e657e349dbe1
MD5 b5603cb6cebf85058eade5d62258acba
SHA1 d09f34ea9df9053b75d49cd949def5d49c31149a
SHA512 042e0101f791aa915ad5bb3c0a39e290f75d32b20207a30e3a0e195c2948c75d241002738920b09271345f71b86685774eee21119fbc906af1962480e0a127bb
SSDEEP 768:Kolmi5ufNvJdyOXsHvFG7tK8+m4jZE8i99Y1a37U9bpb:zT5uf3dyIsNuKzZE8i99Y1C7Uzb
TLSH
T11B13394B3B90C275E6632A39CB606B1D55F5F2304F12895B6329AB8D1A75F47C232F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

32892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dimaps.inf

SHA256 b762ccc6087e6089a923ac09134e19311e57d60e1cbdc4d1525576395d283c8d
MD5 0545bc83300356cc68fdb44e0f90b774
SHA1 0ea39abe3b95a3a4c73ac80ae1c5e36b13acd6bc
SHA512 3557fae927a47db1293f50834236cc9bd1300902541eb742190a9d1695cb53d4363f482d40f1832af4271eed22dd86398d9b85a69b64d2f8f6b2fdcc2ba62621
SSDEEP 192:D1XXRJO0FxTG5Q0U+y0J9zgR1FRPvdbxyNgBTTQai3a6ANIKZfZW8dvm/188OX63:DlhNxTG5Q0UGkOMs4BBKGS1V
TLSH
T13B62B9FA5D1ACE73D4E3D0C2E202AD17F54B9859D2A55DC4E8F1118ACB462A8803CBDA
MD5 SHA1 SHA512 SSDEEP TLSH

dinput.dll

IMPHASH cdcbbe5700e5939b98dbad5bf6ec9b91
SHA256 fbe0589ba7b0aa3da4bbf8158aa79f0f6a309de1ea517a699ee63acd811510ce
MD5 373ff13118d0ca8201e69cb14f673aef
SHA1 f2b2566a3dfaba95d659c7977e8218d043fe282d
SHA512 cd2c8c7276e332a2bdfad93b9ebb08ba3fca2fad460b5ed208611d6c5bd2e4558b2abbdcdedcf9f7f771a621a48165b9dc07c4ac9c6c8d9f17bfc3d412636057
SSDEEP 6144:yOZ/aq5SB/exySKiX9Yg/rrX6n1d121eCnnnnnnnnnnnnnnnn:lt7ohGF
TLSH
T1D4D4F901B3FD5629F6F3BF786EB912954E7BBDA2AA35C10D0250254E1D31F909A20B73
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

43332

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_except_handler3 _ftol

kernel32

DeleteCriticalSection ResetEvent GetCurrentProcessId IsBadReadPtr IsBadWritePtr WideCharToMultiByte FreeLibraryAndExitThread FreeLibrary GetLastError WaitForMultipleObjects SetThreadPriority CreateThread CreateEventW LoadLibraryW GetTickCount lstrcmpiW ReadFileEx DuplicateHandle GetCurrentProcess GetVersion lstrcpynW Sleep ReleaseMutex WaitForSingleObject MulDiv SetEvent LocalReAlloc SleepEx ResumeThread OpenEventW GetProcAddress DisableThreadLibraryCalls UnmapViewOfFile MultiByteToWideChar lstrcmpW GetPrivateProfileStringW GetWindowsDirectoryW lstrcmpiA WriteFileEx DeviceIoControl SystemTimeToFileTime GetLocalTime MapViewOfFile CreateFileMappingW CreateMutexW LoadResource FindResourceW CreateProcessW InitializeCriticalSection GetVersionExW IsBadCodePtr lstrlenA LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime lstrlenW CreateFileW ReadFile SetFilePointer GetFileSize lstrcpyW CloseHandle GetModuleHandleW GetModuleFileNameW GetFullPathNameW InterlockedExchange LocalFree InterlockedDecrement InterlockedIncrement LocalAlloc

advapi32

RegOpenKeyExW RegEnumValueW SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid GetSecurityInfo RegCreateKeyExW RegEnumKeyExW RegQueryValueW RegCreateKeyW RegOpenKeyW RegDeleteKeyW RegQueryValueExW RegDeleteValueW RegQueryInfoKeyW RegEnumKeyW AllocateAndInitializeSid RegSetValueExW RegCloseKey BuildTrusteeWithSidW

user32

mouse_event IsWindow CallWindowProcW wsprintfW CharUpperW UnhookWindowsHookEx GetWindowThreadProcessId IsIconic GetForegroundWindow GetWindowLongW CallNextHookEx SetWindowsHookExW PostThreadMessageW MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW SetTimer GetInputState SystemParametersInfoW IntersectRect GetWindowRect GetDesktopWindow MapWindowPoints GetClientRect ReleaseCapture SetCursorPos GetAsyncKeyState SetCapture ClipCursor ShowCursor GetMessageTime SendNotifyMessageW GetCursorPos GetSystemMetrics MapVirtualKeyW LoadStringW keybd_event GetKeyboardType IsRectEmpty SubtractRect SendMessageW RegisterWindowMessageW FindWindowW PostMessageW SetWindowLongW DefWindowProcW GetPropW SetPropW RemovePropW

winmm

mmioClose mmioOpenA mmioAscend mmioDescend mmioCreateChunk mmioRead mmioWrite

dinput.inf

SHA256 b457f9d6bdc0319e9d25bfdf45894a2ff15450d4d9c15f9c7440d03bcce06c9f
MD5 ccb9a9be27aff07fb568e8590337e530
SHA1 f114e3d8ab09613d9005680b5b44006a75d9a09c
SHA512 e64e41208546ec15e472c32815c96ac6c0cfeeed1663292beb35310e425bc8ee6229c3ec851561eab9f3781d4a0e1c6f3264b1def93555e32c3e7e83690e583b
SSDEEP 384:ljp4nYxTmr/xHz79a/Yh7hjN7D0gt9z7lQv2l6noRV7R7pz7j:ljp4npF3U/ghjtQIplS2l531j
TLSH
T1ACB22486DF1C0611D0C3AB09BB06BD06D12E7B5951A0941FEA9C6F0EF7CE62484F6D2B
MD5 SHA1 SHA512 SSDEEP TLSH

dinput.xpg

IMPHASH bbce740fef1666a6f7c543502180b356
SHA256 6d33bd779b70daed4296aa27113455811267a2d2df99b094d1d641be185d87ad
MD5 a0d6489eb1739bdc106b95266005e1d6
SHA1 ed42b1b53e9e9d8af356735c788dae88778649fa
SHA512 ecaf60050a5316870b9d400cbded221240cc607ab4b7a1406032dc2c89197403b1ad36805a631fa740e3d1f689f7a5dbe41b96cf4c1c22f78c1b52ccd0872c19
SSDEEP 6144:u/uc1FJVzUyEGEGswr616n1q121PTnnnnnnnnnnnnnnnnW:umCHzS9X
TLSH
T19FD4F911B3FD5629F2F3BB786EB916954E3BBDA2A936C10D0250254E1D31F90DA20B73
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

44181

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_except_handler3 malloc free _ftol

kernel32

LeaveCriticalSection SetEvent DeleteCriticalSection ResetEvent GetCurrentProcessId IsBadReadPtr IsBadWritePtr WideCharToMultiByte FreeLibraryAndExitThread WaitForSingleObject FreeLibrary GetLastError WaitForMultipleObjects SetThreadPriority CreateThread CreateEventW LoadLibraryW GetTickCount lstrcmpiW ReadFileEx DuplicateHandle GetCurrentProcess GetVersion lstrcpynW Sleep ReleaseMutex MulDiv LocalAlloc LocalReAlloc SleepEx ResumeThread OpenEventW GetProcAddress DisableThreadLibraryCalls UnmapViewOfFile MultiByteToWideChar lstrcmpW GetPrivateProfileStringW GetWindowsDirectoryW lstrcmpiA WriteFileEx DeviceIoControl SystemTimeToFileTime GetLocalTime MapViewOfFile CreateFileMappingW CreateMutexW LoadResource FindResourceW CreateProcessW InitializeCriticalSection GetVersionExW IsBadCodePtr lstrlenA EnterCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime lstrlenW CreateFileW InterlockedIncrement ReadFile SetFilePointer GetFileSize lstrcpyW CloseHandle GetModuleHandleW GetModuleFileNameW GetFullPathNameW InterlockedExchange LocalFree InterlockedDecrement

advapi32

RegDeleteValueW RegEnumValueW AllocateAndInitializeSid BuildTrusteeWithSidW SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid GetSecurityInfo RegCreateKeyExW RegEnumKeyExW RegQueryValueW RegCreateKeyW RegOpenKeyW RegDeleteKeyW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyW RegOpenKeyExW RegSetValueExW RegCloseKey

user32

MapWindowPoints GetRawInputDeviceList GetRawInputDeviceInfoW GetKeyboardType IsWindow wsprintfW CharUpperW UnhookWindowsHookEx GetWindowThreadProcessId IsIconic GetForegroundWindow GetWindowLongW CallNextHookEx SetWindowsHookExW PostThreadMessageW MsgWaitForMultipleObjects DefWindowProcW CreateWindowExW RegisterClassW LoadIconW LoadCursorW DestroyWindow DispatchMessageW TranslateMessage PeekMessageW SetTimer GetInputState SystemParametersInfoW IntersectRect GetWindowRect GetDesktopWindow GetClientRect ReleaseCapture SetCursorPos mouse_event GetAsyncKeyState SetCapture ClipCursor ShowCursor GetMessageTime SendNotifyMessageW GetCursorPos GetSystemMetrics MapVirtualKeyW LoadStringW keybd_event IsRectEmpty SubtractRect SendMessageW RegisterWindowMessageW FindWindowW PostMessageW SetWindowLongW GetPropW SetPropW RemovePropW CallWindowProcW

winmm

mmioClose mmioWrite mmioRead mmioOpenA mmioAscend mmioDescend mmioCreateChunk

dinput8.dll

IMPHASH 20264582df85180f5b29d7280a7ac0ee
SHA256 6162987ce4d5101168902bde04da37a0e7bd4d2e5cce2d732efacba97d52e899
MD5 9bc8e8eb2fb9d9405928eb0f5c3fa821
SHA1 516f8949e05b6727ed0dbd9ed0c474e5ac267e3c
SHA512 06209c6f99e103058335b21855f460bcf305c64b8d4b0454a729b7573e56c272ebe1a2f668549a4fa8e4bd0ea0f75fbe53d47df44dc3d379b382f7d6b533250e
SSDEEP 6144:6auXlAzI0TrpIh+78u6BGj+1r45zW1t121qA3nnnnnnnnnnnnnnnn:rAP0lBtj+
TLSH
T1F5E40A11B3FC5629F6F3AB786EB912954E3BBDA6A935C50E0250254E1D31F90DE20B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

50851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_except_handler3 strchr iswctype towupper _ftol

kernel32

IsBadReadPtr IsBadWritePtr lstrcpyW lstrcmpW FreeLibraryAndExitThread FreeLibrary GetLastError WaitForMultipleObjects SetThreadPriority CreateThread CreateEventW LoadLibraryW GetTickCount lstrcmpiW ReadFileEx DuplicateHandle GetCurrentProcess ReleaseMutex WaitForSingleObject MulDiv GetVersion LocalAlloc LocalReAlloc GetCurrentProcessId ResumeThread GetProcAddress DisableThreadLibraryCalls UnmapViewOfFile MultiByteToWideChar lstrlenA IsBadCodePtr CompareFileTime lstrcpynW GetPrivateProfileStringW GetWindowsDirectoryW WriteFileEx Sleep DeviceIoControl SystemTimeToFileTime GetLocalTime HeapFree HeapAlloc GetProcessHeap MapViewOfFile CreateFileMappingW CreateMutexW LoadResource FindResourceW CreateProcessW InitializeCriticalSection GetVersionExW CreateFileA GetFullPathNameA WideCharToMultiByte ResetEvent DeleteCriticalSection SetEvent LeaveCriticalSection EnterCriticalSection GetCurrentThreadId lstrlenW GetSystemTimeAsFileTime CreateFileW ReadFile SetFilePointer GetFileSize CloseHandle GetModuleHandleW GetModuleFileNameW GetFullPathNameW InterlockedExchange LocalFree InterlockedDecrement InterlockedIncrement SleepEx

advapi32

RegEnumValueW BuildTrusteeWithSidW SetEntriesInAclW GetSecurityInfo RegDeleteKeyW AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAceEx InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorControl FreeSid RegEnumKeyExW RegSetKeySecurity RegCreateKeyW RegOpenKeyW RegQueryValueW RegDeleteValueW RegQueryInfoKeyW RegEnumKeyW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey GetUserNameW RegCreateKeyExW

user32

MapVirtualKeyExW GetKeyboardLayout GetActiveWindow GetKeyNameTextW ToUnicodeEx PostMessageW wsprintfW CharUpperW UnhookWindowsHookEx GetWindowThreadProcessId IsIconic GetForegroundWindow GetWindowLongW CallNextHookEx SetWindowsHookExW PostThreadMessageW MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW SetTimer GetInputState SystemParametersInfoW IntersectRect GetWindowRect GetDesktopWindow MapWindowPoints GetClientRect ReleaseCapture SetCursorPos mouse_event GetAsyncKeyState SetCapture ClipCursor ShowCursor GetMessageTime SendNotifyMessageW GetCursorPos GetSystemMetrics MapVirtualKeyW LoadStringW keybd_event GetKeyboardType IsRectEmpty SubtractRect RegisterWindowMessageW SetWindowLongW DefWindowProcW GetPropW SetPropW RemovePropW CallWindowProcW IsWindow

dinput8.xpg

IMPHASH 2d552e50787a48e41699730d07d32036
SHA256 48d05ae3fe993c9c64d442bf5440ff03a15609396d7c39637ddbf836b6eb3e1b
MD5 c026f271456e1fc247f7bfb362258bff
SHA1 8cd0742682fb2590f8d9f372911abd5504f3159d
SHA512 a9a38c9cd912bbeaa6af3fdde9e3fe76f60d1aa591b30b2518f4c641c7db1424ce8d5c93bdcb0aef9bd5c65e3ed990cbb5b7c97be9ad155154c9f920e0a7be45
SSDEEP 6144:GoVJKqjmlTkcUpgGq71uDsKrV+zW1t121wXRnnnnnnnnnnnnnnnnn:7VIlNBr78s
TLSH
T179E4FA11A3FC5629F6F3BF786EB916954E3BBDA2A936C10D1250254E1D31F90DA20B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

51637

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_except_handler3 malloc free strchr iswctype towupper _ftol

kernel32

WideCharToMultiByte GetCurrentProcessId IsBadReadPtr IsBadWritePtr lstrcpyW lstrcmpW FreeLibraryAndExitThread WaitForSingleObject FreeLibrary GetLastError WaitForMultipleObjects SetThreadPriority CreateThread CreateEventW LoadLibraryW GetTickCount lstrcmpiW ReadFileEx DuplicateHandle GetCurrentProcess ReleaseMutex MulDiv GetVersion LocalAlloc LocalReAlloc SleepEx ResumeThread ResetEvent DisableThreadLibraryCalls UnmapViewOfFile MultiByteToWideChar lstrlenA IsBadCodePtr CompareFileTime lstrcpynW GetPrivateProfileStringW GetWindowsDirectoryW WriteFileEx Sleep DeviceIoControl SystemTimeToFileTime GetLocalTime HeapFree HeapAlloc GetProcessHeap MapViewOfFile CreateFileMappingW CreateMutexW LoadResource FindResourceW CreateProcessW InitializeCriticalSection GetVersionExW CreateFileA GetFullPathNameA DeleteCriticalSection SetEvent InterlockedIncrement LeaveCriticalSection EnterCriticalSection GetCurrentThreadId lstrlenW GetSystemTimeAsFileTime CreateFileW ReadFile SetFilePointer GetFileSize CloseHandle GetModuleHandleW GetModuleFileNameW GetFullPathNameW InterlockedExchange LocalFree InterlockedDecrement GetProcAddress

advapi32

RegOpenKeyExW RegEnumValueW BuildTrusteeWithSidW SetEntriesInAclW GetSecurityInfo RegDeleteKeyW GetUserNameW RegCreateKeyExW AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAceEx InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorControl FreeSid RegEnumKeyExW RegSetKeySecurity RegCreateKeyW RegOpenKeyW RegQueryValueW RegDeleteValueW RegQueryInfoKeyW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey

user32

MapVirtualKeyExW GetKeyboardLayout GetActiveWindow GetKeyNameTextW GetKeyboardType GetRawInputDeviceInfoW GetRawInputDeviceList PostMessageW wsprintfW CharUpperW UnhookWindowsHookEx GetWindowThreadProcessId IsIconic GetForegroundWindow GetWindowLongW CallNextHookEx SetWindowsHookExW PostThreadMessageW MsgWaitForMultipleObjects DefWindowProcW CreateWindowExW RegisterClassW LoadIconW LoadCursorW DestroyWindow DispatchMessageW TranslateMessage PeekMessageW SetTimer GetInputState SystemParametersInfoW IntersectRect GetWindowRect GetDesktopWindow MapWindowPoints GetClientRect ReleaseCapture SetCursorPos mouse_event GetAsyncKeyState SetCapture ClipCursor ShowCursor GetMessageTime SendNotifyMessageW GetCursorPos GetSystemMetrics MapVirtualKeyW LoadStringW keybd_event IsRectEmpty SubtractRect RegisterWindowMessageW SetWindowLongW GetPropW SetPropW RemovePropW CallWindowProcW IsWindow ToUnicodeEx

dmband.dll

IMPHASH 2dd98eee91901e42aced29ca5eefb08b
SHA256 9b47be4207fdf4938ed2efe147267368156eff3ef858532894dc65994431ab78
MD5 d9fa25931877554c70afff8caef2fa01
SHA1 2a4a97e44ab654f29f33482858b4cb3d4ca59b94
SHA512 d5bf731f1312bc1a5eec9fbb338e28633f41e83941d00780713e296130f83fea9de81ab6736bf85591c0ca3c969bb37caf9ec7d53fbae05129ad83ceb6007fa2
SSDEEP 384:H+RBs49fj7nR2QbX8K8Iv9YFQNKaOb8CIvuV2A8dPCrofD7+p0kWhKZW1:H+7HBnLv/iFmKrb8CIvuAA0PWa7iRg
TLSH
T185C23B63B3E18079E97A1235AF65276923FBD720895A554213451B8E37B08C2E23EB07
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmcompos.dll

IMPHASH 968421b7ed4e42ca13de160c864b4ae6
SHA256 710f66714db0e5c6188d9a0f39e21f06ddcc9ded23e5457e07f8c04ed09de697
MD5 989ba23c8505cba0a9bf202da0c0d06f
SHA1 55712157c443758b17c1eebf374cc7ab09cb4085
SHA512 c13e2687abd9ecceea93f8530ae045e7d368d699a2651dae690e52e1e3ef5b9ab8a63ea83400903157eea627d0417b08553576f95b2fea45b4c7bef1b94612d6
SSDEEP 768:PpjWekfKuZSXp4aVPKRORsyHicwjoE2yjMdGtW7EQj274AMHezbMirGzam:VkFSZZVPK4Rsya92TMQ7EQjpe5r+/
TLSH
T106436C6373E3C0F6D1632171DA08A7EA17F99B2D583B858A67180F4E7B609C5973C50B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

53673

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmime.dll

IMPHASH e84f92ef3e04403f433866f3a97f487c
SHA256 a228e18ff64273e9a6193a95362f8e50d3672321fa60b3f7072c4a9ee42303c8
MD5 2cc3c8a3b898606b3422a1b8a065ed5b
SHA1 b88faec9a7b8b7d35d81101308f7509c0ae15273
SHA512 08f3194296383b922df311e353452029d4623cd1f0ef86d0e823bc31024bf95c24c58cba3273623fcab70039afe27d17347834e5d3c4333449094e2726a2cccc
SSDEEP 3072:Z4FYkXv4moqzj6dn+byWi8M+43UXZIKmU5//02dEEfvE:GWqvcqzj6d+OWNX9qKmU5XpE
TLSH
T120F37C2173D2C03AE483A2328A0973BAF3F9DB292637565312541F1DFBB0596A73D647
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

157721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmloader.dll

IMPHASH 8332206d5778356b1110b44f2e3cfdef
SHA256 544800d356d887b9dd560807b93e8031c9dffd8fe2c70c515ee33105d9867fee
MD5 350527f0de735d2e4ac4fa5f892a41b2
SHA1 a840241b2b273bbf67e60421773ced34fe5fc9cf
SHA512 b9d780bcce6b06ed439c2811042407fb9376fdfdeb2ffa3ce75744c704ba10681f41c9c38f4942b324c1dcac57bf078d37ebad8f1c34cef95cfdec49da583f8b
SSDEEP 768:K3k/xJStMm6UB4kyVkxPzrueihLGP6/zUKpmMtfmw:L/xJKMU+87rXPQ4K8MAw
TLSH
T18DE28C93B7E394B9E7939630A95A73DA23B9A7744A2910165B410B0F3E71A52E33C703
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmscript.dll

IMPHASH 903e24e172a63cf62c8720d3d4074255
SHA256 28d548356bf614035ad26ec572533c09bc88d9cd693a360a2cc74a4b8ea3172a
MD5 e0148ed5eba4a5ddf173c7f40b3b7a26
SHA1 8f4ff2dd7594f07fd80e6db3fc5a3d4dee11064b
SHA512 b46216d9f65b8adb37e9124c9f5fd47c0ff8cb7d51331320aacab2bb50893380ace696605d42e401e4f6e0a7cfd44e2a4abe6c77d691b2b0ac42ca21a10180a8
SSDEEP 1536:CqnzhvqHa+ekgfjpNdvI4b7HYgRsqwCJhzVVXf4Kl3p+n:rS6D9pN9ZbdRs+hMK5pM
TLSH
T116735C2277E58036F77276764A30B269A3FA99142D3BDE1613140B4D2EB1E83E97C347
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

69597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmstyle.dll

IMPHASH 9b9b56669a52debf1b2dccbc03819e5c
SHA256 c7ef00e4f266b88d65a93ee043d990ede09668a2c356896f5d488831dd62505e
MD5 10888b2d07e0d0b4bf359ec02340b838
SHA1 07f8a4e551188eee7b7c4c670f0a4bd8104ef471
SHA512 f21027df801097b78599818084c0fc688aba09f50617ffc19ccbcb3566ac1125ca32ab26980c74d75a8e229b0071e1223de383c740ea0ef3b9d5b7141bf51f8b
SSDEEP 1536:p9KTQGLwfvrhCqa7KcCiOIHzZtxwDl0L/pgupbATi7mV9FX2/FNmBv:pYTQG0fUKcMIvCDlsqCbQrVfG6Bv
TLSH
T1D3A37C52B3D6C03BE65651319A18B3EA73FAC718282AB5077B145E8DBBB04C1D3BD607
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

91279

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmsynth.dll

IMPHASH 7bc002e7c5147c1079569ca2d742d33d
SHA256 eb164cc9722e4a04d11bd77b7b98c57a7b76fc5564abbf35c5ee693c1b7571fa
MD5 9a71f870820f8a5193484854e470a80a
SHA1 aa49f126b7379214b0eb6859e0cc2842f9ee2fa7
SHA512 9312c890f0c4b3d9591f83a5b95bed62e95b30b7368be434302792cd4c3fa0417d41a40bb2908dae505b95a5b2972c1c25860c6538eb8275451b1b476139e8c3
SSDEEP 1536:tAtsOAIBRqtvWRbr6QsndNgL1ciyZR7TpbFcE8VfC9roux2srOpaGOS7:tjIusJrNsnduL1KxOxwOpaGOS7
TLSH
T15AA37E52FEA641FAEC82E935940B73B397769F158525818393A0FF6C69302C1B97D322
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

76374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dmusic.dll

IMPHASH 0d0933e7a3778416c0a53f39a2e21c7e
SHA256 8d33e7113b5c9743d6cc27c4f62d827647ddad59bc403fb4e6135488958e0a67
MD5 bcc54d945bf09ea5fa07bce2c16aff7d
SHA1 5829e8f316e54b95f4f7d1c02f8426d4ab8b9076
SHA512 e5f02634830e205db04486de8e4ea73fa943d88363fc9366fd152a7dcb118befde73f6cca3ac591365c0c281e255f814d1a56b8af6f456e1e53f2da41a4f9184
SSDEEP 3072:keUmWwKwipeXH3J02d6cGYqMTC9I5OWDAFavxthuVusU:Y7peppNiasU
TLSH
T1D5B3395033F65439F9E32A305DB6776BA6B6FB295E36822E06001B8D2CF4D42C539B53
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

87999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection LoadLibraryA GetVersionExA DisableThreadLibraryCalls IsBadCodePtr FreeLibrary lstrlenA lstrcatA lstrcpyA GetModuleFileNameA ResetEvent SetEvent PulseEvent WaitForMultipleObjects CreateThread CreateEventA MultiByteToWideChar InterlockedExchange CreateFileA LocalFree LocalAlloc GetProcAddress GetOverlappedResult SetLastError GetCurrentProcessId DuplicateHandle GetCurrentProcess OpenProcess Sleep QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess CreateFileMappingA GetLastError MapViewOfFile CreateMutexA WaitForSingleObject ReleaseMutex CloseHandle UnmapViewOfFile InterlockedDecrement InterlockedIncrement IsBadReadPtr DeviceIoControl IsBadWritePtr

msvcrt

malloc _stricmp wcscmp mbstowcs _wcsicmp wcstombs wcscpy _purecall __CxxFrameHandler free _initterm memmove _except_handler3 wcscat wcsncpy _adjust_fdiv

winmm

timeSetEvent midiOutUnprepareHeader midiOutLongMsg midiOutShortMsg midiOutClose midiOutOpen midiOutPrepareHeader midiInClose midiInReset midiInAddBuffer midiInPrepareHeader midiInUnprepareHeader midiInStart timeKillEvent midiOutGetNumDevs timeEndPeriod midiOutGetDevCapsA midiInGetNumDevs midiInGetDevCapsA waveOutMessage timeBeginPeriod midiInOpen timeGetTime

user32

wsprintfA wsprintfW GetForegroundWindow GetDesktopWindow LoadStringA IsWindow

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyA RegOpenKeyExA RegSetValueExA RegCreateKeyW RegCreateKeyA RegEnumKeyA RegCreateKeyExA RegDeleteKeyA

rpcrt4

UuidCreate

ole32

StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromString

msacm32

acmStreamPrepareHeader acmStreamConvert acmStreamUnprepareHeader acmStreamClose acmStreamOpen acmStreamSize acmFormatSuggest

dsound

ord11

dmusic.inf

SHA256 d93e8faf798cd31f44d2ceb42506e00d26b2834aad77fe0915e906aaf543cbf6
MD5 6e5ed8816a6182d57502b63c91a833af
SHA1 7bd69ac6bb9d08756f00e34f4638b9b4f2cfdd8c
SHA512 77efc0c1607a438ed273bbc2bbb2d5d87810606949255cc0e75f4feb3a09f0f947a7d225f731b227f87fb306cec9e732b62a00251269947a6e31a505c15a861f
SSDEEP 384:b7reL4Pzs+0QMswKMAoyGtP5tD1nCfeCbmhvOzvqz0s7gs3kp70P7eRO+O2q+rZe:2W3r1oHE7yo6SfjctgW2h/ey+UG4q
TLSH
T195136A19FECEE09AEFDBE18558D41A61675C06A310CFFF6812DDA7680D0B9F5E02A053
MD5 SHA1 SHA512 SSDEEP TLSH

dplay.inf

SHA256 89a14e722647aef89e8b5a36b8ac7e2b27f1398d35e4e401d411f823a5dfd1de
MD5 798d1b276d1ed717bb32666141cab716
SHA1 894a84a567bda05eb324f6d88e209677f72546ce
SHA512 3433fd995e9e6268ad9c4b8fbdace4faaab8f0ecfa5d694955796eb276f937866faa68c1f6132874c598e96e970529f34c72396b7f3a765c920f934936d1d602
SSDEEP 384:L09jzsEAqQCXXg8ouCR5zB7Bo0nRKBhBkRYTKB:vxQ4
TLSH
T12A62AB60BCDEB11131E275C07576A041687640F3580E82AC296643A7B39E6DEE3FE79F
MD5 SHA1 SHA512 SSDEEP TLSH

dplaysvr.exe

IMPHASH 0e2d56d5ee03e5e670b2f35982dccb42
SHA256 e3ee1e2d903237131ba42c770f07e7eceaa3574b4ce718062a4e3c1f9cdbf893
MD5 b3cf3924d51ff06ec7293383cc23ceca
SHA1 bb405ee204bada9b7cc06ce35aa6a1ff8ae1795d
SHA512 d4658ab7187c5450c6647d07cddaa313d6fb9108284b5bc6a45ad5185d867f311f1a2997edc98a4984f9ba3419003d1ec4cec5c92c3d666be7a6e8000f09256f
SSDEEP 384:UcIqBALuftzYypZXBEOZqaEg440qmcG7qknkdigoJUr+7bIGiJhT8i6j9g3AlG2j:Sq2Lwn/Ia+qmc7oJ4MxiJhuWwl3OYpp
TLSH
T1C2C27C0170A8C83FE1534674C575AB06E7BA5E000BB5B7CF9B84A99BAB363D4E539343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree DeleteCriticalSection UnmapViewOfFile GetCurrentProcessId MapViewOfFile SetEvent InitializeCriticalSection CreateMutexA CreateFileMappingA CreateEventA GetLastError GetCurrentProcess SetCurrentDirectoryA GetSystemDirectoryA HeapReAlloc QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetProcessHeap HeapAlloc LoadLibraryA GetProcAddress FreeLibrary CreateThread OpenProcess WaitForSingleObject ExitThread EnterCriticalSection LeaveCriticalSection CloseHandle GetVersionExA GetSystemInfo VirtualProtect GetLocaleInfoA RtlUnwind GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetCommandLineA GetStartupInfoA ExitProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapDestroy HeapCreate VirtualFree GetACP GetOEMCP GetCPInfo Sleep VirtualAlloc VirtualQuery

advapi32

RegEnumKeyExA FreeSid RegOpenKeyExA RegQueryValueExA RegCloseKey InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl

gdi32

GetStockObject

user32

DefWindowProcA RegisterClassA CreateWindowExA GetMessageA TranslateMessage DispatchMessageA

winmm

timeGetTime

dplayx.dll

IMPHASH cbe881ee03c779cb1aa48dc35de15730
SHA256 7fe78e39c52357b722819eceed0b5e695b1b8435ef35a74015c5dad2ad78be12
MD5 57845c9ae5f2dd884e50482bcf3d49b5
SHA1 006e63f3eaac0637a71993e2ad390731c1539b54
SHA512 0986dbf862b1a2f0cdc93fc19b9c1a3ff1fed05e40b8ff5238514c7997825e3d746d067b4f9ce748d33229014ada0303235fb6b0dda64950a363eedfe8ea575e
SSDEEP 3072:SHFOz/apwq0p0vVw7/Wxf3VLt3QKEVYLiun/CH3i35IXATBO3iT3u7:kFODaSKplxxMc5XT/u
TLSH
T150244B02F7910C72C4572BB98D9933E66379CB0E4979D7160B39187B3A15CF29BB920E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

74728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ReleaseMutex SetEvent WaitForSingleObject GetTickCount CreateThread ResetEvent lstrlenA Sleep FreeLibrary GetVersionExA DuplicateHandle GetCurrentProcess LoadLibraryW LoadLibraryA GetProcAddress CreateEventW CreateMutexW CreateFileMappingW OpenFileMappingW OpenFileMappingA CreateProcessW CreateProcessA GetCurrentDirectoryW CreateFileMappingA CompareStringW CompareStringA GetProfileIntA InterlockedIncrement InterlockedExchange DisableThreadLibraryCalls LocalFree DebugBreak WaitForMultipleObjects HeapAlloc HeapFree HeapReAlloc GetProcessHeap WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime TerminateProcess GetStringTypeA VirtualQuery GetSystemInfo VirtualProtect GetCPInfo GetLocaleInfoA GetLastError MapViewOfFile CreateEventA CreateMutexA GetCurrentProcessId UnmapViewOfFile IsBadCodePtr IsBadReadPtr GetModuleHandleA GetModuleFileNameA CreateFileA CloseHandle SetFilePointer ReadFile InterlockedDecrement IsBadWritePtr InitializeCriticalSection DeleteCriticalSection EnterCriticalSection GetCurrentDirectoryA LeaveCriticalSection LCMapStringW LCMapStringA VirtualAlloc VirtualFree GetCommandLineW GetCommandLineA ExitThread OpenProcess ResumeThread GlobalFree GlobalAlloc ReleaseSemaphore CreateSemaphoreA GetStringTypeW

ntdll

RtlUnwind

rpcrt4

UuidCreate

user32

wsprintfW wsprintfA

advapi32

RegDeleteKeyA RegDeleteKeyW RegCreateKeyExA RegCreateKeyExW RegDeleteValueA RegDeleteValueW RegEnumValueA RegEnumValueW RegSetValueExA RegSetValueExW RegEnumKeyExA RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyA RegQueryValueExA RegOpenKeyA RegCloseKey RegQueryInfoKeyW

winmm

timeSetEvent timeKillEvent timeGetDevCaps timeGetTime

dpmodemx.dll

IMPHASH 11047f92afa1f1e11ff8e095545a3dd4
SHA256 200753c96fd4ceac9b9bbed12a4b74d5c25df522cb32820dfc58d3d193be8eec
MD5 a9f01adb35efb4457887e1f19f64ce5d
SHA1 c69d6c0e8d92b88da51eb814ce4987fbfee6d0ca
SHA512 5c05be6f1cbd606bfaa1189d988a82f14caea64fe0fc844f5a4d341284e2b12c358185e220d50b6063e68ac00e2d6c8b1f0f8186b7e660d28d31cb99b729c061
SSDEEP 1536:Lxu8UVLNY6CgV1Ct4pGRVWRs32d3xakCgdMRxGy3SrcW5u:lpUVhY69i4pG72lwkCgdMRUy3SrcW5u
TLSH
T1F173F12163F84615F0F39F7498F643A7663ABC51EA36C31F9A40674E2831A94DA31B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls LeaveCriticalSection EnterCriticalSection PurgeComm EscapeCommFunction WaitForSingleObject SetCommMask SetEvent CloseHandle GetOverlappedResult GetLastError ReadFile ClearCommError WriteFile GetCommState ExitThread WaitForMultipleObjects WaitCommEvent CreateEventA ResumeThread SetThreadPriority CreateThread InitializeCriticalSection SetupComm SetCommState CreateFileA lstrlenA Sleep GetTickCount HeapAlloc HeapFree HeapReAlloc GetProcessHeap WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess SetCommTimeouts DeleteCriticalSection

user32

DispatchMessageA KillTimer PeekMessageA SetDlgItemTextA GetParent wsprintfA SetTimer GetWindowRect GetDesktopWindow SetWindowPos GetDlgItemTextA EnableWindow GetForegroundWindow DialogBoxParamA GetWindowLongA EndDialog SetWindowLongA GetDlgItem SetFocus TranslateMessage SendDlgItemMessageA LoadStringA

tapi32

lineInitialize lineShutdown lineDeallocateCall lineOpen lineNegotiateAPIVersion lineGetID lineGetCallInfo lineGetDevCaps lineAnswer lineDrop lineMakeCall lineClose lineConfigDialog

dplayx

gdwDPlaySPRefCount

dpnaddr.dll

SHA256 d8e745adde0a4f38d915a0b130dc4eb7920d9b96f99bebb992184519c29fa050
MD5 62e741785abde1524a86b480ae922e96
SHA1 ce02b6613fa54edccbe3ba4b0b663e4a17de16b3
SHA512 df8c59cd75ac08a59c64264b36199350d540b93b446a54f9fc270cbd2a44397c8a4c4ebdfb7aa281efe0b2339aa28dbdebbd6ccb6a168d38f4d44fcdc26bdce3
TLSH
T10351AF01A3F80A19F4B70B795DF74627A079BC209F76D25D0E50126E2C71668C972F73
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpnet.dll

IMPHASH 7cd8abafddca244dc1e8376ad8a2fc46
SHA256 b3f41e537797abc414fda5136a864865c37e7324b55a9a5705c6761ff9a8e816
MD5 6ea6032ab20a77e80ad479bf4cd433d4
SHA1 2d1ff2a1895f74ef49fd237746375bd36be9ee3c
SHA512 72c5c00c7a5248b5eec8f1c10eedb9ba493323951f504055dde94334002af2a3adb7c5b62adee8ba68253c7d7e63f3c19bc21662d5d16ffa8501d76e6a912e08
SSDEEP 12288:QNVbQYsTvBX8dZYLlRlckmZReZMMw6Kbp:QN1QvjgGJRlYcxw6
TLSH
T149F4825167F84229F2F37B306AB813656E7BBD919D38C54E028124AD1DB0E41EEB4B73
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

126137

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls CreateEventW CloseHandle IsBadReadPtr IsBadWritePtr Sleep GetCurrentThreadId ResetEvent InterlockedDecrement SetEvent InterlockedIncrement InitializeCriticalSectionAndSpinCount IsBadStringPtrA IsBadStringPtrW GetLastError GetModuleHandleW GetVersionExW FreeLibrary LoadLibraryW lstrcpyW lstrlenW LocalFree TlsFree CreateSemaphoreW TlsAlloc GetSystemInfo TlsSetValue WaitForSingleObject TlsGetValue LeaveCriticalSection ReleaseSemaphore InterlockedExchange SignalObjectAndWait SetThreadPriority SetThreadAffinityMask SetThreadIdealProcessor GetCurrentThread CreateThread CancelIo SetWaitableTimer CreateWaitableTimerW InterlockedExchangeAdd InterlockedCompareExchange GetModuleFileNameW LoadLibraryA GetSystemDirectoryA SetLastError OpenEventW CreateProcessW GetSystemDirectoryW ReleaseMutex UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateMutexW GetCommandLineW OpenProcess GetExitCodeProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar CreateFileW WaitForSingleObjectEx CreateIoCompletionPort SleepEx PostQueuedCompletionStatus GetQueuedCompletionStatus WaitForMultipleObjectsEx SetCommMask PurgeComm SetCommTimeouts SetCommState ReadFile FlushFileBuffers WriteFile lstrcpynW FormatMessageW GetStdHandle DuplicateHandle CreatePipe EnterCriticalSection DeleteCriticalSection HeapFree GetProcessHeap WaitForMultipleObjects HeapAlloc

winmm

timeGetTime timeBeginPeriod timeEndPeriod

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoCreateGuid StringFromGUID2 CLSIDFromString

msvcrt

calloc malloc _adjust_fdiv _initterm free wcscpy wcslen _stricmp wcsrchr _wcsnicmp wcsstr wcsncpy memmove strncpy swprintf srand _ftol wcscat _wcsicmp wcscmp wcstoul wcsncmp _wsplitpath strtoul strchr sprintf strtol _except_handler3

ws2_32

WSASetLastError WSAIoctl WSARecvFrom WSAGetOverlappedResult shutdown WSASendTo setsockopt gethostname bind getsockname getservbyport gethostbyaddr getservbyname htonl inet_ntoa WSAGetLastError socket inet_addr gethostbyname htons ntohs WSAStartup WSACleanup getsockopt closesocket

user32

wsprintfA wsprintfW CharNextW PostMessageW DialogBoxParamW GetWindowLongW EndDialog SetWindowLongW GetWindowTextW GetDlgItem SendMessageW SetWindowTextW LoadStringW

advapi32

CryptReleaseContext FreeSid AddAccessAllowedAce InitializeAcl GetLengthSid SetSecurityDescriptorDacl AllocateAndInitializeSid InitializeSecurityDescriptor CryptAcquireContextW RegCloseKey RegEnumKeyExW RegEnumValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW CryptGenRandom

dpnhpast.dll

IMPHASH 103a3a8f5867b82d4d9d14ed0aa51885
SHA256 ab9743ce54837735f0e1cb8840ac58d578093078bc80e0dd91219dc37e5a703d
MD5 d98628937fd50cda89c64973cef9dd84
SHA1 2d8c793bb60d35279b86b00f168208fcd88273e4
SHA512 9850806bdcab64e9029030d24b05cd2305cc80e7a0006e454f165023239a33a7a1a3b6c048ef4835682e2f8e72f4a59718bcefa6881e07fabb964ad6e469fe35
SSDEEP 768:WdmwgVn9+i+b1fA7Sr+aGez4d6R71TzlZwVsd:Wd7gVn7U+aGY2Q6+d
TLSH
T10DE25B00FAE0C075D46353B05E7C7316EAFBAA6619548D7B23012E9A2934793F3BD74A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27497

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpnhupnp.dll

IMPHASH e1a61076ca8761b8ba640bb74494bcde
SHA256 59e74dd3de40e22aac95133cf746be32cb0de40e4fc801cf63be13d9e2ca8134
MD5 a337328c4d6994e9cca40e0969b0b1f9
SHA1 8ad62a0bb8249be9fdaf21b648903656c8e43cfe
SHA512 a98768549ef58a635e9432be1cac8a8c1561a58bc1abb5e518b2259e58f67387dbbc04057358ac959f9572524802649bca3a893f2bec5a2b51a7877794ed2a6e
SSDEEP 1536:58A+Jttfu2gnxicG1Bu7f7ZpgpYU8d1ej1amOmeDSYfwf:5uZcwBgDLO8d1+kmeDSYIf
TLSH
T1B1637C7BF6F5847AD87212B0585C3352F6B6BE251A248C8763404F861235A87F3BDB27
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

60048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

PostQueuedCompletionStatus SetEvent CreateEventW FreeLibrary GetVersionExW QueryPerformanceCounter InterlockedDecrement GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess Sleep CreateIoCompletionPort GetCurrentProcess DuplicateHandle IsBadWritePtr GetLastError OpenEventW GetModuleFileNameW ReleaseSemaphore GetCurrentThreadId WaitForSingleObject CloseHandle CreateSemaphoreW IsBadReadPtr InterlockedIncrement HeapAlloc DisableThreadLibraryCalls DeleteCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW GetProcAddress HeapFree GetProcessHeap GetTickCount MultiByteToWideChar WideCharToMultiByte GetModuleHandleW IsBadStringPtrW InitializeCriticalSectionAndSpinCount LocalFree lstrlenW lstrcpyW

user32

wsprintfW

winmm

timeGetTime

advapi32

InitializeAcl RegEnumValueW RegSetValueExW RegQueryValueExW AllocateAndInitializeSid GetLengthSid AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid OpenSCManagerW OpenServiceW QueryServiceConfigW CloseServiceHandle CryptAcquireContextW CryptGenRandom CryptReleaseContext RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW RegCloseKey

ole32

CoCreateInstance CoTaskMemFree CoUninitialize StringFromGUID2 CoInitializeEx CoSetProxyBlanket

msvcrt

malloc strtok strstr _adjust_fdiv _wcsicmp _stricmp _strnicmp atoi _wsplitpath wcslen srand swprintf _initterm free strchr wcscpy _except_handler3

dpnlobby.dll

SHA256 d0553ca14ed69afba892e30fe4069c180b07361106eb118a0536c82209469812
MD5 1fd0aecab0ee7510b52081789919c9d9
SHA1 d7a90213c830fed3b55b7254ba0e2a594c1bc7a5
SHA512 43f868b77ee35407ed92ee6775954cce40a835e699624b1300eea4491d0c63ffb92a50d80f6d1b4c338b5faf2c12492be6a13b8016c858f5302b06436a50c1e9
TLSH
T14751AC01A3F81629F4F70B795CF70767A07ABC209B76D25D0A50239E2C705A48971F73
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpnsvr.exe

IMPHASH 14afd694d39937cccde81195f7378eb3
SHA256 1ff263d2c1a97d422f94dd3d0872b1fa49de99b825ba64a5bf06f483a1849ac7
MD5 162a9cbd15be74c26912d57b198bc9d9
SHA1 b278c878fd6db3c3563632ed7d54c785c0679543
SHA512 a12de324b79062dec11cb360dbf5c93a82079fe213597a4e5c5482addf72c055c311a18ecc0514f44b4183d00a2a96aafd139c77215c87aa9534fab8a71a5afe
SSDEEP 384:PMgJp6Ur+pg1tmHLbJKX4RO1tvZScsSTXaOXDskkRD6GmfjkeWrvQW:0g1Kdi4ROjvZSUDskNGeS
TLSH
T149725A92B2FA483FE06287704FB5679BB5B4E7405871532F5B444D8F2A2E981A631F33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileMappingW InterlockedDecrement QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess GetProcessHeap HeapFree CompareStringW MapViewOfFile UnmapViewOfFile WaitForSingleObject ReleaseMutex CreateEventW CreateMutexW DeleteCriticalSection SetEvent GetTickCount LeaveCriticalSection EnterCriticalSection HeapAlloc OpenProcess GetLastError CloseHandle InterlockedIncrement lstrlenW GetStartupInfoW InitializeCriticalSectionAndSpinCount GetModuleHandleW GetVersionExW FreeLibrary LoadLibraryW lstrcpyW OpenEventW ReleaseSemaphore CreateSemaphoreW

ole32

CoUninitialize CoInitializeEx CoCreateGuid StringFromGUID2 CoCreateInstance

msvcrt

_except_handler3 _controlfp __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __wgetmainargs _wcmdln exit _cexit _XcptFilter _exit _c_exit wcslen __set_app_type srand wcscpy

advapi32

RegCreateKeyExW FreeSid SetSecurityDescriptorDacl CryptReleaseContext InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor CryptAcquireContextW RegCloseKey RegQueryValueExW RegOpenKeyExW AddAccessAllowedAce

user32

wsprintfW

winmm

timeGetTime

dpvacm.dll

IMPHASH b17f510eadb77dc154e2cac23cbb4c04
SHA256 4b21c76105096f0a02678b00b0ccff11276bbf0d39d63dd063c5df43b9238c25
MD5 b76ff66231e355f7b1f607657a6fa188
SHA1 777163fb5b5a0d40f0903f9628af6f36f78b0916
SHA512 209126a5e5b55bd6269ce1aac2f000a007af3ce6edccd1e26d1acbd4f5fb9f4bf1c7e283d4cfa7e78e8414532ad962aceafd81dace51d75ee38cfd6000f32c36
SSDEEP 384:vzCjI2yob0h4vXLBHwwAviSwSeeJgpmY+nS180r9qdfqpEohviWkU0Wvgc:vzCj/yob04VillgplZ+K9F6ol5pg
TLSH
T106921A02F7E20176F57296B019B53676D9FAF6A06970CD5DA3105C8A1874B03E2FEB13
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16363

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpvoice.dll

IMPHASH 9c767fdfde0fefa8d0dedc5ac9f6dbea
SHA256 9b1c0f547598bd1c48c54a687801f4dbbb28634c7c133b21f0ef7631bb9712e6
MD5 6a3a72b878cd71364532534412abe15b
SHA1 f302dfe2e60a3363ced98192e2362166f5a87c86
SHA512 843fc0178448c468e1ae3f24b2266a93577a99fa8e402d3a9b4be4e37503d55eb1f9fe8453f8a4ad464da492c09109a20f566eba2a41aa1ed56654e054f23b39
SSDEEP 3072:5MEVPFPElEmD02kLc0M/DBMLdO1+Y78/iYhZdg3GY/LanUic+CqDEN57Eg88UakC:mEdk/DBMaLgZkz/fYCS4d
TLSH
T14F849F21E7FA8221F8F36B7C6DB817926D367D528E34C50E6604228E1DF4A52DA35733
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

73097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA InterlockedCompareExchange GetCurrentProcess GetSystemInfo CreateSemaphoreW LoadLibraryW GetProcAddress FreeLibrary GetCurrentProcessId ProcessIdToSessionId InterlockedExchange ResetEvent IsBadWritePtr IsBadReadPtr Sleep TerminateProcess GetProfileIntA GetModuleFileNameW lstrcpynW GetWindowsDirectoryW CreateEventW CreateThread SetThreadPriority DeleteCriticalSection GetTickCount WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement ReleaseSemaphore CloseHandle SetEvent WaitForSingleObject HeapFree GetProcessHeap WideCharToMultiByte HeapAlloc SetLastError ReleaseMutex CreateFileMappingW MapViewOfFile InitializeCriticalSectionAndSpinCount GetLastError GetModuleHandleW GetVersionExW lstrcpyW lstrlenW CreateProcessW GetExitCodeProcess GetSystemDirectoryW GetExitCodeThread TerminateThread CreateMutexW LoadLibraryA UnmapViewOfFile

msvcrt

swprintf malloc srand _wcsnicmp wcscpy wcsncat wcslen wcsncpy __CxxFrameHandler _onexit __dllonexit _except_handler3 ?terminate@@YAXXZ _adjust_fdiv _initterm free _beginthreadex _endthreadex sprintf _purecall wcscat _CIpow fclose fflush _vsnprintf fputs vfprintf fopen _ftol

user32

LoadStringW MessageBoxW IsWindow LoadCursorW GetSysColorBrush RegisterClassW InvalidateRgn DefWindowProcW GetClientRect BeginPaint EndPaint UnregisterClassW GetWindowLongW EnableWindow DialogBoxParamW GetParent GetDlgItem EndDialog LoadIconW SetWindowPos GetClassNameW GetWindowThreadProcessId SetForegroundWindow GetSystemMetrics GetWindowRect EnumWindows SendMessageW ReleaseDC GetDC SystemParametersInfoW SetWindowLongW PostMessageW SendDlgItemMessageW

winmm

mixerSetControlDetails waveInGetDevCapsW waveInGetDevCapsA waveOutGetDevCapsA PlaySoundW waveOutGetDevCapsW waveOutSetVolume waveOutGetVolume mixerGetID mixerGetLineControlsW mixerGetLineInfoW mixerGetControlDetailsW timeGetTime

advapi32

RegOpenKeyExW RegDeleteKeyW RegQueryValueExW RegSetValueExW RegEnumKeyExW RegCloseKey RegFlushKey RegCreateKeyExW

ole32

CoInitializeEx CLSIDFromString StringFromGUID2 CoCreateInstance CoUninitialize

gdi32

CreatePen CreateFontIndirectW GetDeviceCaps CreateSolidBrush GetStockObject Rectangle LineTo MoveToEx SelectObject DeleteObject

dpvoice.inf

SHA256 6842ec89b0453e1ace1b62cac39a550abb8cc014136db7926388e19fd9921f15
MD5 25887d6e6f3931813cab4ce5a9979b5d
SHA1 048bc6aa7d3a297c1d91f66fa9d0420b035b1f65
SHA512 d5212ad9a22f36bf07c2de4514e87df421232195a0f4fe64a14fdd2d66b42132f6a3d34f9593826e0cb9e09ca4c1c1574f45fd919501d03c0fce42871086552a
TLSH
T192B09294A98765242125A9388EA30299B6AA482192A8A14CBA9121288366608E15DBAF
MD5 SHA1 SHA512 TLSH

dpvsetup.exe

IMPHASH 1405b97b615751afaa909eba25b4804d
SHA256 e874d60d3514f29fafc59bef7e7954b686c7d850366565f514109ded24bb16b7
MD5 a27d713b51923e72e58fae4d5ca073d7
SHA1 dbdd1b4ae44679c8476679cb5d13799921a0c72a
SHA512 a308f6d859258aafb7caf0de865d32af14ec69cba73083d7a9066b4cb21ea0720ce96470cdc1ed4b89a582f7ebc69ed432925c98d3e0aeb346674cb13e217ff7
SSDEEP 1536:EV84GGpVl9qUKw5wfQtB+5GQOTdEhALYywBu3PG:15Gpxtwg+5pOTmT2PG
TLSH
T11C833A01379481BFC04102704A25CB79D6B9AD100F259BDF7BA4BF8B793A6D3B939B12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15468

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess TerminateProcess GetProcAddress GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetCommandLineW GetStartupInfoA lstrcpyW GetLastError LoadLibraryW GetModuleHandleA LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleHandleW GetVersionExW Sleep CreateProcessW CloseHandle GetExitCodeProcess GetSystemDirectoryW GetExitCodeThread TerminateThread WaitForSingleObject SetEvent CreateMutexW WaitForMultipleObjects CreateThread CreateEventW UnmapViewOfFile MapViewOfFile CreateFileMappingW ReleaseMutex OpenFileMappingW OpenEventW SetLastError FreeLibrary LoadLibraryA HeapFree GetProcessHeap HeapAlloc DeleteCriticalSection

msvcrt

__set_app_type _except_handler3 _controlfp __dllonexit _onexit __p__fmode __p__commode wcsncpy _XcptFilter _adjust_fdiv _c_exit wcstok _wcsicmp swprintf srand _wcsnicmp wcslen fopen vfprintf fputs _vsnprintf fflush fclose __setusermatherr _initterm __getmainargs _acmdln _cexit _exit exit wcsncat

user32

GetWindowRect LoadStringW LoadCursorW GetSysColorBrush RegisterClassW InvalidateRgn DefWindowProcW GetClientRect BeginPaint EndPaint UnregisterClassW GetDesktopWindow GetWindowLongW EnableWindow DialogBoxParamW IsWindow GetParent GetDlgItem EndDialog LoadIconW MessageBoxW SendDlgItemMessageW PostMessageW SetWindowLongW SystemParametersInfoW GetDC ReleaseDC SendMessageW EnumWindows GetSystemMetrics SetForegroundWindow GetWindowThreadProcessId GetClassNameW SetWindowPos

winmm

waveInGetDevCapsA PlaySoundW waveOutGetDevCapsW waveOutSetVolume waveOutGetVolume mixerGetID waveOutGetDevCapsA waveInGetDevCapsW timeGetTime

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2

advapi32

RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegFlushKey

gdi32

LineTo Rectangle GetStockObject CreateSolidBrush MoveToEx GetDeviceCaps CreateFontIndirectW DeleteObject CreatePen SelectObject

dsound

ord1

comctl32

PropertySheetW ord17 CreatePropertySheetPageW

dpvvox.dll

IMPHASH 28936a80008711944b369d04d634270c
SHA256 c1af86c20a8b82dc98b3f0cd42fca58580429faf0dc071b1cb41789f056e299e
MD5 092eb4d0e687dd46420a51fc28b55c4d
SHA1 33d9b6b4ba169af1e1f0058fe0f880658469037f
SHA512 0da5f0eeb5a139c29214ab7f319459eedbf81f7da20933b75cd03d4e4534604a6e0bbb970e7d8bb80e14a0095246ddc03351d5c648fc121fb48cecae5733ff9c
SSDEEP 3072:Qc959N7EHm52iiqNlPKqsojo0UOsmq25E:15/v25qNkqdozZX
TLSH
T163B3B0427CD100BAE7974738BD7631A4A3F8DA322D34AA4DDF4814872DA4946F2EDB47
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

107201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dpwsockx.dll

IMPHASH 138099c151cf1ecb23702e002fa85c73
SHA256 b2f5a36a8390299f666dbfc44495d2f718cb4d73bffcd82a05cae92b106ad428
MD5 6590d3eef5964967c6e05a55517569aa
SHA1 86e39223bf5f908cd8b77898d6f6776abc723dd3
SHA512 cb80e43e5f60abef376c1fe6e5bda4569b988fa87030a62c2cd1e9e83a22ab54176010e28199b9818a4730df9ef1994b2a7a63314480d192d6480a79e03fc314
SSDEEP 1536:tVknY6EduwEHbKA4xD+sObzMduapMBNDODsOoDkZ/VaFDRkRb8TFZ6v0q:Vd9A4pObbyDsOQQ/VaFDRob8TFZ6v0
TLSH
T14D73E52177F50136F8B35B70ACF61767A97AFD609A36C25E4690268E2834D40EB31B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

38198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

InterlockedExchange Sleep ResetEvent SetEvent SetThreadPriority CreateThread WaitForSingleObject GetVersionExA DisableThreadLibraryCalls HeapAlloc GetProcessHeap ReleaseMutex UnmapViewOfFile OpenMutexA MapViewOfFile CreateFileMappingA HeapFree CreateProcessA GetSystemDirectoryA OpenEventA GetCurrentProcessId HeapReAlloc WideCharToMultiByte MultiByteToWideChar QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA LoadLibraryA GetCurrentProcess GetSystemInfo VirtualProtect GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA VirtualAlloc GetCPInfo GetOEMCP GetACP GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA VirtualFree VirtualQuery HeapCreate HeapDestroy GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess GetCommandLineA FreeLibrary GetProcAddress ExitThread WaitForMultipleObjectsEx InterlockedDecrement GetLastError InterlockedIncrement InitializeCriticalSection CreateEventA CloseHandle DeleteCriticalSection EnterCriticalSection TerminateProcess LeaveCriticalSection

ntdll

RtlUnwind

user32

SetWindowLongA GetForegroundWindow SendMessageA SetFocus GetDlgItem GetWindowLongA GetDlgItemTextA EndDialog DialogBoxParamA

wsock32

select __WSAFDIsSet getpeername recvfrom gethostname gethostbyname send sendto listen recv getsockname connect setsockopt inet_ntoa WSAGetLastError closesocket inet_addr getsockopt WSACleanup WSAStartup socket ntohs bind ioctlsocket htons accept

winmm

timeGetTime

advapi32

RegCloseKey RegEnumKeyExA RegOpenKeyExA SetSecurityDescriptorDacl FreeSid AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor RegQueryValueExA

dplayx

gdwDPlaySPRefCount

dsdmo.dll

IMPHASH 320f45a32628b35d761b69e505a2c544
SHA256 ff9b3b5a9acc7bbc6d15a668b8ea897e8ff9a94b598cd3bbc35a715249a5411d
MD5 f8bc193b4c119d43181337219be0f37a
SHA1 1be0269567171781807f378e8909a42e0100e4f7
SHA512 765f346543b1cf033cb186b4b87eeed10ee348d5ee10f568f7cb9dbcb1a32984722969b866361ec2dbbb57c92ed3785f6b3af7af1b1b1a40edf8341e84ff4d88
SSDEEP 3072:COFyqAITGF1KTvloaTcACXV4B3JQtuVQtEWkxqhxcj19cJIYxIMOUMSx76klU311:3yqAITGF1KTcnWj19cJIlMOUMSijxAeT
TLSH
T107042A02674B5CE2DE5A38F055BCBBFAD2348B41622558036EB0DF757267079B8AD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

111010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dsdmoprp.dll

IMPHASH 44c532b5aea3995196546902607fa520
SHA256 1e044bf590eb0559a105d4452eac4c43c79380ddd5c67246c770286c3ad4597d
MD5 16d9890f66435b052e75a90fe46466aa
SHA1 96a26c5223f497a58af6a4c0897788a1cbc166fd
SHA512 62ce664f8823f6fb91e47d8b8a6daf00b5753d7807311e98c1de99575667697e0b78e36d38a9567ce0aba4c8d68b6460f4806d72b01697cd459fe10975d0b193
SSDEEP 3072:ZdVLmLDLOOhkjyGMHCfq14jQx1Y2outhpXfDOBoDTREIL:SDLOOSEx
TLSH
T159A40C653BD8C09AF1A746722DF05FC3AC66BC41AE18CE4FEE55730EA839900EF51619
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatA GetModuleFileNameA FreeLibrary GetProcAddress LoadLibraryA DisableThreadLibraryCalls SizeofResource LoadResource FindResourceA GetLastError LoadLibraryExA GetShortPathNameA lstrcpyA MulDiv GetCurrentThreadId HeapAlloc FlushInstructionCache GetCurrentProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess HeapDestroy EnterCriticalSection LeaveCriticalSection lstrcpynA IsDBCSLeadByte lstrcmpiA lstrlenA InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection Sleep GetProcessHeap HeapFree lstrlenW WideCharToMultiByte LockResource MultiByteToWideChar

msvcrt

_initterm malloc free ??3@YAXPAX@Z realloc ??2@YAPAXI@Z atoi atof _ftol _vsnprintf _purecall _adjust_fdiv

gdi32

GetDeviceCaps CreateFontIndirectA SelectObject GetTextMetricsA GetTextExtentPointA DeleteObject

oleaut32

SysFreeString SysStringLen SysAllocStringLen RegisterTypeLi LoadTypeLi SysAllocString VarUI4FromStr

user32

CheckDlgButton IsDlgButtonChecked GetDlgItem GetDC SendMessageA CharNextA ShowWindow MoveWindow IsDialogMessageA SetWindowLongA DestroyWindow IsWindow LoadStringA GetDialogBaseUnits ReleaseDC CreateDialogParamA WinHelpA

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance

advapi32

RegCloseKey RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCreateKeyExA

dsound.dll

IMPHASH d70f4f0e3129cf35ca0973bba72c4159
SHA256 1c46928acb028b7c37570d8f46b283aab8f2c9239527415aaa48114123862593
MD5 ca6cc3a47d8813208cee02eb40daca21
SHA1 8c4ae6cd3b02de91920a2a9286d45fe7f08add71
SHA512 cb31ed31c5df059522a66c7b0f668bbc612b43271ec6f033443e70d6a47b2e7cfba32f045ced496a1545b2ca72949c0c67e55825088baeb317ad3135e0800988
SSDEEP 6144:hv+MRZLLz+SAmU/OlmPdHLFpqmSa7sZFJt4IGpruCGL:lrdAm1UBfSa7Ufz
TLSH
T1E5746CD0BAE3C0F5F7E337B189257E5972EE6BA599F5C90802C85CC92936550F239322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

311591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibrary GetProcAddress LoadLibraryW GetLastError lstrlenA lstrcpynA MultiByteToWideChar WideCharToMultiByte lstrlenW lstrcpynW GetVersionExW SetThreadPriority SetPriorityClass GetThreadPriority GetPriorityClass GetCurrentThread lstrcatW lstrcpyW lstrcmpW CreateMutexW ReleaseMutex DisableThreadLibraryCalls GetCurrentThreadId GetCurrentProcessId SetEvent lstrcpyA Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection GetCurrentProcess EnterCriticalSection InterlockedIncrement InterlockedDecrement OpenEventW CreateThread CreateEventW GetExitCodeThread OpenProcess GetSystemDirectoryW GetOverlappedResult DeviceIoControl ResetEvent GetTickCount WaitForMultipleObjects UnmapViewOfFile MapViewOfFile CreateFileMappingW OpenFileMappingW GetWindowsDirectoryW SetLastError GetPrivateProfileStringW MulDiv VerifyVersionInfoW VerSetConditionMask WaitForSingleObject QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess DuplicateHandle HeapFree HeapAlloc HeapDestroy HeapCreate CreateFileW ReadFile SetFilePointer GetFileSize lstrcmpiW GetModuleHandleW GetModuleFileNameW GetFullPathNameW LeaveCriticalSection CloseHandle

msvcrt

_isnan _ftol _initterm _adjust_fdiv __dllonexit _onexit malloc _CIpow free _wcsicmp wcsrchr __CxxFrameHandler

ntdll

NtQueryInformationProcess

user32

CharUpperW wsprintfW GetParent GetForegroundWindow GetWindowPlacement IsWindow GetWindowThreadProcessId LoadStringW CharLowerBuffW EnumWindows

advapi32

RegSetValueExA QueryServiceConfigW OpenServiceW OpenSCManagerW RegOpenKeyW RegCloseKey RegSetValueExW RegCreateKeyA RegOpenKeyExA RegCreateKeyW RegOpenKeyExW RegQueryValueExA RegQueryValueExW CloseServiceHandle

rpcrt4

UuidFromStringW

ole32

CoCreateInstance

winmm

waveInReset timeBeginPeriod timeEndPeriod mixerSetControlDetails mixerOpen mixerGetLineInfoW mixerGetLineControlsW mixerGetControlDetailsW mixerClose waveOutGetPosition waveOutPrepareHeader waveOutWrite waveOutGetDevCapsW waveInGetDevCapsW waveOutGetVolume waveOutSetVolume waveOutMessage waveInMessage waveOutGetNumDevs waveInGetNumDevs waveOutOpen waveOutClose waveInOpen waveInClose timeGetTime waveInUnprepareHeader waveInStop waveOutPause waveInGetPosition waveInAddBuffer waveInPrepareHeader waveInStart waveOutUnprepareHeader waveOutReset waveOutRestart

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

dsound.inf

SHA256 2e4258ad5fda79156740519a994d2f1bad2e0ce2bc50097b8091dffff662bf78
MD5 7c9a09e48a3567f85d6856805c9f0bc2
SHA1 c3fd6bd20b47dcd1102c415b6e2dbe49cdf29627
SHA512 3d552d12a1953f261baf32b0a67369524ee5b513c70f18d44938258dca7b5971b4ea856e31f188f9d21ff819287b29c52a4025b0c35153136d29db0f4059370e
SSDEEP 768:au1SdfDzvtiMAe0V1ZUrBNBCBsBgB+AVB1BVB5UnBhB2BoBcBiAxBJBhBlxO/nxs:mtDSoEdrLrGBPOMYRf3P3ZW7Wh3vpX
TLSH
T1D6F2D0AE378DA2D2A3CCC5E8ADD0BB19558C44B1E0C6BD5D36A0DED4190D1A423BC7DB
MD5 SHA1 SHA512 SSDEEP TLSH

dsound.vxd

SHA256 dda4d53dd9d6b5d34ad1273c2b82cc81d94752ff5e905d62ca8167b184c61810
MD5 f985c896b37091927e381f3f5121bdab
SHA1 398792cd40882f7c3cc5f4d9e2d0ebf6d2924617
SHA512 9d5b8361a0104e87e0ca9ebcfa876a532a6afadd8cd4e00d0b03cca06de4e8666c84b517835788e4646ee6a40dc8a476ae83fa224acff0943f1900a808cd5def
TLSH
T142A011E208E820B3B08002A8208AB282B30C802000203800C0EAA08028A20202A0FBAC
MD5 SHA1 SHA512 TLSH

dsound3d.dll

IMPHASH 423fd2aec57d2beb55ba046748fc0345
SHA256 fc6a3613748c9285149696b665e7d1de221b6785d59d0b10db7739e83ac1df4d
MD5 32cb980e22bce4cbb33ffa26e9fe802c
SHA1 602ff8ef155ec0e94b6fc99a6e2c7e155f56b145
SHA512 1bfd0e3eb9a236043e292674ce7efafdc047525e30ddb2419522d1301a8459d25b9950163f6ededf1e94aace7548af4eaebef0459129e4b3b1e139e9bc4e690c
SSDEEP 12288:i9gU5I4qC5iFvSLAJYEAg17b1F0UQyHhnBJn5uoMnQCH6BRURa15rm/VixUn3O00:PvSLAJYEAg17b1F0U3xiMfQedyG9
TLSH
T106555BC8843F5CAAFA9824FA50FDB88FA1FC1ADD65F43B55808513897D7620076E90F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1294847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dswave.dll

IMPHASH 53dde5acafd181deae6d47482f150b5b
SHA256 73174f7c2d273f0a371fa76abd3057be4d103aea4ccb087999d972ddadb4d82a
MD5 6b65d315296c83b180d93076f15895a4
SHA1 1e406f357b476b3ff9f58baf7515c5270889507a
SHA512 6120cdcb3ac4f832be46e11b742d507e0ad36d313586e642a0db90d951e936d8b2a8b47f4079810ee7446e016fe5829bf627619068bd79c129c9b0fdd8081aac
SSDEEP 384:61+P3nusjsTdybx6/KmH46S0KsidPygv10LRsAnnkpfWh3UW:A+/usjwybaSBXdPygN0L6AI2
TLSH
T13E824B4277F148FAC453A7304ADA735323A2DB281D1D9D1A06201F593EB89D3EAFE647
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dx7vb.dll

IMPHASH 1075cfd402ecf012fa24c5ee66bf0f31
SHA256 58623415fa9c6cdcdad238f486b796298499e129ffc3aa9390b05eec4794a0d3
MD5 16913af40beee13f9b2874c349e2941f
SHA1 2fa172c74e783557d4f18372e436e1224de522f6
SHA512 0cb365b18aaa089e5855b42199d8f18531118b2f47ab60ef57fb59d375f656b47406af47aba86da01c94adad195115212e1e10a57291e8646b4edadd35cb70ba
SSDEEP 12288:DgvoPMy9NpLXcJHSY8I4mE0fzduc7rSiHwneHZHvlXst+c99xZRKKWdlqaBuJt5e:DSOHG
TLSH
T1E1D4D5637381C9E3C9491631A817A74A9FF560063F02E7877385135E2E623D6BF0E79A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter LockResource _lopen _lread _lclose WriteFile FindResourceW OutputDebugStringA GetModuleHandleA CreateFileA GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile FindResourceA LoadResource SizeofResource GetModuleFileNameA lstrcatA lstrcpyA HeapDestroy GetCurrentProcess GetLastError lstrlenA GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar LocalReAlloc lstrcmpiA LeaveCriticalSection EnterCriticalSection CreateEventA CreateThread ResumeThread GetSystemDefaultLCID WaitForSingleObject CloseHandle SetEvent GetTickCount GetProcAddress lstrlenW GetVersionExA DisableThreadLibraryCalls FreeLibrary GetSystemDirectoryA LoadLibraryA LocalFree LocalAlloc InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection

msvcrt

_except_handler3 wcslen _wcsicmp wcsncmp _wcsupr wcscpy

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyA RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA RegEnumKeyExA RegSetValueExA

ole32

CoCreateGuid OleInitialize CoGetInterfaceAndReleaseStream OleUninitialize CoCreateInstance CoMarshalInterThreadInterfaceInStream CoTaskMemFree StringFromCLSID

gdi32

SetBkMode SetBkColor Polyline CreateBrushIndirect CreateSolidBrush CreateHatchBrush CreatePen GetObjectA CreateCompatibleDC SelectObject StretchBlt DeleteObject GetSystemPaletteEntries CreateHalftonePalette GetPaletteEntries CreateICA GetDeviceCaps Rectangle RoundRect Ellipse ExtTextOutW SetTextColor GetTextAlign SetTextAlign DeleteDC

msacm32

acmStreamSize acmStreamUnprepareHeader acmStreamConvert acmStreamPrepareHeader acmStreamOpen acmStreamClose

user32

LoadStringA CharNextA GetWindowRect GetDC ReleaseDC LoadImageA wsprintfA

oleaut32

VariantChangeType SysStringByteLen VariantInit VariantClear SysFreeString SysAllocString RegisterTypeLi LoadTypeLi SysStringLen

dx8vb.dll

IMPHASH d7478ded6c8775462f2d7c0c8f58d1d9
SHA256 49e4256804a33378ba78ad1ccc839c57bab9fd2aeb964e055ed88420a6b460c1
MD5 5d99843b40e6954f3f9c0dd78afb1972
SHA1 f851f000041326b737b0c85cb2702a4ae30d4ba5
SHA512 23b19f4655ed2ab32a53e3ab65995ba6b2274a8669dd5c39842654dd060c3606a12a7406a4660fadcaa09ad2a3fa97ed81469f73869a8bf0f5ad4243d9a10afa
SSDEEP 12288:iGoAAp8bHeb7fcoz3NcB23tKGCV6Hj2j7exFGnixvkNstVkEmakJTW/K9dCsGB+g:i7KtX9zqIKS/2eLGqeX+r7Mo4+/T
TLSH
T1BB455B03B395D8E7C8071630A957A399AAF166437F06A6C77388172F5E633D07F2634A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

67726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetFilePointer ReadFile SetThreadPriority GetTickCount Sleep lstrcmpA WriteFile FindResourceW OutputDebugStringA GetModuleHandleA HeapValidate LockResource CreateFileA GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile FindResourceA LoadResource lstrlenA SizeofResource GetCurrentThread GetModuleFileNameA lstrcatA lstrcpyA HeapDestroy GetCurrentProcess GetLastError GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar lstrcmpiA CreateEventA CreateThread ResumeThread GetSystemDefaultLCID WaitForSingleObject CloseHandle SetEvent GetProcAddress EnterCriticalSection LeaveCriticalSection lstrlenW DisableThreadLibraryCalls FreeLibrary LoadLibraryA InterlockedDecrement InterlockedIncrement DeleteCriticalSection GetProcessHeap HeapFree CreateFileW IsProcessorFeaturePresent GetVersionExA IsDBCSLeadByte GetTempPathA GetTempFileNameA DeleteFileA InitializeCriticalSection TerminateProcess

msvcrt

malloc ??3@YAXPAX@Z ??2@YAPAXI@Z _purecall realloc free _CIacos _finite _ftol wcslen sprintf wcscpy ceil ?terminate@@YAXXZ exit floor _CIpow _setjmp3 longjmp sscanf isspace isalnum _except_handler3 _snprintf __CxxFrameHandler qsort _controlfp _wcsicmp _strdup setlocale calloc _vsnprintf atoi isdigit isalpha

advapi32

RegQueryValueExA RegOpenKeyA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegDeleteKeyA RegSetValueExA RegCloseKey

ole32

CoGetInterfaceAndReleaseStream OleInitialize CoCreateGuid CoCreateInstance CoMarshalInterThreadInterfaceInStream CoTaskMemFree CoReleaseMarshalData CoMarshalInterface CreateStreamOnHGlobal CoUnmarshalInterface StringFromCLSID CoUninitialize CoInitializeEx CoInitialize OleUninitialize

gdi32

GetDeviceCaps CreateICA GetObjectA SelectObject CreateFontIndirectA GetCurrentObject GetOutlineTextMetricsA DeleteObject GetGlyphOutlineA GetGlyphOutlineW SetTextColor SetBkColor SetBkMode CreateDIBSection CreateCompatibleDC DeleteDC

msacm32

acmStreamPrepareHeader acmStreamOpen acmStreamSize acmStreamConvert acmStreamUnprepareHeader acmStreamClose

user32

DispatchMessageA TranslateMessage LoadStringA CharNextA wsprintfA DrawTextA DrawTextW PeekMessageA

oleaut32

SafeArrayCreate RegisterTypeLi LoadTypeLi SafeArrayDestroy SysFreeString SysAllocString

d3dxof

DirectXFileCreate

D3DIndexBuffer8GetData D3DIndexBuffer8SetData D3DVertexBuffer8GetData D3DVertexBuffer8SetData D3DXMeshIndexBuffer8GetData D3DXMeshIndexBuffer8SetData D3DXMeshVertexBuffer8GetData D3DXMeshVertexBuffer8SetData DXCopyMemory DXLockArray8 DXUnlockArray8 DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer VB_AddDataToBuffer VB_AddStringToBuffer VB_D3DColorARGB VB_D3DColorMake VB_D3DColorRGBA VB_D3DColorXRGB VB_D3DXColorAdd VB_D3DXColorAdjustContrast VB_D3DXColorAdjustSaturation VB_D3DXColorLerp VB_D3DXColorModulate VB_D3DXColorNegative VB_D3DXColorScale VB_D3DXColorSubtract VB_D3DXMatrixAffineTransformation VB_D3DXMatrixIdentity VB_D3DXMatrixInverse VB_D3DXMatrixIsIdentity VB_D3DXMatrixLookAtLH VB_D3DXMatrixLookAtRH VB_D3DXMatrixMultiply VB_D3DXMatrixOrthoLH VB_D3DXMatrixOrthoOffCenterLH VB_D3DXMatrixOrthoOffCenterRH VB_D3DXMatrixOrthoRH VB_D3DXMatrixPerspectiveFovLH VB_D3DXMatrixPerspectiveFovRH VB_D3DXMatrixPerspectiveLH VB_D3DXMatrixPerspectiveOffCenterLH VB_D3DXMatrixPerspectiveOffCenterRH VB_D3DXMatrixPerspectiveRH VB_D3DXMatrixReflect VB_D3DXMatrixRotationAxis VB_D3DXMatrixRotationQuaternion VB_D3DXMatrixRotationX VB_D3DXMatrixRotationY VB_D3DXMatrixRotationYawPitchRoll VB_D3DXMatrixRotationZ VB_D3DXMatrixScaling VB_D3DXMatrixShadow VB_D3DXMatrixTransformation VB_D3DXMatrixTranslation VB_D3DXMatrixTranspose VB_D3DXMatrixfDeterminant VB_D3DXPlaneDot VB_D3DXPlaneDotCoord VB_D3DXPlaneDotNormal VB_D3DXPlaneFromPointNormal VB_D3DXPlaneFromPoints VB_D3DXPlaneIntersectLine VB_D3DXPlaneNormalize VB_D3DXPlaneTransform VB_D3DXQuaternionBaryCentric VB_D3DXQuaternionConjugate VB_D3DXQuaternionDot VB_D3DXQuaternionExp VB_D3DXQuaternionIdentity VB_D3DXQuaternionInverse VB_D3DXQuaternionIsIdentity VB_D3DXQuaternionLength VB_D3DXQuaternionLengthSq VB_D3DXQuaternionLn VB_D3DXQuaternionMultiply VB_D3DXQuaternionNormalize VB_D3DXQuaternionRotationAxis VB_D3DXQuaternionRotationMatrix VB_D3DXQuaternionRotationYawPitchRoll VB_D3DXQuaternionSlerp VB_D3DXQuaternionSquad VB_D3DXQuaternionToAxisAngle VB_D3DXVec2Add VB_D3DXVec2BaryCentric VB_D3DXVec2CCW VB_D3DXVec2CatmullRom VB_D3DXVec2Dot VB_D3DXVec2Hermite VB_D3DXVec2Length VB_D3DXVec2LengthSq VB_D3DXVec2Lerp VB_D3DXVec2Maximize VB_D3DXVec2Minimize VB_D3DXVec2Normalize VB_D3DXVec2Scale VB_D3DXVec2Subtract VB_D3DXVec2Transform VB_D3DXVec2TransformCoord VB_D3DXVec2TransformNormal VB_D3DXVec3Add VB_D3DXVec3BaryCentric VB_D3DXVec3CatmullRom VB_D3DXVec3Cross VB_D3DXVec3Dot VB_D3DXVec3Hermite VB_D3DXVec3Length VB_D3DXVec3LengthSq VB_D3DXVec3Lerp VB_D3DXVec3Maximize VB_D3DXVec3Minimize VB_D3DXVec3Normalize VB_D3DXVec3Project VB_D3DXVec3Scale VB_D3DXVec3Subtract VB_D3DXVec3Transform VB_D3DXVec3TransformCoord VB_D3DXVec3TransformNormal VB_D3DXVec3Unproject VB_D3DXVec4Add VB_D3DXVec4BaryCentric VB_D3DXVec4CatmullRom VB_D3DXVec4Cross VB_D3DXVec4Dot VB_D3DXVec4Hermite VB_D3DXVec4Length VB_D3DXVec4LengthSq VB_D3DXVec4Lerp VB_D3DXVec4Maximize VB_D3DXVec4Minimize VB_D3DXVec4Normalize VB_D3DXVec4Scale VB_D3DXVec4Subtract VB_D3DXVec4Transform VB_GetDataFromBuffer VB_GetStringFromBuffer VB_NewBuffer

dx9w2k.cat

SHA256 db386dd480e3d5b2153724b4ed1034dc0633a9e3a23ce516bbe7ea3fd11e9c91
MD5 2c0af9b48c9c71e4e3bb19ca331909a0
SHA1 6a6af23152aed80c021d7e6b6585bcf917584ccb
SHA512 32bf96fddbb7307d8f0a3e1e0cb35639a7154c1ef97cb457d4b2bda23fed2bbcef93394918e7ef5a83a411c9e409954171e01459338432dfaaf1658238c1cfe3
SSDEEP 192:DWCNEjo6Roui2qNydMgRS3H136TnhfBIIhEJFCvkQ9re+fBQyvF65Z/eWWfad6LW:k81EA+zACd0j2olhe1OHrDpB
TLSH
T133B2AD6B19E84163412DC8B1CFF5EC9FB422D6B6A9125D3E209373944683B62738F93D
MD5 SHA1 SHA512 SSDEEP TLSH

dxapi.sys

IMPHASH 451e7ae3e889975f362e0be68fb23162
SHA256 943e53683ce11630f3dd4954208c1f1e16c2b59efd4f4f4b977c794a4aa1abb7
MD5 bca14d9d8955387401f23a2a2514bced
SHA1 772ac475174b383118af5856b9e0a2d7d170bf49
SHA512 4b767ea9e718a109c3b7a64168720483aeb866db9deccd2209e998ef8b1a6bac3dfca41899c42b666465b08e4057cf4affff79d565ec4f67a01539c3f69fad99
SSDEEP 192:bbgcWtVELv/NiNaO3sKssVxvLhEI56ht+aSaFM3CWSdtWW:HgdawNaO3saJLhe3Sa+3CWSdtWW
TLSH
T15C222B01CFB10639E0A287F68BE72319227F2E155222E67F45846084BD35F147F3A36B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

288B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

704B

Virtual Size

694B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

256B

Virtual Size

241B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

448B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

960B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

224B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dxapi.xpg

IMPHASH 6a7f14fd633aa42f777a1ec1fa7bb386
SHA256 fe26fba13079189ef96a1c994036ea472a4bf34fa14c163c693ad481bf31e676
MD5 fe97d0343acfdebdd578fc67cc91fa87
SHA1 731bd21a972dca7f70adbe1f93ae8200a17a7208
SHA512 6f81e645c7f3e5ad6c43db541240d2f3175489f8765989f93076d5d17672709a4a72e4542854d7660bc171795cf04a44cce5c6e4e87e5caa291384af304439bf
SSDEEP 192:txyMVa9giqkt1fYFCAukBtLtmbkSVM+kY17WSQfwW/Q:y9Okt1fYHBtL617WSQfwW/
TLSH
T1C2221B5067B2013BE5B302B19C9F3325632BDE129523A77F186064D87E28E11BF697B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

dxapi.pdb

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

384B

Virtual Size

364B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

640B

Virtual Size

638B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

256B

Virtual Size

241B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dxdiabrz.chm

SHA256 9ca5aee16796d8bcc7b8b540e5e205001ed8f9a83dc4a4a75da813048dd73838
MD5 53c73ef6daffdb7c3730c1608777e1d5
SHA1 4f26b1ccb0b2250377b848da5950bc10bf2f55cb
SHA512 d69cb7fdad285c8da0c7d4a99a868b966eb31252f86534eeafbfa928ae15c0ce3a91c1d1bca2b077385c3e48d3c979a61eb892d0d38db4b28970ea130a18043e
SSDEEP 384:6Dg65cgcal9pVJsRDy5vzPctpT5EMpkvRDja3etj5kk/CS:6Dg2cgx33sBmPctZSMpUi0bCS
TLSH
T1BAB2CFFB0590C02FC1C346F22EE542C6751D3D56DA921ACB12A9163D9BB368C8FB2D27
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiachs.chm

SHA256 ae5417657ca355416d9d12e90f1e543c7518880e695c2cbfda7a15423c52349f
MD5 73e82b73df5fadafad4b6769e629f785
SHA1 b394d6d6e3dc8266710df5f36b35c308db7f03d7
SHA512 8a4c80f3db5ac3171eea8dae5d9aa3d734b9fbfc26b8977b27527853b092c8373ba7d8b1f6c5e76ce53d816eaf64dd203d4a074a6d299775f3d14aae33d853e2
SSDEEP 384:Lx9c2X4IusikWoiEAC/40BoYH5VAdUZxav5srqSCA+z6pISlXx0Vw3zxdT:Lx9Fssiih44oYH5VHVrSuXx0VE1V
TLSH
T1F8C2CF9133904420E685D83E7A858A43F04A3F17E2DAAA0DF052BBAD1673F0767619B7
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiacht.chm

SHA256 5bbb6a9b1bdb2ec80f8c5fc4a373ec5c2539081e146decd35183bd2ff50b64f2
MD5 024ad44006f8913db27a6dbf9914ca25
SHA1 7201b5d91e77be5a893a9492a37d4c7d75dea054
SHA512 75325fe6b535d26cfbc4d7804fa8623dd07c48f6c3c3b5b7a78cc697ac2e90de46d1337c55d702e455d2284f7e19aac6517b43b10ea8b6398dfc50104f177321
SSDEEP 384:P0rp30rPMPpJild4RO1UfTA5613+IC1Gyjkumtx1MrMxSTuK1743RLmN:P0rpkwpJ+iO1X5e3iGypmtx1Mrf7743m
TLSH
T137C2C0E9636AA95BD80217B65AB8130A92633C08CC5063EFA274332F14F5F641F7495B
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiacze.chm

SHA256 6d77211a660b988c5119b48003db33e990676d32633a37e93ff3f0b1d3e431f3
MD5 144b2198a88cecece732e1ff04b4e124
SHA1 47f84621c0721a8e94453fe5afa5e388edb87ed1
SHA512 00a9e91ae54d1754ce25bf97d1af794ecba87f3945c6986d3ad4a5997f892d8385f9cdc9670492da01e1caa7255c7eb6b80c21b1fa84e01b98d9acfccff8bf9f
SSDEEP 384:oFe5DsecRkWn7/VufDeH/9llasr/37n2wsgy/8bHCVvNuDZan4sgv:oFe5Lc+W79E293P/a5/8bO1uDZanRu
TLSH
T188C2E0B4BBE6A51DE215463153B0F1DFA70CECC4E568D4FC21AAD7A8372E246432C636
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiadut.chm

SHA256 11f25e59793a2fb3860f27223dc8a981b49f4b154a28b4cf63d540ef22ed4d2c
MD5 b0eef1fda652b64c59b113236bdaeea4
SHA1 a5851331a3b2e791a6d5de4a426952ef8168d9c5
SHA512 cf59892252684690608a45fd5e995cad07627afea9053cc88a6a6c7d5829a14b39d936fd837eb448d7b00ef47a49f230d0042f9bb8c304ecf376f632cb86f867
SSDEEP 768:1pFUiogyVdft7K9rRoELdKKbtAWeXDYqEl63oN/ojrHX:1pFUi3wdF7KFRoEL1bCWeOlL/Ub
TLSH
T130F2D1ED3FC599D1D3021A3AA2C91EC57138E63829CB839FE110FD657B67D9C2A2140D
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiafrn.chm

SHA256 05c1747926daad44bfc8e05f54b0d921e9690515c6898430aa665b629225ddc6
MD5 5a14a2abef5adaa08c025365ef47faab
SHA1 3f78e2c9ccc7d9ba62f41300bf197d8f05095daf
SHA512 4936ee5f1cc1bde9dc211d2ca46e7186e533e58629faf179dbb8d6ab1f10f52c52e8c960e9978c8d57effa96ac5db39b7891497774fd9f21545a20847286cb90
SSDEEP 384:JlgmbaNEcvpsUXk0Epc1LqY5kU9ahYxTIsALhKPkVF:JSmb3Up9k0NPkhKaLh0kT
TLSH
T1C7B2C07A23238314F4594A39BF9113A7A234AE5A8575D3D5F31BC6FC5BA7E88BB00061
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiag.chm

SHA256 aa50e05ccb8ded699db5a8da1068afd8bfef1f8717e6004419d89f2cf5e5e506
MD5 e4985c0c04a05d83da060409408d005a
SHA1 6b61a545a26fcfbe7b92bcb2e5490f981c285e90
SHA512 a0dbabf8db99d3603f12366ef0e2792cfbcfb4cf6504241b264e3a5504548a799f946a40fa387a5ef6ddf5e34b613301c4836951551126a8dbf93e5923c01da8
SSDEEP 384:HZjB8bflvUSUP0BsEq6hglFidAEeJvmezSXMgUfe7t:HZjBGBBspHOwJvVCme7t
TLSH
T12EB2C0F05AA02B49DA4526708B600657346F5843D2B19985F63BA21E1EBAD5CCEF23F1
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiag.exe

IMPHASH 4c1cc062ad1ba9603fe58485dabee66e
SHA256 4e2201e6b77dcefcce36f2b20315ef260908a5b19042d995be624f3f6e720704
MD5 0b31a013babc182763ee4eacd70a70cd
SHA1 68a929593bb61d25837fe5784329f1b43fcbd9b6
SHA512 45eb1b3bab84835038a5f9b461867ddb530164619a2e97bcf455aa075ab26e3bcb904cadd3dc4298595ffe6f3d40c25696ad34cf7f3652eb1d437a0a40e50ad1
SSDEEP 12288:xxoVTjLj6H7rseA7PwivOloinBNJFxciPAiVAZDgweM12zFfIJmhnpxlTBP1U+4Z:xxUTXjK4Zx
TLSH
T17F15F91067FD962AF1F36B346EB912A64E37BD51AE35C54F5A10718E4932F80DE20B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

148280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForMultipleObjects SetEvent GetCurrentThreadId FreeLibrary LoadLibraryW Sleep WaitForSingleObject GetCommandLineW CreateEventW GetSystemInfo GetFullPathNameW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess GetVersionExW lstrlenA CompareFileTime GetWindowsDirectoryW lstrcmpW lstrcpyW GetProcessHeap HeapAlloc HeapFree CloseHandle DeleteCriticalSection GetModuleFileNameW GetFileAttributesW InitializeCriticalSection GetCurrentDirectoryW GetSystemDirectoryW ReadFile SetEndOfFile CreateFileW FlushFileBuffers SetStdHandle GetLocaleInfoA LCMapStringW LCMapStringA SetFilePointer IsBadCodePtr IsBadReadPtr RaiseException SetUnhandledExceptionFilter MultiByteToWideChar VirtualQuery VirtualProtect GetStringTypeW GetStringTypeA GetCPInfo GetOEMCP GetACP LoadLibraryA HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy TlsAlloc SetLastError TlsFree GetFileType SetHandleCount GetEnvironmentStringsW WideCharToMultiByte InterlockedDecrement LeaveCriticalSection InterlockedIncrement EnterCriticalSection lstrlenW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetModuleFileNameA GetStdHandle WriteFile ExitProcess CreateThread GetLastError TlsGetValue TlsSetValue ExitThread RtlUnwind GetCommandLineA GetVersionExA GetStartupInfoA HeapReAlloc

advapi32

RegFlushKey RegSetValueExW RegCreateKeyExW RegEnumValueW RegQueryInfoKeyW RegOpenKeyExW RegQueryValueExW RegNotifyChangeKeyValue RegDeleteValueW RegCloseKey RegDeleteKeyW RegEnumKeyExW RegEnumKeyW

gdi32

GetTextExtentPointW

user32

MessageBoxW LoadStringW EnableWindow SendMessageW GetDlgItem wsprintfW EndDialog GetDesktopWindow MsgWaitForMultipleObjects PeekMessageW IsDialogMessageW TranslateMessage DispatchMessageW SetWindowsHookExW UnhookWindowsHookEx PostQuitMessage GetClientRect CreateDialogParamW GetWindowRect AdjustWindowRectEx SetWindowPos GetFocus SetFocus SetTimer KillTimer SetForegroundWindow LoadIconW CheckRadioButton GetDlgItemTextW GetDlgItemInt SetDlgItemInt GetDC ReleaseDC SetWindowTextW CheckDlgButton ShowWindow SetDlgItemTextW LoadStringA wsprintfA MessageBoxA DestroyWindow GetKeyState IsWindowEnabled PostMessageW CallNextHookEx GetWindowLongW DialogBoxParamW UpdateWindow

comctl32

ord17 ImageList_Destroy ImageList_ReplaceIcon ImageList_Create

comdlg32

GetSaveFileNameW

shell32

ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoInitialize CoInitializeSecurity

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

dxdiager.chm

SHA256 ecf4dc10f45af9ca9276d45aaa783b68df0e0450533c3993042ef3e530244dad
MD5 8eddacb09e28fddf68c1d19fd20a7e39
SHA1 944aff3867b30abb7a6b3b588a7766a7a88f0169
SHA512 d228300471abe6eae963e34e49141f44cdfd286730d7ae3fdca7ce7017a061a3284e274a5234caa3ebdc4f5c6c86025f828e23c1c15e93dff5c6a47d64791973
SSDEEP 768:LpuQJ5RzN2PXp4CblEsv655v7Cd6z7BEuim4:LpuQJzQh4Gv6zo6X+uim4
TLSH
T19BE2E0F002AE1111E8959C379BA269CAF2631EC6EF40DD87E0F63B188296C525FD50B7
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiagn.dll

IMPHASH f279e27e8da3ee34daa485580c7a0a49
SHA256 cd170117ad12c60914efd18c26397e1f6e0a679446242cef718a74d3f9b05635
MD5 4654cbe77cc8cf1602e16a30548626fd
SHA1 f614a37a9cfcaffe67069483b8d1843d94f25e7a
SHA512 9953586a2399b3b0cc2dbffae6ed4876aa934c1590f23344690279e584dab86b8da7f04787eebaf206cba6a10ae14c8e35c57575fc5c90f8e78b649210e0e62b
SSDEEP 24576:8yKy9+rrVqHQvFvZYhWozIDlDCf6fkf6fEAfk:/xixqHFQyIDlDCf6cf6cAfk
TLSH
T111751711A3FD5229F1F36F346EB922A61A76BD92AD38C50E1244754E1D72F90CA70B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

389453

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetDateFormatW FileTimeToSystemTime FileTimeToLocalFileTime FindClose FindFirstFileW GetFullPathNameW ExpandEnvironmentStringsW lstrcmpiW GetPrivateProfileStringW GetSystemInfo Sleep SetPriorityClass GetPriorityClass GetCurrentProcess GetProfileIntW OpenProcess GlobalMemoryStatus GetSystemDefaultLCID GetLocalTime WriteFile LockResource LoadResource SizeofResource FindResourceW GetTempPathW DeleteFileW LeaveCriticalSection EnterCriticalSection SetEvent ResetEvent WaitForSingleObject DeleteCriticalSection CreateEventW InitializeCriticalSection CreateFileA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime SystemTimeToFileTime GetModuleHandleA TerminateProcess CreateFileW CloseHandle GetVersionExW GetLocaleInfoW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringW GetModuleFileNameW GetFileAttributesW InterlockedIncrement InterlockedDecrement lstrlenA GetProcessHeap FindResourceA IsProcessorFeaturePresent ReadFile FlushFileBuffers SetStdHandle SetFilePointer IsBadCodePtr IsBadReadPtr RaiseException SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA GetLocaleInfoA VirtualQuery VirtualProtect LoadLibraryA GetCPInfo GetOEMCP SetEndOfFile GetACP HeapSize IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA VirtualFree GetSystemDirectoryW MultiByteToWideChar GetModuleHandleW GetVersionExA lstrcmpW CompareStringW GetLastError lstrlenW FreeLibrary LoadLibraryW GetProcAddress HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount TlsAlloc TlsGetValue SetLastError TlsFree ExitProcess RtlUnwind HeapFree HeapAlloc HeapReAlloc GetCommandLineA TlsSetValue

advapi32

RegQueryValueExA RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW RegEnumKeyW RegCreateKeyExW RegDeleteKeyW RegOpenKeyW RegOpenKeyA RegCloseKey

user32

CharNextW GetSystemMetrics GetWindowRect SystemParametersInfoA IntersectRect OffsetRect EnumDisplaySettingsW ReleaseDC GetDC CharLowerBuffW LoadStringW FindWindowW GetKeyboardType LoadImageW ShowWindow CreateWindowExW DialogBoxParamW SetForegroundWindow PostMessageW KillTimer SetTimer EndDialog IsDlgButtonChecked GetWindowTextW GetDlgItemTextW CheckRadioButton EnableWindow GetDlgItem InflateRect InvalidateRect SetWindowPos GetCursorPos SetCursorPos ShowCursor SendMessageW MessageBoxW SetRect PeekMessageW GetWindowLongW DefWindowProcW RegisterClassW SetWindowTextW

gdi32

GetDCOrgEx GetClipBox DeleteDC CreateDCW GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleDC GetObjectW GetStockObject

winmm

waveOutMessage timeGetTime waveOutGetDevCapsW mmioOpenW mmioDescend mmioRead mmioClose

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ole32

CoInitialize CoTaskMemFree CLSIDFromString CoUninitialize CoCreateInstance

oleaut32

SafeArrayAccessData SafeArrayUnaccessData SysAllocString VariantClear VariantInit VariantCopy SysFreeString

dxdiaitn.chm

SHA256 38281c3e17b2d9c0485012ea200022d0036d3a68873d828f03ec1fa825314f81
MD5 dafc6ee570887cefae4debe72b49650e
SHA1 b1da18985d246b4aabf2872ebf70180afb821484
SHA512 d8e1ed5f61625491d4a53dad42b1d18f60594f314f19a75dc1049ef601ff8cee8a17a62e1c6da345f518caba9cbe28ecf93c8a6f1c57271d9398d59ee106c874
SSDEEP 384:ZxAkR2OekdPNjEePStyBDd5W/OTl9XKijfvIqe60Kf:ZxAUdPNwdcDd5z9XKi7Aqe6V
TLSH
T1FCC2D0C437108E0CCD0499F3F185E1887AB63F42AC50DF5AFB2D6E48BAB5F895B56152
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiajpn.chm

SHA256 da682d976eaa8f066a4cd6ca96dc67abcddbff2715c7998f8a18298423c29370
MD5 81f4ee6ba91a82ef3b435d93911a6873
SHA1 8d4425cdc1f62eb6432cabe0dc4f497ecad6fab6
SHA512 ddb0e4350b6f7e02b5c39ebe6271c8d41b83ae1b2fa8f74f06a5a8e9607386fe4e5f4abd5d4c3673b897489e96e4fcd307bf1c6039a97a5fbc0e2be228339ace
SSDEEP 384:dVZvmyl49vMl/EMtxlGtU86d1uwI02PRyLIf6Ch75bdvLypkX8O4dtmmrJ:dzOyaulXlGtV6C02PRIISApvLfMORml
TLSH
T1DEC2D0831F210332E4266F35B99F2DC6BB594C06FC69BB168EA2B57C0EB7D491015A73
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiakor.chm

SHA256 d9e0d7fcbb6210a8eb8675a37c72dd7fba95a0daa3dcd5eb06baae57bf5ff79a
MD5 b49cd05759b11df66a9f6fd74e04b1a0
SHA1 ddd408554d9701afdcc41b99e65a04ab71eda3af
SHA512 5ba2df5370d2e39e4a9eaf10619f943646ced896c97bb3cc42f633566286fc9544a1493d8e3b1ededc530eb2d6988bdf46c5a2b59644cd967d729c55280f6f17
SSDEEP 384:iGmCZvXVmIlW7kLXXzfkSbf5KdvDP0O+xYEXR3AHxh4o00qpYOs8i772N:iGmI8I5jfkSbfk0O6mHxhO0ELsN2N
TLSH
T15CC2D0745742D193E14E4533AFDE29E239127C107E3866D6F417DB3E8B77E5848E1421
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiapol.chm

SHA256 7015d193adeace0a781ce065c7a53b11c1dbc54caa26e2c14b29ce9c857d5685
MD5 e82515e43e735747d1953e61f02be720
SHA1 1837c25922728ec14c47d75fd6fd39756aa3b988
SHA512 9dfcebfaf8bfa11dc742bf833b5e3d7c0b70a5a9a188b77cc738a7540442cc1e078cfd6bb9437df01f695023c137a34ab4f75bbe122fe16320fffada2cfb8fd8
SSDEEP 384:+TMeBMvZlZ0aASIkUm8orxybF14PtXjcRW2ta3pGTbhkBo2m+6pr:+TruZw7o8/5ktXjO+Gfhuoh+U
TLSH
T1C8C2C0C33302490CC5225F39B4E8EAE1F8E4AC37A150C25EF15CB5DDBB9BE1553459AA
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiarus.chm

SHA256 7526376dcc365dd1e0f23ed1ea915e599005d153c64a6527edfb2b292ef1dae4
MD5 b414edc29df6de61f3fce33b29a91b35
SHA1 b1953e743ee41ffe255de89e4c4f6759f90ff52b
SHA512 f40702046eedb885f13367362fcce7cb497df36cb349a6f710753977351b4a5c5e84e4753f8a23880f0b42f336bbe85a17b2e5d6b281fd66a976aaa934ddb737
SSDEEP 384:jNLm8bF3tITeSD4equLmug7zMCddq6i9A6WdeOraN8qvo/xU:jNL33t0DDxmusACHXi9A6WwOr/7pU
TLSH
T186C2D1F036D6156FD2B49A71F99A24C0805B3E659862B2CF51548F2CE6F80164FF4F92
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiaspa.chm

SHA256 e74077db52d39759c80ccbe7c79714c045e91d43917c2493259f1bbe98d729a3
MD5 d7eb8554de9524e080fd9228e25e71c5
SHA1 21a0cdd2da963b64ed2461a35db5018bc5035c69
SHA512 65a768d19e3be7856ccf05d5e4da25151e1085856abd789643525c32421de2e218c9c19cc0524a8ade5458e9e6b241dc36700a29567df2d5b20386b2ede79f83
SSDEEP 384:Qtoi5o60JWWIBPxzffOOvCQ+23H6BJOra5p90LlnuOUh+g:QtoewJWdvTfOe+wH6Ia8ndUf
TLSH
T152B2D0B823A1454CEC5046711BA886D7A4637E86A45CE196928CF33C1AB8F8F4384E72
MD5 SHA1 SHA512 SSDEEP TLSH

dxdiaswe.chm

SHA256 42f60e3ac4651d996cdfa14b2c869b41595ece1bf04ee47ba684c0fbb0846531
MD5 b1acf7038845805fcf0d504d851429e9
SHA1 6f48f1449b28a939e7be8dfc697b34da2a570c56
SHA512 6b6831e801a57d008edfdf7f97ff87f589009bc92cd3a891e7f8f65c130d3b9f076e46b8c1c4f5c303bfab82b411931708ab8d33982ffcf18e723ce4812bbd14
SSDEEP 384:UOOgdCUxJuREySovd1MoQbCJ/Ag6Ru7jMrlxxaUz4W:UOOgdCUxJlb4MoPJ6Rvrlxx7z4W
TLSH
T10EB2C0BCF7A0126DE1866E3A73E1E0D7B486BC43D060D947755A17232FF498E239A022
MD5 SHA1 SHA512 SSDEEP TLSH

dxdllreg.exe

IMPHASH 7808fd325bf451cda117496280bd1fac
SHA256 81aefdb0459c6cc4c26ff98a3ee8e3a858aaa9eb9f53026d3f8c269a324e6fcf
MD5 5081f2fd42a97c2d8885f1de109f7b39
SHA1 e5531a7eb27e14f92ac7c4c6686ba90b1bba7b9d
SHA512 77a4cef3e8727d6b074f97d7d2338aedb5009119d326ee3c314bd8191cb9bbca1c8b44de1dede5df1366ca39670234de3e6ba35120de19a0c27b1d1b3e497b0b
SSDEEP 768:I42N/LzVSpZQ5zfovWKIvT5dI33zDIP75z0DiCbBkHunij6Ja6OVC/:J2N/LzVSpoZKITazG75QDiCbBkHuFJjv
TLSH
T192137D027360C17FD0C567780576CB25ABB6F4101AB1578F5B548A8EAFA37D0AF39392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError FindClose FindFirstFileA lstrcpyA lstrlenA GetPrivateProfileSectionA FreeLibrary GetProcAddress LoadLibraryExA GetPrivateProfileStringA GetSystemDirectoryA lstrcmpiA CreateMutexA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA TerminateProcess GetCurrentProcess GetVersionExA GetWindowsDirectoryA OutputDebugStringA lstrcmpA lstrcpynA VirtualQuery GetSystemInfo VirtualProtect ReadFile GetProcessHeap SetEndOfFile RtlUnwind GetCommandLineA GetStartupInfoA GetLocalTime HeapFree HeapReAlloc HeapAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsFree SetLastError TlsSetValue TlsGetValue TlsAlloc HeapDestroy HeapCreate VirtualFree CloseHandle EnterCriticalSection LeaveCriticalSection VirtualAlloc LoadLibraryA GetACP GetOEMCP GetCPInfo Sleep InitializeCriticalSection SetStdHandle FlushFileBuffers CreateFileA SetFilePointer LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

advapi32

RegQueryValueExA RegDeleteValueA RegCloseKey RegOpenKeyExA

setupapi

SetupCloseInfFile SetupFindNextLine SetupGetLineTextA SetupFindFirstLineA SetupOpenInfFileA

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

ole32

CoInitialize

dxdllreg.inf

SHA256 a424ebc884e0c9bb227c1e58d205b1aaf4d5495a5f50fc38e7e6c323e619fa6c
MD5 22e034aff6264e9ae75d57caac38a2c7
SHA1 7a89a59e0b629d1f08c8ca448c39f17003664bab
SHA512 5fe42a0c0b339e6d9dd4923e439042715ebad9ce5b77cb0f6a9e203be6857998106145ebe107ffea0d4ebb35dd6b735ad657cdd6cb74e6a525bce2f5a019b78f
TLSH
T12451AA9EE5B2402658D7B04DB810ACCF641224063B5EB7D9B39937D43AB394FACA403E
MD5 SHA1 SHA512 TLSH

dxnetsrv.cat

SHA256 20557cbeb1455617f435daa6118b494559847a37e0249d2aad458fe9a7d3fcba
MD5 c015c83ff0938e8b3870aef662fc7911
SHA1 dae0ffe76114c3e020abb1ac739b4668144961e8
SHA512 7b6b71192c11b3901a932b05cd8e34f80ab572435724585635b4334c0fc8065b506c2e055fdef73dea74bff313da0ab3ceb58522d371f442a19bb66bf5399c3a
SSDEEP 192:5WCNEjo6kLWLuWlqstydMBD7lRQAhh136Tn/hYozhyDbFJFCvVCQ9re+fBQyvFm/:+85SfkS+zuCytA2K1dOLhe1OHrDuhU
TLSH
T1F6D2AC6B19E84163412DC8B1CFF9EC9FF022D6B6A5125D3E209373944683B62739F92D
MD5 SHA1 SHA512 SSDEEP TLSH

dxnetsrv.inf

SHA256 1d52e26294e677227500b3c2bf4568ecdf19ec432a430e724516f31709aec7c5
MD5 a5323dbfd33c8c046e8e60da862ecd91
SHA1 0fdddad6593ce37075e9d5991314dad3fd810494
SHA512 3d3f5f44f651c82de7b32bc1f2f9f314b052a7e274ce5212ecbbb57ce8c3159127be748158f16ae0548ece2d9d10fe29f931f00d265bf40bc4ae18db6ae1c9c9
SSDEEP 96:72oqU4hyNMtG3cwrvCqlZyVedSCspYSCK6gsPnQis2l95V46xJ:72ZHocwrvCqlZyVedSis6gsP7R
TLSH
T145A1FC9CCA308D99B5AA3B50885E7DCDA524C1A637C61247F46E90CD9F2F4BFC224537
MD5 SHA1 SHA512 SSDEEP TLSH

dxnt.inf

SHA256 667056e8724cc1c445631f9818178399b88218444dc0f6adcb9933206fc5c2a3
MD5 31412f15595fed4b42f2a59828ee0b38
SHA1 8004e24c57bfd7437774870d3474ae6b2d4f70ac
SHA512 1afef6295e6f0e12e693836cc961467ad4224fe64505363d6540fb14aea308027ceeed94b39b2a115c3aed8cbafd211971a87998bb25eb9a290304c2bde8ec77
TLSH
T12861004FD2B1C75C02DDA4A0895A2C8F625C50263AA521D6F5AD03CACF7B9BF83A1532
MD5 SHA1 SHA512 TLSH

dxntunp.inf

SHA256 132d87564a8b2804dfc485422005ffa79940c9c85063f361a4a45839676bfc6f
MD5 66180f70e344619e6f3580cd3920f1c9
SHA1 8b3de6114e678ae7aa58c150b2fafa6c4b5d4a65
SHA512 204c9e10301977c5d7a54c8ee82e9a9a2d19434d8e4e7381735f95f2a69fcab6e70d088732eb13bb7eb61000ef948bb242249f7b368ff8b897000521ea53541c
SSDEEP 384:lh/a0BImofpG2C2eEl0bSpg5NA5tszduMriQ4kPmUFrM9KMoGJAbK5kRevD:lh/a0BImofDC2eOhp0FrM9mGJAbK5kRC
TLSH
T123A2C6CDE5B188A8E0947A418A663DCD150CB16733CBAB4DD1A983CD8D2B9FBD151E33
MD5 SHA1 SHA512 SSDEEP TLSH

dxver.inf

SHA256 632ecc3c127aeca60ff9cd394cdad96a0fc8b999f7c1bcdbc3b8d1f6919a862d
MD5 17772caeaa51adf03245418ce84c7d93
SHA1 1dd7dca4ab5c2ac0234f19dfcd4f9921bb17f68d
SHA512 f22781824da76045bfcf80f7375da9df1a23031bf936baab1d8c267470b1468bc184d664a312a45c382bcd006c13061113c15522cf05b22b0132bced7c4270aa
TLSH
T1EEE0C215A515F222E4255722D7073E57FFE8CA4320CAF78CBEF029024715E8A610E7FA
MD5 SHA1 SHA512 TLSH

dxxp.cat

SHA256 5b2db73a74c9abdf6324a61a39afbc2da6955265b0b7b6197bb33d01d9089700
MD5 3c53ef7fd8bc8f4af12953c4e680234a
SHA1 eca39bbdb9d41b2f666763ab34959ed7c891ca31
SHA512 8bdde7f0aa65dc9b52b86460c1ef84a8b15dd41141ea9ecda79620c2c232aaf876ecece8e5f0aed0aa5841f1f21e83df987970e0491b764b7322695f7ea1b001
SSDEEP 192:bWCNEjo6kLWLulqstydMBD7lRN2Ahh136T9O/hYoUNhyDbFJFQ9ovVCQ9re+fBQQ:c85SeIX+7ugyZbFV2t1dxLhe1OHrDUlk
TLSH
T119E2AB6B19E841634129C8B1CFF9EC9FB022D6B6B4125D3E209373954683B62739F92D
MD5 SHA1 SHA512 SSDEEP TLSH

dxxp.inf

SHA256 8d62132b2a5a2bc82ddb0efdba91dee7bb54588328770a9a9f54ad3dfb4ce572
MD5 e251a9fa40e977fe9cf9c47a3e1cc09b
SHA1 dbbe68f276e30e2bc6580029a39bc0286a7b0831
SHA512 c0e2edbf586631c1c5219485c69af1fe8d3551d32caa763e29c4c6979d4d0bb97e51a7f7b1c6fc500f5151f15169953d866356229918b6fa6f2dc4cbebeb9538
SSDEEP 96:72oChARI0GnaBlZltKTpGywKTpinCvQponr4nDffHxCYgSg4nQodp8LVs2l95Vku:72ZhlaBlZlUVGyfV+/n44ddpeB5
TLSH
T1C5A1305DCAB1CE4D54DB7459C90A7E8FA01C901233952396F6AD48DDCF339BF82A063A
MD5 SHA1 SHA512 SSDEEP TLSH

encapi.dll

IMPHASH 7ef4eb075baf0539b4fc0bbc0e5355d6
SHA256 4734bcfbcea9201aa71e0b9cadfbcfa86ea95489bb6fea9dfba00f435bca100d
MD5 f32cdbe214217d6c30676acf807dd047
SHA1 bce835800dab2d087b0058a342f9fc272af84311
SHA512 02ca5b1656d19e054c45f6977231386f4ddc79df3ccf07f55471e1638b78b81812113f0291c043d54bd03d0b12e6b6c27f085fb90beb8b68bebd60f0e890e543
SSDEEP 384:chZeFCCVEXb5SqZthlVSn+cwgrkVh/gbx13x3vfWVZWGl:EZeFCCVqb8qZzDSn+/g4vgXx/qDl
TLSH
T15F823B83BBE58837D2E242714EB23A6572EEE62C4A71DE5243600D0F2D79DC381B9753
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gcdef.dll

IMPHASH 3fc52270ad7ee22032b21464fecb39f8
SHA256 fbb217771b57633d7b05aa0fb01ab580c930402cbe3323110fe91339bc7d3b0d
MD5 45dea90300599245316b92b5b4815b89
SHA1 7cf6279b61d0067faa4d8edc9dc35aec4ae6ffa7
SHA512 b9a8ff99ab1c681ce6e19c07ba8925d7aefa6a65c6504f24f61d230721b87562e68eb850a5ab00a9b7d58ee83e5a4ed8bbe49b6b448d63a49c7485c2bc8b88b5
SSDEEP 3072:HgfkFdp3GTFkzy1rZfCXVLBJH7JigE+2aoWct4/uPgTbd4Owp4sD7FgMSTVr5kfR:HM6cF
TLSH
T17C141211A3F8D109F0F3BB34A9BE8AA55E3BBC519B35C91DA754124E19B0E40DE62723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42u

ord2971 ord3076 ord2980 ord3257 ord2854 ord4459 ord3254 ord3142 ord6238 ord823 ord4270 ord765 ord567 ord3693 ord4418 ord4621 ord4075 ord3074 ord3820 ord3826 ord3825 ord3131 ord2977 ord5273 ord2116 ord2438 ord6051 ord5257 ord1720 ord5059 ord3744 ord6372 ord2047 ord2640 ord4435 ord4831 ord3793 ord5286 ord4347 ord6370 ord5157 ord2377 ord5237 ord4401 ord1768 ord4073 ord825

msvcrt

??1type_info@@UAE@XZ wcslen __CxxFrameHandler _ftol ?terminate@@YAXXZ _except_handler3

dinput

DirectInputCreateW

user32

DestroyIcon ChildWindowFromPoint IsWindowVisible GetMessageTime GetCursorPos CreateWindowExW RegisterDeviceNotificationW IsWindow ScreenToClient LoadImageW MapWindowPoints InvalidateRect SetRect GetSysColor EnableWindow RedrawWindow GetWindowRect GetSystemMetrics MessageBoxW WinHelpW UnregisterClassW DestroyWindow SendMessageW GetWindowDC SetTimer GetClientRect LoadStringW wsprintfW GetParent PostMessageW GetDC ReleaseDC UnregisterDeviceNotification KillTimer SendDlgItemMessageW SetWindowPos GetDlgItem SetWindowLongW RegisterClassExW DefWindowProcW BeginPaint GetWindowLongW DrawIconEx GetWindowTextW DrawTextW EndPaint GetDlgCtrlID

gdi32

CreatePolygonRgn DeleteDC BitBlt DPtoLP SetMapMode GetMapMode SelectObject CreateCompatibleDC GetRgnBox GetStockObject SetBkColor Ellipse SetDCPenColor SetViewportOrgEx SetViewportExtEx SetWindowExtEx LineTo MoveToEx CreatePenIndirect GetDeviceCaps CreateFontW CreateSolidBrush ExtTextOutW DeleteObject SetBkMode PaintRgn SetTextColor

kernel32

InitializeCriticalSection LocalFree GetLastError MulDiv DeleteCriticalSection DisableThreadLibraryCalls InterlockedDecrement InterlockedIncrement LocalAlloc LeaveCriticalSection IsBadWritePtr IsBadReadPtr EnterCriticalSection Sleep lstrlenW

advapi32

RegQueryValueExW RegCloseKey

comctl32

PropertySheetW CreatePropertySheetPageW

shlwapi

StrCpyNW StrDupW StrNCatW

gcdef.xpg

IMPHASH 3fc52270ad7ee22032b21464fecb39f8
SHA256 12f6befcfacabe333ddc04ac643fe033f07f656b0b29310ca1910b055f2b9baa
MD5 663988c1110ac436bb0ef18acfc9e262
SHA1 4cd85ffb56b2c4c67c0d114d588498da8443c2a9
SHA512 ba823c84070d65f052f10708ce3d21506a956033d0695311a85a726e73fc512f03a4d04db849b0ed061bd3c9ecf2bbae26739c059ce23bf0717ca15a0416ca98
SSDEEP 3072:QzPCUGYVx8Rh/IFxkFN+d8J1ZnfX7kf5E+NutZ8G3yx3rZICiKX4cJHONXQvUX+:QLCZh/I
TLSH
T19F24FF15A3F89105F0F3BB3499BE87A55A3BBC51AF35C91DA654324E19B0E40CE62B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15309

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42u

ord2971 ord3076 ord2980 ord3257 ord2854 ord4459 ord3254 ord3142 ord6238 ord823 ord4270 ord765 ord567 ord3693 ord4418 ord4621 ord4075 ord3074 ord3820 ord3826 ord3825 ord3131 ord2977 ord5273 ord2116 ord2438 ord6051 ord5257 ord1720 ord5059 ord3744 ord6372 ord2047 ord2640 ord4435 ord4831 ord3793 ord5286 ord4347 ord6370 ord5157 ord2377 ord5237 ord4401 ord1768 ord4073 ord825

msvcrt

??1type_info@@UAE@XZ wcslen __CxxFrameHandler _ftol ?terminate@@YAXXZ _except_handler3

dinput

DirectInputCreateW

user32

DestroyIcon ChildWindowFromPoint IsWindowVisible GetMessageTime GetCursorPos CreateWindowExW RegisterDeviceNotificationW IsWindow ScreenToClient LoadImageW MapWindowPoints InvalidateRect SetRect GetSysColor EnableWindow RedrawWindow GetWindowRect GetSystemMetrics MessageBoxW WinHelpW UnregisterClassW DestroyWindow SendMessageW GetWindowDC SetTimer GetClientRect LoadStringW wsprintfW GetParent PostMessageW GetDC ReleaseDC UnregisterDeviceNotification KillTimer SendDlgItemMessageW SetWindowPos GetDlgItem SetWindowLongW RegisterClassExW DefWindowProcW BeginPaint GetWindowLongW DrawIconEx GetWindowTextW DrawTextW EndPaint GetDlgCtrlID

gdi32

CreatePolygonRgn DeleteDC BitBlt DPtoLP SetMapMode GetMapMode SelectObject CreateCompatibleDC GetRgnBox GetStockObject SetBkColor Ellipse SetDCPenColor SetViewportOrgEx SetViewportExtEx SetWindowExtEx LineTo MoveToEx CreatePenIndirect GetDeviceCaps CreateFontW CreateSolidBrush ExtTextOutW DeleteObject SetBkMode PaintRgn SetTextColor

kernel32

InitializeCriticalSection LocalFree GetLastError MulDiv DeleteCriticalSection DisableThreadLibraryCalls InterlockedDecrement InterlockedIncrement LocalAlloc LeaveCriticalSection IsBadWritePtr IsBadReadPtr EnterCriticalSection Sleep lstrlenW

advapi32

RegQueryValueExW RegCloseKey

comctl32

PropertySheetW CreatePropertySheetPageW

shlwapi

StrCpyNW StrDupW StrNCatW

joy.w2k

IMPHASH d81675a4e5011c9ef7681b0dce9a2174
SHA256 a1093e62fdce9d44e44eab0b1ec4276f7f10d339a19e50a85cbc6f2cbbcc4190
MD5 46815f507955f52c716757ea491dea86
SHA1 2d7f9b5baec7bc88319ce60a9b8866c10457095d
SHA512 6695198c1c13fdbfc53db6df87f97989838b1b23c6eca6872faf9136f82ed73492f40412f8c1ed2c01c91975672d5962eb3be8e28ad7dfb95c1d259fd58a014d
SSDEEP 3072:6+zbBiuiVCNo6u33ssmmx5Wf5ucjO9SRGaVSbsRbeJSG+mZMhxM8Fv64Dnz+EETl:94uoH6unssL4nmZ8xZFvj0WS
TLSH
T18E64DB21A3F88615F1F3AF34ADB917915E37BCA2EE39C60E5644624E1870E54DE24B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42u

ord2980 ord3076 ord2971 ord3825 ord3826 ord3820 ord3074 ord3257 ord4621 ord4418 ord3605 ord656 ord4270 ord3084 ord5977 ord3131 ord4459 ord3254 ord3142 ord2977 ord5273 ord2116 ord2438 ord5257 ord1720 ord5059 ord3744 ord6372 ord2047 ord2640 ord4435 ord4831 ord3793 ord5286 ord4347 ord6370 ord5157 ord2377 ord5237 ord4401 ord1768 ord4073 ord6051 ord2371 ord2859 ord2854 ord3133 ord4294 ord1165 ord825 ord567 ord1644 ord2081 ord2455 ord823 ord4075

msvcrt

wcscat __CxxFrameHandler malloc ??1type_info@@UAE@XZ ?terminate@@YAXXZ _except_handler3 _wcsdup wcsncpy free wcslen wcscmp _wcsnicmp wcschr wcscpy wcsncat wcsncmp

ole32

CoFreeUnusedLibraries CoUninitialize CoGetClassObject CoInitialize CoCreateInstance

advapi32

RegSetValueExW RegOpenKeyExW RegEnumKeyExA RegEnumKeyExW RegSetValueExA RegCloseKey RegQueryValueExW RegCreateKeyExW RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegOpenKeyW

dinput

DirectInputCreateW

kernel32

CreateMutexW FreeLibrary GetProcAddress LoadLibraryA GetLastError WideCharToMultiByte MultiByteToWideChar lstrcpyW GetVersion Sleep DisableThreadLibraryCalls GetVersionExW lstrlenW FindClose CloseHandle CreateProcessW FindFirstFileW ReleaseMutex GetWindowsDirectoryW

user32

SetDlgItemTextW LoadIconW GetWindowTextW EnableWindow GetDC ScreenToClient SetForegroundWindow MessageBeep GetKeyState UpdateWindow RegisterWindowMessageW KillTimer MessageBoxW wsprintfW LoadStringW SetCursor LoadCursorW SendMessageW GetDlgItem SendDlgItemMessageW PostMessageW IsWindow RedrawWindow SetWindowLongW GetWindowLongW ReleaseDC GetWindowDC DestroyIcon EndDialog LoadImageW SetFocus GetDlgItemTextW SetWindowPos CheckRadioButton InvalidateRect DestroyWindow IsWindowVisible DialogBoxParamW GetParent WinHelpW DestroyMenu TrackPopupMenu ClientToScreen GetClientRect AppendMenuW CreatePopupMenu CallWindowProcW GetWindowRect GetSystemMetrics IsDlgButtonChecked UnregisterDeviceNotification MapWindowPoints RegisterDeviceNotificationW ExitWindowsEx IsWindowEnabled GetFocus SetTimer

gdi32

GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W

comctl32

CreatePropertySheetPageW ImageList_Destroy ImageList_ReplaceIcon ImageList_Create PropertySheetW

shell32

ExtractIconExW

joy.xpg

IMPHASH 94221c7beb4a4be2e07d617b424cb6b5
SHA256 075143957fa10a36a6a1a1cc757b5b5c41686e4d140f2d5ed7560f244019ec3d
MD5 56ca1db6b017f64b0da4af9eb8b7542b
SHA1 8596436b6dfb253fc8ff956973f80af307647b88
SHA512 2486d4b13833f9a632fea70873067a4a60b0b6fc40be9d72d329df943890b4a948289ad4c76272666082e4bd286ca7dd4e28f5abb4423290bf7160f06871217a
SSDEEP 3072:TTPSEseTkmIXeslb3X5OkrYbZCeM2Yqs5LXS0FqaHM3U80CdAz7iai0OXxnwkOP5:6uTTIr
TLSH
T140141D10A3F89615F1F36F3469B647914A3ABD52AD39C64E7A88325E1E30E44CE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcsncpy _snwprintf _wcsnicmp wcscmp wcsncmp wcschr wcslen ??2@YAPAXI@Z ??3@YAXPAX@Z __CxxFrameHandler _CxxThrowException ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ??1type_info@@UAE@XZ ?terminate@@YAXXZ _except_handler3 ??0exception@@QAE@XZ ?what@exception@@UBEPBDXZ

msvcp60

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??8std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

ole32

CoFreeUnusedLibraries CoInitialize CoGetClassObject CoUninitialize

advapi32

RegCloseKey

dinput8

DirectInput8Create

kernel32

LoadLibraryW GetModuleFileNameW GetProcAddress CreateMutexW GetWindowsDirectoryW CreateProcessW CloseHandle GetModuleHandleW SetLastError IsBadReadPtr lstrlenW GetLastError ReleaseMutex DisableThreadLibraryCalls

user32

SetWindowPos DialogBoxParamW SetForegroundWindow ExitWindowsEx GetClientRect KillTimer SetTimer GetDlgItem LoadStringW wsprintfW MessageBoxW GetWindowLongW SendMessageW WinHelpW EndDialog SetWindowLongW InvalidateRect EnableWindow ShowWindow GetDlgItemTextW SetFocus

shlwapi

StrCatW

ks.inf

SHA256 b9298854d34560acff3ad7fb3a8abe902f80a3d06a1a854189cf4695f0d0792a
MD5 bc517470ebe7e36db27398a1394ff831
SHA1 69ff3a23aafa2e549f8615b03dd9b64a0d136b6b
SHA512 7d179e7eb77ee91e7b8e2226213753599cf67df817d0dc86730f3589341ca3ca7d8c2311092fd89f93fbc1a8dfb92aba274fdf3f73d009f036a76b217f8ba99f
SSDEEP 384:3AEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntDynwYOV8Wzzpbt3KD/uO5E1BBeyQQ:3ATGMDhX1eJZjfynwJHRGuJP0yF
TLSH
T1D7F2D11E930D8913E20C72C0F7D12DC7709A509ED0E052AE7B26DA9E685EE96451CF7F
MD5 SHA1 SHA512 SSDEEP TLSH

ks.sys

IMPHASH 799c7065e0973a0f7a80b1e4089df3f8
SHA256 ba790438ca8b68e88fb9fabf12e8e7b54c432a7bc946d71c0e57bc8a35f8dfcf
MD5 dc197a88746a55ae60d1c81d45cd1b4a
SHA1 8fac5067d9507a8582b5ab61af5e3d5082a886cc
SHA512 58b120c32fa5cd778ee08b41a126d4a2bc448a1fae3d560f00b9ef55c25e5f26f7279061792537d9a022d3e050a3ae4a591948923a3a9a02a262341c6be67ec3
SSDEEP 3072:Aahi+EhdvTSVFsmyaa0tCxB62xIVhgeUiT6g0iZVTXJV:cdvTs/BtCnxcHTKinTX
TLSH
T1C3D38C23B2C5443AD19323F19F0E336F73775311172AA25746246EE13ABA901FD2A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

119975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ks.pdb

ntoskrnl.exe

ExDeletePagedLookasideList ExFreeToPagedLookasideList ExAllocateFromPagedLookasideList ExInitializePagedLookasideList KeInitializeSpinLock ProbeForRead IofCallDriver IoBuildSynchronousFsdRequest ZwClose ExFreePoolWithTag ZwQueryValueKey ZwOpenKey RtlInitUnicodeString RtlFreeUnicodeString wcscat wcscpy RtlStringFromGUID SeReleaseSubjectContext SeAssignSecurity IoGetFileObjectGenericMapping SeCaptureSubjectContext IoGetRelatedDeviceObject ObfReferenceObject IoBuildDeviceIoControlRequest ExGetPreviousMode ZwEnumerateValueKey ZwSetValueKey RtlCompareMemory RtlIntegerToUnicodeString RtlAppendUnicodeStringToString ZwCreateKey RtlAppendUnicodeToString RtlCopyUnicodeString ExQueueWorkItem swprintf wcslen KeLeaveCriticalRegion ExReleaseFastMutexUnsafe ExAcquireFastMutexUnsafe KeEnterCriticalRegion IoSetDeviceInterfaceState KeSetTimer IoInvalidateDeviceRelations ExAllocatePoolWithQuotaTag ProbeForWrite IoGetDeviceProperty KeBugCheckEx ZwEnumerateKey ZwQueryKey IoRegisterDeviceInterface RtlGUIDFromString _wcsicmp IoDeleteDevice IoCreateDevice ZwDeleteKey IoDetachDevice IoAttachDeviceToDeviceStack KeInitializeDpc KeInitializeTimer _wcsnicmp SeSinglePrivilegeCheck KeCancelTimer KeSetTimerEx ExInterlockedCompareExchange64 KefReleaseSpinLockFromDpcLevel KefAcquireSpinLockAtDpcLevel ExInitializeNPagedLookasideList KeInitializeTimerEx KeReleaseMutex KeSynchronizeExecution ExReleaseResourceLite ExAcquireResourceExclusiveLite KeSetImportanceDpc ObfDereferenceObject KeRemoveQueueDpc KeReleaseSemaphore KeInsertQueueDpc ExEventObjectType ObReferenceObjectByHandle ExSemaphoreObjectType ExAcquireResourceSharedLite PoCallDriver PoStartNextPowerIrp KeGetCurrentThread ExInitializeResourceLite ExDeleteResourceLite RtlCompareUnicodeString IoCreateFile RtlMapGenericMask SeUnlockSubjectContext SeOpenObjectAuditAlarm SeFreePrivileges SeAppendPrivileges SeAccessCheck SeLockSubjectContext SeQuerySecurityDescriptorInfo SeSetSecurityDescriptorInfo MmMapLockedPages KeClearEvent ExRaiseStatus IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl IoReleaseCancelSpinLock IoAcquireCancelSpinLock ExfInterlockedRemoveHeadList ExfInterlockedInsertTailList LdrAccessResource LdrFindResource_U IoOpenDeviceRegistryKey KeInitializeMutex IoFileObjectType IoGetDeviceInterfaces IoAllocateDriverObjectExtension IoGetDriverObjectExtension IoFreeIrp IoAllocateIrp _snwprintf IoAllocateAdapterChannel PoUnregisterSystemState PoRegisterSystemState IoIsWdmVersionAvailable PoRequestPowerIrp PoSetPowerState IoOpenDeviceInterfaceRegistryKey memmove KeReadStateMutex KeResetEvent KeQuerySystemTime MmMapLockedPagesSpecifyCache _except_handler3 KeTickCount ExDeleteNPagedLookasideList KeInitializeEvent KeSetEvent KeWaitForSingleObject IofCompleteRequest InterlockedIncrement InterlockedDecrement ExFreePool ExAllocatePoolWithTag ExInterlockedPushEntrySList KeQueryTimeIncrement ExInterlockedPopEntrySList

hal

KfLowerIrql IoFlushAdapterBuffers IoFreeMapRegisters IoMapTransfer KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter KfRaiseIrql

??0CBaseUnknown@@QAE@ABU_GUID@@PAUIUnknown@@@Z ??0CBaseUnknown@@QAE@PAUIUnknown@@@Z ??1CBaseUnknown@@UAE@XZ ??_FCBaseUnknown@@QAEXXZ ?IndirectedAddRef@CBaseUnknown@@UAGKXZ ?IndirectedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?IndirectedRelease@CBaseUnknown@@UAGKXZ ?NonDelegatedAddRef@CBaseUnknown@@UAGKXZ ?NonDelegatedQueryInterface@CBaseUnknown@@UAGJABU_GUID@@PAPAX@Z ?NonDelegatedRelease@CBaseUnknown@@UAGKXZ DllInitialize KoCreateInstance KoDeviceInitialize KoDriverInitialize KoRelease KsAcquireControl KsAcquireDevice KsAcquireDeviceSecurityLock KsAcquireResetValue KsAddDevice KsAddEvent KsAddIrpToCancelableQueue KsAddItemToObjectBag KsAddObjectCreateItemToDeviceHeader KsAddObjectCreateItemToObjectHeader KsAllocateDefaultClock KsAllocateDefaultClockEx KsAllocateDeviceHeader KsAllocateExtraData KsAllocateObjectBag KsAllocateObjectCreateItem KsAllocateObjectHeader KsCacheMedium KsCancelIo KsCancelRoutine KsCompletePendingRequest KsCopyObjectBagItems KsCreateAllocator KsCreateBusEnumObject KsCreateClock KsCreateDefaultAllocator KsCreateDefaultAllocatorEx KsCreateDefaultClock KsCreateDefaultSecurity KsCreateDevice KsCreateFilterFactory KsCreatePin KsCreateTopologyNode KsDecrementCountedWorker KsDefaultAddEventHandler KsDefaultDeviceIoCompletion KsDefaultDispatchPnp KsDefaultDispatchPower KsDefaultForwardIrp KsDereferenceBusObject KsDereferenceSoftwareBusObject KsDeviceGetBusData KsDeviceRegisterAdapterObject KsDeviceSetBusData KsDisableEvent KsDiscardEvent KsDispatchFastIoDeviceControlFailure KsDispatchFastReadFailure KsDispatchInvalidDeviceRequest KsDispatchIrp KsDispatchQuerySecurity KsDispatchSetSecurity KsDispatchSpecificMethod KsDispatchSpecificProperty KsEnableEvent KsEnableEventWithAllocator KsFastMethodHandler KsFastPropertyHandler KsFilterAcquireProcessingMutex KsFilterAddTopologyConnections KsFilterAttemptProcessing KsFilterCreateNode KsFilterCreatePinFactory KsFilterFactoryAddCreateItem KsFilterFactoryGetSymbolicLink KsFilterFactorySetDeviceClassesState KsFilterFactoryUpdateCacheData KsFilterGetAndGate KsFilterGetChildPinCount KsFilterGetFirstChildPin KsFilterRegisterPowerCallbacks KsFilterReleaseProcessingMutex KsForwardAndCatchIrp KsForwardIrp KsFreeDefaultClock KsFreeDeviceHeader KsFreeEventList KsFreeObjectBag KsFreeObjectCreateItem KsFreeObjectCreateItemsByContext KsFreeObjectHeader KsGenerateDataEvent KsGenerateEvent KsGenerateEventList KsGenerateEvents KsGetBusEnumIdentifier KsGetBusEnumParentFDOFromChildPDO KsGetBusEnumPnpDeviceObject KsGetDefaultClockState KsGetDefaultClockTime KsGetDevice KsGetDeviceForDeviceObject KsGetFilterFromIrp KsGetFirstChild KsGetImageNameAndResourceId KsGetNextSibling KsGetNodeIdFromIrp KsGetObjectFromFileObject KsGetObjectTypeFromFileObject KsGetObjectTypeFromIrp KsGetOuterUnknown KsGetParent KsGetPinFromIrp KsHandleSizedListQuery KsIncrementCountedWorker KsInitializeDevice KsInitializeDriver KsInstallBusEnumInterface KsIsBusEnumChildDevice KsLoadResource KsMapModuleName KsMergeAutomationTables KsMethodHandler KsMethodHandlerWithAllocator KsMoveIrpsOnCancelableQueue KsNullDriverUnload KsPinAcquireProcessingMutex KsPinAttachAndGate KsPinAttachOrGate KsPinAttemptProcessing KsPinDataIntersection KsPinGetAndGate KsPinGetAvailableByteCount KsPinGetConnectedFilterInterface KsPinGetConnectedPinDeviceObject KsPinGetConnectedPinFileObject KsPinGetConnectedPinInterface KsPinGetCopyRelationships KsPinGetFirstCloneStreamPointer KsPinGetLeadingEdgeStreamPointer KsPinGetNextSiblingPin KsPinGetParentFilter KsPinGetReferenceClockInterface KsPinGetTrailingEdgeStreamPointer KsPinPropertyHandler KsPinRegisterFrameReturnCallback KsPinRegisterHandshakeCallback KsPinRegisterIrpCompletionCallback KsPinRegisterPowerCallbacks KsPinReleaseProcessingMutex KsPinSetPinClockTime KsPinSubmitFrame KsPinSubmitFrameMdl KsProbeStreamIrp KsProcessPinUpdate KsPropertyHandler KsPropertyHandlerWithAllocator KsQueryDevicePnpObject KsQueryInformationFile KsQueryObjectAccessMask KsQueryObjectCreateItem KsQueueWorkItem KsReadFile KsRecalculateStackDepth KsReferenceBusObject KsReferenceSoftwareBusObject KsRegisterAggregatedClientUnknown KsRegisterCountedWorker KsRegisterFilterWithNoKSPins KsRegisterWorker KsReleaseControl KsReleaseDevice KsReleaseDeviceSecurityLock KsReleaseIrpOnCancelableQueue KsRemoveBusEnumInterface KsRemoveIrpFromCancelableQueue KsRemoveItemFromObjectBag KsRemoveSpecificIrpFromCancelableQueue KsServiceBusEnumCreateRequest KsServiceBusEnumPnpRequest KsSetDefaultClockState KsSetDefaultClockTime KsSetDevicePnpAndBaseObject KsSetInformationFile KsSetMajorFunctionHandler KsSetPowerDispatch KsSetTargetDeviceObject KsSetTargetState KsStreamIo KsStreamPointerAdvance KsStreamPointerAdvanceOffsets KsStreamPointerAdvanceOffsetsAndUnlock KsStreamPointerCancelTimeout KsStreamPointerClone KsStreamPointerDelete KsStreamPointerGetIrp KsStreamPointerGetMdl KsStreamPointerGetNextClone KsStreamPointerLock KsStreamPointerScheduleTimeout KsStreamPointerSetStatusCode KsStreamPointerUnlock KsSynchronousIoControlDevice KsTerminateDevice KsTopologyPropertyHandler KsUnregisterWorker KsUnserializeObjectPropertiesFromRegistry KsValidateAllocatorCreateRequest KsValidateAllocatorFramingEx KsValidateClockCreateRequest KsValidateConnectRequest KsValidateTopologyNodeCreateRequest KsWriteFile KsiDefaultClockAddMarkEvent KsiPropertyDefaultClockGetCorrelatedPhysicalTime KsiPropertyDefaultClockGetCorrelatedTime KsiPropertyDefaultClockGetFunctionTable KsiPropertyDefaultClockGetPhysicalTime KsiPropertyDefaultClockGetResolution KsiPropertyDefaultClockGetState KsiPropertyDefaultClockGetTime KsiQueryObjectCreateItemsPresent _KsEdit

Name

.text

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kscaptur.inf

SHA256 8e277c581c0562401fb8551875a11b5498fcf41b98e27d592c14ae5e6b75bfb4
MD5 d9eee85cf7e9d861c91ba68fba82e3c7
SHA1 01cdae51360a2c2f0c6d29cccf6d119862819870
SHA512 e06c8ae3f79230b79484ed8466114181367d5e29b3ee196c1f127a0e0bc1e977f624f5307179dafc658dd20211bba1a5d7386b809f2874097cbac327b337c873
SSDEEP 384:tbPDGYVv871qlvsuPrk1agj6o5aOO0Bs9Ck3omF8Fw7tvy0AeSyaLQ:tbPDGulvsuDk0ZOO0Bswsh6cSy+Q
TLSH
T1DDA2660B831B8963D18592B8F7931EC77084719B41F1916E3B75CA1A34DFDF4882E9EA
MD5 SHA1 SHA512 SSDEEP TLSH

ksfilter.inf

SHA256 adb323c722db57e00e6154812d989ebd96210fa1f38bcac261fa608f0f4316c8
MD5 1a7ab501fe7b9054c7f7649239260dc3
SHA1 c11efd706ea9105d427260ec0ab89361b5e5c44a
SHA512 3676b551f24275ba771d4c4ea86af48e13041f03e7a94dcfa6e2af9dda38a177099fdf9499f59e3e3eb34937037e800f03e340fff3596cf045f42852875e2baf
SSDEEP 192:s0fo0Qo80OcIMNOwSltw3/RwN76wgolFwrYKynddTylQwtXsLBhI:Ko80OcIMNOZ72/RC76UbCYlnddTyCOs0
TLSH
T10222125E4E870876B148E7ACA8D76BC3E6053063B2CC09143D4BE9457DCA9D8623DAFC
MD5 SHA1 SHA512 SSDEEP TLSH

ksolay.ax

IMPHASH a3fd6dc1b0adee45584d8de85cd8c504
SHA256 ce55994b6e475483de09f6bcf32e65b0ff4218a0b38d6ea81d0d13b950eea52b
MD5 02f14573a629d63340ba1898c29494a8
SHA1 1582d7cd94e4b50ffd18d1507bebb55bbf783888
SHA512 178b8ba78b9a621059c134546015555ec4696abf89887d2ee5b75ca96692e15fbcf2e1a2686da01f8f9c42eb9aa518b300ffab7736e79008bca61b8c1c868089
SSDEEP 192:VwrIwyBBWD84aT1BARN2Hca60rLtgI/6yixTvjgQA8TWWfWA:V+894hH2HRgI/63x/g4WWfWA
TLSH
T1DC421901A3D95473E3F34BB56AF5176B33B9BA385BBFA3098920051A1EB4D26D530712
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ksproxy.ax

IMPHASH 29fd22e5424a4c4f251c5cc8a8b9d534
SHA256 72afc310cf5f55408182e16824b9571c538d5f978a43e6cb4ee217caa8a8a424
MD5 8e6c3624d605770f942391b8000dd3f0
SHA1 5f9c35006344e013f354b6e00a6ec4aeafb2280d
SHA512 0452694fb1e17ede8367dfadf03c4ac4eecb2b9e09f759bf17abe41e5495b51e6935d10e5fb52942bb295eb87b2ef04eebd76201995b72167a64f9e141c06724
SSDEEP 3072:+bSMc74NUOJVDoll2flUZnYGg1Zw+W5DhfrSxKK:+bSM04N/Jpo6dUZYGEK+WvSx
TLSH
T10AB3495373F780F7C25302B29DB9B3FAA2F6D6201A2AD64657140F092F60952E73DA17
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

85926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcscpy ??3@YAXPAX@Z memmove swscanf swprintf _ftol _purecall _except_handler3 _CIpow wcslen ??2@YAPAXI@Z

kernel32

InterlockedCompareExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetLastError CreateEventW CloseHandle WaitForMultipleObjectsEx WaitForSingleObjectEx CreateThread CreateFileW ReleaseSemaphore InterlockedExchange CreateSemaphoreW InterlockedDecrement DeviceIoControl InterlockedIncrement ResetEvent GetOverlappedResult CreateMutexW ReleaseMutex GetHandleInformation GetVersionExW DisableThreadLibraryCalls FreeLibrary LoadLibraryW lstrlenW MultiByteToWideChar lstrlenA GetModuleFileNameA lstrcpynW WaitForMultipleObjects WaitForSingleObject GetSystemInfo VirtualFree VirtualAlloc GetProcAddress ResumeThread SetThreadPriority

advapi32

RegEnumKeyExW RegQueryValueExW RegCreateKeyW RegSetValueW RegSetValueExW RegCloseKey RegDeleteKeyW RegOpenKeyExW RegEnumKeyW

user32

wsprintfW

ole32

StringFromGUID2 IIDFromString CoCreateInstance CoTaskMemAlloc CoFreeUnusedLibraries CoInitialize CoTaskMemFree CoUninitialize

oleaut32

SysFreeString

setupapi

SetupDiOpenDeviceInterfaceW SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInterfaceAlias SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiOpenDeviceInterfaceRegKey SetupDiCreateDeviceInfoListExW SetupDiGetClassDevsW

ksuser

KsCreateAllocator KsCreateClock KsCreateTopologyNode KsCreatePin

ntdll

RtlNtStatusToDosError

ksreg.inf

SHA256 042347904c4abcf01e1ce4025bccb8b8b18269f0b7d86a3f21850c591817e94c
MD5 5a65d9e1d248976c5b9d17aef3ac8dc4
SHA1 47825826e88edb62e453474c9f2bb154611ed241
SHA512 456f51e18bcbe4900ebe65ff8297b3911bb9ef350d08a71fb7260af5a26df49019fbe8a30a472986787c124b541c0ec8704e0b88e7be91efb9c834a2a1e5be39
SSDEEP 384:3OEvRGpiNcJxGMDhX1erbBZjJlUVyl3ntDynwYOV8Wzzpbt3KD/uO5E1BBeyQQ:3OTGMDhX1eJZjfynwJHRGuJP0yF
TLSH
T1BDF2D11E930D8913E20C72C0F7D12DC7709A509ED0E052AE7B26DA9E685EE9A451CF7F
MD5 SHA1 SHA512 SSDEEP TLSH

ksuser.dll

IMPHASH 407f14f3ab3229ce994109fc31901c00
SHA256 1cb2339f19f58f0631a043f1debf39265d8a33170a5c06b3be576e606fd12e74
MD5 15914e0bf4dda56cf797993dccb637d1
SHA1 9c8ee02f146f3efb6fc977f0f06e7849d3b2f72a
SHA512 29e690ba9375f97f2f415549e3881bbaa62edc9d1fe682144d02afe4e6136ac28524c490934dd2e2b1830d919b8e959b025c8543b0add48c177eca9eee8c5d0e
TLSH
T1A381635553F80426F0F78F70DBF20B5BA17E7C24AA6A8E690990175B3C61A11CA31F3E
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

l3codecx.ax

IMPHASH d7e8a0cc68dc418d56e7942bed824e2d
SHA256 b5c87e6604585feff04e67f82a5a2e562f51efbf21d49841e6077790cd4ab2c7
MD5 938b396850b318cae7ffb7380091ccbe
SHA1 469403f7cb3b35ae1bc6944d874ec5cb19bcce06
SHA512 8af1f6a5ead49176590daaaa1ad7d63bcab4fd7d6cc039f191b5e85bd1082d8d32e90018017a7c38c3122e19ad03b95656f127a8a635963c360e350401acf145
SSDEEP 1536:znO7U7L8+AkxhnMOejOIOAZM2nrREegqB7v9lCDLU:DiUE+hnMOejOIOAGMrRHgqN9lULU
TLSH
T1D5836B42BAC346B1EABF65B504EB2237E738EA412514CD277B1CC5663833160ABD735E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36687

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mciqtz32.dll

IMPHASH a6a29e19932abf7e264745f7249bd231
SHA256 5fc314830f0a4f4176c8fd079f42e3b53fe72cfac9f167783fe6047cc78a5f84
MD5 d2de8daba14979d79e54e2a040403a19
SHA1 03d1cc87926d753c96fbb8e8217b6cfeb1d68a35
SHA512 6fa130cfdf74ce7201e555e26a6805b091935c017752e88300972a2e0b0152239ec854dc1965eaf407fcc68550c24e02c95ec9cb0f40d8f81eaeca40cede2cb8
SSDEEP 768:qRj+M4DK2hjcQJUBYrLaWwLwvNp792ioNx9Xu:1DRcFocwvn8DRXu
TLSH
T158F26052A7F84A77F1F30F7188762621327ABCB56A37D28F1A45025D1E727818E74B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LocalAlloc lstrlenW lstrcpynW GetProcAddress MulDiv MultiByteToWideChar lstrlenA lstrcpyW DisableThreadLibraryCalls GetModuleHandleA TerminateProcess GetCurrentProcess QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime LocalFree CreateEventW CreateThread WaitForMultipleObjects CloseHandle SetEvent ResetEvent GetModuleHandleW WaitForSingleObject

user32

ScreenToClient GetSystemMetrics SetWindowTextW SetForegroundWindow UnregisterClassW DestroyWindow WindowFromDC EndPaint BeginPaint DefWindowProcW SetWindowLongW RegisterClassW LoadCursorW GetWindowLongW PostMessageW LoadStringW InSendMessage GetWindowTextW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW GetClientRect CreateWindowExW GetWindowRect AdjustWindowRect IsWindow IsIconic IsZoomed ShowWindow IsWindowVisible SetWindowPos SendMessageW SetRectEmpty

winmm

mciFreeCommandResource GetDriverModuleHandle DefDriverProc mciGetDriverData mciLoadCommandResource mciSetDriverData mciDriverYield

ole32

CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance

gdi32

CreatePalette GetObjectType SetStretchBltMode SelectPalette RealizePalette StretchDIBits GetStockObject DeleteObject

quartz

DBToAmpFactor AmpFactorToDB

mpg2splt.ax

IMPHASH 5d049fe11c3e4153abd49378531fbbd9
SHA256 97789ac30f17945031b553a1f02f8123f600789330cb291f2f3d8eb36a9015a4
MD5 1f3286d4feb80e74fe6c362ecea23215
SHA1 b17825811c4a60f3537536705d26b864de00f330
SHA512 98b5f6bac1630952e84a4f4d2cf71f22df87468f0a199631ad9b4d20ff934a708347850c9cbff9eebde1f3afe08bccdd6be8f1329f21b253b337db1965990880
SSDEEP 3072:IHtYrlo1vrJ2qdU5FuF08311nsPWfzK7lUyKMbd7xZuxW:Iyry1vrXpFdn7LILxMx
TLSH
T1EBD38D9373D280BAC3D332734A76377AA7EBD7141A39966347613C496B2544AE23E313
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13455

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency HeapAlloc HeapReAlloc HeapFree GetProcessHeap CreateFileMappingW MapViewOfFile UnmapViewOfFile MulDiv CreateThread SetThreadPriority InterlockedExchange lstrcpyW VirtualAlloc CreateSemaphoreW lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject GetCurrentProcess TerminateProcess GetModuleHandleA GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter WaitForMultipleObjects ResetEvent SetEvent CreateEventW CloseHandle lstrcpynW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleHandleW GetVersionExW lstrlenW MultiByteToWideChar lstrlenA GetLastError GetModuleFileNameA

msvcrt

_purecall _wcsicmp ??2@YAPAXI@Z ??3@YAXPAX@Z wcslen wcscpy _except_handler3 _itow malloc free _ftol qsort memmove

user32

wsprintfW

advapi32

RegCreateKeyExW RegQueryValueExW RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW

ole32

CoTaskMemFree CoTaskMemAlloc CoInitialize CoCreateInstance StringFromGUID2 CoUninitialize CoFreeUnusedLibraries

winmm

timeBeginPeriod timeGetTime timeGetDevCaps

msdmo.dll

IMPHASH 19b6ba09daee0b1fa5b47610e9903183
SHA256 d8386ab77c4293a1c3700beb663e2298324803314ee9c8ed50c880aa795905b0
MD5 5f2a1317fab96fe887447e5fd96838b7
SHA1 b8ff2f10bac16d693187a9078cd92038b160e0ce
SHA512 bf1e8b9d52674edb57e18799502b782b0d764b13524849a31a9c5b3a9008a2c1ac9bdb363a2d81e287350c4474c5357005ed4cf0d8d0bce3b82746e3e49b714a
SSDEEP 384:Pv1uONkqOKUuun/ObWDUQ6JBj/IidxuVj1uWXjioxnLWVqG:Pv17NdY+kEJ+idxuVj1BLxuq
TLSH
T165520802B6E5121BE2E38A75A2F1132753FAE9215C31ED1AC610064F3675F53EBB8B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mskssrv.sys

IMPHASH ae7af65c91def368b78cf6daaa295831
SHA256 dd144a4befc670cc3d874cf690b8ca407d1fdab07e0e2c23d042c6d454a4d8a1
MD5 85736f804191cb420a31aca2a7f0674f
SHA1 3ff53fe75b2f227028e5849c4d02693d3be99573
SHA512 82f42f7e1ab5cba7ca795e17787c268ebdf18c68b0d89426e2e382ac9919888a5e01d5bbd309d4218f1c66f2c323572fc2400ac22e93d0ce3e4a68323b986ea7
SSDEEP 192:MojRsr0NvszGqoaSFE9NTca5rxHO1Isl5bym0WNAwWPH:MoCzGjaSFEvga5Ry5WpWNAwW
TLSH
T1E5E1CA52F7E85527F0B309F4AE97462BD2E3A8125DB0871E59501B4D29BCF04AF32B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4949

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mskssrv.pdb

Name

.text

Size

384B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

384B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mspclock.sys

IMPHASH 80ceafa87487c2a1e5e0a913df0055d1
SHA256 4730d20e07329885ac2b00d41a5fad581bff2389a25fdde375cf2ff92259a8a1
MD5 e943adb93d83c5cbc0ca3f53f53b48cc
SHA1 f7e23473cf5621ff48012697098740cc89640fba
SHA512 0a6844cad5d0c8e57248be0e374f24a18820eb841573ebb78a219a6b96df3506e0ecc4416525b83137a7ba5f3462fe47c7c193ad2b67ca4daadaf0737b8d693d
SSDEEP 96:Hd4d6Jh12+EXq2mCF5BcklFraJowayWViWwjosn:9xLMv62mevD5fyWViW8r
TLSH
T1BFB183A2B3EC6E01E4B619B08CDF2B17A2772C119D74EB0206444B7C3D2A910BD95B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mspclock.pdb

Name

.text

Size

128B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mspqm.sys

IMPHASH 379ad7346b38b027988675ecb0316f3c
SHA256 915f4d83f37872cb1222bdbb055bbff7f190b12b4acb792e0627b99e037c866f
MD5 f6a726b8832db1f88326b8be98b11981
SHA1 6a80150e52ee8b686e8511a451b0f7b07295f6a0
SHA512 16ef9296d09a4bdfeb63da11337808cb46129de4f7d8493549b173c567974c5db0d5dd62b969696c6ae7a78a8cb105a7519a25c33571305ab3e02492910d0f55
SSDEEP 96:DD+EKHekJT8h6RImfkQmy8LZWgOuZwWwU/:v+EKHTW6RImVmyUWeZwWX/
TLSH
T15991B68173DAAA57E0F69AB119EB230771377C208A319F39164C1A1C2FB7660FC15B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mspqm.pdb

mstee.sys

IMPHASH ba17250f7c9c0536bc777562ff599d7c
SHA256 d551d7df5736847caf1c7c48470035a4aabc6fb7cf7512db11c6c9c9898d83ed
MD5 d5059366b361f0e1124753447af08aa2
SHA1 aa5f775c386d70d16d97832119f3c618d6ca36b7
SHA512 ff5824332a973a355e5dbff37e48edaf854ea4bac8cb2fd9e8026f1790a49c1e21a8ea31dd47673324385bc6da5b537866ed892336711b835e76d66c84f8336a
SSDEEP 96:T/4ddiILzpAjlDG3Dp7eG8AvC7RTXsHW7RwWw:rYdiILzpAjlDG3Dp7eG8AvKYHW7RwW
TLSH
T153B19222B7E91D14F8E34A701CEB5B85A376FD215D328B1B1950175E1E36980BC34B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mstee.pdb

Name

.rdata

Size

256B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

256B

Virtual Size

190B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mswebdvd.dll

IMPHASH 92e5618f232053bc39b696e31857d9b5
SHA256 523c4b8a925bb0ad76df192d69802744a32a5134a6233acce5be4853a3460f80
MD5 0db04280a7bec2350dc6585f62ebb4db
SHA1 e68dc06f852f7aff04b078f224ec2cbdba71bcd0
SHA512 529d3efa1441d3ab3fc2b61a7b1ecd0fb68cc8b77072f5f203cf79ec92cab1c830dc8543e30654985e7ff8f564586fda6e7d5859ac5a0ba5eb7d0f6bf503245f
SSDEEP 3072:nGbDgFOO2uR9E/eorkQXqrfNRcya7z5IDLRt9ny1cUPcUfX8z3F1iC6VIIY5C5w7:GIEO2uR9E/eorNX6FRczzuvRfyxzszy
TLSH
T17264C301B3E8C626F1F71B305EBAA69A5A77FD509E36821F2284131D1D71F84EA24737
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

82087

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetProcAddress TerminateProcess FreeLibrary GetVersionExA GetUserDefaultLangID IsValidLocale GetCurrentThreadId SetEvent ResetEvent GetTickCount WideCharToMultiByte WaitForSingleObject lstrcpynW GetDriveTypeW CloseHandle lstrcpyW InterlockedDecrement GetLocaleInfoW InterlockedIncrement HeapAlloc GetProcessHeap HeapFree GetShortPathNameW LoadLibraryExW GetLastError FindResourceW LoadResource SizeofResource lstrlenA DisableThreadLibraryCalls GlobalAlloc GlobalLock GlobalUnlock GetModuleFileNameW lstrcatW HeapDestroy lstrcmpiW DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar CreateEventW EnterCriticalSection LeaveCriticalSection Sleep GetVersionExW lstrlenW GetSystemDirectoryW GetModuleHandleW LoadLibraryW GetCurrentProcess FlushInstructionCache GetModuleHandleA

msvcrt

_except_handler3 ??1type_info@@UAE@XZ ?terminate@@YAXXZ _vsnwprintf fwrite fclose _ui64tow malloc realloc ??3@YAXPAX@Z ??2@YAPAXI@Z _CxxThrowException wcslen _ftol __CxxFrameHandler free fopen _purecall

gdi32

GetClipBox GetDCOrgEx CreateMetaFileW SetWindowExtEx CloseMetaFile DeleteMetaFile CreateDCW LPtoDP SaveDC SetMapMode SetWindowOrgEx SetTextColor DeleteDC RestoreDC CreateSolidBrush SelectObject Rectangle DeleteObject GetNearestColor GetDeviceCaps GetSystemPaletteEntries CreateRectRgnIndirect SetBkColor SetViewportOrgEx

user32

GetWindowRect SetTimer CharNextW GetDC PtInRect UnionRect GetKeyState DestroyAcceleratorTable SetWindowLongW CallWindowProcW EndPaint BeginPaint IsChild GetFocus RegisterClassExW wsprintfW GetClassInfoExW SetFocus ShowWindow GetParent SystemParametersInfoW SetRect GetSystemMetrics IsIconic DefWindowProcW DrawTextW InvalidateRgn RegisterClassW GetClassInfoW PostMessageW GetWindowDC ReleaseDC KillTimer DestroyCursor DestroyWindow LoadStringW InvalidateRect ShowCursor GetCursorInfo GetWindow SetCursor GetClientRect IsWindow GetDesktopWindow MapWindowPoints ClipCursor LoadCursorW IntersectRect EqualRect CreateWindowExW IsWindowVisible GetWindowLongW SendMessageW SetWindowPos SetWindowRgn OffsetRect

advapi32

RegDeleteKeyW CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptCreateHash CryptDestroyHash CryptHashData CryptGetHashParam RegCreateKeyW RegQueryValueExW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW

ole32

ProgIDFromCLSID CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc OleRegEnumVerbs OleRegGetUserType CreateOleAdviseHolder OleSaveToStream WriteClassStm OleLoadFromStream CreateDataAdviseHolder OleRegGetMiscStatus CoTaskMemFree

oleaut32

SysAllocString SysFreeString SysAllocStringLen SysStringLen VariantClear VariantCopy VariantInit SetErrorInfo CreateErrorInfo OleTranslateColor VariantChangeTypeEx SysAllocStringByteLen LoadRegTypeLi VarUI4FromStr LoadTypeLi RegisterTypeLi VariantChangeType SysStringByteLen OleCreatePropertyFrame

comctl32

ord17

comdlg32

GetSaveFileNameW

shell32

SHGetSpecialFolderPathW

winmm

mixerSetControlDetails mixerGetLineControlsW mixerGetLineInfoW mciSendCommandW mixerGetControlDetailsW mixerGetNumDevs mixerOpen mixerClose

ddraw

DirectDrawCreate

quartz

AMGetErrorTextW

pid.dll

IMPHASH c104ac93b4854145491d5be96d5f7be7
SHA256 3b3414e5dab4a23dd5306804f2b20aae2fa44cd353e7c35df3c8922c19b094da
MD5 c5439671424e05065262a89b2d7262c8
SHA1 07d35edea49fc6bcf45f5ed7af5d608f1113d405
SHA512 b051a360a4bae7d6df6503375a7ec854c38ec7dd7fa3e6e4344457d3450070a4870d86135783ce6fcb801494b6b760cf81284ea6f57db670ae3c7f15c1440756
SSDEEP 384:9wATgCadCCf325/I4SO0Zy4qEg7pf4gDE3ogcxo2hTXRgZm6MqtqtsWuhGWqD/:tTgChC/2VSOUmf76gDQQto5MRtQ
TLSH
T158E23B20B7F989B7F2F6427019C26B6177BC59180278AD8F53E01D8B3CF0D95A62A753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

kernel32

FreeLibrary LoadLibraryW CreateThread CreateEventW GetModuleFileNameW CreateFileW WaitForSingleObject GetVersionExW GetVersion IsBadReadPtr WriteFileEx ReadFileEx FreeLibraryAndExitThread ReleaseMutex MulDiv WaitForMultipleObjects ResetEvent SetEvent WriteFile GetLastError UnmapViewOfFile DeleteCriticalSection GetModuleHandleW GetProcAddress DisableThreadLibraryCalls InitializeCriticalSection CreateMutexW CreateFileMappingW CloseHandle MapViewOfFile LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement lstrlenW lstrcpyW LocalReAlloc LocalAlloc LocalFree Sleep

advapi32

FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW BuildTrusteeWithSidW AllocateAndInitializeSid RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegCreateKeyExW

user32

MsgWaitForMultipleObjectsEx PeekMessageW TranslateMessage DispatchMessageW PostThreadMessageW wsprintfW

hid

HidP_GetLinkCollectionNodes HidP_GetUsages HidD_GetPreparsedData HidD_GetAttributes HidP_SetUsageValueArray HidP_SetUsages HidP_GetSpecificButtonCaps HidP_GetSpecificValueCaps HidP_SetUsageValue HidP_SetScaledUsageValue HidD_SetFeature HidP_GetScaledUsageValue HidD_GetFeature HidD_FreePreparsedData HidP_GetCaps HidP_InitializeReportForID

pid.xpg

IMPHASH c104ac93b4854145491d5be96d5f7be7
SHA256 77ab8f0f35c1979f0682edd320c8a89979d5312596afd4e1b9c61b92d172a9ed
MD5 23f608f9e03f9044d8ae1e07c360cf35
SHA1 9d61f30741c95af392a22a4cfcf161bc2fb7533e
SHA512 715704ee6c51566611544e9e0660e123f8dc251c6a14cb66c9becbf9c8df11f77b467fd5b471a708d9762b8b68e5bd841bbb96dd0570bbae7c95007575b47131
SSDEEP 384:KxbTgqDq1QVb520nP0GFu1AqDfxOtpW0JMlmg8C2xdrGBD6nITqtqtCUbWu5GWQD:8TgqEQVbc0cGlTjJMlQKBDnTRtCU1
TLSH
T113E24A50F7C549BAE1F636345AD2AB6137BDAE180234E88F53D01D1A3CB0E51963E7A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwind

kernel32

FreeLibrary LoadLibraryW CreateThread CreateEventW GetModuleFileNameW CreateFileW WaitForSingleObject GetVersionExW GetVersion IsBadReadPtr WriteFileEx ReadFileEx FreeLibraryAndExitThread ReleaseMutex MulDiv WaitForMultipleObjects ResetEvent SetEvent WriteFile GetLastError UnmapViewOfFile DeleteCriticalSection GetModuleHandleW GetProcAddress DisableThreadLibraryCalls InitializeCriticalSection CreateMutexW CreateFileMappingW CloseHandle MapViewOfFile LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement lstrlenW lstrcpyW LocalReAlloc LocalAlloc LocalFree Sleep

advapi32

FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW BuildTrusteeWithSidW AllocateAndInitializeSid RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegCreateKeyExW

user32

MsgWaitForMultipleObjectsEx PeekMessageW TranslateMessage DispatchMessageW PostThreadMessageW wsprintfW

hid

HidP_GetLinkCollectionNodes HidP_GetUsages HidD_GetPreparsedData HidD_GetAttributes HidP_SetUsageValueArray HidP_SetUsages HidP_GetSpecificButtonCaps HidP_GetSpecificValueCaps HidP_SetUsageValue HidP_SetScaledUsageValue HidD_SetFeature HidP_GetScaledUsageValue HidD_GetFeature HidD_FreePreparsedData HidP_GetCaps HidP_InitializeReportForID

qasf.dll

IMPHASH 34b0e65d4741d54395cac26e108e8246
SHA256 4cc448041d271b2a6f81bbcfe4a4fc6d806bb7116c592bc41293dfd20093b072
MD5 d00019595622e5bd09692e78ec659b04
SHA1 20161fcfa6b19a2a4221a28a18aa435b0c89fe59
SHA512 c9308d94cc993ff26ac7c4f57b46be24a1feb2dc6f83477f742910b195c2598fe1f94481ee4c02ea224e6dcb4e4de90529caaddde4ea69da7298f0de277d6170
SSDEEP 3072:qef8nrZvp82W6CDaU42u6KrEZdL2Z0VoYhto0HV3eKVp2RFJxen8ef8IOaQyD5Zq:qTvp8Lu6KrEZdL2KWqtrV34nJxO8
TLSH
T197046C02B3F67075E1E3523ADB7AB37BB379BB145A21D65A06144F1E2E31680E92C317
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetComputerNameA GetDiskFreeSpaceA GlobalMemoryStatus TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetLocalTime DeviceIoControl GetModuleHandleA LoadLibraryA GetVersionExA LocalAlloc LocalFree DisableThreadLibraryCalls CreateThread GetTickCount SetThreadPriority InterlockedExchange lstrcpyW GetModuleHandleW GetProcAddress VirtualAlloc CreateSemaphoreW GetCurrentThreadId GetCurrentProcess lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject ResetEvent SetEvent CreateEventW CloseHandle lstrcpynW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection LoadLibraryW InterlockedDecrement FreeLibrary GetVersionExW lstrlenW MultiByteToWideChar lstrlenA GetLastError GetModuleFileNameA InterlockedIncrement RaiseException

msvcrt

swprintf _ftol _except_handler3 _wtoi ??3@YAXPAX@Z ??2@YAPAXI@Z _purecall wcscat wcslen wcscpy

gdi32

GetTextExtentPointW

user32

wsprintfW LoadStringW GetDesktopWindow GetWindowRect DefWindowProcW DestroyWindow ShowWindow InvalidateRect MoveWindow CreateDialogParamW SetWindowLongW GetDlgItem GetDC ReleaseDC SendMessageW GetWindowLongW

advapi32

RegQueryValueExA RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW GetUserNameA RegSetValueExA RegCreateKeyExA

ole32

CoTaskMemFree CoTaskMemAlloc CoInitialize CoCreateInstance CoFreeUnusedLibraries CoUninitialize StringFromGUID2

oleaut32

SysAllocStringLen

qcap.dll

IMPHASH 5b434342bca065771fb82248c16cfe2f
SHA256 300cf546942d1677931a9a8870f5db4908d1c7c047fda678ce5d2e9bcf341c5d
MD5 ba463212059dd46754ddbb652deaa1cc
SHA1 5775c1f78e598304dc06f71b15713d65f3f880ef
SHA512 fd685dad38883940d9be616c55acaece75a4c3719e2dad20804469dcd7365e39e9c6cfe7807e8fbc6c1142a4c2e2ba8370b3c126954fec41573dc4358d7b6f38
SSDEEP 6144:rBHGyV1sKLcgkFdzHukl2LT98EUFXW1mV6/gQ:VHGU1nLcgkaX98EMW
TLSH
T172443A01A3F9C03AF1F34B755EF977A65A7AFD045A28C80F9B82278D1971A00DA25737
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetSystemTimeAsFileTime DisableThreadLibraryCalls GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcessId lstrcpyA CreateIoCompletionPort GetDiskFreeSpaceW GetTickCount QueryPerformanceCounter lstrcmpiW GetModuleHandleW GetCurrentProcess ReadFile GetFileSize DeleteFileW DeleteCriticalSection PostQueuedCompletionStatus GetQueuedCompletionStatus CreateFileW SetFilePointer WriteFile SetEndOfFile GetACP IsBadCodePtr IsBadHugeReadPtr GetFileAttributesW IsBadWritePtr HeapFree GetProcessHeap HeapAlloc GetPrivateProfileStringW IsBadReadPtr GlobalMemoryStatus GetProfileIntA GlobalAlloc GlobalLock GlobalHandle GlobalFree GlobalUnlock MulDiv CreateThread InitializeCriticalSection WaitForSingleObject GetCurrentThreadId EnterCriticalSection LeaveCriticalSection lstrlenA WideCharToMultiByte MultiByteToWideChar lstrcpyW GetFullPathNameW lstrlenW GetCurrentThread GetThreadPriority SetThreadPriority InterlockedExchange VirtualAlloc CreateSemaphoreW lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore WaitForMultipleObjects ResetEvent SetEvent CreateEventW CloseHandle lstrcpynW InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA GetLastError GetVersionExW

msvcrt

_except_handler3 wcslen _ftol ??2@YAPAXI@Z _purecall ??3@YAXPAX@Z

gdi32

GetObjectW GetPaletteEntries GetStockObject SelectObject PatBlt GetTextExtentPoint32W

user32

CheckDlgButton GetDesktopWindow IsRectEmpty SetDlgItemTextW EnableWindow GetDlgItem SetDlgItemInt ReleaseDC ClientToScreen GetClientRect GetDC IsWindowVisible IsWindow SetCursor LoadCursorW GetAsyncKeyState CheckRadioButton GetDlgItemInt SendMessageW wsprintfW GetWindowRect DefWindowProcW DestroyWindow ShowWindow InvalidateRect MoveWindow CreateDialogParamW SetWindowLongW GetWindowLongW PeekMessageW DispatchMessageW TranslateMessage LoadStringW

advapi32

RegOpenKeyW RegCreateKeyW RegSetValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegEnumKeyW

ole32

CoCreateInstance StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoInitialize CoTaskMemAlloc CoTaskMemFree

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SysAllocString SysFreeString SysStringLen VariantClear

msvfw32

ICCompress ICDecompress ICGetInfo ICOpen ICClose ICSendMessage ICLocate

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

SendDriverMessage mixerOpen mixerClose waveInStop waveInStart waveInAddBuffer waveInPrepareHeader mixerGetControlDetailsW mixerSetControlDetails mixerGetID mixerGetLineInfoW mixerGetLineControlsW waveInGetDevCapsW waveInReset waveInClose waveInOpen CloseDriver OpenDriver waveInUnprepareHeader

qdv.dll

IMPHASH 9996c03ebc30affa9b90fc9f618619d0
SHA256 68ffcb34ed26f9dbb516783d3f956c39b688ff3c51c825ae5ecb0bad3a2941e4
MD5 f0a0a5bb04bb2dc9a01db2cf6a9f65c5
SHA1 498420750cd23c94f8e2bdd738d0475cf3785294
SHA512 21b8bdbe5abd07439d01a601b8851b9c95d2a4ab85f5c110c071200991ac9150c8f2673b958e2d0ea03cac121d96c3405b053031ebfe0cb87af646a3d11142c1
SSDEEP 6144:w6xsCTokQkaUGp5F0koa+bS15tJ1KI715ta15th3lwg1IXEU8qWc2x5hPFqBFvYi:w6xsCToVKOEIU5BPN
TLSH
T1BF648D7363A5D62AD0A2447A95FF23BD29B9BF20C615988786C1357D3C706828B3335B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10669

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

??2@YAPAXI@Z _purecall _ftol _except_handler3 ??3@YAXPAX@Z

user32

GetDesktopWindow GetWindowLongW LoadStringW IsRectEmpty IsDlgButtonChecked SendDlgItemMessageW CheckRadioButton wsprintfW SetWindowLongW CreateDialogParamW MoveWindow InvalidateRect ShowWindow DestroyWindow DefWindowProcW GetWindowRect

advapi32

RegEnumKeyExW RegQueryValueExW RegCreateKeyExW RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegCloseKey RegDeleteKeyW

ole32

CoInitialize CoFreeUnusedLibraries CoUninitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoTaskMemAlloc

msvfw32

StretchDIB

winmm

timeGetTime

kernel32

GetModuleHandleW TerminateProcess GetModuleHandleA GetSystemTimeAsFileTime GetCurrentProcessId GetVersionExW DisableThreadLibraryCalls lstrlenW MultiByteToWideChar lstrlenA GetLastError GetModuleFileNameA InterlockedIncrement FreeLibrary InterlockedDecrement LoadLibraryW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection lstrcpynW CloseHandle CreateEventW SetEvent ResetEvent WaitForSingleObject ReleaseSemaphore lstrcmpW GetCurrentProcess GetCurrentThreadId CreateSemaphoreW GetProcAddress lstrcpyW InterlockedExchange SetThreadPriority GetTickCount CreateThread MulDiv QueryPerformanceCounter

qdvd.dll

IMPHASH 5636221ffff22127eabde036df3441b1
SHA256 df18a93af09a5310eea956545c58ae3722d9f3c57b68ab4dc30d06f40b2dcf83
MD5 e078a1400c7965c4dc0dee954d68b288
SHA1 5a8053649a890c729458f23d8a2f249be7de1115
SHA512 a1785f2cc2ec856e4d1c308fb09fa7272ad96cd34952571650847140e4dd6965fa7b0639c72844e7ba1668263df32b65f9ed94f9c03a30868675864c95a0c973
SSDEEP 6144:4WEgNPdQ4AZnSFiTsR4/XgXzpNVmO2pku+O3OfNe0n3Im89nH:wiQ4riAtznVmjpUIM3Im8Z
TLSH
T1BCA47D52B3FAD036E0F327349D7D67B666BBB9102638880A53451A0D3B72A01D62F777
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

46027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetVolumeInformationW SetWaitableTimer CreateWaitableTimerW SetFilePointer ReadFile FindCloseChangeNotification GetLocaleInfoA IsValidLocale FindNextFileW DeviceIoControl GetOverlappedResult TerminateProcess GetModuleHandleA GetProcAddress DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId FindFirstFileW FindClose GetDriveTypeW GetFileAttributesW GetUserDefaultLCID GetComputerNameW CreateThread GetThreadPriority SetThreadPriority InterlockedExchange lstrcmpiA VirtualAlloc CreateSemaphoreW VirtualFree GetSystemInfo ReleaseSemaphore GetModuleFileNameA GetVersionExW IsBadReadPtr IsBadWritePtr HeapFree SetLastError lstrcpynA lstrcpyA WaitForMultipleObjects ResetEvent CreateEventW lstrcmpW SetEvent Sleep GetFullPathNameW SetErrorMode LoadLibraryW MulDiv GetTickCount QueryPerformanceCounter GetModuleHandleW CreateFileW GetFileSize CreateFileMappingW LoadLibraryExW FindResourceW LoadResource SizeofResource FreeLibrary GlobalAlloc GlobalLock GlobalUnlock GetCurrentThread lstrcpynW GetModuleFileNameW lstrcatW HeapDestroy WaitForSingleObject GlobalFree CloseHandle GetLastError GetCurrentThreadId lstrlenA WideCharToMultiByte MultiByteToWideChar lstrcmpiW GetProcessHeap HeapAlloc GetCurrentProcess FlushInstructionCache InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW lstrlenW

msvcrt

malloc realloc ??2@YAPAXI@Z free _purecall _ftol qsort _except_handler3 ??3@YAXPAX@Z

gdi32

CreateCompatibleBitmap GetDIBits CreateDCA SetBkMode ExtTextOutW CreateFontIndirectW GetTextMetricsW EnumFontFamiliesExW GetSystemPaletteEntries SetBkColor SetTextColor CreateRectRgnIndirect GetDeviceCaps CreateDCW DeleteMetaFile CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileW DeleteDC SetViewportOrgEx SetMapMode LPtoDP SetPixel GetPixel GetStockObject GetObjectW CreateDIBSection DeleteObject StretchBlt BitBlt SelectObject StretchDIBits SetDIBitsToDevice GetRegionData FillRgn OffsetRgn CreateSolidBrush CombineRgn GdiFlush SetStretchBltMode CreateCompatibleDC CreateRectRgn

user32

SetDlgItemInt SetDlgItemTextW CheckRadioButton EnableWindow EnumDisplayMonitors DrawTextW ChangeDisplaySettingsExW GetSystemMetrics GetMonitorInfoW GetQueueStatus PostThreadMessageW MonitorFromWindow SetRectEmpty RegisterWindowMessageW PostMessageW ScreenToClient FillRect SetRect ClientToScreen IsWindowVisible IsRectEmpty InvalidateRect IsWindow DestroyWindow ShowWindow SetFocus LoadStringW CheckDlgButton PtInRect CharNextW GetWindowLongW CallWindowProcW PeekMessageW DispatchMessageW TranslateMessage MsgWaitForMultipleObjects SetWindowPos SetWindowRgn OffsetRect EqualRect IntersectRect EndPaint GetClientRect BeginPaint ReleaseDC GetDC GetDlgItem SendMessageW MapWindowPoints GetWindowRect GetParent SetWindowLongW GetDlgItemInt CreateDialogParamW IsDlgButtonChecked KillTimer SetTimer GetWindowThreadProcessId UnregisterClassW SendMessageTimeoutW RegisterClassW GetClassInfoW wvsprintfW GetDesktopWindow MoveWindow UnionRect RegisterClassExW wsprintfW LoadCursorW GetClassInfoExW CreateWindowExW DefWindowProcW IsIconic

advapi32

RegDeleteKeyW RegQueryInfoKeyW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegDeleteValueW RegCreateKeyW RegSetValueW GetUserNameW RegOpenKeyW

ole32

CoCreateInstance WriteClassStm CreateOleAdviseHolder OleLoadFromStream CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateDataAdviseHolder StringFromCLSID IIDFromString StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoInitialize OleSaveToStream

oleaut32

GetActiveObject VarI4FromStr SetErrorInfo LoadRegTypeLi VariantChangeType SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear VariantInit SysFreeString

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeEndPeriod timeBeginPeriod timeSetEvent timeKillEvent timeGetTime

qedit.dll

IMPHASH dc535e1caa50b23b0200f8cc949d7f8b
SHA256 f9960a3175589339793b3873d3a6d7970cc981ad6a6b0393a3b902a3b47dd686
MD5 13b80167ea34ecab3a0a6c80459a59ad
SHA1 6b1f4e7a3ae11e5dd878cba3f63605dbf7edcaf2
SHA512 2d473fd7f98bb47fd2405da12eff88517a272d82eb895588c980ec073e379476401e87eeae6a61e5e80e90136644b0d476347a6a66ab16fa6acb36576822a688
SSDEEP 12288:WWikFauLgL2ChPJN5+Xrq5qtq1CdBBBBBBBBBBBBBBBBSoJN:VimJX0b5arq5qtqPoJ
TLSH
T18F851A52F3C6C5A3C05E02304C7B6BD62F71B9015E26AB1B7B09578E2EB23D5B6057E2
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

53496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW LocalAlloc LoadLibraryA RaiseException TerminateProcess GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter MulDiv LockResource GetModuleFileNameA GetModuleHandleW CreateFileW GetFileSize GetFileType GetFileTime GetSystemDirectoryW DeleteFileW GetFullPathNameW WriteFile lstrcpynA GlobalFree SetFilePointer ReadFile Sleep CompareStringW CreateThread GetThreadPriority SetThreadPriority InterlockedExchange VirtualAlloc CreateSemaphoreW lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore WaitForMultipleObjects ResetEvent SetEvent LoadLibraryW GetVersionExW LoadLibraryExW FindResourceW LoadResource SizeofResource FreeLibrary CreateMutexW DisableThreadLibraryCalls CreateEventW GlobalAlloc GlobalLock GlobalUnlock GetCurrentThread lstrcpynW ReleaseMutex GetModuleFileNameW lstrcatW HeapDestroy WaitForSingleObject CloseHandle GetLastError GetCurrentThreadId lstrlenA WideCharToMultiByte MultiByteToWideChar lstrcmpiW HeapAlloc GetProcessHeap HeapFree GetCurrentProcess FlushInstructionCache IsBadCodePtr IsBadWritePtr IsBadReadPtr InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW lstrlenW

msvcrt

free _purecall ??3@YAXPAX@Z malloc realloc ??2@YAPAXI@Z wcspbrk wcstoul wcsncmp wcscat srand rand _vsnwprintf _wsplitpath wcscmp sprintf _iob fprintf exit fread _setjmp3 wcscpy atof _ftol wcslen longjmp fclose _wfopen _wtoi

gdi32

DeleteObject CreateCompatibleDC SetStretchBltMode StretchBlt CreateDIBSection GetObjectW CreateFontIndirectW SelectObject GetTextMetricsW GetTextExtentPointW DeleteDC GetDeviceCaps

user32

LoadStringW EndDialog DefWindowProcW GetWindowTextLengthW GetWindowTextW GetDesktopWindow CharNextW wsprintfW GetWindowLongW PeekMessageW DispatchMessageW ShowWindow MsgWaitForMultipleObjects SetWindowPos ReleaseDC GetDC GetDlgItem DestroyWindow IsWindow InvalidateRect MoveWindow WinHelpW IsDialogMessageW CreateDialogParamW GetDialogBaseUnits wvsprintfW PostThreadMessageW RegisterWindowMessageW GetQueueStatus MessageBoxW GetDlgItemTextA SetDlgItemTextW SetDlgItemInt GetDlgItemInt CheckRadioButton IsDlgButtonChecked IsRectEmpty CharPrevW GetWindowRect SetWindowLongW

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegQueryValueExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegSetValueW RegCreateKeyW RegQueryValueW RegOpenKeyW RegEnumValueW

ole32

CreateBindCtx StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc OleLoadFromStream CreateStreamOnHGlobal StringFromCLSID CoUninitialize CoFreeUnusedLibraries CoInitialize CLSIDFromString StgCreateDocfile CoCreateFreeThreadedMarshaler StgOpenStorage CoCreateInstance

oleaut32

VariantChangeTypeEx VarI4FromStr LoadTypeLi RegisterTypeLi SetErrorInfo LoadRegTypeLi SysAllocString VariantCopy VariantClear VariantInit SysAllocStringLen SysFreeString

msvfw32

DrawDibOpen DrawDibDraw DrawDibClose

winmm

timeEndPeriod timeSetEvent timeGetTime timeBeginPeriod timeKillEvent

comdlg32

GetOpenFileNameW

qedwipes.dll

SHA256 949e4d6697ce7f4101682affdfa915ef32908a170417aae657b6da5da2e39a11
MD5 15329f765ae3559fbc62ef241b71fdab
SHA1 cecafa46ebb3b7830cec3775c68882da28fb0a11
SHA512 fd2bb614d007edabc7074fc289764cf7536f297c81ff11409df7b55acd5dca6a55c0f8520a07f01ac2a296e5aa9b0027c70708210f206fbb892534a306d63918
SSDEEP 12288:2HHhsO4j/aBz5ge6BbeZ2gnzM6MNCTs17pfST8iypSovFLBs5nrSi/7F:2HH6GzaD5Fi5rSi/7F
TLSH
T18EF4CF0FAF725C56CCE8433006A93275D7189A76AFEFD68C7469AB3E5C1044B947A02E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

quartz.dll

IMPHASH ad5ba4fab893c1bbbbb3ec299e041eb7
SHA256 a378764866d8dd280e63dda4e62c5b10626cf46a230768fb24c3c3d5f7263b87
MD5 6b6e934bee7aa98a5eed62c6c8506612
SHA1 23007bee25fc8bca6f1f1fc1307fadd9724a535a
SHA512 22c919540af04de4e5944a9d10bc997ab507b0d64c683d942e8e376962fd298a7c559d3c8a45bc844b4d0aaf506929842952af589cbc481f1f9e08f85b4417d4
SSDEEP 24576:TZrLvyvWJhmrnDRi847M8KwW2HQkf8zFpNkISLtYO:NrTwWDontib4WWvy5p
TLSH
T1E595E60227FA8166F1F37B3569B953A25E7A7D91A939C60D1380665E2DB1E40CE30F33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

349357

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProfileIntW MulDiv GetShortPathNameA GetACP lstrcmpiA CreateFileMappingW MapViewOfFile UnmapViewOfFile GetProfileStringA GetExitCodeProcess lstrcpyA GetFullPathNameW WriteFile QueryPerformanceFrequency ReleaseMutex CreateMutexW HeapDestroy WideCharToMultiByte FreeLibraryAndExitThread Sleep GetPrivateProfileStringA lstrcatW SetFilePointer ReadFile FormatMessageA FormatMessageW CreateThread GetCurrentThread GetThreadPriority SetThreadPriority InterlockedExchange lstrcpyW LoadLibraryW GetLastError lstrlenA GetModuleHandleW GetModuleFileNameW GetVersionExW VirtualAlloc CreateSemaphoreW lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects ResetEvent SetEvent CreateEventW CloseHandle InterlockedDecrement InterlockedIncrement lstrlenW lstrcpynW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection DelayLoadFailureHook MapViewOfFileEx GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalAlloc LocalAlloc LocalFree RaiseException HeapAlloc GetProcessHeap HeapFree WriteProfileStringW SetErrorMode GetDriveTypeW GetFileSize LocalUnlock LocalLock LocalReAlloc CompareStringA lstrcmpA lstrcpynA IsBadWritePtr IsBadReadPtr GetDiskFreeSpaceW CreateFileW DeviceIoControl GetCurrentProcess TerminateProcess GetModuleHandleA DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter LoadLibraryA InterlockedCompareExchange FreeLibrary GetProcAddress GetModuleFileNameA MultiByteToWideChar OpenProcess lstrcmpiW

msvcrt

??3@YAXPAX@Z _ltow towupper atoi memmove ??2@YAPAXI@Z getenv sscanf _except_handler3 sprintf wcscpy _strdup _wtoi wcslen _ftol free _initterm _adjust_fdiv malloc _onexit __dllonexit

gdi32

CreateCompatibleDC CreateDCA GetClipBox GdiFlush SetPixel GetPixel ExtTextOutW SetBkColor SelectPalette FillRgn CombineRgn CreateRectRgnIndirect CreatePalette GetStockObject GetTextExtentPoint32W SetTextColor SetBkMode BitBlt CreateDIBSection StretchBlt SetStretchBltMode CreateDCW GetObjectW StretchDIBits SetDIBitsToDevice EnumFontFamiliesExW SetTextCharacterExtra SetDIBColorTable GetDeviceCaps DeleteObject GetDCOrgEx EqualRgn ExtCreateRegion CreateRectRgn CreateFontIndirectW GetSystemPaletteEntries GetDIBits PatBlt CreateSolidBrush SelectObject DeleteDC RealizePalette CreateCompatibleBitmap

user32

SetTimer SendMessageW GetWindowThreadProcessId LoadStringW GetDC ReleaseDC GetMessageW TranslateMessage PostMessageW KillTimer IsWindow ReplyMessage GetMonitorInfoW MonitorFromWindow wsprintfA SetRect EqualRect GetSystemMetrics IsWindowVisible IsRectEmpty SendDlgItemMessageW EndDialog DialogBoxParamW GetDlgItem MessageBoxW SystemParametersInfoW GetDlgItemInt EnableWindow GetWindowRect UnhookWindowsHookEx InvalidateRect SetWindowsHookExW EnumDisplayDevicesW EnumDisplayMonitors ClientToScreen GetClientRect SetRectEmpty MapWindowPoints ScreenToClient IntersectRect ChangeDisplaySettingsExA MonitorFromRect GetWindowPlacement IsIconic GetParent GetWindowLongW CharNextW DispatchMessageW GetQueueStatus RegisterWindowMessageW SetWindowLongW PostThreadMessageW wvsprintfW MsgWaitForMultipleObjects PeekMessageW wsprintfW AdjustWindowRectEx DefWindowProcW CreateWindowExW RegisterClassW LoadCursorW GetClassInfoW IsZoomed SetParent SetDlgItemTextW CreateDialogParamW DestroyWindow InSendMessage FillRect OffsetRect ChangeDisplaySettingsExW GetWindowTextW SetWindowTextW MoveWindow SetForegroundWindow ShowWindow GetForegroundWindow SetWindowPos UpdateWindow GetKeyboardState SetKeyboardState LoadImageW DestroyCursor SetCursor BeginPaint EndPaint GetDesktopWindow

advapi32

RegCreateKeyExW RegQueryInfoKeyW RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegCloseKey RegQueryValueW RegFlushKey

ole32

CLSIDFromString CreateBindCtx CoCreateFreeThreadedMarshaler MkParseDisplayName CreateStreamOnHGlobal StringFromCLSID StgOpenStorage StgIsStorageFile IIDFromString CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoTaskMemAlloc CoInitialize CoFreeUnusedLibraries CoUninitialize CoCreateInstance

oleaut32

SysAllocStringLen SysStringLen SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData VariantClear VARIANT_UserSize VARIANT_UserMarshal VARIANT_UserUnmarshal VARIANT_UserFree SysFreeString SysAllocString LoadTypeLi RegisterTypeLi VariantCopy VariantChangeType LoadRegTypeLi SetErrorInfo SysReAllocString VariantInit

winmm

waveOutGetVolume waveOutSetVolume waveOutWrite waveOutUnprepareHeader waveOutRestart waveOutReset waveOutPrepareHeader waveOutPause waveOutOpen waveOutGetPosition waveOutGetErrorTextW waveOutGetDevCapsW waveOutClose waveOutGetNumDevs midiOutReset midiStreamOpen midiStreamProperty midiOutGetNumDevs mixerGetNumDevs mixerGetLineInfoW mixerGetDevCapsW mixerGetLineControlsW mixerSetControlDetails mixerGetControlDetailsW midiStreamOut midiOutUnprepareHeader midiStreamRestart midiOutPrepareHeader midiStreamPause midiStreamPosition midiOutGetErrorTextW midiStreamClose timeKillEvent timeGetDevCaps timeBeginPeriod timeEndPeriod timeSetEvent timeGetTime

rpcrt4

NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer_Release NdrCStdStubBuffer2_Release NdrDllRegisterProxy NdrDllUnregisterProxy NdrStubCall2 NdrStubForwardingFunction CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke CStdStubBuffer_Disconnect CStdStubBuffer_Connect CStdStubBuffer_AddRef CStdStubBuffer_QueryInterface IUnknown_Release_Proxy IUnknown_QueryInterface_Proxy NdrOleFree NdrOleAllocate NdrClientCall2 IUnknown_AddRef_Proxy

quartz.w2k

IMPHASH ad5ba4fab893c1bbbbb3ec299e041eb7
SHA256 a378764866d8dd280e63dda4e62c5b10626cf46a230768fb24c3c3d5f7263b87
MD5 6b6e934bee7aa98a5eed62c6c8506612
SHA1 23007bee25fc8bca6f1f1fc1307fadd9724a535a
SHA512 22c919540af04de4e5944a9d10bc997ab507b0d64c683d942e8e376962fd298a7c559d3c8a45bc844b4d0aaf506929842952af589cbc481f1f9e08f85b4417d4
SSDEEP 24576:TZrLvyvWJhmrnDRi847M8KwW2HQkf8zFpNkISLtYO:NrTwWDontib4WWvy5p
TLSH
T1E595E60227FA8166F1F37B3569B953A25E7A7D91A939C60D1380665E2DB1E40CE30F33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

349357

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProfileIntW MulDiv GetShortPathNameA GetACP lstrcmpiA CreateFileMappingW MapViewOfFile UnmapViewOfFile GetProfileStringA GetExitCodeProcess lstrcpyA GetFullPathNameW WriteFile QueryPerformanceFrequency ReleaseMutex CreateMutexW HeapDestroy WideCharToMultiByte FreeLibraryAndExitThread Sleep GetPrivateProfileStringA lstrcatW SetFilePointer ReadFile FormatMessageA FormatMessageW CreateThread GetCurrentThread GetThreadPriority SetThreadPriority InterlockedExchange lstrcpyW LoadLibraryW GetLastError lstrlenA GetModuleHandleW GetModuleFileNameW GetVersionExW VirtualAlloc CreateSemaphoreW lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects ResetEvent SetEvent CreateEventW CloseHandle InterlockedDecrement InterlockedIncrement lstrlenW lstrcpynW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection DelayLoadFailureHook MapViewOfFileEx GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalAlloc LocalAlloc LocalFree RaiseException HeapAlloc GetProcessHeap HeapFree WriteProfileStringW SetErrorMode GetDriveTypeW GetFileSize LocalUnlock LocalLock LocalReAlloc CompareStringA lstrcmpA lstrcpynA IsBadWritePtr IsBadReadPtr GetDiskFreeSpaceW CreateFileW DeviceIoControl GetCurrentProcess TerminateProcess GetModuleHandleA DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter LoadLibraryA InterlockedCompareExchange FreeLibrary GetProcAddress GetModuleFileNameA MultiByteToWideChar OpenProcess lstrcmpiW

msvcrt

??3@YAXPAX@Z _ltow towupper atoi memmove ??2@YAPAXI@Z getenv sscanf _except_handler3 sprintf wcscpy _strdup _wtoi wcslen _ftol free _initterm _adjust_fdiv malloc _onexit __dllonexit

gdi32

CreateCompatibleDC CreateDCA GetClipBox GdiFlush SetPixel GetPixel ExtTextOutW SetBkColor SelectPalette FillRgn CombineRgn CreateRectRgnIndirect CreatePalette GetStockObject GetTextExtentPoint32W SetTextColor SetBkMode BitBlt CreateDIBSection StretchBlt SetStretchBltMode CreateDCW GetObjectW StretchDIBits SetDIBitsToDevice EnumFontFamiliesExW SetTextCharacterExtra SetDIBColorTable GetDeviceCaps DeleteObject GetDCOrgEx EqualRgn ExtCreateRegion CreateRectRgn CreateFontIndirectW GetSystemPaletteEntries GetDIBits PatBlt CreateSolidBrush SelectObject DeleteDC RealizePalette CreateCompatibleBitmap

user32

SetTimer SendMessageW GetWindowThreadProcessId LoadStringW GetDC ReleaseDC GetMessageW TranslateMessage PostMessageW KillTimer IsWindow ReplyMessage GetMonitorInfoW MonitorFromWindow wsprintfA SetRect EqualRect GetSystemMetrics IsWindowVisible IsRectEmpty SendDlgItemMessageW EndDialog DialogBoxParamW GetDlgItem MessageBoxW SystemParametersInfoW GetDlgItemInt EnableWindow GetWindowRect UnhookWindowsHookEx InvalidateRect SetWindowsHookExW EnumDisplayDevicesW EnumDisplayMonitors ClientToScreen GetClientRect SetRectEmpty MapWindowPoints ScreenToClient IntersectRect ChangeDisplaySettingsExA MonitorFromRect GetWindowPlacement IsIconic GetParent GetWindowLongW CharNextW DispatchMessageW GetQueueStatus RegisterWindowMessageW SetWindowLongW PostThreadMessageW wvsprintfW MsgWaitForMultipleObjects PeekMessageW wsprintfW AdjustWindowRectEx DefWindowProcW CreateWindowExW RegisterClassW LoadCursorW GetClassInfoW IsZoomed SetParent SetDlgItemTextW CreateDialogParamW DestroyWindow InSendMessage FillRect OffsetRect ChangeDisplaySettingsExW GetWindowTextW SetWindowTextW MoveWindow SetForegroundWindow ShowWindow GetForegroundWindow SetWindowPos UpdateWindow GetKeyboardState SetKeyboardState LoadImageW DestroyCursor SetCursor BeginPaint EndPaint GetDesktopWindow

advapi32

RegCreateKeyExW RegQueryInfoKeyW RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegCloseKey RegQueryValueW RegFlushKey

ole32

CLSIDFromString CreateBindCtx CoCreateFreeThreadedMarshaler MkParseDisplayName CreateStreamOnHGlobal StringFromCLSID StgOpenStorage StgIsStorageFile IIDFromString CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoTaskMemAlloc CoInitialize CoFreeUnusedLibraries CoUninitialize CoCreateInstance

oleaut32

SysAllocStringLen SysStringLen SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData VariantClear VARIANT_UserSize VARIANT_UserMarshal VARIANT_UserUnmarshal VARIANT_UserFree SysFreeString SysAllocString LoadTypeLi RegisterTypeLi VariantCopy VariantChangeType LoadRegTypeLi SetErrorInfo SysReAllocString VariantInit

winmm

waveOutGetVolume waveOutSetVolume waveOutWrite waveOutUnprepareHeader waveOutRestart waveOutReset waveOutPrepareHeader waveOutPause waveOutOpen waveOutGetPosition waveOutGetErrorTextW waveOutGetDevCapsW waveOutClose waveOutGetNumDevs midiOutReset midiStreamOpen midiStreamProperty midiOutGetNumDevs mixerGetNumDevs mixerGetLineInfoW mixerGetDevCapsW mixerGetLineControlsW mixerSetControlDetails mixerGetControlDetailsW midiStreamOut midiOutUnprepareHeader midiStreamRestart midiOutPrepareHeader midiStreamPause midiStreamPosition midiOutGetErrorTextW midiStreamClose timeKillEvent timeGetDevCaps timeBeginPeriod timeEndPeriod timeSetEvent timeGetTime

rpcrt4

NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer_Release NdrCStdStubBuffer2_Release NdrDllRegisterProxy NdrDllUnregisterProxy NdrStubCall2 NdrStubForwardingFunction CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke CStdStubBuffer_Disconnect CStdStubBuffer_Connect CStdStubBuffer_AddRef CStdStubBuffer_QueryInterface IUnknown_Release_Proxy IUnknown_QueryInterface_Proxy NdrOleFree NdrOleAllocate NdrClientCall2 IUnknown_AddRef_Proxy

stream.sys

IMPHASH 175996a21e8bff8704f68bfef83adfb6
SHA256 323e279cd44c5930453c3715bf238f5d1ba3acabd19491d759dd3031e55e09ba
MD5 d5ecbe98cceda4507fa9168e8d932088
SHA1 2aba7cf7cfce349bf55f75a6bac20448d682a0d9
SHA512 d497a40e6ac5160f850566a05c26aa7ab41d5c561929c150c0fc80b8b68e2d9f04fd1a4db6bc765047725f1eb2147f932b5d844b49f48babd355d6e62ee7def6
SSDEEP 768:K5Wdw0ZIzUoSxME1qF85bAMgwsN+nf3rNzdz1r8b9Cx6IpK6WC:NdzZIIFxfYe51vZ3rNl1rIIpGC
TLSH
T142237DD1B6D114B2D5D30FF09A2A272BB33B7F075229D2B703205D656B2AE41BD29273
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

39173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

stream.pdb

ntoskrnl.exe

MmMapLockedPagesSpecifyCache KefAcquireSpinLockAtDpcLevel IoFreeMdl ExAllocatePoolWithTag IoAllocateMdl IoWriteErrorLogEntry IoAllocateErrorLogEntry KeSetEvent InterlockedDecrement IoFreeIrp IofCompleteRequest IoCancelIrp ZwQueryValueKey RtlInitUnicodeString KeWaitForSingleObject ExFreePool IoBuildSynchronousFsdRequest KeInitializeEvent MmResetDriverPaging KeSetTimer KeCancelTimer ExQueueWorkItem PoRequestPowerIrp InterlockedIncrement PoCallDriver MmMapIoSpace ZwClose RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString sprintf IoOpenDeviceRegistryKey IoAllocateIrp MmBuildMdlForNonPagedPool InterlockedExchange IofCallDriver MmPageEntireDriver IoGetDriverObjectExtension IoBuildDeviceIoControlRequest KeResetEvent PoStartNextPowerIrp ZwSetValueKey IoOpenDeviceInterfaceRegistryKey IoSetDeviceInterfaceState IoRegisterDeviceInterface IoStopTimer MmUnmapIoSpace IoDisconnectInterrupt wcscpy wcslen IoCreateDevice ObfReferenceObject ZwEnumerateKey ZwOpenKey _snwprintf swprintf IoGetDeviceProperty RtlIntegerToUnicodeString IoStartTimer IoConnectInterrupt KeSynchronizeExecution IoGetDmaAdapter KeInitializeTimer KeInitializeDpc KeInitializeSpinLock IoDetachDevice IoDeleteDevice IoInitializeTimer IoAttachDeviceToDeviceStack IoAllocateDriverObjectExtension DbgBreakPoint IoGetDeviceInterfaces KeDelayExecutionThread ObfDereferenceObject ProbeForRead KeInsertQueueDpc IoReleaseCancelSpinLock memmove ObReferenceObjectByHandle IoFileObjectType ExGetPreviousMode IoGetRelatedDeviceObject KeTickCount KeBugCheckEx KefReleaseSpinLockFromDpcLevel RtlUnwind

hal

KfLowerIrql KeQueryPerformanceCounter KfRaiseIrql KfAcquireSpinLock KfReleaseSpinLock

ks.sys

KsUnserializeObjectPropertiesFromRegistry KsDiscardEvent KsAllocateExtraData KsProbeStreamIrp KsFreeObjectHeader KsAllocateObjectHeader KsUnregisterWorker KsRegisterWorker KsDispatchIrp KsAddIrpToCancelableQueue KsRemoveIrpFromCancelableQueue KsFreeDeviceHeader KsAllocateDeviceHeader KsNullDriverUnload KsGenerateEventList KsGenerateEvent KsCacheMedium KsDispatchFastReadFailure KsDispatchFastIoDeviceControlFailure KsDispatchInvalidDeviceRequest KsPropertyHandler KsEnableEvent KsDisableEvent KsMethodHandler KsPinPropertyHandler KsCreateDefaultAllocator KsSynchronousIoControlDevice KsTopologyPropertyHandler KsStreamIo KsQueueWorkItem KsSetTargetDeviceObject KsFreeEventList KsValidateClockCreateRequest KsValidateConnectRequest KsPinDataIntersection

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.edata

Size

896B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

swenum.sys

IMPHASH 2b29cc5a8e62f78b659fb1c44e574507
SHA256 97582cf8f5065b1408343ff996cdd6b7df63c7de0fee7fd468ef12eb2138a351
MD5 616a013d3ea068b6dee83d905e92ee9f
SHA1 c7a7c7e6dbd9e2a948713f2d40fecff5b2696117
SHA512 578533684c01cfb531c0e4abe7101650907c9a4bcf302ae43f476855eff92f5af6b2cdde48321bc31e41a853970d664beb59d62be53f67aa0df9457d707a1b46
TLSH
T16381981183F81D7AF5BB1B312CE35A232277F8109C72CA1D2634478F1C59E40B955B23
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

2253

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

swenum.pdb

Name

.text

Size

384B

Virtual Size

298B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256B

Virtual Size

198B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

640B

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

640B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

128B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

DirectX9/dxsetup.exe

IMPHASH 771d815b9638cdc29fedafed6d81c3a6
SHA256 67c521b646c74f01ccae7e730cde027326908ddc7d26ace045451a68a6567d31
MD5 50ca7683aca3e726583aa99f1621decc
SHA1 7234cb81e06e72ea9c4160cf70caca19ec163aca
SHA512 7a7a1214469d4a1806f94a6fe9786bb0c2de83336961e5e5f24b6dfbb7e0612ef11a42b820ee419d2aa54fdb460ffd3daeddf091fefe53055265f51aa776a4bc
SSDEEP 3072:W2N/LzV2ocdHDDvziN0YngAqJdOC9SN2LhaM87fICs532mNot4c383fMkII4RKov:WNoOWLgAHwUMXR84CD
TLSH
T14BA4D72167F99225F4F36B386AB913964E3ABE90DD34DA5E5310319E4931E40DEB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemDirectoryA GetModuleHandleA CreateThread QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess lstrcatA CreateMutexA SetErrorMode GetModuleFileNameA GetCurrentDirectoryA GetCurrentProcess CreateFileA GetFileSize ReadFile CloseHandle lstrlenA lstrcpyA FindFirstFileA FindClose GetLastError lstrcmpiA GetVersionExA LoadLibraryA GetProcAddress GetProcessHeap SetEndOfFile RtlUnwind GetLocaleInfoA GetStringTypeW GetStringTypeA SetFilePointer FlushFileBuffers SetStdHandle HeapReAlloc InitializeCriticalSection GetCPInfo GetOEMCP GetACP LCMapStringW MultiByteToWideChar LCMapStringA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect Sleep HeapAlloc LeaveCriticalSection FreeLibrary GetWindowsDirectoryA OutputDebugStringA lstrcpynA GetCommandLineA GetStartupInfoA GetLocalTime ExitProcess WriteFile GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsFree SetLastError TlsSetValue TlsGetValue TlsAlloc HeapDestroy HeapCreate VirtualFree HeapFree EnterCriticalSection

advapi32

RegCloseKey OpenProcessToken LookupPrivilegeValueA RegDeleteValueA RegSetValueExA RegCreateKeyExA RegOpenKeyExA AdjustTokenPrivileges

gdi32

GetDeviceCaps CreateFontIndirectA SelectObject CreateCompatibleDC DeleteDC StretchBlt GetObjectA DeleteObject

user32

MessageBoxA LoadStringA LoadImageA wsprintfA SystemParametersInfoA SetWindowTextA SendDlgItemMessageA GetWindowLongA PostMessageA GetParent SetDlgItemTextA SendMessageA ShowWindow GetDlgItem SetWindowLongA GetAsyncKeyState ExitWindowsEx EnumWindows GetWindowTextA GetClassNameA SetForegroundWindow SetFocus GetDC ReleaseDC

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

comctl32

CreatePropertySheetPageA PropertySheetA ord17

DirectX9/mdxredist.msi

SHA256 896805fa53c890615d12c6476af8baf4ee95088a6c3f63b61adf6fbd8cbb50be
MD5 ff9252312b1a32ee095060878d9e67e8
SHA1 c5c21bb7612c7a9838ebda81c896fe5e4b2993cf
SHA512 5799afc9a2b99e52b20abda13743f6f43454db9cb2658c4b09e4d1c9490be67d00754f48b1b862ba7a70f972310df9f72ee482beba6efbd77d18fd710491c028
SSDEEP 24576:haJqkP0NJeAgOT+tpt+BmR8hz60B4SshrqrOfeoLTXL2Z9HLzebxUSo:haJqkP06A9Es60eSshCOfZjLm1ubeV
TLSH
T18B3523D6FDD10B27C4C3F93C05A3277823BA1C52AB9A901B115AB790387DAF560BB9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned MSI

Checks for missing Authenticode signature.

Help/Game Help.pdf

SHA256 fae35f5ef47b1f8ee03338cb55b2c78e42e0b7d667393461e5695e84f77fcd14
MD5 5356fef2f4e47da0f33f7329a4137563
SHA1 3edcdc9d92422647a0a1e7dc8969c6cb572900e4
SHA512 ae4eac934a8129124712f2454707b46bcd275e65087554413d69b85fd2502a87f685a0667411929a4b77672cc81ccb1f3aeb7d7542a7d2e5d5d2c24cdeba9544
SSDEEP 24576:RnJ+/apmtNPlx7z4Ko80PFgXyOkNf+AHICMkvgLZQ+:HFCpUKo6i5Nms5gLZL
TLSH
T13325F114968EAD5EE6E143B45A1BFF8CB24DBD35E2D316C2323CF71633716A6880614B
MD5 SHA1 SHA512 SSDEEP TLSH

Setup.bmp

SHA256 a1726c6a8e41d33456ac97844ecc2ff7b891629f6f313838b18665a4c3dd643e
MD5 d0d895ca5c4e2660e1f0a4c35fd4409c
SHA1 0f940a279853e4057d26be9bbab86b377d735018
SHA512 383cb90f0d98827f18117d53162058967fa812c1636932e402fc70b5f653ae9a25095608e75db1fe8421dc4d791c7b21a490b98ace93e3e4438174f1401d3563
SSDEEP 6144:1GAniiJE5YgoQbNE35GvUO0PDdzeGCgPkYU49djerm8:MUiii55bMjO0PDZeGCR69term8
TLSH
T13B647D06C1F47AA482C5B3E6001AB7B9AE74128B4B86250CDC7E1FC1469BFC976157BF
MD5 SHA1 SHA512 SSDEEP TLSH

Setup.exe

IMPHASH b4e0151a222ad217806d8344bc933b60
SHA256 fe95a9fc8b2cdb5add76fbd326b1a11801eaa43c7d908f20cbdf413fd4d8dfde
MD5 fb6674a519505cc93e28cf600bbc23a3
SHA1 d5dbd3dabc4872710d5bdabfb3829f976efe92c6
SHA512 fd4e93d545a704bbc197bcbfd1731c24fffff7aa05db11ed4ad9bcac458253b8fb368d13e48df3d3d322044f4d4cc9e134c24cc7bee4079110f591623e988912
SSDEEP 3072:SMssQNxJUJTp2E+qvFuIoF1PYUGQQEKGLY+q+XrNJd2/GP+oh:9QOpkpNJ
TLSH
T1B4F3FC116BFA8625FAF36F71FCB816910A7BBD56AE38C60E1300555D1C70A94DAB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9397

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA VerInstallFileA

kernel32

CloseHandle Sleep lstrlenW DeleteFileA GetAtomNameA RemoveDirectoryA SetEvent OpenEventA AddAtomA HeapDestroy GetModuleHandleA GetStartupInfoA HeapCreate ExitProcess GetCommandLineA HeapAlloc CompareStringA HeapFree LockResource LoadResource CompareStringW GetVersionExA SetErrorMode LocalFree FormatMessageA InterlockedDecrement CreateProcessA CreateFileA CopyFileA GetTempFileNameA GetTempPathA WaitForSingleObject SetFileAttributesA ReadFile GetShortPathNameA GetPrivateProfileStringA GetFileAttributesA CreateDirectoryA GlobalLock GlobalAlloc MultiByteToWideChar GetModuleFileNameA RtlUnwind WideCharToMultiByte lstrlenA GlobalUnlock GlobalFree GetLastError SetLastError lstrcpyA lstrcatA GetUserDefaultLangID GetPrivateProfileIntA FindResourceA FindResourceExA GetWindowsDirectoryA

user32

TranslateMessage PeekMessageA GetWindowLongA EndDialog GetDlgItem SendMessageA SetWindowLongA DispatchMessageA IsDialogMessageA CreateDialogIndirectParamA SetDlgItemTextA GetDesktopWindow GetClientRect GetWindowRect MoveWindow CharNextA CharUpperA CharLowerA ReleaseDC LoadImageA GetDC EndPaint CreateDialogParamA BeginPaint DialogBoxIndirectParamA MessageBoxA DestroyWindow wsprintfA

gdi32

DeleteDC SelectObject RealizePalette SelectPalette UnrealizeObject CreateCompatibleDC GetObjectA GetDeviceCaps CreateHalftonePalette CreatePalette GetSystemPaletteEntries GetDIBColorTable BitBlt

advapi32

RegCreateKeyA RegCloseKey RegOpenKeyExA RegSetValueExA RegOpenKeyA RegQueryValueExA

ole32

CoCreateInstance CoFreeAllLibraries CoInitialize CoUninitialize

oleaut32

SysAllocStringLen SysStringLen SysFreeString SafeArrayGetLBound VariantClear SafeArrayGetElement SysAllocString SafeArrayGetUBound

Setup.ini

SHA256 3235d470ba917034730ee1fc861fbf677c90464e0b87ed8ad2e9a469fe72ab4d
MD5 a5aaaec79fb8b931897bab01e62d8200
SHA1 07744018f038b8cde4cb76d307f8348d383e95c7
SHA512 2ac89f2dd177e8d3913e33addea66a2600df670020be78b38d3abe7c623d1387e996d6c869d54e3cf7c623e196fae5b4ca33a8dcf22ca04b9e5d7cf125dccc82
TLSH
T111C09B76A665A78155D9152C112616C095D017159554D44582D0451BC851815D24517C
MD5 SHA1 SHA512 TLSH

autorun.exe

IMPHASH 428c2a51c96ffc17c66f28e53a092368
SHA256 34b3ea30b46bcc45181709d9dcaa521929c0e9af1d9a80434203bb78f3986959
MD5 1efcea791a9a60247c8ca980c6393125
SHA1 34fccee971ee79c93c3eb4e8e4eaf4e47169cdfc
SHA512 a606587cab0345421cb365daa812428ed1d299e9ddb59e7ea600becb0930c89f74f6c223c99cbfcf09f4e5dd3788519fe169e7587ee03ce8e07c9d9908dabb14
SSDEEP 24576:t6zngiY46pFgRqw+UI04rVbzpv2qL0wk1zmstc47s:wjBfMfw7Md9Ck4o
TLSH
T1B4652AC09A41D53DEAECE6348DF077B497D13B054A018A65CD39F9EEF5EEAE219301A0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11917

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA VirtualProtect GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount HeapSize VirtualQuery InterlockedExchange RtlUnwind GetCPInfo GetOEMCP GetACP LoadLibraryA GetFileType WaitForSingleObject GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle WriteFile GetCurrentProcess TerminateProcess GetProcAddress ExitProcess HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersionExA GetCommandLineA GetStartupInfoA GetFileAttributesA lstrcmpiA CreateEventA GetLastError lstrlenA CloseHandle SetErrorMode QueryPerformanceFrequency QueryPerformanceCounter lstrcpyA lstrcatA SetHandleCount GetModuleHandleA HeapAlloc HeapFree GetSystemInfo

user32

SetCursor PostMessageA SetCapture DestroyWindow PostQuitMessage DefWindowProcA KillTimer SetTimer GetWindowLongA FindWindowA GetForegroundWindow GetWindowThreadProcessId IsIconic SetForegroundWindow GetMessageA TranslateMessage DispatchMessageA LoadCursorA LoadIconA RegisterClassA GetSystemMetrics CreateWindowExA SetWindowTextA GetClientRect LoadImageA SetWindowRgn ShowWindow InvalidateRgn RedrawWindow GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect ScreenToClient GetCursorPos ReleaseCapture MessageBoxA LoadStringA

gdi32

DeleteDC CreateCompatibleDC CreateRectRgn DeleteObject SelectObject BitBlt CreateCompatibleBitmap

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteExA

winmm

PlaySoundA waveOutGetNumDevs waveOutGetDevCapsA

data1.cab

SHA256 e737f1d78c57b19a7dedf4f01d8043237a682e2e367e04a3ba2bb91949d3a790
MD5 ec9b5426245077a2df07f9db3a28d7a1
SHA1 1652eaf378722d138a2b21bfd3125d3a7bc08b43
SHA512 4c1512a8f440ad0fc8f8f95db9ac629e9f346b590a7f48ac6840e83776a0f4438649cc39a44a68d65b63fd62626062acaf3119737aad0cad9a691e173b298d08
SSDEEP 98304:KObhVROYkgAklLms8viQvtlpm97FGa4dUh8Ejfr9xVFQ:RROlgBLmhJopo
TLSH
T1D82633A5646F0996810BC13A133E9CF8E7A1331CF69FC5E0A9CB91018EB1995BDB7D13
MD5 SHA1 SHA512 SSDEEP TLSH

data1.hdr

SHA256 c8c7a7df422ced28faf1ce66ffb9de5e17a083dacd6a02d9bda852174b6ff217
MD5 73f331a73abfc42aab2a4f80a24d9e5e
SHA1 1017cc300669d706558a913219803538392bf3d4
SHA512 3511412542b93167f0a4a3b273605dfc8b5451d23c865a97d5e03c198886aa6c03414a58ce76d7d36f571ed7bcb40e6ea16bff8e7c25ef892742e49165d9e63b
SSDEEP 768:B/Mz20lmk+ORnqqqX8jSePWKti2VO2MTg6kf55g24dBVfN1G:NMz24+O1qqqMjSePt+20kfM24dBVfm
TLSH
T136437301BB09DDC3C90A4336C1FE56E937318D9A2B7BA3461148947D3CF7BA689253AD
MD5 SHA1 SHA512 SSDEEP TLSH

data2.cab

SHA256 5b450f560838e71d18e5dc37fc6578af50b38b7a716e54b820dc2624e4aa02eb
MD5 8091949866f68e5fe87041e02b779209
SHA1 33753d43a66a8235d728c297ba4c0b9bc6aeb351
SHA512 a100dc9d11af2dd1c26d6dc1fef286fd5f21108f310ed0502e282b2a6903d5402d1cc9d20e306b7ad5136cdbf6570ef9db841f3dd2fd6e9b28085a258ea1604c
SSDEEP 3145728:74yfN28vjBUnS0sbOwf4zIbuAbDYgDCYFcDBd2Bd3lqpIh6H3yFxMYEvNaJrgU+X:74yfN7UnS02M+uwDY8xFcVcBdo0UymJ
TLSH
T14A78F147E152D829E5245E70EC03EFF142A2FD02CF1A85637629BC0DBEF55A72E60396
MD5 SHA1 SHA512 SSDEEP TLSH

ikernel.ex_

SHA256 fbf95719b956b548b947436e29feb18bb884e01f75ae31b05c030ebd76605249
MD5 93b63f516482715a784bbec3a0bf5f3a
SHA1 2478feca446576c33e96e708256d4c6c33e3fa68
SHA512 2c8f29dda748e21231ab8c30c7a57735104b786120bb392eb1c20a320f2dddde392d136fd0c70853bb9af851bbe47df2955d8f9d5973b64870ac90bd12d2dd70
SSDEEP 6144:GnqCU025Do1BIFcsvbEfeqbnTdOJzEANlA9atuimsU7gaeaiNqltaBZv4fvxg:Aqw2qnQcs4bh+zxNeim79GqlQuK
TLSH
T1F1742313FFEECBF32596113AAB20B73BA5D37D44CA83C52F0368194A6625CD6852344B
MD5 SHA1 SHA512 SSDEEP TLSH

layout.bin

SHA256 8bc5bdd1cf3e64434650641f07763b9b6020e3b0866b0fba7a3a48fe03b9c501
MD5 2c8bc136e2cd9aab7b5f4272bb0e3ffb
SHA1 2a9025d5b123451764bb6e88e0fa613f37f1d943
SHA512 7d2673be2e8f34301e06dd76696b49d45640c0916cbef279081f119e64a126975407f853b11e0497003a08b6ed28dec900c1c5b236c4c88553c4a3abb53ed32f
TLSH
T1CAE08C2D362B8900C2030E3560FFF7EB12E7B23A0120D301035BA0952C0E23DFD880C2
MD5 SHA1 SHA512 TLSH

setup.inx

SHA256 2be63427cb8ef0d2e9094b64565e61726bb49a06067dd391fc3872d5ac4427c5
MD5 4c557b7e31517872b264ba30fff37bd1
SHA1 a0df8cf3069dd5ebee4873ebae70c9aae89ee5dd
SHA512 5b72fd7643e58a950d347da7218aea1c7f7119558a26e61f804fa95bb5c54e84ba501e1342612f38b7be9c8104e0f308215d6e86ecee971ab8dbdc93cacc4fb4
SSDEEP 1536:4zUDmYdDA62KgrR8FbHn+MrkG/KtK6F9kb3Bysd8CPatcI2HKWMWDmL7bo6rF1wF:49AfqL7ba
TLSH
T1C9F39B70B4416E0BE37D9B3FC9679573B360B0549F23AB2661AB77386C851272F422B1
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

Ballance.iso

out.iso

AUTORUN.INF

Acrobat/AcroReader51_ENU_full.exe

PE Signature issue

kernel32

user32

gdi32

comctl32

advapi32

shell32

lz32

generic

DirectX9/BDA.cab

MSDvbNP.ax

kernel32

msvcrt

advapi32

user32

ole32

oleaut32

generic

MSVidCtl.dll

kernel32

ntdll

ole32

oleaut32

user32

advapi32

rpcrt4

generic

Mpeg2Data.ax

kernel32

msvcrt

winmm

advapi32

user32

ole32

generic

bda.inf

bdaplgin.ax

kernel32

msvcrt

advapi32

user32

ole32

ksproxy.ax

generic

bdasetup.inf

bdasup.sys

hal

ntoskrnl.exe

ks.sys

generic

ccdecode.inf

ccdecode.sys

ntoskrnl.exe

hal

stream.sys

generic

dx9bda.cat

ipsink.ax

kernel32

msvcrt

advapi32

user32

ole32

oleaut32

ksproxy.ax

iphlpapi

wsock32

ws2_32

generic

kstvtune.ax

kernel32