53b8946c3bc5c51d8dbc01054609e0ca7e0ce1c9720286fbe11bfac2add42580

resource
53b8946c3bc5c51d8dbc01054609e0ca7e0ce1c9720286fbe11bfac2add42580
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/ai-station.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 53b8946c3bc5c51d8dbc01054609e0ca7e0ce1c9720286fbe11bfac2add42580
MD5 bcacec65e129f45c8b3176fa00ae81b6
SHA1 48bd3937e1eb8317e67aeb1e0c0f729be8d50afb
SHA512 9e9d82a628b4e88487484b416ce2cc4b474d7ac700bd2b7e1a1e1456a3dc5e850f4bff70eb89950da009bef94c688eefde3f6705a70fef0c630955f7eb9497e2
SSDEEP 98304:D7ELPrYs+D8w8hLQhXmpDg9oexNL5t/fzLsJ46r0iixP9yz0OaPDd4b:D7ELDT+D8PLQUluzNL/n/X+Woz0OaP+b
TLSH
T1604633C72346CD73C2B9527148F93622B191CA16B30C925F73E1DB427F913A78B96A87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

ai-station.exe

IMPHASH fc3be447eebb191adb0e14d79ad6b99f
SHA256 3281b6de76bea59b48046c9fcacdf63b0f5cace3b738d48e0f51264942b87fd9
MD5 d0b9255a368d40c34f82bca2272a7802
SHA1 27cf19cd50f17de02aff128de1d85ab15702b54c
SHA512 bb51ad71ae41ba153647f969198a09585cb75dcbc656a0ca5ea9f782d967e044bc1428694f35def008a80b9f295eabbbcdb2ef83982d06e91a7faf65319baea5
SSDEEP 196608:CBmuZkQ+j6bqIg/Kb0ZQDLLuLy+MsNI6C5:CBmuZkQ+j6bqIg/N5O+c6C5
TLSH
T11307F6217A5A996CD09BC47483478A725E7130CF0B39B9FF449896382F69BF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11689008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ai_station.pdb

bcryptprimitives

ProcessPrng

advapi32

RegGetValueW RegOpenKeyExW RegQueryValueExW EventWriteTransfer RegCloseKey EventSetInformation EventUnregister EventRegister SystemFunction036

ntdll

NtWriteFile NtCreateFile NtOpenFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtReadFile RtlGetVersion NtDeviceIoControlFile

kernel32

RaiseException RtlPcToFileHeader IsDebuggerPresent GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent EncodePointer PostQueuedCompletionStatus CloseHandle GetLastError GetProcAddress Sleep GetModuleHandleA GetQueuedCompletionStatusEx GetCurrentThreadId TlsAlloc TlsGetValue GetModuleHandleW GetUserDefaultUILanguage LCIDToLocaleName ReleaseMutex TlsSetValue TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetOverlappedResult RtlUnwindEx FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LoadLibraryW SetEnvironmentVariableW DeleteFileW ReadFile GetFinalPathNameByHandleW CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread LoadLibraryA lstrlenW SetThreadStackGuarantee AddVectoredExceptionHandler SetHandleInformation WriteFile SetFilePointerEx OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW CreateDirectoryW FreeLibrary GetStdHandle TerminateProcess GetProcessId GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess FlushFileBuffers ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle DeleteCriticalSection MoveFileExW GetFullPathNameW SetLastError SleepEx LoadLibraryExA WriteFileEx HeapAlloc WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW InitializeCriticalSectionAndSpinCount FormatMessageW RtlVirtualUnwind CreateMutexW CreateFileW SetNamedPipeHandleState GetConsoleMode GetFileInformationByHandle GetFileAttributesW SetFileCompletionNotificationModes CancelIoEx CreateIoCompletionPort

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

DragQueryFileW SHAppBarMessage SHCreateItemFromParsingName Shell_NotifyIconGetRect ShellExecuteW Shell_NotifyIconW SHGetKnownFolderPath DragFinish

user32

GetMonitorInfoW FillRect SystemParametersInfoW TrackMouseEvent ValidateRect GetTouchInputInfo CloseTouchInputHandle RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowCursor MonitorFromRect FindWindowW ShowWindow GetWindowRect TranslateAcceleratorW GetParent FindWindowExW SetWindowRgn VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo GetClipCursor ClipCursor DestroyMenu EnableWindow CheckMenuItem GetMenuItemInfoW GetUpdateRect CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx RegisterClassW IsWindowEnabled CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW ToUnicodeEx GetKeyState GetSystemMenu EnableMenuItem SetWindowTextW GetWindowTextW SetWindowLongW GetWindowTextLengthW SendInput SetForegroundWindow MonitorFromWindow ReleaseDC GetCursorPos GetClientRect GetWindowLongW ScreenToClient GetDC RemoveMenu GetForegroundWindow IsProcessDPIAware SetWindowLongPtrW DestroyIcon GetRawInputData RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetWindowLongPtrW SetCursor LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW ClientToScreen GetKeyboardLayout EnumDisplayMonitors PostThreadMessageW PostMessageW DispatchMessageW GetMessageW MapVirtualKeyW MonitorFromPoint DefWindowProcW IsIconic EnumChildWindows GetMenu IsWindowVisible DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW SetWindowDisplayAffinity DrawIconEx RedrawWindow AdjustWindowRect SystemParametersInfoA SetPropW DestroyWindow SendMessageW

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc TaskDialogIndirect

ole32

OleInitialize CoCreateInstance CoInitializeEx RegisterDragDrop RevokeDragDrop CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoUninitialize CoTaskMemFree

gdi32

GetDeviceCaps CreateCompatibleDC DeleteObject DeleteDC CreateRectRgn SelectObject BitBlt CombineRgn CreateSolidBrush SetTextColor CreateDIBSection SetBkMode

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

ws2_32

WSAStartup WSACleanup freeaddrinfo select getaddrinfo shutdown closesocket accept getsockopt getsockname getpeername recv WSAGetLastError WSASend send setsockopt ioctlsocket connect WSAIoctl WSASocketW bind listen

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc floor pow roundf __setusermatherr round

api-ms-win-crt-string-l1-1-0

strcmp wcsncmp strcpy_s wcslen _wcsicmp strlen wcscmp

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode calloc _callnewh

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm _get_initial_narrow_environment abort _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe __p___argv _cexit _c_exit terminate _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _exit _crt_atexit

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

resources/claude-zh/10月/LICENSE

SHA256 ec3b776dbc993f37fef9f89b654a0bf14404ef1ea3ad4cda465cd6bcbd495e54
MD5 c0fe2b2cbb9fe47e8346a54a41e10729
SHA1 1f4d76ce3ea1fc86eb9cf4772448a3c711c847cb
SHA512 9472fdca45ac53f8f418ec024f58d4c239576d22619b8da7391192fb4f9211334ade838398fe8baf94c5c24498652ad00649dbb38ea1acb11600a4fcd9c655bf
TLSH
T12E11421E72510762189B13A05578A8D9F22BB25B7A5F2A84246DF245632A06CC5FB844
MD5 SHA1 SHA512 TLSH

resources/claude-zh/10月/resources/desktop-zh-CN.json

SHA256 7c99b9876f0898f2c84c226166015c932ec435de3568d7bc69e998b740b4d246
MD5 445bc581a7c68bdc6a4fffbb2a05acd6
SHA1 0e4289fb368b218a2d34d6c0499fea6280604289
SHA512 1192b6ade6311d482bbfef0d1567acdaa34a2899102d58fab1f6494fb02f442eeee3534430c94f096cc11cba2ff4240ebbf1fa745ff6b5c9e76fb2739ab967e2
SSDEEP 1536:z1HNgVvfqEsUs+yfMHRun+mLjl7b3kzRo1n:dNqaUPct/uA
TLSH
T1A33318550799C8EB10CC22D467269476A6102F0BE1A4BE0CDFCB185D82CDA6F4E7DF9E
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/10月/resources/frontend-hardcoded-zh-CN.json

SHA256 3202282228712bc93aced81dc556f7486fae399259b1a2713996f42731b77fb9
MD5 d0e61c7f424e08c1c0ac3551110f2d3b
SHA1 682a74bfe36729427df176d8f5f0e4114da6ba1e
SHA512 cab7cf180dec1eee36fe74f3b51fa165da68dd8bb3dd555856fba53650b420e772d3fddaf495c61c346447deb32253a7cd5fa808822429ef9ca912efb14c9a37
SSDEEP 12288:pooEhT7GjTlO5V3cHw28RsEyeQWNkbHYAwO0IIudRLtZr1XYmRMOoT97u1fKvvoQ:pooEhT7GjTlO5V3cHw28RsEyeQWNkbHo
TLSH
T1C4B4B31BD2145E62016A0BB16E0E53526B1C12172BF13F1AB75D803C2F7CB5E4FBA6AD
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/10月/resources/frontend-zh-CN.json

SHA256 ae67b41133177f021fd0842ae98df216653c19af763121f032bad5314c99660f
MD5 a4fd56cfda7ae594749def343e89cc6a
SHA1 e4eb3cd33134ab7f49c981f60e291cddd288f8fa
SHA512 cc7f4556fbf80eff32109d5c3f3b64209d0d89e46527219bcdbbc10332565b5983ef15847e44c5d555f170c64c4e825f458da7fabc6ec99f112324936d778e42
SSDEEP 24576:kWtipGOgLy8x/aGwg8z269l6qVky96xDbGZTxA8+fztkhJG2HxUZJYzRJkIf3Zwt:un8laGav61GZTS8kAJG2KZAyIGYY
TLSH
T15EB519514399CCEF00CD13E4772A8535B1006F0FA1A6B60CDF9B486D56ACA6F4978BBE
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/10月/resources/manifest.json

SHA256 f4a7af85c8f4fd76e2c55f81f4ce8582ec2f32e2457229f6bd2302e094eb05ea
MD5 6631a3f9a670f0f8eb03d86e053b9154
SHA1 676aa7d08dabc4596e32650965f069bb629bfdfd
SHA512 e674844c7f8e03bebd56cb30fefd0ec0d14d7131bc7cc18e583acbb1f89446dc08c61e93b8280f68034396934c8f69aec204e5f91eca6f450d5359f1e62e8538
TLSH
T1CCE0C017C500093209CD53DE4C5E961B72104F670CD4341FF3E7160000CC53A2D7658D
MD5 SHA1 SHA512 TLSH

resources/claude-zh/10月/resources/release.json

SHA256 c70dda6c37f5602b66f8b79d9ab8eab1701df74e0eb1579b908b978ba51c5faa
MD5 40cb85dc400f224e4c376e5c7f5dcbe2
SHA1 12262d5ae1b0900d9dc34c2f31caedc2d4d0f7ee
SHA512 d3dd75ea18ea4566800c2b2902a030c852fbdec21e75c2071331895af831dd5a8d6cd60559efa7769c045b0b94b7507ae6ad156892045eebea580f79cca9ecb4
TLSH
T146A0023EA40DAF3B46E4046FDD66A681DA5C4C9BC240E42D37632289F15DAB644E594C
MD5 SHA1 SHA512 TLSH

resources/claude-zh/10月/resources/statsig-zh-CN.json

SHA256 c778fa95fccc11e8bc8497fce41dded336948df8d6f4cd98d3226c6ba26f8b4e
MD5 23f3b2d7336b41bb060202f9e6aad5b2
SHA1 0b0b0da4bb2baaff5042c9e67dd0de11cbae9d38
SHA512 a409b9d9ca2b9e919af41db37a0781ffb4090c91ff474b654590d6989959035503300f8176456918a2533afb50ab9c458afa1bc4b16079bdcd95014533c26d01
TLSH
T18441B82203D4C9C782D466C6391612461CB78F976019794D571F0CAE89DC27FE97A33E
MD5 SHA1 SHA512 TLSH

resources/claude-zh/10月/scripts/install_windows.ps1

SHA256 b18aac428e4594bcecd1766c324739f5107f8ebac1932175233df6e35d9d73ae
MD5 369c00c15d4453597ed2aa773acf27ed
SHA1 868089700b9ba86650c6a85b8ff168dd818561b2
SHA512 b18932813b8beca47490d5436b0f3ba9ec1ff5dc8dca5d3405b03cddf6af461000a151b8fade96a4a6d0fe06646ad880a540637088f8f1d4714914416e75700f
SSDEEP 3072:sx2hBtCCqYnUu88ByFLT2Wg1KgG5lhVM4q6Q36me6Yoc5lRG39:J5qYn4X2WgqVq6Q36mMRGt
TLSH
T10F14C93A7406519A80B7173D9A935408FF1A013F45145E85FABCD1CC3FFA72DC6A8EAA
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/9月/LICENSE

SHA256 ec3b776dbc993f37fef9f89b654a0bf14404ef1ea3ad4cda465cd6bcbd495e54
MD5 c0fe2b2cbb9fe47e8346a54a41e10729
SHA1 1f4d76ce3ea1fc86eb9cf4772448a3c711c847cb
SHA512 9472fdca45ac53f8f418ec024f58d4c239576d22619b8da7391192fb4f9211334ade838398fe8baf94c5c24498652ad00649dbb38ea1acb11600a4fcd9c655bf
TLSH
T12E11421E72510762189B13A05578A8D9F22BB25B7A5F2A84246DF245632A06CC5FB844
MD5 SHA1 SHA512 TLSH

resources/claude-zh/9月/resources/desktop-zh-CN.json

SHA256 21c09c193773d5bfdbc9a59e5470881a3976cafa07403094e372921f5299da44
MD5 a79cf2e36fe7450cad6c67afafc19125
SHA1 80dc92ce896f67bd7b632e281b958ec6777e92c7
SHA512 fcbe92f6800ef6d260f037d8310c1c5027a45abb8f2c3dca09676df7ccac9a2f58f8b5148d7d4d3e29a572d752e1714aafe87b230b42666e5ee3200ec2ca02bf
SSDEEP 384:MlEDTutkjsiml8zd1PnxB8I0krQsvt1oNbZvlvRvsqqp0HY2:lIl851HTRv4NVvlpvmk
TLSH
T145921A594398ECFB00CE22D4272641696A105F5FE2547E1CDFCB18AD528DA2F4A3DB8F
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/9月/resources/frontend-hardcoded-zh-CN.json

SHA256 c5fbc98db8ef42fd29fb1a63dce016d8a73eb77b6579d831ab0feb925d8c06b4
MD5 1b8517b3d348fe713c96c286b0858ecd
SHA1 9e1836740687be82a7162154aa99b49e5f609e52
SHA512 d6d1624613b800ca89a4cf137d7d315fbb4315897a82c40ccd96135a90c0bc7bd18cd032ab1404fdbc9d8a5d8530f80cca1c739967514acc6516120bac739722
SSDEEP 1536:e3ucKoPqtOQJ+85jDSXLBWDoEhT7GjTlO5V3cHw28RsEyeQWNkbHYAwO0IIudRLl:e3uPO2h/5icoEhT7GjTlO5V3cHw28Rsz
TLSH
T18583B30BE1144D6601394BB16E1E57622F1D129B1EF03E16B36C847C2F6CB1E8FB66AD
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/9月/resources/frontend-zh-CN.json

SHA256 915eb7f62832c840b3ffd5f37b9568ddc64d6acde3a0070c464cbca9ce9b2bd9
MD5 77f349c8ce9e5a6aa044ea8282451dea
SHA1 0537885dd8f660235d2520e0009cf929ffcb5b92
SHA512 9847276538182237a92e46202d46a1ceb1b76a4eb2b158e66d9b39b38495fe2712f7569ddf24cf131575ff242b95e9367532856fd8520c14233cd045904120b6
SSDEEP 6144:MVo+BknqNsSFj5vFiicnGmMuP9BaCsO3mU9t4G6t0wcNZBJdyuZZBrADTP+KA:MVo+B3XW1TKUgG6VcbDdZH0P+KA
TLSH
T1EBE46C25435CC8FB01CD13D43716457A72106F0B9264B60CCF9B88AD1AADB1F997ABEE
MD5 SHA1 SHA512 SSDEEP TLSH

resources/claude-zh/9月/resources/manifest.json

SHA256 f4a7af85c8f4fd76e2c55f81f4ce8582ec2f32e2457229f6bd2302e094eb05ea
MD5 6631a3f9a670f0f8eb03d86e053b9154
SHA1 676aa7d08dabc4596e32650965f069bb629bfdfd
SHA512 e674844c7f8e03bebd56cb30fefd0ec0d14d7131bc7cc18e583acbb1f89446dc08c61e93b8280f68034396934c8f69aec204e5f91eca6f450d5359f1e62e8538
TLSH
T1CCE0C017C500093209CD53DE4C5E961B72104F670CD4341FF3E7160000CC53A2D7658D
MD5 SHA1 SHA512 TLSH

resources/claude-zh/9月/resources/statsig-zh-CN.json

SHA256 c778fa95fccc11e8bc8497fce41dded336948df8d6f4cd98d3226c6ba26f8b4e
MD5 23f3b2d7336b41bb060202f9e6aad5b2
SHA1 0b0b0da4bb2baaff5042c9e67dd0de11cbae9d38
SHA512 a409b9d9ca2b9e919af41db37a0781ffb4090c91ff474b654590d6989959035503300f8176456918a2533afb50ab9c458afa1bc4b16079bdcd95014533c26d01
TLSH
T18441B82203D4C9C782D466C6391612461CB78F976019794D571F0CAE89DC27FE97A33E
MD5 SHA1 SHA512 TLSH

resources/claude-zh/9月/scripts/install_windows.ps1

SHA256 64795aa2ce1d190e2f429eca365036def61e93cf3b60af187da4fb8c18688f27
MD5 d1a3902a2843ccf0609b0322d579ac61
SHA1 b038c80ddd97432594010c78b5950a3807ccdb5b
SHA512 47dcbc32e9c84609bfbcc854ee00d2d3a990563601bfcd185b2a61599c6577996fa1cb0cf068844d27e767f1610dff23040246c35cb1995b6caafd5c38655cb5
SSDEEP 3072:PxOgBtCCqYn6u88VRFLT2WgjoL5YoI6QY6me6Yo4DRGVy:T5qY9X2WgeI6QY6mgRGA
TLSH
T1A6F3B83AB806515A80B7573D9D825508FF1A013F45241E85FABCD1CC3FFA72DC6A8E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer