MDE_File_Sample_35a99c986461c79b5407bc2c14d3fdb05a3f393a.zip
- SHA256 457686fa4f0c0244f82850670dc2162470a353c2b8d0069a5436ceb89e39f07e
Password
2026
Static task
static1
1 signatures
General
- Target MDE_File_Sample_35a99c986461c79b5407bc2c14d3fdb05a3f393a.zip
- Size 16.1MB
- Sample261022-1adwksh17n
- SHA256 457686fa4f0c0244f82850670dc2162470a353c2b8d0069a5436ceb89e39f07e
- MD5 157f520f3a0e22ce85e3750caedb65de
- SHA1 b423e095703929e19886a68285b48a9884114466
- SHA512 76ddbe0035fe8d7606f5e83b7cc315d435306287c78fc75c30063adbbb085024fe7f0228308c125d8e6b56fc73b01be9e52fdf4398039bbe347832344f13ecfb
- SSDEEP 393216:6+n3wSsXCyXL+mEhmVmPDGcwd11Nr5ycWOyYtp:WSKXqoH1VhWutp
- TLSH T111073367B0197A01A6BBCCB47ED6D362801FEB7E6085C52C39CF54667498B97CC12E32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/ClearEditPro_252510.exe unpack002/$PLUGINSDIR/Banner.dll unpack002/$PLUGINSDIR/EmbedHtml.dll unpack002/$PLUGINSDIR/NScurl.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/$PLUGINSDIR/nsis7z.dll
File Explorer
-
MDE_File_Sample_35a99c986461c79b5407bc2c14d3fdb05a3f393a.zip.zip 16.1MB
-
ClearEditPro_252510.exe.exe 16.1MB
-
$PLUGINSDIR/Banner.dll.dll 4KB
-
$PLUGINSDIR/EmbedHtml.dll.dll 767KB
-
$PLUGINSDIR/NScurl.dll.dll 7.2MB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/eula.html.html 2KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsis7z.dll.dll 424KB
-
icudtl.dat10.0MB
-
resources.pak5.1MB
-
uninstall.exe.nsis1KB
ClearEditPro_252510.exe
- IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
- SHA256 5861bfe3fe17cac44241715d2b9c383cef3bea165de2cf2ebac6ec69f51dce6c
- MD5 08adabc0f480616c30d13db2ad4cd558
- SHA1 35a99c986461c79b5407bc2c14d3fdb05a3f393a
- SHA512 4cda2a7beb9c53eeb24ff0925f7da30a5e65d63b70c1369d506ce8504bac5861728037914e56838276660fdb341a94d6cffa57a3fd261b502fe570caa5053f6e
- SSDEEP 393216:Q0cHWFEL/FMGnvi6mIuhnzVkRU51a67oi2FHfifqSBI4kUM:Q0xw/OGnviXNpmRU51Wi2Uqz43M
- TLSH T11707330AFE2A6442F9DD1BB60103A35BFD0007566B6E48EACA59E31D507A1B7BF1C50F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
13899
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
WriteFile
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CopyFileW
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/Banner.dll
- IMPHASH beba03bbad1f8d79d5b3c1359e913e0d
- SHA256 189a30bd5802d2f43256c9f8958a7ec7fdf794a6a681731c85af01796d13582a
- MD5 4e50e372bed7882789360c37b1369e0d
- SHA1 24aa9ddf67ebae447313082d12b358029cc0070c
- SHA512 c05db65d19621132cc91ab09ce8ae7edc0906c1b9eff80b20921147de451138921b384345f98e88ee9fec8328a130a9d2bcb0e68cef794e81da3d26325a87500
- TLSH T1B781633BB2F04EF7E563023300830BD3259BA954A728471A4D67A1ED764A9D7D53DB02
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
4760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpW
GetModuleHandleW
CloseHandle
Sleep
CreateThread
GetCurrentThreadId
GlobalFree
lstrcpyW
lstrcpynW
GlobalAlloc
user32
DestroyWindow
SetWindowLongW
GetWindowLongW
SetWindowTextW
SetDlgItemTextW
DispatchMessageW
PeekMessageW
WaitMessage
IsWindow
CreateDialogParamW
ShowWindow
AttachThreadInput
IsWindowVisible
wsprintfW
PostMessageW
destroy
getWindow
show
Name
.text
Size
1024B
Virtual Size
874B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/EmbedHtml.dll
- IMPHASH 3001d5294dd723db0f98ac6324faaf19
- SHA256 888fd9e1baf6e78c41c87ddc203b84d754ae5f73167876e3bf83a5253c375d8e
- MD5 d1d5fc1d51cbac6171601d3f990e0cc8
- SHA1 fc3b32f7ad1e717a7f31590dd6c02b8417d7c75d
- SHA512 571e2b767608bf502f3cf7a320ce5d93571168510a37e6aefd37c43ce3319feb8211bebcca1274f13deaac0c444366ea2091a9e4a744344874a22f9294370a54
- SSDEEP 12288:39nfbYbyicF595btShv/NMAPjhxBDcoBJHD/Yd1QPN+N7Eq:39nfbYbyi4595btShv/NMArhvcoBJiQ4
- TLSH T1B8F4C4C2E2A5F656E3A700719C0962D50A612E303394ED67BFC632858D3A1E7E5E1F37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
6
Entry point
626599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetUnhandledExceptionFilter
GetConsoleMode
GetStdHandle
GetProcessHeap
SleepConditionVariableSRW
AcquireSRWLockExclusive
lstrcpynW
SetFilePointerEx
GetModuleHandleW
GetOEMCP
HeapSize
FreeEnvironmentStringsW
IsProcessorFeaturePresent
LoadLibraryExW
RtlUnwind
WakeAllConditionVariable
GetModuleFileNameA
LoadLibraryA
GlobalAlloc
MultiByteToWideChar
GetStringTypeW
TlsGetValue
LCMapStringW
InterlockedFlushSList
GetLastError
UnhandledExceptionFilter
DecodePointer
GetCurrentProcess
lstrcmpiW
TlsFree
ReleaseSRWLockExclusive
QueryPerformanceCounter
GetStartupInfoW
CreateFileW
InitializeCriticalSectionAndSpinCount
ExitProcess
GetFileSize
LocalFree
TlsAlloc
DebugBreak
FindFirstFileExA
GetEnvironmentStringsW
WideCharToMultiByte
HeapFree
GetCurrentThreadId
FreeLibrary
TlsSetValue
EnterCriticalSection
WriteFile
FindClose
GetCPInfo
GetCommandLineW
EncodePointer
HeapReAlloc
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
lstrcmpW
LoadLibraryW
MulDiv
HeapAlloc
FlushFileBuffers
SetStdHandle
RaiseException
GetCurrentProcessId
GetConsoleCP
GetACP
TerminateProcess
IsDebuggerPresent
IsValidCodePage
GetModuleFileNameW
lstrlenW
GlobalFree
SetLastError
LeaveCriticalSection
GetSystemTimeAsFileTime
lstrcpyW
DeleteCriticalSection
FindNextFileA
CloseHandle
GetFileType
GetCommandLineA
InitializeSListHead
WriteConsoleW
OutputDebugStringW
InitializeCriticalSectionEx
user32
DestroyWindow
IsWindow
GetParent
InvalidateRect
GetClientRect
SetWindowLongW
GetDC
CallWindowProcW
GetWindowRect
MapWindowPoints
wsprintfW
ReleaseDC
gdi32
GetDeviceCaps
advapi32
RegSetValueExA
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExA
RegDeleteKeyA
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
ole32
OleInitialize
OleCreate
CoTaskMemAlloc
OleUninitialize
OleLockRunning
OleSetContainedObject
oleaut32
VariantClear
SysAllocString
SysFreeString
shlwapi
PathStripPathW
GetIEVersion
GetURL
Load
Name
.text
Size
680KB
Virtual Size
679KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=208, version=65501,
count=4, id=206, version=65501,
count=1, id=261, version=28320,
count=10, id=241, version=40116,
count=128, id=243, version=40116,
count=25, id=242, version=40116,
count=45, id=261, version=28117,
count=17, id=260, version=28117,
count=18, id=259, version=28117,
count=21, id=203, version=65501,
count=119, id=1, productName=Unmarked objects,
count=100, id=265, version=28320,
count=1, id=256, version=28320,
count=1, id=255, version=28320,
count=1, id=258, version=28320,
$PLUGINSDIR/NScurl.dll
- IMPHASH d8f1ee8314d0fd54e08e607254db6cf8
- SHA256 f41c74c3024c8640e82e924db0af73b2fb04dd65e8f239af745926b2761a8162
- MD5 578986617b7a4e3c93adfd9172705a53
- SHA1 162efb4fc94797726f7d360643b45011a3280cda
- SHA512 19d7e0cb8a3eb957c0cc611d51db64d01242b8e5454a8fe03c269f7d964b73f28e3e6b48cf4218402a88ffd1fb8ce26f7c865c4cbfe6fcd29031d6bb563c7a9f
- SSDEEP 196608:zXr8P3PrSYc4SThnIhr8vOKnbDR8ncC9NRlrn9PGYAY0iT6V:UnEkTT2
- TLSH T1FF763A94FECB04F1E55384B0D8DBB37F8B349B018125E6BAEE4C5E56F933701252A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
5320528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptImportKey
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceW
ReportEventW
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenSystemStoreW
kernel32
CloseHandle
CompareFileTime
CompareStringA
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileW
CreateSemaphoreA
CreateThread
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileW
FindResourceExW
FormatMessageW
FreeLibrary
GetACP
GetConsoleMode
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileSize
GetFileType
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersion
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LockResource
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseSemaphore
ResetEvent
SetConsoleMode
SetEvent
SetFilePointer
SetLastError
SizeofResource
Sleep
SleepEx
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
msvcrt
__p___mb_cur_max
__p__iob
_amsg_exit
_assert
_beginthreadex
_close
_close
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fstati64
_fullpath
_initterm
_fileno
_fdopen
_lock
_lseek
_read
_setmode
_snprintf
_snwprintf
_stat
_strdup
_sys_errlist
_sys_nerr
_unlock
_unlink
_vsnprintf
_vsnwprintf
_wfopen
_wopen
_write
_wstati64
_wtoi64
abort
atoi
calloc
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
fsetpos
ftell
fwrite
getc
getenv
gmtime
isdigit
islower
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
raise
sprintf
realloc
setlocale
setvbuf
signal
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
time
strpbrk
strspn
strrchr
strstr
strtol
strtoul
tolower
ungetc
vfprintf
wcscat
wcscpy
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsstr
wcstombs
wprintf
user32
CallWindowProcW
CopyRect
CreateDialogParamW
CreateWindowExW
DestroyIcon
DestroyWindow
DispatchMessageW
EnableMenuItem
EnableWindow
FindWindowExW
GetDesktopWindow
GetDlgItem
GetProcessWindowStation
GetPropW
GetSystemMenu
GetSystemMetrics
GetUserObjectInformationW
GetWindow
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
IsDialogMessageW
IsWindow
IsWindowEnabled
IsWindowVisible
LoadImageW
MessageBoxW
MsgWaitForMultipleObjects
OffsetRect
PeekMessageW
RemovePropW
ScreenToClient
SendDlgItemMessageW
SendMessageW
SetForegroundWindow
SetPropW
SetRectEmpty
SetWindowLongW
SetWindowPos
SetWindowTextW
TranslateMessage
wsprintfW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSASocketA
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getpeername
getservbyname
getservbyport
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
cancel
echo
enumerate
escape
http
md5
query
sha1
sha256
unescape
wait
Name
.text
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
640KB
Virtual Size
640KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
231B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/eula.html
- SHA256 9c0c0ad6ad8378551421514f046b945074f678b105e2640c9794a483b76e59ed
- MD5 cb19589828799d5f33cfe69a03f244ac
- SHA1 780629a1637ef5e6cc397e401946f4acd98b3b67
- SHA512 18dda77e19bfef79735f3ecf47cf13b2737b2d6aa2d78cc910e6a016b39b944ec22a02196dc188e0d3a5e1dbbede655eabd5aa6584b823d69424d2e304b86abf
- TLSH T1B541FE6C739337224AB006141F4683E8EB169A77636A2191F5CD800B3FB291086F37DE
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 3b477381217c97b22146297f93df2a92
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- TLSH T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
GetFileAttributesW
lstrcmpiW
MulDiv
lstrlenW
HeapFree
GetProcessHeap
GetCurrentDirectoryW
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
HeapAlloc
SetCurrentDirectoryW
user32
GetPropW
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
RemovePropW
CharPrevW
GetWindowLongW
DrawTextW
GetWindowTextW
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
MapDialogRect
GetClientRect
CharNextW
SendMessageW
DrawFocusRect
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsis7z.dll
- IMPHASH 2656ea25cde98f31a490513c2db04ae8
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
6
Entry point
268568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalFree
FormatMessageW
GetFileInformationByHandle
SetLastError
DeviceIoControl
GetModuleHandleW
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetStdHandle
WaitForMultipleObjects
GetTickCount
GetConsoleMode
AreFileApisANSI
SetFileApisToOEM
SetFileApisToANSI
GlobalAlloc
GlobalFree
lstrcpynW
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
GetCurrentDirectoryW
CreateDirectoryW
CreateSemaphoreW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
GetCurrentProcessId
GetCurrentThreadId
MoveFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetModuleHandleA
SetEndOfFile
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatus
GetProcessAffinityMask
IsProcessorFeaturePresent
WriteConsoleW
HeapSize
GetStringTypeW
DecodePointer
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WaitForSingleObject
CreateEventW
ReleaseSemaphore
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
VirtualFree
VirtualAlloc
GetLastError
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
DeleteFileW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
GetFileType
HeapReAlloc
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
user32
SendMessageW
FindWindowExW
SetWindowTextW
GetDlgItem
wsprintfW
CharUpperW
advapi32
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
oleaut32
VariantClear
SysAllocStringLen
SysStringLen
SysFreeString
VariantCopy
Extract
ExtractWithCallback
ExtractWithDetails
Name
.text
Size
323KB
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=26213,
count=152, id=261, version=26213,
count=35, id=261, version=26706,
count=16, id=260, version=26706,
count=20, id=259, version=26706,
count=19, id=260, version=26213,
count=15, id=257, version=26213,
count=190, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=131, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=256, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
icudtl.dat
- SHA256 51edd31f6c5d298c662af320424b632172a31e3348cdbb201380636c95ded794
- MD5 516f6b90d1539bd1eaeaa2fc32dadb92
- SHA1 8017789bef98902cdc95c18e67b84378ddd293c0
- SHA512 db4b5fd7f8a0e0a331ffa7c574d011b059df8654cdc6ee4970f84fda20b88a3b8706f2605d91d19a6dd86d2702cc9542e026a054d28f85c51b676daa8d3f3bb0
- SSDEEP 196608:zTzwSv9AAyM0agliXUxCGZHa93Whlw6ZEtZ2:zoKlyMqliXUxCGZHa93Whlw6ZEt4
- TLSH T1B6B62907A2FB4EC2F9F7AF30D9F152679467BD496E31805A11442F3B1C337A08661BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
resources.pak
- SHA256 d1c062104f136edf33ad4d89460b2e4d9c1e463e792834ab91ef7d2a11953794
- MD5 915f50ee09363c2e946fa60c3080d97b
- SHA1 38038c4bee8780aaa89936534e5559fbc6aec953
- SHA512 c59543522ae69753996a9912a2dec751f16dab7175c2073864253f77087654d895d12191815b257408b7442d027b0717c6a0d4e5e0b8948a3e60543197c1f10f
- SSDEEP 98304:YhFdIHa+WSTCCDw/xcljwglh1eZML3Arwr/NGKwkT+E59zqaPqPXSF7yOzy2oeUn:S+WSG+lUGhkMLQkrVWk6q9+nPXsq2oek
- TLSH T144463311F3A01D37E2D6933AD4A840372D35D18759A2BC2CF4CE211E8F5CA9B16B976E
- MD5 SHA1 SHA512 SSDEEP TLSH
uninstall.exe.nsis
- SHA256 ccf0aaf08adde0d2732a422bfe45f92cb5a26442c53a265802f6237f9dabb3e4
- MD5 02d63a98d7bd88a4a4cc9289e35c35fd
- SHA1 25a994f5a0e898af94493bad061ef9c987bf1468
- SHA512 107f86dd8509f5aa9a97a8abf59e5991d3d8d5074c50e6674d26f25a4887612e6861f41baaaf7156af6444bf9487448eb5d3d8f76a1d547bfddfa4128d9049cb
- TLSH T11F31E74F5C4B3770C83412B619E47D796E0059BF36865D429541B4AD62C74D1EC2A23E
- MD5 SHA1 SHA512 TLSH