faf4d3b4da421c0e3b9611e9b861647ec1e6f14995c783a21689c8f44a0e5346
- SHA256 faf4d3b4da421c0e3b9611e9b861647ec1e6f14995c783a21689c8f44a0e5346
Overview
overview
7Static
static
3aipai_cliper.exe
windows10-2004-x64
4aipai_cliper.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...if.dll
windows10-2004-x64
3$PLUGINSDI...if.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/Inetc.dll
windows10-2004-x64
3$PLUGINSDIR/Inetc.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...tn.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3【多多�...��.url
windows10-2004-x64
7【多多�...��.url
windows11-ltsc_2024-x64
7多多软�...��.url
windows10-2004-x64
7多多软�...��.url
windows11-ltsc_2024-x64
7Behavioral task
behavioral1
Sample
aipai_cliper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
aipai_cliper.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Inetc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Inetc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSIS7z.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSIS7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/WndProc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/WndProc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
【多多软件站-交流群】点击链接加入群聊.url
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
【多多软件站-交流群】点击链接加入群聊.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
多多软件站-提供绿色软件和热门单机游戏下载.url
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
多多软件站-提供绿色软件和热门单机游戏下载.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target faf4d3b4da421c0e3b9611e9b861647ec1e6f14995c783a21689c8f44a0e5346
- Size 711KB
- Sample261110-wlk2tact7v
- SHA256 faf4d3b4da421c0e3b9611e9b861647ec1e6f14995c783a21689c8f44a0e5346
- MD5 db04062dee636f0541f5647592443d59
- SHA1 d0ef17439c4777bab5b3662086e1a36e1129f810
- SHA512 7a0553e52c68031154b239505bbed3d635f528bde20e6495ffc596cd9296fb7c5e3451dd59db10ec7b9783f08fe4b085b1202ec2d7bb992e2e03c3ee64b7b120
- SSDEEP 12288:brRq1bwg7Ea8zPY7b+Xf7ivbrgCHO7rBj+BX9KFUmZHMabg5fLsOrdSCP9HJ:biwhVj0Sl+B9rmRMa0GAdfP9p
- TLSH T176F433F8150FDB2288171BD43CD6860DE8FB2CB5FBBF7705D2A405A24482F195BB6989
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/AnimGif.dll unpack002/$PLUGINSDIR/BgWorker.dll unpack002/$PLUGINSDIR/Inetc.dll unpack002/$PLUGINSDIR/NSIS7z.dll unpack002/$PLUGINSDIR/SkinBtn.dll unpack002/$PLUGINSDIR/SkinProgress.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/UserInfo.dll unpack002/$PLUGINSDIR/WndProc.dll unpack002/$PLUGINSDIR/nsDialogs.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/aipai_cliper.exe nsis_installer_1 static1/unpack001/aipai_cliper.exe nsis_installer_2
File Explorer
-
faf4d3b4da421c0e3b9611e9b861647ec1e6f14995c783a21689c8f44a0e5346.zip 711KB
-
aipai_cliper.exe.exe 738KB
-
$PLUGINSDIR/AnimGif.dll.dll 12KB
-
$PLUGINSDIR/BgWorker.dll.dll 2KB
-
$PLUGINSDIR/Inetc.dll.dll 766KB
-
$PLUGINSDIR/NSIS7z.dll.dll 624KB
-
$PLUGINSDIR/SkinBtn.dll.dll 4KB
-
$PLUGINSDIR/SkinProgress.dll.dll 4KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
-
$PLUGINSDIR/WndProc.dll.dll 3KB
-
$PLUGINSDIR/bg.bmp593KB
-
$PLUGINSDIR/bg_complete.bmp593KB
-
$PLUGINSDIR/bg_welcome.bmp593KB
-
$PLUGINSDIR/btn_close.bmp2KB
-
$PLUGINSDIR/btn_complete.bmp93KB
-
$PLUGINSDIR/btn_directoryselect.bmp1KB
-
$PLUGINSDIR/btn_helper.bmp9KB
-
$PLUGINSDIR/btn_min.bmp2KB
-
$PLUGINSDIR/btn_next.bmp93KB
-
$PLUGINSDIR/btn_privacy.bmp13KB
-
$PLUGINSDIR/btn_srv.bmp13KB
-
$PLUGINSDIR/btn_website.bmp19KB
-
$PLUGINSDIR/button.bmp93KB
-
$PLUGINSDIR/checkbox1.bmp3KB
-
$PLUGINSDIR/checkbox2.bmp3KB
-
$PLUGINSDIR/ck_hide.bmp16KB
-
$PLUGINSDIR/ck_show.bmp16KB
-
$PLUGINSDIR/lb00.gif.gif 160KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/progressbar1.bmp5KB
-
$PLUGINSDIR/progressbar2.bmp8KB
-
bin/resources/version.xml32B
-
uninstall.exe.nsis45KB
-
【多多软件站-交流群】点击链接加入群聊.url159B
-
使用说明.txt596B
-
多多软件站-提供绿色软件和热门单机游戏下载.url151B
aipai_cliper.exe
- IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
- SHA256 ec9065f4158ef0195a1b1341cf60888966046fbb2a7a14335bb461f8ab764e5b
- MD5 d5d4d3dd9f1784059f2b236ca7ade449
- SHA1 21f0b86539164a62386da19e7447dd1fcd8ab5c1
- SHA512 a89039c3371625883b54cc53a163e05527428320ee52eed1e31179c31cd131a7b88670e6e4b50a8987dd2a90291818843bd6218155c28e9ff95816c0e3258abc
- SSDEEP 12288:iOTtAoEMr+7b+Xj7ivb9oiiG5H+xrBj+DX9gFUmZHwib0ZAKgWsO3dSCPN4QY:TyoEOOvbsl+b9pmRwiw1gTWdfPNY
- TLSH T135F423C72A05C47BC4121BB019B69D4B7FFB8C7496E9210797783D6218B37422BBE987
- MD5 SHA1 SHA512 SSDEEP TLSH
-
NSIS installer
Digest
42:64:ba:00:05:22:bd:7e:f9:57:af:18:c1:4e:40:50:a7:42:db:77:68:30:75:c5:e5:e7:78:0c:25:9c:cd:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号201房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 6, 2026
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号201房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号201房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号201房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
52:ea:24:b8:28:38:29:99:45:7a:f9:11
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 25, 2024 - Sep 26, 2027
Subject
CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE
Serial Number
01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 11, 2025 - Dec 10, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
0
Major OS version
4
Entry point
12812
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AnimGif.dll
- IMPHASH 6547d8bc6a3af52f06d7821153e62201
- SHA256 751d3b248db6bc83927e6e30c18180a547e1f3a04ab55e06776eb377a9563542
- MD5 6ebf230433155f750832677a49a30ee3
- SHA1 3115d72099f1cb0dc5eea01e1b19741194c66967
- SHA512 b938514e17b1cfb7e0a7334c835788dd6fc70fb74cfbb0a2c678f6686d5674440fae7e9402d38ed614e3d9b0824940d73ac3fea83808f9a4a9761f39149f6b3f
- SSDEEP 192:0nJ/LON9CxheJr/7H2B6lHv0hXbh3IQ5w:Y/e80JTvH2Xbq2w
- TLSH T16242F902AA01C1F3E453753A15AE3972EAEAE382A5705F8BC727EC6918201527D3D34A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GetFileSize
CreateFileA
ReadFile
ResetEvent
SetEvent
lstrcmpiA
CreateThread
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
CloseHandle
CreateEventA
lstrcpyA
GlobalFree
WaitForSingleObject
user32
CopyRect
ValidateRect
FillRect
InvalidateRect
SetRect
GetSysColor
FindWindowExA
IsWindowVisible
GetClientRect
GetDC
ReleaseDC
IsWindow
GetWindowLongA
SetWindowLongA
RedrawWindow
CallWindowProcA
gdi32
GetDeviceCaps
CreateSolidBrush
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetPixel
BitBlt
msvcrt
strtoul
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
play
stop
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=19, version=8022,
count=1, id=14, version=7299,
count=2, id=4, version=8797,
count=49, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=2, id=11, version=8799,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/BgWorker.dll
- IMPHASH db2755f409b81c4dbfc04f648cfb80b9
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- TLSH T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiA
GetModuleHandleA
CloseHandle
SetThreadPriority
CreateThread
user32
IsWindowUnicode
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
CallAndWait
Name
.text
Size
1024B
Virtual Size
987B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
66B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/Inetc.dll
- IMPHASH 6edde372ee153b5b1989f5f3ff74d493
- SHA256 d662da3c509ce0d4083d6bf502f7cae6ce15f42907e4ab04bc414da592480478
- MD5 4fcff2eff179f1001f9072376d980cec
- SHA1 2cbd03904717c24434b10cd2c79c70461674098b
- SHA512 e41ba1e953b93cddd744dfc1532e3f8ceb372b02d2b4c3eab0ba37a735396d967b0b8523181b2739995c14bd7fc601839f4a74a4f79397344ed8ad574adccdb7
- SSDEEP 384:v/WRIf3j70UHjUSuGDVFpy1Xe6Eo/HpXzQrNVpgwQ2WX0Ac9khYLMkIX0+GL0dH5:v/Wg3j70UD7xRbYe6EohjgawV4TIE
- TLSH T1F7F42980728CDCB3E1A077B59E1D12A2B0C00EC5571E3AE7A2ED564C34EA6E17AF5D1D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4261
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\client\xiaodao\mkup\nsis_yt\NSIS\Contrib\Inetc\Release\INetC.pdb
wininet
InternetQueryOptionA
InternetSetOptionA
InternetGetLastResponseInfoA
FtpOpenFileA
FtpCreateDirectoryA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestExA
HttpEndRequestA
HttpQueryInfoA
InternetErrorDlg
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
comctl32
ord17
kernel32
GlobalFree
GlobalAlloc
MultiByteToWideChar
LoadLibraryA
lstrlenA
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
MulDiv
WideCharToMultiByte
CreateFileA
DeleteFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
WaitForSingleObject
SleepEx
CreateThread
TerminateThread
GetTickCount
GetModuleHandleA
GetProcAddress
LocalAlloc
LocalFree
user32
SendDlgItemMessageA
SystemParametersInfoA
IsDialogMessageA
LoadIconA
FindWindowExA
GetParent
SetWindowLongA
GetWindowLongA
FillRect
MessageBoxA
GetWindowRect
GetClientRect
GetWindowTextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageA
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem
SetDlgItemTextA
SetWindowTextA
SetTimer
KillTimer
EnableWindow
UpdateWindow
GetDC
RedrawWindow
DrawTextA
gdi32
SelectObject
GetStockObject
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
get
head
post
put
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
730KB
Virtual Size
730KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=24123,
count=11, id=203, version=65501,
count=89, id=1, productName=Unmarked objects,
count=3, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
$PLUGINSDIR/NSIS7z.dll
- IMPHASH 5384af199ef3032c1515ee1f40d61d4f
- SHA256 1d437a6c34af37d497067cc8f8bdf00f7dcf767f5185b8abc971fcbee2b43e05
- MD5 ca45db26bb1c02b6eca5103d2acd0985
- SHA1 b6d38ed55e41bd61c3a8e36b60b1b49ae1ac348d
- SHA512 fd03327e141b1cbb400c1f28df780753ecdc4e8d0ae017b1aa62de9e7cc69fdb886dcdaf01a1aee06f3049fa91191abbce6ef1b2b258e184c5b23b3a1a876e8a
- SSDEEP 12288:AiTC6gj/AeeftSrpNxGaR/gneKTKL2Uar8P25j+tURrmw:AiTCXApuGaZgneKeLk8P5krm
- TLSH T14ED49D23B981C076E23F12318D18F7BD12FEB6754924966BB7981B6D1FB04C1AB19B13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
257396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalFree
FormatMessageA
FormatMessageW
GetFileInformationByHandle
SetLastError
DeviceIoControl
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
GetSystemTimeAsFileTime
GetStdHandle
WaitForMultipleObjects
GetTickCount
SetFileApisToOEM
SetFileApisToANSI
AreFileApisANSI
DeleteFileA
Sleep
GlobalAlloc
GlobalFree
lstrcpynA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileW
RemoveDirectoryA
RemoveDirectoryW
SetFileAttributesA
SetFileAttributesW
CreateSemaphoreA
GetTempPathW
GetCurrentProcessId
GetCurrentThreadId
GetTempPathA
MoveFileA
MoveFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
GetFileAttributesA
GetFileAttributesW
SetEndOfFile
GetCurrentProcess
GetSystemInfo
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
VirtualProtect
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateEventA
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
VirtualFree
VirtualAlloc
GetLastError
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetFileTime
CreateFileA
CreateTimerQueue
HeapSize
ReadConsoleW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
DuplicateHandle
GetCurrentThread
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapReAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FindFirstFileExA
user32
SendMessageA
CharUpperW
CharUpperA
GetDlgItem
wsprintfA
SetWindowTextA
FindWindowExA
advapi32
LookupPrivilegeValueA
SetFileSecurityW
AdjustTokenPrivileges
OpenProcessToken
oleaut32
VariantCopy
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
Extract
ExtractWithCallback
ExtractWithDetails
SubExtractWithCallback
SubThreadExtractWithCallback
Name
.text
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=155, id=243, version=40116,
count=30, id=242, version=40116,
count=24, id=259, version=24123,
count=106, id=261, version=24123,
count=36, id=260, version=24123,
count=1, id=206, version=65501,
count=15, id=203, version=65501,
count=254, id=1, productName=Unmarked objects,
count=41, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=127, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
$PLUGINSDIR/SkinBtn.dll
- IMPHASH baf2d405231cd43dae48df474a521d01
- SHA256 ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
- MD5 e4ec95271ff1bcebab49bdfed6817a22
- SHA1 2c03e97f4773aea80ecdb98a1482e5896fe4677b
- SHA512 771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
- SSDEEP 48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
- TLSH T1E691B6BF33C48EF5E056017B1E9319935B9E49715379912F942329866B60DABCA3C703
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5021
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiA
GlobalAlloc
lstrcpynA
GetModuleHandleA
GlobalFree
user32
InvalidateRect
GetParent
SetWindowLongA
CallWindowProcA
GetPropA
SendMessageA
DrawTextA
DrawStateA
LoadImageA
RemovePropA
GetWindowLongA
SetPropA
gdi32
GetObjectA
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
SetBkMode
msimg32
TransparentBlt
comctl32
_TrackMouseEvent
Init
Set
onClick
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
947B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=29, id=1, productName=Unmarked objects,
count=2, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
$PLUGINSDIR/SkinProgress.dll
- IMPHASH df38729be926f91d3390389029adf53b
- SHA256 888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
- MD5 cc037c4703d3ec257efeef2ce0a1a20e
- SHA1 b3d6cc8f687a31fb2c1a5921a38de9429af20502
- SHA512 120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
- TLSH T15E81833A76D109F3D01902BF169B49F3A7F545608375810D88B36E9EAB65E6BC87CB03
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4177
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyA
GlobalAlloc
GlobalFree
GetModuleHandleA
user32
GetWindowRect
BeginPaint
GetWindowDC
CallWindowProcA
ReleaseDC
EndPaint
GetWindowLongA
GetPropA
SetPropA
SetWindowLongA
RemovePropA
LoadImageA
SendMessageA
gdi32
DeleteDC
BitBlt
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
GetObjectA
DeleteObject
Set
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
797B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
254B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- TLSH T162324A1503904AF3F996C13C14263ABF7F792A218BF14E939FA39481BE2D5D96D39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10469
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/UserInfo.dll
- IMPHASH cce05dea98cbac3a9d486b233588f528
- SHA256 0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
- MD5 dada3e1836af78d5b24499da252d01e4
- SHA1 d2a1c25405e3c74973cf18dec2c7138df9e96a83
- SHA512 f8bda8413dadb00a644341da5e076f203a3134daaefd2961fa0341f5a533eee28582ce9872354ead698bb1275ee7726fa574267e909a3e2f977908392e7a5c66
- TLSH T19A81717B62A80CF3C0940BBB41D71CA71376DC702793011E99470E9A34C4AAFED6E705
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4713
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentProcess
GlobalAlloc
GetCurrentThread
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
advapi32
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
673B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/WndProc.dll
- IMPHASH b3f659d7637a91b4fec12ff9b930080d
- SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
- MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
- SHA1 b66ea0c10b08750295f2dc7c170b370402393214
- SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
- TLSH T1E951207317E005E2F4142BBD285B6BD7633BC27437A5C3DB816A49072A045EBBCB8756
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpyA
GlobalAlloc
user32
CallWindowProcA
SetWindowLongA
GetPropA
SetPropA
wsprintfA
onCallback
Name
.text
Size
1024B
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
377B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/bg.bmp
- SHA256 cf1a526eebb05064ee22ae02c74b84c9ddb72599c94a00185cb8b76411e989f9
- MD5 f7c10b5f4709abaae9ee1a4869dbe6ad
- SHA1 ee7c6186f0d41cb8a6c9bc1498b61bd8d3d14582
- SHA512 4e7db663432f893273d72743497609249d57c68018569d6540491c6f9b5e0fc0dfb061af734eee453ba23d7333202e335070f1d6ec9afa6e67075719de42fbb5
- SSDEEP 384:pMq2lYdBmldtfUNcZsaI5syP+O+EEnaZ5rE:F+O+daP4
- TLSH T118D4F595724CDCB365A077E5DE2C02A2F0C00EC9601D7E26A2ED978C79F5A6273E9D0D
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/bg_complete.bmp
- SHA256 94ad703fd44a629f16e39a07ad72995ddc617bd5d23c9cb038ff433df28fc743
- MD5 2f3d7f897bf77f62e20026149f2ded28
- SHA1 eba3110372cb73e33fbca9e2b06ef2c416d4531f
- SHA512 b66e2d9d0e02becdcd3d742a094c5c5edb454fb28554f71b0ac09cb292fc0c22162a54a21c067f765ad70c26fd3bfc4de0963c535562891dae2ab0ae2796bd17
- SSDEEP 384:pzRskwiqWcheb2sYsNcabmRApBtnfwMUNcOEaUVq4qo+JF/+SvHTrKncZn2:Nxuno+JF/rvHT+cA
- TLSH T16FD43655764CDCB765A177E5DE2C02A2F0C00EC9601C7E26A2ED978C39F962273EAD0D
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/bg_welcome.bmp
- SHA256 78a3430f3b4e8ef715df3896e88d6df5ebce625ee4a44764b54a1baee1747fd9
- MD5 2b67fca8317ee44a8d4b13bc9006ffb1
- SHA1 faf500dfb320900a8f1a166fda6ac21cccdbb554
- SHA512 18804e810f425d17fc2c1114b43e16b628edaf9f6de33383717fadb8ab0cfb23db4a4f9d679a8b789c8f02852998eb9f4a079d7513c6016a966c92a1a8807615
- SSDEEP 384:p3W0G2Y4PszTNVZu26FSYgxGCotKNc5a6xab+z4fZZvvIeEKniBnE:k0GN4PYZUC0OvvIevii
- TLSH T14ED405D5724CDCB765A077A58E1C02A2B0C00EC9601F7A26E2ED664C79F77227EE9D4C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_close.bmp
- SHA256 e68572cc808470587fedcff5da5671bee78dfb954d90a5fc8c10374565597664
- MD5 c37019be4a261359efa0cabfda13492d
- SHA1 195597c7b9f08240ce6cab902495773de834d17b
- SHA512 9fc63fc13de4942186db9acbf6489fb5f97c5ffc3858d5b4714511d44acefaae3e9eaeca2ae9b988a7d0904bfbbe550fa5ffa9c75fe9db4d35438d4a3523c6e6
- TLSH T14141312AB2AE52B0CCE033FC3DCC79526B2465D5A15E4A536BED86355E13206F0062EB
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/btn_complete.bmp
- SHA256 23f640813344821b7d29672b282a29dd645e76f19fd9ccd9c21754ee8119b5cf
- MD5 0b9ebcb2b92ef3a2dcfd7d42f39978d2
- SHA1 2005bc3f8972bbe286cf7cba485fa72388eb7d9c
- SHA512 fdf940e8923ea75b70c5415f1a72ad68b58182e1ee7c239a2e2e727c7e41b5fe7de651b8ea685d7f349b130f4c0f890e616d68c420461937db6a0b83d7b7e717
- SSDEEP 96:ZSMK1Oiiz6qIplCVe6D/7K24NqIplCVTMK1OiizX:ZSx1OitqIphNqIp8x1Oiy
- TLSH T17B938B6CCFEC6A633935AC6117AF3A2331A5CC801D94532A4B997548DDEE30C4AB17F8
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_directoryselect.bmp
- SHA256 866e469cd8070c1b646756934d45369fd410da951503b98728a9cb154b8b1266
- MD5 85b342e031effb6d4fad4a51276027b1
- SHA1 2630e5a7a6e18be7153bf9aa155f81705e1b0224
- SHA512 6bab2e2442f178e4a07140c29a10eba3c4e02804f05f6ef88479ea317435fc4c93cfb1838e72e85d0fdd534c1864bcea9d9accb1b9201e35dfcbadaadd7fd19c
- TLSH T12031262574CC25738C383B627E0F36EB380369C7AC184A1CDBC20107497DF940496A3A
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/btn_helper.bmp
- SHA256 ceb2ef27687f0f06b9760aad87c32e2c0a5d83558b7c606f0a6ea398230cc3c0
- MD5 129f864359131b157214eca7c70399e4
- SHA1 853237273bbe78511d096714f167028a80ce97fd
- SHA512 89a39153f1c1aa0e244d137891cdbadaf847dcde3829b1f7160aeb49b6b4513d1b4a6b0b28bb95d575778d46056fac37c38ac9106a127165ae924f8ccf027cd4
- SSDEEP 192:8jlkN3cG1RDwmkN3cG1RDwmkN3cG1RDwe:oiN3cG1RDwpN3cG1RDwpN3cG1RDwe
- TLSH T1C712B13472CC247F5475BB596F3FBDE732162AE60EA409D9E1E22DD001AEB49907B070
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_min.bmp
- SHA256 e21aa3f0aa8053c0e573928f06980454444868e097ceef3919dcf498e575c6c9
- MD5 bd95cc1b1d6c260e4b7f1228b0d4e1d4
- SHA1 29f687645e7a277d5394693278c1ae4279547a21
- SHA512 775d1064f39c4094bef9e58b1cbc87c71da89ccb9f503b29efa58798e7368c4eab9e32115b69bc67b927fb95bbd57a0e68e0376b6b2ec2c4d6cbd0bb99918e6f
- TLSH T10E51B603F54CCC36F5A63B248D9E9A3638509CC4064CBA4804FE5B5FB5EDD5A002ACEB
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/btn_next.bmp
- SHA256 981af44a05576b2f969ac37aa34f43bcee93cc97f51f477e68622878dc5be375
- MD5 a5ac314fbad0fc15f12b8e051b16cae2
- SHA1 fc876331f225ada8012a695a2be023eed7e1e178
- SHA512 0f6ef783c5863c4ce029ba560def07a398a1cc6082a606804c91855ebd6319a338017e08c5d085c5e7de71485f4fbb4988dfc767122353380a7746c1f58c75d4
- SSDEEP 96:ZSMUnrOvLq3l+38YzhU6mCgvl1mRYWQppTlLNJIU6mVMUnrOvLq3l+38YzX:ZShnicl+MO+Z/GYnK+Vhnicl+Mc
- TLSH T1E7937AADCFDC5A533A34AD1913AF362331A9C8942E90536A4B597414DCFE30D06B6BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_privacy.bmp
- SHA256 9b78ed0dfaf93307f463040c10fe286bd5ae9e7ad15fc7aa912136dd20a827aa
- MD5 808ceebe48ad270dce17adfe86cdad35
- SHA1 6074067707b29ef244f5be4cfc472e72de57d9df
- SHA512 7af179de71f30a0af905621a2bd1c894a886525b071a46782440a712fb10e43e4d09c67ca440f43bbb2bdf606668c87975b786f298f507636991ce2fa6c658bc
- SSDEEP 192:A5/UzhIw7uqQIuOXCYw0IuOXCYw0IuOXCYwWGuh1w4sFR:A5/VI1rw0I1rw0I1rwWG
- TLSH T125527D32F0AEED794280BF579EBC3B584D945AE0A5F314B11BC2928F6406E5376C13E9
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_srv.bmp
- SHA256 6e2914152a0d96aef7302e3dd965cf5b01024802fb4918393f09eba278732c1d
- MD5 062203f11d7f4932ee4401ec92c708e1
- SHA1 f7944e84b0605ea4dad83194d9a032bc07231208
- SHA512 49ffdec758297808e3981734ca2f79a27c23660dc1b7ee0b24d6470c31719cac74352c19c1bbbfab6f809f053f1a28b24eb21f9fb82c8d5421505926d31f3c26
- SSDEEP 96:A5df1hyhHkG91YIeXwKR1YIeXwKR1YIeXwKD5IhYoIkc1:A5df1hyhHIXBIXBIXR5IhYo6
- TLSH T1A252F436F4DEEC3542417F5B6EAC6B584D849AE0A9F314B12BC2934F2416E4376C13E9
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_website.bmp
- SHA256 3a05c20b0798e0d0e29c3c4181b679de756c4247869126067a7cff7afec7d517
- MD5 0d6ba1de46596c3bbe7f758a3a18c077
- SHA1 002dfaff00893269ce3dec9f1f3a3e47a9ba1fbe
- SHA512 e1b82da19ab787640005b2948e7c7cce0c54fe4d03930dde01660b01efb6a075210f30bac7120e5e9655b93b489bcbf7888ed0bfbc956594d1e9943fabc3d353
- SSDEEP 384:ncQvS35ogo48+gXQOSPNnWPdPPUQ+SW6ixS4X+VanF:JONnadHc
- TLSH T1F792AA9A77CF247A0D3177496E6F7B5BF23F05C2DA28D462DAF22E28503CA947252064
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/button.bmp
- SHA256 5d5ec75eee4b8fbb96cf813c6e0196643163ca4e176b17e4a482ecd18766dae5
- MD5 96b86e26fd6b7c559c6dc640932b09f8
- SHA1 e56b10a6f45faa8a9eca5269ff7ff57ccf7a0384
- SHA512 55e3deb0c05ae2ed89aa2d1b4d748ae9a80f2797a3e5948c2eafc691f8888e26a8efd404b86168c4e1808d1b126bd6d22f5489d5ee2d20e461ee23829f80ce29
- SSDEEP 192:ZSE0Wsg3BiRJSc1VdWh8AeYHdCCCCCCCCBCCCCCCCCCyCCcCCO/dCvHNYFWR6C1I:ZTmnt1WCrJLTHE
- TLSH T15B930F4ECFED8C073A712E85075F7993799AC680AE4247CA432A6A51DCEC79E11363F4
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/checkbox1.bmp
- SHA256 c3d888b505fa7dac6f8ef8687de42094f176ad71b8f0a50aa531d5a57908dd9b
- MD5 e71a6ff6406b7f189f7f5f76f9bfe006
- SHA1 225fc15df58434d6f1f8372a5a8a56ea968e7854
- SHA512 1d106c36c4f4bdf8e16913a9d63c6418d7f13ab5ba4398aa103acc1d61cf2d6ca6d34966689a704d0c266bb9e1b90c9d2012103a7124a64e05c93da96dc9447f
- TLSH T141614DBE783B76C17AB3A2F4B0457E3118C51DC83EE0FB4359D20E95B863B761688600
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/checkbox2.bmp
- SHA256 1db5d5cfc179d47bd0a178baf83a77ba1793f713501a43c9d2534842952b48d7
- MD5 e99a851bac35acd87b6c8c9d18dfc905
- SHA1 b93a6ce9829f82792285340f9c3d4b4a5006b0fb
- SHA512 70e172cd4184c6ed166b6ea8d635f591ba57889d02dbd555e0b131dd5019d9b4627aea144ec0d61e86ec8c84f9608fb852b09dc86cc307b92a8b382d99428a70
- TLSH T15F6193BE783F65C6BB7796F4B5157E3128852EC83DD0FB075AD60D486827B762389200
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/ck_hide.bmp
- SHA256 cc1097c0f554e0d8ab7bea8b403adbbd4a3dbc728c17572bb418ab7a21c49f2e
- MD5 e524f8bd058af45f04df8d386c2e2a64
- SHA1 9e0acabc998ae34603d4491070745fbac7af8a79
- SHA512 a8aef13b2a1e21e9ba8af844bba6b526b4de2b32559702efd5db7a1d80416e9759f7d3c78eb07f6dc9f1966492c6dd6f3f8974420281c0e1b213e2d580cad664
- SSDEEP 96:hwVSBWMUKuF8Vg2AdAmxW8KThmxW8KThmxW8KTwVSBWMUKuF8Vg2Ada:hwj3cYcYcsjE
- TLSH T12D726D21B98FB477DC653B2A6ECF7C076A4B46CB6CC01882C9C6175540BDE56F21A2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/ck_show.bmp
- SHA256 9d6aaba2edb1683a68775fa86b7a871709d316042768c3a1c45474896dd35cc7
- MD5 52a7bc32055a9de27c24e7ca6d915084
- SHA1 4d3f2e5a3aa3e4dd8bca639e2bc29bf091cf05eb
- SHA512 0c657ab25b31b272e676bcd7f71854b18453c7df1443f632561f4454ca1bc47cbab945ebe42cbb41d786701fd378eb8ee86271fedc145338ab431100feebfde7
- SSDEEP 96:hQ2/s3zlpND26Y6zxVNcYL/26Y6zxVNcYL/26Y6zxVNcYL82/s3zlpNV:hR
- TLSH T1B872A225B9CEA8B7AC763B162E9F7807364786C71CC82885C9C5168300FDF45F20A7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/lb00.gif
- SHA256 9589f753b452ea6df1aa2bf4fbacc15ecef1fad0d87d62fdf0434d03f078b939
- MD5 c0f826afd190c5da3d70da227246aa0d
- SHA1 1babde442d6342b713ec3eda2a61bc2fadbe870d
- SHA512 d686ae83a8c97b7d653b5b850fe373f4f7f8d661acfdfc0dad463849a3b61213a521945f37dc536c48ca3e7b02bb3f832cfc5f5476b0881bd2e0cd0693d99755
- SSDEEP 3072:+sJEGJ0hlbkRFRQ8ho2LNnme12A4lccthUswXefwMrEPHuX0V1+8+4l8BAOjvy:+sSGaTURW2LNmeoccHUlXefqOmIfKOj6
- TLSH T1B6F3125DE7948C095C85442E9CEE39B306BD32A7E0ECBBA097B1F59F61E02741B17B21
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
- SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
- MD5 eac1c3707970fe7c71b2d760c34763fa
- SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
- SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
- SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
- TLSH T108121A635A4455F3D5D7223A216A2F2FD77C9324A062BC0287779E462BF431A7E3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/progressbar1.bmp
- SHA256 1c3f9b23f6fc75f68f0d3157406ec06255f1a615cbfea56abac958403ba3f15b
- MD5 d82d5ee2ba08e557425b914e7e4ae925
- SHA1 b22fa8884f98b45c61146dfec328b90dcc07cf31
- SHA512 9dd620e712a1e4c213504fd28846cf5f6f3999bd3ab5aa11834082ccb28340751f999530cd0ab3dde4abd5838d456a37257c4c8e6dd5ad523a5820edf32df895
- SSDEEP 3:tAkpll+lFlB8rl8jlCfobobobobobobobobobobobobobobobobobobobobobobM:qIll+lfqrujXMdybQHwrKIxp
- TLSH T1FAC192032EC0B847E6B4A7B4741B322B369AE41D3C98121A3705A40A864EF20784A1F8
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/progressbar2.bmp
- SHA256 7b5830fcc15aac53e43e089d1cafbce3cc1d5a166f6676948cd60d5e8f7731eb
- MD5 7226fef7395bb869f5902b1df4d1d12e
- SHA1 da08903fcd040f99d950822dc87fbd5a6003bc2b
- SHA512 962d20731f72e76463778989028e6abe3ed744f86f0460fa80606b27da77b1ec0bb41f1d63aec5c388d98c60205700a866698747932bd466283b1a8ea864138c
- SSDEEP 3:qqkrl0l/3jlREURvx8kKG7PMVbSFWVbSFd+yrVx8kKG7il:ZKlcPjvCDG4VzVUYDGi
- TLSH T12E0248E53B2D88F6E082B3B80CED6149362081E878A3AF59E1E21020481B7663C9D480
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/resources/version.xml
- SHA256 85dd8a5b990bb3b16add42dc54ab5615e941c78dbecfb1a24d79c1a76122749b
- MD5 842bf46a4dd84a2fd33b4c5996efe491
- SHA1 11aa9e71eb126d133e6cbd13b83895795635d78f
- SHA512 869d509d15c88451e4eb8822e6f3a3a939ad0c01224ee6ca44b047a758de4b9b1f4fd3a280308559439f4f382255079bea67a402c3bf1253af4de03f55f91531
- MD5 SHA1 SHA512
uninstall.exe.nsis
- SHA256 f195d483ae50b5160a3ac049bc3dfa6a04e33824a8f8cee0b143e71c12d1a16c
- MD5 6c04d4274cd5f9dd0f6849b6509878ae
- SHA1 c62365ec1c7d32443630d51d34a4c41643ea276d
- SHA512 d1a0e215ac4ec41fb294e3619af00c1a4065892293b42ea37f0cf9356ec4a9154715a1c08953e4a6693bf910a8e9ee5c0a0803d6b7ac6fa1ec9d05e15dc40b7d
- SSDEEP 768:ghnq8qXACphVxh6W4VnB1Zi7PzJWS8ZhA2ifBRhYMPq6hFYHLUc35r2ap6O09K5Q:EchWLK7PzyhADFYqXYHLUcpp10l/u6xJ
- TLSH T10623F193B82BCE78E718D8710F67234A1FBA864873076426EBF45D2354A11345D76CEE
- MD5 SHA1 SHA512 SSDEEP TLSH
【多多软件站-交流群】点击链接加入群聊.url
- SHA256 3b10c3004ea794d27b95a901c8ce61c3168afa27f7885e27c16bbd5d44de8639
- MD5 a8f0fe295879119b6365410e0cc1ad49
- SHA1 d62d2c310106c15fd4be2ef542906c2e259d38d6
- SHA512 a8312763bb0b1d4c00e2ef4fa2e905743d140d8edb5553c441992c48dec40c5984ad700346e2fcd2cca22f43cf7b454a7ae9abeafc85b641a2568d1ec33bb1e2
- TLSH T165C02BAD0242CCCAC214944B6070FC0E9B0FB0620AD7D1BC3641DF892CEE0DAE04CB26
- MD5 SHA1 SHA512 TLSH
使用说明.txt
- SHA256 3a6d3ad537e94ce609a94c45b20397579d6878c2655b32e9f215e22b117ae9f2
- MD5 70007f8cc621daaa15483b4f57cb3c5d
- SHA1 5fbeb8a2d58a80b7948b60468a31c20a8f748a6b
- SHA512 e966a5c9f2f93a55b0d6bb80d007473204b701980b39e4cec0f7aaed9ee30f42333752b1d6b5096f131e5f3056c6681baa7a23b4b377ab59631cf2273bfa2b72
- TLSH T1F0F0C75B7297D136D67980EA12330242F44DD6D75507E891B53C0117AF973F415747F4
- MD5 SHA1 SHA512 TLSH
多多软件站-提供绿色软件和热门单机游戏下载.url
- SHA256 8ce5067162b095958f82aae58b375228d6f0e987ee643729f6c860c74a2be055
- MD5 45c18450ef1bb6b023956b704797f7b3
- SHA1 41dc152a5cb6e6fd8c8fb6e0203221c8fe0de3bb
- SHA512 e6844e78a5ab4e323b2d8fd2960a1da326d333dc3096fda1c1e030a76f25e22858754623176add769e6a86c54de6cd7d877b5005891dfff689662acf176bca7a
- TLSH T140C08CA80101C0C6D300800A20B0F909990F716009C2C2A92A45DF492C8D0C2E048665
- MD5 SHA1 SHA512 TLSH