f52902b93de09e862166ba74d7355f0e8931933d947108f30fade1d2b18e3564
- SHA256 f52902b93de09e862166ba74d7355f0e8931933d947108f30fade1d2b18e3564
Overview
overview
4Static
static
3aipai_recorder.exe
windows10-2004-x64
4aipai_recorder.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...if.dll
windows10-2004-x64
3$PLUGINSDI...if.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/Inetc.dll
windows10-2004-x64
3$PLUGINSDIR/Inetc.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...tn.dll
windows10-2004-x64
3$PLUGINSDI...tn.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
aipai_recorder.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
aipai_recorder.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Inetc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Inetc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSIS7z.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSIS7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/SkinBtn.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/SkinProgress.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/WndProc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/WndProc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target f52902b93de09e862166ba74d7355f0e8931933d947108f30fade1d2b18e3564
- Size 760KB
- Sample261110-wlk2tact7x
- SHA256 f52902b93de09e862166ba74d7355f0e8931933d947108f30fade1d2b18e3564
- MD5 3cd6caab45871a43283caf7723ae81c0
- SHA1 2a774cf5ebc1f6b3de4c0f70fd001d39e6e37b52
- SHA512 1ad032005ed91624dd264ad522551aea65bca0f28d03af0b79bf18b1b385c6ec8d35f5bdaabf3ad9e1d91199a868dbcc5f6fd5bfac946c9ac1842f5f28ae0f2c
- SSDEEP 12288:WT0vOSLtDAcXPcJg6pXkg/6Rz41LUu6/H2zrBj+tX9EFUmZH+8bs4KbzCly++Qk:jBEJgRg/6KLOel+l9FmR+8AdzUfzk
- TLSH T1C1F4338A365BEF030A1F418493C47453617E1C747D0FEE554AB96AF206A2E08BBAFF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/AnimGif.dll unpack002/$PLUGINSDIR/BgWorker.dll unpack002/$PLUGINSDIR/Inetc.dll unpack002/$PLUGINSDIR/NSIS7z.dll unpack002/$PLUGINSDIR/SkinBtn.dll unpack002/$PLUGINSDIR/SkinProgress.dll unpack002/$PLUGINSDIR/StdUtils.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/UserInfo.dll unpack002/$PLUGINSDIR/WndProc.dll unpack002/$PLUGINSDIR/nsDialogs.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/aipai_recorder.exe nsis_installer_1 static1/unpack001/aipai_recorder.exe nsis_installer_2
File Explorer
-
f52902b93de09e862166ba74d7355f0e8931933d947108f30fade1d2b18e3564.zip 760KB
-
aipai_recorder.exe.exe 789KB
-
$PLUGINSDIR/AnimGif.dll.dll 12KB
-
$PLUGINSDIR/BgWorker.dll.dll 2KB
-
$PLUGINSDIR/Inetc.dll.dll 766KB
-
$PLUGINSDIR/NSIS7z.dll.dll 624KB
-
$PLUGINSDIR/SkinBtn.dll.dll 4KB
-
$PLUGINSDIR/SkinProgress.dll.dll 4KB
-
$PLUGINSDIR/StdUtils.dll.dll 93KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/UserInfo.dll.dll 4KB
-
$PLUGINSDIR/WndProc.dll.dll 3KB
-
$PLUGINSDIR/bg.bmp593KB
-
$PLUGINSDIR/bg_complete.bmp593KB
-
$PLUGINSDIR/bg_welcome.bmp593KB
-
$PLUGINSDIR/btn_close.bmp2KB
-
$PLUGINSDIR/btn_complete.bmp93KB
-
$PLUGINSDIR/btn_directoryselect.bmp1KB
-
$PLUGINSDIR/btn_helper.bmp9KB
-
$PLUGINSDIR/btn_min.bmp2KB
-
$PLUGINSDIR/btn_next.bmp93KB
-
$PLUGINSDIR/btn_privacy.bmp13KB
-
$PLUGINSDIR/btn_srv.bmp13KB
-
$PLUGINSDIR/btn_website.bmp23KB
-
$PLUGINSDIR/button.bmp93KB
-
$PLUGINSDIR/checkbox1.bmp3KB
-
$PLUGINSDIR/checkbox2.bmp3KB
-
$PLUGINSDIR/lb00.gif.gif 131KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/progressbar1.bmp5KB
-
$PLUGINSDIR/progressbar2.bmp8KB
-
bin/resources/version.xml32B
-
uninstall.exe.nsis89KB
aipai_recorder.exe
- IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
- SHA256 938e00fbe6d818bc20fc30a05ff1fdac14c652d77f7b40a653db77c5cc284a16
- MD5 c5cb3ba57047fbf77549783444130ac8
- SHA1 0c70540146fd6e0571b66c101124fa7d6014258f
- SHA512 58984f5ff835ef549d34251d163f025d287aaab37fac0ca2b5d14b8203cc6bf928d9ba582fee031ab78c8dea022da7776b87fdfebec255b2f06c49129ddc76f8
- SSDEEP 12288:11BWX2WmBme6k/99CEwnN/sNWpXkg/6RzdhKI5H+xrBj+DX9gFUmZHwib0ZAKgWW:5F9anSbg/6prsl+b9pmRwiw1gTD1UDzw
- TLSH T15A0523C72B09C87BD9135AF001F25C9B3BF94D15AE58314207717AA13973A0A7F6EA87
- MD5 SHA1 SHA512 SSDEEP TLSH
-
NSIS installer
Digest
7a:29:62:b4:11:d7:3e:ac:ab:8a:d1:24:02:f6:c5:c3:92:05:d0:76:24:d7:90:28:6d:a7:a1:d4:17:4c:bf:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号302房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c06e5b9bfe5b79e,1.3.6.1.4.1.311.60.2.1.2=#0c06e5b9bfe4b89c,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 30, 2024
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号302房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c06e5b9bfe5b79e,1.3.6.1.4.1.311.60.2.1.2=#0c06e5b9bfe4b89c,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号302房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c06e5b9bfe5b79e,1.3.6.1.4.1.311.60.2.1.2=#0c06e5b9bfe4b89c,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=91440101MA9Y0A9B9D,CN=广州音视舞动网络科技有限公司,O=广州音视舞动网络科技有限公司,STREET=天河区建中路59号302房,L=广州,ST=广东,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c06e5b9bfe5b79e,1.3.6.1.4.1.311.60.2.1.2=#0c06e5b9bfe4b89c,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
48:1c:18:d7:52:22:ce:a7:9d:bf:90:a3
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 14, 2023 - Sep 14, 2024
Subject
CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE
Serial Number
01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 7, 2023 - Dec 9, 2034
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
0
Major OS version
4
Entry point
12812
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/AnimGif.dll
- IMPHASH 6547d8bc6a3af52f06d7821153e62201
- SHA256 751d3b248db6bc83927e6e30c18180a547e1f3a04ab55e06776eb377a9563542
- MD5 6ebf230433155f750832677a49a30ee3
- SHA1 3115d72099f1cb0dc5eea01e1b19741194c66967
- SHA512 b938514e17b1cfb7e0a7334c835788dd6fc70fb74cfbb0a2c678f6686d5674440fae7e9402d38ed614e3d9b0824940d73ac3fea83808f9a4a9761f39149f6b3f
- SSDEEP 192:0nJ/LON9CxheJr/7H2B6lHv0hXbh3IQ5w:Y/e80JTvH2Xbq2w
- TLSH T16242F902AA01C1F3E453753A15AE3972EAEAE382A5705F8BC727EC6918201527D3D34A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GetFileSize
CreateFileA
ReadFile
ResetEvent
SetEvent
lstrcmpiA
CreateThread
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
CloseHandle
CreateEventA
lstrcpyA
GlobalFree
WaitForSingleObject
user32
CopyRect
ValidateRect
FillRect
InvalidateRect
SetRect
GetSysColor
FindWindowExA
IsWindowVisible
GetClientRect
GetDC
ReleaseDC
IsWindow
GetWindowLongA
SetWindowLongA
RedrawWindow
CallWindowProcA
gdi32
GetDeviceCaps
CreateSolidBrush
StretchBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetPixel
BitBlt
msvcrt
strtoul
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
play
stop
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
136B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=19, version=8022,
count=1, id=14, version=7299,
count=2, id=4, version=8797,
count=49, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=2, id=11, version=8799,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/BgWorker.dll
- IMPHASH db2755f409b81c4dbfc04f648cfb80b9
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- TLSH T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiA
GetModuleHandleA
CloseHandle
SetThreadPriority
CreateThread
user32
IsWindowUnicode
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
CallAndWait
Name
.text
Size
1024B
Virtual Size
987B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
66B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/Inetc.dll
- IMPHASH 4429f3d0d67adcb6a5d408a8fd951976
- SHA256 f9ef059e032da673eec4098108d83d08dae124a6f8749d99971f92fb85b5f67d
- MD5 b1e340a291c7b01170a71d2b9c8a4d87
- SHA1 b8ebdbb058bf9286383026b4bbe8ba3936d09ac9
- SHA512 64195985994cb6d449a21c76810943e40f6848b312177b88e0cb7ecc69c81d2b8957306d80eb339d4e14a84017f302ddd2ceaee973e1987ba140b2cf7d34cefa
- SSDEEP 384:6W9qjPs7naXNUmu2DrwdNqQ/P3pX1r+59NG1W20Ac9khYLMkIX0+GJ0dp5QHq2DL:6WqPs7nadnB3YIQXZ0vNFEMJ0a
- TLSH T165F42980728CDCB3E1A077B59E1D12A2B0C00EC5571E3AE7A2ED564C34EA6E17AF5D1D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4261
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\client\aipai_recorder\mkup\nsis_yt\NSIS\Contrib\Inetc\Release\INetC.pdb
wininet
InternetQueryOptionA
InternetSetOptionA
InternetGetLastResponseInfoA
FtpOpenFileA
FtpCreateDirectoryA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestExA
HttpEndRequestA
HttpQueryInfoA
InternetErrorDlg
InternetWriteFile
InternetSetFilePointer
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA
comctl32
ord17
kernel32
GlobalFree
GlobalAlloc
MultiByteToWideChar
LoadLibraryA
lstrlenA
lstrcatA
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
MulDiv
WideCharToMultiByte
CreateFileA
DeleteFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
WaitForSingleObject
SleepEx
CreateThread
TerminateThread
GetTickCount
GetModuleHandleA
GetProcAddress
LocalAlloc
LocalFree
user32
SetTimer
SystemParametersInfoA
IsDialogMessageA
LoadIconA
FindWindowExA
GetParent
SetWindowLongA
GetWindowLongA
FillRect
MessageBoxA
GetWindowRect
GetClientRect
GetWindowTextA
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageA
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
CreateDialogParamA
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
KillTimer
EnableWindow
DrawTextA
UpdateWindow
GetDC
RedrawWindow
gdi32
SelectObject
GetStockObject
DeleteObject
CreateSolidBrush
SetBkMode
SetTextColor
get
head
post
put
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
730KB
Virtual Size
730KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=24123,
count=11, id=203, version=65501,
count=90, id=1, productName=Unmarked objects,
count=3, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
$PLUGINSDIR/NSIS7z.dll
- IMPHASH 5384af199ef3032c1515ee1f40d61d4f
- SHA256 1d437a6c34af37d497067cc8f8bdf00f7dcf767f5185b8abc971fcbee2b43e05
- MD5 ca45db26bb1c02b6eca5103d2acd0985
- SHA1 b6d38ed55e41bd61c3a8e36b60b1b49ae1ac348d
- SHA512 fd03327e141b1cbb400c1f28df780753ecdc4e8d0ae017b1aa62de9e7cc69fdb886dcdaf01a1aee06f3049fa91191abbce6ef1b2b258e184c5b23b3a1a876e8a
- SSDEEP 12288:AiTC6gj/AeeftSrpNxGaR/gneKTKL2Uar8P25j+tURrmw:AiTCXApuGaZgneKeLk8P5krm
- TLSH T14ED49D23B981C076E23F12318D18F7BD12FEB6754924966BB7981B6D1FB04C1AB19B13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
257396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalFree
FormatMessageA
FormatMessageW
GetFileInformationByHandle
SetLastError
DeviceIoControl
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
GetSystemTimeAsFileTime
GetStdHandle
WaitForMultipleObjects
GetTickCount
SetFileApisToOEM
SetFileApisToANSI
AreFileApisANSI
DeleteFileA
Sleep
GlobalAlloc
GlobalFree
lstrcpynA
lstrcpyA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExW
LoadLibraryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
DeleteFileW
RemoveDirectoryA
RemoveDirectoryW
SetFileAttributesA
SetFileAttributesW
CreateSemaphoreA
GetTempPathW
GetCurrentProcessId
GetCurrentThreadId
GetTempPathA
MoveFileA
MoveFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
GetFileAttributesA
GetFileAttributesW
SetEndOfFile
GetCurrentProcess
GetSystemInfo
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
VirtualProtect
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateEventA
ReleaseSemaphore
WaitForSingleObject
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
VirtualFree
VirtualAlloc
GetLastError
CloseHandle
WriteFile
SetFilePointer
ReadFile
GetFileSize
CreateFileW
SetFileTime
CreateFileA
CreateTimerQueue
HeapSize
ReadConsoleW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
DuplicateHandle
GetCurrentThread
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapReAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FindFirstFileExA
user32
SendMessageA
CharUpperW
CharUpperA
GetDlgItem
wsprintfA
SetWindowTextA
FindWindowExA
advapi32
LookupPrivilegeValueA
SetFileSecurityW
AdjustTokenPrivileges
OpenProcessToken
oleaut32
VariantCopy
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
Extract
ExtractWithCallback
ExtractWithDetails
SubExtractWithCallback
SubThreadExtractWithCallback
Name
.text
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=241, version=40116,
count=155, id=243, version=40116,
count=30, id=242, version=40116,
count=24, id=259, version=24123,
count=106, id=261, version=24123,
count=36, id=260, version=24123,
count=1, id=206, version=65501,
count=15, id=203, version=65501,
count=254, id=1, productName=Unmarked objects,
count=41, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=127, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
$PLUGINSDIR/SkinBtn.dll
- IMPHASH baf2d405231cd43dae48df474a521d01
- SHA256 ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
- MD5 e4ec95271ff1bcebab49bdfed6817a22
- SHA1 2c03e97f4773aea80ecdb98a1482e5896fe4677b
- SHA512 771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
- SSDEEP 48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
- TLSH T1E691B6BF33C48EF5E056017B1E9319935B9E49715379912F942329866B60DABCA3C703
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5021
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcmpiA
GlobalAlloc
lstrcpynA
GetModuleHandleA
GlobalFree
user32
InvalidateRect
GetParent
SetWindowLongA
CallWindowProcA
GetPropA
SendMessageA
DrawTextA
DrawStateA
LoadImageA
RemovePropA
GetWindowLongA
SetPropA
gdi32
GetObjectA
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
SetBkMode
msimg32
TransparentBlt
comctl32
_TrackMouseEvent
Init
Set
onClick
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
947B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=29, id=1, productName=Unmarked objects,
count=2, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
$PLUGINSDIR/SkinProgress.dll
- IMPHASH df38729be926f91d3390389029adf53b
- SHA256 888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
- MD5 cc037c4703d3ec257efeef2ce0a1a20e
- SHA1 b3d6cc8f687a31fb2c1a5921a38de9429af20502
- SHA512 120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
- TLSH T15E81833A76D109F3D01902BF169B49F3A7F545608375810D88B36E9EAB65E6BC87CB03
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4177
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyA
GlobalAlloc
GlobalFree
GetModuleHandleA
user32
GetWindowRect
BeginPaint
GetWindowDC
CallWindowProcA
ReleaseDC
EndPaint
GetWindowLongA
GetPropA
SetPropA
SetWindowLongA
RemovePropA
LoadImageA
SendMessageA
gdi32
DeleteDC
BitBlt
CreateCompatibleBitmap
StretchBlt
SelectObject
CreateCompatibleDC
GetObjectA
DeleteObject
Set
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
797B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
254B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/StdUtils.dll
- IMPHASH ecbe1fbe5190eab5d326930114ad14a8
- SHA256 c18b46a68436d164c964ba9b208e5c27ccc50e6a5a2db115e8fb086663b5308f
- MD5 21d805663834f61cb443545b8883faf2
- SHA1 b222c5ca1e4cb8a7bff7eb7b78d46b8d99bf71e1
- SHA512 37836150ef2837f69b82399024d0b93dbdac992971c7fe7b50959107c0520f5874d45f4230f08554514e3bd6a76d6e35c55c8afd53f993aba18f77475ef02001
- SSDEEP 1536:fn3DhuJJT35gGtLjbMGCDsTF7RqXqOGrgCf46qKn6LJ8Lr7f59aguhrAPfKS:fnNuJJT35gGtjMhDsTF7RqXqf8ZQEwy
- TLSH T180934AA3E097ACF1D58B0ABD0429BB2B4DFF0B3954359F3A13415687D678106EA2E347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
59915
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
??3@YAXPAX@Z
isspace
_msize
setlocale
iscntrl
sscanf
_beginthreadex
time
srand
rand
clock
_getpid
_splitpath
strncpy
strchr
isgraph
__getmainargs
_strnicmp
_stricmp
calloc
free
_wcsicmp
_snprintf
swscanf
abort
??2@YAPAXI@Z
memset
memcpy
shlwapi
ord176
crypt32
CryptProtectData
CryptUnprotectData
kernel32
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
HeapValidate
InterlockedDecrement
InterlockedIncrement
GetSystemTime
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSection
SystemTimeToFileTime
TerminateThread
WaitForSingleObject
LocalFree
GetFullPathNameA
GetVersion
GetCommandLineA
GetVersionExA
LoadLibraryW
FreeLibrary
CloseHandle
lstrcpynA
GlobalAlloc
GetExitCodeProcess
LeaveCriticalSection
EnterCriticalSection
GetTickCount
Sleep
VerSetConditionMask
GetCurrentProcess
GetModuleHandleW
GetVersionExW
TerminateProcess
RaiseException
VerifyVersionInfoW
GetLastError
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
FatalAppExitA
CreateFileA
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
GetFileAttributesA
user32
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
wsprintfA
DestroyWindow
SetTimer
KillTimer
LoadStringW
MessageBoxA
GetWindowThreadProcessId
AllowSetForegroundWindow
UnregisterClassA
CreateWindowExA
RegisterClassA
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
shell32
ShellExecuteExA
SHFileOperationA
ShellExecuteA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
AppendToFile
ExecShellAsUser
ExecShellWaitEx
FormatStr
FormatStr2
FormatStr3
GetAllParameters
GetDays
GetDirectoryPart
GetDrivePart
GetExtensionPart
GetFileNamePart
GetHours
GetLibVersion
GetMinutes
GetOsEdition
GetOsReleaseId
GetOsReleaseName
GetParameter
GetParentPath
GetRealOsBuildNo
GetRealOsName
GetRealOsVersion
HashFile
HashText
InvokeShellVerb
NormalizePath
ParameterCnt
ParameterStr
ProtectStr
Rand
RandBytes
RandList
RandMax
RandMinMax
RevStr
SHFileCopy
SHFileMove
ScanStr
ScanStr2
ScanStr3
SetVerboseMode
SplitPath
StrFromUtf8
StrToUtf8
TestParameter
Time
TimerCreate
TimerDestroy
TrimStr
TrimStrLeft
TrimStrRight
UnprotectStr
ValidDomainName
ValidFileName
ValidPathSpec
VerifyRealOsBuildNo
VerifyRealOsVersion
WaitForProcEx
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=3, id=4, version=8047,
count=4, id=14, version=7299,
count=1, id=48, version=9044,
count=25, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- TLSH T162324A1503904AF3F996C13C14263ABF7F792A218BF14E939FA39481BE2D5D96D39312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10469
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/UserInfo.dll
- IMPHASH cce05dea98cbac3a9d486b233588f528
- SHA256 0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
- MD5 dada3e1836af78d5b24499da252d01e4
- SHA1 d2a1c25405e3c74973cf18dec2c7138df9e96a83
- SHA512 f8bda8413dadb00a644341da5e076f203a3134daaefd2961fa0341f5a533eee28582ce9872354ead698bb1275ee7726fa574267e909a3e2f977908392e7a5c66
- TLSH T19A81717B62A80CF3C0940BBB41D71CA71376DC702793011E99470E9A34C4AAFED6E705
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4713
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
GetCurrentProcess
GlobalAlloc
GetCurrentThread
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
lstrcpynA
advapi32
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
GetAccountType
GetName
GetOriginalAccountType
Name
.text
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
673B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/WndProc.dll
- IMPHASH b3f659d7637a91b4fec12ff9b930080d
- SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
- MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
- SHA1 b66ea0c10b08750295f2dc7c170b370402393214
- SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
- TLSH T1E951207317E005E2F4142BBD285B6BD7633BC27437A5C3DB816A49072A045EBBCB8756
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpyA
GlobalAlloc
user32
CallWindowProcA
SetWindowLongA
GetPropA
SetPropA
wsprintfA
onCallback
Name
.text
Size
1024B
Virtual Size
934B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
377B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/bg.bmp
- SHA256 9692fe81dd8a5895ed28b31f6f033bdeb7156175e749470060fa0ba2654bb068
- MD5 c199844c46e40caf16e1cc7170b9d67c
- SHA1 cd4e8635a06bb49199bd75dcdb1b6ef803f8c8f7
- SHA512 3cca970b15de0ed720ade363fd03a0d6e38df8e11fde328ac87be028a3e38b13eb32a94b58045b64373572216721322a268c3e6350196b63fb0c3601b73ae09c
- SSDEEP 768:oftvMpDygcLdWu/l97cAvkDXZsijM8AjhgNVqfQM:ECNEJ
- TLSH T16DD4A431358C5D73A1627FA18D2D312250A49AF4EFEC752061F822EF9EDE74723B8619
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/bg_complete.bmp
- SHA256 171730c41fd89025ff8860118eecc3a647b24e0637561393646c3e0e0fe8dbb7
- MD5 8860704984e440df395ca2c6b6f6f3b4
- SHA1 58f1bd8b1f4765ddee1d22abf0fbe2c70dd51d04
- SHA512 ed2b40575d442d4bec6db9d5e6f4dd6fbed26f67872ebb799c094b8e9fe6b967e1c18913e5bd79d988ce621462a140cfbe691ec85f7edc57239e34fe25c06e04
- SSDEEP 768:x2VdI+FWIhxcXIaxrGKxLJll/D8rxUDZ+Zl1nrluNZAyEcLtxrOJw:O4gXFR2tBd
- TLSH T156D4F531358C9D73A1627FA18D2D312250A49AF4EFEC752061F822EF5EEE74723B4619
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/bg_welcome.bmp
- SHA256 9390f1a6280334ae08b43bc5186a949fabcf8ed447ba69bedc87fceb84130815
- MD5 f4ba614d15348dcbb307e3189777248e
- SHA1 a931f5f2052d7393a84dde2737052ca360aec6eb
- SHA512 d7b19e8fe790525c1ad0b17794146464181c4746cd3b807f942bb78c9fc881d423ccdcabac71ab1f91fb323fae37c34cfb333b2a0cedf2a090c2cd96a681e89a
- SSDEEP 768:C5wzvW7pye96w061+0+++w+++x+KKfgcLL/u/aaIx4gkd7L1m3YjeiSeAZOstViK:Twj9VkWc01B
- TLSH T1FDD4B3F1348C5D73A1527FA18D2C311270A499E4EFAF7520E1F422AA4EEF7472FA4619
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_close.bmp
- SHA256 053028840736e77fb0fdf4a7013b8190a7602a2a462e23fc2bf86c4bf5f44a83
- MD5 41844c5165d8737c5c1cae7ddc595d63
- SHA1 4b328c2502e0457ba6009cd90eead981b6eb1ad7
- SHA512 64d77800382ef463b5343967d3de2254303b61813aacb4f2c6dae7f7155a443c222a0dd04202d1d77ac2e4b4704cb9888faa0def0e999976fcb115d027e444ab
- TLSH T16E411E9BB74D54BDC0B533387D8C4622148024CD22568B1AF2EAB254B6D35DE62A682B
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/btn_complete.bmp
- SHA256 f92d32308436b2aa4de9e8b6c6389367a5db33e25a404ab0f8b6ff7236f6f2a7
- MD5 7002497aea09d8e59d3e0231d1660a20
- SHA1 6b46e72a18fe845acb66f75989f93aa0e2210945
- SHA512 50e8876b79be3698e0bfb3e56084c907c51de9031f7a9a3021d088e8a75431b34d87bcc298b7aefc7b07c1cf83a7ede72435aed2e742e7b8dec093c13a2ee131
- SSDEEP 96:ZFPmkGRkcfd/xtp69joOCcwDRkcfd/xhPmkX:ZUDRDHtperCrDRDHgy
- TLSH T1BB935449E0D8428644173EC8E1973CFF879EDAE3EC6AB4F1DD4ED875281A2D260B4971
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_directoryselect.bmp
- SHA256 866e469cd8070c1b646756934d45369fd410da951503b98728a9cb154b8b1266
- MD5 85b342e031effb6d4fad4a51276027b1
- SHA1 2630e5a7a6e18be7153bf9aa155f81705e1b0224
- SHA512 6bab2e2442f178e4a07140c29a10eba3c4e02804f05f6ef88479ea317435fc4c93cfb1838e72e85d0fdd534c1864bcea9d9accb1b9201e35dfcbadaadd7fd19c
- TLSH T12031262574CC25738C383B627E0F36EB380369C7AC184A1CDBC20107497DF940496A3A
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/btn_helper.bmp
- SHA256 ceb2ef27687f0f06b9760aad87c32e2c0a5d83558b7c606f0a6ea398230cc3c0
- MD5 129f864359131b157214eca7c70399e4
- SHA1 853237273bbe78511d096714f167028a80ce97fd
- SHA512 89a39153f1c1aa0e244d137891cdbadaf847dcde3829b1f7160aeb49b6b4513d1b4a6b0b28bb95d575778d46056fac37c38ac9106a127165ae924f8ccf027cd4
- SSDEEP 192:8jlkN3cG1RDwmkN3cG1RDwmkN3cG1RDwe:oiN3cG1RDwpN3cG1RDwpN3cG1RDwe
- TLSH T1C712B13472CC247F5475BB596F3FBDE732162AE60EA409D9E1E22DD001AEB49907B070
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_min.bmp
- SHA256 9a22ee8cb4f0fcc5e503e2ec36609243e59537fa9af7e8db8894b567df9ebee7
- MD5 bcd4098ef0971b9bbf7bf034df73a737
- SHA1 2b0f3807bba3a1024388b6b6c47f3cd4490817ec
- SHA512 a721c319c68ddfbe4cd09686af713809b833641a49cc2fcd6d3c8cb36723b8518c30d89c346974fac3e12d2f85ab968496a12cc27c243249a700779c044f26ea
- TLSH T1FA51E5CA2A1908C0D30F2C33DBF5B10816844C68F80402205082BEE30B3FACB7EBCB90
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/btn_next.bmp
- SHA256 f61f32edbec9ceb49c1322246c85eec650e8265791298b9375f81cc8c92a9ea2
- MD5 446f3e33ed7d44db2fb27aa7714a1143
- SHA1 2a289e4930cd5d747bef6edd62807c49ee49d27f
- SHA512 a468ee7327ebecb579156ecb4ec062ae77b189d84fa49d1c4ec781cab706c4b4f30dd749f4559906a2d81bc5b333c1490bd0a857ba9a76b6dd357389d799aae8
- SSDEEP 192:ZKTCx7q3XRarlbcsNN0YJMRarlb+TCx7q3W:ZVkarlbcs4YJaarlbBz
- TLSH T14F93414AE0D8428644273EC8E1573CFF839EDEE3DC6AB4F1D94EE875542A2D260B4971
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_privacy.bmp
- SHA256 9b78ed0dfaf93307f463040c10fe286bd5ae9e7ad15fc7aa912136dd20a827aa
- MD5 808ceebe48ad270dce17adfe86cdad35
- SHA1 6074067707b29ef244f5be4cfc472e72de57d9df
- SHA512 7af179de71f30a0af905621a2bd1c894a886525b071a46782440a712fb10e43e4d09c67ca440f43bbb2bdf606668c87975b786f298f507636991ce2fa6c658bc
- SSDEEP 192:A5/UzhIw7uqQIuOXCYw0IuOXCYw0IuOXCYwWGuh1w4sFR:A5/VI1rw0I1rw0I1rwWG
- TLSH T125527D32F0AEED794280BF579EBC3B584D945AE0A5F314B11BC2928F6406E5376C13E9
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_srv.bmp
- SHA256 6e2914152a0d96aef7302e3dd965cf5b01024802fb4918393f09eba278732c1d
- MD5 062203f11d7f4932ee4401ec92c708e1
- SHA1 f7944e84b0605ea4dad83194d9a032bc07231208
- SHA512 49ffdec758297808e3981734ca2f79a27c23660dc1b7ee0b24d6470c31719cac74352c19c1bbbfab6f809f053f1a28b24eb21f9fb82c8d5421505926d31f3c26
- SSDEEP 96:A5df1hyhHkG91YIeXwKR1YIeXwKR1YIeXwKD5IhYoIkc1:A5df1hyhHIXBIXBIXR5IhYo6
- TLSH T1A252F436F4DEEC3542417F5B6EAC6B584D849AE0A9F314B12BC2934F2416E4376C13E9
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/btn_website.bmp
- SHA256 34d61230db7c55b446cb8d2e854bf20fb3b4750d4efd72a648aedad376e4a1e0
- MD5 cb011e435c63041b9cefd50d339593b7
- SHA1 691092336c054fc64cf718a52ca8133f779971b4
- SHA512 074b606b2fed93ddffd29a35ad59a6813f9427034b9c06a67ffc1dbed73606f778890df4f4cd955ab110670bec57c9d606b18cb340408c3125559233a86795d9
- SSDEEP 384:mUL2pfk/qEyOkPrcbmkfIne2cjXaR28L2NfkGC7yOkTrIIm9:gIIe2IaR2Ve
- TLSH T18EB2C9087BCC9D73A0B23F648C9F357B75994AC09E68436464C461ADCEDF71EAA520EC
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/button.bmp
- SHA256 e08384174a723371eaaf87075640315dc1ee18678c19568258e2aeed53456c0f
- MD5 2c1ad9abc4a87fb2148aa6cbe7db60a8
- SHA1 0c2d1e72a1c28bf549c8b5e4a41377e46c6b45cd
- SHA512 03d9515fff3d0154463061fa6d22d9bdc86b771f47460c28ad251dc153da99dd16c61906f7db0bf87e6c95df8b9855dce3ffcce64e7a4817dbe22ec2d0c2528a
- SSDEEP 48:ZFZ8GzlRmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm3:ZFCGRVxtU+RVxhCX
- TLSH T1C9935009E0D8428684173DC8E1973CFF879FE6E3AC2AB5F1DD4EC875680A2D260B5971
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/checkbox1.bmp
- SHA256 c3d888b505fa7dac6f8ef8687de42094f176ad71b8f0a50aa531d5a57908dd9b
- MD5 e71a6ff6406b7f189f7f5f76f9bfe006
- SHA1 225fc15df58434d6f1f8372a5a8a56ea968e7854
- SHA512 1d106c36c4f4bdf8e16913a9d63c6418d7f13ab5ba4398aa103acc1d61cf2d6ca6d34966689a704d0c266bb9e1b90c9d2012103a7124a64e05c93da96dc9447f
- TLSH T141614DBE783B76C17AB3A2F4B0457E3118C51DC83EE0FB4359D20E95B863B761688600
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/checkbox2.bmp
- SHA256 1db5d5cfc179d47bd0a178baf83a77ba1793f713501a43c9d2534842952b48d7
- MD5 e99a851bac35acd87b6c8c9d18dfc905
- SHA1 b93a6ce9829f82792285340f9c3d4b4a5006b0fb
- SHA512 70e172cd4184c6ed166b6ea8d635f591ba57889d02dbd555e0b131dd5019d9b4627aea144ec0d61e86ec8c84f9608fb852b09dc86cc307b92a8b382d99428a70
- TLSH T15F6193BE783F65C6BB7796F4B5157E3128852EC83DD0FB075AD60D486827B762389200
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/lb00.gif
- SHA256 fc618593c7797a43664cd76be1ae30205d3121379dc3171b2e173aabe10fc024
- MD5 3bc3be087bd90870f34e83291f57d0aa
- SHA1 d84d09039fd805e35848f1c0115bc00ff07a8fb3
- SHA512 6abdfabdf8c1570c9fa2ffbb3b799b6dcc6ae293c5d04c689b73d2ad1f4e721b7657b461891ca3e5dc7bfade284704a394063fdb0a8858ae36075e0ec842d67e
- SSDEEP 3072:emKkDGvGa/i1oiB1b3c5GopXb8R4e/bSGVv7kBN/:emVDGvGa/UrsxNbalVC/
- TLSH T1C0D3126FF696E8357814CBC027F4692C6AF1C8C022614C999145FBB9A7F485B69CCB8C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
- SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
- MD5 eac1c3707970fe7c71b2d760c34763fa
- SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
- SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
- SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
- TLSH T108121A635A4455F3D5D7223A216A2F2FD77C9324A062BC0287779E462BF431A7E3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
620B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/progressbar1.bmp
- SHA256 1c3f9b23f6fc75f68f0d3157406ec06255f1a615cbfea56abac958403ba3f15b
- MD5 d82d5ee2ba08e557425b914e7e4ae925
- SHA1 b22fa8884f98b45c61146dfec328b90dcc07cf31
- SHA512 9dd620e712a1e4c213504fd28846cf5f6f3999bd3ab5aa11834082ccb28340751f999530cd0ab3dde4abd5838d456a37257c4c8e6dd5ad523a5820edf32df895
- SSDEEP 3:tAkpll+lFlB8rl8jlCfobobobobobobobobobobobobobobobobobobobobobobM:qIll+lfqrujXMdybQHwrKIxp
- TLSH T1FAC192032EC0B847E6B4A7B4741B322B369AE41D3C98121A3705A40A864EF20784A1F8
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/progressbar2.bmp
- SHA256 7b5830fcc15aac53e43e089d1cafbce3cc1d5a166f6676948cd60d5e8f7731eb
- MD5 7226fef7395bb869f5902b1df4d1d12e
- SHA1 da08903fcd040f99d950822dc87fbd5a6003bc2b
- SHA512 962d20731f72e76463778989028e6abe3ed744f86f0460fa80606b27da77b1ec0bb41f1d63aec5c388d98c60205700a866698747932bd466283b1a8ea864138c
- SSDEEP 3:qqkrl0l/3jlREURvx8kKG7PMVbSFWVbSFd+yrVx8kKG7il:ZKlcPjvCDG4VzVUYDGi
- TLSH T12E0248E53B2D88F6E082B3B80CED6149362081E878A3AF59E1E21020481B7663C9D480
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/resources/version.xml
- SHA256 85dd8a5b990bb3b16add42dc54ab5615e941c78dbecfb1a24d79c1a76122749b
- MD5 842bf46a4dd84a2fd33b4c5996efe491
- SHA1 11aa9e71eb126d133e6cbd13b83895795635d78f
- SHA512 869d509d15c88451e4eb8822e6f3a3a939ad0c01224ee6ca44b047a758de4b9b1f4fd3a280308559439f4f382255079bea67a402c3bf1253af4de03f55f91531
- MD5 SHA1 SHA512
uninstall.exe.nsis
- SHA256 9eb6394a5fa16a978d90587833bee86190f6efff7abb534aad453305a3bbc182
- MD5 f6f65f4371d0a5a76601f4b4296918bf
- SHA1 88085aeb320ab73d2e5cd60da25734ff56db6bbc
- SHA512 e49839ae6a59da5a9b5f9c76e6644fe4da5efb93007c90fe938b101d24b88c73418a8e1a2ba4c2d2872f881cfc12955795a9e10fbf97bd47992506d407d6c123
- SSDEEP 1536:UbFSyhWwNqu9yl1yP+BfJX02t16xojr6RSijlOggDMBHWP+8xLIIIobAp+:mNhoWgIP+3lOxojrKvsJD9PAIGs
- TLSH T100930216ED0BCE14CB25C879034748A437F929977B26213105E39777E8B6A5CFE24CD9
- MD5 SHA1 SHA512 SSDEEP TLSH