» emacleoverlays_x64.dll
Overview
Analysis
File Details
Behaviors (1)

emacleoverlays_x64.dll

Tongbupan

Net263 Ltd.

File name:

Publisher:

Yimeiyun (Beijing) Information Technology Co., Ltd. (signed by Net263 Ltd.)

Product:

Tongbupan

Description:

EmacleOverlays DLL

Version:

1, 0, 4

MD5:

96a5335ed333262c907845d249413d3b

SHA-1:

d5f67d67c65311e28c73c4c372ba24291c36d5be

SHA-256:

50675e09fd18fd33392cf9bc80a77fbda305f7748cf2138d17377bc91e2689ab

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/29/2024 10:33:27 AM UTC (today)

File size:

1.6 MB (1,648,552 bytes)

Product version:

1, 0, 4

Original file name:

EmacleOverlays.dll

File type:

Dynamic link library (Win64 DLL)

Common path:

C:\users\{user}\appdata\roaming\emacle\tongbupan\emacleoverlays_x64.dll

Digital Signature

Signed by:

Net263 Ltd.

Authority:

VeriSign, Inc.

Valid from:

7/1/2015 8:00:00 AM

Valid to:

7/31/2016 7:59:59 AM

Subject:

CN=Net263 Ltd., OU=Enterprise Conference Department, O=Net263 Ltd., L=Beijing, S=Beijing, C=CN

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

3C446423F2C025FEC37DA10B1D2CCB39

Registration

CLSIDs:

{5282A6F3-EDFF-45AB-83F1-ADF0B8081925}, {5282A6F4-EDFF-45AB-83F1-ADF0B8081925}, {5282A6F6-EDFF-45AB-83F1-ADF0B8081925}, {5282A6F7-EDFF-45AB-83F1-ADF0B8081925}, {71E2CB30-1EFD-4d1e-99DE-F0F9709D3EEE}, {B175D999-AF55-4f29-BDB9-10060684CF57}

ProgID:

webber84.CopyHook.1

COM registered:

Yes

File PE Metadata

Compilation timestamp:

4/5/2016 4:12:52 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:n8ZmaPeye742XEEazpw/yti3JTMolbNRvtiSWNRpH3sK4n4pKGj054vzDB3ljKCA:8ZmaPC742XFadw/ytCbD8LwnhjISiJQ

Entry address:

0x1BE10

Entry point:

48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, F8, 8B, DA, 48, 8B, F1, 83, FA, 01, 75, 05, E8, 37, 73, 00, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, AB, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, 66, 66, 0F, 1F, 84, 00, 00, 00, 00, 00, 48, 8B, C1, 48, F7, D9, 48, A9, 07, 00, 00, 00, 74, 0F, 66, 90, 8A, 10, 48, FF, C0, 84, D2, 74, 5F, A8, 07, 75, F3, 49, B8, FF, FE, FE, FE, FE, FE, FE, 7E, 49, BB, 00, 01, 01, 01, 01, 01, 01... 
[+]

Entropy:

3.4937

Code size:

190 KB (194,560 bytes)

Approved Shell Extension

Name:

EmacleOverlays

CLSID:

{5282A6F6-EDFF-45AB-83F1-ADF0B8081925}

Scan emacleoverlays_x64.dll - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.