ausweichspiel[.]exe

resource
ausweichspiel.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/${ausweichspiel}.exe
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll

ausweichspiel.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 756e9f397d503a182518366139f96f338b1e783d9faabca95a399c75eb257edc
MD5 c9e580a34f98310722a475b37628fbfa
SHA1 1603a0cc1c18d268dc7e633df1c39046a3be7cbd
SHA512 f5a2aef83b75c8c2759043db86b3eb7041097c0083fe59860f3e15adce55e435955d32e4ee74e5018d44c99efea0578ecefbef9fb8bfc82d63a77421fe0247d7
SSDEEP 393216:4Mm202e5O8LaAlQr4tP1LDba7AS7ITej9AWdNK/CjondDV421okvhhBd:JmVZd22j2tMT8mWDACjI421oyd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/InstallOptions.dll

IMPHASH 06a4f1236d62b715e2a75887755952df
SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
MD5 6f3098fb5f3db26f3bb84f5481109e39
SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcmpiW lstrcpynW lstrcpyW lstrcatW GetFileSize GlobalUnlock GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar CreateFileW GetCurrentDirectoryW GlobalLock GlobalAlloc GetModuleHandleW CloseHandle WriteFile SetFilePointer SetEndOfFile GetPrivateProfileIntW ReadFile lstrlenW SetCurrentDirectoryW

user32

EnableWindow GetSystemMenu EnableMenuItem DrawTextW SetWindowRgn SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW SetCursor MapWindowPoints GetSysColor DrawFocusRect PtInRect GetWindowLongW CreateDialogParamW LoadCursorW LoadIconW DestroyIcon LoadImageW IsDialogMessageW MapDialogRect SetWindowPos ShowWindow DestroyWindow CreateWindowExW CallWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetClipboardData CloseClipboard OpenClipboard GetDlgCtrlID SetWindowLongW wsprintfW GetDlgItem CharNextW

gdi32

CombineRgn CreateRectRgn DeleteObject GetDIBits SelectObject SetTextColor GetObjectW CreateCompatibleDC

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
MD5 ea00e2678e4679ba28b0f560baec9776
SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 0abda28f18fd768f6b2e6c6f0afd029124882e2230eb0f2d410cd5caf12acdc0
MD5 014e9352956693bbe145b2c38d1ac572
SHA1 1a51cdbc86742f12c394103894c7f79c29df9ecf
SHA512 c9003cb7f2718b7f3b717900f2bd2052165c78f1eeb2755f7e9d47bb2a70b20dad94b9afda5a67268cb66b92fbd154d0ba23e63a9d06b0c8beeb0fc37e5e4d9a
SSDEEP 48:6WRJ+AKhdDg5q7w8l2MwHh1Y1uQgZwlN6Oa2CIlcgQ+tgBENb:6u78gGbf0TC6SOx29Ft+Et
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 98ea8591187dea2f4f07dde506cebdd6a9b4aefbd3df278e1720bad1545215b5
MD5 39bfc6bb3d7095bd3a023a9877e8deb6
SHA1 0421ddac9efda3deb3a5b5c78d97f595bd0f5743
SHA512 e5685bd1449de849788ed8541c2622ee2dc600a32ca5abdd485eddf6477589fe0f89df5d19dafec831e7cf18a6227befadecead8fb1a1259c129c6ce5e5ca87c
SSDEEP 48:stjiISh2yZ48ZBCUeu6VWwHX2pc9ykglDdowsy7s2aZ/h0g9ilzevnVyiUrlc/7p:sdSCUeu6NHGu0ztses2a1WgIzKokj
MD5 SHA1 SHA512 SSDEEP

$TEMP/vcredist_x86_2015.exe

IMPHASH 8e2588a9cf43886de3449dfff03137b6
SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
MD5 1a15e6606bac9647e7ad3caa543377cf
SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ab:06:cb:ec:52:d7:a1:69:63:80:49:01:2e:f8:86:a1:5e:87:65:11:a6:e9:90:cd:1f:7b:f7:ad:25:14:e8:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 22, 2024

PE Signature issue

Digest

df:f2:e7:17:7c:35:2e:2a:10:e7:c1:35:9e:a2:41:d0:98:70:74:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

1

Major OS version

5

Entry point

165012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

gdiplus

GdiplusShutdown GdiplusStartup GdipDeleteGraphics GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromResource GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipAlloc

advapi32

QueryServiceConfigW CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegDeleteValueW RegQueryValueExW GetUserNameW InitiateSystemShutdownExW CreateWellKnownSid InitializeAcl SetEntriesInAclW DecryptFileW ChangeServiceConfigW ControlService CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW RegQueryInfoKeyW RegSetValueExW SetEntriesInAclA SetSecurityDescriptorGroup RegOpenKeyExW GetTokenInformation CheckTokenMembership AllocateAndInitializeSid FreeSid LookupAccountNameW SetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner

user32

GetMessageW PeekMessageW PostMessageW IsWindow PostQuitMessage GetWindowLongW SetWindowLongW DefWindowProcW UnregisterClassW DispatchMessageW TranslateMessage IsDialogMessageW MsgWaitForMultipleObjects WaitForInputIdle LoadCursorW BeginPaint EndPaint GetCursorPos MonitorFromPoint GetMonitorInfoW ReleaseDC MessageBoxW PostThreadMessageW RegisterClassW CreateWindowExW

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

gdi32

GetDeviceCaps CreateDCW

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoInitializeEx StringFromGUID2 CoInitializeSecurity CLSIDFromProgID

kernel32

GetCurrentProcess InitializeCriticalSection TlsFree DeleteCriticalSection CloseHandle TlsGetValue Sleep GetLastError ReleaseMutex TlsSetValue TlsAlloc GetCurrentThreadId GetVersionExW GetModuleHandleW ReadFile SetFilePointerEx CreateFileW GetCurrentProcessId GetProcessId WriteFile ConnectNamedPipe SetNamedPipeHandleState lstrlenW CompareStringW LocalFree CreateNamedPipeW WaitForSingleObject OpenProcess lstrlenA RemoveDirectoryW GetFileAttributesW ExpandEnvironmentStringsW LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress VerifyVersionInfoW VerSetConditionMask GetComputerNameW GetTempPathW GetSystemDirectoryW GetSystemWow64DirectoryW GetVolumePathNameW HeapAlloc GetSystemDefaultLangID GetUserDefaultLangID GetDateFormatW GetSystemTime InterlockedExchange LoadLibraryW InterlockedCompareExchange GetExitCodeThread CreateThread SetEvent WaitForMultipleObjects CreateEventW ProcessIdToSessionId InterlockedIncrement InterlockedDecrement GetStringTypeW SetFileAttributesW FindClose FindNextFileW FindFirstFileW CreateProcessW SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW HeapSetInformation MapViewOfFile CreateFileMappingW CreateMutexW SetEndOfFile ResetEvent SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA GetSystemTimeAsFileTime VirtualFree VirtualAlloc DeleteFileW GetThreadLocale GetTimeZoneInformation TerminateProcess UnhandledExceptionFilter SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GlobalAlloc IsProcessorFeaturePresent GetTickCount QueryPerformanceCounter HeapCreate SetLastError EncodePointer GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW GlobalFree MoveFileExW CopyFileW GetFileSizeEx GetModuleHandleA RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode HeapSize HeapReAlloc LCMapStringW MultiByteToWideChar SetStdHandle WriteConsoleW FlushFileBuffers GetLocalTime UnmapViewOfFile IsDebuggerPresent DuplicateHandle HeapFree FormatMessageW GetTempFileNameW GetWindowsDirectoryW CompareStringA FreeEnvironmentStringsW GetModuleFileNameW GetStdHandle DecodePointer ExitProcess SetUnhandledExceptionFilter GetStartupInfoW GetCommandLineW GetFullPathNameW CreateDirectoryW GetProcessHeap

cabinet

ord22 ord20 ord23

crypt32

CertGetCertificateContextProperty CryptHashPublicKeyInfo

msi

ord88 ord17 ord125 ord116 ord115 ord118 ord8 ord171 ord205 ord45 ord137 ord141 ord238 ord190 ord169 ord90 ord173 ord111 ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW InternetErrorDlg InternetReadFile HttpSendRequestW InternetSetOptionW InternetOpenW HttpQueryInfoW InternetCrackUrlW InternetConnectW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

${ausweichspiel}.exe

IMPHASH f245518ae52e20fe3edf5edd7841ca4f
SHA256 92323b50c923433f4167a906dcfb6750a5e0b4250577423050473ed2b7752e37
MD5 26ce28eb1383c656431e95533d5f7b5d
SHA1 2154cf2db3833dfcdbb083d18b865caafc05b2b4
SHA512 de6319a0cc1a7604da0e39c9a5c0cdf1201777d8b9c1ae34263259b4b0744bf484e06f66e0411b78452cb9ed8050ff4854c26f5824fa8ab3be549720d7f8661c
SSDEEP 98304:JyDn63AaZq6QmZAuFNtcsIrcAdrVjDdwzP:JA6waHQQAQDcPQAdZSzP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5256068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\GameMaker\GameMaker\GameMaker\Runner\VC_Runner\x64\Release-Zeus\Runner.pdb

rpcrt4

UuidToStringW UuidCreate

wininet

InternetCrackUrlA HttpEndRequestW InternetOpenA InternetCanonicalizeUrlA InternetWriteFile HttpOpenRequestA HttpQueryInfoA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetGetConnectedState

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

dbghelp

MiniDumpWriteDump SymInitialize SymFromAddr

winmm

mciGetErrorStringA joyGetPosEx joyGetPos timeGetTime timeGetDevCaps timeEndPeriod timeBeginPeriod mciSendStringA

ws2_32

send inet_ntop connect inet_ntoa gethostname recvfrom recv getsockopt freeaddrinfo inet_addr ioctlsocket setsockopt WSAGetLastError getpeername __WSAFDIsSet select ntohl ntohs htonl htons WSAAddressToStringA WSAStartup getaddrinfo listen closesocket bind accept sendto WSACleanup getsockname socket

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

mfplat

MFStartup MFCreateSourceResolver MFCreateMediaType MFShutdown

mf

MFCreateAudioRendererActivate MFCreateTopologyNode MFCreateMediaSession MFCreateSampleGrabberSinkActivate MFGetService MFCreateTopology

kernel32

HeapReAlloc GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTempPathW SetConsoleCtrlHandler WriteFile GetStdHandle FreeLibraryAndExitThread ResumeThread ExitThread PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW FileTimeToSystemTime IsValidCodePage FindFirstFileExW MoveFileExW SetFileAttributesW GetFileAttributesExW GetModuleHandleExW HeapWalk HeapValidate RtlUnwind LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx VirtualQuery GetProcessHeap HeapFree HeapAlloc InitializeSListHead RaiseException GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind GetACP GetOEMCP RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent GetCommandLineA SetCurrentDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetEndOfFile HeapSize SystemTimeToTzSpecificLocalTime RtlCaptureStackBackTrace EnterCriticalSection InitializeCriticalSectionAndSpinCount LoadLibraryW GetProcAddress WideCharToMultiByte MultiByteToWideChar GetLastError LoadLibraryA CreateEventExW WaitForSingleObjectEx CloseHandle OutputDebugStringA GetConsoleWindow SetLastError GetFullPathNameW GetExitCodeThread FormatMessageW DeleteFileW CreateThread GetCurrentDirectoryW LocalFree GetModuleHandleW ReadFile SetFilePointer CreateFileW GetFileAttributesW GetCurrentDirectoryA SetCurrentDirectoryA GetFileSize FreeLibrary FormatMessageA CreateDirectoryW FindFirstFileW FindNextFileW RemoveDirectoryW GetEnvironmentVariableW FindClose Sleep CreateProcessW GetExitCodeProcess SetWaitableTimer CreateWaitableTimerW WaitForSingleObject GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcess K32GetProcessMemoryInfo GetFileAttributesA SetPriorityClass SetThreadPriority GetCurrentThread GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoW GetVersionExW GetUserDefaultLCID GetSystemInfo GlobalMemoryStatusEx VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId DebugBreak GetEnvironmentVariableA ExitProcess lstrlenA MoveFileA GetCommandLineW ExpandEnvironmentStringsW GetFinalPathNameByHandleW GetModuleFileNameW SetErrorMode GetCurrentThreadId SetUnhandledExceptionFilter LeaveCriticalSection SetEvent GetStringTypeW GetLocaleInfoEx GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW InitOnceExecuteOnce DeleteCriticalSection FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle GetNativeSystemInfo SwitchToThread SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock TlsFree TlsGetValue TlsAlloc TlsSetValue WriteConsoleW

user32

EnumDisplaySettingsW UpdateWindow GetForegroundWindow GetMonitorInfoW IsDialogMessageW PeekMessageW TranslateMessage SetProcessDPIAware SetDlgItemTextA SetWindowLongPtrW DispatchMessageW MonitorFromWindow GetRawInputDeviceList GetRawInputDeviceInfoA MessageBoxW LoadImageW SetForegroundWindow ReleaseCapture GetClientRect SetCursor SetCapture MessageBoxA GetFocus OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable keybd_event GetAsyncKeyState wsprintfW GetCursorPos GetActiveWindow ClientToScreen MapWindowPoints MoveWindow SetCursorPos CreateDialogParamW GetDC EndDialog SetWindowTextW SetDlgItemTextW GetDlgItemTextW GetDlgItem DrawTextW DialogBoxParamW DefWindowProcW AdjustWindowRectEx GetKeyState PostMessageW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW ScreenToClient SendMessageW CallNextHookEx GetSystemMetrics RegisterClassExW ShowWindow SetFocus BringWindowToTop LoadCursorW ReleaseDC

gdi32

GetDeviceCaps SelectObject GetStockObject

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW

ole32

CoInitialize CoTaskMemFree CoCreateFreeThreadedMarshaler CoCreateInstance

dwmapi

DwmGetCompositionTimingInfo

Name

.text

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

537KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mydata

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Uninstall.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 646a5e0db19fc939e83abb7d9e1c23831b8fb942e8ef31dec25da77384303131
MD5 920a5fea98024449c278745d07304627
SHA1 ec695252ccd2906dfbb38ffbb584bac90575d6a9
SHA512 e1807568f0b77f44af213cb70a7bc5f3d8a2335d0799c7aa973042594948aa639ca98aa7c93f95f75914cdaa148a55f02e7c633164efa65142ad9775d927b5ed
SSDEEP 1536:UcVxMtkyfWqPG1QIcVdWToWw2EgdLeAyNsdBt4ItRTGCIXZY:U4MrfWdbcDWToWNEceA9B2IrTUG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/InstallOptions.dll

IMPHASH 06a4f1236d62b715e2a75887755952df
SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
MD5 6f3098fb5f3db26f3bb84f5481109e39
SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcmpiW lstrcpynW lstrcpyW lstrcatW GetFileSize GlobalUnlock GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar CreateFileW GetCurrentDirectoryW GlobalLock GlobalAlloc GetModuleHandleW CloseHandle WriteFile SetFilePointer SetEndOfFile GetPrivateProfileIntW ReadFile lstrlenW SetCurrentDirectoryW

user32

EnableWindow GetSystemMenu EnableMenuItem DrawTextW SetWindowRgn SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW SetCursor MapWindowPoints GetSysColor DrawFocusRect PtInRect GetWindowLongW CreateDialogParamW LoadCursorW LoadIconW DestroyIcon LoadImageW IsDialogMessageW MapDialogRect SetWindowPos ShowWindow DestroyWindow CreateWindowExW CallWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetClipboardData CloseClipboard OpenClipboard GetDlgCtrlID SetWindowLongW wsprintfW GetDlgItem CharNextW

gdi32

CombineRgn CreateRectRgn DeleteObject GetDIBits SelectObject SetTextColor GetObjectW CreateCompatibleDC

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
MD5 ea00e2678e4679ba28b0f560baec9776
SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 0abda28f18fd768f6b2e6c6f0afd029124882e2230eb0f2d410cd5caf12acdc0
MD5 014e9352956693bbe145b2c38d1ac572
SHA1 1a51cdbc86742f12c394103894c7f79c29df9ecf
SHA512 c9003cb7f2718b7f3b717900f2bd2052165c78f1eeb2755f7e9d47bb2a70b20dad94b9afda5a67268cb66b92fbd154d0ba23e63a9d06b0c8beeb0fc37e5e4d9a
SSDEEP 48:6WRJ+AKhdDg5q7w8l2MwHh1Y1uQgZwlN6Oa2CIlcgQ+tgBENb:6u78gGbf0TC6SOx29Ft+Et
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

data.win

SHA256 94b5bc5c4ee95834cfd2a8235df0e91b9c911d00e422c22b5250b46fb36cd655
MD5 1efb1e29947f7159943ec54ce0bacfd9
SHA1 752de7bd395f43fbc7762a347534de03f7c0903b
SHA512 8e91ed686a9294db4ddf576d42af6b8dbada01b68ac3ff8b88ecbf95ec85d0af6cb2a220d8cbd3d93880d63332695e3b733da6a4210a1f56689b15e6ddefa383
SSDEEP 6144:2fF2beLops9tuHyRoEUBc/q9BfNeDaLoHLvyPVnsAzBzwtoeuT:KF2UopOsyRoEUZfAaLorvyPf1u5u
MD5 SHA1 SHA512 SSDEEP

license.txt

SHA256 2c88d719c0e7ee8aafd407571ac6f1a374bd8c431ed22ea4520dd543cce29ea3
MD5 916c4589c406f7c0524e12ba8bb46373
SHA1 3dde8d42028ed22173d2801adc742e996c396504
SHA512 6cb08f79586468c9181531071acf7cc1cf5d92d1bbe96b784e6641a28ca6301b420db3fb9172a256ef1610f04930ecd283a13e1dffa5907e8de4222c9c0156d8
MD5 SHA1 SHA512

options.ini

SHA256 d2b6d2ed327bcec3e24ba0d814db911b9497ad63c69325d2b25c98b60d03a54a
MD5 f561f2b3e4e0438915c77790648c66ea
SHA1 f684b62a1408960673d1aa590c796932ec3ef19c
SHA512 ca107ddb1b69107eb5387a96cb0a8ac577afec9bc1e2e085cc1287273fd938e6cec8701e041670a8a2f36788d87d7c73d1c624152d2e821f461c01f1a4996df6
MD5 SHA1 SHA512

splash.png

SHA256 4619e7513f940dd8ca9ac99438cbd8f5d3d3275a37c7cd8de24dae933a24f63c
MD5 de94631ba4621df39a0b77a436aec63a
SHA1 58fb47d1a375db144b9d27a8aee6977cb5a46eba
SHA512 f9cb75b819b9628dc62180b1d5f5eaeae579c63b5bbb402261c75b7758c7b421116e85f27a1a7b62c94096743fe2eb8045b3ce25450d000d2b7ac3cc9a32c448
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

ausweichspiel.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$TEMP/vcredist_x86_2015.exe

PE Signature issue

PE Signature issue

gdiplus

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

cabinet

crypt32

msi

rpcrt4

wininet

wintrust

version

generic

${ausweichspiel}.exe

rpcrt4

wininet

d3d11

dxgi

dbghelp

winmm

ws2_32

gdiplus

comctl32

version

mfplat

mf

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

dwmapi

generic

Uninstall.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic