852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc.jar
- SHA256 852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc
Overview
overview
10Static
static
3xerox322200524.exe
windows7-x64
10xerox322200524.exe
windows10-2004-x64
10$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Duramen/Sa...rs.app
macos-10.15-amd64
4Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xerox322200524.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
xerox322200524.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Duramen/Sabbatters.app
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
150 seconds
General
- Target 852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc.jar
- Size 367KB
- Sample240522-rtlwvsed7t
- SHA256 852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc
- MD5 91a034327be0deaa30c73c21e1a72dad
- SHA1 d69bb4445717931d0c80931bff02f0cb6d8d8d16
- SHA512 06414545c70e01af969bf935433e328f1f9a5d029454b883d963e248f8b42020161ce83339f27c1e8e801501f40131f216384f71e06abdfc9c26e4067b3ae740
- SSDEEP 6144:xqZUJOXigyQjLGz0IDw1txim5ruiZpIRZ4gc9ps83WDw5+zmonPBMJwoLr5hLQv2:xqZUQygv2pEyY7pIhoa808loPBMJwoZB
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/xerox322200524.exe unpack002/$PLUGINSDIR/Banner.dll unpack002/$PLUGINSDIR/BgImage.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll
File Explorer
-
852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc.jar.zip 367KB
-
xerox322200524.exe.exe 464KB
-
$PLUGINSDIR/Banner.dll.dll 4KB
-
$PLUGINSDIR/BgImage.dll.dll 7KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
Blaarvs.Dvr19KB
-
Blandish.Sli254KB
-
Boligsager.nut4KB
-
Charlet.paa2KB
-
Duramen/Folkekulturs.unf1KB
-
Duramen/Hamnet/blout.unm4KB
-
Duramen/Hamnet/craftwork.for2KB
-
Duramen/Hamnet/depel.txt461B
-
Duramen/Hamnet/maga.amo3KB
-
Duramen/Hamnet/peruvian.arb4KB
-
Duramen/Hamnet/produktionsprisen.bec1KB
-
Duramen/Sabbatters.app1KB
-
Duramen/albuminurophobia.epi3KB
-
Tidsfrister/sapota.sea1KB
-
Tidsfrister/unharping.ran2KB
-
Tidsfrister/ydervgselementet.bin2KB
xerox322200524.exe
- IMPHASH b34f154ec913d2d2c435cbd644e91687
- SHA256 285009b0e71742b5fbe9407dcb25e378d35c2b9eab33f51618b46b647878c60d
- MD5 5b578b597f4f4eef57eda996ee33cdb6
- SHA1 efdb66166e1a45e9a30c67bc6d80e42f843b5604
- SHA512 a7cc33e0e73c5c821d66a2ce437dfcd1ae8074161e3cafb9c2668dd3e411fc4073e1161f8781a17bbb3c8af29f210b9c3b7cf9d7a534fb278fc54ae4eabdeea3
- SSDEEP 12288:vi3hR5SANiItEOU79Uhua4g8Do3BMJSojhvnH3:K3hv5iIizUhH4g8eqSqd3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13171
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
SetCurrentDirectoryW
GetFileAttributesW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
ExitProcess
GetShortPathNameW
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/Banner.dll
- IMPHASH 767a5b32183c6c4ff645882480adc9a6
- SHA256 4083bef584ad6793b3d57e3e3f764a31afac876412df65c5da5afee76bbd1e10
- MD5 0d5428f7920274caedfa8f2ae980e196
- SHA1 ce2ca2381a4b9ed9f06f6af5a183a840de290c3f
- SHA512 78419752f3e6579f7caf1f9bab70a46ac2b0a7c5f08eb8604e927baea611c182133ce8d58929a059f22e6c2befb5ff0c24ee6500d0708bc884a65e395ea7c4cf
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyW
GetModuleHandleW
CloseHandle
Sleep
CreateThread
GetCurrentThreadId
GlobalFree
lstrcmpW
lstrcpynW
GlobalAlloc
user32
DestroyWindow
SetWindowLongW
GetWindowLongW
SetWindowTextW
SetDlgItemTextW
DispatchMessageW
PeekMessageW
WaitMessage
IsWindow
CreateDialogParamW
ShowWindow
AttachThreadInput
IsWindowVisible
wsprintfW
PostMessageW
destroy
getWindow
show
Name
.text
Size
1024B
Virtual Size
874B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/BgImage.dll
- IMPHASH 32b0f5880a0efd258c6be2f7a14f4a9f
- SHA256 286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
- MD5 9436196007f65f0ae96f64b1c8b2572e
- SHA1 4b004b5c2865c9450876be83faa8cc96e1d12c01
- SHA512 5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e
- SSDEEP 96:8egk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:t7TJa2roqJyA2EN8diuTHje
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
lstrcpyW
lstrcpynW
GlobalFree
lstrcmpiW
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection
user32
UnregisterClassW
CallWindowProcW
LoadImageW
DestroyWindow
BeginPaint
IsWindow
SendMessageW
DefWindowProcW
RedrawWindow
ShowWindow
LoadCursorW
RegisterClassW
CreateWindowExW
SetWindowLongW
GetSystemMetrics
SetWindowPos
DrawTextW
EndPaint
FillRect
gdi32
GetObjectW
DeleteDC
DeleteObject
CreateSolidBrush
CreateCompatibleDC
SelectObject
SetMapMode
GetMapMode
CreateCompatibleBitmap
CreateBitmap
SetBkMode
BitBlt
DPtoLP
SetBkColor
SetTextColor
winmm
PlaySoundW
AddImage
AddText
Clear
Destroy
Redraw
SetBg
SetReturn
Sound
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=1, productName=Unmarked objects,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
- MD5 8b3830b9dbf87f84ddd3b26645fed3a0
- SHA1 223bef1f19e644a610a0877d01eadc9e28299509
- SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
- SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsDialogs.dll
- IMPHASH e2ee55bddad4241d619d6a8a38e2d869
- SHA256 59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311
- MD5 82c3f38cd34739872af07443c65d0bd8
- SHA1 1f4ee2d394404a291eda6419f856adaf4b960237
- SHA512 3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d
- SSDEEP 192:ow8cSzvTyl4tgi8pPjQM0PuAg0YNy+IFtSP:lBSzm+t18pZ0WAg0R+IFg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7443
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
GetDlgItem
GetSysColor
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
630B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Blaarvs.Dvr
- SHA256 555046bae983c04238fea883e3a5d6347fc96458e36b5c7b043e5fe8de3a9cf8
- MD5 43823b06e7202f2052e2702ad2b94752
- SHA1 026f2ba6046e29053f52895109b514d855579581
- SHA512 e909d3548c0937f601a33133b5e205b6fb73b7e0be46207521bea2a3b2b55464a52195f3f3fae21d3708560bcfd482c9e4a865aaded52a0b0155e314c56b11cc
- SSDEEP 384:Sx/LBGSSciaQqRfSzRfhA2Gk0DHpwLile/Crh4f1uZ:GLB1iaQs6lJ2PpQ3C4dc
- MD5 SHA1 SHA512 SSDEEP
Blandish.Sli
- SHA256 ce8c563525ee46a70be9b675f1132277b6e3ca5a2bc82bc29cb93a057f0e431f
- MD5 1bb22180b6fe9fecdf8dc0d27b87540c
- SHA1 6e62ddb69a6a969ff45bbb1d7edce4bb77de2af3
- SHA512 7bcd4ad7c9006af6d39cc15f25e2c4838cea0ca30abfa9b30a8e80b46554c997bdeff5af997ab8627e1b0d0d0a1e3b6baf2995cb837173e1e79d76ed4140bf4d
- SSDEEP 6144:m638Pe07dizEgf6tvuOwrM4BLGDJwEmVwtCok7lgyzGS:mfMzErt24buiCokpgyqS
- MD5 SHA1 SHA512 SSDEEP
Boligsager.nut
- SHA256 0b02fa7743a7b99949b035f9ba634dacadb3750f84692756e3931b9892b9fd5f
- MD5 b06a6ee33e50bc75d872bea06f75578b
- SHA1 e7aa1543686fc05f3f05ccac75030685016ea338
- SHA512 ba75b26b3a47b51f7c9b5aec749b431947b074e0de2e8da5f53998b5b4aa293f452d411f4b90ac226bfe060eb454f93da5fc23fab5f937bf18d99a2f0d6f0a9a
- SSDEEP 96:0Ex2/ClcMjuTNb2vAlUFVdyg01V2RANcF:xlluZ2ISrdyHH2P
- MD5 SHA1 SHA512 SSDEEP
Charlet.paa
- SHA256 809943f0707c458250f2f723ee102cc8e514c1a5d8dd14c0e4372bd913a4eb1b
- MD5 19f4b6f2c0071e09baaf89e2b6760ec0
- SHA1 c53de929b36544969f7bddf3c21e4e13152ae70e
- SHA512 b58a12cf0a83722db70b5120e454750a4925aa084f1eeed3450c527a60c44f9a38a6deced58f8ecca815e45e0cf880e9a2b38b8866a52e1c421d0a1c5911c712
- MD5 SHA1 SHA512
Duramen/Folkekulturs.unf
- SHA256 9188ed20089b5a8b23385ea46d73120565541b5d9b3f6752c6b0168de98c1acd
- MD5 f0a3ef4a4c309425f9e66efe2b82773f
- SHA1 df5e3834fb6d6b42c361a714db06bf7186ea24a4
- SHA512 41afcb6a400af1d69347da51151d260e292fd1369e8746ee93906e8fa87420200232c6bcf71adb84776ee0b3c0d7c1ed4e456b4f09e24ca5725dbd4e72d11ddf
- MD5 SHA1 SHA512
Duramen/Hamnet/blout.unm
- SHA256 8be5116bf871c3c2f12763c732a7c23cb965ad76367b144711991e2859d2b6c8
- MD5 e1c5b53e9928d1abed5e30e1e8c8a301
- SHA1 6e4891770a873fc842c5a446500af1cbb4d2b82a
- SHA512 ef14bf48141883d9175e8eea38231667517ef7576675a48484e4105f0ed61e089011521b29dcb76954d83dda388aad7e6fcd378f8fa7a4e003f5793c696219d1
- SSDEEP 96:bEdXb/ugHJ9RYcS0OuvopsUKfRv2dIH/1maCcj6mY81k5Ny:b/gpvTyYtSIf1maCe1kDy
- MD5 SHA1 SHA512 SSDEEP
Duramen/Hamnet/craftwork.for
- SHA256 7a36b98211ba5c13d89467f85873a88b628e2a307c0081270b92f9a70cc14b68
- MD5 b718d04820e1d3c54e83103b5f6e33c0
- SHA1 f217d0bb818c5957be381f3bb2b7504a585e9de1
- SHA512 574e1e3895764a88f158c2c934e2e707e284d6d803bbd7a7fa501814d14c2670e4584c3c4147782521e6314590eb80e3778efbe72732ac80bcf1e534af689393
- MD5 SHA1 SHA512
Duramen/Hamnet/depel.txt
- SHA256 ebc5dbdb52b413aaf0b958763fe8ad35e8a98d77c51daf8b519d3815e44dd818
- MD5 13d8deb35288701927da205f3c887787
- SHA1 5ba9084d199f24c3348d3197e97f253d281ef853
- SHA512 6264560f031bf903dd8f3be05c35144d2d98b61fc790684893473e63a2806b4a8bd07dafb9e75e20aa7f2859ca1ec0c92190672cbad06f97d7ea74cf34e1e632
- MD5 SHA1 SHA512
Duramen/Hamnet/maga.amo
- SHA256 859b473416878c5b8df172b88411fc95ebe3567c2a248bdf912b33fb2dd21a2c
- MD5 3bfa3fc47efae291c7a323d217b988ba
- SHA1 1880f33480d4809fbeb48aa190f9a27eb8718dc6
- SHA512 96a5eb0a696fe78d1512db46cef3c0f4358a1ed4cdc740c2c3e881e6c6dad2f593ba7690b6f309efe8df7346a965f20746801c737c92c29a6de62ce02b885e44
- MD5 SHA1 SHA512
Duramen/Hamnet/peruvian.arb
- SHA256 436035dd581b5f49f857ec1c28e9139b6827b3d2900972b01c45b4fc1e69d2df
- MD5 a7185c14c6e3f9c4b7a930418b436520
- SHA1 59268f92379b769ff975a96c8ddba436519b681d
- SHA512 d3054d61223522b22ecc4e6a38fe6320671b2a4821f41960febd580323f5fc6e523a90988e591fd45a35ca1b5e23f5ebb6ceb25e0e344ab5bf6f66b3aa726976
- SSDEEP 96:WGo9yr4WVDppaKiKDiSWe+Vcn+myVGs1dJFEBiy9c:ek4QPT0StBy71bFEBiz
- MD5 SHA1 SHA512 SSDEEP
Duramen/Hamnet/produktionsprisen.bec
- SHA256 eebbe8820673aab704b090e4bc54420a0980353c2f093f0d4daff0a231c43f76
- MD5 eec6e8634b4760186277fcda2a5729ec
- SHA1 c3681bf683b78f569283a7a984b7a0a98167cd44
- SHA512 f693a66b72b3ca33960b731acaef1f0c5232e31e37e8e3cea928162d7909d3a79683eb814fc9aa56c1e26a98e541f49db02c934bec3dad34808c4688ae253606
- MD5 SHA1 SHA512
Duramen/Sabbatters.app
- SHA256 68c60b54d23a7eac7decbd381934147857868b1b5f14a5087cc7d691f68670d6
- MD5 6d05f4d490578ac56f35a2fb0fdc48c3
- SHA1 98cbe66769dca00383a1e6345a0af8d8f5158802
- SHA512 0d038240e209b7b478d66800c76668fe40b10ffca149b1920946fb025ba5f1be9f20cd75e689cae6c9e5d9c2f722bf54b5bc2783602a0379def34be48e6753b5
- MD5 SHA1 SHA512
Duramen/albuminurophobia.epi
- SHA256 e1a1f4dedfd1565fe90c4ed80c5a9ad02a5d47db9bb7086e2a4a3a3249857a4c
- MD5 eb2b5f2c9c169e58377641d7987948fc
- SHA1 241bec9ad054cb725dff062a2f7b3dd61bfd5f83
- SHA512 5a44ed28da13d0b5225d2a332405e034359fa9b1e0d434e982853f6ba99b3eed3415dddec1ae674bf3c0cf79a8db3ba4fa7a7b1ef35f570aaf3786132b3f9f6d
- MD5 SHA1 SHA512
Tidsfrister/sapota.sea
- SHA256 5c32d1e7512d5514e460b80582af8e6045ae5e8a63fd962cd4fe51477aa11bb3
- MD5 a6d326d0622826b10f379d3298934673
- SHA1 4d422a45e1a8c2a25a1a30baeaa900cf848f01eb
- SHA512 d6160ac8d0b71bda3fafc582f61f0e3bd456b6880905732b9839e69492e87877b7b30a6a5de622037f46627367e9e9be48475779746819fc5a44339bbfd17113
- MD5 SHA1 SHA512
Tidsfrister/unharping.ran
- SHA256 af27d4b3305b809d64659a3b5a02389d412c906c4f592954a81def970bd9747a
- MD5 1e50c3524552877dd948770c9ff92dc8
- SHA1 0e87f93c3c875db3d8b02b5870217a1394b1e51d
- SHA512 68f7ea34ba75bbf2588a65fa2e296c46d9b05e809410a349b8c928e4ce64ab9b0743126475c83942a9412ae59b6daf6da76e330a6c0e4d343366e388c04f0ca4
- MD5 SHA1 SHA512
Tidsfrister/ydervgselementet.bin
- SHA256 ebf578ca1fbafff1fcaa75a44fa4e8c7b275a773b006de0bdd2713e5b4d73bc5
- MD5 b9d53633f865356f4ef7e2d5ccb9696b
- SHA1 b2f65737d0c3db82e441e5247131c33b38c42560
- SHA512 d3961eab3b61661b819193b5c240384833633fbfd21219db6e335af7c8965b1efdeaaa3c9051c22320e91d85082d81ed1ec1610b2ad5ab3b8d8e988ad167f82d
- MD5 SHA1 SHA512