e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf
MD5 5009d8c72623d30ce09149187c66d37c
SHA1 5c6035f099f16ff4753198e5f631ba410e98227f
SHA512 5908f38589b4097fd96f35129bbfa344a7940193ef0df6dab4e514106e7054c8ea9b3e97f9ebb7ff36fdbbd7c724cd1500e37f6c1ea6013f51842d39a642b5c1
SSDEEP 12288:i3nIF6bq58AFe0TenvBdHdpUXjwxipfpQGYAGau5yxX9O9R:i3IFsmez5pdpUXjUiNuGYpawA9uR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

8b:e3:8e:8e:ac:06:5c:bb:9e:11:5c:79:9e:a4:3b:67:1a:78:0c:c1:39:16:1a:93:01:90:ed:b6:4d:a5:d0:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Stallet,O=Stallet,L=Bilsington,C=GB

Chains

Oct 29, 2024

Minor OS version

0

Major OS version

4

Entry point

13474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Foreningsprocessens/etisk.hvs

SHA256 1f6bb50c9ac95a61782fcde006b6e396aceda7794fd30ffb7d97020fd7b8059e
MD5 a4946227de4dc2a79bf473a3d09c4247
SHA1 9ff800e6b4a72b6281d812710d00ad003f757170
SHA512 2902630584092375e1a2fb4669437c43548bc0d0e00b2b98a3fdaeedc57f3567b61a3fc545c8157fd410d6e26c9a70e8d989e97983700ffb55d9d1154cebe1f4
SSDEEP 768:++TtgE2yMxqLKoiyt4CpVdIwu3Uema6LhlEv9cCAXP69rBqGDpx/NEJKTPLqqQJl:bMFgNCAE6oLJS9a/IrOyTWq2uC
MD5 SHA1 SHA512 SSDEEP

Foreningsprocessens/leakers.txt

SHA256 f2552d843f4d62f481743a15b7c95aa322c14ea5dbb999c8c889a42cbb093a8e
MD5 e80e34f461528df8f86c4248c971b2ad
SHA1 a1a74d8f5711deed35af2b81be070ca471c39500
SHA512 46a5d6487131677dac16c2be4fc29517c14cb8db6228b40344d733597462122ef0d1d7dd69b4d5a7a10f9c86635f99d91e91ac2cebdf923c6b72ef3809637622
MD5 SHA1 SHA512

Foreningsprocessens/persongalleriers.una

SHA256 05de1ff63cc38c7c4b3034091a311791bff578658ff17d156aa4fb41a2e197c6
MD5 18c3da2aa022ff0b89999e28e6a2ae9a
SHA1 0659dde0fd4b39b22825f1645a0bae7e7202c7f9
SHA512 d3a51d8b29fef026f94b339087413319e03da3193d9159a43ad7b4fee35a67eeebc3e66a0092b5ed14f57458173d518c618f2ee00f4203f428ebe0fc162f667c
SSDEEP 768:yFPJSwGwS4JXi8PNDQNMDeMW3SGBqGHw1zwpmPMoaO64g1abi4IZxeMcdN9vfd95:/rFf4EoTti54LkFvI3oDW
MD5 SHA1 SHA512 SSDEEP

Foreningsprocessens/porkiest.mis

SHA256 8caf84ce635bd92186709e81d12ae352e049c83b53f1c22a6dcb221e8f1c011e
MD5 17b0342d31b6e728e13df79009833371
SHA1 b9f3354c4e886382d220d5ec4fa91f389585bd40
SHA512 4772f5ae64e0619b23114a41785dde7dd1a9bace12a9abedef3400edb3660d4e780c9b91e23a9fdec1d97bcf7dc48e201771d7d58eb1740191a05ccfdb433c83
SSDEEP 768:iEGLlMkjkYtwS3MeXM3OpckON5VIbjnI3Oif4NxZSqJbDvz+hE7IkHAYsaW3DQLF:LtWLdp3I3yrt+3SoTMU5oT5
MD5 SHA1 SHA512 SSDEEP

Gnavpotternes.The

SHA256 169e6ea357fc6dbd10e530fcfcfa50386ba75247273597cd43a63f9951899535
MD5 06e8fed876003b3ac855c94b4e0be59d
SHA1 85bd886154f33d5f67be64a865b03bc3d04cd70f
SHA512 455354fab278d537404c17ad8e97ed9c29caeb5ffb21b1588254d2fce6c5ee58b17751463991d3e1116dd89cac6b2753269100a34371442793054a14facbadca
SSDEEP 192:Jxy5BzknZQeAE9zL/NR2CNzUWG9//5Uc5:anzkZ9z3/NA0KX5Uc5
MD5 SHA1 SHA512 SSDEEP

Maleriet213.arc

SHA256 00fad7ec11db9706955fdf3be0e6fb037e9f9780f94a502a774b30ab52773a94
MD5 e6ac7a31da2d4322339135ad20eb0f23
SHA1 f76c6d6ee7c9b01db799642990aa88b140003ec4
SHA512 c87dabb08d092d546ff80270b052cf1c5d92d25852dbfecc139ce528ccd2a22cce130a8c90c08117df542e6d83de91e92180f853c201f042bed4681d4737e75d
SSDEEP 768:ArczTS8oocp0tWLSMkXWg7PKU30gfL4Qf1AUdyM03I3xkjFlu7NDSAZd+6XYIHXd:7Yhp0ckXv78owAC3MhxqI
MD5 SHA1 SHA512 SSDEEP

Sprogforskningen.Ins

SHA256 9d3b9b1c5c1b26412f53f4fa81542c8b9dfde8f8c02e4cfde656852ce03d60bc
MD5 6a35648f77e6363bce0de47d934ab494
SHA1 33cf7d82f5819ca739d5e2a784fb975b0bf16a99
SHA512 e362a84a1c2a7bb553b2d89277d2c2b60449d56de0d328e0a7c6ddd6bc2b0b94028aaecbaa84f993ffbe50f98e2b6d219e1e298c7d867022aff10de8fdfb01c2
SSDEEP 6144:EAaO357P3ehcQVXJrF7TH7JOJFeB4dG2UIpRZ:vaOp7PO6QR7THN8w4dUsZ
MD5 SHA1 SHA512 SSDEEP

afsgning.for

SHA256 1113e4990bef55e4cd1d868513b2305c72803fb296d559bfa9c8c93de2edc8ab
MD5 8ed0d91c7c65b02a5630d1a012895c3d
SHA1 fa74c3bd3a32123d71aea67d386b5ac251fec260
SHA512 fbe41906ccabb44e8d71d7664b756f75abdbf0fb80bfcbbf4bba9d9370df4cedbe437ba9f116b3f9e9d2ae2fb1e2d34d34f152e518a2e5e0096a506093f8db24
SSDEEP 1536:vu65sFtuGbUq4CCWG9TcLs9xEEc0MVWFnhMA:2PjbUquWUYs/9x
MD5 SHA1 SHA512 SSDEEP

bookishly.egg

SHA256 04f64748055424253509a229ee3e6f9bfc86898cba667da8312333552987b610
MD5 96e6c0cbbacf232110df3e7fc4b4d980
SHA1 fc18fdd4e5417ac76f68bf507ac0ba6b9a183cfe
SHA512 8dd22abbed1522a08e9ac3559f5cc6871b77c1b76c2a7aa0cd61e52ca7d3a43dcbaf00285bf29c1ff885fc5f424fa411f56f19eb1886da97cc7010bca66530a9
SSDEEP 768:DDh04DrooyUGbNSipoS0yYEt0ihBLBJU06zf8VWZt+il3sVxTD6I6o9+2u5inuB4:rorpFGQVWwj9bQdun2ljrAbUGl
MD5 SHA1 SHA512 SSDEEP