another-fnaf-plus-fan-game-by-ehanix-3[.]5[.]exe

resource
another-fnaf-plus-fan-game-by-ehanix-3.5.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/FNAF PLUS.exe
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll

another-fnaf-plus-fan-game-by-ehanix-3.5.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 023a6b63a9adb9518dd666c39a385c9313b327a3e8082c375d973bc8e74a2b4d
MD5 73f1e1d4d30cc79237aae620e0882fdf
SHA1 79f7ce0eb1857f7c49ad1e2df546ac5d6d57fa9c
SHA512 79158d833fb16476e580ca1ca3efc3c0b3e5756952a5f4a11ddb0465e986e563be21a95cf0ab3a27837aa7001e45971c0c177e5f3cae488096265491581dc32e
SSDEEP 12582912:GiGCbNN1z9BBqWEb6uPXvd4zcwuIBDBzvQqUnIM/OdTOJ1TQsimy84H76:GiGCthQjdScwfBhX5O7xW8y76
TLSH
T1FF8933ADE1EA2F1CD4736D3886719B5453F4852AC817DC38B76A07428DDB7C7B26C288
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/InstallOptions.dll

IMPHASH 06a4f1236d62b715e2a75887755952df
SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
MD5 6f3098fb5f3db26f3bb84f5481109e39
SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
TLSH
T14E621A527AC120F2DDD6A53037E77F236FB2B52094D58C1B97633E4B5922212BE39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcmpiW lstrcpynW lstrcpyW lstrcatW GetFileSize GlobalUnlock GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar CreateFileW GetCurrentDirectoryW GlobalLock GlobalAlloc GetModuleHandleW CloseHandle WriteFile SetFilePointer SetEndOfFile GetPrivateProfileIntW ReadFile lstrlenW SetCurrentDirectoryW

user32

EnableWindow GetSystemMenu EnableMenuItem DrawTextW SetWindowRgn SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW SetCursor MapWindowPoints GetSysColor DrawFocusRect PtInRect GetWindowLongW CreateDialogParamW LoadCursorW LoadIconW DestroyIcon LoadImageW IsDialogMessageW MapDialogRect SetWindowPos ShowWindow DestroyWindow CreateWindowExW CallWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetClipboardData CloseClipboard OpenClipboard GetDlgCtrlID SetWindowLongW wsprintfW GetDlgItem CharNextW

gdi32

CombineRgn CreateRectRgn DeleteObject GetDIBits SelectObject SetTextColor GetObjectW CreateCompatibleDC

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
MD5 ea00e2678e4679ba28b0f560baec9776
SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
TLSH
T110425C496B618EF2F62A463729B77F264B38EE1411E446DB8FD38445E8A01E721363C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
TLSH
T185C0128DD09A812548222707BE7ABFA177903D505B2718F7D1B24D17CB4C9CD58CD5C6
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-header.bmp

SHA256 55b900f6e1610f464bee6e82d1d2da8c3738f33a0f7e4c60ade292667ced244e
MD5 eb92c4aa3a0e0bd7dc55baa43a20dbab
SHA1 49a4eca6eb5883e06c2264db386780bde5d902bc
SHA512 4ba97ea78b1b92d05cbe4d90b899b29014e7efd8ff3d1e0e8c73802f377cbf290b2c63f5a001d43a322f34400836f8cda28e701abf195494fa938785c5e23fe8
SSDEEP 192:eXGA6MFan3D5chtTq562ucdzqesDvV4snWbNUZRFEoPJBSMQnOaCKtqw:eWNf16VqBuScV4VbNUBEoCMQnxC7w
TLSH
T191C2FED45EC2CC72479327C3B634AE90B2089112D7EA2D5A331E2E4D0DDB7BA4569F23
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 921a71cc45f813d5e06a2e0903a15348205456cd837fbd555ac33fa697628a8f
MD5 5e2f66647d6a23432dbe912dd0355bd0
SHA1 7ee171eac1a18a9c5eef7041f747d1b569f1100b
SHA512 080e30d70bc3195a5d2980a3dbdddf1e6a6c61149c07bc1735db5f95e56420ba3abacc4555758ae455fccf6200c8f69837b8975fe449b89c9b0bc535e5f721ff
SSDEEP 1536:L2T6gBjiaRCEdiEj4Rmv7/N34pfW69Gq3u7DhhZln/fp8UY:UBApu6r2NA
TLSH
T16DE3DAD06E46DCA133477BC37A21EED1A2D8506196E72D0422DE095C0DEBBFA867DB07
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/vcredist_x86_2015.exe

IMPHASH 8e2588a9cf43886de3449dfff03137b6
SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
MD5 1a15e6606bac9647e7ad3caa543377cf
SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
TLSH
T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ab:06:cb:ec:52:d7:a1:69:63:80:49:01:2e:f8:86:a1:5e:87:65:11:a6:e9:90:cd:1f:7b:f7:ad:25:14:e8:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

df:f2:e7:17:7c:35:2e:2a:10:e7:c1:35:9e:a2:41:d0:98:70:74:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:6e:9d:da:5a:a6:f3:1c:5b:00:00:00:00:00:55

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 20, 2015 - Jun 20, 2016

Minor OS version

1

Major OS version

5

Entry point

165012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

gdiplus

GdiplusShutdown GdiplusStartup GdipDeleteGraphics GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromResource GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipAlloc

advapi32

QueryServiceConfigW CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegDeleteValueW RegQueryValueExW GetUserNameW InitiateSystemShutdownExW CreateWellKnownSid InitializeAcl SetEntriesInAclW DecryptFileW ChangeServiceConfigW ControlService CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW RegQueryInfoKeyW RegSetValueExW SetEntriesInAclA SetSecurityDescriptorGroup RegOpenKeyExW GetTokenInformation CheckTokenMembership AllocateAndInitializeSid FreeSid LookupAccountNameW SetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner

user32

GetMessageW PeekMessageW PostMessageW IsWindow PostQuitMessage GetWindowLongW SetWindowLongW DefWindowProcW UnregisterClassW DispatchMessageW TranslateMessage IsDialogMessageW MsgWaitForMultipleObjects WaitForInputIdle LoadCursorW BeginPaint EndPaint GetCursorPos MonitorFromPoint GetMonitorInfoW ReleaseDC MessageBoxW PostThreadMessageW RegisterClassW CreateWindowExW

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

gdi32

GetDeviceCaps CreateDCW

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoInitializeEx StringFromGUID2 CoInitializeSecurity CLSIDFromProgID

kernel32

GetCurrentProcess InitializeCriticalSection TlsFree DeleteCriticalSection CloseHandle TlsGetValue Sleep GetLastError ReleaseMutex TlsSetValue TlsAlloc GetCurrentThreadId GetVersionExW GetModuleHandleW ReadFile SetFilePointerEx CreateFileW GetCurrentProcessId GetProcessId WriteFile ConnectNamedPipe SetNamedPipeHandleState lstrlenW CompareStringW LocalFree CreateNamedPipeW WaitForSingleObject OpenProcess lstrlenA RemoveDirectoryW GetFileAttributesW ExpandEnvironmentStringsW LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress VerifyVersionInfoW VerSetConditionMask GetComputerNameW GetTempPathW GetSystemDirectoryW GetSystemWow64DirectoryW GetVolumePathNameW HeapAlloc GetSystemDefaultLangID GetUserDefaultLangID GetDateFormatW GetSystemTime InterlockedExchange LoadLibraryW InterlockedCompareExchange GetExitCodeThread CreateThread SetEvent WaitForMultipleObjects CreateEventW ProcessIdToSessionId InterlockedIncrement InterlockedDecrement GetStringTypeW SetFileAttributesW FindClose FindNextFileW FindFirstFileW CreateProcessW SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW HeapSetInformation MapViewOfFile CreateFileMappingW CreateMutexW SetEndOfFile ResetEvent SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA GetSystemTimeAsFileTime VirtualFree VirtualAlloc DeleteFileW GetThreadLocale GetTimeZoneInformation TerminateProcess UnhandledExceptionFilter SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GlobalAlloc IsProcessorFeaturePresent GetTickCount QueryPerformanceCounter HeapCreate SetLastError EncodePointer GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW GlobalFree MoveFileExW CopyFileW GetFileSizeEx GetModuleHandleA RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode HeapSize HeapReAlloc LCMapStringW MultiByteToWideChar SetStdHandle WriteConsoleW FlushFileBuffers GetLocalTime UnmapViewOfFile IsDebuggerPresent DuplicateHandle HeapFree FormatMessageW GetTempFileNameW GetWindowsDirectoryW CompareStringA FreeEnvironmentStringsW GetModuleFileNameW GetStdHandle DecodePointer ExitProcess SetUnhandledExceptionFilter GetStartupInfoW GetCommandLineW GetFullPathNameW CreateDirectoryW GetProcessHeap

cabinet

ord22 ord20 ord23

crypt32

CertGetCertificateContextProperty CryptHashPublicKeyInfo

msi

ord88 ord17 ord125 ord116 ord115 ord118 ord8 ord171 ord205 ord45 ord137 ord141 ord238 ord190 ord169 ord90 ord173 ord111 ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW InternetErrorDlg InternetReadFile HttpSendRequestW InternetSetOptionW InternetOpenW HttpQueryInfoW InternetCrackUrlW InternetConnectW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

FNAF PLUS.exe

IMPHASH d1be4c84448e0738971d7db8c380bfa8
SHA256 90ac06a6c106ebaf2d385722172bd861b5fd842b888e9370af3172888fce590b
MD5 94403a597c2fe3e6f7da7f15992ad1ee
SHA1 8a25ecd75c585756921342d79e83baffd881f633
SHA512 54f3de2ebaf4144354941dd880f2ff26965cb243c30205d0872b70bf4a6d9514d93bd73859e5d6687356ad429e1ce04b5e0a42424083772cd711eabcf1975afa
SSDEEP 196608:h11sYP7pFubcekPZlyoFutmDGjNARKM1AmgDp37IT:VXDGd3H1K
TLSH
T191665A8636A5C19DD167903CC5869AFAE2713C45CF5097CB22A47F6E3F33AD40ABB211
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3928292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\GameMaker\GameMaker\GameMaker\Runner\VC_Runner\x64\Release-Zeus\Runner.pdb

rpcrt4

UuidCreate UuidToStringW

wininet

InternetConnectA InternetReadFile InternetWriteFile InternetCloseHandle InternetOpenA InternetCanonicalizeUrlA InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpEndRequestW HttpQueryInfoA InternetGetConnectedState

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

dbghelp

MiniDumpWriteDump SymInitialize SymFromAddr

winmm

mciSendStringA joyGetPosEx joyGetPos timeGetTime timeGetDevCaps timeBeginPeriod timeEndPeriod mciGetErrorStringA

ws2_32

sendto getsockname recvfrom recv listen inet_ntoa inet_addr getsockopt ioctlsocket socket closesocket bind accept getpeername select __WSAFDIsSet ntohs ntohl htons htonl setsockopt gethostname WSAStartup WSACleanup WSAGetLastError WSAAddressToStringA getaddrinfo connect freeaddrinfo inet_ntop send

gdiplus

GdiplusShutdown GdiplusStartup

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

mfplat

MFCreateMediaType MFShutdown MFStartup MFCreateSourceResolver

mf

MFCreateMediaSession MFCreateSampleGrabberSinkActivate MFCreateAudioRendererActivate MFGetService MFCreateTopologyNode MFCreateTopology

kernel32

HeapReAlloc GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTempPathW SetConsoleCtrlHandler WriteFile GetStdHandle FreeLibraryAndExitThread ResumeThread ExitThread PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW FileTimeToSystemTime IsValidCodePage FindFirstFileExW MoveFileExW SetFileAttributesW GetFileAttributesExW GetModuleHandleExW HeapWalk HeapValidate RtlUnwind LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx VirtualQuery GetProcessHeap HeapFree HeapAlloc InitializeSListHead RaiseException GetStartupInfoW IsDebuggerPresent CreateEventW ResetEvent SetEvent IsProcessorFeaturePresent GetACP GetOEMCP TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCommandLineA SetCurrentDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetEndOfFile HeapSize SystemTimeToTzSpecificLocalTime RtlCaptureStackBackTrace EnterCriticalSection LeaveCriticalSection GetProcAddress LoadLibraryW WideCharToMultiByte GetLastError LoadLibraryA MultiByteToWideChar CloseHandle WaitForSingleObjectEx CreateEventExW OutputDebugStringA GetConsoleWindow GetCurrentDirectoryW DeleteFileW GetFullPathNameW SetLastError CreateThread GetExitCodeThread GetModuleHandleW LocalFree FormatMessageW SetCurrentDirectoryA GetCurrentDirectoryA CreateFileW GetFileAttributesW GetFileSize ReadFile SetFilePointer FreeLibrary FormatMessageA GetEnvironmentVariableW CreateDirectoryW FindClose FindFirstFileW FindNextFileW RemoveDirectoryW Sleep GetExitCodeProcess CreateProcessW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject SetWaitableTimer CreateWaitableTimerW GetTickCount64 GetCurrentProcess K32GetProcessMemoryInfo GetFileAttributesA GetCurrentThread SetThreadPriority SetPriorityClass GlobalAlloc GlobalUnlock GlobalLock GlobalMemoryStatusEx GetSystemInfo GetVersionExW GetLocaleInfoW GetUserDefaultLCID VerSetConditionMask VerifyVersionInfoW GetCurrentProcessId DebugBreak GetEnvironmentVariableA ExitProcess lstrlenA GetCommandLineW ExpandEnvironmentStringsW GetFinalPathNameByHandleW SetUnhandledExceptionFilter SetErrorMode GetCurrentThreadId GetModuleFileNameW MoveFileA InitializeCriticalSectionAndSpinCount RtlCaptureContext GetStringTypeW GetLocaleInfoEx GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW InitOnceExecuteOnce DeleteCriticalSection FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle GetNativeSystemInfo SwitchToThread SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock TlsFree TlsSetValue TlsGetValue TlsAlloc WriteConsoleW

user32

SetWindowLongPtrW UpdateWindow GetForegroundWindow EnumDisplaySettingsW IsDialogMessageW PeekMessageW DispatchMessageW TranslateMessage SetDlgItemTextA MonitorFromWindow SetProcessDPIAware GetMonitorInfoW GetRawInputDeviceInfoA GetRawInputDeviceList MessageBoxW SendMessageW PostMessageW DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow MessageBoxA GetFocus IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard keybd_event GetAsyncKeyState wsprintfW GetCursorPos GetActiveWindow MapWindowPoints ClientToScreen SetCursorPos MoveWindow SetWindowTextW ReleaseDC GetDC DrawTextW GetDlgItemTextW SetDlgItemTextW GetDlgItem EndDialog DialogBoxParamW LoadImageW LoadCursorW CallNextHookEx ScreenToClient SetCursor AdjustWindowRectEx GetWindowRect GetClientRect SetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture GetKeyState SetFocus BringWindowToTop SetWindowPos ShowWindow CreateDialogParamW

gdi32

GetDeviceCaps SelectObject GetStockObject

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW

ole32

CoCreateFreeThreadedMarshaler CoInitialize CoTaskMemFree CoCreateInstance

dwmapi

DwmGetCompositionTimingInfo

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

554KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

257KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mydata

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

SP_ANIMTRONICS_0.yytex

SHA256 8662e4dc38f2f33ba3da0cd5a377db0a87f59ad8be9682318e20685686fcdb3c
MD5 983de089f5633d1adc2d4629271ca962
SHA1 3f746b1535bbae22801539f31eee35dc4e23a6d3
SHA512 915e13b45adcdbd639db673a99a6287a3ac92a070643b07dcbcf8fdb2e0b59264270b0cab6f84eae0d0bbc2a43496e44803f0bb9a9fc42369932be346645673c
SSDEEP 196608:a1VXHoHWGyRY/cP/MweEtS5Yg/pndVtyqQIf7tV9IfoqRUYrhAOAAQmMbMBE1Dex:8VXHSiecPEweEtaYopdbybUoUYrGOAFQ
TLSH
T1DBB633950302B4A1F76F9078067787D18AE48E9D64E0EE09C617B827C9F56BE4E1C7E3
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_1.yytex

SHA256 b6f5373f3d360ad6c1abe6e893e5dd76bc449c829c217a88f140079877194ded
MD5 1aa8729f547a4f0cc16f8a1b68c4425e
SHA1 80d8bdbfd9f3277eb9dba07812d25f6cd635a600
SHA512 55b52e36cdda609ee2a27bffc96e8786405fb89542ecf9b49ea460a22f14a761d39f1a05b453b9985e974e4bf8bdc66ad5507fc3dbd9d45322f2c33c24c7345c
SSDEEP 196608:Ak3vMBE9gS7vKiKF8lKrdmvuzSm2NNNIvMCFeJ2NQFycr6kAqWhfCPrG45/c1eG2:EE9nDKidlssvufTMCIGQFX6N2bGIGGWg
TLSH
T137B63335D23CA40DF87D8FB640370E6CA2C81C560E07AA354B2BBD7177F96AA49454EE
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_10.yytex

SHA256 ff7314ddb2de5d79b01d30eea02cfd9f1098ae7c423e18b6fb06fb8804ec4ef4
MD5 0c40163886ec2faa22bc39e42e9ec3b2
SHA1 fbf4ba6d6e662a5533faa622cc0531cc73efbd51
SHA512 4c64c808cb7c90422f4285c6c6cfb9c527e0bd9d1339d6b485a8aa530620b5f450e8088220072e79396ccc8a883d71289518623cd9ee1384a04786c7d9b1303a
SSDEEP 98304:DtS/nyI9kHH7CrXp0uKKnGIorAn3VAmOpRxE1o1J2YqXQTFERBgDbUaCRN25LRq:x89kn7MnGIokFAmkE1o1J9qgTqRBcbUD
TLSH
T1943633225AF16ED7D5813E78F4BA482A7866CDC823562E0C0C945D9429B4FDA7C0DEF3
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_11.yytex

SHA256 f61c527afbc7ebfc5588dcad0f8a671ea2ccfeff78336d38572ba0f104d3572e
MD5 9afe69c24106ea72fa007805b1662005
SHA1 6d9cc6bf48996cd2c849ea2af0aa785a432e69aa
SHA512 af497d792438a00b402b3a5d9e64cc372b42fc715ecfd766ce78a1c9d043e523e3f297e5e9da07aba36c001d5c1ea4bba73f31488b18af48437b7ab298218c42
SSDEEP 98304:sjY/VyRoQq97LuUh22/TAzupQLqxM+wv+yDyoHY3n0z0ixBsXNLwc:7NLQq9vTAapQWx5w4oHY3pyBsLb
TLSH
T1C646338D3E9E1A02D958C43CEA49F97523702CD9A58039787A547E1B3E74A9CCFC72D2
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_12.yytex

SHA256 7c8de97c1e439586d50fc0aab85da9ac35962fdeef0f47f7d44dbe8ea1ace938
MD5 f7278495387427915b088b6d832b78e3
SHA1 efacd58ed3b8c59e18523bdb8bb17a82734a5a63
SHA512 3bb38ad8535ad5afd7f2aa47f7951422a1e60336f54ccecbb0436727e4b68afecab33bd36eff99feb66c8df918930cfaa621789f731ab9b0209f1da2c068b855
SSDEEP 196608:v20vpK9HLQgEfKt+oq/2i3iVJXmHwyFsa7iqkhY16zOKC51YV0RpSbVwrhNdtcUu:v2DVsgEKJpJX4xf19551YV87XwIglj
TLSH
T126E6339D1D0A496EFE978EB083F38848D5E7EED45B6AA34CDE946D80B87030531685F3
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_13.yytex

SHA256 3433e94b81e66720f844fe183b98254e7baa76bbd5e62ba0e72280c64420b2d8
MD5 7a291deb28454eb5ed553c7bdb88306e
SHA1 bd80e29f588d1ae77774bdb87db8cd52068ccb38
SHA512 27ee7a85d6489132b433798d2472a215467177440da43eb212c7595926c4ae282601726d9a57cf58b2b946de8ac924ec4a54ae08817fab56d417e5118752ed6e
SSDEEP 393216:TS1+/qXHkq4/wFcElloMHsry27xhm5F0S7h5Gxv:r/1q4/w2ObWb8Fp95GV
TLSH
T13CE6333BD35FBC6FFB421178F28666B68AD32D312A15485E92B774009DB9827C5C3293
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_14.yytex

SHA256 f1feb4ccc2dbbf4f601d6f061bcd69817cce0cc8d7f3ad3cb2d7e34154d02731
MD5 104da562f4bd12c8a9179764b88c26ae
SHA1 f58731c0986ae9574c710ec28ac6c48cf916dcd3
SHA512 d2964ffceefcab62460df749677ff251a68f9a3350a9f030c222afd49a2d367a451b1dd99ac8bc2f2bdec416770dc2fd87497332d40bc83d780fdda5bdd52515
SSDEEP 393216:BUaJ5CNCijYiALf9hmZUchIR7BwSLJvkHS/G:6kCNCijYiAXMIoWJC
TLSH
T1BEE63332F596C76CCA56F53E46265251CBEB2A31D4C3BEE9C8D99A8C6BF040B614D0C3
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_15.yytex

SHA256 d74059246d843a583f903109529d3e1d49cdd9414a2234f42e5be7087cf20ac5
MD5 64ea74a8949d7eb55addd6aec41b442a
SHA1 967a3d02e790bf5c3742f16fa1666b0d83ca407d
SHA512 1398f11cc8e0dbe6812478d14c02145c6bbc005c5f6b585d23b4c3f7412e044777bc4392bf6c05f57a1b7d0686ddbe632e940bdff4b8fb2380ee17f16908da96
SSDEEP 196608:dZpfjIT0Xie7WBhZdf/NcfgathlKBYjyR3hqWRIDnYw9xI7AH1LH8:PRj0K7qvf/qfzhlKB484I74LH8
TLSH
T19FB6336B5BC440D4D71A5B7850E0A4E3ACF448C0592DF55E08E664B83FE68B29DFAC3B
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_16.yytex

SHA256 1887bc58b70ad9284560941668128b79beb14ea15f8305586936514d82cbaa31
MD5 6806e4c8bedc06560908037b425cfeb6
SHA1 125630bbb40730f61981c0c916c871cf923b48a5
SHA512 2cffa760aeac5213b77297a1c55b07492c5bda8e2c029d77bf2bc314aff9dd274006cc6cc1b99434175bffd33b26bc2e4c9e26af5908fc1b0ca469effbf1b5ac
SSDEEP 98304:1/qQgJOy+zoVE0E9MLxtpMuTh6sXeTJDnnkQhe/dAPobuIeiVRIly4HPRdjH92N:1zCh+MtAMbpdTh/eNoZWPanxRo/jIN
TLSH
T1507633DFADF62A47E09EB2F711868666E3732C64633244900BDF7B14686FA301C5A5CD
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_17.yytex

SHA256 1f2e81a59c65fd5cb3111bf14a7cc029ac887f6b7c5ad346a903d9976f6a8cf7
MD5 682d67b177ad5ca083eee717f48789ee
SHA1 eb93dc5629c6b03e61fd4925e148fe0b720d3bd3
SHA512 52a92236a108c54790107284acfbcf10225c0ed72d4fa9a20b9f9bd22706399d00c7eb6f38ff4e0e515d683f6a68bf240b08c8d59fad99cf51c0b23b009f1c27
SSDEEP 196608:YUBC2WwUdwwxtQ7I183WrQAwK9fi6GtqsmDbsnRuSMzU2:xA3VlxUx4Xw6GtqbDQRr2
TLSH
T11B763306579B4B83C9101F74895A1D0FB9FB0F55488A6C182FE5BC0E0EFF94EE0665EA
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_18.yytex

SHA256 f5eea4768c8ebca07107aa328c3bcbf33de402589792c28275f2da153953dac3
MD5 3b008b496b72d024489e66a4735e93c3
SHA1 a616f328feb8877d6fe9d9818ad3fea17fb2a059
SHA512 87855245b677569e7bc2ed717488bf0f993419d18077f77f987ff1b506649b0674574b8863d1da1de1d66b31f375e9ace56c0398ddb9f9a4f4f7977576f822ec
SSDEEP 196608:NEzUppNB6iuoZnKAqxNeKCvUXBixJNXK3kLe4:2Y3NXnFhKLBMNXs4
TLSH
T1406633453B8A5BCAFB8E58B65B6251AECDD848474B9C0614FDE0F2C3B16D1F10A14AFC
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_19.yytex

SHA256 8afe71a3fa7173c5730df6e2eee4762ced33840c2e9f1a0423fe9ccb75969e90
MD5 4ee825fc03417db8844b55bf0d089c8c
SHA1 10250b47040de0c90c1926ce7862334164ccbe75
SHA512 bda933ddf62a3e402325a4c887ca461c47ae57d5aaccdce98626601c2eb3b1335474712efeb6380b3667f4d8f5ed354e5c9c58e49c18a88f86d7de1bb610c72b
SSDEEP 196608:QCCr0zILfvNPNWgKb4sPWO93XVom8oVTgWRvQYxsb:QCCAKvPJI4sPfxVfpTQWsb
TLSH
T1A696332A970CF933C5918F31539AB83065B2AA4452F52DDE071FB3A01E7506F8D7CA6B
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_2.yytex

SHA256 d77d67007f5f4b2af520bf577bb1f42878d70ba83c50b70186d3db262c6afd7f
MD5 ed5b2e966f02b50498a999c950dd691c
SHA1 47a0ea86874264e43cb76ece72bae8a2f4f7664f
SHA512 b002dc379897493326d1d8a6f84bd03af069e740037c034b66c0289beb50a871cb3e0b26b3080e1f60ab2be0466a0cdf6b9ed6a02cf14eb837970b862f6db116
SSDEEP 196608:xdnwtRKri+7cbwBNGfi2mSKFvNzLlr0u6zL22ArB6kdjYfuWju6yfPEn+CRPi:vwYoSGadSKN1prwL22Ar3d29ju6yf8n+
TLSH
T1C5C633EC20D490B2CF9D0A3692D251550A398D4AE469747FCBC63BA713BBF2D7843786
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_20.yytex

SHA256 3f5af6e05ba9ba34c9a8554822bc3e4eab95304639c19f2e7f8c51f9bde51e84
MD5 81824467f72ae9320a10c64db77f906c
SHA1 8e75b2bec820fb54582773aa723334d7442ed3b4
SHA512 4f2804d404514867392b220e833c99fa1cf5027f4093a959ceb0b9a51d1ea2a190fb11a8f3113017e6c0ef11a4d9c09e6e627341de59ed4a9dfb9c2dfbee0675
SSDEEP 196608:UhcDvOfhF0LGBb8rhyA/Ght4SkcxyNLPXhZ/actpiqjWLUp1A:hOJF2jgljejbtJyLU8
TLSH
T10A96337C92C12B02C0EEE070201B2F54DCD7AC9A4E7566537F666A09BCF8625FD8C7A5
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_21.yytex

SHA256 71859dca9c43df00c0a13dc400cd5010fefad6ae74f496d92909060c5d4ca5fe
MD5 fcd349f8969974e182b5afa882335b58
SHA1 9abc8e1033eb01a7100971e69db495f4a6fc92a9
SHA512 058f85a726666e69d2215966b89e80151fbe705e86678793c1d47414c765483a12783c1e2693767834f2372fc79cfaebb2b579c861901f8aa856af21e6a3f484
SSDEEP 196608:vpCTAz17mGyoFSYVZ/bwVDq3lMvbehnYom7zYx88E:vvhSGyoAYD/bwlGlcehzxy
TLSH
T1E176336574247A36D44F0C3F1ECB62648B7A9D857D0EC48B320A867376E0BBD5B11BA3
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_22.yytex

SHA256 2ae290132d620366f043a71131017a1d635f74bdc1a1df96725e4317899a53db
MD5 f827166bfec9145b1d2d6a228609a004
SHA1 3a140f9561ff8e5540b60776648b30fd01718ca0
SHA512 32350b5016152689c63c24452b72529fc47a37624f50f1203990c8d8108f979bb80cec8449c04149a78d06607c400d4f48b98630faad21d925e549fd4fe3ca98
SSDEEP 98304:zNGpV56BPDKDGjN7WCj/lyc3LaK3I1xXjTjA8hjLXTdvN31vBUyX4wlVUoEJZGUO:5bPDOGjgCjAc314fEoLXFB1+c/moEJZW
TLSH
T19156336BB2F62816F1B9A074A4CBBE19E4C25C971BD1B72FD1D376A24633E350D43A10
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_23.yytex

SHA256 f986d58dcadb31ebd16ff52a642a9a344e1d4e04373ce8837b507ce4e9b0893e
MD5 a936615a536314c71b52c1dd9ec24d9c
SHA1 33b87ea601cb496998489484b0724ed9fcf714e3
SHA512 5daf7a1a0241ef83074a3b1e6ea9786aa4be0624446ddbab379c7ab3440c3a2fd3a25847985181f8295e9daeefd016c76e62747071ac96e9bb1c52e39d5b5d65
SSDEEP 98304:L69xPXGXU9oQf1h8QighzXC4wV1VHfYsY1L2Cs5D6psKcGgeckJDbcoxYMUW1y5v:YX39oQ9lVgfssgpsKcGge5fcBMIRJ7
TLSH
T127763383D5627DC2DE299335C8E341E52867B64AEDB152A3A2C6728D00F0D6DFF05B87
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_24.yytex

SHA256 b8212d965c3aa3742a3f41b9dd79a90dc67dd73bc402228b8bfe40728ecff4f1
MD5 01b5ec2272a424e4d169f4edf3c33ece
SHA1 1f91ad1ed2a8bfcff30cdbd008a6d03e88a63f24
SHA512 7df217d719dcf3033dea6041f72e5b36d548f42d0d5b03e9374d0b68a05a11f0d0920a56bb4357a1ad8cb9d9068ffbc591278f6fbb1bb7b916a82dacc8b79f96
SSDEEP 196608:exfrE/O/Qq56FFLLm4VHOdh6NzBh5wn7/SAtSrruIlqCx/:elb/Qq56TLq4Adh6h5wnjh+Ya
TLSH
T1248633E51D326F52F2E750B3716FE2125BF4DDE2B800945A88023988B53FEAB2E45753
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_25.yytex

SHA256 4109af087913477a5f5da2ab8c292a2a7be47ff8749323015b040ec39bc96faa
MD5 15400d5d2ef60ab8a2a3dde7f063c5b1
SHA1 9d17223890536858987f43a2b615c2ace818ea52
SHA512 8ade44af725bb73f7b135b0f6354dc30c828b8a6ca936a99dc3df25c83382d7220149c2b4dbbed496c8a9df0368da9b08499f8f06b7c8908e25407f0faf5ea66
SSDEEP 98304:yXKSNDXwR001Z16o6uQoZurfPOF7+pFuOO1HQYjXkFWrEZQ/GRfMwiOJo1yc4G:+KSNDA/1nn6uZZTeAOO/IBZQ/afMwTJ0
TLSH
T1E4463312DBBF8666FD093A3417E81480A58F43E5A0D2A6009C7DB813F5F9D519E8F7E2
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_26.yytex

SHA256 2c5518149687d369ec4942359daffbb75e3367cd51f84e2e37bb0e25d5f40995
MD5 7eae0ad4b050fbc015609b417b9c7fd1
SHA1 0c05aafea6de41541dc58a64ca18091473ae3670
SHA512 2930b30f7a04412dbd954c5c1837f5c25bb5632d9e73d619b695385e2d46d295a781ddcbc4fc63e74e943598c07e429637f1b1c655c59a0580c64465d080d4e8
SSDEEP 196608:l/DI4lEmpug3+icrIuahY9/oVxYtS8ifDFaDfyaaDz+LO1l7:CSlirIu80wVaniLF02+LOj7
TLSH
T1577633D4713F98B4C09A5B7987AA9392B1605CBB7BF300AA4BD52B177CA02D091C7F17
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_27.yytex

SHA256 49f1bca6bf17333fb2df4700d6f35ccce3d240c0beb051c55de4cb7b30f855f3
MD5 3967eeefc64a0f5a3f1fcd5c53728237
SHA1 fd4953917ddfb9c6ca21f26f90269322630f3ac2
SHA512 10adbf06ceb3bcf9559e6469f32b24c374cadbdac524dc8315fd33a4b55c4ddd42d68f0f41d5313f096f60c33263e7c6f587e3d962b3f093713c2037da573c25
SSDEEP 196608:Gr3M+GH28gKy6I5RbOvKYJtJX1EUWc/MpSJuO73teE4:e8L281IvOvKYJnW7ij3cE4
TLSH
T17A66330194E26348FF32D27A9D57A3CE85351DC988F0B110927A838BA756DF9E06F763
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_28.yytex

SHA256 705faee61b0972db7e56f53fde296c3c4e113a6b16fc19bf94e576b78d6e23e9
MD5 09d5bd3b3e894088996471b18cd2007e
SHA1 830779b918badd116d5a3326ca0c9a531e7f4cda
SHA512 d04cd9d98485704c9c24d95a6cdd7aedf24eaee2c4b5d515885112970c9f5659b0c809cda1c1f60cbd0f455da84231f86651825c91d7edecf9ec569fc108a3a0
SSDEEP 98304:Qba6r6nZHghIdysTvBDq0bWf3D/5SG+hmCNCsKrwDoo:QumYksbdWDojhnN7KrUN
TLSH
T1601633BA13FA4C28E07B50B054AF491DF9BF936E3269764492D4B0216CFCFA94D91BC1
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_29.yytex

SHA256 69fcfe05840c03ea1cbc684c9457c9aaaee1a82ba222cae930f83e46aa8b778d
MD5 0264912a8673c9bdf8e2368d29c6a969
SHA1 8c629ec1e9b557d871f84caaf2a2db546304348a
SHA512 07aa4622c2eabaff97058632ef5560d7669571523fbedc06afa31c57ad0ee02dd66eab10ac70c04c314f807a4c897849a9e20e747b87e691172c7f62a6d7f273
SSDEEP 98304:gp5ABk6pcYccGSlKsm4RNNSZIb2Leqhw663/JB4OXrZVh+SXMW7VJTf9:guuucLcG0Ks/kOyLeqh76bdVh+mvx
TLSH
T1AA4633285E920F59D8D2DEB75F55B0243F48AA430B2A4BB5D846732407BD8D8FF2F621
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_3.yytex

SHA256 fae29648915e649a4d6cc1d3b2ecbd6f409011083fa1489007b6ce9dc38c12d5
MD5 5f47af2ff6a220d210c3e9c5c5a2e17e
SHA1 e8509d7bfee4abd01c87d40ac284f1549c08c3a6
SHA512 3609f2bf8fb8ed0a1fbad1f8c3b593a20dca5fcf14588adba62430b74c4bfa4e671fdf24c3d6c6a4ea210db05ff3dfbb6d412042256d756dc8c5050a4069ee2b
SSDEEP 196608:XXzTRdGrgIdnMNxoV9QjtxhrZVb+J1fJ9Pi4RJAvgDmPlbwSZdvOMM13itE0MAvs:XnRk3nMXdZ5+JnltQvgDmOSzcskADY
TLSH
T126C633F2310BEAB9D3F1693F1B99122A64319FC8BA79D93F00F43A513071525C4AA7B5
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_30.yytex

SHA256 e065fd9526d5cf21d32c831630e2a471019734d81caf04b4136ecb063e558cfa
MD5 e456ce04f534d46304b939fc31682906
SHA1 94c426696a7aa1bdbc2a6ddfcf1f7217b2e67096
SHA512 88f5dcd5a23329ba12637822f7fd9b5b01b98094682724a39c9e47f700c3fef658846a3f061ab0f675950b057de1c03e88915a26c05aca17b5f5c4ecab44dd6a
SSDEEP 196608:I1DNFQhtalKZogIeJSO9WXEFBa0APv81y/LjeH4ksgXNZsR:W4htKg/SkWXEFBaUyT6Pc
TLSH
T1438633AB2630E195C1252EB0600A6E1652B5CCB4FD8CA506A7447E3D5C33C46FF6EB2F
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_31.yytex

SHA256 71967689d70139f2acc31238af352349dbf0c3f2256d69fd116b52fd44b2f180
MD5 fcef2c40d3034c95c57cdee790fc27df
SHA1 125227e29752a67ced9e376ac4ed90f4561f1a22
SHA512 c2bd60789a7e3136af533e99bbf9fd0f3359966afb0b79d3d8b0bf864e9cd9b9584870f2cc735265ecb99a6bcb1d961b6a722360b93be958cd6e6a72db9fb655
SSDEEP 196608:q4QnBlQzG+wJHWtHdq2ZN1CWi/NpVdTZ/6DLxx8USs:q40lQzG+AAdoNB/ia8
TLSH
T1F856334ACD309176FE6A47738B532FA587A4A9A30B083734B153F25B89B721AF57F440
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_32.yytex

SHA256 8b7a2cec85d6a43e7e600acc0b680181dde64a112ac5091806908a21ee8e8121
MD5 482f813338293778ef43f2fd71963474
SHA1 65136f6fa728127c5bbf3c384402fe996705540f
SHA512 1772fa4b6e077c1b6adeb57a570d9e147e92ac68d13f4d8d74a9f0d24ea1d36bd99800be0c04206785a8d62f5bc7e389d3c02c678ce1e295e2ec82e94457101f
SSDEEP 196608:nA6oHE1lQOnrB3r3bNYqtsX5r+0Fa53F7YupEU8b+74:ATHE1lQOnpraqtsX56oK3FHqt+k
TLSH
T14A9633A5858EEF6CC20007768AD23D7E6A336C16863DA164E82C3CD8DD6D19F794D3D8
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_33.yytex

SHA256 7065500e3fb3e8b27ef7bbb8e2b34263920119a5f54a1cde2ec84002b6e0ddc1
MD5 b921ea0b6f9ec31b4b730d9e160a2dbb
SHA1 2cbcabee12b458b5fa63de6aad60ff949a28ca68
SHA512 aacf6a151eb0303151d5d8088945aacbcb4c1977434956317171a667870ada6a257ca56fd32aa96769ca7e2ff0ac2f31776991e13f64293937e612139812d390
SSDEEP 196608:VrZPYonwzLFKDetOmXQjt7mhifmT5ZMiAy/x4oEyizn:VrSowz5OmXQZ7PmT5ZPx/2oElL
TLSH
T140963300AFC242E1FE5E9B58C3849AF6B943C94D149B75413DABF1AB3F56328A751C2C
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_34.yytex

SHA256 683d9266ea11d48b9f69e1e18b9c7f73019f1d6ce3cc072286915838f91b0608
MD5 7d3a99cfe457c8f08098f0af4a7fba49
SHA1 06f5dcef0d9fccdcb2db2b8d76ed379392d2da09
SHA512 8e7ac3f0e0aa2fe107652e7855aaeccd71c7c46301946e73e2657883c2b2bf1bb2d951bf960e121c256c6368a8c81908820da170d72d5a09212844d1d5321aa4
SSDEEP 196608:KslXsL0dN00uCnknjtc22IiyLfIGO4x2a41nlC8cN:KSXs+0CuZ/i+fI8Ua41l9cN
TLSH
T1FB9633FE03771CC5CE7B5075E01BCC62ABD2F39B73FD08D3A322AA9688B28559494951
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_35.yytex

SHA256 c71e4822e7325d648b0b05840005b47365a2882ba4dd0800e6044ba62c3f80d6
MD5 e23656bb664dca1617fb0658930d3c64
SHA1 29ef4e2a9e4b3dd4477c48627f5fab551f6569d8
SHA512 88b8685f4d57c47a9e718f5aacbfb0648d1e148592766a974031b77306ff8cd3cc0c4a0032d05c889382fac7d9943b2045a0ec610508c9410fb2a7e512181fea
SSDEEP 196608:j+P7bQDirxmWBtLoo+RRhwhEm//tTlPxXYGIMx1QT4UrJm:jyb1mcOo+RRhGHthpXBbx1QT4UrJm
TLSH
T1BC8633C299C702F8D5846B31908037D39DBE9895B71B800377C566F6FA1892EBFA74C9
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_36.yytex

SHA256 903689a71f5b4e793052ee45d41e9c258b5982005c2cb87e3a82f20a63923aa3
MD5 24ed1ac80794996b578a4e5aac7fa5e8
SHA1 3bb3d207cf772e2140f36b72c6d3bfba525d3443
SHA512 47d9a222891c79a0ddebe3b457ed1df1b37fcb8e208e6434664da91380de5834aa5a8e24e1d9528ba2bd443ea59339bf10774205b7cd441a01b9056609d64475
SSDEEP 196608:yDS3bL5NPfF8ULJ2+snY1y7zmQ11k6YDvGqUpSx:yOXGc/RcBXk60qpQ
TLSH
T188663355AD554F81E6BE07B59303EADABB8715BCECED1C1F09C1330D0AB50C8EA526AC
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_37.yytex

SHA256 5a76a606defde9cfaaecb31dd1870661c19f186723a6441f876da92a335bed83
MD5 a76c69234fc8846922ccb621be2c6c43
SHA1 f7ba56d730dc6ee16dd27f0ad97a20f0f8090656
SHA512 5c87a3c0342d04a692613f716bb7f670729a1d3f52bc117ac70962e9dfdba8ef77f45d28f2a1482570c2eac2f237eb6975121673ba3341a1b78fa2176cbc5318
SSDEEP 196608:zgwZxRxQQDn40F4huwAzmAtoe0rdqyYJvOi:1ZxPQun4z9+toyyYFOi
TLSH
T10376333127BBCE86DF804F7DF8C340DB3778545C599455E0A0AE7AEAB85B10B76A8324
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_4.yytex

SHA256 c8e2871ff230c5ee1c3768257efb24ac1b6962be2d5eff8df652f2e52ad56db4
MD5 cf8170b04e1673152f0ac4882eaaf59f
SHA1 6c690b32b7c296a51d35bfd33bc27e62396cef61
SHA512 47c5f319c32dbc23705f41a5932fcbc9858e031e502b4dd66c72d575bdf18ff0df69cab558edb83cb91e277a5937d490aa2beef8d329af85b98a57a9f233266a
SSDEEP 196608:Dfzftt5eXRjS6B7cWXdzO3pWbis+sx1f07JN2LgG:vVtSjS6dHXhO3pWbis+sx1f0A
TLSH
T143A633F699E1A0E1E07458B4F83A565A8425CD60511BFCF0EBF5363AFB313D1B8A0B81
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_5.yytex

SHA256 52de670a83c6305bd6eb1d55f96c659507d2ee784b394acf68e8c361ffb7921d
MD5 d2b5b835cd8568182e3937a483638f8c
SHA1 e339a28b784f1380095757d45570b98123054719
SHA512 8c6608c12b218f3f0fd8074875cd510aba469d90e70d47c6cd2fc52d27895be76e280a82b3105a81244983e5e41595d3b26423abe5694181fba052212537635d
SSDEEP 98304:BfMBQ45A/pm+OWt5HH3iNZBwDMx+nUFtfJ2b77wmYo54B5X9SgSspvhEHyQbGoGB:yQ45A/pmMt53i91xPj2bgTlvNSpsB3PB
TLSH
T10F56337B7DD73EE2F2BB18358019FBA672B94C4984AAD417B8981B49D4BF903C61E014
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_6.yytex

SHA256 3cb6f1f66d2244a5378de1a59742aacfa8c9df517f61a27b191dec81223e661a
MD5 f9a679d48bacf9880ebf8b872a161dcf
SHA1 5f3a854ce3bd68a5c163d02e07d5992753ff1627
SHA512 12b3669c3ca159edb918290d704e714b85345168da504a1ece61004cf111f98cd79da4340f97685eda1576fe03a8da294eb28ca36c9ec1867f0d1e80b9dc4f64
SSDEEP 98304:t5M5BdJUBSXuA2fdb3bptRjZpIPFKi83Pmsb1fORTmnMZ/CHtYb0JKUqkRP:t5M5Bd2j1brprkPoi8pZftyCHiHUqkx
TLSH
T1534633BF4336592BC887C0F305234A997DF23D93BE65562E7784B41A1167CA0B231DEA
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_7.yytex

SHA256 9a944d45b5cbbfb6f1f7304a3c9b3d6a0dce31a273ac2d8f7c824bab5cf640d9
MD5 8fc461d3ff78392587b51b71d572fdc3
SHA1 b05ff2a9a0f48af9b3526258f7e1867a38ef8d9b
SHA512 6fc7d3a56db0ed84a30fa07113a32d0aebd700635f189de46e88a2e149b2ef100278b40d2f737378346d6dd651d104dcfcf2b9b7b1b6d68a787fc2fac37023ec
SSDEEP 98304:vjavmEwS98PIK5tOKp5BMKwH03lHTAyGNjkXEO26RXeF8Mx:OvmiGpTMJUVHT+oXM6deF8s
TLSH
T187363395CEEE4E4BCE982E771AC320F976843D55EB50E42BDD723C9C492CDCA981A344
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_8.yytex

SHA256 b9b2dce8e76a4c131c6530104ba741300d1693cdc413b87accaa35946f95c70a
MD5 3bbda711d835d35bd8b04af72305bfb3
SHA1 32d4d0a573ff8f36ac2f2e5f90c88820ac056c96
SHA512 a57e924f6e1de32d57558da478a7428eb739552af6b1accd081fb6eeb579514b3925f5c90cb788e3d1a6fc1772129dd2b42ed311f7a744119e9f65bb1a168052
SSDEEP 98304:/Sq+zGPrv/FdqTLeWaAEu/7oZoTMG5YHLdimpqgFV6hvMsdpiAIRSUyk4z:1PrvnqTLefHujoZoVYXNF0ys3ilKj
TLSH
T1DC3633D50BC042C7C06EB579FF9BE291968B7904C875A628C36EBC98F0BE9781591F13
MD5 SHA1 SHA512 SSDEEP TLSH

SP_ANIMTRONICS_9.yytex

SHA256 9f917e6e2b1df1153b52473291487b2f05e982f83931475eaa19d8efc3390df7
MD5 3cc2cbcff7dbef4ff7abccce7ee9bf7f
SHA1 8f0ac9d8eba3e0e11f7af7febf3c76c6f4c1ff1d
SHA512 4ad6a2ef1d019deef08b4b9de660b4bc656218e355dfa94faa3525b8376ddb98142199055168a3e8d79b4ecc53ad0574bb13b61ddbc1d5886ba52b737a9549b0
SSDEEP 98304:nCrNdhbzT/Cr9vOj2avxaX/T2Ck+6YeY8zrw7zQ:CJvbzGhvpa0X/T2FZzrw7M
TLSH
T1D936334E977CDE29EE56FCF41152D666EFC2A878F462DA5B06803A20407239C9DF364C
MD5 SHA1 SHA512 SSDEEP TLSH

Uninstall.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 bb00629fa5a6b409d65b73e7a32f19eb3596348c90014bbf6d3273acc97d2b94
MD5 ca022b958a7589baf9444def9b5f6cf6
SHA1 6c4b336bbe005e92009abb5521c96f2ca6a0d35f
SHA512 4a822ee183775449e292525f595992c402c7e07c2e1f26bacb42a292686fdaa0c8c76745d9be6aadc70771301970dd85063d622d2572e478c0b1d858f253814f
SSDEEP 3072:w4MrfWdbcDWToWNGL/o2NMfrgAfajDDd5zSTaarTUNZ0:1MrudbcDdcGL/MrBfEnd5zSTauUNa
TLSH
T1A004070B76838D87D343623D4824E77D26206FE84827B62A4AF07CA3F929F475D5D2E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/InstallOptions.dll

IMPHASH 06a4f1236d62b715e2a75887755952df
SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
MD5 6f3098fb5f3db26f3bb84f5481109e39
SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
TLSH
T14E621A527AC120F2DDD6A53037E77F236FB2B52094D58C1B97633E4B5922212BE39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcmpiW lstrcpynW lstrcpyW lstrcatW GetFileSize GlobalUnlock GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar CreateFileW GetCurrentDirectoryW GlobalLock GlobalAlloc GetModuleHandleW CloseHandle WriteFile SetFilePointer SetEndOfFile GetPrivateProfileIntW ReadFile lstrlenW SetCurrentDirectoryW

user32

EnableWindow GetSystemMenu EnableMenuItem DrawTextW SetWindowRgn SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW SetCursor MapWindowPoints GetSysColor DrawFocusRect PtInRect GetWindowLongW CreateDialogParamW LoadCursorW LoadIconW DestroyIcon LoadImageW IsDialogMessageW MapDialogRect SetWindowPos ShowWindow DestroyWindow CreateWindowExW CallWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetClipboardData CloseClipboard OpenClipboard GetDlgCtrlID SetWindowLongW wsprintfW GetDlgItem CharNextW

gdi32

CombineRgn CreateRectRgn DeleteObject GetDIBits SelectObject SetTextColor GetObjectW CreateCompatibleDC

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
MD5 ea00e2678e4679ba28b0f560baec9776
SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
TLSH
T110425C496B618EF2F62A463729B77F264B38EE1411E446DB8FD38445E8A01E721363C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
TLSH
T185C0128DD09A812548222707BE7ABFA177903D505B2718F7D1B24D17CB4C9CD58CD5C6
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-header.bmp

SHA256 55b900f6e1610f464bee6e82d1d2da8c3738f33a0f7e4c60ade292667ced244e
MD5 eb92c4aa3a0e0bd7dc55baa43a20dbab
SHA1 49a4eca6eb5883e06c2264db386780bde5d902bc
SHA512 4ba97ea78b1b92d05cbe4d90b899b29014e7efd8ff3d1e0e8c73802f377cbf290b2c63f5a001d43a322f34400836f8cda28e701abf195494fa938785c5e23fe8
SSDEEP 192:eXGA6MFan3D5chtTq562ucdzqesDvV4snWbNUZRFEoPJBSMQnOaCKtqw:eWNf16VqBuScV4VbNUBEoCMQnxC7w
TLSH
T191C2FED45EC2CC72479327C3B634AE90B2089112D7EA2D5A331E2E4D0DDB7BA4569F23
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

data.win

SHA256 cbe5863caf4d35288c74ff5f45a9a7c2c14551cb9b55d38c37bc5f1aa9237ca3
MD5 a3e453edba9ea3e186fb62060383f61e
SHA1 4de374dbe56c0798e42e3eea3b2430e75808860b
SHA512 e25cb911a8389345b1b42bb77d1f66fc449f9c0678ae4aca327f701c231ff75d4e51373607eaa3e2a879b2060fca17e37763a76bd3fe8c9b671c5e72f099786b
SSDEEP 12582912:JtaTJSQfLhSH4aH3SdQ/PLLRc9CbknUOCknJ7b5kzKYIP:JtaT40LZQ/PLlWCIUOCGtb5yKYI
TLSH
T1D0391262F4838A41D7F78736DE911E500DF6B84CFD69252F3089AF04B6E3340B6667A9
MD5 SHA1 SHA512 SSDEEP TLSH

license.txt

SHA256 2c88d719c0e7ee8aafd407571ac6f1a374bd8c431ed22ea4520dd543cce29ea3
MD5 916c4589c406f7c0524e12ba8bb46373
SHA1 3dde8d42028ed22173d2801adc742e996c396504
SHA512 6cb08f79586468c9181531071acf7cc1cf5d92d1bbe96b784e6641a28ca6301b420db3fb9172a256ef1610f04930ecd283a13e1dffa5907e8de4222c9c0156d8
TLSH
T1565112AFAB8A13B615D101F2164AF4C5BB1961343A7A0B1530AD815F3B93E34473B9AE
MD5 SHA1 SHA512 TLSH

options.ini

SHA256 d2b6d2ed327bcec3e24ba0d814db911b9497ad63c69325d2b25c98b60d03a54a
MD5 f561f2b3e4e0438915c77790648c66ea
SHA1 f684b62a1408960673d1aa590c796932ec3ef19c
SHA512 ca107ddb1b69107eb5387a96cb0a8ac577afec9bc1e2e085cc1287273fd938e6cec8701e041670a8a2f36788d87d7c73d1c624152d2e821f461c01f1a4996df6
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer