FFXIII-2 - Console Content Patch (v2.4) (1).zip
- SHA256 6a6fe61a43e850e200d52fa5f64263a6e060e04e0f7b25f8e496a26db683b3ae
Overview
overview
8Static
static
3FFXIII-2 -...1).zip
windows10-2004-x64
1FFXIII-2 -...1).zip
windows11-ltsc_2024-x64
1FFXIII2Con...ch.exe
windows10-2004-x64
3FFXIII2Con...ch.exe
windows11-ltsc_2024-x64
3LocateFile.dll
windows10-2004-x64
1LocateFile.dll
windows11-ltsc_2024-x64
1PatchData.zip
windows10-2004-x64
1PatchData.zip
windows11-ltsc_2024-x64
8WhiteBinTools.dll
windows10-2004-x64
1WhiteBinTools.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FFXIII-2 - Console Content Patch (v2.4) (1).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
FFXIII-2 - Console Content Patch (v2.4) (1).zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
FFXIII2ConsoleContentPatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
FFXIII2ConsoleContentPatch.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
LocateFile.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
LocateFile.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
PatchData.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
PatchData.zip
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
WhiteBinTools.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
WhiteBinTools.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target FFXIII-2 - Console Content Patch (v2.4) (1).zip
- Size 7.2MB
- Sample260620-2yctvsas4j
- SHA256 6a6fe61a43e850e200d52fa5f64263a6e060e04e0f7b25f8e496a26db683b3ae
- MD5 062829e1582d29b5230827baa0a32df0
- SHA1 b531c844963cca70510b82d8a6660639b9927197
- SHA512 19e13f8a87ff19863eeb77eb930ab75614c9de28cc40fff048a46ee11dbaf32906c300811065c53d898e4779deda3e694e2cb1b42e106588762a3b0206fb43cf
- SSDEEP 196608:UljYzY6wY4H1xiD0HnI3UqaUGSXeSFpghLGKwATEsQS2SVQQG6bWK:UljY86+H1xRo3UqnPghLFwA9D6QWK
- TLSH T1AE7633C1D32ED69BCB39C36DF6E7F4C227322F986452090AC93B12612E8153626FD759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/FFXIII2ConsoleContentPatch.exe unpack001/LocateFile.dll unpack001/WhiteBinTools.dll
File Explorer
-
FFXIII-2 - Console Content Patch (v2.4) (1).zip.zip 7.2MB
-
FFXIII2ConsoleContentPatch.exe.exe 22KB
-
LocateFile.dll.dll 4KB
-
PatchData.bin.zip 18.9MB
-
btscene/pack/wdb/x000.bin282KB
-
chr/pc/c107/bin/c107.win32.imgb2.8MB
-
chr/pc/c107/bin/c107.win32.trb831KB
-
chr/pc/c160/bin/c160.win32.imgb3.0MB
-
chr/pc/c160/bin/c160.win32.trb642KB
-
chr/pc/c160/bin/c160_def.win32.mpk236KB
-
chr/pc/c160/bin/c160_rain.win32.mpk244KB
-
chr/pc/c160/bin/c160_snow.win32.mpk243KB
-
chr/pc/c163/bin/c163.win32.trb573KB
-
chr/pc/c163/bin/c163_def.win32.mpk165KB
-
chr/pc/c163/bin/c163_rain.win32.mpk174KB
-
chr/pc/c163/bin/c163_snow.win32.mpk171KB
-
chr/pc/c166/bin/c166.win32.imgb256KB
-
chr/pc/c166/bin/c166.win32.trb595KB
-
chr/pc/c166/bin/c166_def.win32.mpk170KB
-
chr/pc/c166/bin/c166_rain.win32.mpk178KB
-
chr/pc/c166/bin/c166_snow.win32.mpk175KB
-
chr/pc/c170/bin/c170.win32.imgb2.9MB
-
chr/pc/c170/bin/c170.win32.trb670KB
-
chr/pc/c170/bin/c170_def.win32.mpk239KB
-
chr/pc/c170/bin/c170_rain.win32.mpk248KB
-
chr/pc/c170/bin/c170_snow.win32.mpk247KB
-
chr/pc/c171/bin/c171.win32.trb660KB
-
chr/pc/c171/bin/c171_def.win32.mpk181KB
-
chr/pc/c171/bin/c171_rain.win32.mpk182KB
-
chr/pc/c171/bin/c171_snow.win32.mpk187KB
-
chr/pc/c172/bin/c172.win32.imgb256KB
-
chr/pc/c172/bin/c172.win32.trb745KB
-
chr/pc/c172/bin/c172_def.win32.mpk186KB
-
chr/pc/c172/bin/c172_rain.win32.mpk186KB
-
chr/pc/c172/bin/c172_snow.win32.mpk191KB
-
db/resident/wdbpack.bin1.3MB
-
sys/debug/version.txt15B
-
WhiteBinTools.dll.dll 114KB
FFXIII2ConsoleContentPatch.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ddd39508d7c90b08e1a349046955c0087b6dbd129dd9ae71fb970e835d20afe5
- MD5 859dbb4e1a29189a1e8d9ec3a3993314
- SHA1 7aac806310ed794ee349e09f6edececdac01c48f
- SHA512 ebafdacd369ba84f5b6913dc091bdb016373cda57102395b6ad532817b17d7f1ea792f75d0989d1394b47adffd43e041b905253125c3ff1aafdba6f18d904404
- SSDEEP 384:iWhLMNqQy/F/64YFZ2n9ZycQc9faTgTOmf4fzfGf6fVuQuCuzuDuf9W919w9M9Fj:i+P/0j2n9ZBQctEgT3f4fzfGf6fVuQus
- TLSH T1FFA2701DBAD0062AE2FED73589B256518D363D63F932DF0D28DA024D01A7E426C50FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LocateFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 38ad378686d7772ad85e6ca2da7bb6a97ea1c66c2f932de0a769248bfbff5ce9
- MD5 3f37ea40c706a6927a1b8a0ec2f15318
- SHA1 a71d5a440908bf1a95a7d4f826903032a1caa890
- SHA512 bf3428c1b186871b7d19f6ba0d2770919fdb42b3d91d23a3dd652968b94e0211eb61051ad498542e312007e3d7b7eca246291f64be2bd989b91657f81cfccf44
- TLSH T147818425A7E48777DEB74B31ED63134906B4FB609A13DB2D09C0A21B7C166244E32BA0
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PatchData.bin
- SHA256 1ed2f92a56d9ddd60d5f8fd803cb8a95764281ea159454d7c5b18d926340b5b8
- MD5 39d6a89aef856455bb741b4510fc59dd
- SHA1 b0cf2bd4ca80763823a5aad2b51eafb268b57515
- SHA512 096896badd401245f6abd7336a7a64fd27a2b3b2774261a45f969ce6933601054e9cd174f4e7818a94e5f1feebab3523b33024351fd46062652e86453b3ffcc9
- SSDEEP 196608:mJqOOgbagPQEXe8dQuYMfJ/xQ45vvL0pv+h:mcCbagPs8Dft5bb
- TLSH T17917F71EFAB44D35D00D19F4896B9FA0D3AEC1362A0486A37D7C2728FFB33511E66598
- MD5 SHA1 SHA512 SSDEEP TLSH
btscene/pack/wdb/x000.bin
- SHA256 b87977adc41a693eacb151bba9a054e6613c924375f74bd2a0e5e145f5baf137
- MD5 99a86e682bf7391d741e390043c2dd80
- SHA1 2805de58cd3a57e0b3d235fb775c3b8ece1d684c
- SHA512 76382f69baed5b8f2acdad3865d96e728ff2e07e0971c8418f7d08518e46f4d564fd898be3653db2b123d8485a2a68c53019c0507f555d64c8223ccdcbad90a4
- SSDEEP 3072:WYX1sueE2gyaFqgm86aB2cyic90TCWBuidUNSfHJtEZ:UhaY9cHK8tE
- TLSH T11D54B81EEB0B526AF8BD063585A703066F2D5C497107238B82842D667F733F2EEE654D
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c107/bin/c107.win32.imgb
- SHA256 abb351c9204f354fb60fe4672247d8a382ef06f3ba065b86fb726b37e2335eb2
- MD5 50a15c202c8c6709822ae8507534c054
- SHA1 8fa85a4fa8c84bc6e309c3cf20b240339440111b
- SHA512 ac37f36279b8fe1b9b50e93c84e5a0ab85982894bdc3e93e67a825724c6529a15dae49914562fdedb02ad7409ad4bce42d9dc24a7e80cbaf470922225b8e5c9a
- SSDEEP 49152:UUSAMaYN4mDbhGNQpvybMzCCjNCcvUHoNmIg8Cn9XOx7:ULDaI4mJGNP8RC4UHoNxgxndOx
- TLSH T12ED5097BBFF508BCD90D7964991F5A81E0AF91756E80D8B39D2F29417AAB0350C03DB2
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c107/bin/c107.win32.trb
- SHA256 52f7011815dce9bf00ff2d48d1036a06b10062fdc3a6596f48219a392b104959
- MD5 dd119539b9be1cf1222be917246112a6
- SHA1 1e633fcd7d239f5696c990b2961d7c48e695996d
- SHA512 b66bb40095476e7bcad6b5de3fb2a25af49a2243b4338e89ffc2a7306c17f4b9bcbdebdebe1594032f9b25486ceb47f9af82fc71970fa70265bfdb4704ce4283
- SSDEEP 12288:qNw+qzqB2TxkTX27zTFYVYa0YwcYC64VVqFrcJGuZ1SuWdo+LFn:L+z2xRoYa05k8FrcJxZ1h+LFn
- TLSH T1AF056C0DFA47DE3AC4526A324CA7EFFD97A5E859DA42821775E0773E2CF1340668128C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c160/bin/c160.win32.imgb
- SHA256 e192fd27111edcde4288505b19b42120e9de6dbfac12b35097c1294dca1ff94c
- MD5 7b7514f519b538a16e053795902059d7
- SHA1 bb8fe9fb69f0192be5b97d3b4c35966d40559b44
- SHA512 6c9e204b4a363c3d7e8b63269e49dcdc5b355a2230281846f7400137438f463f412f0bcde146cda21f6e23d332d3f4df8066afec9aad43c3ab50c21eb9fa3c49
- SSDEEP 24576:Sk0NhMNluiQ/4Ofc968YwGNqNxXG8xXVWqNwhOPa9feFxM5oveBu1ZPpsta4/Qj7:NIeDQgOjcZoOPCeFxM5o8VsCQg4OJQ
- TLSH T117E590AEF9BC04B8D45C5CF0467991A6C6DDE4742C4E84A3BD3E2909EBF34150D3AAE1
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c160/bin/c160.win32.trb
- SHA256 aaa6a8b6cbd6bf9731c88114f62ec1bed0d51bbd3512ac4c51168cf64eb5d1cc
- MD5 e2213797222f065d714ca11add1d9b32
- SHA1 e0b650a60c342287e3c2d8d980e6c5d043c62f3b
- SHA512 e8ef507a5a0d5176e3da60e5c65490757337cc4c912df8b0e49aa6b8598d625a4025771bb5a2d79f619f4c86967109ff60895692b3142adf9f8e38175c93d73b
- SSDEEP 6144:9A63DkfXy92syKOLGVC1X8HDFCrxH5qaBs6RlWBaLMpdgqYP7Ov2dRbBz3jK0PCA:6O8XMI8HOr0sTOWhBLak5Qfw
- TLSH T1C3E4390DEA83DE36D4526A764DB7EFFD8765E91ADA01422771E0733E2DF13405A8228C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c160/bin/c160_def.win32.mpk
- SHA256 c596ea583edf5dc36b462eb03ff240cdb13a3ccb79fbb2d1403b926cfaa59c19
- MD5 59334a8cc791572da1938ee09a90cc35
- SHA1 296d1b47914d10043511d25fa55d9612e57e5f49
- SHA512 6fd34d7f31a17f1ed5037a351c88d9bb58f7582a60cb639a1d6fb5701e81ce72dc06edaf48cbac4a480064a3553cac136b485dca419d4c1d98726c6979220de8
- SSDEEP 3072:bxOx6xNqvxNVeuzMvcKlcrb33ct8chpYzgUVDAL0jVDHqaHzVDF63mPvVrcrWLcG:hoZSHak8
- TLSH T19734991EFC845F36D05319B908AB9FB153B6C34F37166B8976717B283CE43846A8A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c160/bin/c160_rain.win32.mpk
- SHA256 c0ce7c2fe71088ed36ed98b8f33303bed170b1a27dfc558982c3677ddc7bf672
- MD5 10329f0982a4f42137f423c6ce9f424e
- SHA1 5162b3c86fa718580aa468bc78fd7d4c3bab7396
- SHA512 1b62715ece7acad22558f7f76dea0c7aa9e97f29276f1137c268d478ed5e9c9f5727128ff70b19b5165a02e96779005b35185b3fa002e7a0671ae1adb6472fe3
- SSDEEP 3072:FL53ZzwKHLdt4jLdNuWUFagC3gEbNbG9ZHUZAggsV1Li7LXV1fir9XV1fGO7PvVK:Tppg5OxA8
- TLSH T1C434AC1DFC845F36D05329B908ABAFB153B6C34F33126B8976717B783CA43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c160/bin/c160_snow.win32.mpk
- SHA256 987121caa2377492de457fc0520397b9cd411f5388cabf49a4e8ead990e554a7
- MD5 1ca5c91077059f7c11246368f00e89d5
- SHA1 cab709324a0dc3a790ff8d35c99711a7b40cd273
- SHA512 f7b375ea7bf9757b6950e8d2431afa7880f8a66114e38192730cab01960d3cbb30001b03b890430f7bff1ce1a72272e4421d9f012004d7b84e1457d48d4bca37
- SSDEEP 3072:qLKzUA4F5LXibLX9uvefTt6AtkxIZbKH6QneAe0g3JfV1fd1dV1bzr3sV1bXCPvu:+2GSYm8
- TLSH T16634791EFC845F36D05315BA08AB9FB093B6C34F37166B8976717B383CA43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c163/bin/c163.win32.trb
- SHA256 12d13e82d44cdf54f1fa99964c819305b71c6fd0552a3d798402949e568728ef
- MD5 6dae2731342b0726b7bcfa5f5599750a
- SHA1 aa79fa20df2656f236c1d3f395c5866c600f7336
- SHA512 c2bc78c754056f63bb703d5ca036e4ca8a338f8466715103202cc7d8ddb24f43e3be24c7301641ab88e26bd0c71385cd3c76b37f24147b83c0153a19444dee8e
- SSDEEP 12288:BhENfq8f0LreTzkggPi1ltF03gDgTK7YHIqkadJ:kOrenkFAltF0XWkHIu
- TLSH T187C44B09E987CD6AD45167764CA7DFF9C376E45AEB46072376F0332E2DF03806682298
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c163/bin/c163_def.win32.mpk
- SHA256 f54eabdfdd3f5186df9cecb0bd7759b9bcfe96105649b199c548e1e18c99acdf
- MD5 be352408f362f6ede2136ee6c3574475
- SHA1 061f41d55294077a6ffd66c8c8657b386560603f
- SHA512 22e1968a432e136d5012f115140341e332e70b01ab2283dd024371860c7d4c78504b8710601762ccf8acb07ce33265a467492385d6e0447c7f522c6e71648fb9
- SSDEEP 3072:qVDAL00VDHqaHgVDF63vPVV0lhXOllrUll3I3y8S5x8C2I8CnTKMw9UXaUhVl7lm:7FhV
- TLSH T1DDF37A1EFD841F36D05319BA089B9FB153BAC34F37166B89767167383CE43846A8A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c163/bin/c163_rain.win32.mpk
- SHA256 e8928a0bc7052dd0fa40d1d8b9fd3c9f021faa6f64f2b30b29075122ae4d4225
- MD5 db15b9feca0b92d7176fff7b8b51c900
- SHA1 2a219e673f4be5ed51db9215d71aee70450e343f
- SHA512 71344cb1e5b2a65a385ac473fff2bfc6f983c24663e20e4ca02ea4b1a819139fdace9894be88c86873c732ffd8ac4e64618fe959509e6a759efd77551bfe3c51
- SSDEEP 3072:1V1Li7LGV1fir9aV1fGOaPVVFLrjLHoLHuIAa5eM4emWalkUalDyTZoV2PQNO9Sk:iz
- TLSH T13204791DFC845E36D05315BA08ABAFB157BAC34F33126B8976707B783CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c163/bin/c163_snow.win32.mpk
- SHA256 0a4688884bf5ac57977dc48253fb485f85ff8097d9935580f44e5bb72f16dd78
- MD5 850fcccee72afd41735542b9bc783a5a
- SHA1 8f7c481e7496a716aabc9a71a62110447280ee8a
- SHA512 8b77ea0b8e7f5b6dcace54090d97c1155bb70ee5b3c49bd0b142b37a40fc77685fc2dfc9dbae031284ef76e292a071c5a4db7b97772a7f774ec6ec197235037c
- SSDEEP 3072:pJfV1fd1UV1bzr3lV1bXzPVVFLYEALst4LsNIFa6iwQvRPaCg7aCzCpTKj/3saRG:k7
- TLSH T1AF04691DFC845F36D05319BA089BAFB153BAC34F37126B89767177283CE43856A8A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c166/bin/c166.win32.imgb
- SHA256 2476d9f35b38a8d7761db382b3a56ff71285183514dd5ac54336f2827e0b8b6a
- MD5 023d3368e6b7f0a29d84c3cd7371d38a
- SHA1 321272eb2269d79870525a146d750633e84d554c
- SHA512 abaeef76871ae4db20018875b9d975132fb7eaa6860b180214409218f1ad365d924ac011677aef9a02918bfe61f4476c8d233abc685d7a9e68bfb15aeed4e005
- SSDEEP 384:fgL3NBwkfn3/6ptZa/zXd5IpEsCGoPCxllC:xZi5Z
- TLSH T13944EE4A7F3188B07A6C19DDE77EB14AD09D027AB81D12783D3E4141D3532A39BFA8D6
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c166/bin/c166.win32.trb
- SHA256 45f96745fef8929f393338f1df0a372d601a1483ce5649dad37be60dd5813ad8
- MD5 9bed4f7f4642582a2522ccde5b183b6d
- SHA1 dba8b4a72367fbb653d99b9014df22a4ca150ae1
- SHA512 c8e32333f39a6a3dd22534fb6cfbf5552e64d773855d1c49ae953a767e388a9d97fd5988eeb8b23cff565236cdf836c42f822272f120f96f0fb4b275bcf541c8
- SSDEEP 12288:rNENfq83zKVuAtRG+8GL6NqPsFXkW32K74HIqkadS:OuVuKnLHPsFX5ZEHI7
- TLSH T17ED45B09E987CE6AD45166768CA7DFE8C375E44AEF46072376F0332E6DF4380664229C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c166/bin/c166_def.win32.mpk
- SHA256 ef1e73a985050f6072525a7b92b28ebf4a52fab95b927bc15c7f1ec02175721f
- MD5 106f22a134165617e7a293e72a3561ea
- SHA1 b36f2900584c317d6d8bdd121b3777af92d71c84
- SHA512 bfa35a33c5d7107da1faa315f96ace6544bb96334d9f9c9bad74210f0790216ff45e0267c0078d84f6828af9a810556c5e480314b336e54a3c3339ec65968185
- SSDEEP 3072:HVDAL00VDHqaHgVDF63vPVV0lhXOllrUll3I3y8S5x8C2I8CnTKMw9UXaUhVl7ly:IFX
- TLSH T15504AE1EFD841F36D05319BA089B5FB153AAC34F37166B8976717B383CE43846A8A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c166/bin/c166_rain.win32.mpk
- SHA256 072454c286a3ad2952c0d94489691f6f161d6f94c744dcbc24885ddecb8afc40
- MD5 a9145d5a3d64a60929bc6035bde5a22b
- SHA1 e88e13c832e3b72e3d9da93f5acddb88093113ad
- SHA512 912ab147208d2b7d297f286387c084d44940f2ccc9c119fe76e62200c80e3727af105643a16366463c3bb87086337e37098877f5eb7a67c60b42cda693e36666
- SSDEEP 3072:PV1Li7LGV1fir9aV1fGOaPVVFLrjLHoLHuIAa5eM4emWalkUalDyTZoV2PQNO9S4:UPj
- TLSH T1F3047A1DFC851F37C05325BA08ABAFB197AAC34F33116A8976707B787CE43856A4A54C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c166/bin/c166_snow.win32.mpk
- SHA256 4a35cf248c2649ea667d05b2a4df6ba4c95d307d13031483a5aadcd67d5b8c3a
- MD5 39343919ca06835a18deb77169e90d83
- SHA1 860bf3a19ffc6422d102ac4475f9ae5089dc0d26
- SHA512 2aee90c0452c94338b56be901e898533de69a06d940e176430da1fc33896a59ca271b085bd6dd1d3295523a2298c1b46e71e3e8a9c00e7586dbd4c09fee9ad25
- SSDEEP 3072:6JfV1fd1UV1bzr3lV1bXzPVVFLYEALst4LsNIFa6iwQvRPaCg7aCzCpTKj/3saRm:d0c
- TLSH T107047A1EFC845F36D05319BA089BAFB153A6C34F37126B8976717B383CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c170/bin/c170.win32.imgb
- SHA256 62f15394aa284aca040a2d03a8575af89299308c0f3f9b7c55de81a6c06af476
- MD5 0c677a9c83946089c971eb897bde7ea7
- SHA1 cfeb33d0844fb55aea8b78c6171a4a9ab4a9c29d
- SHA512 0eaaa912a60ea44f293072dd7a6593c287c13b15ce60d0d24c977018cba11e04ad56d18cfa778dc0c68f82b7003d9b7627e1ebb1c18503338e79f08f62c7ad3f
- SSDEEP 24576:6nj2zICrAuE/Oljg5HWqNwhOPa9feFxM5ovJQjV4QAruxH157Bv97ZfPwQk2fpeo:eSkIOPCeFxM5oOCy5rBFWipeZhwP
- TLSH T142E539AEB97D06BAE50C0EF0843A8F49D1CED8741C8458E73E7C681DCAE70154D79AE6
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c170/bin/c170.win32.trb
- SHA256 54a8c97003916e1c219e457d40126e575b4d9a491b86643cf777f84bd7ec0c44
- MD5 4bcdb33bbb778c771b929c075a6ae4a2
- SHA1 e06fa0c5bcf95471d47b8118836e7216b4bab8b3
- SHA512 2e003b1d8d0f4430ddbafdf6c55c5fac08878a84b107dc454cfc4c19f3be91c8677ffbb0bc3106141b336441abe8086501237915385314e28bf160b643f67493
- SSDEEP 6144:nBlgrmbkHLFFihYT4o/1lRIwe9I8zA5O8i7n4MbAfgqrQuceQP60OaBvoiMgq5QN:/9iRIJ+A4MbAfbc9zq5Qfl
- TLSH T1F9E4060DF642CE26D45176728D67EFEDAB65E825EE0AC21735E0B32EBDF03805A4124D
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c170/bin/c170_def.win32.mpk
- SHA256 01ec7962f8532f860ff4fe620e55d85cc0cab710ce059151bcd95d15ea1f10d9
- MD5 7ff889245883e353912ec8554ab5f547
- SHA1 e42e6fbabcc9549e436688e04e12c42674f5bd59
- SHA512 51a98010349c7e6780ff3f3a4c555671f442b93b5d5fd74a742fd206f2676a9d996d908bb9554e1227d5a75b392d3ec542034d9ac34cc92692bae60c3aa31c60
- SSDEEP 3072:zxOx6xNqvxNVeFBJzMvcKlcrTjrad7Zgk5eX5efzW6nFvnbinbteGfSHYni/ivbj:TBadVvacC
- TLSH T1E8349A1EFC841F36D05319BA08AB9FB163B6C30F37166B49767177787CA43846A8A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c170/bin/c170_rain.win32.mpk
- SHA256 0b5500bf71aa31eb1b672009de4b985a4b8a4c968dd3010056f3132e73fbece0
- MD5 a8891b3e8195956b5bc14cb1cd91d6b9
- SHA1 5cf1f50dcf101e4c79529fa1627e06e44d9bfea7
- SHA512 9d5a7ee77c8e89e8bb28c7547447d0ff6c4d743095cda271c6ade0b8382a29325d59ef307cb2e4bc51edf2095006f4e487ac9a70ff47fabfe3456f07bc7b01c2
- SSDEEP 3072:6L53ZzwKHLdt4jLdNFBJWUFagC3gET8VQi5XnKdCK3F6zW+d9/dDSdDieGXK3IgK:8wBH+mX4C
- TLSH T1FA44CC1EFC841F36C05319BA08AB9FB167B6C34F37126B89767177787CA03856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c170/bin/c170_snow.win32.mpk
- SHA256 0e3217d51a48183a9accf78b601e68e799b5c66b7cb67bcb1b6e81ac3abb191a
- MD5 4e3c9e13587c521f821829165c607258
- SHA1 85f9a2abdc59e0f19a4074a9e4d036f183c33a7b
- SHA512 79dba915cdc3e28e0d2d2caddf8b1d6c7cfbe0631636d63a0999c4220302d105fb71b931c72cb5268de7b2df96b98dbb275e8c4ae28aff83ab5c30d0ca480cbe
- SSDEEP 3072:OLKzUA4F5LXibLX9FBJvefTt6AtkxIZTItliiG2G12G29zWtkdthdmndm+eGXtpw:fBvLo3gmC
- TLSH T1E434891EFC841F37D05325BA08AB9FB063B6C35F37166B89767177283CA43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c171/bin/c171.win32.trb
- SHA256 dde9faedf125b254de5d0cec490bf7428fb137b38f1cd61991395fbcee78b4cf
- MD5 f8e5a778697b32d10fe29686134b8641
- SHA1 89297c93e2aa3b7f9ca5dc0a1ac549d261c991a2
- SHA512 79800cad4ed0e1eeca67ce871014e3db54bfd9ed337944bb1c22a37d04ea852bf03539cecd998bd18877ed0af8cab49d0e4836303d33e8c89f9d46b23d147245
- SSDEEP 12288:O5Eh9mhaQRKDWv99vEKAZefltgYqlEAhvElSoHIqkadk:Oih9mhahDWv99vEKAZefrq+aEXHIT
- TLSH T193E44A0DE987FD36D86126768C67DFF98365E416EF16036737A0372E2CF53806686288
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c171/bin/c171_def.win32.mpk
- SHA256 7fbd6e42ad77f3f780fe4b42389f758eb3ea0730300e0d15a3f7a1c41006e018
- MD5 554b6cdbed3bae5dbbed5e6493d92b88
- SHA1 55003088423fe6656f5822488e4643e02b3844d1
- SHA512 504d7d9dcd44005a43a79142abe7eabd5a8cddc2972b9c4a8644652d0a005a0e5b57de5c142e3c75253659041c297a0f60d9c04d810db260f5590d49ce232e49
- SSDEEP 3072:IuRkuBKuBdBWuc/rlwMic/E2Cc/E2QTSv41y8S5x8C2I8CnhKMw9UXaUhVvx2POY:2KVTv
- TLSH T1DA04BD1EFC841F36D05319BA08ABAFB153B6C34F37125B8976716B387CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c171/bin/c171_rain.win32.mpk
- SHA256 10771b2fd7d90478281405de709582d880d3ffeb15d1fddb11f77a7996177b44
- MD5 67c8399df91f26f46ef991c18c2296f1
- SHA1 cc70e10c258e0f1f5f71ed216d62a664e2a4ded6
- SHA512 077f014c8364de10e559b2f34f32f9b6c7dd505af9caf5a1c8d8290c7b3aa39346e2dbcc018563d4a36962c3010cec4d60e156fd2f5cf5835258ae966cd99d2d
- SSDEEP 3072:WAMGieMUvMUnBkcpmB5EcpZU8cpZUQTSv42a5eM4emWalkUalDyhZoV2PQNO9S6d:st
- TLSH T1B4048A1DFC841F36D05325BA08ABAFB153BAC30F37125B8976716B387CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c171/bin/c171_snow.win32.mpk
- SHA256 7f176b0ab71f6d24ee91829587d70aead5bb4c770b464c568e918f033a8fd0c1
- MD5 0b8db3c430a5a07352d7d4dda54828ba
- SHA1 6326d5738c2d993da1c7129461e1756a9a98e090
- SHA512 7f139197783f02f4dcf1d2581fbbbf9806918dd7b875291f904c55eaee12d23b6b541665b97605908298ea97ece95ea8cedc3466e7ad01a25e995a362f1ab4af
- SSDEEP 3072:yM0tMYfMY0BzcpmS7g0cpZVJcpZVaTSv47a6iwQvRPaCg7aCzCphKj/3saRaVNlW:c6
- TLSH T1CC148A1DFC851F36D05315BA08ABAFB153BAC34F37125B8976716B383CE4385AA4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c172/bin/c172.win32.imgb
- SHA256 2476d9f35b38a8d7761db382b3a56ff71285183514dd5ac54336f2827e0b8b6a
- MD5 023d3368e6b7f0a29d84c3cd7371d38a
- SHA1 321272eb2269d79870525a146d750633e84d554c
- SHA512 abaeef76871ae4db20018875b9d975132fb7eaa6860b180214409218f1ad365d924ac011677aef9a02918bfe61f4476c8d233abc685d7a9e68bfb15aeed4e005
- SSDEEP 384:fgL3NBwkfn3/6ptZa/zXd5IpEsCGoPCxllC:xZi5Z
- TLSH T13944EE4A7F3188B07A6C19DDE77EB14AD09D027AB81D12783D3E4141D3532A39BFA8D6
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c172/bin/c172.win32.trb
- SHA256 f7b1a7feac838f0e42f6d94ef170efb9c06177792d14058b15451172ce1b911f
- MD5 dbddf7069af9f928595c9bdc8324199d
- SHA1 79aba60833bf06c41b0d90474e93376a01cb08dd
- SHA512 11da3fb89279825b8f16ac95392f28c755a4130d2c6b55c3008cfee2db2d9446f6ca5cd5cce1ac2157f80380db60efcb97a6314cc18e580477d50c70c9ee58c0
- SSDEEP 12288:oLDrFdf5Birx2vtJAvUiMf1r1Tjvqu8MJybEz/92DMHSIHIqkadi:ovrFdf5BWx2vtJAvUiMjylQybENHIf
- TLSH T1F2F46C0DE983CDE6C5A16B754CA7DFF583A5E565AE06072736A0333E2DF5380228279C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c172/bin/c172_def.win32.mpk
- SHA256 07077a37c5fdab2bc5aa1a950d438ee738e04500e217d7eb0bb296bc24a60a41
- MD5 f2be9ced49b260e4ded14f112743a12d
- SHA1 420820aeb63565d30ef264c02ff71dcf228d02af
- SHA512 69546ac2647fa7dc09fe9f2683852bb8e4dd3fcca28dd455a1cbd4b8531a6460f096bbd4fea2d25b95bf5f161b74732b467f427c1233ea5c103ba3f2d9bbb633
- SSDEEP 3072:cuRkuBKuBdBWuc/rlwMic/E2Cc/E2QTSv41y8S5x8C2I8CnhKMw9UXaUhVvx2POi:CKVZ
- TLSH T19814BD1EFC841F36D05319BA08ABAFB153B6C34F37125B8976716B387CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c172/bin/c172_rain.win32.mpk
- SHA256 9b5014abed6e6d5e69b4bff76af275bd3b50410684ae52db86f627d0c7ab8099
- MD5 6f1d72b12ae64586ce090296ce342808
- SHA1 1df6c37ac1d364a01694a070dbf9ce30c2100e9c
- SHA512 992db6d21e8dc52e2d87598121b1320c4476a587709225e8d48b4750ca6750dcad3716b454313982bfa35a36cf54a6351829a09d18397b234b751a8a7814654c
- SSDEEP 3072:EAMGieMUvMUnBkcpmB5EcpZU8cpZUQTSv42a5eM4emWalkUalDyhZoV2PQNO9S6n:GDr
- TLSH T11C148B1DFC851F36D05325BA08ABAFB153B6C30F37125B8A76716B387CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
chr/pc/c172/bin/c172_snow.win32.mpk
- SHA256 4123462928c3013ed47ae2035232f3e98de42305482a6bef2a7e7db8e66e5bb6
- MD5 c403173d37e63bb7c21806baea819d59
- SHA1 08d9d1b4c58fc1a04165e0542579e6f9591598a9
- SHA512 9645749da53f86af61195e7d9be395fdeccae562c94c7bb2207d80910ceea094da89e35b076a95fcb239fa3094d45c75cd86e84d88bec806fee6546a59a86fde
- SSDEEP 3072:hM0tMYfMY0BzcpmS7g0cpZVJcpZVaTSv47a6iwQvRPaCg7aCzCphKj/3saRaVNlc:rrU
- TLSH T10D149D1EFC851F36D05325BA08ABAFB153B6C30F37125B9976716B383CE43856A4A64C
- MD5 SHA1 SHA512 SSDEEP TLSH
db/resident/wdbpack.bin
- SHA256 ea3f247eb99f21c23f54d60e4fc3b85460a130ae8adc557ab9334238afe8d963
- MD5 5b3d8c35ce3e42303ff9987908a73e22
- SHA1 41a2d272964e753515502a2e30c64c527a1fc392
- SHA512 e186910a632d3286eaa8169b35b87dc8c847e68a572b6061ce7847558507eb4baf61ef75228e6405f486827e035b2a9bd4a92d7de342673f8dc3c1974658afea
- SSDEEP 24576:t8ClkGHQPEGHy2sG+6795dSV5CPbuVIu+RvMlCCxYciRIunUiFc3uV4XRKnBsHNo:CxKcT
- TLSH T1D855B50EDF456477C0AC6B30CCFB0B06273368C466966F1BA2C894327956770BED59AE
- MD5 SHA1 SHA512 SSDEEP TLSH
sys/debug/version.txt
- SHA256 0778eecc73e4f81e0183b9749a88a5bab4d050efda5700494c72bc4ea47e77e7
- MD5 2fefd28f1f5148de2fbdf4c0b4f48ecf
- SHA1 8406f88e2666fec8a08a5e483afddebcf117808f
- SHA512 451b2581763f7a17d3f3289c41b295637122156ec4b72815b4630cc5c09dbe6a3a98f8222590fcacf884799ac7bf6a89dcc34f4efd8113a93fdf968246f7f646
- MD5 SHA1 SHA512
WhiteBinTools.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b3ead2ea9df39b03e11a1b73fd39210abf2ed6ce89c268b8f28e77e9703ff1a4
- MD5 8710cc5c4eb7d147a0299c69c353fb5c
- SHA1 ee7564c9103eb26857d383ea6d7c681645865314
- SHA512 5f4ce8902266a13af3e54de8ca764429394209beff2401e69be592aa57526b8be0209006e518f0669785f634f39ede41c427cc556118c71b7482d6ad8cc5999b
- SSDEEP 3072:hIONhLQToLxcQACtWiKXVkkA28mVN5VgweI/KQ73WmVNc:hIONhLNLxFtWiKXas8mVN5VdN
- TLSH T154B35C346F9D9B6FD4BE82FDA4B0127503F0B136B61BE79B694024F919037818A11BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
112750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ