8c05f2d5234fc6abc358e6effbcf051ce579380706e7482715682dca0a827aed[.]exe

resource
8c05f2d5234fc6abc358e6effbcf051ce579380706e7482715682dca0a827aed.exe
unpack001/$PLUGINSDIR/System.dll

8c05f2d5234fc6abc358e6effbcf051ce579380706e7482715682dca0a827aed.exe

IMPHASH 6e7f9a29f2c85394521a08b9f31f6275
SHA256 8c05f2d5234fc6abc358e6effbcf051ce579380706e7482715682dca0a827aed
MD5 f3042117f7dd49e9caeb55023bd8a84f
SHA1 648635a1023d341b24f2d0af05e7befcfd10bf85
SHA512 d494e9a5d1ca414219e6e0e2a50c5f1beeddcf3c6968bc659fd93f3b3a66b93b82faf7686a50ebadd67d1471a3e573902a0a66bd0768a7629413628d0c90d52f
SSDEEP 6144:AT4DtKL6tDfcE8BAHYhtMBX4D3V3QHeIbUUOjjbxA978FOoyVxG0nqk2ivPQuNei:ATZ6tgE8BA4vhzVgHeHUOVA97cOoyvGY
TLSH
T125741242BE14C477FEF16A3015B48FDBAE72A8B146766F0353E86948B9736405E0B393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor SetWindowPos PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersion GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW ExitProcess CopyFileW GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Bilabialen.txt

SHA256 cc3e14c9ce4c02c30c2a8b348c0ab4498cf3a278a70a5fc20975a1553467fb09
MD5 cda86dfdcae339e466cbaf210b0f1f65
SHA1 6d8689335122afe80c841abee8ea24fd427e3294
SHA512 6ad84644b252e192963c62c24f9605c12f86af3c2a374ee2a1e5f2cfb25dac2a70b9c8b8bcaed9b5fa26a3e099d5219b4420f557946302b3833cc9ed1ccb2f09
TLSH
T1AEF00E01CB22B1000E63EAA4B8A60BC632AF8905F91481A272D8A7081152198C23890D
MD5 SHA1 SHA512 TLSH

Billardkugles.ini

SHA256 ac748c1de25947d7293176abc03a1018b17942737735c69e73326c618c3d82aa
MD5 ecdbfd97bc7e5351a2e48f3dc5541f4c
SHA1 71f468f3f1622081942b219d8b6af8b669333286
SHA512 d210f54daff5437d609f0c409c6914076f23d11419fc88fe469bb4f5c31bb59eb8b8bba6120bb3c2d257d71f74c0cd38420c831413449afc27392596a9e1a94e
TLSH
T135F09E991C9B12944393C014A5715C56A61581ACDE036EA06C6B4B412A1999AF4FEB18
MD5 SHA1 SHA512 TLSH

Cyklon.sac

SHA256 8b534075a7cae9246ed8168eb53861d9ed88d534e7b01174eb7afd3c90077386
MD5 5e6eab0464a5ba87492e0e98809d127c
SHA1 053f5b74ad34ac9e9d61bec785528c0f752ba57b
SHA512 761f1f3031648a0275b8de9cb65b8a092f9dfec0cc9352e08c84223c470f752ddfe11cb1b31b06c7e8bf87ae5c893f2017b4c2f3a080208404b7e10bf862e135
SSDEEP 3072:z/kwkk3emDt6BDQL6FY0a6lycMifEWh61etIwrYO4eMxEZrFLf/u5va5Su/:z98DPNa6wNOp61etH8OXMxEZrFbm8N
TLSH
T1A714F1475C978071DAD94E8B04CA87BFD9C07507169933AE84A7EAE0F66C71C3907EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Plankede/momsnvnet.jpg

SHA256 45caf13ca4190dba0d1342ad5efefe6036957d79ded0ca869627ae7403eab7f2
MD5 48e3872225ad7bcbe8084837c22af186
SHA1 b56bf9d5cd84a5696c20837acb49d8532c71d4a1
SHA512 8f21979bca96171cd1be0959ca38f7b0ecbf9f7e1c2fc14b6d622d8f629c680035695bc05b6a3e44fd57b9cd552eb3908ab5bb6a8766c30fbc72de371b1b04c5
SSDEEP 192:LPH/PLOznRChI8ee0BO92zdnuRfLpLJ428CGKttHHCZF3Rx7b3:zHHL0RCO8ei2zduRTXwKzC3f3
TLSH
T19752CF3247A68A59A75EB4318E0E136DBDFDCF0483D918B45AC3B02191A4EFDCA195BC
MD5 SHA1 SHA512 SSDEEP TLSH

Plankede/noticed.ite

SHA256 7224b858b50234f82f571a1c6968e19a7cc7f805222b2e16788d141b57b0b1ea
MD5 85eeca3815197a4dbe9dc723238b9989
SHA1 3f60fc7b87d5b4fa576b9c34a44888977bd614bf
SHA512 42f1890bc144a4350588e761b9d5fa27dd770217ef6d76749a497631f74ba03390ac2414a409a73dc3cf8b6c77ecd9aa6f0f3fceda458d297a64ebf0fe8e28c3
SSDEEP 384:k7zk/Q7eDXdZxko0VPeRnVUpYaRJfopTFxUVbz5HYU6YCiH:kXoQ74ko0VWeFR7bzdR9H
TLSH
T1F264BF8D75DB64881AF039E2C3FB14EBC04C16F11FE743E62251962F5D5449A9607F38
MD5 SHA1 SHA512 SSDEEP TLSH

Plankede/orthic.hus

SHA256 f8aac92323f4d9f1ba4a2a11e5dc83bacc55d8ad9d9d7adef101a9aa607b1c8d
MD5 341af6a0424b7326e5e51e15b0ecefbb
SHA1 d2030c40918e55726f84697bd8cb76697e4b7001
SHA512 0091bd2c1e0d144ba17ca90af3d8f4ea97f62809c0f233aa792093a71f0e74b02b05e6935ed62b96c21707b49554f4f9f2bbf6bb822a9de1c163e28c58e414cf
SSDEEP 768:hA6TexAuU6XIiFdUdDTDf6iOy6cdVC56NATl+oEKMzfMnBetD/ActRqAQ:O7u/w+zNKGQ
TLSH
T1EC94C0CDD23ED55572359D87B3009E24FA5C6C452A04B6BEBFDA1A22204BC7D00FD9C6
MD5 SHA1 SHA512 SSDEEP TLSH

Plankede/projektrerne.hem

SHA256 5599c520e742fec418bd5950e80f6ed7ba4266593d38a57b28e3068190bceb3c
MD5 4bdd2f12a5cc58e7285ffa758d9ecece
SHA1 8759d9cb600874d82a921505a8483db09d9bc3c0
SHA512 10950bb1d5465b8e86db5ce77d9deed394c9ae7fe9fe0ba7481b9458dfde3c1f842e8b5ad231435ddc230a74327f4ceef19998eb09afac04e004ea0b89f88809
SSDEEP 96:FydLf3klQA9k99Mc2HGBbxnXx3VG24k4/PGLqakuKFk:IdYlQQk992+xXdVGl/Gmakup
TLSH
T1A824AE16E40B48F3C78BEDC4702C66C38781E491B72DEB909A293395711059E02FDA75
MD5 SHA1 SHA512 SSDEEP TLSH

Plankede/vicentes.kny

SHA256 b6eb4e68b4589d41eb4c7d01bd8a7a65576483dc57d4ac413ab6a441005c7ba7
MD5 67543775aa6202837c3583bba60536a1
SHA1 73af89e80b04bd489ceb2908146b2222b5a33748
SHA512 f3c727f8862b67c6ea88846cdd39fe1d3fbaedb2c4034f4e40602c4d252fb1fbb82e4363d3e4a66d86726960820a24e6390ef8fe4f75f319780d955c6b113213
SSDEEP 96:xDZLtweL3pkY3n1IpIKJVaz/tYAlo+/9DX:5Zep7+/P
TLSH
T189149F354CF1C8062C83CB99E9075DABC5CF7E812FCC67C8359B376819A61118991D7E
MD5 SHA1 SHA512 SSDEEP TLSH

Pleonastic77.txt

SHA256 e072de0b5de6a3288f183929f1b27797fdd743dde4143cf9db8c669218e4c2fa
MD5 87e0ee6ec25bb816d676d2f959ad036f
SHA1 00f1aa3461d80fc9080e0362f0b645e6fdc851c3
SHA512 241d6b8d2b8827f415065cd213f407e9daaed5aff4d90e8b454a789431220ea3c26172622cf7d4d6a3c00700812641c7dc94b72281c57adf927d9b51d349317c
TLSH
T11CE060F0C84C2FF6AC0B0BA29EAF0000BA3DB6078B906D4DA8FDB14014224CCC3628A4
MD5 SHA1 SHA512 TLSH

Skylightet.Ped

SHA256 1af1a9af23a916adb1dd5d3b0ebf0ad4532a4a346df008b9dca58cff33bbf202
MD5 35031744e4b9d77728182c2751a16bae
SHA1 7d37b01dd22667b00dd6c3509bdcb620cb8de504
SHA512 34dedbc4bc9c8e32f5ba5775e66140d3e76bc1301ec431eea18ca22031f4e2b9804bd5276d394a3602be992a0a760e51f858df1d832083817d7e589bb3de0680
SSDEEP 1536:9xezDdsR7CwGQR4zFF1Lyt7LzNfhwLuvnvvTnCmj2n2jcH600E5fyUMyY6:9xezyuVryJN5dvTCmjXjcH6BE5lo6
TLSH
T136D3AD63D7469CBFDC06C638C5AE31F54D6960055B0FE4BCA1B2ED59C1872E263382EA
MD5 SHA1 SHA512 SSDEEP TLSH

angrebsvaabenets.ini

SHA256 13d84baeb8dd73d770ae5aff65a941696e834938576142d8d4cc4e08aad42927
MD5 2eff60b57e81963f67d8e1a236c66ca7
SHA1 ea2dc4779220ebd7eab86567d37d4535c2b862d4
SHA512 949389f0de202e03870149d89019b2bd4cda2500c21a9385f9de229b3d5a26fb3e1c2c7614cf273479c33aa126e9bed2cfe9f243f8e994ea21010b8bc4a0b761
TLSH
T120E028145687312127837F51EC0E0E44DC5082448710F05215F85305C544D6511EF42E
MD5 SHA1 SHA512 TLSH