8_sobeit.rar
- SHA256 787b60c9435b83ca173d42d92bc1076d02185ef17e8135a3581ce6891bb33d90
Overview
overview
7Static
static
3mod_sa for...s).exe
windows10-2004-x64
7mod_sa for...s).exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...od.dll
windows10-2004-x64
3$PLUGINSDI...od.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rl.dll
windows10-2004-x64
3$PLUGINSDI...rl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...og.dll
windows10-2004-x64
3$PLUGINSDI...og.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
7$PLUGINSDI...up.exe
windows11-ltsc_2024-x64
7Uninstall_...CM.exe
windows10-2004-x64
7Uninstall_...CM.exe
windows11-ltsc_2024-x64
7d3d9.dll
windows10-2004-x64
3d3d9.dll
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/bassmod.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/bassmod.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/brandingurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/brandingurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/dumplog.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/dumplog.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/dxwebsetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/dxwebsetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
Uninstall_mod_sa for CM.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
Uninstall_mod_sa for CM.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
d3d9.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
d3d9.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 8_sobeit.rar
- Size 705KB
- Sample260724-pjphwszelb
- SHA256 787b60c9435b83ca173d42d92bc1076d02185ef17e8135a3581ce6891bb33d90
- MD5 a40c1397d5f043ffcb35822461e24842
- SHA1 6ea163e70b067dd084c8742a443d8e901164c1e2
- SHA512 c92710f7042749ca639da1f3448e8982240ce312b6b2caffbe8813848bbac8264de06a3d3c1ebde22c1ce780062d1eae7cde3bdc573c46e963574f301bb05b5a
- SSDEEP 12288:UV+8zsgWMRbRL6HqMlhXxCG4ZuT3RbHxwTwjNloKLFPTUFzkyJmGFXe39WKMjbI0:i3TWMpRLkXT5Th76Tw5l3tBmPWqz
- TLSH T1A9F4334C7C368B421A6ED610EF5E1EB31CCE48F832B49C2C2576E56B5551398F8FA4A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/bassmod.dll unpack002/$PLUGINSDIR/brandingurl.dll unpack002/$PLUGINSDIR/dumplog.dll unpack002/Uninstall_mod_sa for CM.exe unpack002/d3d9.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/$PLUGINSDIR/dxwebsetup.exe - NSIS installer 4 IoCs
resource yara_rule static1/unpack001/mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe nsis_installer_1 static1/unpack001/mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe nsis_installer_2 static1/unpack002/Uninstall_mod_sa for CM.exe nsis_installer_1 static1/unpack002/Uninstall_mod_sa for CM.exe nsis_installer_2
File Explorer
-
8_sobeit.rar.rar 705KB
-
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe.exe 730KB
-
$PLUGINSDIR/System.dll.dll 10KB
-
$PLUGINSDIR/bassmod.dll.dll 33KB
-
$PLUGINSDIR/brandingurl.dll.dll 3KB
-
$PLUGINSDIR/dumplog.dll.dll 2KB
-
$PLUGINSDIR/dxwebsetup.exe.exe 285KB
-
$PLUGINSDIR/music.mod19KB
-
Uninstall_mod_sa for CM.exe.exe 46KB
-
d3d9.dll.dll 814KB
-
data/HANDLING.two63KB
-
data/SHOPPING.two47KB
-
data/VEHICLES.two20KB
-
data/carmods.two11KB
-
data/default.two662B
-
data/surface.two575B
-
data/timecyc.two39KB
-
mod_sa.raw28KB
-
mod_sa_ChangeLog.txt23KB
-
mod_sa_cm.ini49KB
-
needle.png.png 3KB
-
speedo.png.png 62KB
mod_sa for CM.v4.3.1.3.SA-MP.v0.3e.Setup(rus).exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 cc8bcbfc26b42b2570d460fed996f39e18e1ded18f14fe2e17c2c6bb7689a645
- MD5 4ca37985bd2fee60d5216688d3227296
- SHA1 4ee020b9e1d2e57adec6ad065809d434ed2890b4
- SHA512 c42879a8c3080dd2c2ad719c213b1dad70ff900bea00ccd23ad1f24a7d69688af113d2c1fb9e4d9a079a575106b226a894a93612b0c6f4a44997870183aa4427
- SSDEEP 12288:DiBQLEyQrL5/c8Epy1tt41xnBh40n1+eUhOHiwzJifllKpxenZiV7FNsEtFF1tO1:WB9ZneY1w1dVRUIHiwUfnKpxwZcp2W3Q
- TLSH T1BBF423092289D463E745B5316FEBD67BDABECD005374CC930F2E675882861C7963B18E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12837
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
- SHA256 bea71368433f91e32c597db990089ecb7599879f76a64f7f3446489578b2d5fb
- MD5 4c0c6163b636f627e0d505deda672c90
- SHA1 2eae4e6f00673a03ae2434f1b22dc9218e4761a8
- SHA512 e817ad35f0e89ecce9d73add641d9eab95de6c6c30153e594673c8e0243e738a31dfb872cc76a8d51bc513775fc1dabc9adb65019298048539d6c3aa7d33e2ef
- SSDEEP 192:MO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1apgMO:9KAFERdlxhGRYUzqZap
- TLSH T1E1225C6547A042F3DD61823C08973D276BA87B149EA54ED3CF9314429E296A6BCBC336
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10425
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=3, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/bassmod.dll
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASSMOD_ErrorGetCode
BASSMOD_Free
BASSMOD_GetCPU
BASSMOD_GetDeviceDescription
BASSMOD_GetVersion
BASSMOD_GetVolume
BASSMOD_Init
BASSMOD_MusicDecode
BASSMOD_MusicFree
BASSMOD_MusicGetLength
BASSMOD_MusicGetName
BASSMOD_MusicGetPosition
BASSMOD_MusicGetVolume
BASSMOD_MusicIsActive
BASSMOD_MusicLoad
BASSMOD_MusicPause
BASSMOD_MusicPlay
BASSMOD_MusicPlayEx
BASSMOD_MusicRemoveSync
BASSMOD_MusicSetAmplify
BASSMOD_MusicSetPanSep
BASSMOD_MusicSetPosition
BASSMOD_MusicSetPositionScaler
BASSMOD_MusicSetSync
BASSMOD_MusicSetVolume
BASSMOD_MusicStop
BASSMOD_SetVolume
Name
Size
31KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
$PLUGINSDIR/brandingurl.dll
- IMPHASH 135de77644e2add2fd9dd8176740e7e0
- SHA256 798ce85390508959953b55d966ee3ad8fae938cb107233876566a5823d339a66
- MD5 028857ee4bf29e5379b19027df010071
- SHA1 8cba90942b3ea405f70e4ae899bb08f7b58dfe70
- SHA512 e08d91f53039a1ec0c768a873b91901cae3fa7b91f368157c3adca12cb439b627e9d4558b49d747ef7fe6250a51693183ca29422603bf102bee05aa410539b8c
- TLSH T13A61303637F919B2D3724F7B58A31BEB6A7AB4310726404F446B299A6042D63CD79B03
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4945
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyA
GlobalFree
user32
GetWindowRect
SetCapture
InvalidateRect
SendMessageA
GetCapture
ClientToScreen
EnableWindow
LoadImageA
SetPropA
SetWindowLongA
GetWindowLongA
GetDlgItem
PtInRect
ReleaseCapture
SetCursor
GetPropA
CallWindowProcA
RedrawWindow
gdi32
GetObjectA
SetTextColor
CreateFontIndirectA
shell32
ShellExecuteA
Set
Unload
Name
.text
Size
995B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
842B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
37B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
154B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$PLUGINSDIR/dumplog.dll
- IMPHASH db09deaefe977cb28b3feeb04f93d8a6
- SHA256 0dafc86043fc2d263570cd95b778721924bfcbce36744b828961529b779ca4a3
- MD5 a517578af0baffd5a235d8177a651a5c
- SHA1 900040ea61cb705f5529ffe87522640ca220c8fe
- SHA512 afc20fb8dcae46f65f92300cc51ccf0c21d76d2135e3a8beed2fe363a2b10b1525fc042d7e307ba173ad719c23705a5718d4059c834969bcff7a717845e9ae11
- TLSH T11D41EF7747A11DB1F826033771570DC56DE5F21016D3BB1D0A02ED8CF50676B8A2DD10
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpyA
lstrcmpA
CloseHandle
WriteFile
lstrcatA
CreateFileA
user32
GetDlgItem
FindWindowExA
SendMessageA
DumpLog
Name
.text
Size
773B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
505B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
100B
Virtual Size
138B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
$PLUGINSDIR/dxwebsetup.exe
- IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
- SHA256 b68ca13c29b2c9ad899f68fe3f9baff7ecbb848e963604ab5f66bcbf420a26c8
- MD5 14ca145edd4f381e1adad6c2ceda5e7a
- SHA1 1f785ac7c5da7cc2750de9991cbb2d72b570ab82
- SHA512 58c08005db38c9dee19d9ee02717fc9780fcd61a41e14491c51f7f23782511737ec8235637b797b3f83cef4028aad3edf746ab87e02ca08aac2727cd1ba7788f
- SSDEEP 6144:nWK8CN+qHUKfw5R8DPv5N6RkMphh++axWzfAHzxHtUiq4:ngKI5R8DpNakMpWn0zmtUiq4
- TLSH T11B54F15266E9817BE0F52BB40EF602533B71BED27D79F32E9382548C1C61395A938327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
61:d1:e2:56:4e:45:25:ef:ca:0e:43:76:95:48:91:aa:63:29:5a:12
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
1
Major OS version
5
Entry point
23134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree
gdi32
GetDeviceCaps
user32
ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics
comctl32
ord17
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
243KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,
$PLUGINSDIR/music.mod
- SHA256 66d1dabfb83042c9bc76260fd294bce9c8820883e07f6cc37f42a09f7d27868d
- MD5 9424e2237ee146b140fa32fb13a8e794
- SHA1 65d2e8907e5a70e1e8becb13a7dec359d68e5b28
- SHA512 785799597c37d26d2476e5ecde129bbfcdc7d81c68709463a1cb10fd0e822cd785cee56b386144e33104c51138a0f7fbaae5424208e310dcf4786a6a0c862bd0
- SSDEEP 384:FyXRemsNTEvpNtrZzej/a1c6QXynffCa2oEf1KSj:0XsmsNIvBlze16QCnf0BfUSj
- TLSH T14E926C21EFA31066D9E0ADB81892A337E9528DF4E896F9D67F152E045FFE7010C16B03
- MD5 SHA1 SHA512 SSDEEP TLSH
Uninstall_mod_sa for CM.exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 49163831f55678fc559f4da178283086eeef32544ce1df3d6b4ec5a24bd9a9cc
- MD5 97387f97fd4a02e7cb5c23d8074a8b89
- SHA1 57ea3501a8d424066f465d54ee9868e9ac5caa74
- SHA512 74bbdcf6dc1ad76471f89592be1ba3bc5146581f77ebff1af9c92c9b29f99f56b50bce3de6a81584af20a08787a4b36036a7b124f825f96b0a57695b57795bc6
- SSDEEP 768:7Sup23EQCjlQRB8/ewZ1iU6nyYFxbssT/F/O71mJ5agd2iZQAm6kRRS+NoJRneX0:Wu4EQalMK/ewGnh0mJQgdLeAyNxAb
- TLSH T17E23AE0A36C4C8EBD56A067119BBDBBAF7F6F70112100A275B500FBF6921183EE16297
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12837
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
d3d9.dll
- IMPHASH 76855678f8ddca2b5005f0a4bcd173df
- SHA256 34801e5d4d1914605c2f27ce21e3ef846bf36cecd8af2c41e27bf9b79b870226
- MD5 f8c0e1668b31e4de213f3a0bec441896
- SHA1 40c1591222615c04bf35e5b3f1649145a7377de1
- SHA512 e12f401f502219768c1e321b0abd072686417e4eaa392f342fd4e6438d9898ff2473bcf8ead55af61533b4dc19f75fa65bdef349b85337460f7a000960fc3aa7
- SSDEEP 12288:jtyYA5oRPrjRR4LulaYemwedT83h7XFkW7:EYAWPAMsgl83h7XX
- TLSH T10F059E41368EC031E15E513C6A13F33A6BFDAA3444F399773B8616BE5D78362E939206
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
353800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d3dx9_41
D3DXMatrixInverse
D3DXMatrixTransformation2D
D3DXCreateTextureFromFileA
D3DXCreateSprite
D3DXAssembleShader
kernel32
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
WriteProcessMemory
ReadProcessMemory
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryA
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
SetUnhandledExceptionFilter
GetModuleHandleA
GetSystemDirectoryA
GetModuleFileNameA
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
CreateFileA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetProcAddress
VirtualQuery
GetCurrentProcess
FlushInstructionCache
OutputDebugStringA
Sleep
MultiByteToWideChar
VirtualProtect
SetEndOfFile
GetProcessHeap
DisableThreadLibraryCalls
FreeEnvironmentStringsA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
WriteConsoleW
HeapSize
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ReadFile
ExitProcess
VirtualAlloc
RtlUnwind
RaiseException
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
WriteFile
GetStdHandle
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
HeapDestroy
VirtualFree
user32
EmptyClipboard
OpenClipboard
SetWindowLongA
GetForegroundWindow
CallWindowProcA
MapVirtualKeyA
FillRect
SetClipboardData
GetSystemMetrics
GetAsyncKeyState
GetClientRect
SetWindowPos
SetCursor
GetKeyState
ScreenToClient
GetCursorPos
MoveWindow
CloseClipboard
MessageBoxA
gdi32
CreateDIBSection
SetMapMode
GetDeviceCaps
CreateFontA
DeleteObject
DeleteDC
SelectObject
CreateSolidBrush
SetBkMode
SetTextAlign
GetTextExtentPoint32A
ExtTextOutA
SetTextColor
CreateCompatibleDC
shell32
ShellExecuteA
ws2_32
inet_ntoa
inet_addr
closesocket
WSACleanup
htons
bind
ioctlsocket
setsockopt
socket
gethostbyname
ntohs
recvfrom
WSAGetLastError
sendto
gethostname
WSAStartup
??4RakNetworkFactory@@QAEAAV0@ABV0@@Z
?DestroyRakClientInterface@RakNetworkFactory@@SAXPAVRakClientInterface@@@Z
?DestroyRakPeerInterface@RakNetworkFactory@@SAXPAVRakPeerInterface@@@Z
?DestroyRakServerInterface@RakNetworkFactory@@SAXPAVRakServerInterface@@@Z
?GetRakClientInterface@RakNetworkFactory@@SAPAVRakClientInterface@@XZ
?GetRakPeerInterface@RakNetworkFactory@@SAPAVRakPeerInterface@@XZ
?GetRakServerInterface@RakNetworkFactory@@SAPAVRakServerInterface@@XZ
Direct3DCreate9
Name
.text
Size
416KB
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
214KB
Virtual Size
879KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.d3d9_sh
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=39, id=149, productName=VS2008 build 21022, version=21022,
count=152, id=131, productName=VS2008 build 21022, version=21022,
count=10, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=165, id=1, productName=Unmarked objects,
count=223, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
data/HANDLING.two
- SHA256 b6d06109441c342a000e8bec367ffac1bd949cd12690372dc01a2c025d6c0240
- MD5 6868accef933f1855ec28ce193a78159
- SHA1 2324de99ad3023ccc222f627aaa39769f29bc9d4
- SHA512 7fe2e793f9e887d109732212ff948c8177db9e12d8e955b57f01e3e0dcba6e28b84ee4aae594fe189acd792c2c1aa676fc4b2cf0e57e51a07bd77bfc29d9ddea
- SSDEEP 1536:fAOjzkU7yg9V4bNbZ15pHRjqHcO73juXOt2q8qEZHAk6qsx50:n/kU7y84T15pHRjqHcUjuE7Pk6qsx50
- TLSH T18753676F5B894290F874EC169671912817EDB0393C839A487DCDCBACE7325D8D78BC1A
- MD5 SHA1 SHA512 SSDEEP TLSH
data/SHOPPING.two
- SHA256 35e9cbb2363abecdc46f913bf60e8a5166f02a7f243eb53b7fe75b37b5776bd7
- MD5 19ff65162eaa59000db59ac1fd88d3d9
- SHA1 5a5796327fd627718a321d45fad476e6edd7e5b6
- SHA512 91fd6010486ba1d2dff44f81edc583d16ab23bbb5b1a9394a63f78d03a0a418a06cfe1de58132af5b7524524ae0aee04315e6e7b107cc65cc2442a7409769c9e
- SSDEEP 768:h/zbHPbKvJHRTqojiXn2CYVqQ4Mozl7GkmCuXN50Aqw5VlRfPgSWEQ9xaprPwQdU:h/zbHPbwNhp/qQmlGk7cN50AqwlRfjQH
- TLSH T10A23AA3632D511D9F230707CB93E6A14ACCD927ED867D1C07A8D50A8A20E3678AF5D7B
- MD5 SHA1 SHA512 SSDEEP TLSH
data/VEHICLES.two
- SHA256 4931e68e80c856c0e8aa634f44ffae2a2d98c6d1ce76815af64dd81a934811f8
- MD5 9c2bd18dc1c428d247e118d8e7856eca
- SHA1 4cdb10f28c0a47f5e15bc352994c930995ecfbeb
- SHA512 0d4fadb4625f4c4031ee4abdacabca38573841a322543b6c442784776833a6c04d672c7a45715802ce5f95507c85aa7f6c44bee0183010abb2639f75bc32808f
- SSDEEP 192:J3s5O13N8aTrOBuOmxh7AYvYEPbfOnFgotv5jGPEACcWnjPBxIyynr28yLPUoMil:J3b13nxOTYvB2go3dUyGi8wMrk
- TLSH T1C492DD66C3F88FF20A41685E4CD044904DC4C5175674E0AEBEBF1E0BECBD8A866A776D
- MD5 SHA1 SHA512 SSDEEP TLSH
data/carmods.two
- SHA256 48932aaf2bf7d7ae0abd635773a66785e70863b1b120af044e00152dae339f30
- MD5 c5f6270eb1004a541536680a44408f9f
- SHA1 bf1f77844cffff97cc6a844ac0b0c0e86c2c65ca
- SHA512 7d28f7dcf610438bf34f3e45cb469592a6da2b474a341caa045fea762d8370091ecaca095a51e562e6f5e2f7478abac42de6cae34e1e26ffa64b464b87085655
- SSDEEP 192:q7siYJJgPqFLetReICqmjlAHVjulAHwjr:q7sFJJgPqFL8R/mjlAHVjulAHwjr
- TLSH T15732DC2F6D6A4EF091C3BA6DC89F3E85096F1B0CDE6A61D10A18CC68120555FACE4F77
- MD5 SHA1 SHA512 SSDEEP TLSH
data/default.two
- SHA256 52b3f078b134b23cb577c90cc873c5f12c4a1a0f168c3ddf0891ede2bc5d622e
- MD5 9f5c4f4c19464f93f8b3bce556c66bd2
- SHA1 f39e10568291ad5022f809c8e45ced144f87d8c1
- SHA512 fc50a33191945816d984e53792d1d07a5424b0e895eb1f380d71ba72af6757b89ea346222d9345561d857d9a006a0cda5b5811b34738d634ba32eb308f28b130
- TLSH T17B01475C3BBEBB37B8B2D61266CC806A5700E8E15728AE5472C7C2905820B658252497
- MD5 SHA1 SHA512 TLSH
data/surface.two
- SHA256 fb6d31d3aceaa41e98bf65632bf2bf8b29a3f85dc0e4240759eb8fb34ddefb78
- MD5 2763746005ce02ddfafbdb0b2d0c654c
- SHA1 5d2c1a3a54a028c272f64cb3898d9b89b123a60d
- SHA512 ce91232bb88b10c3e74290c4764d9934af2e506b2a5e9ca604f1fcc18eb31e43edd9c87482949f53e1930da915ca523aeed458462547595a769e3acbc51c671f
- TLSH T196F0C2AF269C6A2A5BF3073C86824443DBFD22DF1C172E1E340C061C2316B81D5D7062
- MD5 SHA1 SHA512 TLSH
data/timecyc.two
- SHA256 04dc13f12e773f906e844e395b6347465d293f0675e5b92edcf05e52f1016b2e
- MD5 5269c77151ed180a15be889c6e302217
- SHA1 091d96cbb7af554db6e5e28aab10e65c41f813cc
- SHA512 e600b81dbd6c87b130714a1903ca574f6126dbeed81a93fddebba15f2fcd4e119b43424cee6665b234cabe4717ccf0ea6c96997325b4133f8c921725f6db2f0b
- SSDEEP 384:2gm7iNtCObN7b1qwTZEyqMBzR+p4Mi5xMhFg0QWv9d9Gj9qeTTA547KoXAQ3:7m7X9BqKcR
- TLSH T1FC035AED599400D8A834DE8A04283B54537FE2E7394257D0BEDCDBF07927ABBC992D09
- MD5 SHA1 SHA512 SSDEEP TLSH
mod_sa.raw
- SHA256 f18e565b2632853d800ccf429e32e02e8aab0cdc6907611d3dec5b19a0742638
- MD5 d7c0dea609bd25249025f0e98cf9c9d2
- SHA1 842d735ec121bb34e62e0a949135ec810e166db4
- SHA512 a93be062ba803d17813e14d94ecdc5c9abec94740f3cc9722d34c8c2c5a2a30a620c189cc64d74b6c20378fd560c3a76fc124a4f0ccab0a80d0d910efe91cb1b
- SSDEEP 192:bn+QgAQAwYrAQnAIAQQw4AvAwDYogwvAAqgQIYH4w494AQP4h44AAQwQowYQHIQ2:bnFaIrif35qE/+HUIHEPB
- TLSH T184D2DB1A5FFB33C7C6057B3494A6AD99AB2ABF9932340D5A0E0F5172CC531711E36E28
- MD5 SHA1 SHA512 SSDEEP TLSH
mod_sa_ChangeLog.txt
- SHA256 12d18d2feea0c06e7becd10e6d24d0fbff297f478c2f0d487ea64fed5493e322
- MD5 5a35d72dc71c3bb4d679a45ca7578dce
- SHA1 2bf15e257dde58166ce3e0642d8275954eb13e34
- SHA512 5ffbee3969e7f9d74caddbfd8290de52d1a87685f71948e50bb7f24116e2bbe68f245e4b0a5dc00250110cbaa7f1f0422cc3d9036847a5dd1528dd10509dbe33
- SSDEEP 384:2VwZBrmAw1nNloOzbxgRcM24M/k+S7dkteYyaOgqV2sLWxzXpMUFhglWt1EDvXuK:KymAInNlFzbDP4BqgH2sLWxzXpMUFuWw
- TLSH T177B2B46F6C1B36375AB30962D35D28327722912C57B7667870E9D06C324A06DA3BD2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
mod_sa_cm.ini
- SHA256 6cbfa9931968d5167f84d49f5b6647df8390d2959a100cea08c67b6996e477c4
- MD5 f73d8c6a91af5b3063e9ac5ec22af63e
- SHA1 8dd1a8be0e040285de1b981e74e5c95b53239126
- SHA512 fb702780e8ca9c86f433dc4c7509a76a2f6996d60db6d0569d0bdc8aa479b8fdc78a42e375a539fe30230d72f3b11f60ee7fcffcb653c44d5344c1e4d84ac973
- SSDEEP 1536:9JzfeATyZT31TcJTh9T0X60Yy82N+3CFcd:fNWJUP0K0mp
- TLSH T1EB33A5B8971F781E4BF30282A2069DB6F749243A7F63A415F40CD3EC2721B55A3DD85A
- MD5 SHA1 SHA512 SSDEEP TLSH
needle.png
- SHA256 91488099408a3e6f46cabfeffc782323ec586bffdf753dbc53d1e42f88f0c2bc
- MD5 925f5131220a94570994bbabd3ac2951
- SHA1 e1485d33edd2aea01b659d369cd7c28c84ca7dba
- SHA512 cb7b0b3919b94cdda5198363f6dfa5cbab82d0b284b36cd625114fa113a3d56f79bdfebcde747be3e6a7cba0dbbc678cec3fe36d3a1fb28913e846ef94059482
- TLSH T1D4615C6CF6A99B84C107543530B9236C692F11D3705327CB2A75B309CD43E2268E47C7
- MD5 SHA1 SHA512 TLSH
speedo.png
- SHA256 de7e7ba31ff3fd56878cf4736801ef4237f5b287b85b64463b0ca68bc7479650
- MD5 f9c48019b3a20ea04c9e93e998f5ab9a
- SHA1 c71690f6fdcb269470f489f2d843728bc347357b
- SHA512 be1952d8e1187c088a79e72f9911264e7a5e2084ec8221b5b4502a869fe8f71e76a7d04dcf16e1cfc0016f4e5ff625805be29039920b0952bb02a79d58c0a738
- SSDEEP 1536:PyndbUS6F4JMGP/H13qT6NIQeMkBNPIo01Mj5veke:KndbUS6F4J9/VakDkPPB0+j5eke
- TLSH T1F853F16023F61E1BF8294671D462B138D364D16CCF88158BFC6FB6A614A41BAF191CBF
- MD5 SHA1 SHA512 SSDEEP TLSH