1fa1f6771fb7bd651620defede366815a60327188fb632db13263e259e84387c[.]exe

resource
1fa1f6771fb7bd651620defede366815a60327188fb632db13263e259e84387c.exe
unpack001/$PLUGINSDIR/System.dll

1fa1f6771fb7bd651620defede366815a60327188fb632db13263e259e84387c.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 1fa1f6771fb7bd651620defede366815a60327188fb632db13263e259e84387c
MD5 ee84041334c9ad09d3f170b21cc2bf91
SHA1 8c7962dbed70a85a1896980501da1623e4a519c0
SHA512 5da7caa9ad7c26f6939a58dae92347ad94aa65368b4b23fbdaf6c817fc989cf2ac586ff21a6987014b3ae0d138727944884a9ae85885c5eea0b1e1d2d0a9b338
SSDEEP 6144:9pkXGhH0MbGaruHjzdMPTyoF+t84uxnG2SNVLr6jMVNtk5aJd7JRoFxtBbRSHs6E:0E0Mb1rMzEW+BSNh6j4n3ixtGHbE
TLSH
T1AE7412A137C4CA5BD7625FB05C5B4F7E4EE6CC60D1886E1323909E56BC92386EC1DB82
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ameiuridae.ang

SHA256 e829cca6f58fb2527965072339eeda493a058e1afcfc3f1038a9a1a588319f86
MD5 7eb62d1e13e02c6437fa388e5dc0e33d
SHA1 0739433c869dc83ed7d86751269acdf8025cfc05
SHA512 d908553cd395b984b5351060e7d89b66a0702dc88289fd16ddf09753b5cd635ecb01be92fa742ba9d7e37281aa33dff9a498b940470a0b19cd200ccecb8b75ba
SSDEEP 48:ycYgc3P7zmVu1086UwOnHjQpQDwO4LG2VwUgl7RUvBkIOUbWeV3iC6:yFNDBZwOnHjQpQDv4LnmmBBWeVy3
TLSH
T16523E6A16839DACC7721AE32367877F47E3C2431C218EC264A7CAC6C52AF24F41D6475
MD5 SHA1 SHA512 SSDEEP TLSH

Blodfyldte

SHA256 e2cc97fa056c21324fd4f78230a2866d5f65e69e3a001e9b84d0168bcca66e4d
MD5 a65fb7f04bad04660fbea8778a9a633e
SHA1 e841aa498d56ca98f15549d3759331e659aa13aa
SHA512 a4fd78109541ba73a840ede8ae3843f1cc4181f12b5cbc86752f2279e4eec1c2db8dc45abf22ef1c32d07d8653613e4d16716241f75bdbf6ff0bd97270939075
SSDEEP 6144:vDvwpTzZ13YncSZ4MHWXtHLHBfGhwKka2A:7oTF13YndCHLHlC
TLSH
T17F34F22E9AB5659DCC819539A60705A5DFE89C7A56D7F337C23BBF87C2001CA03E05A3
MD5 SHA1 SHA512 SSDEEP TLSH

Nell

SHA256 1ee9aa6af30a1f6fb217f9afca734edd7726266babb698da2bdc40733eed3feb
MD5 5fc804971cf5db1383fa66c7e5a74ce5
SHA1 113cd185a486b2d3f23fe3a50f917d7e6bd1a72d
SHA512 257aa1aa38bfbbca46fcf51edec7ee689697ba501c44d63c5b472af5dda79e7abcc10d398dee819b1d4397998719f6aaf6afed5427fb23574b6236fbdf912c61
SSDEEP 1536:LYVF/uDHNGZyLIUCjbMq43QfTu/09YXpAKClOoICgno2ezn1qpZYE1a7:SF/cHdq43QfT2sl1b6o2cqpSr
TLSH
T113E3BE51CB56CCBBDD078938C57E50A649D97006AB4FD0FDA1726928C2833E3A7246EF
MD5 SHA1 SHA512 SSDEEP TLSH

Tornls.unt

SHA256 1e47ab1ba31c636237e0180927a38730a8f06cfe06302e119c0fa01b5aff1a17
MD5 12f2899413d2fa6232ff084223bd35a4
SHA1 6ccf1c6151ebb82518429e0b220e52618a7ea680
SHA512 0eccad6d4fda26451b714e48def99b0ceff1248867ad772b548e28dedff88a88f89043b000fdda075783d2dedcdca1e19b85f91b6315231442cb1cfd5c453bbc
SSDEEP 24:io2JC7dUXa9lKH67DyTnKMqkQ99+sjWdnlS9:io8+dUq/KH67DyTWkQ2aWdnlS9
TLSH
T15543EB5F07DF7591EF8C90B5B4BDC93DD160C630D05CF45658AE6BD1CBB261104165B8
MD5 SHA1 SHA512 SSDEEP TLSH

agate.sam

SHA256 bd63c3993d902c96c0cfe59cd5b721c6ad237ba57e773d9e04b54925da000f8a
MD5 0fcfe0b482e39b9da523409c4c3b13f0
SHA1 fcc1d20d4fd2e56606ab7f1b5253e03d0b7f2105
SHA512 4862f6469e823721ad25a2752d7b710d27fbc8b1d838f4f1d12e60a85ad2dd5d66a8892ff08fcd8203d34e29857948edee4f2ab253eaad565863269fff792f07
SSDEEP 6:8575nnt5w5HnI5EninRnl5A5Q5m5Lnc5i5u5nn857:895LwpEEiRjcsOLcUu58N
TLSH
T1F30297FC2BC00923993784E94B970A1EDC2452281D4888F347D0D98C5A47A0A3BE8006
MD5 SHA1 SHA512 SSDEEP TLSH

begyndelsesgrunden.for

SHA256 380b8cb75730f9bb1d9c093715811098788309fb8f5cb6867734338d847e6c4a
MD5 dd711f4631e1cb54ec57407c93c1ba46
SHA1 583d41c4c3022915ad67a78525d790780747f462
SHA512 e23a3c5aa38f9d32f9339d65f495658aba08f16621d0e5993367d6ca703fd839552c31345357408b66bb25b915731815b828ea5aeaf2aec4da3de24096fa647f
SSDEEP 96:N/9TA8OqMTmIO2rc0dNWLh1g+JE9VIlASgwVJTzlZqCVcB6A:N1A8b0dNWEQE0Zh6R
TLSH
T11A7307ECC30568337E9258731F22F7E0A607D4632266096A84D1599B837A200BADF458
MD5 SHA1 SHA512 SSDEEP TLSH

blodtabets.lev

SHA256 9853c2b9f3ca16bf1214874ef8795f02d42ed72e97a9f69b84f95b4fe57fb7c4
MD5 4243cd1b247cbad31cb17f71c0d5a284
SHA1 b8a9e123b2ceb7abf06a8b810527219ef1d3d095
SHA512 0f8f744b765a9b813ed4eecd82e2407104345bf98b0629a33656eb04cd6274c7a5cc2cb5792775dff34ece03a50db76e26aa707653b98fb8636af726eff63000
SSDEEP 96:yhHpKgrBVH06er4ZMZsyXoRLHS9Q/GKHDIxdu4PZse1:yxp/vH0b0Z7luR
TLSH
T14D832B50F159666F38CB113D0395722094897282B7389FB450E2E6F571E96C9E21D384
MD5 SHA1 SHA512 SSDEEP TLSH

commeasure.uns

SHA256 c9c863c8d08b587db47686807a51057f508a2c63f17d615556de906f72af74d5
MD5 8adb40bd42f3cbb30474ba1294bc6d40
SHA1 dc8a318709945d88d02b8fda356b4fab36317813
SHA512 a5ba7c1c58a59d380d2631a2112e13bcb1d84577aa533ab514d0db455bdc8e61a18aba89e0bb5fac083ea4805e51fb5ae4f1d34f5080ad6b71e3c8973f7586d1
SSDEEP 24:fUYAeY8s0pVKoj0b4+kfpVclJkT49hpKCkMKoEkNwb4iL9WFqdCR:8YwVixF5fpOvkU9HKJM1XNwbHhndS
TLSH
T11EB2446E0A45ABC3B57AF0B4BA7C636B897A743A9CC6897C6E8191D9A44640D1D48340
MD5 SHA1 SHA512 SSDEEP TLSH

courgette.cho

SHA256 4fa19ce6083f17299eb1693b6fb162db5c3aace0d13ac703110d1a4c37e4cebf
MD5 b92b4bebecef06037f20fd75f2daa9b6
SHA1 a1af5b697e0653a0800b0bb52cc9473aa7f61268
SHA512 e4ce8222b928ef3d047e87e6384c983150d76b0502adbcf57f39f165d2c1341f38ea1427464f5728094db2c0da507a0ca4b56ff0c596a64af5563efcdb1803c5
SSDEEP 48:gEY8L/APnRKASazW4UnWdYmzfmEbIKYU6gFxyKS4IR:gE9YPRKAVDzOnK7HC
TLSH
T1F0130B046C453C4556C94F0D990C82F0835D04A5FDD7A55BB557409ABDB6087837AD19
MD5 SHA1 SHA512 SSDEEP TLSH

ergoterapien.uti

SHA256 c8b03b4df5a1ada1befe2cb3e53f0b29344e85e8a8ae8ff3f7da3ef0e55bac5f
MD5 1a51437d2795166fefd52e563393c2a1
SHA1 742e1f8ffb6e1ecad359b4440c4db7a680cc56db
SHA512 12923e34ea4fc184912cb61b1f5a70fb486c3ea6da8f1a2f5ddc5bb2ad32c74b95643bbce24a0492286c10bf18b55fe29a8c0f40ef881d3de2ef2dbd96961d9e
SSDEEP 48:jaHSQBng6pydMU+ZAe0vDjz+mr/kDnmCux8tDBCQKPoN0vbjL1:j6g6pBetr/knmC6yD8Q7N61
TLSH
T11473FBCB664A8F4089BADC436C38C77D355611E26B7B6C804DB851FC8C05644EF8FA10
MD5 SHA1 SHA512 SSDEEP TLSH

hjulsporenes.ren

SHA256 3b989647989f93fc6cdb05b829c1a3f8735783924ef7d6895ad829acdaf293ee
MD5 3600c983859681c7665d959faa8633a3
SHA1 059377a5b179e5dae0aa8b9e34cbb4a6e11d5dc0
SHA512 c107e427b79a24cf6f2ee63f164b292bcb493f7e1f0d8aa1c09a9b7dd54a1b9ea30eb8c5c60e4a7bb7aa04e97322f8fb2562a874f223263dff00475aeeff25de
SSDEEP 96:OoyRyuIUiQe5ESHZhe96wA9r52hIxpbS1ACm:7qTW5v5hugv2aHbSLm
TLSH
T188330ADA1CE2271666BC3F49C5C3AD37209960AB5765FF03718FCA9311D6615BC8C406
MD5 SHA1 SHA512 SSDEEP TLSH

sikkerhedsmarginernes.kas

SHA256 8142f6e41796ae4bcbeae133cc2277cb57d7061aafce1a2fc4d5de8fd4e2897a
MD5 7c8e72c3c5f6e2fe585bff0bce013efe
SHA1 e52bed2153546197f25c60ca1a8c308cc973636e
SHA512 fd945b799843b32290cccb4dd19c8b17330ca94b9845eca43f33d7240c78a3343712fdb9b6489c317e28b4ec47c703f12ba7ff603f798d4b57fccea90057bceb
SSDEEP 24:Et1huizdHc5Sx0uquZE21AwiXwcxcHdDnnNcPr4YoP8tal:EbdzRc560uqkdewip0dDnnWUHktU
TLSH
T11253C8639A0E2D635060F39B50667DB9FA0D184D381F2341AF5442327DF269421BB96F
MD5 SHA1 SHA512 SSDEEP TLSH

skibobs.rem

SHA256 f81134d58b1fa0e27ff4ad19cfa7fb2e164edceca68b28759105a6d647d3f446
MD5 e1b35379f3f6ce0f185ee6eb1d634bfb
SHA1 67319b665e14528e3fb3aea648ebe9c7cf523657
SHA512 b8a814574a52e79cb3437af4779a3cda0b7fb6884cf6316981deca3e45814c00dbbc4748245e66133a87c6d2ab8795d92eddebdb2e3622d62fadf2b2c7b69211
SSDEEP 24:sQ7VRmf80C+oydS6KQAOkaOqEtGBEoJ8WZ0Ebvc2nlyIODBs4lbpuXLJUjQcJPPW:/KDZS6pn9wtqJVCiqKJGQcVRP0z
TLSH
T1B233F9084003B48E78DD59CD47D52C8DE6ED6326FD64D2C030E11C973C450A52AFFA55
MD5 SHA1 SHA512 SSDEEP TLSH

soporiferousness.spr

SHA256 08c2a9b5f066a4391d51eb5cb310118e9e70b9b47363181949666e11e4b2f40f
MD5 c414e1a7f116c4afbf3a8439a33a436f
SHA1 6e93d74648aab14b32b4343eb3cc567378799608
SHA512 af79f8e876964efe2b75d56b442d396a98bf981557fdeb052c740043b8287d3adfc2741c39c19654502bf60b0661b426865270dc23dbe02ad8421dc1b446551b
SSDEEP 48:5orHNaEOxegzRXvdCG7jwLL+qPrEiwuexYGHeUNDPMmpPSgw2BMbMOB:yaheiXvd/jwLRuxAUNDPhpPzmbMu
TLSH
T162330A7D50E3783C0B58FB85C86EAEC5C2F1D280655072ECA1F753E420BD16088AC293
MD5 SHA1 SHA512 SSDEEP TLSH

tilskuerpladsens.baw

SHA256 9d39ee136a863522ec15386c2de7f5320628b087dbb24aaff97b5d4d4dc7f341
MD5 2b60ce5d02f71450cd875119efc10d4d
SHA1 b10f687784f150d463fb6635840cdeeac6773491
SHA512 7c1cb0e909d1768ac9345132c1fbe1885cbfee95afb5fe0791d5abd52a99802c92050708b2bd06b28ab9fee8ace4e825d461dbe4679c4951602ca4ff7e5af9ab
SSDEEP 24:MAj4V4EHRnzYtfKbECjcTS+wLFmbbL5mAxNo/hvBymYFAk53P1O4I:MA0RdMS+wwbbL5Po/hvYVAk5/Y
TLSH
T17513C87C535FA0902FB2A9A1FB4084602B655F528822F4DD6E4CB9854C45774DCDB78F
MD5 SHA1 SHA512 SSDEEP TLSH

uplight.sel

SHA256 4a5e2ea3b01f433cbdb0a1f5d2032f9fa9c646505ff158ce60bc6f48463503de
MD5 10cdab5ad85db3aef78ab73120ccfde4
SHA1 7c2058dc94c60c538893b1fbfc583f90b2d2af11
SHA512 87c931175b074826d4c18913d655be68800be01cea8881977d1898de66b4f0d870887b1481683c2cbe09c4cf0f83d8207a33a9c10a511255be11c7e14d24025b
SSDEEP 48:0M/djKo5JlU0iNLXm5BlsttWaGmTJ1gWU9qcb9miivfiLR9GUgfI+fA:RjLkkBwdVyIMmijR4JA
TLSH
T1AC833BF2804E972334859BEE7495B1EC915825D5DF436A32E127240DFAB51C4F8F7AC2
MD5 SHA1 SHA512 SSDEEP TLSH

uskadeliges.ant

SHA256 5bc286cb8b62c17fdfb2e83da85c93e05cb7934c0306fea64df02639d7acbf93
MD5 b938de4fe8a6b3f0775dccc121c45553
SHA1 5ef3f9f792d75001e5fe6728fa65bc131cfaa52f
SHA512 1991e675e9c0aa1598184966a29a5450997d04ceeece2fdd5505b4bc15443c1fd4c3b3333cdbeb4f2adf396d0d50a21cf8afe896b81739b2542814629f49f838
SSDEEP 24:NU5O0LAxs16RhpfUX2+ey6LiR73WVv2sT1SXDo38QHE92lAu:eXLKY2pcEy8iFmVxT10o38xE
TLSH
T1C8A28819A40D638DE00E5AEF2763E0F016B47857539D09EC57557C9373A61C44286E4A
MD5 SHA1 SHA512 SSDEEP TLSH