366962dc2e090af9079b3c78d17584ae0bcd3216f9ed124d3087dfcd6b58b9d0
- SHA256 366962dc2e090af9079b3c78d17584ae0bcd3216f9ed124d3087dfcd6b58b9d0
Overview
overview
5Static
static
3submacros/...32.exe
windows10-2004-x64
3submacros/...32.exe
windows11-ltsc_2024-x64
3submacros/...64.exe
windows10-2004-x64
1submacros/...64.exe
windows11-ltsc_2024-x64
1submacros/...ers.js
windows10-2004-x64
3submacros/...ers.js
windows11-ltsc_2024-x64
3submacros/...or.vbs
windows10-2004-x64
5submacros/...or.vbs
windows11-ltsc_2024-x64
5submacros/Status.ps1
windows10-2004-x64
3submacros/Status.ps1
windows11-ltsc_2024-x64
3submacros/...und.js
windows10-2004-x64
3submacros/...und.js
windows11-ltsc_2024-x64
3submacros/...ro.vbs
windows10-2004-x64
5submacros/...ro.vbs
windows11-ltsc_2024-x64
5submacros/update.wsf
windows10-2004-x64
5submacros/update.wsf
windows11-ltsc_2024-x64
5Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
submacros/AutoHotkey32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
submacros/AutoHotkey32.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
submacros/AutoHotkey64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
submacros/AutoHotkey64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
submacros/PlanterTimers.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
submacros/PlanterTimers.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
submacros/StatMonitor.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
submacros/StatMonitor.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
submacros/Status.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
submacros/Status.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
submacros/background.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
submacros/background.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
submacros/natro_macro.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
submacros/natro_macro.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
submacros/update.wsf
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
submacros/update.wsf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 366962dc2e090af9079b3c78d17584ae0bcd3216f9ed124d3087dfcd6b58b9d0
- Size 1.3MB
- Sample260730-py86vaap6t
- SHA256 366962dc2e090af9079b3c78d17584ae0bcd3216f9ed124d3087dfcd6b58b9d0
- MD5 bd0914569a89fed796575e161a5bf9e7
- SHA1 d694f39d307ac4bc23db0597dc096535c76077cf
- SHA512 50ce4dbb119aa7241e2722844da05bafb6e1ca313efc04be44c8fbcd99b9d5b573177a008ae3c9f4ce677ac159dca51736be24f04557af218c68bbc644780969
- SSDEEP 24576:/QYsOj4li62jyFYSoYINnXjDSKJ5+iE2fsHoolsOutRpAq6IJNJTFXNWUj6biFe:YYd4IyF7EjDjJwiE2YlQ7pAq/3JNWUjC
- TLSH T1B95533499ECF6E94BFCB4BE620B0ABFB5DE80099835B43DFD344292E4241065469DD3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/submacros/AutoHotkey32.exe unpack001/submacros/AutoHotkey64.exe
File Explorer
-
366962dc2e090af9079b3c78d17584ae0bcd3216f9ed124d3087dfcd6b58b9d0.zip 1.3MB
-
submacros/AutoHotkey32.exe.exe 957KB
-
submacros/AutoHotkey64.exe.exe 1.2MB
-
submacros/Heartbeat.ahk3KB
-
submacros/PlanterTimers.ahk.js 36KB
-
submacros/StatMonitor.ahk.vbs 72KB
-
submacros/Status.ahk.ps1 172KB
-
submacros/background.ahk.js 16KB
-
submacros/natro_macro.ahk.vbs 871KB
-
submacros/update.bat.wsf .bat 3KB
submacros/AutoHotkey32.exe
- IMPHASH 07cf90eb46aaf6a294723af987f55fbb
- SHA256 05fcaf6f09b9fe4b85887f75183310d34166a0b854ca0907b497808be7b8f87d
- MD5 8bc086a1ce0b394de31cd415a3cd0e87
- SHA1 620fbfc0fce8067a9af12c0e3267f8c17c658d6a
- SHA512 0f989b2584fdbfde2ea01dd0ac7ff7c51da0063ab01c57053ddf15547ba7187f2795d5013beff558431fe0db0a1a0af991dbc4af455cd86ba7d4676366104237
- SSDEEP 24576:UnbyRuLHeIj86TTuQbyB3+vETrGNW8NxqxYk:2yKgqEvGNW83qxY
- TLSH T127256B53B3D3C1B1DFA215F3D5B66B369939F8380B2889CBB2D4582ED9A05C05B36706
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
639033
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
htons
getservbyname
htonl
recv
WSAAsyncSelect
inet_addr
inet_ntoa
gethostbyname
ioctlsocket
WSASetLastError
WSAGetLastError
gethostbyaddr
getservbyport
ntohs
send
gethostname
shutdown
WSACleanup
closesocket
connect
socket
WSAStartup
winmm
joyGetPosEx
mciSendStringW
joyGetDevCapsW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
comctl32
ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
psapi
GetProcessImageFileNameW
wininet
InternetCloseHandle
InternetReadFileExA
InternetReadFile
InternetOpenW
InternetOpenUrlW
shlwapi
StrCmpLogicalW
uxtheme
EnableThemeDialogTexture
SetWindowTheme
IsAppThemed
dwmapi
DwmGetWindowAttribute
kernel32
GlobalFree
GlobalUnlock
WideCharToMultiByte
GetCPInfo
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
IsValidCodePage
LoadLibraryW
GetLastError
OutputDebugStringW
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
VirtualProtect
SetLastError
GetModuleHandleW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetVolumeLabelW
GetVolumeInformationW
GetDiskFreeSpaceW
SetEnvironmentVariableW
MultiByteToWideChar
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
ReadFile
DeleteFileW
LoadResource
LockResource
WriteFile
SizeofResource
SetCurrentDirectoryW
CompareStringOrdinal
CopyFileW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GlobalLock
SetFileTime
GetFileSizeEx
MoveFileW
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
GetProcessId
QueryDosDeviceW
EnterCriticalSection
LeaveCriticalSection
Beep
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetDateFormatEx
GetTickCount64
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
GetTempPathW
WaitForSingleObject
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
SetDllDirectoryW
GetModuleHandleExW
GetShortPathNameW
CreateProcessW
FormatMessageW
CompareStringW
RemoveDirectoryW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
GlobalSize
FindResourceW
SetErrorMode
Sleep
GetTickCount
MulDiv
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
IsProcessorFeaturePresent
IsDebuggerPresent
TlsSetValue
TlsFree
GetCommandLineA
GetCommandLineW
ExitProcess
HeapSize
HeapReAlloc
HeapQueryInformation
HeapFree
HeapAlloc
GetProcessHeap
FindFirstFileExW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GlobalAlloc
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetSystemTimeAsFileTime
VirtualQuery
UnhandledExceptionFilter
user32
EnumChildWindows
SetActiveWindow
IsWindowVisible
IsChild
SetWindowRgn
SetWindowPos
EnumWindows
IsZoomed
IsIconic
GetLayeredWindowAttributes
SetLayeredWindowAttributes
DestroyWindow
RegisterClassExW
SystemParametersInfoW
CreateWindowExW
GetMenu
EnableMenuItem
LoadAcceleratorsW
AddClipboardFormatListener
RemoveClipboardFormatListener
LoadImageW
PostQuitMessage
CheckMenuItem
RegisterWindowMessageW
DefWindowProcW
SetForegroundWindow
MonitorFromPoint
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
GetPropW
GetClassLongW
SetMenu
SetPropW
RemovePropW
GetSysColor
RedrawWindow
DrawTextW
SetParent
GetClassInfoExW
AdjustWindowRectEx
GetAncestor
UpdateWindow
FlashWindow
GetMessagePos
GetSysColorBrush
FillRect
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
SetMenuDefaultItem
CreateMenu
CreatePopupMenu
SetMenuInfo
DestroyMenu
TrackPopupMenuEx
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
DrawIconEx
EnumClipboardFormats
GetWindow
BringWindowToTop
MapVirtualKeyExW
GetLastInputInfo
GetLastActivePopup
GetShellWindow
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
SendMessageTimeoutW
CharUpperW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
DialogBoxParamW
ScrollWindow
GetSystemMetrics
GetWindowRect
SetFocus
DefDlgProcW
MoveWindow
MapWindowPoints
GetClientRect
EnableWindow
MapDialogRect
GetDlgItem
SetWindowTextW
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
IsClipboardFormatAvailable
CountClipboardFormats
LoadCursorW
GetCursorInfo
ClientToScreen
MessageBeep
GetIconInfo
GetWindowTextLengthW
InvalidateRect
AdjustWindowRect
SetDlgItemTextW
SendDlgItemMessageW
IsCharAlphaW
DestroyIcon
EnumDisplayMonitors
GetMonitorInfoW
BlockInput
MapVirtualKeyW
SetWindowLongW
ScreenToClient
GetKeyboardLayoutNameW
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
GetQueueStatus
VkKeyScanExW
ActivateKeyboardLayout
GetDC
gdi32
GdiFlush
CreateDIBSection
EnumFontFamiliesExW
SetBrushOrgEx
CreatePatternBrush
GetClipBox
GetObjectW
SetBkMode
SetBkColor
GetDeviceCaps
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
CreateSolidBrush
GetCharABCWidthsW
GetTextMetricsW
GetPixel
GetDIBits
SelectObject
CreateDCW
CreateFontW
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteObject
BitBlt
CreateCompatibleBitmap
DeleteDC
GetSystemPaletteEntries
SetTextColor
advapi32
UnlockServiceDatabase
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueW
GetUserNameW
RegConnectRegistryW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
CreateProcessWithLogonW
OpenSCManagerW
LockServiceDatabase
CloseServiceHandle
RegDeleteKeyExW
shell32
SHBrowseForFolderW
DragFinish
SHGetKnownFolderPath
ExtractIconW
DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
DragQueryFileW
SHGetDesktopFolder
SHGetMalloc
SHCreateItemFromParsingName
ShellExecuteExW
SHGetFolderPathW
Shell_NotifyIconW
ole32
CoCreateInstance
CoTaskMemFree
CLSIDFromString
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal
oleaut32
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayGetDim
OleLoadPicture
SafeArrayDestroy
SysFreeString
GetActiveObject
SysStringLen
SafeArrayCreate
VariantClear
VariantChangeType
SafeArrayGetLBound
SysAllocString
SafeArrayCopy
SysAllocStringLen
VariantCopyInd
SafeArrayGetUBound
Name
.text
Size
730KB
Virtual Size
729KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=30795,
count=44, id=261, version=32533,
count=21, id=260, version=32533,
count=25, id=259, version=32533,
count=27, id=260, version=30795,
count=160, id=261, version=30795,
count=1, id=262, version=30795,
count=33, id=257, version=30795,
count=484, id=1, productName=Unmarked objects,
count=1, id=259, version=32822,
count=66, id=265, version=32822,
count=1, id=255, version=32822,
count=1, id=258, version=32822,
submacros/AutoHotkey64.exe
- IMPHASH ce1444d915054b4e2ded192c44720156
- SHA256 37ff15a23a98f0a658298e21f1873ca896a05208810bf796f90ca212ee07c7b1
- MD5 825448610a8213a8408578df2361d5eb
- SHA1 f43875855e4f02010ad6c755067b813d0fcbe68a
- SHA512 7556143128878b2e765309db8b35cc8206d325c0c17c37b191600bd8f719a923b0f917f4c53f0946ed2d12136a9e42774246595eed78f1038779fdcbd3736eee
- SSDEEP 24576:Ve1psX+O47m4ffJhxZ4rBcRyMlc/SsVNGgMxCRjU:Vek+bi4ffJhxZ4axcbHGPWj
- TLSH T1DC459E4773E7C1F8DA7B81F6C5614226E67178600B389BDB25A0862EDF63ED04E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
762012
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
htons
getservbyname
htonl
recv
WSAAsyncSelect
inet_addr
inet_ntoa
gethostbyname
ioctlsocket
WSASetLastError
WSAGetLastError
gethostbyaddr
getservbyport
ntohs
send
gethostname
shutdown
WSACleanup
closesocket
connect
socket
WSAStartup
winmm
joyGetPosEx
mciSendStringW
joyGetDevCapsW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
comctl32
ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
psapi
GetProcessImageFileNameW
wininet
InternetCloseHandle
InternetReadFileExA
InternetReadFile
InternetOpenW
InternetOpenUrlW
shlwapi
StrCmpLogicalW
uxtheme
EnableThemeDialogTexture
SetWindowTheme
IsAppThemed
dwmapi
DwmGetWindowAttribute
kernel32
GlobalFree
GlobalUnlock
WideCharToMultiByte
GetCPInfo
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
IsValidCodePage
LoadLibraryW
GetLastError
OutputDebugStringW
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
VirtualProtect
SetLastError
GetModuleHandleW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetVolumeLabelW
GetVolumeInformationW
GetDiskFreeSpaceW
SetEnvironmentVariableW
MultiByteToWideChar
GetFullPathNameW
GetFileAttributesW
CreateDirectoryW
ReadFile
DeleteFileW
LoadResource
LockResource
WriteFile
SizeofResource
SetCurrentDirectoryW
CompareStringOrdinal
CopyFileW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SetFileTime
GetFileSizeEx
MoveFileW
GlobalLock
OpenProcess
TerminateProcess
SetPriorityClass
GetProcessId
QueryDosDeviceW
EnterCriticalSection
LeaveCriticalSection
Beep
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetDateFormatEx
GetTickCount64
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetCurrentDirectoryW
GetSystemWindowsDirectoryW
GetTempPathW
WaitForSingleObject
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
SetDllDirectoryW
GetModuleHandleExW
GetShortPathNameW
CreateProcessW
FormatMessageW
CompareStringW
RemoveDirectoryW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
GlobalSize
FindResourceW
SetErrorMode
Sleep
GetTickCount
MulDiv
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCommandLineA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCommandLineW
ExitProcess
HeapSize
HeapReAlloc
HeapQueryInformation
HeapFree
HeapAlloc
GetProcessHeap
FindFirstFileExW
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GlobalAlloc
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
GetCurrentProcessId
InitializeSListHead
user32
SetWindowPos
EnumWindows
IsZoomed
IsIconic
GetLayeredWindowAttributes
SetLayeredWindowAttributes
DestroyWindow
RegisterClassExW
SystemParametersInfoW
CreateWindowExW
GetMenu
EnableMenuItem
LoadAcceleratorsW
AddClipboardFormatListener
RemoveClipboardFormatListener
LoadImageW
PostQuitMessage
CheckMenuItem
RegisterWindowMessageW
DefWindowProcW
SetForegroundWindow
MonitorFromPoint
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
GetPropW
GetClassLongW
SetMenu
SetPropW
RemovePropW
GetSysColor
RedrawWindow
DrawTextW
SetParent
GetClassInfoExW
AdjustWindowRectEx
GetAncestor
UpdateWindow
FlashWindow
GetMessagePos
GetSysColorBrush
FillRect
GetClassLongPtrW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
SetMenuDefaultItem
CreateMenu
CreatePopupMenu
SetMenuInfo
DestroyMenu
TrackPopupMenuEx
CopyImage
CreateIconIndirect
CreateIconFromResourceEx
DrawIconEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetQueueStatus
GetLastActivePopup
GetShellWindow
MapVirtualKeyW
VkKeyScanExW
SetWindowRgn
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
SendInput
UnregisterHotKey
RegisterHotKey
SendMessageTimeoutW
CharUpperW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CharLowerW
ReleaseDC
GetDC
DialogBoxParamW
ScrollWindow
GetSystemMetrics
GetWindowRect
GetWindowLongPtrW
SetFocus
DefDlgProcW
MoveWindow
MapWindowPoints
GetClientRect
EnableWindow
MapDialogRect
GetDlgItem
SetWindowLongPtrW
SetWindowTextW
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
IsChild
IsWindowVisible
SetActiveWindow
EnumChildWindows
GetLastInputInfo
LoadCursorW
GetCursorInfo
ClientToScreen
MessageBeep
GetIconInfo
GetWindowTextLengthW
InvalidateRect
AdjustWindowRect
SetDlgItemTextW
SendDlgItemMessageW
IsCharAlphaW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
IsClipboardFormatAvailable
CountClipboardFormats
SetWindowLongW
ScreenToClient
GetMonitorInfoW
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
EnumDisplayMonitors
DestroyIcon
MapVirtualKeyExW
BlockInput
CallNextHookEx
gdi32
GdiFlush
CreateDIBSection
EnumFontFamiliesExW
SetBrushOrgEx
GetObjectW
CreatePatternBrush
GetClipBox
SetBkMode
SetBkColor
GetDeviceCaps
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
CreateSolidBrush
GetCharABCWidthsW
GetTextMetricsW
GetPixel
GetDIBits
SelectObject
CreateDCW
CreateFontW
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteObject
BitBlt
CreateCompatibleBitmap
DeleteDC
GetSystemPaletteEntries
SetTextColor
advapi32
UnlockServiceDatabase
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueW
GetUserNameW
RegConnectRegistryW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
CreateProcessWithLogonW
OpenSCManagerW
LockServiceDatabase
CloseServiceHandle
RegDeleteKeyExW
shell32
SHBrowseForFolderW
DragFinish
SHGetKnownFolderPath
ExtractIconW
DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
DragQueryFileW
SHGetDesktopFolder
SHGetMalloc
SHCreateItemFromParsingName
ShellExecuteExW
SHGetFolderPathW
Shell_NotifyIconW
ole32
CoCreateInstance
CoTaskMemFree
CLSIDFromString
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal
oleaut32
SafeArrayUnaccessData
SafeArrayDestroy
SysFreeString
GetActiveObject
SysStringLen
SafeArrayCreate
VariantClear
OleLoadPicture
SysAllocString
SafeArrayCopy
SysAllocStringLen
VariantCopyInd
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VariantChangeType
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
SafeArrayAccessData
SafeArrayGetElemsize
Name
.text
Size
885KB
Virtual Size
884KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
240KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=23, id=259, version=30795,
count=46, id=261, version=32533,
count=19, id=260, version=32533,
count=9, id=259, version=32533,
count=25, id=260, version=30795,
count=156, id=261, version=30795,
count=1, id=262, version=30795,
count=33, id=257, version=30795,
count=494, id=1, productName=Unmarked objects,
count=2, id=259, version=32822,
count=66, id=265, version=32822,
count=1, id=255, version=32822,
count=1, id=258, version=32822,
submacros/Heartbeat.ahk
- SHA256 6a3940cf5f56b69dd2eabe4beca192fcead452f614cb7870c746770910c271f2
- MD5 4c78253ac47e1c3f53d7dbf740cefd9f
- SHA1 241e8cbabb0b368bb6f4d72af930ffec8a41173b
- SHA512 c430431b837c6da46b7c767eccdea704d08735c7eedc06b78f60dfae0fc5c9191e4a79eb34515ee8f15a632fa98facabb344a43427485808efc827f997acee9a
- TLSH T19F71B76AFD37C46DE5F10E97557496CE9F078060F27A84E0B0CEA8DEDB0A1120929FE4
- MD5 SHA1 SHA512 TLSH
submacros/PlanterTimers.ahk
- SHA256 50ecab75c4da83c6a2a91409bb33ae54661591ece65348facf1c80a8e2de5b5d
- MD5 4c507e7f6e8b370ffb1e76fcda41fdc7
- SHA1 f739a6fbc55b374bbd3f5445516316aa1f80a2b7
- SHA512 c74555ef9a4f0f1993f9dd1be486340c9cda0fdd8e71819e2b09fde40a9c719e6b7bc2fef55a822c8d84546b29ba582d3caadcd49ff0a503ca569c8b9ed2577c
- SSDEEP 384:vKq3vSx7IhKd78l6MLMga4RC1QXdXLDlt30Uw+Zmuse7svWD8V0NjCqso2CzXzPk:Cq2L8l6MLMga4RBVTz/TD8VojLd5o
- TLSH T10AF2511DB827182B62C326E9BDB10D80FF4A8352C07594592AB605F3E9EF47864F9FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
submacros/StatMonitor.ahk
- SHA256 466ac3d23cc2f002df56c1e41ac685646b8308013d429b91c4bb68d4edcc5f0a
- MD5 c414285b6ceb9021737ed4bce078bfb8
- SHA1 8a8dbda9e4558450f94a93e8cfead9dd143ba5b9
- SHA512 6c87cdcdd8d07c9670fb8a4a8062036de46dcbe4e6778b1926accf480260517893cbbac12ce6952248cc2025e8c81eb607d4b427cbb74c62bd7a9fd91802d9e1
- SSDEEP 1536:nQtuTLLP96GZ3SZanYW2Oc9R9URVH85xo:QtuTLLDnYLOcdUjoxo
- TLSH T19173C81FB70F0E99C6D1D98EB7346ED8CA6AF443A4A305C9E722F6E841DF510819C399
- MD5 SHA1 SHA512 SSDEEP TLSH
submacros/Status.ahk
- SHA256 bb0c2a4b31ca1b0e550e8ccdd6e95fa31d15244b42656d0709cd0bc2933c85b7
- MD5 0f90a55216c70b4ce48d0d1bcaefd356
- SHA1 ffdcefda9ff982b872426652be5d47a64f3705ea
- SHA512 a01afe3f193cacff71eb53dec1915f79cebe1de695bdbef2278d836a55db33b53bdb7fb3e964df75dfabf92d87709b1efc71ff265c5406ef4482276de7a27c90
- SSDEEP 3072:YxPo6iUUcV431Oi1txYKNIK02qDHObEKTzgkp+x0EkGUJcYKkqPs5b:+YdHbiDeR+x0EZPs5b
- TLSH T1F9040912B10EB03E02E710EDE5F53E506E1CD6B4A3FE043A73B6C394D6AE45590B6B69
- MD5 SHA1 SHA512 SSDEEP TLSH
submacros/background.ahk
- SHA256 d2fd7e1393691c4f3f6d899f24efc4e3bfa6b8615f9a2519f627cf2aed901d0d
- MD5 f1fa8abffb5d03c86577c16cd44e7bc0
- SHA1 196c5b84b15ebb80d966fc04a6e4d66f5c7f603b
- SHA512 c1a6238ddc6ac1907695bf05998396b8bfcf315e2f397523637fb75a450ec768cba962a947c7b73294c0c9ee09d241a5e0031fa5c86bd4480ff5bdf112521fbd
- SSDEEP 384:vKqH/J1K/PhqWXJOgmAo/1quIx+bHkS6/8FFw:CqHTKwomAo/AuIx+rN6/J
- TLSH T1CE727659B90E3E0F9293615EAE31A6894D6EF47801B501D13FFE70CAFAE522140647BB
- MD5 SHA1 SHA512 SSDEEP TLSH
submacros/natro_macro.ahk
- SHA256 0aba10072f3b1c9b0d7ce78b1ab89ef599bc0055c7ac2942c6d540d9e2e33e3a
- MD5 d9158d81fdb2d47899f660681750633f
- SHA1 edee86fc203e58e99c74d8935202b9ec13c39a01
- SHA512 a730233e5dde5e79513b91ed32db49d83442988b32f9a8c9c71295e748e78017c4aa640d71178030f6dea2e7e5f1c2fad9395b0363c45a2559298adfb700e4a9
- SSDEEP 12288:5PVpFa6P2EKFM5XaQ0+pXsUb3eQsDBhPizLivS:TpFtP2EKFM5Y+pXsUb3ejib
- TLSH T15B152930F10F083B42A3655EAA702AD1DF0DE071C1B901E9F6AD52FDAA8F8154799BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
submacros/update.bat
- SHA256 6ab41f52393591f9b847241d5b0f66e38a17045c218b5d55071e2ac7cb36eb36
- MD5 ff05dde1ba3a679b58b3631ff7cb2631
- SHA1 dc410f1600cdeacf0dc3da05e5d897f2f1bf9096
- SHA512 61dee1798e0d943c162810490ff7ba294d3e92aa94bb9573ee5b8044e890af2b9e985aaf4f07692bb49948fb3e0631e7df7197b7360419c7e0cb1de7c06011fb
- TLSH T1B381EC073908C0D10FF647F549240797EB4AC19B5B20DD9FB8AEC0904F7619A6AF92C9
- MD5 SHA1 SHA512 TLSH