2589[.]zip | Triage™

resource	yara_rule
static1/unpack001/GnySoft.dll	vmprotect

resource
unpack001/GnySoft.dll

2589.zip

SHA256 d5448084b38eb03359787cfaa22e8b2654eeb097233824a558b61c59140bcbf8
MD5 5b987f25a58ae0b34b7e345600124c1e
SHA1 3a7bf00fbd91868a65a9e5dc5102a61bf3324cdf
SHA512 9cc07935f4100249fc710bc3a4dcaed4e951b13bd905f4ef07dde3a869deda9e47f7448cc5ff1f547e2dc722bf0deba0931b4a588c9d7ab83134adfe97ea6627
SSDEEP 196608:yh4vnsfoEEyoqQzvfIsrH5bztVQ7r0hrL5WUhQMTWweT7Yejoa:c4vnsoEjgvAsr5tVQn0rL5rCwegOoa
TLSH
T101A633E288FD9436F9BF8FB18FE57A94F88CDA61F9E4A013F797134498814181DA7021
MD5 SHA1 SHA512 SSDEEP TLSH

Data/NPC_us.tbl

SHA256 ed38a2c80835859053c206a785f6075a0b3016ab9227ae35dfa737e59e79292a
MD5 1258993499e49a2223002251d3bf9bc3
SHA1 bbe2b792858fe6a2fc907a024d86d1be98afd39a
SHA512 558d5b0009d05d0a9008e3c4accb14fcc3b07948ef2f0522f7f3f66a6cac83e0377fe45b177e9e98df32dff29f6ce4710e400360f3b20ac6acfab93f09db29ef
SSDEEP 1536:IkyNpIK4RkI75PKkMnDsRoITjgQguto1E0CpTL/1/SPwP2GHOSpQLYSt5dykUDl:I93L4rPK1YpHZg1TAhKrK0T5dy9
TLSH
T1F4830221F4CA95F5FB729F6C52FB0EA29A0647D43BA50E651320C8DA39A15DC0C1B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Data/Quest_Menu_us.tbl

SHA256 ab7186c2bcee878e270a52eb42c7ab011c89914d30a41a3b98462b63fade09e0
MD5 93b0dc47e42bd74f78146fcd55298222
SHA1 48ea05e659d0359c3fff794ea656fe0a917d5df8
SHA512 2224c71b3a6af1d96cadef7796b527e7c30cd236375b26a2ca6dbb46ac53a7e87c013292a3318725bfc19c833dbc82c2308a04baddbfdece53ce6926d170df5d
SSDEEP 3072:KaUvZI++OhUVnJaz4uLnimiUUdeLuR8/fGTv7Oc:Wph8BuDiE4cN/fGTvSc
TLSH
T114C312D26D7511AD225A83D73A35C6BE088B7C01424A38594216DF18E87FF1D5EF0BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Data/Quest_Talk_us.tbl

SHA256 7b7fdf14df067a7ba5a457e82687ea7e8344d6ddee0948f469f7a44323d7969e
MD5 a72ee2f8207481999823c67cc2c614c0
SHA1 dfb7f926dae34832e8849b45d49facc3be17c2d4
SHA512 fb49651dcb9d9e5ee4dc4e21b7dca2c5d80974b4e3684f751a896399c37d13233a90d8a71cd5d584b53099563ee15ecc13bfa78d23b43ed01c55a93dc66dabac
SSDEEP 49152:4t5lFopL5FCoVoRsdGTfpdCuKZpAS/h07RibF1v:4tQDC4CTfpcLAsW7gJ
TLSH
T1267533EB4CF1E99A4A957B91DFA88831F89DD46AFEE4C30B6760C7805654001BE5FC38
MD5 SHA1 SHA512 SSDEEP TLSH

Data/warpinfo.tbl

SHA256 a50338dde6cb75ed4db93d9e69df07c661df0a38aaa5cab84b41c270ee73aee3
MD5 86c1a547786e7c9e791aa4204757086c
SHA1 9b58190ea40f72b6b148aa621a9729899d97e1c4
SHA512 631346e0b6bd713e4721da5f368a8b2439ede98ce463dc4f7aa737431dc3e5f20e0b454673e0eefbddba086ad36da51c4859963e47217d485d8631d3978efdd9
SSDEEP 768:8plqt6kbPcX1Uu5NhY7PyKrKjQRDP3zehpz8wx39ELAFhkL/:8plExb0X6SNhIsc7zMxkAFhkL/
TLSH
T1CCF2F1DA34828E754E2C2F9523A6B514D67C4EFD6E2F4632E78C0DFC9055F408463C5A
MD5 SHA1 SHA512 SSDEEP TLSH

GnySoft.dll

IMPHASH d5f47e8f675aebed304332fc09d3992c
SHA256 70735f15abe2e7427d054351dfc890d476785b5e07d599a645f6ccb3cc82f47d
MD5 48ab35a5b1c0c6b55b8da9a099af9bcf
SHA1 1d8559effe1637f4b0c18728d5e868972d8f49b0
SHA512 584490e4bc967709bc837755b5d761ea1d92638de330c271efb1ad9e1b2039b4168eaa37f2d2c8ccde7aeb9ef718744b0c5f10b2ffe1fe8c548a1b44a039d989
SSDEEP 98304:VojJFy3r+b7K7J65Et2yeDd+/EEWwLdXFS1yqQQ09H8Aq1L+zSF+Dtf:6jPir0+7JXtfaUZfoyJQMcDl++Fs
TLSH
T1F056232322555C08E0AAC579C692FEA433F74F19CA41D83AA0FE7AC8E5F95D2D3135D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7135348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

917KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.siktirg

Size

Virtual Size

34B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

214KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

GnySoft/UIF/re_genie_sub.gny

SHA256 e33511c642dc815f9b720adfbc2461fa88f6d8b2b9ac5dd53feca3fe777fa09c
MD5 f6f4e965c628d527b7d4421a9474fe61
SHA1 5b93ea5a3c0ed17b0ee24de626b8c3b5619af36a
SHA512 3a38311d5b5071b97e995b9d0593c3ee55edb8e738faf30a60444ee7f7ce2910cd33d5080c80f783a08c52e191836aaca13404b2a88af796147197023f9157ad
SSDEEP 3072:/+idFIQ2SJlNW0ty47LObz6tjZmO7+PsLpA8g3AQBl6diRV+Yd:2Y/NrttObIsvkLhkAQRf
TLSH
T1CCD3123D2CB4A0335412067E1DC2938CED5C4EFA1DBA7B1793062D1B7A699D35183DBA
MD5 SHA1 SHA512 SSDEEP TLSH

UI/mykogenie.dxt

SHA256 b8a44805066a0d034eb6137765aafb107e87c43be959a07de7b0f83117ab080b
MD5 7aa3c0f85cdd0d181d91dc6993512c21
SHA1 4ae115e71c859410ee9f37f490ee5f19caec7321
SHA512 91f142279e6ca657f536ffe2f7486fb178a5ac0bc9e10759dab6fa771a73b4f7409be2297bbe21aa8d5ae160536feabe1d561d32e946748ff4ba5406b6eaf3e7
SSDEEP 6144:38JZmdrTbplS/0/n60c4y+9VRhFahPYY+kbMjDoe+VR:38JZ8HrS/0/n60c9aNwp+0Mj30
TLSH
T14B5549799614D31DF6143AB4CE70F3FE849A8D24D81D682338E8BFABB170796650C17A
MD5 SHA1 SHA512 SSDEEP TLSH

UI/re_training.uif

SHA256 24acd7b1cd585d7535f0413ab0c656a0a4e67194a22cbc55c880d34bc5e98681
MD5 c7a46a31c6cab56b419c4b8e0e83770d
SHA1 9e140270b4cbe3c3da0f135ea8e52eb114848c46
SHA512 37944a53d6314044af0ff8c2f81de1fb784b6d1e5a92e54b297cf47722d8144c040624dd930b799998dda015c037a4f978804ea375ada93abc278b877a456d7b
TLSH
T129510989FB359E22CC186E7D0492EBA11775F216250C372777B0BA2D3E6E0142C57465
MD5 SHA1 SHA512 TLSH

Zones/moradon_xmas.NaviMesh

SHA256 c345c3a834deb859c5cfeba8a1203ac1a42c971e38436020c61cccde9b61f7cf
MD5 8852a8877824d3f2a72a6bc68186dce7
SHA1 f8f8253e4c95017f2b4c2fe67a4975f79ca7806f
SHA512 36d14687ea2f9f978960ba160a726b18c738e1a4b72b48690e857bdf017c1066d4511fd5fca9ebc8a34f6bfb55a3077e0d9254ab4819c529bac54b96906b75e1
SSDEEP 6144:TIgF/QBJ66kaD6EV4ZRVX0rEmbEnPP+G//+/mO3P+PGHv+G+OWeo/HXkUQbkaE00:MgF/KWA6E2ZbO2
TLSH
T183F6F403FDD61F3BE99B0B7860A3D257026EC2853786D28B1F969C24B18977125C72ED
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.dxt

SHA256 ad5b9f0996ac55c4dd97efceba3138a28ca710d6a6ed9b37fc7e1ffea96a0ff8
MD5 192d683c263c77768a2c9cdcf5215c2f
SHA1 6f8f99a215e6ff17c9291d3a7274ffbce588e4cb
SHA512 922e56b59a5de55b4e9be2ef2bcfd43e5fcc354b62e36f001bcf79af0ce90793b4921d83f5408e0c41c7d8629654d156ad7ed1c2ff6df413983e74b08d11ea00
SSDEEP 6144:i8m6jix3HMzhb+WIQk3LoiiaFsmnri1uTxAX01R8WrQGWDE8qeI:i8m6i3s4d3LdriATxA4CIyon
TLSH
T12774AFB7326A6771F2E0F6F36F8123048BF181011AAEB8353A79F350763D6FA9415259
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.ens

SHA256 b76875c50ef704dbbf7f02c982445971d1bbd61aebe2e4b28ddc58a1d66317d5
MD5 e4a1661c2c886ebb688dec494532431c
SHA1 a2ae2a7db83b33dc95396607258f553114c9183c
SHA512 efdcb76fb40482bc94e37eae3701e844bf22c7d74d53aef93ac7b6ae1c1094ba2f853875d2c66a49a7075ea8c69f5a348b786d6ee0fa711669279d04adaac22c
MD5 SHA1 SHA512

Zones/moradon_xmas.evtsub

SHA256 199840fc375b035f712cd6dc8171c3f0cc11b851d6fceb5785246b9309d62136
MD5 7bb14ad1043028ed8fd1941270e83631
SHA1 87007a5d77deb1db8f8f8c220cf8a90417df9f85
SHA512 b5ab8a0b8d46d417195690da01314d078a6e57cc4082d4e9fe42174e5ed1599e99d205086b71e0e4975e30aea426a3b6cae26024a2a564ee9636ac594e6635c4
TLSH
T12B21CC4C1DAA141EF14402F812C74CF4E3DD747B7D75CB0DA910F2C617A41682618A33
MD5 SHA1 SHA512 TLSH

Zones/moradon_xmas.flag

SHA256 19b5a4a14102a01fb95bcc23bcd2ef97639a0133fcd4232fd13d989a4c53c325
MD5 70a2356da4a72134b013d5c626d5814a
SHA1 9f2c3a766e859bb7b94d0ba307c5cb4b0a1903b0
SHA512 baedce06179bb30b4cde801f8db4564e4d500cd321c26307e32343cb81ee1ea40a3aadbfa80c5f3a6d56514404c02bd91e114f739a8355b1296860acec6f091d
SSDEEP 48:4cScL3BZCGMpqLWljAGDT+/Ha/dF3yscl0fG3+/CNK4ncwFETO/ucfB7E7P:xepNNDT+/6/b9clic+4KdaqO/51W
TLSH
T1C7E17CA12B1EB432E4B1B33DD64A7E8F5EB8FEB300D106B7779151A72550DA08471E1D
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.gev

SHA256 8a7966949091cc2cdd4579653e1bc557f28baca6c1da194b83309553b4eea776
MD5 e6f9d6f10d0e19471146cd6fac790c0e
SHA1 d5525ebd731c83e5524399e0cbda3d1593ad308e
SHA512 eade4f28eb7f160f71440733b8a7db9e7a9b7d2925cf2db4f7c5c5f4d13ff5a6b5b4c18a541ab482fddef27c8e17f91bd68e2686c38a805fadde5e9af8626027
TLSH
T118B00224534A34C2EC337D3186A5AF28079FEA660C114356359257D03F5A905C481823
MD5 SHA1 SHA512 TLSH

Zones/moradon_xmas.gfo

SHA256 3642c13a8b081a0eb13b24728c593381dbe83a6f4815e6923cf608e6caab2aa7
MD5 58d6bec3608c68cdb9eec62275addb55
SHA1 626c2a5a9f27ea4fc0e8b231e4dc5abd0dcd555d
SHA512 de13fd74d85200413e781f0856dfc62dbced718067bb6b1c62ac779c060fcd7b9dd8628ecd641487bc06e791a563dc55e3a3def736c3657387e7209869c5de02
TLSH
T15101B643572890ABD92D507642530E029FB1AF3009F4A6777EAF91ACEDDC6C84F828D3
MD5 SHA1 SHA512 TLSH

Zones/moradon_xmas.glo

SHA256 d2dfeb841cf627c9e5ad0d367ed45810689c4d5fd23ba87052cbedbcb40f5ad2
MD5 f3d32b4bd88c2abf501d108596fe193b
SHA1 dd7fefd7710fced5b2f70ec7bc1fc75840f092b6
SHA512 c280bf6221fc4e89d5252204cc68ef1c2d915c9b38afae2e5f0e4b32b9417166aefe9b28b41902338eeca8a577c4cac947ade79c84a43a2fbb76d7e235ae132a
TLSH
T12CE012266895AE8CC070337F01F3CF80F415C01D45AEED37C2A9451C5CC9BDD9913102
MD5 SHA1 SHA512 TLSH

Zones/moradon_xmas.gmd

SHA256 130192c04686342eabc7d6aa2444bb8a24cb1c008244081aa33ef2198f0ec934
MD5 70190bbc7a0899e785623ccf31d144e9
SHA1 3ca797b7bf1e1e7833b9dc6241f314a60288771c
SHA512 4d392b8a0979159985f71a0f4b073cef5500cea6cfb8c8097fc40915f29841f5ab4259648e7363164fa54ae8ce2c7d700d9f1571e74384ba860cc288e36bb9b2
MD5 SHA1 SHA512

Zones/moradon_xmas.gtd

SHA256 37c4299f0f2b7caa3c6cafdc200a9f0031733f6a39473964899425f16d29e312
MD5 90d13487780c25fae305a9928c9826ab
SHA1 b019d48afaf8493c4d6247619b2c2aaab95d9314
SHA512 a1aaa86e19317ba3c62264be2a7e5e89e8a3461d0ac9cbeb6ab5212e743529557b32aa306f68d5f33768c7bb18e2a16da8c9c6f1e39508a70986c66662580b87
SSDEEP 1536:pIRbi9R3ID2dAEOFS1Sn9QMC1hztXylAJ+iG5LYepLjb99IYFLX9YgLO6/t32DYh:psoI2rl8Q3+A8iG5ce9bnIYIgJt35lV
TLSH
T1242430143177889FC738BAB4B9866F86D7D0F1E249635D2396773A9D8E93B0DBA00074
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.gtd.bak_patch

SHA256 68d2f879186aeb1200e237edb15db185fd53a51069077d6db480fc7413985ab7
MD5 a903450d828b8b79c92df7d600c3d904
SHA1 c6c36d0cd5028ec17c9da00a836df918f8bacc21
SHA512 678946047b5d264ee7d2dc530825abafb7769cb62ccbfe5f6419bb34617563ef03eef9b6535f80e8cd55de4d291498cf8ded441c82f2c426a3933bf114e39961
SSDEEP 1536:pIRbi9R3ID2dAEOFS1Sn9QMC1hztXylAJ+iG5LYepLjb99IYFLX9YgLO6/tJd2d1:psoI2rl8Q3+A8iG5ce9bnIYIgJtHYLV
TLSH
T14824411431B7889FC738BA74B9866F86D7D0F1E248635D2396773A9D8E97B0DBA00074
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.n3m

SHA256 86d7dcd86a8b11a1bf2da8371b6238e399cbbc15ea00aba3bcdd27cede8c357d
MD5 904f1ee5a92e2bb2caebba7d20e85089
SHA1 92d401cb9996b07769c8c701455810bc5f4caebf
SHA512 b7e4d7e0b7dff30941f94001583d55e2750e12913a7997f5fc4bcb975b507e499870ff953446443dbf47260e54512ce10a4836cded6b74f193bbfaa71afff540
MD5 SHA1 SHA512

Zones/moradon_xmas.ofx

SHA256 83af98e9f8f6f4604e7c6a4a0e60817550958e8c10bf2d341028f5fbdf1c0d1b
MD5 afca611cb6c591b8d56adaf17d0853b0
SHA1 2b6b938088b325bfe24506b6b93194d1b0d11121
SHA512 dd3055aac4deb7e7fd4389aaeaeaea15d204db30c72e76450b0ba52061ea03c83ed6adae904c2fb03702d4430429f1eab1bd50880323b0817d15c28919be3712
TLSH
T1DBF08C4381120569E5319E7FA9BBCC77519149C4FCC280D14911CBACEC5EEF9CAD57B1
MD5 SHA1 SHA512 TLSH

Zones/moradon_xmas.opd

SHA256 1425aecc92c7646eb06f2b172e82db17f3a026de5e44660d747b02f38cc12063
MD5 a7d9bc1072e7a13c516fac302c2d78cc
SHA1 6f7414c6179281912c8d1983d18b6954354eab8a
SHA512 7e47a582950815fa9870d4dc22128ae401f426fd18425039334588e30be570a7595cdd64a2e6c7a4d38ca0fba4a50fe8d97bab1047c351376467cbbaf760775e
SSDEEP 98304:f8xlcqj1l45ppRGPnuvjkTN8TEnM0NUAGhrXmkgwJR2ppX5:f8xlcK45ppRGl8w9Uu5
TLSH
T11E163A24B914641BC0667B7B84E74D5AD2F8C4495B3E67376778E4CEECDC6C20E882CA
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.opdext

SHA256 974de355a4b6bf5aaaf9e4144976fc359e05cd6c2ff54eb88ad2068f68279ef8
MD5 31b97711fad5922af83269d4a635ab86
SHA1 11486fb93f8f91b60ee05f00018a107b5e7cd121
SHA512 1e74d124cc91bc3a7c8cc02463d6096e69b5a1182a0f260965c56c3e646884045867ac9f7990cd62ab3850b0c25316377117ef0e14f2acd62415098d52c11894
SSDEEP 384:8wvOARK2sqRQ1151515161Q1515151+1515151/1J1y19zW+KW+dMW+zWW+cW+xK:8wvOARK2sqQ9qdQqA4
TLSH
T14293E9653BC18B39C993A536D6EF0BAD4371E809648D770381E8F411AEC7DA11FA3768
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.opdsub

SHA256 3a71bff527064d416e3ad8b507999e2a509ccebe8ef5f8b525c7a8ba1240e156
MD5 445aecd63949487c06b2cf8a9bd25b0f
SHA1 00a5a4e115b3c79e908485620970f73122158360
SHA512 f3aab65a267c188041c6e95de53e3ed2797582950c884b83eb5f331c2ad1dcb93dce7fd06e1794704c593d3d9030a9b87109b0a0425a391b3ff3af58a41bd830
SSDEEP 6:A42p+KPKKQ2p+f3fhlXKw2p++jDLFdlf2p+f38pOWXdlf2p+Tl/Al/KKQ2p++jUl:A4lZlXzvl+lflp8flTl/AlEl+g/J
TLSH
T1521292438512098CE937DE7F957BCC7781918984F9C140E24410CA98ACAEFF9C396B72
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.tct

SHA256 1982db75498afebdafaa59bed755c495c5e671b6a9effa155592119d061dab27
MD5 2fd4abf71f68be053b9d925e5efffcba
SHA1 4de53c77c167deb26d47340c988619f32eb59230
SHA512 502ff6b9bed80e19693eda196107a651553acb81ff7b28be01085ff18c2e95ffdf45dcf042b8b2004e39c2b79cb3b0495741d3c0be0f25e6d0347ce6249d729b
SSDEEP 1536:OLRcHHHHH/iAnmvHo7O6aM3Qt3eRBQHUpDV82jrnvh2HaXHyHHgVY7HHHx/6uH2N:OLRiV82jdQ1DwSqtefz0Z41Odryzg
TLSH
T1A5E426FFEC4D149C2884F76AECD801B9669CD4B09A318A7EDFCA4364B652465FF1128C
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.tlt

SHA256 88ef58b289ccd71b4497b715f42230086807a5f4d4f5499ca26b7e9ffc50671d
MD5 5951a1a5e8c3a9232250dd6b9294681b
SHA1 65fce6f34ba9cd6624ecf95b7ad409793aefe0e9
SHA512 68bacaee8afd8e3bc4d2088137a08d600aa29d835f53ad7c72fc3d0b0ac790d683e4873e57ea2ae12f9b1d5470fef2cde2035c471394cf8912641e317545fc0c
SSDEEP 24:np9Xa1lWoTlXoKZdP99LUyxQqlJhN+emsjVDPDaE+DwUXegue9aCOb3nTDeObGjY:nzWlWoxlZp99LVHlb6
TLSH
T13A65BD22AA4904F6E41DA776A5C939EB54CB7B5403F908AA9F59432C0F6BD44C8FFF10
MD5 SHA1 SHA512 SSDEEP TLSH

Zones/moradon_xmas.wal

SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Zones/moradon_xmas.wap

SHA256 7c9fa136d4413fa6173637e883b6998d32e1d675f88cddff9dcbcf331820f4b8
MD5 33cdeccccebe80329f1fdbee7f5874cb
SHA1 3da89ee273be13437e7ecf760f3fbd4dc0e8d1fe
SHA512 991294f43425a5b80f8a5907ca7cdbb611401282585a58bb415077005428e3b4c0f661fc07ba5c45f627bd8bdcb172389ce2fda461c029b837abc70f0abbea20
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

2589.zip

Data/NPC_us.tbl

Data/Quest_Menu_us.tbl

Data/Quest_Talk_us.tbl

Data/warpinfo.tbl

GnySoft.dll

dbghelp

kernel32

user32

gdi32

advapi32

shell32

crypt32

ws2_32

discord_game_sdk

iphlpapi

gdiplus

wtsapi32

generic

GnySoft/UIF/re_genie_sub.gny

UI/mykogenie.dxt

UI/re_training.uif

Zones/moradon_xmas.NaviMesh

Zones/moradon_xmas.dxt

Zones/moradon_xmas.ens

Zones/moradon_xmas.evtsub

Zones/moradon_xmas.flag

Zones/moradon_xmas.gev

Zones/moradon_xmas.gfo

Zones/moradon_xmas.glo

Zones/moradon_xmas.gmd

Zones/moradon_xmas.gtd

Zones/moradon_xmas.gtd.bak_patch

Zones/moradon_xmas.n3m

Zones/moradon_xmas.ofx

Zones/moradon_xmas.opd

Zones/moradon_xmas.opdext

Zones/moradon_xmas.opdsub

Zones/moradon_xmas.tct

Zones/moradon_xmas.tlt

Zones/moradon_xmas.wal

Zones/moradon_xmas.wap