assistant[.]zip | Triage™

resource	yara_rule
static1/unpack001/cports.exe	Nirsoft

resource
unpack001/cports.exe

resource	yara_rule
static1/unpack001/dependencies/ViGEmBusX/virtualGamepadPoe2.exe	upx

resource
unpack001/dependencies/ViGEmBusX/ViGEmWrapper.dll
unpack002/nefarius.vigemclient.dll
unpack001/dependencies/ViGEmBusX/_virtualGamepadPoe2.exe
unpack001/dependencies/ViGEmBusX/virtualGamepadPoe2.exe
unpack001/dependencies/ggpxeditor/GgpXeditUI.exe
unpack001/dependencies/overlay/overlayapp.exe
unpack001/dependencies/selfpatch/PatchGGPX.exe
unpack001/dependencies/tradebot/BuyBot.exe
unpack001/main.exe

resource
unpack001/cports.exe
unpack001/dependencies/ggpxeditor/oo2core.dll

assistant.zip

SHA256 2711dd8d2a49681886f9e770e1d7685ec41a63e4f92aca57234cb4e5fffcc40b
MD5 81b63a5f5e574ec3edaa0ecb641969bf
SHA1 62cd23a6d6a65e1c314faa488e8fedb6e9732a3d
SHA512 094b2f0498667926ac5879bb623816691b0d7b41a24b5d1f988ae834cdbcefa51e4f1715e5dcecfb840604cb93c016b1493057ffe983a1b4a3a2ba879138f521
SSDEEP 196608:gXZRyNLxbyW1KR83YlkEzj38GpWCH1gBB/vShrAYBzybtB92Vlu8fhsaPPAFy:gL+1ja8Ylkij3ivSdAkVQGAg
TLSH
T161A633E9E215F8A9E09F8A7CC89F716F02DD0541DE91B68BDD9500FE402909B27D13BB
MD5 SHA1 SHA512 SSDEEP TLSH

KeyListController.txt

SHA256 8266da096acb1a56f11124b93d12b9e4c604939f93e908817d3866313f3a1999
MD5 25f8606d1de6a1745665876366de51ad
SHA1 552accaa641a619f1470776f2e00801e06418ffe
SHA512 6acc33daceb6cec045dbd855e8b4ee3689fc92c3a042fb5f10f820ea451957e54c5108fe45141e93de839fcd30602a22c3ce8efc7cbb21ffa447a084f5dd4a22
TLSH
T1CEF0F6486F0840359BB9E0A475711E15DF6CC39192B53C5838B231C85FF299F686C789
MD5 SHA1 SHA512 TLSH

THREAD_AUTOPOT.AHK

SHA256 28ec6c90ea8843b059e9d8d723be806973fc690e9e609bd1e40c85fff774ec48
MD5 250e2ea75a53210b274579b33e20c4ad
SHA1 807d8b014fd510696eaa4f51150459cbf4173967
SHA512 a7dd6a959536b6eae4ad20f195c29ad3d67e16385b8511c4c022b29e0d99c0f08b7d8b781f024c828c28eeecb5085396c9053b471c54ba9e4307784d1fa12115
SSDEEP 384:H1Ae2zpFe78T8/8j8ZnYdYjYfYNSt8uY+YvkTYvk7YvkXv8SYvkTYvk7YvkXRY+Z:VAe2zpFe78T8/8j8pYdYjYfYot8uY+Yu
TLSH
T16C528BA1B29C475F07597B3A1CB3260FA91DC17AD33441FEFA4E2199E0E22165109FBE
MD5 SHA1 SHA512 SSDEEP TLSH

THREAD_CHARGED_STAFF.AHK

SHA256 be50ace28c3df811008be8652a760d57aeba81d87dc99cf210f14cf2370a81ee
MD5 db965f18aba194fba91ac97768183245
SHA1 1212e06e7a5844e5064927292de80c57cdcc71c4
SHA512 f6f439b5da2045299a57fc40b481e0b63b8f28a4a1aef6c9a4e4b7663a9df0a73f92f5ab4198b77c13b3024b9370f3493b36a99582a1f9aa31f31e52be76a42b
TLSH
T14401CB81306E455F07053B7A3E77120FBE0CC4A9522C82DCB59E2D6CA991B2A246DFE8
MD5 SHA1 SHA512 TLSH

THREAD_CUSTOM_1.AHK

SHA256 8f81d04b3cf1a0e46f3e154f51886944d13d66b50a9f86cf955f52e8c0a4d266
MD5 3481bce1e20a4e4bbcf7993a4f6afd78
SHA1 12e01e556cd50c7a771423be1a1f714793274c7e
SHA512 9274fab82f28d26d3104a1328870bee93a7824dfebbb137764327fe57a689e7d40a27ccc572d53e9e6e10341b55e6a879c71456c6490fb03d753b7d50a2023e5
TLSH
T1EFE0F14340BE006FD32035BA7AB1560F7C0DC895932D02ECF49E26B85861F6D1537F84
MD5 SHA1 SHA512 TLSH

THREAD_CUSTOM_2.AHK

SHA256 8f81d04b3cf1a0e46f3e154f51886944d13d66b50a9f86cf955f52e8c0a4d266
MD5 3481bce1e20a4e4bbcf7993a4f6afd78
SHA1 12e01e556cd50c7a771423be1a1f714793274c7e
SHA512 9274fab82f28d26d3104a1328870bee93a7824dfebbb137764327fe57a689e7d40a27ccc572d53e9e6e10341b55e6a879c71456c6490fb03d753b7d50a2023e5
TLSH
T1EFE0F14340BE006FD32035BA7AB1560F7C0DC895932D02ECF49E26B85861F6D1537F84
MD5 SHA1 SHA512 TLSH

THREAD_CUSTOM_3.AHK

SHA256 8f81d04b3cf1a0e46f3e154f51886944d13d66b50a9f86cf955f52e8c0a4d266
MD5 3481bce1e20a4e4bbcf7993a4f6afd78
SHA1 12e01e556cd50c7a771423be1a1f714793274c7e
SHA512 9274fab82f28d26d3104a1328870bee93a7824dfebbb137764327fe57a689e7d40a27ccc572d53e9e6e10341b55e6a879c71456c6490fb03d753b7d50a2023e5
TLSH
T1EFE0F14340BE006FD32035BA7AB1560F7C0DC895932D02ECF49E26B85861F6D1537F84
MD5 SHA1 SHA512 TLSH

THREAD_CUSTOM_4.AHK

SHA256 8f81d04b3cf1a0e46f3e154f51886944d13d66b50a9f86cf955f52e8c0a4d266
MD5 3481bce1e20a4e4bbcf7993a4f6afd78
SHA1 12e01e556cd50c7a771423be1a1f714793274c7e
SHA512 9274fab82f28d26d3104a1328870bee93a7824dfebbb137764327fe57a689e7d40a27ccc572d53e9e6e10341b55e6a879c71456c6490fb03d753b7d50a2023e5
TLSH
T1EFE0F14340BE006FD32035BA7AB1560F7C0DC895932D02ECF49E26B85861F6D1537F84
MD5 SHA1 SHA512 TLSH

THREAD_DEBUG.AHK

SHA256 63a205f54e23177501322b46373d4381fca93a1736f5c751b6a3d358593bea74
MD5 02e0222f6e94223feb4ed2b7389f4e80
SHA1 3655a8b5adde05168fcb52ddcb428cc09165aa19
SHA512 435a4575e4c1917f31f68e6f86b4293366c79dc33b5d3d0d0d8816b97ec064a77ad74e3ab4300a937721d221cfacb0cfecac2f03f4093cf98012a47757a81bef
TLSH
T118118E220069581AEE37B4367E46160EFE170407165D1EA4BC9E21992FB25595225F38
MD5 SHA1 SHA512 TLSH

THREAD_KEYSTATE.AHK

SHA256 d02eb514c26d4a292da98e7e151300c1251c7b451955745fae1ecd59c7f3df75
MD5 ac858a4213fd8ea2f55e28a947ee25ae
SHA1 9ca3c874c0e7b503dbfe5cbe3939f8b1d54a4d17
SHA512 8b3fe4d8b4e1d4fdbc437af1d083b623eab3da5414fb5ac1c651d1311f3872fa0e1ddd63c6da6986eec48d7c4199c9bed2ac83a840c09585ac014146fd091844
TLSH
T13921AC294115081F163332356C0F262FF536F99B2289449EF5AF29D88F71A251936F66
MD5 SHA1 SHA512 TLSH

config.ini

SHA256 31e6d3079ba0295d9f03fac26322c0cbcb96b4fcbfe2092b2dab430cbe8c6035
MD5 1c40309ee2233cea7b87ed6541807a4c
SHA1 ae855a7d72d9b1ed76dc7d8003955af4c8ea3773
SHA512 1ff1758f62c5a7c6467390575b26f5c927a33ab6792f2897c27a61e688bd0ab338a7c2e32be518c0a554c1565e5756213b3cc5f6e7e71ea67263f05bfc880f0b
TLSH
T15B01F1230745A16F7236744602A957D1C3E1B0BE07F6B494222CCC3EB8D8C5D681C178
MD5 SHA1 SHA512 TLSH

cports.exe

IMPHASH 8070873eb376ae42da6d67ccb058fcb3
SHA256 a82c70fe52f0142b4f72340aefe2a4f54c55cf352e8a042274802f43a9c3c19a
MD5 996b2a9ad2af67fbf9629e86a42597c2
SHA1 14f47a3b1fc82806540c5139b37d2f2a834dcd60
SHA512 47892c4d65871d45c12aaa8a889b2be2d2a87b1a12494a5fa7a35baecf36be72a0103a9e643b0ba77f6805624d3e1be15d5228196a99d0ab24bb11b24d38ab3a
SSDEEP 3072:9tOcwHdlKCt4fasynGmluPVV5ro2EGixRHFNc4q3cxxUw3yL8YXI/1:9CspGGmu9XrGhFNcRuyw1
TLSH
T1EC146D46A7B410E5D5ABC976CDB38723EBB178944734865F5370DABA0F23310BE19326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

19:d6:f2:be:96:38:95:2b:f4:42:02:b6:bb:15:9c:a8:2f:1c:fc:39:28:0b:20:e6:3e:a6:e3:dd:52:8a:3e:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Apr 10, 2018

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

1c:80:11:99:66:9c:04:50:89:5f:a4:98:ad:36:59:42:be:75:8d:65

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Apr 10, 2018

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2014 - Sep 12, 2019

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 30, 2016

Timespan

Mar 30, 2016 - Jun 30, 2019

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

0

Major OS version

4

Entry point

130640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Projects\VS2005\cports\x64\Release\cports.pdb

msvcrt

_initterm __getmainargs _acmdln exit _cexit _exit _c_exit _XcptFilter __C_specific_handler _onexit _mbschr __setusermatherr strcmp malloc free modf _stricmp strtoul _memicmp _strcmpi strchr _purecall strlen _ultoa _commode _fmode __set_app_type strrchr memcpy memcmp strncmp atoi strcpy ??2@YAPEAX_K@Z ??3@YAXPEAX@Z memset strncat sprintf __dllonexit qsort strcat _strlwr _itoa _atoi64 _mbsicmp _errno fopen fread fprintf ferror ftell fclose

ws2_32

WSASetLastError closesocket gethostbyaddr WSAAsyncSelect connect inet_addr WSAGetLastError htons WSAStartup getservbyport WSACleanup

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

CreateToolbarEx ImageList_SetImageCount ImageList_Create ImageList_AddMasked ImageList_ReplaceIcon ord17 ImageList_Add ord6

kernel32

CreateEventA GetThreadSelectorEntry GetProcessHeap GetCurrentThread HeapFree UnmapViewOfFile DeviceIoControl ResumeThread ReadProcessMemory GetCurrentProcess ExitProcess DeleteFileA GetCurrentProcessId WinExec GetStdHandle DuplicateHandle GetPrivateProfileIntA EnumResourceNamesA WritePrivateProfileStringA WriteFile GetDateFormatA LoadResource LoadLibraryExA ReadFile GetWindowsDirectoryA GetTempFileNameA FormatMessageA lstrcpyA GetNumberFormatA GetModuleFileNameA LocalFree GetLocaleInfoA GetTempPathA MapViewOfFile TerminateProcess GetStartupInfoA GetPrivateProfileStringA CreateThread OpenProcess CloseHandle FileTimeToLocalFileTime WideCharToMultiByte CompareFileTime Sleep GetProcAddress GetModuleHandleA GetFileAttributesA GetTickCount GetSystemTimeAsFileTime InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FreeLibrary FileTimeToSystemTime LoadLibraryA GlobalAlloc CreateFileA GetFileSize GlobalLock FindResourceA LockResource GlobalUnlock GetVersionExA GetTimeFormatA SetFilePointer lstrlenA GetLastError

user32

SetForegroundWindow WindowFromPoint SetTimer RegisterWindowMessageA PostQuitMessage TrackPopupMenu DrawTextExA SetCapture IsDialogMessageA TranslateMessage KillTimer PostMessageA GetKeyState DispatchMessageA ReleaseCapture GetMessageA MessageBeep UpdateWindow GetSysColor LoadMenuA GetMenuItemInfoA DestroyWindow EnumChildWindows CreateDialogParamA DestroyMenu GetDlgCtrlID DialogBoxParamA LoadStringA ModifyMenuA LoadImageA MapWindowPoints GetCursorPos GetSysColorBrush ShowWindow ChildWindowFromPoint SetCursor LoadCursorA SendMessageA GetWindowPlacement GetSystemMetrics SetWindowPos BeginPaint GetWindowTextLengthA GetWindow GetClientRect SetDlgItemTextA DrawFrameControl GetDlgItemTextA SetWindowTextA SendDlgItemMessageA DeferWindowPos GetWindowRect GetDlgItemInt EndDialog GetDlgItem EndPaint CreateWindowExA InvalidateRect SetDlgItemInt SetMenu LoadAcceleratorsA DefWindowProcA TranslateAcceleratorA MessageBoxA RegisterClassA IsWindowVisible EnumWindows GetWindowThreadProcessId GetWindowTextA LoadIconA FindWindowA DestroyIcon GetWindowLongA SetWindowLongA BeginDeferWindowPos EndDeferWindowPos SetFocus GetMenu MoveWindow OpenClipboard EmptyClipboard GetDC GetParent ScreenToClient CheckMenuItem EnableMenuItem ReleaseDC GetClassNameA GetMenuItemCount GetSubMenu CloseClipboard GetMenuStringA CheckMenuRadioItem SetClipboardData EnableWindow

gdi32

GetDeviceCaps SetTextColor CreateFontIndirectA SetBkMode DeleteObject GetTextExtentPoint32A SetBkColor SelectObject

comdlg32

FindTextA GetSaveFileNameA ChooseFontA

advapi32

RegDeleteKeyA

shell32

Shell_NotifyIconA ShellExecuteExA ShellExecuteA ExtractIconExA

dependencies/ViGEmBusX/ViGEmWrapper.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9828b5e6c7a5c8e3d684d8c048e14b0cc567d07f2a649b926e31126a4d6d45db
MD5 9053d4747feb614cbe4947d80231f791
SHA1 ec7e0487e22942951d949826ac907080056d8108
SHA512 bd787e9bf503007a3fb70a7756af9e4e2aaee9c0852f06430aaa1354bd26889fbe0a7589bc35d168ec70b89a04ae7388ab75f37aca6af2eeb60e49ef47748e07
SSDEEP 768:ALj+IdyImAbdvgQwh4Krih4VbZ8Ik//PcqQ33ScQIvMl83:4xHEhprA4VbZMPK3iuAA
TLSH
T12C13E00A1BF9A5A5DC699F3EEAF3AE510330E716040ED7CC1CD8BDE94512B65062237E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

49774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Data\Code\GitHub\Mine\AHK-ViGEm-Bus\C#\ViGEmWrapper\ViGEmWrapper\obj\Debug\ViGEmWrapper.pdb

nefarius.vigemclient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cbf1f86c73f7d5b392d24c7c7a334bd3a792afdbd8d77b8700594aa101a08273
MD5 5601d806bb87b52d9601abdd20a415fa
SHA1 d8f7d0510acc3003f53b608dca1c6e78e1509262
SHA512 576c78d47c9afb7e4c7e367aad46779a225bddbf322f35b90f2571c3be16ffa2f247962e5c74bf237839b19fc3d9f52e9cbaa9e1e95c67c3c81544c8d7b20256
SSDEEP 1536:g+8AQmHzOeY6SF1lEpOQrSQi5gSF1UvbFtibG9M6j:tTdY6SF1OpOQrS5gSF1OJtibGmY
TLSH
T13E736D04B3D946AACC7E5239987253A6D271FA24EB5367CF9B90021F1F3B3D2A135613
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

79118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\vigem-net\ViGEmClient\obj\Release\Nefarius.ViGEmClient.pdb

dependencies/ViGEmBusX/_virtualGamepadPoe2.exe

IMPHASH 48e414e431433a62713440d22abb8343
SHA256 9f18e298b1b8d1409cd6e40b7211947d4d05c9ebe1c14f7245cb5b771e8162fd
MD5 9ad3834a4801be413ff1380d6bd0e027
SHA1 448180cf4a9cd134c221fb745ec4907a3be160a8
SHA512 bac23ea2be9139c7d326b50c5041fe5c603d80febcd248d5e8a95ebbcab92fbd6418b59f62b64cac0d62ddf985da53ccce3aecaf8b072d3d6f1cbbe9e7fd1f94
SSDEEP 12288:XKPjdhAUJFWgl6riAcbMuJl2/ZEkXHP3KEUU3:6Jhjrl6EDlCEuKEUU3
TLSH
T119E4E0D69E404464CB2DDBF556B6DE3B93BBDEE56F32E0009006B7A26B331CD2172906
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

1487762

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

dependencies/ViGEmBusX/virtualGamepadPoe2.exe

SHA256 cff1a09cdaf01e35464653556cc7caa2ce26a3e13cda9f68e9d73acc3f973478
MD5 fcd255276844c319ce19e8d50025242f
SHA1 46d044faa0ea6f2bce67fa877423cf3e0c588b90
SHA512 9ea3623fe0107022ec631029ed79302fd1c10d1558b0f877f43634536c81306c1f27a0bb5a9ce6453a3ea2581c3f71f0b325b189f15e788c7923881498dd6944
SSDEEP 12288:5U62YZ6GRhLOiIuLhtZsKo4RUiD4xYmFnjye0WWBxEaf:5UgnnPLr1/RUiDwYm4ZPf
TLSH
T123E4EFDA8E444560CB5CEBF455B6DA7A43BFEEE52B32E5089016FB766B330CD2531802
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

1507312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dependencies/ggpxeditor/GgpXeditUI.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 5fd2d0ab763573430230b353ce7e60bf5e8935b1b29eed7ef12a9c1c8a7adcf5
MD5 87f0271301a4a08c4aa11dfb20be72ce
SHA1 5aa06ec6e03596254237774efac94068c9198ec1
SHA512 40040227b20be03056257aa9fb698b830f03b4c37ceec4897597b05a24bc9ebc1ae2bdc22d8582277dd162376d94ee1911ebca8f7f42c6575faca0b8bddf5d80
SSDEEP 98304:n93zeoa88zCRERpm0/Mw0o2PZ0vuHspGZ0:n93z1a88zCRERpm0/Mw0lZEuHspl
TLSH
T19DF5F702A6E04916F2BB5B3C99B54920E773B9871831CE1E36AD144D0BFBB40BC65F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

dependencies/ggpxeditor/oo2core.dll

IMPHASH 83a0a46015dfbd6ccaaa56f598f9f353
SHA256 4758c7901cbd68df1848b7afed48c1975ad59b509886c21b87c0e91d717446b5
MD5 a555e1cd5870d1fd7c385d0ea695aa2a
SHA1 28b7f7ffe991a02bde8e62fe0da92e2e259348f3
SHA512 3404ab5a635a5980683d73265190647399e4ea062ba6a3f0abab59c2b69e503abfc4af2942291ce2e4e829fa079cfa73000cf8cd88c7489963b59ba3b28d1c39
SSDEEP 12288:VdAwMfEGT/SOqa61m1qdjOsLI4iVcwIBBih5m5JQgzFf/3FL5icE//rekCye:VdAwMfEGT/SBdkUBBihM5JQgzd346kC1
TLSH
T1E3D47C92A2D151ECE2A78139CBABA213F3B13859032459F352B8DE752F4BED0637D705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1d:26:db:36:6f:b8:bc:20:10:1d:d1:f9:bc:ce:c9:58:d2:83:01:81:7a:54:66:2e:a4:62:84:4c:92:41:74:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=aianlinb,ST=Taiwan,C=TW,1.2.840.113549.1.9.1=#0c1569616e6c696e303131306740676d61696c2e636f6d

Chains

Feb 12, 2024

CN=aianlinb,ST=Taiwan,C=TW,1.2.840.113549.1.9.1=#0c1569616e6c696e303131306740676d61696c2e636f6d

Subject

CN=aianlinb,ST=Taiwan,C=TW,1.2.840.113549.1.9.1=#0c1569616e6c696e303131306740676d61696c2e636f6d

Serial Number

5d:f0:f6:8f:4b:77:09:d6:72:f5:be:74:64:86:6d:27:54:97:25:cf

Issuer

CN=aianlinb,ST=Taiwan,C=TW,1.2.840.113549.1.9.1=#0c1569616e6c696e303131306740676d61696c2e636f6d

Timespan

Apr 23, 2021 - Jan 1, 2100

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

533940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

v:\devel\projects\oodle2\cdepbuild\win64_release_dll\oo2core_9_win64.pdb

OodleCore_Plugin_DisplayAssertion_Default OodleCore_Plugin_Free_Default OodleCore_Plugin_Free_None OodleCore_Plugin_MallocAligned_Default OodleCore_Plugin_MallocAligned_None OodleCore_Plugin_Printf_Default OodleCore_Plugin_Printf_Verbose OodleCore_Plugin_RunJob_Default OodleCore_Plugin_WaitJob_Default OodleCore_Plugins_SetAllocators OodleCore_Plugins_SetAssertion OodleCore_Plugins_SetJobSystem OodleCore_Plugins_SetJobSystemAndCount OodleCore_Plugins_SetPrintf OodleKraken_Decode_Headerless OodleLZDecoder_Create OodleLZDecoder_DecodeSome OodleLZDecoder_Destroy OodleLZDecoder_MakeValidCircularWindowSize OodleLZDecoder_MemorySizeNeeded OodleLZDecoder_Reset OodleLZLegacyVTable_InstallToCore OodleLZ_CheckSeekTableCRCs OodleLZ_Compress OodleLZ_CompressOptions_GetDefault OodleLZ_CompressOptions_Validate OodleLZ_CompressionLevel_GetName OodleLZ_Compressor_GetName OodleLZ_CreateSeekTable OodleLZ_Decompress OodleLZ_FillSeekTable OodleLZ_FindSeekEntry OodleLZ_FreeSeekTable OodleLZ_GetAllChunksCompressor OodleLZ_GetChunkCompressor OodleLZ_GetCompressScratchMemBound OodleLZ_GetCompressScratchMemBoundEx OodleLZ_GetCompressedBufferSizeNeeded OodleLZ_GetCompressedStepForRawStep OodleLZ_GetDecodeBufferSize OodleLZ_GetFirstChunkCompressor OodleLZ_GetInPlaceDecodeBufferSize OodleLZ_GetNumSeekChunks OodleLZ_GetSeekEntryPackedPos OodleLZ_GetSeekTableMemorySizeNeeded OodleLZ_Jobify_GetName OodleLZ_MakeSeekChunkLen OodleLZ_ThreadPhased_BlockDecoderMemorySizeNeeded Oodle_CheckVersion Oodle_GetConfigValues Oodle_LogHeader Oodle_SetConfigValues Oodle_SetUsageWarnings

dependencies/includes/_FUNCTIONS.AHK

SHA256 0a140ea4898d3361a2df0f3bc7717b7a8f70455bfe73ae93bd4d004f30a014f2
MD5 4870a98df113a3b285d209858d530030
SHA1 fc51046728ac510f4d74113285b515291157d3ab
SHA512 ff140a352e8f0a25a2bdb269a7c37c2e42797f4cc308e533dc362c2538db62981fecd42a4472a149ce385adf4a9b8724bb83a12b2bbb35e4a50445ce47d5a98e
SSDEEP 96:HSWv0Gsf7gxnLXZEFMkJ/jkWljw5jdqT6A8TaoCD9deaNtSOtoe+K0aktwx:tEYnDWFMk1jkWljw3qGA8TaoCD9deaN9
TLSH
T171C131267157522FA3B6533CAB93254EFF0B81BB1119466CFFAC45102FB859A8134FC5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/includes/_INCLUDES_GLOBAL

SHA256 e1e6ffbbbf999b806e659ebf2f277c709972db6dda4c700de5e1cb2e8e647caf
MD5 45cca67afbe85e5e80aa48c08e633ca0
SHA1 c38896298d9e441a79c02a7c91537841366e4750
SHA512 e5be6e5c3ab9196faf865b0eccb8d23d0058f1f96851de91a02e7518daaa33fae6e7827612bcc255ab54f51d5379b6ac3b892377515d1ffdcde726fedf948b1c
TLSH
T1F3C080115D5955981054FB3774D13D1FF6C745180D1725342DB1469C1300319084D93D
MD5 SHA1 SHA512 TLSH

dependencies/includes/_INCLUDES_THREAD

SHA256 d4b5a6fea7a457bedbe51816e5a2d0eaa023f9685d0497f41bcd4d17af7d034f
MD5 6cf14d942b7df696ec1d1ec4f9e2fac6
SHA1 41b5d8e3c3a3cd2287da3f83750711e4b6d9f907
SHA512 473853de7752ea30c8ce5985a4ba81b6860a6af748f8412b9c751cb71b1af6b9a72c1d8134ab1b5a9f69d713a77d6e797194005befb27382425f7d9b00d5d2d5
TLSH
T129411A13171FCE1BC831D59D9541F86AFA45A007B50EC2CE7B8F5C86A7B6A0F294CAC5
MD5 SHA1 SHA512 TLSH

dependencies/media/always_enemy_hp.png

SHA256 1ade922657f61269b838980b5d512be67ba468efd11ae3d9b82f0257089133d1
MD5 bf4f1c3c029e34a769cd1de018e652bb
SHA1 d9a824c5aab56d8ba99a7a291e98b4999414354b
SHA512 d60d88171016f48709e8d8943b907da4bed25ca4c242d8b5046e375c77f5ff37f5f26eb3dcd423efc03a75eeb444c5dd5d1d1637dfca8481d66c8f8e152453a1
SSDEEP 96:bSVo7FPWlknGbOJdYuTjm9AHNf6Gf9cNG0gLjGwpFHoFiHHCHEgFHQjWE7exP/sV:bS67FAknWOiAWybFIFiHi16exslpQ8NV
TLSH
T11FB1191DED116E209A06AD01ADF9818A8B771F40D793B081FDD5A91B0CA15BACE1DDC6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/always_enemy_hp_a.png

SHA256 4d211124be24c124b20dffb2095d7e3668a5b97ffc53a105eac6793db54235ef
MD5 bb69e5d95035adb56a2d03341f9a3d66
SHA1 90c92d11e898574372f488ec36905801e5e67ffa
SHA512 bec23bfcd9add3ece1ae4c176f7fe20e130f13a7c6d31508ffa02c2ba5859111bcec0f0d25450869ac0ecd3eca1405b644f7d3554b34a19207ae37e5be3947c7
SSDEEP 96:bSOo7FPWlknGbOJdQuvEwm9AHNf6GfNcNG0gLjGwpFHoFiHHwuHEgnuHFljWcvnm:bSf7FAknWOkAeybFIFiHQu+ldnc2z49r
TLSH
T1B2B13C5EFA105C28A50BBEC46AF95107A67B0F44AF42E081FCD4FA570DA02B9CC8DED1
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/always_enemy_hp_acn.png

SHA256 a5e7539c3ae151ea6a8d491be558a06dbc90a2a86cfb8e17e96f7f0d22f0fb22
MD5 45dff9623ec43bcd41a8aee752f5bcc5
SHA1 7be718714f49f1a2e883a944d8446056e5159e38
SHA512 d9698dd759693349980b7f04c27537f58d6330a35547ab07127474fbe96282b146f8c2a302f98318b44c48be9bca8fa2616e2561a946bba4b16fe28da8d776f5
SSDEEP 96:bSAo7FPWlknGbOJdK+uuU0Hm9AHNfq2fdcNG0gLjGwpFHoFiHHJDgHEgcxgH4L0m:bSF7FAknWO0A+ybFIFiHann8F0+qJAx
TLSH
T1DDA11A0DFA22AE00498E6E40AFFD6143537B1F909BA38045FEDAB41B1C605BDCD5D6CA
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/always_enemy_hpcn.png

SHA256 5e438f31a450ebc359d9d58a742f28dcab7633910a1d24d1cc80c0f747e7296a
MD5 86d6ccbe45713937b2e9406d6874763c
SHA1 6703a618d93df9f8ff2296a5cb2d4e14557013f0
SHA512 a6a13f05346fbc51c1ca8f16761745ca98a019a1d90f7839edf38b93501e675b8d5482c3bd00ad54248c4ee7e94e5b1096ec2a493479a6250b3276f725c677cd
SSDEEP 96:bSNo7FPWlknGbOJdmu/Om9AHNfq2fwqcNG0gLjGwpFHoFiHHrnHEgKHYP0W4TobZ:bSi7FAknWOhAeybFIFiHjalouwhhXQE1
TLSH
T161A11B1EFA12EC104A5EBA415AF9A08256370FE09F43F084FDDBD82F5961178CC1E6C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/close.png

SHA256 311c9588cc4b5a194eea97e804086510ef6e538664dafed4de0299a6c8e5a2cc
MD5 b225d613564860b8020ba9248a1b6f2b
SHA1 58920e3e1e43454a46346c13eb2a34443c75dfc9
SHA512 7cd15e1040463d9377e44f5348eb16ef971bd64ff838c4ed789ad79d25822446c59c92072e61c25f99dd74cd654d6d28a10e96981f82fd15991e1e703ea7fe32
SSDEEP 96:GSzo7FPWlknGbOJluJFf9APNf3La5wCFoHo+HNJHEg8HORL7aRj2rzS0p1V+f1:GS07FAknWJfUBI+tJsuBsjGzS0p1V+d
TLSH
T1B991E88CFE01AD10AE96DA817DF97202657B0F95C6C1D045ADDAD90B19B10BDEC0EEC6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/close_altered.png

SHA256 a3247d15a447ed24bb57fbb7a4b392fa2ad51b90770a5981596b592e67eaab54
MD5 dc0278a2dbec73b60385115efae75942
SHA1 2efb54520767c9b378db53cbd430f35d9d726488
SHA512 04544caac0d7fc00e9061938ca68e1d76bb9c970edc712ee8d76b098ba66602c2241d30ed5c804ccae99b54cd06ea086fae250fad5b086f1718fb638750e6c6d
SSDEEP 96:GSzo7FPWlknGbOJVuNVf9APNf3La5wCFoHo+HhHEg4H8L7OTJw7PPSdxr4h:GS07FAknWRfUBI+BoSC0PP/
TLSH
T12C91E90DF911EC105E9AEE856BFE119266770F8487C1E044BECAE8175C611A9DC0EAC3
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/close_alteredcn.png

SHA256 b47681c127bf51b0876f572df6fb1033c61c04a657aad3b9f6ae85dd3892cb58
MD5 a2f23c93acaf4efe8b80f80ca9e011ba
SHA1 294e399745c5dc7dcfae018d9aed74eb214f989a
SHA512 c47674728181d169f3f30044c21bd4450eec31e92a85970842d1e2b1031c5f48bb40f93b196a1daecb1bbb10f3e6dd01a3aa7636ab30a4f6039cb654e049ce7e
SSDEEP 96:GSFo7FPWlknGbOJFuqoV9APNfJrda5wCOmyoHo+HDlHEgvHklL7HK4fN6/ZC6NLY:GSK7FAknWpVUiI+jl/E9OONSZ7anZ
TLSH
T180A11C0CF9635C115E5BFA853AB8A06365B75B919BD1E0057DE6F80B4D110BCC90E7CB
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/closecn.png

SHA256 56111dba74c2a7acdbab7e64bd4296ed47dc31fb3925e593841f5262a1928a55
MD5 58e52405b506b9c4a9419951f2368db5
SHA1 0f4ced263cd2cdaaa014d1fd19865f9fc3e11062
SHA512 f8afc0cb468f95cd64ef9a2b767f0b0cccb906e22ea07089916f5d214d1772c7a809e34066cbad2430caeae073c369e8706a4710277862d43bfb8fc3fb0e571b
SSDEEP 96:GSFo7FPWlknGbOJ3uto9APNfJrda5wCOmyoHo+H0sHEgDHH7L7p3GidleZcG1Etp:GSK7FAknWyUiI+UsTnnVnscs9rrgWTyb
TLSH
T1EBA13C09F5029C150A56EF83BEF4B043BA7B4BD086C3D455BEC6A91B48111FDC84E6CE
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/dashboard.png

SHA256 2291e9bf682b926f4371aca9b7d4815310c7d3b8101dd9b422409866dddcfdaf
MD5 f1a6c0781998ad02080b4ed2b06c6d71
SHA1 f93e121a5d2e0c0383f2d7f9dd62fc6e2d85e9e5
SHA512 ae9d9a716cda78a20b9e0c24d1cdc27d4e8367d9cdcf3d5b3c0618abb718ff62fd2421bcecfee94ca6f528799723170298bc1793147e9df739c017c8ce209cb4
SSDEEP 96:bSTo7FPWlknGbOJdgu2hm9AHNfiSFdVSefxTdcNG0gLjGwpFHoFiHHSHEgyH+jWV:bSU7FAknWOPAVGybFIFiHyCdtTcfWqv8
TLSH
T180A1EA0DBE11DD008E5EFD4099F85192A6BF8F909B82A014FCD9AD1F0E640B9CD5DAE7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/dashboard_a.png

SHA256 90cf8e95d28635e0ea2b02ce682012db0b9945417ed773e3c715af5f9713e957
MD5 d545cb109a66ba7b560da1b11a58a3df
SHA1 e38fd91ef195660ea99048bf25cf6aee8e5923b0
SHA512 209b21d8c210998f77a2684f1101f56b4fd99bdf9d98c8146649d916684df1a94a3ad4ae515cc690a3717e8055f6fc2c1890f68b5fd9de48b96471cdc2aa40b7
SSDEEP 96:bS2o7FPWlknGbOJdKt1uOIm9AHNfiSFdVSef2TdcNG0gLjGwpFHoFiHHnelHEgLq:bSX7FAknWOKttAVvybFIFiHHelblw5LL
TLSH
T14BA10B0DF922ED105E0ABE00BAF61097A67F4F909BC2A048FDD4BA1F0D9117ADD4E9D1
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/dc.png

SHA256 ab7ffa7d24dfa8fa4f76980a1d7a21536d5485d12fbbf5c5fb95c9fff4fecfb0
MD5 1d749b98836bc8e47cead02bde8a4437
SHA1 63c03d40cf45869b9707c98421047638c59f3eef
SHA512 fd02ffabd1685a8e18634137d853529ca00e8737561ef98fd10ef321ddec17bd2ba707d45b75d89476cc3d84d46833660e4b13ab36d67d196d60602f0e77c096
SSDEEP 96:OSco7F8knmWIJp/7VSHoa5HH5Jlj970a1dQWIeCWean/BZXCZlGtbIRMnMj:OSR7F8knKkIa559HCWl/BZXwlrRMn2
TLSH
T120918C84FE01AC504541EE427E9913A78BBBCB814B027581FECCC52B08723F1D99CAC3
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/dc_altered.png

SHA256 ff3560d14de7dd9bfb657e3a57cca8d066910e082af7abb8cfd19364ba0009d5
MD5 cbbcc1ad191ecf357baaf1cb01bf4bce
SHA1 4a443e9824b62fb0a850a2ca967776c1310a54ca
SHA512 9d3156cdf520ed3e324473a4fb9a8d7528cf8cbe4274388af38f3fd5d676654fcce402cd7ba860d947cab6121c523d46790c4d6a85f2087dd2f332f6750af2e9
SSDEEP 96:OSLo7F8knmWIJ95t/2A4Hoa5HCNHHZ2fPlC63ptt5Is1K8XGQPjHpXhc9:OS87F8knJIa5Y85S3kHq
TLSH
T1FAA16C55DD12FC00209AFF0536E5E3D3AA770F566B41E180FDDDE83688602B6D9586C0
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/dock_settings.png

SHA256 5207ca0008f3d40b47ced66bf52f69d90b6dba807f5f7fbd0f217f89d9ef20bb
MD5 9ea37f27a9bfe742bc3c02c980df11cd
SHA1 eef234921735aecf1345fc974866558bd74e647a
SHA512 82f5a9ea0dc64106d2438d609961f12b00fe7b7718eb5ffde9928c2801db2dcc8f395abe6273fa7c56ee94b12234c76243dbddd8380c5988a1b8f00010d28e1a
TLSH
T107419506FDA17C00AA1EFE4929F612471A375BD08F426464ECDDCA63AD600FBCD19AC3
MD5 SHA1 SHA512 TLSH

dependencies/media/dock_settings_a.png

SHA256 bddf811ff15cc6b6e6085bc43ce2939da83bd283c0a9353fb5393e1c725b0c2c
MD5 c5b36f7dd63ca3392b0233885bb092ad
SHA1 36f1de19ff9fe54e0c65a750cbb7cb0d3e58f95d
SHA512 0b91d14224f2870debc7844992fa5fd9d3bbc504a26c11a03478a8b0c21ae8914cdfa4a27e1093b18e94049054ff5fd642a781f606bc26335d2bd8dafd9c4d97
TLSH
T12C51D826FC46AC01E60CFE4819FD2793933B6BD09B91D859FC985A531C104B5DD2D9C7
MD5 SHA1 SHA512 TLSH

dependencies/media/exit.png

SHA256 5e1c4232b3f6f2974d6c64c82bc8248b6b9693062b2d2e0d1fade51aeac70342
MD5 e2c3de4958bc38d7d8863f436cc33336
SHA1 90090a90b46f774fe8b2861b5fae523f2776e9a5
SHA512 664d93c2223b383e832221a7bd63bb1fcd2d0843adfe25513686b82caee7186d0a24f3f0b6934d5bc42fdefbd687987e79a321fb0c74f64f84ba0ea5b7485abe
SSDEEP 96:GSzo7FPWlknGbOJVubk19APNf3La5wCFoHo+H9THEgmHwjL7YoGfp3TI1qh4bxD4:GS07FAknWK1UBI+dT2QvOp3TIJF4
TLSH
T1C891E948FE01AC105EC9EF852EF8B19366B79B9587C2E045FED5950A0D5117DDC0E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/exit.wav

SHA256 cc1d96be17ae2ba54c48960ac41cd5b0eb114129dfe99a1a87f8ee47642cf836
MD5 0cd6c260ef1faf1efc252a25613bf31e
SHA1 b72f26d445da21615ac853806fe5eed701fe88c5
SHA512 2bf8cd7a30cfb8af1e5cea61e9451092282e976353f66a1aacd96e64b48b3eb7851e56fae717f7d3b0170ae24c49d596f60085d5b84848a1c642ab6a9080df28
SSDEEP 1536:0bLPdgHA45KujwqS9Fa/VUM/R3mOUv6KTao14oRpUC82z4a/uyVJOuFfS8l0wjVf:0bLPiH1UuyClPY55dXPVUC6C02sx
TLSH
T111C48482B341DA41C84B2F398566DFF95337AE46BF0BA3633050BE2B7D725C22A551C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/exit_altered.png

SHA256 3e44e2e5eee75a4cec8574110ac21a3bb6d4c9147e8a7e85d8d1bb7b8fefe910
MD5 3f59cc6f003e6e12ccb739ce5f68f4f3
SHA1 d2e1169337d6d3384307aacac41e67aeba2ee673
SHA512 2ed0d05d2638d02df0381e11977e06dcaed9542d6234ad30b5d2368570c6774d99e1ae8b859addb46981b67f60d93790b6c372d124629f10ffc833a79342237f
SSDEEP 96:GSzo7FPWlknGbOJjuys9APNf3La5wCFoHo+HkHEg6H4L7NM7SsbaMxdJJaNaM:GS07FAknWXUBI+EK2OmnM/wB
TLSH
T1A291F70DF912AD405E45FE817EF87187657B8B8487C2E041FED1DC1B09A01BED84EAC2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/exit_alteredcn.png

SHA256 0a6c18d439e16888afdcdb44cf957ffc3a751eb1d66c42c7c7b6000749a0e6ee
MD5 f8a83ce9519cf5f2896fa8bd14e250f9
SHA1 543e919c892507260b45f5441cf39cae3f05cdac
SHA512 717ec9fe0d96e3ead6670bbfdfc374d434e42aa5f5c0232bb4ca48c0fa2e5fa29ccb68ea9391dd53ab63ee9a468dd676d2c5e8f982412856dea59e410513ccc3
SSDEEP 96:GSFo7FPWlknGbOJ1ueZ9APNfJrda5wCOmrcoHo+HtcHEgPHe4L7vb/aFbo/Jr8s9:GSK7FAknWoUoI+Ncf+W3aF+JDNz
TLSH
T1D591E90DAD119D109E4AFE42AFF9B142267B0F91CBC2A185BDC5DC0758711B9CD4E5C2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/exitcn.png

SHA256 1b684497872cde349ed8674ee34331c0d3b4ce9f97686d75ad7087cde58e7c9f
MD5 93deedf4c783beb692e6c0419e5afcde
SHA1 070b6cdc11b1f2aaf9e12782ed3cd1fdafed2920
SHA512 3e06746530dbdf53eadea9703630b23c247dc54ac6ed87a712392270198c605765edb3e9552aea112fd9130027fb5440de6868e34f30c6ab2e8c8d8ab8de9535
SSDEEP 96:GSFo7FPWlknGbOJxulxm9APNfJrda5wCOmrcoHo+HAHEgsHTL7qI9E79U+kjtTAy:GSK7FAknWToUoI+g8f2I929ItTgo
TLSH
T1E491F91CFA21DD009E5AEB816EB560436E3B1FD18AD3E080EDC9A81749A21FDC80F5C3
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/gamepad_wnd.png

SHA256 295965a3d35b9d8123eb4555d05c303312526dcc01f548c3ff2fc01d28e5b9c8
MD5 0998493e571984a817f2f68a9bb084e0
SHA1 80d6bd2a25dad8e556c9333bdf28037f80ed0f3d
SHA512 7befa42a7f5edb237aed03b1cf0ac5239244d791e0762ca655783a2fc6a18a6a0738f18eefa2a51e47313c7f0d49101d1cbe60cdf9453351a5bd98af451f49bf
SSDEEP 384:78YnSjVUOcqExR4HR9KHGX4WIMsvcyk9FV:gYyjExR4x9KHG7yG
TLSH
T1D162CF55FD3038C0D4D5ED4A7ADD76F027FE07E1D2CAAE92BAE5415A6CC0006AD0C2E2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/ggpx_editor.png

SHA256 33ba3481dee5f566f3d660bd10df4f17de8b82329df5f9775410381ca42db3ab
MD5 ee7c7ceeb3faf71c61a104e0dbd1c836
SHA1 0b08d0e6302e070117851b3033288db81690cf05
SHA512 f69bd2168bdb455148a5cdc3aee481a10305b05208030680f19c02076a776d5ad8539640c47f7563ecb48ee9747f89469a2592e2d2ce9c25d98844d93481d2bd
SSDEEP 96:bSPo7FPWlknGbOJd4u5JjQm9AHNfiSFdVSefKTccNG0gLjGwpFHoFiHH8LHEg9Hc:bSA7FAknWOPjRAV0ybFIFiHytGqxW
TLSH
T14391084DFD02CD109E1DF945AAF8504367779FA0ABC2E048FED9A81B1CA10B6CD4D9C5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/ggpx_editor_a.png

SHA256 56116a371323c154858e5bc17c44319f43071c624ad4dc55f7f034e672d5944f
MD5 2b0520127abd5daf650de09bf00f4e14
SHA1 2097274c52cd9394f61ca4588b0e2256f39c7dbb
SHA512 f2ed972dbf8ceef0e3ab2828436673e0ba33653d4ff7416d3a5aefe395a7c6171b952c6d4f7b8e843297ea42cf4ab5b89e91cd4ddaed09605a1dc6c3553a4a8f
SSDEEP 96:bSMo7FPWlknGbOJdSupx5Lm9AHNfiSFdVSefdTccNG0gLjGwpFHoFiHHjHEgSH2b:bSh7FAknWOqAVTybFIFiHDCnO
TLSH
T13C91C60EBD12DD109E5DBA409EF82093A2775F90CB82D04DEDD5B80B2EA106ACD1D6C7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/kook.png

SHA256 e5766b76e34f69b1061ba989987374535d781978af03cfec8f33bbff3747672b
MD5 e94ee4b1e78a5862bac328aea515e6d1
SHA1 b7d4b82655ef0a42b6cdc677ba5c0d313a457a77
SHA512 e49f26b242e38e3f0e7b8b254895a1d80d795a1d07cf970c81d1ea0d97bee94314a268d877b3cb340a268e5f01fb4134f23cd837a595f2f81b19b9db5a0f1fbc
SSDEEP 384:zVUus30jfEQLHdq8yTBHalnsI/zMY88IGF4Q6G5AXML5MqTlGRBarofcYKK/+Wy8:hUugfO9BnOY8nxQ6j8L5TpEm2yzcb
TLSH
T11EB2E15228977506FE9B9ECA69AA8D30EE843DFFEC630740252133B24C5B323C060C5D
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/kook_a.png

SHA256 8fb52fdc03f1c3b4a60c868354d33f7be1c899bb67f6bedb330371c9dad0835a
MD5 ed87ca0e6bc29039572f58f8dab7632a
SHA1 bc75ee9bea233c3c1d4d677a565fca0b1c03ccab
SHA512 5d48faa948b1c4ce95378cbcfb828d7b80ef3cae9aed6ee6eafdf6357ab7b85c43ab0c679c4ae5d7f7879abf742aa01208d3e2ef8b000843447d3c65c1ce316e
SSDEEP 384:UrNnlRN2uECCgzFI1MwKs0o55bWclgZzwrWmx7vZ3UvHNK0BVRGMHjXHVCh:ENX/CgFI1MwKs155bWcyNwrZJuNrVRGJ
TLSH
T17992D09FD557EE485814DCC8ACB1B88906F2A560EB70840975C365A66F3687AF40E3CE
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/minimap.png

SHA256 0f880826ab442b4267ac1794fd42f6cabb515deef3aaf03b83d8855f0446882d
MD5 c6d794c577c43974544d8a0bdd23ed18
SHA1 44156fd156d713961eab08b78cee56dd998e7087
SHA512 41c6fe439430316b5e7275d993ace90f5158e22ece42ffc6285b14b43d2b9bf5e5075e179f3e4478b3a4de766ba945120d4813eaf3b4d34228a7e8a8f3d09d4d
TLSH
T185310AD05118C466A6A2C21E89606DE5EC995516E6FFC58FC200C735C72432CDD95E00
MD5 SHA1 SHA512 TLSH

dependencies/media/minimap_altered.png

SHA256 8eb17f7d3d0d3fe8a9cb1ce1ba2b2163ee0702d3256f0ec8f3d4bc0bfe08135e
MD5 24226837b9aea40e477b1f537ecdcdfb
SHA1 583bbc326cdd83371419cc25d5ed373bf9db9a6a
SHA512 73e80417fe06754c1178aacdf2ea50e274f8b2f423ad321e1538672ee9718f785f2b4469624ba3e700d8c9df74168e7360b0c65d19612b4b1550b565c47837e9
TLSH
T139312AC6926998511DE85715D48025D0340351EEC52E074DEC9EA46073A880DFA22EBA
MD5 SHA1 SHA512 TLSH

dependencies/media/minimap_alteredcn.png

SHA256 49b05c201de8fd6e64268a303fbf0e179f0e40c863cc96ec950a35e987974b72
MD5 f02fe3fb25dd638a08f6801610a2d050
SHA1 04bd0e46dd1cfa58259aae7f21026b6494ed5ebe
SHA512 9da985b78d412e82255ec9b843a0312fb8585066d43eff35976a30ca680a5ab398154ac9782e80b85ba1589f5d80afc0d59ec8bb882ddfabe449603222f06b96
SSDEEP 96:bSFo7FPWlknGbOJdcuxhm9AHNf1dfHcNG0gLjGwpFHoFiHHbqHEgBHWH0WrTBbOa:bSK7FAknWOKASybFIFiH7qx2zs1ASIqy
TLSH
T1C0A1D84DB9119E109A2AFD85BEF990C3263B5ED0DA819044EDD9D82709704F8CC6E6C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/minimapcn.png

SHA256 87d86311de19bce3e57e520d617dbbd84722404469e6414be59e1b803fec3b35
MD5 2b708b0a90180a81ff92cea3c34d02a4
SHA1 cf2ca67f5d92c773abf1bd9d960d76768bcd5d0d
SHA512 00efcae57578d25286e1a1ca922dcdd8c22923f2af182a4d4485134f73b23cb528cff1af3048e8c2be95bd91ea19952b78429f19ffbd60f7bda57fdf9f7708d1
SSDEEP 96:bSro7FPWlknGbOJdSuCTm9AHNfIIfHcNG0gLjGwpFHoFiHHtHEgZH+0WFt9P4u2J:bSc7FAknWOHASybFIFiHNpyF4vY5f4
TLSH
T169A1F80DE612AE106B1BFDC1EEF4918257335BD0DB839080BDD9EC5B18201B9DD2D9CA
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/notify.wav

SHA256 cefd091aec2cb3ddabaacbd529fa65a9af4df047303f9a9571d7ee21cb83e5b9
MD5 80c94c596e16453bac410773ceadadfb
SHA1 f8d1264a059f6ecaaf09af6e78432eb3673a056f
SHA512 ce13600759bcc1e0d288858abe7ad6c3d5d02d3c096e04bb7c533deea9c1b292b20ee9540f1f868c02847161c64079832f318871cd8bb251230543fe0aded5b8
SSDEEP 6144:PXtBht2bHAkF16nPOJQ5njlVArWIRs3WyKcKmYEQ:Eg2WPO1rWIRsmPcHU
TLSH
T1C1349E82F501A781C4CB2D76D063DAB587361E47AF071A751038F72378A35A3BE95ACE
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/overlay.png

SHA256 7f8c9922edf29f12a1e057a1533ed59be84d9d7400d1895125d08fca1cdbea2a
MD5 66ef137be1f18f8ad8b0a8ad28c54bb3
SHA1 637f224ea466264dc70c65dd81bbac182162458a
SHA512 f369d736a21499e082a37c8606ed9dfc11cf3a41fefab1b496df16f30d793ecddd38f6d2d15db143b66a53e46abc394ae74eb59536bfdf6d83bcee81b8047a1d
SSDEEP 96:bSyo7FPWlknGbOJdyuoSm9AHNfiSFdVSefKT5cNG0gLjGwpFHoFiHHvHEghHijWr:bSD7FAknWO4AVHybFIFiHPxaf9aAs
TLSH
T16BA1FA0EAD02EC108D1DBE81AEFD515267BB5FA45BC19014FDE4A90F0D615B6CE0DAD1
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/overlay_a.png

SHA256 76f000d068b8fdf892c483632137f6d59d2f393dc0fe1f8d50439d7dfb390c23
MD5 2d4d0810fdd67a5d89f42bcfb4b0b4df
SHA1 9b545d201c9f77bdced4046c69c61fc90d755b42
SHA512 fa35ba8424cc0f71a9f521c6d4ca5a16f0906ffb1326af061d1392e1f35a492d9d1c451544abfda460afc89462b6c8447439872052ed55c5b2896268f7281c66
SSDEEP 96:bSyo7FPWlknGbOJdouozm9AHNfiSFdVSefKT5cNG0gLjGwpFHoFiHHuUHEgoHbdv:bSD7FAknWO3AVHybFIFiHR4vt7ZuQR
TLSH
T183A1D60EFA02DD50DE0EBA40ABF85192977B1FC05782E008BDD9E91B1D708B6CD1CAC2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/pp.png

SHA256 62ff31014ef0763e7bb40ba77d052159d61a9fa0b06ac8e8390662bc8a8f7b18
MD5 b501654a158aaa2243c532ed01b135d6
SHA1 597adf9f143308503872517679eb698c5b90ea39
SHA512 e5c615064b420886c4809b0ed5911a938bccabd0ae9ae4b770f02e4a27273d8df8154e19451fe2f963edad8a4bdac0a04e4382fa5c3dc5dabcf75b065e3d314a
SSDEEP 96:SSKGo7FmWlknNJWqT4/nSHo64HzNGaikGpgOC2TlYOpFerwgA+Pp8YB8I9Rtg0HO:SSKH7Frkna8I64TnIT2hrwgH8YB8IJzO
TLSH
T1BEA16C0DDA02B881174FBD442CE260462F7B0FC0DF61A019ADD4EA835D62676DF4D5E7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/pp_altered.png

SHA256 591f7cabc9dbba8f5fa895d460bc9c9f2835adede59c88b316f1316c1938a6b8
MD5 bcebd645465a3f95ba92678358b2c538
SHA1 f1e226c9eb5958260ee22e1e64ee4f5c5b76706c
SHA512 96d4ff1307a3cc093b7473d121045c9c9f03a6f20a97d5078cad4cb76b720cc1dc80bf9f984e2c2cc55bf989799dd9e76585f24530a772d9436e61f22aebe732
SSDEEP 96:SSKGo7FmWlknNJrIju1E/bcHoBI+HzNGaikGpIWl5iJ9MlnvG/PYi2KHgNynExB:SSKH7FrkngC4cI++Tndi5iJWlvG5xHhg
TLSH
T1A6A15D087E0038214656E8525CDDF6DAAF1A2BE66E4151C92FC9DCCB1C711ABCB4EBD3
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/remove_delirium_fog.png

SHA256 68d2bb7d3a71e96494bba1889e2f34953ad1505c675d765ac51b804773c7da48
MD5 ac277b4d0ac78d17143d10f7b4042510
SHA1 7ab63905dcf100407e717132b62d59309c5f4039
SHA512 fd81336461b0b2c785feafef5747e1869a5f26b91ab96f960c5b2fe52b49b411f78b0c3f39d307d830394bcb53c0f07bbda69caed5cb6ed1a3d54ab94c5bd7ef
SSDEEP 96:bSMo7FPWlknGbOJdeucgm9AHNfh5fNcNG0gLjGwpFHoFiHHXzHEgJHefjWtw3PnX:bSh7FAknWOGAIybFIFiH3z5+Gguh2dJX
TLSH
T157A13E0D7E10AD105E9EAE40ADF86093673B4BC0DB91D081FEDDE50B25914B9CC1D6D7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/remove_delirium_fog_a.png

SHA256 162720f9de5c82036e8a14acd34585bbc577fa56f2914d042c3eb57124818251
MD5 61636c8159a5bceaeb0c6782666f52cf
SHA1 7db15e51f60594d86896dc47fdc66a2cc0c30c52
SHA512 bdc2303ffbc6c92c2e80d67af9bc67ab87227ff8de0cb275cb93eb0431c04e2dbf3e39bce21c9b2e557091ef3f32832342cebb7cdc27028cb84c807043ddae33
SSDEEP 96:bSPo7FPWlknGbOJdwuRlm9AHNfh5fQcNG0gLjGwpFHoFiHHrHEgrHpjWuQZE8MRJ:bSA7FAknWOiA1ybFIFiHL7um88SUBdwy
TLSH
T1E2A10B4CBD129D109E5AFE407AF950635A7F0B809B829004FFE6E8170D549FADD0D9D7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/remove_delirium_fog_acn.png

SHA256 386f1649eb8e2564244821a9e6db475a56fea256499ae0f3beaa3ab4971a821c
MD5 f885f86c90466110906fae87c896ca2d
SHA1 cfcef0d5b8f6075440b4bac240ef1403cc3a5bb8
SHA512 8c86b5421434a42d5f1ab5154a161ab3c88ac99830fed1616272c492922f40c7124aa232950617c355dfc57022c95b4172a9ac552681d94b8673fc8fb5f9c798
SSDEEP 96:bSZo7FPWlknGbOJdmu14m9AHNfq2fBcNG0gLjGwpFHoFiHHDDKHEgEHQDW0WCu2o:bSu7FAknWOtASybFIFiHjDK0wDA01O8e
TLSH
T166B12B09BD01AC50CA4DAD017AF95093973B0F80EBD2D044FDDAA8531C615BDCD1F6C5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/remove_delirium_fogcn.png

SHA256 f1ca991cb3ffeb0b6e9236df4976f565fc4fcd94a4bbc03cdeba0b2dc168fee6
MD5 ab23022916cc08f2859c0ea1906165a3
SHA1 d437373deadaf1151b623aa3a80ff6e7ac8fbe17
SHA512 e425ea163a36365197884e093d3fb48bd9a0a49bf82e726bebf96b7c4aa11cc7cf1ff2311cc453bff683f9d537417dfc1d1d410738eac0b11573cc62e5e6f058
SSDEEP 96:bSro7FPWlknGbOJd4uHqsm9AHNf2CfBcNG0gLjGwpFHoFiHHMHEg/uH40WNz1pGJ:bSc7FAknWODSAsybFIFiHsvuEzfGFfC0
TLSH
T185B10A1DFA239C509B1DB88A2DF8614666B75BD0C7836045FDD9A80B19601BCCF8E7CB
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/restore.png

SHA256 664629e252af0f96b79e46db8264bd343325d73e65c94a32b6d034a2c4a928c2
MD5 8805b0e6e1cfeb0c67eb70c4652c0365
SHA1 11aa8ab5bd7cc0e4e6cebcb0864f78c554a6eb03
SHA512 e48620a687d3776bdc274d51d06b0c4c0bef19cf07f08f0b0a9dd3d040b5983beddb23b49624d6d8338cab9902c28bcbd8c7cd3ec01ad8878772d2770464db51
SSDEEP 96:bSTo7FPWlknGbOJdSuf2Fm9AHNfY4fwcNG0gLjGwpFHoFiHHZHEgiHcjWet3omGj:bSU7FAknWO8EAPybFIFiH5yUSwzlZlF+
TLSH
T15BA1FA4DB903AC105A1FAE81BEEA618B677B5FC0DB81A044FCD9A80B4C94579CC0E6C7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/restore_altered.png

SHA256 575ca2bf796fdfccb484d753dd8f4abdd0af64e6cc61a9273485194061605486
MD5 91a79add583ab54ec91263331e51be2b
SHA1 da178b115ebe0d721cefaad2e04cd6fd5d4ffb57
SHA512 b8640916416de4e58f00721949cdcfcda606e041633f044e16b675a15c4cbb3e39e08f044bc0c6d9e2fe1a941be8b5f2eeb88d7dc512f2f3b42ad55dec92e6c0
SSDEEP 96:bSqo7FPWlknGbOJd+uHVkm9AHNfY4fXcNG0gLjGwpFHoFiHHBHEgPIHEjWMtgsqU:bSL7FAknWO13AEybFIFiHh/IOq5udvxJ
TLSH
T15BA1F85ABD03ED10AA0A6E44BEF690536BBB0BC1DB91A044FED9D90B0C614BDCD4D7C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/restore_alteredcn.png

SHA256 8ae7d15f87b7a703705538af06030ec1864e2621731cab67aa0707dab5c3b4d1
MD5 9a4943589f1450ff48eeb2e610102509
SHA1 f1e5159fc1e53ddffcf355eb58b432f628ac6275
SHA512 2b4af5bea49c1eaa5e79f22a33b96d47e706fb620f0d97fe6feb17640e93b7c37b6c57ec512d82fed65e3aa693ee0163e0a35599f59ea8c16c5cfacadf771740
SSDEEP 96:bSWo7FPWlknGbOJdYu4vm9AHNf1dfccNG0gLjGwpFHoFiHHgHEg6Hu0WtN/f6f5t:bS37FAknWOTApybFIFiHAqsN6hhx73vt
TLSH
T111A11709B921EC108A6DFE867FF55045A6374FD08B93E088FECAE6171C600B9CD5D6C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/restorecn.png

SHA256 3300915fa52a742ddea390699fc6d39d5d6ce6ef4b7337e11ffff19f62fc8e5e
MD5 a83870a4c4963114e8c2ae2a14f31523
SHA1 9ce34a34fde4ff4ebb1e8ec908f3a315705feea8
SHA512 fcee63aa8a46e802a6aa05a8a62e2310ccffb838423e799a6f12bd2a3ec8eeb6bf6fa24711cdb4948abe0c5f255e73ed1e3373de9b083a65ad5a0e72328df750
SSDEEP 96:bS8o7FPWlknGbOJdSug9m9AHNf1dfWcNG0gLjGwpFHoFiHHgHEgfH30WnGTFk6xK:bSx7FAknWOLATybFIFiHAvexEzpqVWcq
TLSH
T10EB13A0DFA23DD109A19BB89A6F5A1D3A6370FA097839045BCEA6D134D608F9CC0D5CB
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/save.png

SHA256 627cc8136d201646ef8491be98be59a6f237b85bcc20ee0cb50b7e0633be4bf4
MD5 82a631b6b495482b761a5ca35025f842
SHA1 ecabd0faafd2f1af125f14668c9c229ffa6a6000
SHA512 700fc89f40e495dfd70cb7578b203bb5e8e2e0854f5a635cb9b26dd8ecc3f56598f92f2f7074dc200589250e1b0a588f15bcc522e8417f24d2c0ab60773da411
SSDEEP 96:GSzo7FPWlknGbOJrus19APNf3La5wCFoHo+HkHEgMH0L7RpInxruE4CBmK3OzZnu:GS07FAknWwUBI+E8KtpIxN4yH3Oz5OiI
TLSH
T1E4912A0CAE01BC50AE96FA047DFA505355774FA58B82E000BDC6ED271CA22ADDC8E9C2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/save.wav

SHA256 589f859ebda41746629ba6c6accd47daf973781508c9ca8aa3c40180efb9e75c
MD5 3a38af61795d6a0b85801f4c5bcd3169
SHA1 9548886fe4b1a8acdccb993bbda9d2912248cc2e
SHA512 ba442f79c552d6838a0fc3e8603ccae3c4f61f83fa4267138a9f69f366057799f057ce8b3d53cc5ef35f1842da50894bebed9b9e29fc613ee4c4ea66ee951f93
SSDEEP 3072:EvNp87rDbTYHhaU5uu3LGRJtXqo08tpy/A1YmCCKt8tR5:ucbcHh55H7GRf3/6/qbCCK
TLSH
T13364BC80F341DA82C4473A79D256DBF9533ADE45AB4767232050FE373EB2E821AAD1C5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/save_altered.png

SHA256 01aa0d80816ea7059fcb5ae263662fbf902e67b8cd78b1b06e6e368156a8d72a
MD5 838c4b5bb5766b44663b897f6d2f062e
SHA1 581118614a2390e2456ccbbfd1096c05025ccf26
SHA512 6c214bf4c8eb9594ed04f65737d4d932e69e63f2d9b79534eb95824f3315c82113154018a1bcaf5ada12ab1c86a10973375396a1edcaff8a6e3b55249f520580
SSDEEP 96:GSzo7FPWlknGbOJpu6a+9APNf3La5wCFoHo+H0HEgypHbL7BNz7oivTtk96/E:GS07FAknWyUBI+U+nfsKq9t
TLSH
T1E0913B85FD019D405FA7FA486EFD60823A7B4B8187D2E160BEC5DD074D621E9EC4E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/save_alteredcn.png

SHA256 7e340f938d739d1035d773a455c7dcff0bfcdc47c6cfef5fbf5b52b521634b65
MD5 f00d3932f908102d4c03b15ede53dd62
SHA1 f704308cdb654a0b7fffa44259a03a36acee6d33
SHA512 cd4005d75b02c62accfebc132219ab1453c3e59cefeb70813dc14ddb19a6ff23f5814b9a83abcaf78a2ec60a1ba09b794574fc945ec67b9508a9fd45398defb3
SSDEEP 96:GSFo7FPWlknGbOJJuQc9APNfJrda5wCOm7oHo+HwKHEgXH14L7R97+w0xejGHpuH:GSK7FAknWnUBI+lHsAHpuYax
TLSH
T18C910B0CF902DE149D89F6C16DFA6046A97B5B80D2C1E016BDD6DA0B0D731BDDD1EAC2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/savecn.png

SHA256 0b87fb19bbdb3ac1427d40a12cd53e2d47b6f930a746a4b00f2456d1782e4c70
MD5 d82efcfc660356b38e46fc9506821cce
SHA1 0c12852f2f40bc798bf80a24a4a84d08b2525bef
SHA512 1da56e41f974575674c91ffac56e1193f8bbc426dcacfeb4fcbfd3e640a7a1417c423ed08acd065d1defde30ffca03b79d9cfbd8e417913d6dade0aac9543515
SSDEEP 96:GSFo7FPWlknGbOJNu3JVS9APNfJrda5wCOm7oHo+H52HEgv+HKsL7Uw3lT6+06Eq:GSK7FAknWtLSUBI+Z2f+qCQy6lSsKR
TLSH
T11591090DBD919D00DEA7FE42AEF961D25A7B1F80CAD2E0116ECA590B0C610FDC55D9C5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/tradebot.png

SHA256 535abd7750230d384ea5724b680a06a64d73c9b389cb9d3d0562acd3eee292b7
MD5 76c351ce88ae0d772810b7d80df49ca1
SHA1 8a9a0b3f3f505cef80e3b2b9b5c865d85fbbcd6c
SHA512 3e1112ad50aedbc961f255a534821c6896d5088d335f2cf0e12440a117426aab971548beb87c1c650264823c0a0c5fdfbddae21f70213b41710d525d93762ea0
SSDEEP 96:bSyo7FPWlknGbOJdxu1uXEOEm9AHNfiSFdVSefdTGcNG0gLjGwpFHoFiHHklHEgv:bSD7FAknWOxukxAVdybFIFiHElfClHfa
TLSH
T1BC91E80DAD13CC008E0EBE01BEF951A6A67B5FD096829049FEE9EA1F0DB1175CD0E9C1
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/tradebot_a.png

SHA256 c9599b925ca3e8f140d5f3b96e3bbed1ec8694dfab09ab1c449a8287f81fa53d
MD5 6386d08fa227d3a714579546982975ef
SHA1 8bb991215fbeff43c4a82a8e83584206bbc4d97d
SHA512 1df5aab19cf82ec2d13d91bb655a59266f63772477fc32bd62dc191b974b30c4ceba3ec040b892739a3675d7ac357b2009d9b13af7b80f0d2bb0961cfc7ba50c
SSDEEP 96:bSAo7FPWlknGbOJdgukngkm9AHNfiSFdVSefvTGcNG0gLjGwpFHoFiHH1HHEg8Rt:bSF7FAknWOog1AVHybFIFiH9MRkK/7Rp
TLSH
T1F391B61DB913DD005E1DBD416AF9509356BB5F90D742A004FDD6EA2B0DA08F5CE1DEC2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/virtualgamepad.png

SHA256 8679492c22161c55dccba1825926402a6c8c3bf74ba7a3cb64c90c362ee6d1b4
MD5 41b0bfe1b1738704cfc4a2b66b08d90c
SHA1 94de584dbe74e11b8abc040550bc56ab13748098
SHA512 723dc029369af2ef09d690c50ad03a17074107fcf5c016f8c0638c8fe98bde7502db3977d51a65fb9c2d6f68f2ef837147c8561eab41fd4176fa781167722da6
SSDEEP 96:bSAo7FPWlknGbOJdXxIuAtkpm9AHNfiSFdVSefvTYcNG0gLjGwpFHoFiHH7SHEg5:bSF7FAknWOmNAVlybFIFiHu8tAfbF
TLSH
T1C3A1D94DF912DD009E6DBA416EF89093DEB79F905B82A014BDD5E82B0C610B5CD0DAD7
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/virtualgamepad_altered.png

SHA256 b08c99982c6482e334bdb1dc375b6a7f73f871c116dbaddc83ae5c39ca292512
MD5 9f9633233ba7c0e92712c183b3145bd7
SHA1 3f7be002130e050fe1a5fd229c492063777314d6
SHA512 e987815d711b57dc760a8b16bae0d0756770f38840f50b5be0a60175ab3f1e9818006618b2ff968db9939f00ed9f0b726664fe32bf740e9e241336a4945f2e50
SSDEEP 96:bSAo7FPWlknGbOJdsuYZm9AHNfiSFdVSefxTYcNG0gLjGwpFHoFiHH9HEg6HbjWM:bSF7FAknWORAVjybFIFiHdqCDl8LUJ7Y
TLSH
T1CDA12B0DBE12AE008E19ED40ADF8909626B79FD05F52B044BDDAE11B1E600B6DD4E9C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout13.png

SHA256 a4db258a0c13e7d0942b815af280d982629984eec45266a4815424603e1dbfc2
MD5 ed26d458eb4189ffa5a6cdac55f54c7b
SHA1 87c192aee9f2bedff72398b1378946faf4604ef9
SHA512 84dcead54cde8bd55a498d6ffb25d5b214f7b381933bd899d62f4085581424b5b47bd742beb9bd57b2e893debd76ed13c0ef7bc990b6f329c485285b0b2e2327
SSDEEP 96:bSZCo7FPWlknGbOJdAuDehm9AHNfz3fncNG0gLjGwpFHoFiHH88HEgL2HbljWO5z:bSV7FAknWOXA+ybFIFiHc8K7HlOKWNhq
TLSH
T16E91F91DBA115C00759EAD409EF871A76B3B4FA09B519084FDDDA8171D901FECD0EACA
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout13_altered.png

SHA256 fba0a4e8249f86581e099fc403de1c1c3d79f93fa93064a2edc253f3d452a137
MD5 5605f50ce6f40fc8437da12230763f44
SHA1 85944a351f189d7fb4cf0e0f108459717060900b
SHA512 0f54d0d37c659bd69c00bc0b845b36e50cdc1e03f1fca58b0994770d7de7a792e816d6998179bec3f065b726cf2706e8758e628813264db640961b58ee54ae0c
SSDEEP 96:bSWo7FPWlknGbOJd6uBVVm9AHNfh5f+cNG0gLjGwpFHoFiHH8MHEg5WHTSjW6kl/:bS37FAknWOD+AnybFIFiHcMpWzuC6nTA
TLSH
T1E0A10A4DFA019D50491C7D40AEF990836B7B0FD0CB81D008FDE9A9171A51579DC2F6C6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout13_alteredcn.png

SHA256 4abe7e59f948bcd313222282bdad57c8e3622788ae7523ccb81c1a22b0b08a6b
MD5 10e6b58072c9b74079562b3e349aaeb7
SHA1 c3cde48c735389373b436d534cf15d0748eb3d4f
SHA512 43539415fef398f3bec4747700f42c070a692d37b5dde5a6bf4165f2f0a47a1142491bfaaff5366f430d354f0c71767c26c704f6155b8cfe5038ba4af186856a
SSDEEP 96:bSzo7FPWlknGbOJdOuL/m9AHNfohwxfwYcNG0gLjGwpFHoFiHHKHEgDHI0WDA4XO:bS07FAknWOUAuybFIFiHqTCBfH9b96Su
TLSH
T1E3A11B0EFA129C405B19FE857EFD21A3273F4F809AD19054FED958271960079CC6DACB
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout13cn.png

SHA256 b816bba09c1e8b1dbc7882b91474c8f09f81f7daca1dce38470ab88b610a7be7
MD5 1c288aae8c437c07f93e1e1dfd29b88d
SHA1 55a7e5969fdc039ea71ae9059728853f291cd17f
SHA512 aa0582c742c2fe7af486a7177ee055694c68450245fe4f39368ebf29d13052a7550f7659b484031aa7bcc2d737315380619b48357cd88509ad56f0ac78262056
SSDEEP 96:bSGEo7FPWlknGbOJdYuBvkm9AHNfohwxfHcNG0gLjGwpFHoFiHH8HEgJRHy0WzN8:bSGJ7FAknWOFtA6ybFIFiHc5R6NTTt2h
TLSH
T140A12C0DBE129D50DB9ED8823AF9909752774F80DBC26048BED9EE1B09604BDCD4D9CA
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout16.png

SHA256 2386a031e798aec7c8f1695847c20fc567ee1a9fdd42b93b2f744b9817988acb
MD5 e867ab9c734ab04bb01fc7862eee72d6
SHA1 549ef2debedf34155a1aeb7b5d167600eabb5343
SHA512 65e948429ba8d1a42b7f8d98498ef33b520154a491f1666ba3f70b51baf077d08586d57eaf5f4bf607dde9a775ece4948e78a05160211d09f6fb13a5ac30bc50
SSDEEP 96:bSZCo7FPWlknGbOJdAuo2jm9AHNfoYfncNG0gLjGwpFHoFiHH+cHEggyHVtjWALk:bSV7FAknWOEtAcybFIFiHecwy1hLd4th
TLSH
T19DA12A0DBA015C209A9A6D41EEF961C63B7F1F809B91E005FCD9A4575C511B9CC5CBCA
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout16_altered.png

SHA256 904b913748f8cf9bbc9381b724613f9eaf7c7227a2476f4ae379adf2a8a18573
MD5 97761b1bf313a2ef7ad2b1ff06228166
SHA1 8b25ec4faa84a3506a30ede605a3ea0204567dc7
SHA512 712f494eb2b3cb9f8e1ee9e7066997d217093ed154b1f4726d76347643c928a19066992b389aa692bc19e52f36521937232770afc1cfc62681db82d2ef518a99
SSDEEP 96:bSWo7FPWlknGbOJdGgsuIkH0m9AHNfh5f3cNG0gLjGwpFHoFiHH2GHEgkGHXjWKY:bS37FAknWOGgI+FA+ybFIFiHWG0GrB3q
TLSH
T1B3A1FA1EAF025D104B5EAA45AFF89187667B0FC0EB829044FEEDD9424C6007DCD5EAC5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout16_alteredcn.png

SHA256 1138980bab049d377e8d922fd50800a149221a33c740819854a32ffd4eaf9af9
MD5 8edbb49454aed9861ce68adb97855788
SHA1 c317e26ba79c0ab9cff4fb17dd9886312ee431e1
SHA512 5131cd9c8be102a7f9435d8d1e2c77dc0c9b1c2a0074512cee76041b3fc74e687d6a5c0b4c140c0dca00c9afc80afce5901a079ad6910b7b53bd3b6c13368c0e
SSDEEP 96:bSXo7FPWlknGbOJdSukUm9AHNfoUwcfwTcNG0gLjGwpFHoFiHHlHEgXHu0Wpe4sR:bS47FAknWOKA9ybFIFiHFHc8oYddfQh8
TLSH
T1FBA10B09BD11AD00561E7E817AF961C6527B1FD0AF83A088FDE5DD1B18604BACC0FAC6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout16cn.png

SHA256 ffaf4a3d3ac050b04b1cbd1b4e8166052bef3c2f813771878181d56f6e198df9
MD5 5ac1da9ad0796cf2de485028c9f62b40
SHA1 ecfe2180edd52dcb3918845ba1d28fadf4f7bb80
SHA512 a188ba6671c8f29994300618b26346611170c831ac20798b95b6cae8d3a3f6b5d0f274c08a513c62bb1c11f13e57f801c2e82a1ab2b2757ba6e98b7cadf26e91
SSDEEP 96:bSXo7FPWlknGbOJdkuzKm9AHNfoUwcfwYcNG0gLjGwpFHoFiHHPHEgBHl0WFB/iF:bS47FAknWOfA+ybFIFiHvxpC5M0Ldb
TLSH
T1C7A1FB1DBD029D10A68AE989ADF815A753370BD09BE260C4BDCDF60B58112BDCC1EAC6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout19.png

SHA256 1f705f0976a4c644370d3e96d5d1e4a84a83e5b49eb24fcb9e71570d6a02b932
MD5 edffe4aa1ad5887a0e98268e3c688fed
SHA1 f9d250add1d21fcc0487f3045e323631d1ac8bd7
SHA512 282fa35a4d2ce7b8b74d35d70a3d07cb6125e8505dfe03e565535fcaec7b20c47d1d0cfe280e4bb81f5c034af94adee0e46d5d039401a110e4a70d2b3e75e9c3
SSDEEP 96:bSZCo7FPWlknGbOJdKuQqm9AHNfh5fncNG0gLjGwpFHoFiHHzHEgdHejWsgpQEMy:bSV7FAknWOMAqybFIFiHTNcgmnCF
TLSH
T12AA1E719BA229C10991DEDC2EEF800C72F370B90DF81A044FDD8A9671E61579DD5EBCA
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout19_altered.png

SHA256 28794c3cd884823ae501bf0956daf389bdaa6991aaf216dcdfd2666bf8f990b6
MD5 b5cebe9734dd48d264d486b5e6db0c69
SHA1 9b92a706ea7be86bceea100d942aec710b978867
SHA512 a17cd39eecfd0640a0c91ebe0e38a328c2bca220233d1c0b5b918e0f5b2afded936dd975edfcf37dad03a4a033601e8c5efe19557f4373d366da555b41ee5d15
SSDEEP 96:bSWo7FPWlknGbOJd3zuuEum9AHNfh5fQcNG0gLjGwpFHoFiHHTgHEg8gHfjWkWwG:bS37FAknWOwAtybFIFiHcPHWehbo
TLSH
T1C8A10B4CEA12DC004E59A941FFF960831AB70FD4DB529048FDDBEC17696117ADD0EAC5
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout19_alteredcn.png

SHA256 9bd172474713bfa735588afb11de502fbca15914445a9ce5186f9bc16f3a0fc4
MD5 d956afc42f7472181fd3d413d3827bc9
SHA1 900da8256018c1ca5c62a9a363730772bbb7564f
SHA512 02c2d93c28ac56423b7d60704535fd97aacdeff5c436eca3493b81a29de4dafce8dfae97ae933e322b14f69637c0da579b3cb3a4f50e624f90c56294f32e0a8d
SSDEEP 96:bSXo7FPWlknGbOJdWuoYmm9AHNfoUwcfwqcNG0gLjGwpFHoFiHHiuHEghHTm0Wv2:bS47FAknWOxXA0ybFIFiHfxWD4r4pql
TLSH
T1D9A1D70DF912EC108D0AFE857AF4619796370BC49B924094FED9ED1619611B9CD0FAC6
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/media/zoomout19cn.png

SHA256 2e5180630b2f01b865335cfd45a4bb6773624db1867b283cd010a9d36a0bc2ff
MD5 7fbad827df5e11a6fa8bb11e0f92829c
SHA1 52cdef4ce896c720468f105c4c2a92802a1741b5
SHA512 26016e5bfe2582672d40032fcf246569cde07e5e22862aaf6d2a72102a3ab8e96d62c3040803e3c479c8eb9e7936ed9066a047dd13490f904d6c5164a6aba479
SSDEEP 96:bSXo7FPWlknGbOJdcus9m9AHNfo/wrfwqcNG0gLjGwpFHoFiHHUHEguHq0Wctxpq:bS47FAknWOBAEybFIFiH0eLtXCMTIvfN
TLSH
T1F0A1190DFE129C009AADDD86BAF9509655336FD0CB81E044FDD59A270D600BDCD5F6C2
MD5 SHA1 SHA512 SSDEEP TLSH

dependencies/overlay/overlayapp.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 241e7f33e36a3db5acb6a750820db80789d09b546793ada9ec2ab28ca1c18451
MD5 38218addec8590e6ac4f71aab0fef094
SHA1 35730e61fb9cca35529cd7d77a1da7f93f2060fd
SHA512 51a6a3c3c0e1e95f019b4c743212b53c463ac9f430999fc125c1461ee158b3781eb50e27e8c4247ec74b768dc86423ef2421fe2abc4ea639a6b0a762711bc29e
SSDEEP 49152:ic37znoOw5xqwzpdjrlo8j1IZZGGT3pb80E0AvLqK7C0HQV/2XNqwfo6ZRA4ZHcS:ic3nQpdjqA6qIATHCd/wNs74Upq
TLSH
T1AA869D13B7984A77C59E1736D4F6840143F0FA13A602E74F39CFA6681F93BA669113A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

dependencies/selfpatch/PatchGGPX.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 05a68647e25cc2bfad790b9a21e93a95f71e4e913833f8e4810c3ad64c151e66
MD5 a193792712e37a6ca4e05a270441231f
SHA1 01f933831c4de1c98d8aca409d6e4589df465774
SHA512 523d715047696e67703f0e1890221e6b36ddbc8e9ef5eb73b684df9f745b7b918e52b2ccdf294359501626cc0720f9b44812d9c7d5066bb64847e2c5742c3453
SSDEEP 3072:rqvmgiYSoIk8uIHzlqRwa/fB26dPIgNZvd2T2q+jSzdsnOclpJ1dPzCzkT80:r64k83TlEvhTIg7sTq2TcPekL
TLSH
T1F3547D0BB7D843A5D1B59A38C5E35814A7F2B88B5773E7CF2B4046B60E137D09E69382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

dependencies/tradebot/BuyBot.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 d56a0594fe1dc839596206872c6c4c646471f8b917fb7a0a90c1b734f42ac4a7
MD5 8a25cd5fc5ea14da30ab1e3e9fbe955a
SHA1 fb9865c25f3b10e3fe3dc411027cb33b3e3d4f39
SHA512 67dbccddc23e769a6f2a82bf1b17f969e5038342c8cf127085fd4ca1f984ca97bed0eb8689226be16a04f3f86f417ac63fd22105d0121c8e96c5fb38147b94ef
SSDEEP 12288:tvggNaxme6lTd41oB+Nh0iNIfNbjwL9Ju9dOeqe8Gl8W+XkOJxPqu2mSKps:+L+Td41IeswL9JsdcGCdXkOJxPTqos
TLSH
T16E455B13B6E58D36E2BE0B34C0B2580897B2DA05AF67EB8B2B96137D0C43791DD552C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

main.exe

IMPHASH e45fac1ffa0e9dda27daa50fe8cc82b0
SHA256 dbaa7944905055060653034ae2112ed39a89188ef581f8334e96e0b621c4d896
MD5 5a72ea7cf62a6e6faca85d2dd0ed5783
SHA1 7224f59ab4e9e01c8e0d7fd570d46f19d50d7c48
SHA512 294ee0631a8f9ecc94841ab11b6cfe17523a5d4ff4c48938da6176124cf64988c9eac2d5a0076086c913597ecc33db39351b342b1714a147de8d81a00eb7d597
SSDEEP 49152:qiuSiClkzCqIqUXzLdxwEg1/w8+W3rnaPLR6HSk1rsDj8HWAJEiGLtcBV6fiAIYV:qiqr1B+Snu4HTJsYWAeiH/JCV
TLSH
T159E5E14773E6C1E9DE6781F6C9114223D671BC2017388ADB25E49A2EEF73ED05A3A710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

820932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

WSAStartup gethostbyname WSACleanup inet_addr gethostname

winmm

mixerGetLineInfoW mixerGetLineControlsW mixerClose mixerGetDevCapsW mixerOpen mciSendStringW joyGetPosEx mixerSetControlDetails mixerGetControlDetailsW waveOutGetVolume waveOutSetVolume joyGetDevCapsW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

comctl32

ImageList_Create ImageList_GetIconSize ImageList_Destroy ImageList_AddMasked ImageList_ReplaceIcon CreateStatusWindowW

shlwapi

HashData

crypt32

CryptStringToBinaryW CryptStringToBinaryA CryptBinaryToStringA

psapi

GetProcessImageFileNameW GetModuleBaseNameW GetModuleFileNameExW

wininet

InternetCloseHandle InternetReadFileExA InternetReadFile InternetOpenUrlW InternetOpenW

kernel32

GetExitCodeThread CloseHandle CreateMutexW GetLastError GetModuleHandleW FreeLibrary WideCharToMultiByte MultiByteToWideChar SystemTimeToFileTime SetFilePointerEx ReadFile SetFilePointer GlobalSize lstrcpyA lstrlenA lstrcmpiA lstrcmpA LocalFileTimeToFileTime CreateDirectoryA CreateDirectoryW IsBadReadPtr CreateFileW CreateFileA WriteFile SetFileTime DuplicateHandle LoadResource LockResource SizeofResource GetCurrentDirectoryA GetLocalTime FileTimeToDosDateTime GetFileInformationByHandle GetFileSize lstrlenW FindFirstFileW FindNextFileW FindClose UnmapViewOfFile CreateFileMappingW MapViewOfFile SetLastError FlushInstructionCache GetTempPathA HeapAlloc HeapReAlloc VirtualAlloc VirtualFree LoadLibraryA GetProcessHeap HeapCreate HeapFree HeapDestroy GetCommandLineW WaitForSingleObject GetThreadLocale VirtualQuery GetSystemInfo GetVersionExW CreateThread RaiseException DeleteCriticalSection GetCPInfo GetModuleFileNameW GetFullPathNameW GetShortPathNameW FileTimeToLocalFileTime SetEnvironmentVariableW Beep MoveFileW OutputDebugStringW CreateProcessW GetFileAttributesW GetExitCodeProcess WriteProcessMemory ReadProcessMemory GetCurrentProcessId OpenProcess TerminateProcess SetPriorityClass GetEnvironmentVariableW GetDateFormatW GetTimeFormatW GetDiskFreeSpaceExW SetVolumeLabelW DeviceIoControl GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceW GetCurrentDirectoryW DeleteFileW SetFileAttributesW GetFileSizeEx GetSystemTime GetSystemDefaultUILanguage GetComputerNameW GetSystemWindowsDirectoryW GetTempPathW TryEnterCriticalSection QueryDosDeviceW CompareStringW RemoveDirectoryW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetPrivateProfileStringW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW WritePrivateProfileStringW WritePrivateProfileSectionW HeapValidate HeapSize SetEndOfFile GetACP GetFileType GetStdHandle FileTimeToSystemTime IsWow64Process VirtualAllocEx VirtualFreeEx EnumResourceNamesW LoadLibraryExW RemoveVectoredExceptionHandler ExitProcess ExitThread GetStringTypeExW lstrcmpiW OpenThread GetCurrentThreadId LeaveCriticalSection EnterCriticalSection ResumeThread SuspendThread GlobalUnlock GlobalLock AddVectoredExceptionHandler GetProcAddress LoadLibraryW SetErrorMode InitializeCriticalSection FindResourceW VirtualProtect RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead RtlUnwindEx RtlPcToFileHeader GetSystemTimeAsFileTime GetProcessTimes GetCurrentProcess CheckRemoteDebuggerPresent GetCurrentThread GlobalFree _lclose _lopen _lread GetModuleFileNameA GlobalAlloc GetModuleHandleA SetCurrentDirectoryW Sleep GetTickCount MulDiv EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread HeapQueryInformation LCMapStringW GetStringTypeW GetConsoleMode ReadConsoleW GetConsoleCP FindFirstFileExW IsValidCodePage SetThreadPriority GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers WriteConsoleW InitializeCriticalSectionAndSpinCount

user32

ClientToScreen GetCursorInfo GetLastInputInfo GetSystemMenu GetMenuItemCount GetMenuItemID GetSubMenu GetMenuStringW ExitWindowsEx SetScrollInfo ScrollWindow SetMenu FlashWindow GetPropW SetPropW RemovePropW MapWindowPoints RedrawWindow SetParent SetWindowLongPtrW GetClassInfoExW GetAncestor UpdateWindow GetMessagePos GetClassLongPtrW DefDlgProcW CallWindowProcW CheckRadioButton IntersectRect GetUpdateRect PtInRect CreateDialogIndirectParamW GetWindowLongPtrW CreateAcceleratorTableW InsertMenuItemW SetMenuDefaultItem RemoveMenu SetMenuItemInfoW IsMenu GetMenuItemInfoW CreateMenu CreatePopupMenu SetMenuInfo AppendMenuW DestroyMenu TrackPopupMenuEx GetDesktopWindow CopyImage CreateIconIndirect CreateIconFromResourceEx MessageBoxW EnumClipboardFormats GetWindow BringWindowToTop GetTopWindow GetQueueStatus SetWindowPos SetWindowRgn SetFocus SetActiveWindow EnumChildWindows MoveWindow GetWindowRect GetClientRect SystemParametersInfoW AdjustWindowRectEx DrawTextW SetRect GetIconInfo SetWindowTextW IsWindowVisible BlockInput CheckMenuItem LoadImageW ChangeClipboardChain SetClipboardViewer LoadAcceleratorsW SetDlgItemTextW GetMenu CreateWindowExW RegisterClassExW LoadCursorW DestroyAcceleratorTable UnregisterClassW DestroyIcon DestroyWindow IsCharAlphaW MapVirtualKeyW VkKeyScanExW MapVirtualKeyExW GetKeyboardLayoutNameW ActivateKeyboardLayout GetGUIThreadInfo GetWindowTextW mouse_event GetSystemMetrics keybd_event SetKeyboardState GetKeyboardState GetCursorPos GetAsyncKeyState AttachThreadInput SendInput UnregisterHotKey RegisterHotKey PostQuitMessage SendMessageTimeoutW UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW IsCharAlphaNumericW IsCharUpperW ToUnicodeEx GetKeyboardLayout CallNextHookEx CharLowerW ReleaseDC GetDC OpenClipboard GetClipboardData GetClipboardFormatNameW CloseClipboard SetClipboardData EmptyClipboard PostMessageW FindWindowW GetDlgItem SendDlgItemMessageW DialogBoxParamW SetForegroundWindow DefWindowProcW FillRect DrawIconEx GetSysColorBrush GetSysColor RegisterWindowMessageW GetMonitorInfoW EnumDisplayMonitors IsIconic IsZoomed EndDialog IsWindow DispatchMessageW TranslateMessage ShowWindow CountClipboardFormats SetWindowLongW ScreenToClient IsDialogMessageW WindowFromPoint SendMessageW IsWindowEnabled GetWindowLongW GetKeyState TranslateAcceleratorW KillTimer PeekMessageW GetFocus GetClassNameW GetWindowThreadProcessId GetForegroundWindow GetMessageW SetTimer GetScrollInfo GetParent GetDlgCtrlID CharUpperW IsClipboardFormatAvailable EnumWindows GetWindowTextLengthW EnableWindow InvalidateRect MessageBeep EnableMenuItem SetLayeredWindowAttributes IsCharLowerW

gdi32

GetClipRgn CreateFontW SelectObject GetStockObject CreateSolidBrush DeleteObject CreateDCW GdiFlush CreateDIBSection EnumFontFamiliesExW SetBrushOrgEx CreatePatternBrush SetBkMode GetCharABCWidthsW GetDeviceCaps FillRgn ExcludeClipRect SetTextColor SetBkColor GetPixel BitBlt CreateCompatibleBitmap GetSystemPaletteEntries GetDIBits CreateCompatibleDC CreatePolygonRgn CreateRectRgn CreateRoundRectRgn CreateEllipticRgn DeleteDC GetObjectW GetTextMetricsW GetTextFaceW GetClipBox

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

advapi32

CryptReleaseContext CryptDestroyKey CryptDestroyHash CryptDeriveKey CryptHashData CryptCreateHash CryptAcquireContextW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegConnectRegistryW RegOpenKeyExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW GetUserNameW

shell32

SHFileOperationW DragFinish ExtractIconW DragQueryPoint SHEmptyRecycleBinW DragQueryFileW SHGetPathFromIDListW SHBrowseForFolderW SHGetDesktopFolder SHGetMalloc SHGetFolderPathW ShellExecuteExW Shell_NotifyIconW

ole32

OleInitialize CoCreateInstance CoInitialize CoUninitialize CLSIDFromString CLSIDFromProgID CoGetObject StringFromGUID2 CreateStreamOnHGlobal

oleaut32

SysFreeString SafeArrayDestroy GetActiveObject SysStringLen SysAllocString VariantClear VariantChangeType SafeArrayCopy VariantCopyInd SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayCreate SafeArrayLock SafeArrayPtrOfIndex SafeArrayUnlock SafeArrayAccessData SafeArrayGetElemsize SafeArrayUnaccessData OleLoadPicture

readme.txt

SHA256 c600243957bd4e10b6648a3fc150f3e7a436d2931dc86d83a6789afa93522751
MD5 f1648dc0b13fdfbc9028238073e8f3f4
SHA1 436fcf1b1badd1e60e0cce7a9bf4cbdd44ccc660
SHA512 5c94afa827cccaabcd634003d7d20cbf22308fa9d731c14c4dfea1b10d33cd24f35692f665cc55d54fdbd247733b4a0b2ff3ddf32567e4692a857246a954172f
TLSH
T1D30149FB4893FA2D5A3334C5D1DD722AD2DB204DDC9A0168E28150ACEC0C86BC49DB3E
MD5 SHA1 SHA512 TLSH

scripts/POE1_DPS_FLASKS_THREAD_CUSTOM.AHK

SHA256 9891808e532e776166f1dd90bebb61ab2caf12cca6f978996213709e3cc6a3fa
MD5 18067c2c65c2af12037df21aea5b1e91
SHA1 5eed8919605ebf34037ba4746482d08878bd45dc
SHA512 9b40a042a1890ee1b04afe2b725a47d8b408afc8f5f44d2f0c111b985a3ae7f55d3508c304db7e7283eac74cad9cf623289431904e8a16d577f94d791fe98d35
TLSH
T194211048A85F1A8FA376347818F7210F7E0FC07D862C22E0F88D215D62C85250867F98
MD5 SHA1 SHA512 TLSH

scripts/POE1_QUICKSILVER_FLASKS_THREAD_CUSTOM.AHK

SHA256 4f0b3dd39d1d612861082818042fec49dffe04d478e6dee08b8d6d5447dd4de0
MD5 af4de470a07ef5f6360deb70d11ccfde
SHA1 fc71df34206761f5f9b2a502b78e8df49e7dbc0b
SHA512 2a5c35c587b53e177fe896c17f08c27034e2fb9b57797f87e1346b20a90303de4723c24efd9532d4848e20d060172422f736b4eceae265f0cc63abf30d30442e
TLSH
T17B41DE4CE12DA2DDA91222651A72213B4D3FC435D3A627FA355C308C37CD62D88AAF98
MD5 SHA1 SHA512 TLSH

scripts/POE2_ELEMENTAL_INVOCATION_THREAD_CUSTOM.AHK

SHA256 5c54df84daecbba6a1a7cc9d87940ddec80c29d83aac03d780ef351cba1595e2
MD5 35f16d04295d16f7f4457dd997fa9530
SHA1 4618de4432e2a6b46e24d9f151e7d4c18f362cdb
SHA512 210dba2d7d97526bff199e0f74420bc645c44d61a7e1731c8f9ecb6ea1a3d95ce135c01d2ec9c49aea3e8bf3195e1077da69c27dff5c79355f952d3cab631a6e
TLSH
T142F059155869141F533B3A39A893150EFF1E085B002A01AC7CAE24945FA1F7E1237F18
MD5 SHA1 SHA512 TLSH

scripts/POE2_FLICKER_CHARGED_STAFF_THREAD_CUSTOM.AHK

SHA256 ba495c1e7dc26f292cf1e46ddd121a909b930ff3d56badc985da1084eba61301
MD5 df6753ef538104340baa0509ebcd2143
SHA1 d7c1953a5ea9ca91f944a17b14652e88f9df4e64
SHA512 36eda2ef2af3efa80963e64afdbf0de2fe3402b9b468b8b18411fe799c26cc9a502214abdd14291a13a5ea1697c73aab7aa2b2a5ed4fcf0f0dded367a63a3e8f
TLSH
T19A11DA41742F414F07576A792D7B210FBE0CD4DD10ADC2EC75892D88ABD523E1A5CEB8
MD5 SHA1 SHA512 TLSH

scripts/POE2_TEMPESTBELL_THREAD_CUSTOM.AHK

SHA256 6f21b47ee34603119dd36010c89a2f98efbff05ce53d3f34ba5b18fed0492904
MD5 20347360638a5ccce41e1f4a1deb0e84
SHA1 f71fd98e18d7902bd49e0bc98dda00c5c70857d9
SHA512 39c05aa4523fcb4ab7aee032e808dea2282c6e1848c72609005022aefb743632e0eccc274d2750aa55e27333c01ca569f6c7a8f46c1af8cb208e054c83155d32
TLSH
T1BF019C098056009A43376D7CFD52262FFE04049F125E42ACB95D25E46FF427A1B6AF74
MD5 SHA1 SHA512 TLSH

scripts/POE2_TEMPORALRIFT_THREAD_CUSTOM.AHK

SHA256 dc3321c2c13874803198094e1143682969c79d31074c67b80e51e4253f370189
MD5 b83d7d817fe98529919c9f404dba96fa
SHA1 3f627232eed4d4d8a7b7a82c18296be887e67ef1
SHA512 b93665b2dfd3107dbdab7b713332bfc0bc21794fd9ff0cac456bb5cc5138d3c47df4fe27fe280d92a7d16aaf54fba3d3ba5cf4f69441721780e71a80a77ed6c2
TLSH
T1282131502F124B3B81A03BB1646F55DFDFBF9071E56F4694B08E2638328CA5C56650E7
MD5 SHA1 SHA512 TLSH

scripts/POE2_UNBOUND_AVATAR_THREAD_CUSTOM.AHK

SHA256 ae953c3c5cf576cda7b1bfec888e46c7b97dab7baed64f2cf883d7a2d0dc0c78
MD5 7ed0d77c1fa01e2031d2f6d8a4ef4010
SHA1 7f06376c98033898903e914cf1c500a0af848cb9
SHA512 09dd6dbda71beadea9f644312be3f3b13603821fef836ffe5e83572ca11f7401cc2374921c8a36f0a38b493739ecb308d36d28a82f636c2cdaf979e66b61d077
TLSH
T10EF050045469042F51373F397D92551FEF1A185B401E019CF8AD24A4AFB1F7F5627F24
MD5 SHA1 SHA512 TLSH

scripts/readme.txt

SHA256 dd3562bf53c57619bcba7647b3557ca89753db35271aa9ed433d5c1ec9910ca2
MD5 bbda31f21e753573151b18857e9a38db
SHA1 5749c244a3d7acb50cf278d5c92548de738fd22e
SHA512 0e58eeb21499b4c34af76e2a6d2822026dadb07aa7738dbff0fecdbbb78a466f4c7ef8524ba8644b56f145a7371d788083d816f4741ddb2e4d8578efe9416fba
TLSH
T10EE0C093EBEB43B728B0CBC4641E17D3FA268239B16CA751D4E01478771C5E208150E8
MD5 SHA1 SHA512 TLSH

version

SHA256 330d5ef64286b448e4f0705c7b1e95847dc7a4c5ee8dd20273422c4efdaa526d
MD5 90926549e7441849f15624cef1675816
SHA1 9361285aa54f0a319faa02c2f9c09bb6a6676d8d
SHA512 91d70fe1aa5eefd6067c8d02e81bd36c9957a64546789cb60826def9d67e2f70621befbe146fb01d25d62ab969506e391a2af64b01b1fd006e583b153375073b
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

assistant.zip

KeyListController.txt

THREAD_AUTOPOT.AHK

THREAD_CHARGED_STAFF.AHK

THREAD_CUSTOM_1.AHK

THREAD_CUSTOM_2.AHK

THREAD_CUSTOM_3.AHK

THREAD_CUSTOM_4.AHK

THREAD_DEBUG.AHK

THREAD_KEYSTATE.AHK

config.ini

cports.exe

PE Signature issue

PE Signature issue

msvcrt

ws2_32

version

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

generic

dependencies/ViGEmBusX/ViGEmWrapper.dll

mscoree

dotnet

nefarius.vigemclient.dll

mscoree

dotnet

dependencies/ViGEmBusX/_virtualGamepadPoe2.exe

kernel32

wsock32

winmm

version

comctl32

psapi

wininet

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

dependencies/ViGEmBusX/virtualGamepadPoe2.exe

generic

dependencies/ggpxeditor/GgpXeditUI.exe

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

dependencies/ggpxeditor/oo2core.dll

PE Signature issue

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

dependencies/includes/_FUNCTIONS.AHK

dependencies/includes/_INCLUDES_GLOBAL

dependencies/includes/_INCLUDES_THREAD

dependencies/media/always_enemy_hp.png

dependencies/media/always_enemy_hp_a.png