SourceDir.zip
- SHA256 c477003d4707c9a4d3f483c049b3a9088aec84f1cfe7a4a1d9cee14c3159ab6c
Overview
overview
10Static
static
10HotPlugins/av.dll
windows7-x64
1HotPlugins/av.dll
windows10-2004-x64
1Plugins/Options.dll
windows7-x64
1Plugins/Options.dll
windows10-2004-x64
1Plugins/Options.dll
windows7-x64
1Plugins/Options.dll
windows10-2004-x64
1Plugins/Pr...er.dll
windows7-x64
1Plugins/Pr...er.dll
windows10-2004-x64
1Plugins/Pr...er.dll
windows7-x64
1Plugins/Pr...er.dll
windows10-2004-x64
1Plugins/Recovery.dll
windows7-x64
1Plugins/Recovery.dll
windows10-2004-x64
1Plugins/Regedit.dll
windows7-x64
1Plugins/Regedit.dll
windows10-2004-x64
1Plugins/Regedit.dll
windows7-x64
1Plugins/Regedit.dll
windows10-2004-x64
1Plugins/Re...ra.dll
windows7-x64
1Plugins/Re...ra.dll
windows10-2004-x64
1Plugins/Re...ra.dll
windows7-x64
1Plugins/Re...ra.dll
windows10-2004-x64
1Plugins/Re...op.dll
windows7-x64
1Plugins/Re...op.dll
windows10-2004-x64
1Plugins/Re...op.dll
windows7-x64
1Plugins/Re...op.dll
windows10-2004-x64
1Plugins/Re...xy.dll
windows7-x64
1Plugins/Re...xy.dll
windows10-2004-x64
1Plugins/Re...xy.dll
windows7-x64
1Plugins/Re...xy.dll
windows10-2004-x64
1Plugins/RunPlug.dll
windows7-x64
1Plugins/RunPlug.dll
windows10-2004-x64
1Plugins/RunPlug.dll
windows7-x64
1Plugins/RunPlug.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
HotPlugins/av.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
HotPlugins/av.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Plugins/Options.dll
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Plugins/Options.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Plugins/Options.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Plugins/Options.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Plugins/ProcessManager.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Plugins/ProcessManager.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Plugins/ProcessManager.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Plugins/ProcessManager.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Plugins/Recovery.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Plugins/Recovery.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Plugins/Regedit.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Plugins/Regedit.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Plugins/Regedit.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Plugins/Regedit.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Plugins/RemoteCamera.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Plugins/RemoteCamera.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Plugins/RemoteCamera.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Plugins/RemoteCamera.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Plugins/RemoteDesktop.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Plugins/RemoteDesktop.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Plugins/RemoteDesktop.dll
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Plugins/RemoteDesktop.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Plugins/ReverseProxy.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Plugins/ReverseProxy.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Plugins/ReverseProxy.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Plugins/ReverseProxy.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Plugins/RunPlug.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Plugins/RunPlug.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Plugins/RunPlug.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Plugins/RunPlug.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target SourceDir.zip
- Size 72.1MB
- Sample240413-fgvsfsbf67
- SHA256 c477003d4707c9a4d3f483c049b3a9088aec84f1cfe7a4a1d9cee14c3159ab6c
- MD5 266588cc20ca6069ee822b9f7aefb083
- SHA1 2addfc605391f5b2de8fd987fb669094c1364a3e
- SHA512 1c335bb0ab0290b400806d2db4d3a38399257dc46530685da340d76a5d924a4c9ec31467eaeb3ff3a06c0f78dddd3a4f0ee18a796c0003ca2b38b07c12411c28
- SSDEEP 1572864:pM5O4BZ3hKpMKimvZjI3gQ9nbDGvCvakgB38irD4EAQjYkgiQbs:pTSKnxv63z9bDG6ZgBRAURr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/Stub/SourceDir/Stub/Client.exe family_asyncrat - Asyncrat family
- Unsigned PE 66 IoCs
Checks for missing Authenticode signature.
resource unpack001/CyberSpike.exe unpack001/HotPlugins/av.dll unpack001/HotPlugins/dll.dll unpack001/HotPlugins/密码欺骗.dll unpack001/Plugins/Audio.dll unpack001/Plugins/Audio.dll.duplicate1 unpack001/Plugins/Chat.dll unpack001/Plugins/Chat.dll.duplicate1 unpack001/Plugins/Discord.dll unpack001/Plugins/Extra.dll unpack001/Plugins/FileManager.dll unpack001/Plugins/FileManager.dll.duplicate1 unpack001/Plugins/FileSearcher.dll unpack001/Plugins/FileSearcher.dll.duplicate1 unpack001/Plugins/Fun.dll unpack001/Plugins/Fun.dll.duplicate1 unpack001/Plugins/HttpServerLib.dll unpack001/Plugins/HttpServerLib.dll.duplicate1 unpack001/Plugins/HttpServerLib.dll.duplicate2 unpack001/Plugins/Information.dll unpack001/Plugins/Information.dll.duplicate1 unpack001/Plugins/Keylogger.exe unpack001/Plugins/Logger.dll unpack001/Plugins/MessagePackLib.dll unpack001/Plugins/MessagePackLib.dll.duplicate1 unpack001/Plugins/Microsoft.Management.Infrastructure.dll unpack001/Plugins/Microsoft.Management.Infrastructure.dll.duplicate1 unpack001/Plugins/Mimikatz.dll unpack001/Plugins/Mimikatz.dll.duplicate1 unpack001/Plugins/Miscellaneous.dll unpack001/Plugins/Miscellaneous.dll.duplicate1 unpack001/Plugins/Netstat.dll unpack001/Plugins/Netstat.dll.duplicate1 unpack001/Plugins/NetworkManager.exe unpack001/Plugins/Options.dll unpack001/Plugins/Options.dll.duplicate1 unpack001/Plugins/ProcessManager.dll unpack001/Plugins/ProcessManager.dll.duplicate1 unpack001/Plugins/Recovery.dll unpack001/Plugins/Regedit.dll unpack001/Plugins/Regedit.dll.duplicate1 unpack001/Plugins/RemoteCamera.dll unpack001/Plugins/RemoteCamera.dll.duplicate1 unpack001/Plugins/RemoteDesktop.dll unpack001/Plugins/RemoteDesktop.dll.duplicate1 unpack001/Plugins/ReverseProxy.dll unpack001/Plugins/ReverseProxy.dll.duplicate1 unpack001/Plugins/RunPlug.dll unpack001/Plugins/RunPlug.dll.duplicate1 unpack001/Plugins/RunPlug_NET.dll unpack001/Plugins/RunPlug_NET.dll.duplicate1 unpack001/Plugins/SendFile.dll unpack001/Plugins/SendMemory.dll unpack001/Plugins/SendMemory.dll.duplicate1 unpack001/Plugins/System.Management.Automation.dll unpack001/Plugins/System.Management.Automation.dll.duplicate1 unpack001/Plugins/System.Management.Automation.dll.duplicate2 unpack001/Plugins/SystemInfo.dll unpack001/Plugins/SystemInfo.dll.duplicate1 unpack001/Plugins/browser.dll unpack001/Plugins/x64/SQLite.Interop.dll unpack001/Plugins/x86/SQLite.Interop.dll unpack001/Stub/Client.dll unpack001/Stub/SourceDir/Stub/Client.dll unpack001/Stub/SourceDir/Stub/Client.exe unpack001/Stub/SourceDir/Stub/Load.exe
File Explorer
-
SourceDir.zip.zip 72.1MB
-
CyberSpike.exe.exe .ps1 50.8MB
-
CyberSpike.exe.config.xml 6KB
-
HotPlugins/av.dll.dll 63KB
-
HotPlugins/dll.dll.dll 311KB
-
HotPlugins/密码欺骗.dll.dll 6KB
-
Plugins/Audio.dll.dll 23KB
-
Plugins/Audio.dll.duplicate1.dll 23KB
-
Plugins/Chat.dll.dll 454KB
-
Plugins/Chat.dll.duplicate1.dll 454KB
-
Plugins/Discord.dll.dll 24KB
-
Plugins/Extra.dll.dll .ps1 31KB
-
Plugins/FileManager.dll.dll 31KB
-
Plugins/FileManager.dll.duplicate1.dll 31KB
-
Plugins/FileSearcher.dll.dll 277KB
-
Plugins/FileSearcher.dll.duplicate1.dll 277KB
-
Plugins/Fun.dll.dll 33KB
-
Plugins/Fun.dll.duplicate1.dll 33KB
-
Plugins/HttpServerLib.dll.dll 24KB
-
Plugins/HttpServerLib.dll.duplicate1.dll 24KB
-
Plugins/HttpServerLib.dll.duplicate2.dll 24KB
-
Plugins/Information.dll.dll 39KB
-
Plugins/Information.dll.duplicate1.dll 39KB
-
Plugins/Keylogger.exe.exe 10KB
-
Plugins/Keylogger.exe.config.xml 161B
-
Plugins/Keylogger.exe.config.duplicate1.xml 161B
-
Plugins/Logger.dll.dll 26KB
-
Plugins/MessagePackLib.dll.dll 16KB
-
Plugins/MessagePackLib.dll.duplicate1.dll 16KB
-
Plugins/Microsoft.Management.Infrastructure.Native.dll.dll 211KB
-
Plugins/Microsoft.Management.Infrastructure.Native.dll.duplicate1.dll 211KB
-
Plugins/Microsoft.Management.Infrastructure.dll.dll 115KB
-
Plugins/Microsoft.Management.Infrastructure.dll.duplicate1.dll 115KB
-
Plugins/Mimikatz.dll.dll 305KB
-
Plugins/Mimikatz.dll.duplicate1.dll 305KB
-
Plugins/Miscellaneous.dll.dll 82KB
-
Plugins/Miscellaneous.dll.duplicate1.dll 82KB
-
Plugins/Netstat.dll.dll 25KB
-
Plugins/Netstat.dll.duplicate1.dll 25KB
-
Plugins/NetworkManager.exe.exe 29.9MB
-
Plugins/NetworkManager.exe.config.xml 186B
-
Plugins/NetworkManager.exe.config.duplicate1.xml 186B
-
Plugins/Options.dll.dll 402KB
-
Plugins/Options.dll.duplicate1.dll 402KB
-
Plugins/ProcessManager.dll.dll 26KB
-
Plugins/ProcessManager.dll.duplicate1.dll 26KB
-
Plugins/Recovery.dll.dll 1.3MB
-
Plugins/Regedit.dll.dll 279KB
-
Plugins/Regedit.dll.duplicate1.dll 279KB
-
Plugins/RemoteCamera.dll.dll 107KB
-
Plugins/RemoteCamera.dll.duplicate1.dll 107KB
-
Plugins/RemoteDesktop.dll.dll 42KB
-
Plugins/RemoteDesktop.dll.duplicate1.dll 42KB
-
Plugins/ReverseProxy.dll.dll 14KB
-
Plugins/ReverseProxy.dll.duplicate1.dll 14KB
-
Plugins/RunPlug.dll.dll 41KB
-
Plugins/RunPlug.dll.duplicate1.dll 41KB
-
Plugins/RunPlug_NET.dll.dll 22KB
-
Plugins/RunPlug_NET.dll.duplicate1.dll 22KB
-
Plugins/SendFile.dll.dll 27KB
-
Plugins/SendMemory.dll.dll 28KB
-
Plugins/SendMemory.dll.duplicate1.dll 28KB
-
Plugins/System.Management.Automation.dll.dll 6.1MB
-
Plugins/System.Management.Automation.dll.duplicate1.dll 6.1MB
-
Plugins/System.Management.Automation.dll.duplicate2.dll 6.1MB
-
Plugins/SystemInfo.dll.dll 31KB
-
Plugins/SystemInfo.dll.duplicate1.dll 31KB
-
Plugins/browser.dll.dll 85KB
-
Plugins/x64/SQLite.Interop.dll.dll 1.6MB
-
Plugins/x86/SQLite.Interop.dll.dll 1.2MB
-
Stub/Client.dll.dll 61KB
-
Stub/Client.exe.config.xml 161B
-
Stub/SourceDir/Stub/Client.dll.dll 61KB
-
Stub/SourceDir/Stub/Client.exe.exe 42KB
-
Stub/SourceDir/Stub/Client.exe.config.xml 161B
-
Stub/SourceDir/Stub/Load.exe.exe 4KB
-
Stub/SourceDir/Stub/Load.exe.config189B
CyberSpike.exe
- IMPHASH 47ef05eb53d09a9dba4db02d08012899
- SHA256 701d35c57c2cb2662a7acb9b7d021e0d727fb8ae48e08de94dd763249fe91c17
- MD5 9fe6ff5d944608a78521119ba18cf6b8
- SHA1 9a432d1442f49665dcd35988cf137fc37e72a4c3
- SHA512 3330c840548667db4e9461a4259092bae73cd3a50b3157426542a6656084cf645c28c83d6fc50d2cebde131656690fe108d410a03c490de1c7175c4a8815c2a0
- SSDEEP 1572864:jDaet5drCLcYMMvDNKzWglhXVM/AZ2Ss5nMMDLx:qmCHFvoz/lxVMoJs5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
102907509
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
OleInitialize
oleaut32
SafeArrayCreate
user32
CharUpperBuffW
Name
.text
Size
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.q l
Size
Virtual Size
47.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.`U3
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.<\O
Size
50.7MB
Virtual Size
50.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CyberSpike.exe.config
- SHA256 0a768d6ae9d31d99b96e8666a37c2595d72a343a335acdea2d91a59a08914802
- MD5 0f1fb18d0b9a58de9609adb35e777b92
- SHA1 0f03fe98f58d23faf4eeb0645437a7290ffc4ccf
- SHA512 5909d31438c22912f58bbdad974f88255c8013ad17823601ac0e50f2f76203144b31f2edb9a3da9a206ff3bdaf8f9e80fae3ef858b4b2cd57c87ba54ad155e5a
- SSDEEP 192:ur7S7x7Be7z7nrBpI2GoKS/pv7sJ+J/qJvu:uXS7x7BMz7VpI2XSu
- MD5 SHA1 SHA512 SSDEEP
HotPlugins/av.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d813ba03ff27bf4a342ce65020256f12c4c0cd3af802f2fe8b6176b9a01e50a
- MD5 0c2185d51efb900af3ca5d1ad8a36919
- SHA1 dcf6be79ce27720b95576c6eb7295a317af39d4b
- SHA512 f3956bb5f126e2e9612bfb9deee7ddfd0a3d8eed0da90c9d9768d60741de6845fcf1932371f5bdc5403ec7061e02dc0db01612d8a1369de0fdf1cfe3137252c7
- SSDEEP 1536:uRTDHKAAhYJz53WloceBkGHvxxIzzSPr:uRTDliYJl3OeKGIHSj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
HotPlugins/dll.dll
- IMPHASH 636af8d364acbe9ac52a2127f79d7de9
- SHA256 10d099ba6995f715dc888402196676f9d7417629b81282977b0223c3ba86aa25
- MD5 80db95017cb52bd67983b60a27abf357
- SHA1 6c5c33a98553b2cd27b6e1838e5f486d65cc04a0
- SHA512 51b50795d2798b3056e3e00609a3ae888b65f304daf680f84cbd902b27b79a52bfe922accd60c46e47cbc1bc5f17f5b822723da7ba167d0be0e5ea26ba5446f5
- SSDEEP 6144:P+GEpXOvC0ujPTlE+DSh9dVnNipm/y+TKRHT1/fj:HEpXOq0u0iA/XKRH5/fj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
29768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteFile
ReadFile
CreateFileA
CloseHandle
GetTickCount
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
RaiseException
RtlPcToFileHeader
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetProcAddress
GetModuleHandleW
ExitProcess
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
FlsGetValue
FlsFree
SetLastError
FlsAlloc
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetModuleFileNameW
HeapReAlloc
LoadLibraryW
WriteConsoleW
SetStdHandle
CreateFileW
SetEndOfFile
GetProcessHeap
Start
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
183KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=158, productName=VS2010 build 30319, version=30319,
count=49, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=81, id=1, productName=Unmarked objects,
count=2, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
HotPlugins/密码欺骗.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 457d98cd9dcaa923e4fc6f01f95115e48fafc73b146363491689b77efa9ed09a
- MD5 3721de38056280a923c140eead388d9d
- SHA1 cf4ce86a0bec788f1708dece2d4cae0efda4c8ea
- SHA512 aacb5b9f87080215feea02efd0815248ecf544f85b16e6b72bc212e269c45766ec4bceafb91d93d1d6ed383ea8d7caddf1c10a29a79cd49b7d0401f24ab5a1ef
- SSDEEP 96:WUyneJztYDvg60Swir2h3h3j4rk9CIUBOVJ2D:oeMvg60Szr2X3jQk99VJm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Audio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ae352a5478b0ad27d625521e4256c7195566d9a64738bbc95bc671187772dce6
- MD5 90b874246d48b19d2775b4d50b1d38ba
- SHA1 979512f77ed163a21dbcb46781fad4ac68b3abaf
- SHA512 e666fa85949747ea403970dab5585952f284f482e8735d28b9a79497bee14ba0e41781b6aaba0af3e339db815e0b8f421a4b7f08a4bdb9240dab111639bc4fae
- SSDEEP 384:wooj1JbmvvYkLig/BdsehGDfICDzukNGJuS7fgkuS:wooj1YvvZLxJs/guShB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Audio.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Audio.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ae352a5478b0ad27d625521e4256c7195566d9a64738bbc95bc671187772dce6
- MD5 90b874246d48b19d2775b4d50b1d38ba
- SHA1 979512f77ed163a21dbcb46781fad4ac68b3abaf
- SHA512 e666fa85949747ea403970dab5585952f284f482e8735d28b9a79497bee14ba0e41781b6aaba0af3e339db815e0b8f421a4b7f08a4bdb9240dab111639bc4fae
- SSDEEP 384:wooj1JbmvvYkLig/BdsehGDfICDzukNGJuS7fgkuS:wooj1YvvZLxJs/guShB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Audio.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ba6700945ba4d383097e17518323ccb76e957ed98538f172ba14055268900b7b
- MD5 56ec052aa3510830300874eac23c814f
- SHA1 4632fc55b3dc6c8d0bb49f03405262eb64896708
- SHA512 f0267003fd87f7b5bc75ff639ba42ea4239dff8b31ce008ba798e1571d9d679f5de5441704840024780e7df353e0bc5d135406a327d0c37b0191898ed6c11b8d
- SSDEEP 6144:LtBlKJ+p4JX0cZsaB6N83r2y/plBWnxfID/uKNlNQ7fOiLXyCrxO9w+KQqxe/t:LVKTkcZBB6NKbBWnxfIvNr4siQqx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
471078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
452KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Chat.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ba6700945ba4d383097e17518323ccb76e957ed98538f172ba14055268900b7b
- MD5 56ec052aa3510830300874eac23c814f
- SHA1 4632fc55b3dc6c8d0bb49f03405262eb64896708
- SHA512 f0267003fd87f7b5bc75ff639ba42ea4239dff8b31ce008ba798e1571d9d679f5de5441704840024780e7df353e0bc5d135406a327d0c37b0191898ed6c11b8d
- SSDEEP 6144:LtBlKJ+p4JX0cZsaB6N83r2y/plBWnxfID/uKNlNQ7fOiLXyCrxO9w+KQqxe/t:LVKTkcZBB6NKbBWnxfIvNr4siQqx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
471078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
452KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Discord.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e2ac2a715917dd5dfd5243a845a9fbd18040ccca4a2cce72effb95b267baa717
- MD5 32033674c21608ea252880c35a212494
- SHA1 dfe2a02b6ea33f0ee20fae84372f4beb52656090
- SHA512 7653be7a95d5635f608d06655aa0684f5cc67bf2e66f8de0a6bba8ac975099e42d320b430e9e7fd6840d63e3b5013d8d2da52428ec112edc775297bbd84be337
- SSDEEP 384:b+BiIXQSRrm1uYdxsztvW2BdsehGcdh+JaL6WP6VukXspTsnhlhX9qOig2:MT81ueMC0fiZXxhzX9qOib
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Discord.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5dd8eb17bb3cb7143ddc2e4c3393ebd649cb8807da85c09fb49e78867d0f1343
- MD5 12beb1edca2327f146968c246379d93c
- SHA1 e7f1aeeceff49047e24bb2e1940edb7efb8a5cb9
- SHA512 018c3f2ac1e957aae4be561f076bab640bfdae70c2e589d97c79a37c5c7fe6b123b342c8518f666c1193a4c5ccc587e56449465ac6bae4d807fe766d4e3d021a
- SSDEEP 768:iHAb77yUjceuxRkVq69K7w77SmRh4bA0m:iH1Px8nnSmRh4bAt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Extra.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1ff5990818e68df41b159bedde6fc128e594bd530fa7e8aeca43813e882d411d
- MD5 3bf2078ddf644e3f9725ca15c1c3a65c
- SHA1 cde9c9e43d994d15499b7ad86f84bf3421964422
- SHA512 1a871d23b58520825a955651ca02d5c41c24753e57a26dde306d29f6f567caff620606f16b3d688faae61f3f81a9f3dcaa2b0c178704252f5cb0e2db0faa1ff2
- SSDEEP 768:IpT1YufXAiBcbslRws45K36fSLmIksod+:IpBzPd26Rt4zfumhE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FileManager.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1ff5990818e68df41b159bedde6fc128e594bd530fa7e8aeca43813e882d411d
- MD5 3bf2078ddf644e3f9725ca15c1c3a65c
- SHA1 cde9c9e43d994d15499b7ad86f84bf3421964422
- SHA512 1a871d23b58520825a955651ca02d5c41c24753e57a26dde306d29f6f567caff620606f16b3d688faae61f3f81a9f3dcaa2b0c178704252f5cb0e2db0faa1ff2
- SSDEEP 768:IpT1YufXAiBcbslRws45K36fSLmIksod+:IpBzPd26Rt4zfumhE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 adf1fe7eb070a3b244413f2ae71e3ce61c1f550e4b12354aa66ee0b840e2f321
- MD5 44a048c1982fa0a626d5aa8cedfcaf59
- SHA1 405d07201d0f61ace7b83a0649fe971f9f04811e
- SHA512 96b3799e6207a722b333e90e20b90fef0850c0ae36655a96a2551467ba9d9957c04bbc87fa8384feb8bbbd279cd3f06bf718abc84dfb79a9b48b74fc4e8af932
- SSDEEP 3072:5RCFQ/vmJOTcIiTuWglfy0gt5nhYE2sfzccc9k1DEwWcSCSLeyYcEeI/KQ73Wmbx:5Ewn4rgv46ED29k1qlbKr6s4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FileSearcher.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 adf1fe7eb070a3b244413f2ae71e3ce61c1f550e4b12354aa66ee0b840e2f321
- MD5 44a048c1982fa0a626d5aa8cedfcaf59
- SHA1 405d07201d0f61ace7b83a0649fe971f9f04811e
- SHA512 96b3799e6207a722b333e90e20b90fef0850c0ae36655a96a2551467ba9d9957c04bbc87fa8384feb8bbbd279cd3f06bf718abc84dfb79a9b48b74fc4e8af932
- SSDEEP 3072:5RCFQ/vmJOTcIiTuWglfy0gt5nhYE2sfzccc9k1DEwWcSCSLeyYcEeI/KQ73Wmbx:5Ewn4rgv46ED29k1qlbKr6s4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8dbd1d1d7b42f2df322a451aa6a0399d223d4af5e0ed9f6b3e9df166bf8471ff
- MD5 ecbfb43dd455593ee980e1182159a3e1
- SHA1 be6e38b32e4d238905fec0639994be72eef840cc
- SHA512 cb2f3a21636842b4a8b9845d4278ffb2ee9de27bcb3ac438c6804991150dc5a4072872dad2776d5ccfbf157a9a34d081bf21bad41937896e0163ecd8e432c238
- SSDEEP 768:xMH8fKdQFR5ZF7he72hJRg165ntnxN32vYY+d3TB7gPqF:xMcFR5i2hJRg165ntnxN32d+d3TB7gPi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Fun.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8dbd1d1d7b42f2df322a451aa6a0399d223d4af5e0ed9f6b3e9df166bf8471ff
- MD5 ecbfb43dd455593ee980e1182159a3e1
- SHA1 be6e38b32e4d238905fec0639994be72eef840cc
- SHA512 cb2f3a21636842b4a8b9845d4278ffb2ee9de27bcb3ac438c6804991150dc5a4072872dad2776d5ccfbf157a9a34d081bf21bad41937896e0163ecd8e432c238
- SSDEEP 768:xMH8fKdQFR5ZF7he72hJRg165ntnxN32vYY+d3TB7gPqF:xMcFR5i2hJRg165ntnxN32d+d3TB7gPi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/HttpServerLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f3def07f64ad13f2f43a51afe8985bbe752b08e6a53d5a14b877ddb84f1e6a1
- MD5 1ebac43039d89e1240d91049781e601d
- SHA1 db4c780a20fa5019006f237e6f26ec60204b1c1a
- SHA512 9b487855bc9e05e1363dc4c0f29cd39e15a3f3bc8439b3d587d81d37ad4a9b758b85c08fcbb822a617801079f7106f8580f61e158bcfd0b08ba930e110ec83da
- SSDEEP 384:n1NG3fQ31tHo/oEE13YGQCHXKpGuskm+L+PNYqOJ54YLnl5pepvu03Xs71M:n18vsnzYuXKpGdkBiPuBtep20n3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\zhaotianci\Desktop\HttpServer-master 2\HTTPServer\HTTPServerLib\obj\Release\HttpServerLib.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/HttpServerLib.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f3def07f64ad13f2f43a51afe8985bbe752b08e6a53d5a14b877ddb84f1e6a1
- MD5 1ebac43039d89e1240d91049781e601d
- SHA1 db4c780a20fa5019006f237e6f26ec60204b1c1a
- SHA512 9b487855bc9e05e1363dc4c0f29cd39e15a3f3bc8439b3d587d81d37ad4a9b758b85c08fcbb822a617801079f7106f8580f61e158bcfd0b08ba930e110ec83da
- SSDEEP 384:n1NG3fQ31tHo/oEE13YGQCHXKpGuskm+L+PNYqOJ54YLnl5pepvu03Xs71M:n18vsnzYuXKpGdkBiPuBtep20n3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\zhaotianci\Desktop\HttpServer-master 2\HTTPServer\HTTPServerLib\obj\Release\HttpServerLib.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/HttpServerLib.dll.duplicate2
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f3def07f64ad13f2f43a51afe8985bbe752b08e6a53d5a14b877ddb84f1e6a1
- MD5 1ebac43039d89e1240d91049781e601d
- SHA1 db4c780a20fa5019006f237e6f26ec60204b1c1a
- SHA512 9b487855bc9e05e1363dc4c0f29cd39e15a3f3bc8439b3d587d81d37ad4a9b758b85c08fcbb822a617801079f7106f8580f61e158bcfd0b08ba930e110ec83da
- SSDEEP 384:n1NG3fQ31tHo/oEE13YGQCHXKpGuskm+L+PNYqOJ54YLnl5pepvu03Xs71M:n18vsnzYuXKpGdkBiPuBtep20n3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\zhaotianci\Desktop\HttpServer-master 2\HTTPServer\HTTPServerLib\obj\Release\HttpServerLib.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Information.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0145bcb9b88343056fa5555f77590e0f979ed06cdf95453eeb7182f388d2e00f
- MD5 d261147fab650cefad5a4a7f9b1d103c
- SHA1 f4f74fd92aac2a17a741eb6e339adc3e157ca88c
- SHA512 f358f36717bfe68f01bd4747a2177cfd94979a89dfb481c5b8acef05aa85f757e4ae2831979648d6e5ca2fba640b6ce03aa39000276578d5627bc3e58344ebd7
- SSDEEP 768:Zja46Np63oTrdv/w8BlCnhcMV1PO30TxlZ:9a4Idrl/JCnh91PnZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Information.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Information.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0145bcb9b88343056fa5555f77590e0f979ed06cdf95453eeb7182f388d2e00f
- MD5 d261147fab650cefad5a4a7f9b1d103c
- SHA1 f4f74fd92aac2a17a741eb6e339adc3e157ca88c
- SHA512 f358f36717bfe68f01bd4747a2177cfd94979a89dfb481c5b8acef05aa85f757e4ae2831979648d6e5ca2fba640b6ce03aa39000276578d5627bc3e58344ebd7
- SSDEEP 768:Zja46Np63oTrdv/w8BlCnhcMV1PO30TxlZ:9a4Idrl/JCnh91PnZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Information.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Keylogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 45c79f972ed94d5daf8cf76e22868b660e7c44756a933c59d8f760ab22d6eae9
- MD5 a0a220a6c5c050311b561bd264999a0c
- SHA1 8f5d03298f8ec906c3ed083df0348bdfd934b265
- SHA512 07f661943d83c32661e79e4dff701e7832f9dda5be58ac35eec2651e05f981b509be11b9c51500d25b833a485e956817aef618c1d82ab8d6b27972ad314ede6e
- SSDEEP 192:NDccujUso3edDxi4GaMLnKRzmEsLi6gv5DHBgQ7hfPlpEi:NDHdso3e5EhrLKhVsLo5VZ1pE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Keylogger.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Keylogger.exe.config
- SHA256 d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
- MD5 c16b0746faa39818049fe38709a82c62
- SHA1 3fa322fe6ed724b1bc4fd52795428a36b7b8c131
- SHA512 cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
- MD5 SHA1 SHA512
Plugins/Keylogger.exe.config.duplicate1
- SHA256 d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
- MD5 c16b0746faa39818049fe38709a82c62
- SHA1 3fa322fe6ed724b1bc4fd52795428a36b7b8c131
- SHA512 cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
- MD5 SHA1 SHA512
Plugins/Logger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b88c59a0f50404aa4aa2a8d0e987f66e95c844ca2c9563d755fdcd38646d3df4
- MD5 dbde2afa5000466ad652abf8e3f5ac77
- SHA1 e25c3b63682bd6721e2538d79b14ab2db13f3871
- SHA512 fe9f12bcc345467ae1185ab82aa90290e1f4f5cb7eb6d4db14ea0a5001893e3272da01a24aeda06c26cd50d87413957606f7b465938061e2c164b564d5410eca
- SSDEEP 384:PSDbVNa14m6KNUiic/KPdsehG8g9IhDbuJPk4EmXxOs9B2Qf7QGa:PB1rjp0PDg0uMs9kQDQ1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Logger.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/MessagePackLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b5c05f7b9a939ab66e11293187d55d67a9499151e2f1d3a7dcaf4f52b92ce8ae
- MD5 7c158b8f6085cc19d07f602d9b132669
- SHA1 85d44cea0f8819f98acff5b1a6a81500a834905c
- SHA512 6c74e1945f954d5d0e08439986f0826422831bac03cbda1ffd38b26b93154808f727ae095108a7a753fe2227c32b4dc9425b8d3201afc8c84fe4b7f3f2ceb142
- SSDEEP 192:loVWmIUqxhE7hHYQwBLUfa9jeycHFP/Saniseqdz/2Gr8puYJcC1ahssQfklUjsa:zmLHYH9cl1isehGr8puUMZf/2pVhuq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22194
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\MessagePack\bin\Release\MessagePackLib.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/MessagePackLib.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b5c05f7b9a939ab66e11293187d55d67a9499151e2f1d3a7dcaf4f52b92ce8ae
- MD5 7c158b8f6085cc19d07f602d9b132669
- SHA1 85d44cea0f8819f98acff5b1a6a81500a834905c
- SHA512 6c74e1945f954d5d0e08439986f0826422831bac03cbda1ffd38b26b93154808f727ae095108a7a753fe2227c32b4dc9425b8d3201afc8c84fe4b7f3f2ceb142
- SSDEEP 192:loVWmIUqxhE7hHYQwBLUfa9jeycHFP/Saniseqdz/2Gr8puYJcC1ahssQfklUjsa:zmLHYH9cl1isehGr8puUMZf/2pVhuq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22194
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\MessagePack\bin\Release\MessagePackLib.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Microsoft.Management.Infrastructure.Native.dll
- SHA256 931915926ab86a21e39bfbffb8172d306e44749657433ea139264c41726886c4
- MD5 c773df1f398065b0e2a6cb59d467ef79
- SHA1 cfd2cf46bae7fa545dc10e59c4be08e3b84bfca1
- SHA512 6a37cde0899764819b3edf1fbf4d7f3c2424e922eef95dfbbbf70cb590c4e4e1577fba9465bd029150d4fe3f8697c5c3de78182e885a5cc3b704755568aae021
- SSDEEP 6144:m6Kt8FqcbApZnSvzVo/Iu5I2Cbx+N0A/z9Ju0P0iqJO1pHJJy2:rFqfpG0P0i8O1pHJJy2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
eb:70:e8:ee:6d:62:df:5b:37:ff:71:79:62:f3:dc:b4:2c:77:13:28:c9:53:34:4a:00:ed:34:53:22:ca:b3:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Microsoft.Management.Infrastructure.Native.pdb
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=34, id=261, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Plugins/Microsoft.Management.Infrastructure.Native.dll.duplicate1
- SHA256 931915926ab86a21e39bfbffb8172d306e44749657433ea139264c41726886c4
- MD5 c773df1f398065b0e2a6cb59d467ef79
- SHA1 cfd2cf46bae7fa545dc10e59c4be08e3b84bfca1
- SHA512 6a37cde0899764819b3edf1fbf4d7f3c2424e922eef95dfbbbf70cb590c4e4e1577fba9465bd029150d4fe3f8697c5c3de78182e885a5cc3b704755568aae021
- SSDEEP 6144:m6Kt8FqcbApZnSvzVo/Iu5I2Cbx+N0A/z9Ju0P0iqJO1pHJJy2:rFqfpG0P0i8O1pHJJy2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
eb:70:e8:ee:6d:62:df:5b:37:ff:71:79:62:f3:dc:b4:2c:77:13:28:c9:53:34:4a:00:ed:34:53:22:ca:b3:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Microsoft.Management.Infrastructure.Native.pdb
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=34, id=261, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Plugins/Microsoft.Management.Infrastructure.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e35c214e1601a7f1130fe00c2dfec1e747bf4679fed88e761529b62e32c990f
- MD5 940d6e2544804d78c47167ab4e1df082
- SHA1 1aa6ede07254d0c2dfb2c6704f36e6c151e1bf13
- SHA512 35c5f8c979a22ab1985f0f5850340ee2b9dbab7d191d3982b04a3f9643a220b728ac0da7e74f5cd011e82c819433bcec23871f0160c7d997f5457ac3568ec2d2
- SSDEEP 3072:aJy4eDWpcZyswbTGWWKZWAyRFPKQIetK/bSX:aaDOxRoAyL/IeY+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
123182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.Management.Infrastructure.pdb
mscoree
_CorDllMain
Name
.text
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Microsoft.Management.Infrastructure.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e35c214e1601a7f1130fe00c2dfec1e747bf4679fed88e761529b62e32c990f
- MD5 940d6e2544804d78c47167ab4e1df082
- SHA1 1aa6ede07254d0c2dfb2c6704f36e6c151e1bf13
- SHA512 35c5f8c979a22ab1985f0f5850340ee2b9dbab7d191d3982b04a3f9643a220b728ac0da7e74f5cd011e82c819433bcec23871f0160c7d997f5457ac3568ec2d2
- SSDEEP 3072:aJy4eDWpcZyswbTGWWKZWAyRFPKQIetK/bSX:aaDOxRoAyL/IeY+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
123182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Microsoft.Management.Infrastructure.pdb
mscoree
_CorDllMain
Name
.text
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Mimikatz.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f7d43fb43cf5d97d1f99099c859e107e3dd682829c702d1a5d12a895a14bda73
- MD5 9f1fd8de9c1892dd2b9d9a4d70cd38b9
- SHA1 c931e256cdf75a75f39e35305e836ec5895c5d46
- SHA512 0a015a8a32dccf963a14a81112a8e28ad070138e949e88885856780110d77d2222c324cc34ecb42430fb35b074a711ddd32dd8fa9ac504baf1ef82ac6316b7a5
- SSDEEP 6144:NQcpENNNZka0asATFOFgiUhh7JPvUR/uJFTX26UaX/0flrjmUdHZs3PjmEsp:ycpENtiUz7l+KX9rmEs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Mimikatz.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Mimikatz.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f7d43fb43cf5d97d1f99099c859e107e3dd682829c702d1a5d12a895a14bda73
- MD5 9f1fd8de9c1892dd2b9d9a4d70cd38b9
- SHA1 c931e256cdf75a75f39e35305e836ec5895c5d46
- SHA512 0a015a8a32dccf963a14a81112a8e28ad070138e949e88885856780110d77d2222c324cc34ecb42430fb35b074a711ddd32dd8fa9ac504baf1ef82ac6316b7a5
- SSDEEP 6144:NQcpENNNZka0asATFOFgiUhh7JPvUR/uJFTX26UaX/0flrjmUdHZs3PjmEsp:ycpENtiUz7l+KX9rmEs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Mimikatz.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
303KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 be2f4fe689495ede566988126cc4cb411c2f4c73bcd4cb6c4e8ae0992b193bc0
- MD5 dadc330288233ac2da7dadfc482405c3
- SHA1 f34100fa1dabf88af87c2b872fcf99e40e93fe50
- SHA512 542127d5934378751d69827ebf0aeb1b5f71dbfb1ef6b5ff659e1273ace97ef82e07a602e6b66b604507d13b4b7634a6f244ec0094e2ea4a8310b393ac135eb1
- SSDEEP 1536:LfcC28lqJ3cLAojUVA51noA3O43aaLNQ/PGBsMq0:LfcCOsLLIVAL3O43aamGBJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Miscellaneous.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 be2f4fe689495ede566988126cc4cb411c2f4c73bcd4cb6c4e8ae0992b193bc0
- MD5 dadc330288233ac2da7dadfc482405c3
- SHA1 f34100fa1dabf88af87c2b872fcf99e40e93fe50
- SHA512 542127d5934378751d69827ebf0aeb1b5f71dbfb1ef6b5ff659e1273ace97ef82e07a602e6b66b604507d13b4b7634a6f244ec0094e2ea4a8310b393ac135eb1
- SSDEEP 1536:LfcC28lqJ3cLAojUVA51noA3O43aaLNQ/PGBsMq0:LfcCOsLLIVAL3O43aamGBJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 620424bc9397ae57e4a064b4b7dacb967ab5f7ccfd9fcc6b67aaa6197873ebe5
- MD5 ac1c965933190f1b1d05199f2b2bc25f
- SHA1 5a72a9a46929af9a59ce1097870a94f5eabffa38
- SHA512 229d6852657931c7ff36a37aa6f092cf40c1f9ca198b2c46a5f73cb4b09752817419cfb5cb8e58fe4bd6b6edc3bd6e8757fc001255028843e7274f179ef746e1
- SSDEEP 384:CVAtOA+mymtjKdSeKrqCOPPo9AdsehGOhBReDm7uAtDCJcnPucFe7I/KbEh5oU83:C3A5hKkTOZn1Q6Cl5cKSojRgQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Netstat.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 620424bc9397ae57e4a064b4b7dacb967ab5f7ccfd9fcc6b67aaa6197873ebe5
- MD5 ac1c965933190f1b1d05199f2b2bc25f
- SHA1 5a72a9a46929af9a59ce1097870a94f5eabffa38
- SHA512 229d6852657931c7ff36a37aa6f092cf40c1f9ca198b2c46a5f73cb4b09752817419cfb5cb8e58fe4bd6b6edc3bd6e8757fc001255028843e7274f179ef746e1
- SSDEEP 384:CVAtOA+mymtjKdSeKrqCOPPo9AdsehGOhBReDm7uAtDCJcnPucFe7I/KbEh5oU83:C3A5hKkTOZn1Q6Cl5cKSojRgQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/NetworkManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 67f458779771734920c3ab5c5b8109e3c898bbb6b2e53dc25fe592ac2f0437e2
- MD5 b00a078033dea154a4df2b72bc9deb7f
- SHA1 1d3b5eda9362c4f886b840b4be8b9a4493dc0570
- SHA512 b6721b52a8b5ea6e10cbba5e4c15bd87fdb1d5d1a0cb6c3fef1e6e8c7356059336da573852678e6758be84da37c4a4060aacee89b6d5bfb4eb8e952eeeee8979
- SSDEEP 196608:hR+JLEfjEH4OgYCR5+ze8obUkPEKmhRs:hRgLEfROLPzSUkRmh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31340838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
29.9MB
Virtual Size
29.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/NetworkManager.exe.config
- SHA256 7921098e47e894412fdfd0cafe0f88cc68497740998eac17c68c00129069d803
- MD5 b51c130a957051ba9fb2245bf76fb6f6
- SHA1 42181e5745daab2a0e8cf87693142828306f9bda
- SHA512 fa2ac3eff5d51aea7acc9cf6aa018a77fae295d55c5bf808c9d7048c801baf4626568f00fb001a9f2780c46dce294482cfeb3045aabe139ddc557c0d3bc11640
- MD5 SHA1 SHA512
Plugins/NetworkManager.exe.config.duplicate1
- SHA256 7921098e47e894412fdfd0cafe0f88cc68497740998eac17c68c00129069d803
- MD5 b51c130a957051ba9fb2245bf76fb6f6
- SHA1 42181e5745daab2a0e8cf87693142828306f9bda
- SHA512 fa2ac3eff5d51aea7acc9cf6aa018a77fae295d55c5bf808c9d7048c801baf4626568f00fb001a9f2780c46dce294482cfeb3045aabe139ddc557c0d3bc11640
- MD5 SHA1 SHA512
Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3de78a634f34eb74171ff05cb83d8da32dbadaaecfc6226b8847935ecc9ee55b
- MD5 af5e43fd6694d19f98b4e073df30b40b
- SHA1 a9ebe64ab2fa94dbfb6cb7657d72497072128f30
- SHA512 658eccc6b873724480063182df9599bb2fac75fe3ee218770a287696bf70185d4aba0d1f7cc7a58916bd36cbe2d2eb64425a1b0d179419faea2573770851118c
- SSDEEP 6144:NCjwXgvQfNlyE57D3g15ONiuwePZco/NawCUqB:sjyNhD3gbux5Na/B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
417418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
400KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Options.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3de78a634f34eb74171ff05cb83d8da32dbadaaecfc6226b8847935ecc9ee55b
- MD5 af5e43fd6694d19f98b4e073df30b40b
- SHA1 a9ebe64ab2fa94dbfb6cb7657d72497072128f30
- SHA512 658eccc6b873724480063182df9599bb2fac75fe3ee218770a287696bf70185d4aba0d1f7cc7a58916bd36cbe2d2eb64425a1b0d179419faea2573770851118c
- SSDEEP 6144:NCjwXgvQfNlyE57D3g15ONiuwePZco/NawCUqB:sjyNhD3gbux5Na/B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
417418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
400KB
Virtual Size
399KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d0722dc2d627978ac95d123d18b0ff637e4ef8ba414a17a41cab94e97330ab5
- MD5 b9e79f636d325cb7c6280bb9a554f149
- SHA1 996d45765032f0a545bbbf0772601a5b9e0bfb80
- SHA512 3b23b7ab53f2e626af2b2da77a892d7febb10b437eac5d2c4e6c362752be9bd27a8867d8500cc5036b7c63763282ac2e3841c9b5cc0c1b9563567f903ea1d23b
- SSDEEP 384:ZL3RGwIJampKt/a12XzFkCwdsehGwi6ZD4l9EH51DBqNvjV/1dRnB4aFAMFQHSJj:ZL3AXJt86WkfN6zRnOWAMFQHSJLf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\ProcessManager.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ProcessManager.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d0722dc2d627978ac95d123d18b0ff637e4ef8ba414a17a41cab94e97330ab5
- MD5 b9e79f636d325cb7c6280bb9a554f149
- SHA1 996d45765032f0a545bbbf0772601a5b9e0bfb80
- SHA512 3b23b7ab53f2e626af2b2da77a892d7febb10b437eac5d2c4e6c362752be9bd27a8867d8500cc5036b7c63763282ac2e3841c9b5cc0c1b9563567f903ea1d23b
- SSDEEP 384:ZL3RGwIJampKt/a12XzFkCwdsehGwi6ZD4l9EH51DBqNvjV/1dRnB4aFAMFQHSJj:ZL3AXJt86WkfN6zRnOWAMFQHSJLf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\ProcessManager.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6abe9987d07871389ed15a66b0123f9b6c6f15a8414a011aa187e7c355254592
- MD5 aa029fa3057c8fd8dd9ed8b3c3487cc3
- SHA1 e4c168a84a6e931dd16d9e59e907cb99d7608f06
- SHA512 dda2595730237192a5645b61e689c90a0684d50fb2a5a85501927041bcbcde19a51aa782db416e975c5e96b91f467dd7c8169b3c6aa91214a6c8e2bb859e2fb8
- SSDEEP 24576:OjcjNgjeWwQyTGje9rjDvDW+2mwJ7Oe97v0uyJRE4wb:OjcjN5F+e9HzsmwJ7OeQrY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1326918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 886a5b22e3f272b155e3afeca038d415ed2f1ab57dc4c4dbffc9f680490d8628
- MD5 8d08902592819068815a4445078b92e3
- SHA1 d0eea6aa4a8b1b2c61e95d87107a2b3fd109942c
- SHA512 c76f8c63d887bd026446910a92bbed7a13c3c6e1c90258da3d644d5b11a15ec947620540d73429e41b38704563ad4b32866ae8c3c6eba0e061f599a2a7e3233b
- SSDEEP 3072:Uz8SCxINKloZvaHRhBgU/5zLs9B4aI0GWNxwbo1dbJVzkeEE61Cg1fr7u/+B:Wa88oUi49Ls9BG+xNVHQHE2Cg1Dm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
291534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
277KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Regedit.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 886a5b22e3f272b155e3afeca038d415ed2f1ab57dc4c4dbffc9f680490d8628
- MD5 8d08902592819068815a4445078b92e3
- SHA1 d0eea6aa4a8b1b2c61e95d87107a2b3fd109942c
- SHA512 c76f8c63d887bd026446910a92bbed7a13c3c6e1c90258da3d644d5b11a15ec947620540d73429e41b38704563ad4b32866ae8c3c6eba0e061f599a2a7e3233b
- SSDEEP 3072:Uz8SCxINKloZvaHRhBgU/5zLs9B4aI0GWNxwbo1dbJVzkeEE61Cg1fr7u/+B:Wa88oUi49Ls9BG+xNVHQHE2Cg1Dm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
291534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
277KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7ab42add0570da2a7255341e8df28ff0d32f8f467f89f38196dd03b5bf7c438b
- MD5 80f65c889077a88b8eba07816309206f
- SHA1 8bceaad48fad25433d89865a5969d4ecfed38436
- SHA512 51dac722192b269f85da6809986d4323c6cd29eb9f76d2cf95dc1f2501ac801fb8de2419985866440fbaf102675d35562a8bdabb0e8ceaeff4b545d080ed9403
- SSDEEP 3072:SCmmsseegnQsBB33ppD7iiooqq0zYzh/0+rpk0qIpQkoL+OYylhwVJ:XmmsseegJBB33ppD7iiooqq0s4IpQkok
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RemoteCamera.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7ab42add0570da2a7255341e8df28ff0d32f8f467f89f38196dd03b5bf7c438b
- MD5 80f65c889077a88b8eba07816309206f
- SHA1 8bceaad48fad25433d89865a5969d4ecfed38436
- SHA512 51dac722192b269f85da6809986d4323c6cd29eb9f76d2cf95dc1f2501ac801fb8de2419985866440fbaf102675d35562a8bdabb0e8ceaeff4b545d080ed9403
- SSDEEP 3072:SCmmsseegnQsBB33ppD7iiooqq0zYzh/0+rpk0qIpQkoL+OYylhwVJ:XmmsseegJBB33ppD7iiooqq0s4IpQkok
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1380ddfecb74a0a6c3540778a3c62a9e318d43ac79084dd43bd1c2823f2013a2
- MD5 878d3cc940849e785ba379f91853f0b0
- SHA1 8060861e5ee6c051e0d6146f7826a049e748eb2e
- SHA512 34380161600f628658df51e755ca1ed96c783b1f56f5a72a9b50c3ef4a98498039586b95808e902763da67ba62aed561ad6d10f7bc0e6759ed92b1a6b8ddd077
- SSDEEP 768:lcIwgWCpOQx4kLLa7/fTOwpjAEM+WPWcpy4OLlz/OTThaZUa0egpuev3yX:aIUCpvUnTOwpjAEM+WPWcpy4OLlzSThC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RemoteDesktop.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1380ddfecb74a0a6c3540778a3c62a9e318d43ac79084dd43bd1c2823f2013a2
- MD5 878d3cc940849e785ba379f91853f0b0
- SHA1 8060861e5ee6c051e0d6146f7826a049e748eb2e
- SHA512 34380161600f628658df51e755ca1ed96c783b1f56f5a72a9b50c3ef4a98498039586b95808e902763da67ba62aed561ad6d10f7bc0e6759ed92b1a6b8ddd077
- SSDEEP 768:lcIwgWCpOQx4kLLa7/fTOwpjAEM+WPWcpy4OLlz/OTThaZUa0egpuev3yX:aIUCpvUnTOwpjAEM+WPWcpy4OLlzSThC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8463e1e852ded8fe6d542771bf7b0f39d5fadbb5533c31e26d993a734fba2dd
- MD5 5554d40435ad6ef99a0d085afc8c3cdd
- SHA1 4b70e9d0111c17835e0b4203431ea574f39bcd15
- SHA512 081a24945a8589e501e8d725efd5d3301202fe9a8be483bdd335fd9283079c3fa46e7125d939be38369e1c28d20faf004418f454ec1ed2023cb4e3741e3c31d3
- SSDEEP 192:+bBTOv+EgIRtac3iIs8YviqCOLUVw1xOa2ZHouB/By0t/WJIGWm9PIQ:0IvpAcFOLUqbkP/By0RE9PJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ReverseProxy.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8463e1e852ded8fe6d542771bf7b0f39d5fadbb5533c31e26d993a734fba2dd
- MD5 5554d40435ad6ef99a0d085afc8c3cdd
- SHA1 4b70e9d0111c17835e0b4203431ea574f39bcd15
- SHA512 081a24945a8589e501e8d725efd5d3301202fe9a8be483bdd335fd9283079c3fa46e7125d939be38369e1c28d20faf004418f454ec1ed2023cb4e3741e3c31d3
- SSDEEP 192:+bBTOv+EgIRtac3iIs8YviqCOLUVw1xOa2ZHouB/By0t/WJIGWm9PIQ:0IvpAcFOLUqbkP/By0RE9PJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RunPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6dee3bf3eaa9e674a86babb4c5e13620f80e0fe8934c9e03f1035c652f50ca4e
- MD5 b3ac8b30a0e5ebb04aee8fc11da5ba56
- SHA1 66fea52e544f4989e44d0e7dca796acc529e0c5c
- SHA512 a60c10ab4bb6a0ad426b7bb95617a53fa27f0eabed932aa8087c58a5914861dcc7c4c2559b2784e8f1460980ac0ee7cfb8edd243b443145185818acfe7a614ae
- SSDEEP 768:Of1YG8iqLEt83H4xkrofehyXsGgEeEU8/kFFf9PZfj6HwTdN37BboIHcpy:mYZiAHrhyXeFIwTdN37DB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RunPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RunPlug.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6dee3bf3eaa9e674a86babb4c5e13620f80e0fe8934c9e03f1035c652f50ca4e
- MD5 b3ac8b30a0e5ebb04aee8fc11da5ba56
- SHA1 66fea52e544f4989e44d0e7dca796acc529e0c5c
- SHA512 a60c10ab4bb6a0ad426b7bb95617a53fa27f0eabed932aa8087c58a5914861dcc7c4c2559b2784e8f1460980ac0ee7cfb8edd243b443145185818acfe7a614ae
- SSDEEP 768:Of1YG8iqLEt83H4xkrofehyXsGgEeEU8/kFFf9PZfj6HwTdN37BboIHcpy:mYZiAHrhyXeFIwTdN37DB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RunPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RunPlug_NET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 130c4a6507d34e0b073cec9065a220dcbd31ba0aad57cbaee1ef76e227b17ef8
- MD5 3ac08c9bb02d3f4a577c350eaed5fe85
- SHA1 8ed85ea7be7d3d3355e173f4ff6114582773e52f
- SHA512 fb7b5d5eb9cc30016e61c44a9de1547f28ed1d2a472707a1e0af87508b6c986cdbb9ecc31feecdd8b66d9b726194c9470706d5f26b571e7ff6dedcc123beab5e
- SSDEEP 384:haeUn0fmF3urwGkb8dsehG109ZDIuNKpIDRMeV+tAK+gFBq:ge8NwwDItznK69Mq+u5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RunPlug_NET.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RunPlug_NET.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 130c4a6507d34e0b073cec9065a220dcbd31ba0aad57cbaee1ef76e227b17ef8
- MD5 3ac08c9bb02d3f4a577c350eaed5fe85
- SHA1 8ed85ea7be7d3d3355e173f4ff6114582773e52f
- SHA512 fb7b5d5eb9cc30016e61c44a9de1547f28ed1d2a472707a1e0af87508b6c986cdbb9ecc31feecdd8b66d9b726194c9470706d5f26b571e7ff6dedcc123beab5e
- SSDEEP 384:haeUn0fmF3urwGkb8dsehG109ZDIuNKpIDRMeV+tAK+gFBq:ge8NwwDItznK69Mq+u5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\RunPlug_NET.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d3bdabb5bd86116f1ef0a2434ffa64d396f38a5d85d0364ef2cf9528fabb9efa
- MD5 c0b2ee7f8af5471cf9ab803f864626cf
- SHA1 ee0b2a4b230ada5d025d845a70517f2fa7baf2a9
- SHA512 cf1c2a2c7744a0187887dd33b589c79c6dde107950400bb14ca8e27525ed53e61a929ea226904f1bb42d9c8b92aac296ce5c69510a4233b6e1397be6c7abed3e
- SSDEEP 384:dhDbqyt/zmEC19hyljh6AvAHtu/dsehG8rQhiU7pusRqrahdc/IGzqUAkc6666x3:jmBZ9w6u/NJUHK/7Gpkc6666x7Kz+z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34050
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ce4754ddd4cb7906beef4df79324ac34af939244e7aad1a373447502ee482ba
- MD5 cb245d11129a51099a3a62e670752c0d
- SHA1 300522e0fe48f11957d1642f4da0a8633f0e76e8
- SHA512 bcce7dc271c78a5872509fe854888436fef85e39737006a4f086d2e9699dd4efb31f517ff99fcc42babe86295355779ea4785cda4df3247a275b657f1fd5d47b
- SSDEEP 384:zk+medTSnL3poZadsehGUDfhD0um5MZK4FknwR1H3Cw8NIuHWlIk9pI1U5:zkZedmLOabp5KnwHCrII29pI4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\SendMemory.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SendMemory.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ce4754ddd4cb7906beef4df79324ac34af939244e7aad1a373447502ee482ba
- MD5 cb245d11129a51099a3a62e670752c0d
- SHA1 300522e0fe48f11957d1642f4da0a8633f0e76e8
- SHA512 bcce7dc271c78a5872509fe854888436fef85e39737006a4f086d2e9699dd4efb31f517ff99fcc42babe86295355779ea4785cda4df3247a275b657f1fd5d47b
- SSDEEP 384:zk+medTSnL3poZadsehGUDfhD0um5MZK4FknwR1H3Cw8NIuHWlIk9pI1U5:zkZedmLOabp5KnwHCrII29pI4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\SendMemory.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0208b783efaf3854f07a31f9bcbb46f9afcd80b12e2ddb8001a9faeccfc2d0f0
- MD5 4e83c528d307d3b5da2aed5abbe3ffe8
- SHA1 2e84ceccecb30378f84be898711f15b4e157e045
- SHA512 378f75db718891fd214776d7d5a2bad0c493dcf5c4413308554d2fe3283170aef55de1ff4bdbc0d417e5bef4f6acd3370c48bb33c37f360a606baeff12e6f72a
- SSDEEP 49152:fQmXVLJwIcWpaaPMcJs4p5LchZSv7vakU+6rRbG3PZbyh8pCuneK7OXCDO9OxuXS:fQmFCHtans4zcjSv7HUhKP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6445310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/System.Management.Automation.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0208b783efaf3854f07a31f9bcbb46f9afcd80b12e2ddb8001a9faeccfc2d0f0
- MD5 4e83c528d307d3b5da2aed5abbe3ffe8
- SHA1 2e84ceccecb30378f84be898711f15b4e157e045
- SHA512 378f75db718891fd214776d7d5a2bad0c493dcf5c4413308554d2fe3283170aef55de1ff4bdbc0d417e5bef4f6acd3370c48bb33c37f360a606baeff12e6f72a
- SSDEEP 49152:fQmXVLJwIcWpaaPMcJs4p5LchZSv7vakU+6rRbG3PZbyh8pCuneK7OXCDO9OxuXS:fQmFCHtans4zcjSv7HUhKP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6445310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/System.Management.Automation.dll.duplicate2
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20a8d5e8c1ddff881a0767b8ed1ee9d2b71a21f780617829276575f06dc5a662
- MD5 c0e9bed8ccbba27661deba134c09bc1d
- SHA1 2023030938c177d1ec171fa31e133b9a167f5e42
- SHA512 76ff61d700a513b522af24a92f248b56be1a870ff3dd677ddc43c27150fa83b53bcde92a09f4a44032c0ff90b2921af6e1f5cf50e48904912342a84c91192215
- SSDEEP 49152:tVhkjNsFEV9eu+no876Z3eSJeJTAB2Px+/GSOvZGyG8qhunYq7gXCD/zOkpNQe0b:BkjN4EJ+mNTJSUcUPT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6429838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SystemInfo.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7904175baad249774783103e75f645349e67a17e67758e6a0509a96dd3fd10db
- MD5 aa9ca423fce14a6a3938b9640ff92af4
- SHA1 5cb067d515ebf3424b5229737cb2592ecd99b56c
- SHA512 582f0e23b2d41bca71d447c59f488122ac89cca298eedc51f5140932e615275cdbbad6e7b27b2efe51968d9d724d4dc32b40c27eeca6cce1ea1ea6acf5a46f8a
- SSDEEP 768:FNJKtshPUoHWWiSxLBInDUFoM3npQ2LU0jdAuw:FeopHZkDUF13n6SUwdAZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\SystemInfo.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SystemInfo.dll.duplicate1
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7904175baad249774783103e75f645349e67a17e67758e6a0509a96dd3fd10db
- MD5 aa9ca423fce14a6a3938b9640ff92af4
- SHA1 5cb067d515ebf3424b5229737cb2592ecd99b56c
- SHA512 582f0e23b2d41bca71d447c59f488122ac89cca298eedc51f5140932e615275cdbbad6e7b27b2efe51968d9d724d4dc32b40c27eeca6cce1ea1ea6acf5a46f8a
- SSDEEP 768:FNJKtshPUoHWWiSxLBInDUFoM3npQ2LU0jdAuw:FeopHZkDUF13n6SUwdAZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\SystemInfo.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/browser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 249dadf328b9517c22f9b9b38dab676a2807a6f7b3d772eb5f1382dcfb283515
- MD5 589eec1b0d6046108066cef845647dd1
- SHA1 3c5883395dfa165244f79587fdcc30546f0c7f7a
- SHA512 667f7c5fe9345b456455cd114887912583fa83d5b91a9d74f2a80f54f24a79bbdeb25f780895975b66200178ad691cbeb4afd1e19f89619f6961827a36ee1324
- SSDEEP 1536:IlKCphhfFw1hr/b+gwyNFVe1nICgkS02u2dOt43vNHxPr0eSn7iVU:IlvphhfFw1lKgwyNXe1nICgkS02Gt4/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
93538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Plugins\browser.pdb
mscoree
_CorDllMain
Name
.text
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/x64/SQLite.Interop.dll
- IMPHASH 6f6d0bdadb839e140d7a41e8d1e05c22
- SHA256 96c952efa25720eec63437df20e20b8959dde5230c6f1d5c30be68cf72665532
- MD5 df5c214d9a436a6a96c93cb8927194e4
- SHA1 70110af5cd1600ca5552c3ba69a0ac58e33750e4
- SHA512 2207725c056f109dffa95f2ac2bd2ffb8131232ce558173c1ef608d715922e5166f2974ce3a2e132cf405317d1502a14a71fbe895334707fd96b9350825d3b86
- SSDEEP 24576:NGOu/gMGBbocBpflBQO8wgLGYS/YxwFtXBCtt2Ry0X76AQKKf:cGBBrQO8R6YS/YxeBCO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
10596
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet\bin\2010\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MapViewOfFile
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFileAttributesW
GetFullPathNameW
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
EncodePointer
DecodePointer
GetTimeZoneInformation
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
GetModuleHandleW
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameW
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
RaiseException
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
interop_compileoption_get
interop_compileoption_used
interop_libversion
interop_sourceid
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_finish_interop
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_double_interop
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_int64_interop
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_parameter_name_interop
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_close_interop
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_changes_interop
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_interop
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_database_name16_interop
sqlite3_column_database_name_interop
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_decltype16_interop
sqlite3_column_decltype_interop
sqlite3_column_double
sqlite3_column_double_interop
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64_interop
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_name16_interop
sqlite3_column_name_interop
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_origin_name16_interop
sqlite3_column_origin_name_interop
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_table_name16_interop
sqlite3_column_table_name_interop
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_text16_interop
sqlite3_column_text_interop
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_collcompare_interop
sqlite3_context_collseq_interop
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_disposable_module_interop
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_interop
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_cursor_rowid_interop
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errmsg_interop
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_finalize_interop
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_index_column_info_interop
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_last_insert_rowid_interop
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_malloc_size_interop
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_highwater_interop
sqlite3_memory_used
sqlite3_memory_used_interop
sqlite3_mprintf
sqlite3_msize
sqlite3_msize_interop
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open16_interop
sqlite3_open_interop
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_interop
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_interop
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_reset_interop
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_double_interop
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_int64_interop
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_table_column_metadata_interop
sqlite3_table_cursor_interop
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_double_interop
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_int64_interop
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16_interop
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_text_interop
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_apply_v2
sqlite3changeset_apply_v2_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3changeset_start_v2
sqlite3changeset_start_v2_strm
sqlite3rebaser_configure
sqlite3rebaser_create
sqlite3rebaser_delete
sqlite3rebaser_rebase
sqlite3rebaser_rebase_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_config
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=110, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Plugins/x86/SQLite.Interop.dll
- IMPHASH 43cf4064308c8cffa2acc646c51eabf0
- SHA256 ba0bf347cd8966e53efa282df84a9f966bbc2ff99642ee0be5b2a86644bb7f5e
- MD5 c09a5ff0cf2613ebcf29357be05c9bc3
- SHA1 0ed14fa706e2e46933c4dbc27c8329cd99201070
- SHA512 99eda404ec421756049f5d7fc42c27079187c6afb35ab125f4b8a8f9764687bf1777bac018ad0b7fd7640b1215f0b3a2741689ead569bec938aef428510ccaf8
- SSDEEP 24576:wFnIJ6GG4PYmGL/mnOkumid0vuP0CKJUvo6FywlapXf7bGKHu9b0D:wxIJGjmGL/SOSWP1AUsHGn0D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\dev\sqlite\dotnet\bin\2010\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
MapViewOfFile
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
HeapValidate
GetFullPathNameW
ExitThread
CreateThread
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
GetModuleFileNameW
RtlUnwind
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_blob_close_interop@4
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_msize_interop@8
_sqlite3_open16_interop@20
_sqlite3_open_interop@20
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_apply_v2
sqlite3changeset_apply_v2_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3changeset_start_v2
sqlite3changeset_start_v2_strm
sqlite3rebaser_configure
sqlite3rebaser_create
sqlite3rebaser_delete
sqlite3rebaser_rebase
sqlite3rebaser_rebase_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_config
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=108, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Stub/Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 534bb4d55e186ce50c469f0e41542cdf2eafa7cf74fd63e6992020de6a7eeb4d
- MD5 1ef903cbeb58e3a2f4a56b9e8850076d
- SHA1 9b7114b22b712368b840ec835b4a9ac8e77381e8
- SHA512 b92c78eee5e06cb16599f60646dc67dbc1ec17a77f4fe9e9c54fddee2ff6a3d46a36a794d11af8d062b520c07d06de540fb23158f76c0a6738f371b6a94e2124
- SSDEEP 1536:EWVhTRW58wKxGSGUQgPbRJDEAI9t0VclN:EWVHW55KxGSiQPDbI9tmY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Stub\Client.pdb
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/Client.exe.config
- SHA256 d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
- MD5 c16b0746faa39818049fe38709a82c62
- SHA1 3fa322fe6ed724b1bc4fd52795428a36b7b8c131
- SHA512 cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
- MD5 SHA1 SHA512
Stub/SourceDir/Stub/Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 534bb4d55e186ce50c469f0e41542cdf2eafa7cf74fd63e6992020de6a7eeb4d
- MD5 1ef903cbeb58e3a2f4a56b9e8850076d
- SHA1 9b7114b22b712368b840ec835b4a9ac8e77381e8
- SHA512 b92c78eee5e06cb16599f60646dc67dbc1ec17a77f4fe9e9c54fddee2ff6a3d46a36a794d11af8d062b520c07d06de540fb23158f76c0a6738f371b6a94e2124
- SSDEEP 1536:EWVhTRW58wKxGSGUQgPbRJDEAI9t0VclN:EWVHW55KxGSiQPDbI9tmY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
E:\程序\CyberSpike\Binaries\Release\Stub\Client.pdb
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/SourceDir/Stub/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8e358d5d5b33d359037e59655ceef18b59bde0a6bc825b0ce61a9a568193d07b
- MD5 fb4d2b6405c5469f3895236bb5b3e658
- SHA1 9bac0e56ba4b51857195009173aa2d0ccfa72cdb
- SHA512 1a841aa1e3cec2d977b87db940aa131b91c1b6205e231a67aa10028c3db1a5aab650b0f5a4fb338ed6126f1a3a79c9007f10a57136b6ae181c39439ca4074ec2
- SSDEEP 768:mIp8Z2m+JSXBRgA6Q5A8EsiSoaLRPYB90:mCe2xbjs1LRQI
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
E:\程序\CyberSpike\Binaries\Release\Stub\Client.pdb
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/SourceDir/Stub/Client.exe.config
- SHA256 d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
- MD5 c16b0746faa39818049fe38709a82c62
- SHA1 3fa322fe6ed724b1bc4fd52795428a36b7b8c131
- SHA512 cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
- MD5 SHA1 SHA512
Stub/SourceDir/Stub/Load.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a17ec1b94be2cef52a994d94fb6ac16d8e21c484cc42358f863c5a2b2ebd25fd
- MD5 0e2704a09d125fe9c6de5c4ee1b23ff5
- SHA1 81e4492abb24d268feebff2a4857a97dd61129b3
- SHA512 7a3c3ea2bef23ceb130f14014452bb69026b3b2a903f4d166694173750c6a589d715b5bd154221a2c60addad064381f19414b47f4d2b9ffb5dccd2b1d1e2983a
- SSDEEP 48:6DHvbNkP/NMvYcb7OsitoplMFbNFapfbNtm:kmgX2IUgzNt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/SourceDir/Stub/Load.exe.config
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- MD5 SHA1 SHA512