XWorm.V5.6.zip
- SHA256 8ba9b12031e5f17c36580506ed7ee0c396175a7f569dafe47b800fbb83624a61
Behavioral task
behavioral1
Sample
Xwrom/XWorm V5.6.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
60 seconds
General
- Target XWorm.V5.6.zip
- Size 17.3MB
- Sample240715-txazwasbpb
- SHA256 8ba9b12031e5f17c36580506ed7ee0c396175a7f569dafe47b800fbb83624a61
- MD5 f5afa2b8b3702b8a63cc8f3ef5347c92
- SHA1 a2d3c8e8c082e05157db8e32d55c58ab22adb503
- SHA512 c1b84587484f89e5183e5d97819a28568ecd47ae55fdbfd53cc9493379c0110a2a1bb06cb5cafc35f44842f71dc50b02831474aed9cbb06b4043791f9893c13a
- SSDEEP 393216:GyaLq4XFeuBc9Q+FW7GMm389HCjIR7kjJPGAKbtUb8qcz:Gy74XDBYQw6GP2kjNKtpz
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
C2
-
127.0.0.1:59769
-
usr-contemporary.gl.at.ply.gg:59769
Attributes
-
Install_directory
%Userprofile%
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/Xwrom/Guna.UI2.dll family_agenttesla - Agenttesla family
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/Xwrom/Plugins/Options.dll disable_win_def - Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/Xwrom/RES/XWorm.Resources.resources family_xworm static1/unpack001/Xwrom/RES/Xworm error.exe family_xworm - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/Xwrom/Plugins/Recovery.dll family_stormkitty - Stormkitty family
- Xworm family
- Unsigned PE 46 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xwrom/FastColoredTextBox.dll unpack001/Xwrom/GMap.NET.Core.dll unpack001/Xwrom/GMap.NET.WindowsForms.dll unpack001/Xwrom/IconExtractor.dll unpack001/Xwrom/Plugins/ActiveWindows.dll unpack001/Xwrom/Plugins/Chat.dll unpack001/Xwrom/Plugins/Chromium.dll unpack001/Xwrom/Plugins/Clipboard.dll unpack001/Xwrom/Plugins/Cmstp-Bypass.dll unpack001/Xwrom/Plugins/FileManager.dll unpack001/Xwrom/Plugins/FilesSearcher.dll unpack001/Xwrom/Plugins/HBrowser.dll unpack001/Xwrom/Plugins/HRDP.dll unpack001/Xwrom/Plugins/HVNC.dll unpack001/Xwrom/Plugins/HVNCMemory.dll unpack001/Xwrom/Plugins/HiddenApps.dll unpack001/Xwrom/Plugins/Informations.dll unpack001/Xwrom/Plugins/Keylogger.dll unpack001/Xwrom/Plugins/Maps.dll unpack001/Xwrom/Plugins/MessageBox.dll unpack001/Xwrom/Plugins/Microphone.dll unpack001/Xwrom/Plugins/Ngrok-Installer.dll unpack001/Xwrom/Plugins/Options.dll unpack001/Xwrom/Plugins/Pastime.dll unpack001/Xwrom/Plugins/Performance.dll unpack001/Xwrom/Plugins/ProcessManager.dll unpack001/Xwrom/Plugins/Programs.dll unpack001/Xwrom/Plugins/Ransomware.dll unpack001/Xwrom/Plugins/Recovery.dll unpack001/Xwrom/Plugins/Regedit.dll unpack001/Xwrom/Plugins/RemoteDesktop.dll unpack001/Xwrom/Plugins/ReverseProxy.dll unpack001/Xwrom/Plugins/RunPE.dll unpack001/Xwrom/Plugins/ServiceManager.dll unpack001/Xwrom/Plugins/Shell.dll unpack001/Xwrom/Plugins/StartupManager.dll unpack001/Xwrom/Plugins/Stealer.dll unpack001/Xwrom/Plugins/TCPConnections.dll unpack001/Xwrom/Plugins/UACBypass.dll unpack001/Xwrom/Plugins/VB.NET Compiler.dll unpack001/Xwrom/Plugins/VoiceChat.dll unpack001/Xwrom/Plugins/WSound.dll unpack001/Xwrom/Plugins/WebCam.dll unpack001/Xwrom/RES/Xworm error.exe unpack001/Xwrom/SimpleObfuscator.dll unpack001/Xwrom/XWorm V5.6.exe
File Explorer
-
XWorm.V5.6.zip.zip 17.3MB
-
Xwrom/Background.png.png 924KB
-
Xwrom/ClientsFolder/BE0980072E6EBA5FF6EF/Recovery/Chromium_04-15-2024 21;13;31;638.txt7KB
-
Xwrom/ClientsFolder/D8C2D8B2335F89840F44/Recovery/Chromium_05-04-2024 14;59;17;811.txt2KB
-
Xwrom/ClientsFolder/D8C2D8B2335F89840F44/Recovery/DiscordToken_05-04-2024 14;59;35;623.txt70B
-
Xwrom/ClientsFolder/D8C2D8B2335F89840F44/Recovery/WifiKeys_05-04-2024 15;05;33;613.txt235B
-
Xwrom/FastColoredTextBox.dll.dll 333KB
-
Xwrom/Fixer.bat122B
-
Xwrom/GMap.NET.Core.dll.dll 2.9MB
-
Xwrom/GMap.NET.WindowsForms.dll.dll 147KB
-
Xwrom/GeoIP.dat1.2MB
-
Xwrom/Guna.UI2.dll.dll 1.9MB
-
Xwrom/IconExtractor.dll.dll 10KB
-
Xwrom/Icons/icon (1).ico97KB
-
Xwrom/Icons/icon (10).ico115KB
-
Xwrom/Icons/icon (11).ico9KB
-
Xwrom/Icons/icon (12).ico9KB
-
Xwrom/Icons/icon (13).ico361KB
-
Xwrom/Icons/icon (14).ico361KB
-
Xwrom/Icons/icon (15).ico361KB
-
Xwrom/Icons/icon (16).ico97KB
-
Xwrom/Icons/icon (17).ico66KB
-
Xwrom/Icons/icon (2).ico112KB
-
Xwrom/Icons/icon (3).ico131KB
-
Xwrom/Icons/icon (4).ico125KB
-
Xwrom/Icons/icon (5).ico100KB
-
Xwrom/Icons/icon (6).ico106KB
-
Xwrom/Icons/icon (7).ico164KB
-
Xwrom/Icons/icon (8).ico108KB
-
Xwrom/Icons/icon (9).ico264KB
-
Xwrom/Logs/ErrorLogs.txt224B
-
Xwrom/NAudio.dll.dll 502KB
-
Xwrom/Newtonsoft.Json.dll.dll 695KB
-
Xwrom/Plugins/ActiveWindows.dll.dll 14KB
-
Xwrom/Plugins/Chat.dll.dll 18KB
-
Xwrom/Plugins/Chromium.dll.dll 32KB
-
Xwrom/Plugins/Clipboard.dll.dll 14KB
-
Xwrom/Plugins/Cmstp-Bypass.dll.dll 11KB
-
Xwrom/Plugins/FileManager.dll.dll 679KB
-
Xwrom/Plugins/FilesSearcher.dll.dll 478KB
-
Xwrom/Plugins/HBrowser.dll.dll 25KB
-
Xwrom/Plugins/HRDP.dll.dll 1.7MB
-
Xwrom/Plugins/HVNC.dll.dll 58KB
-
Xwrom/Plugins/HVNCMemory.dll.dll 39KB
-
Xwrom/Plugins/HiddenApps.dll.dll 45KB
-
Xwrom/Plugins/Informations.dll.dll 22KB
-
Xwrom/Plugins/Keylogger.dll.dll 17KB
-
Xwrom/Plugins/Maps.dll.dll 15KB
-
Xwrom/Plugins/MessageBox.dll.dll 14KB
-
Xwrom/Plugins/Microphone.dll.dll 540KB
-
Xwrom/Plugins/Ngrok-Installer.dll.dll 400KB
-
Xwrom/Plugins/Options.dll.dll .ps1 30KB
-
Xwrom/Plugins/Pastime.dll.dll 17KB
-
Xwrom/Plugins/Performance.dll.dll 16KB
-
Xwrom/Plugins/ProcessManager.dll.dll 19KB
-
Xwrom/Plugins/Programs.dll.dll 13KB
-
Xwrom/Plugins/Ransomware.dll.dll 20KB
-
Xwrom/Plugins/Recovery.dll.dll 1.1MB
-
Xwrom/Plugins/Regedit.dll.dll 15KB
-
Xwrom/Plugins/RemoteDesktop.dll.dll 18KB
-
Xwrom/Plugins/ReverseProxy.dll.dll 16KB
-
Xwrom/Plugins/RunPE.dll.dll 11KB
-
Xwrom/Plugins/ServiceManager.dll.dll 14KB
-
Xwrom/Plugins/Shell.dll.dll 14KB
-
Xwrom/Plugins/StartupManager.dll.dll 188KB
-
Xwrom/Plugins/Stealer.dll.dll 3.3MB
-
Xwrom/Plugins/TCPConnections.dll.dll 16KB
-
Xwrom/Plugins/UACBypass.dll.dll 10KB
-
Xwrom/Plugins/VB.NET Compiler.dll.dll 14KB
-
Xwrom/Plugins/VoiceChat.dll.dll 539KB
-
Xwrom/Plugins/WSound.dll.dll 539KB
-
Xwrom/Plugins/WebCam.dll.dll 209KB
-
Xwrom/RES/U40957361f7481084776e6aedU9f0U195KB
-
Xwrom/RES/XWorm.ACT.resources67KB
-
Xwrom/RES/XWorm.About.resources3.3MB
-
Xwrom/RES/XWorm.Builder.resources107KB
-
Xwrom/RES/XWorm.Chat.resources99KB
-
Xwrom/RES/XWorm.Clipboard.resources113KB
-
Xwrom/RES/XWorm.Clipper.resources106KB
-
Xwrom/RES/XWorm.CustomOpen.resources101KB
-
Xwrom/RES/XWorm.DDosAttack.resources99KB
-
Xwrom/RES/XWorm.EditReg.resources107KB
-
Xwrom/RES/XWorm.FM.resources178KB
-
Xwrom/RES/XWorm.FilesSearcher.resources151KB
-
Xwrom/RES/XWorm.Ftp.resources109KB
-
Xwrom/RES/XWorm.Fun.resources99KB
-
Xwrom/RES/XWorm.HApps.resources128KB
-
Xwrom/RES/XWorm.HBrowser.resources92KB
-
Xwrom/RES/XWorm.HRDP.resources103KB
-
Xwrom/RES/XWorm.HVNC.resources105KB
-
Xwrom/RES/XWorm.Hash.resources99KB
-
Xwrom/RES/XWorm.Hosts.resources102KB
-
Xwrom/RES/XWorm.INFO.resources171KB
-
Xwrom/RES/XWorm.Keylogger.resources124KB
-
Xwrom/RES/XWorm.MBox.resources107KB
-
Xwrom/RES/XWorm.MIC.resources119KB
-
Xwrom/RES/XWorm.Main.resources1.8MB
-
Xwrom/RES/XWorm.Maps.resources140KB
-
Xwrom/RES/XWorm.Performance.resources106KB
-
Xwrom/RES/XWorm.Port.resources139KB
-
Xwrom/RES/XWorm.ProcessV.resources67KB
-
Xwrom/RES/XWorm.Programs.resources164KB
-
Xwrom/RES/XWorm.Proxy.resources108KB
-
Xwrom/RES/XWorm.Ransomware.resources101KB
-
Xwrom/RES/XWorm.Registry.resources169KB
-
Xwrom/RES/XWorm.RemoteDesktop.resources99KB
-
Xwrom/RES/XWorm.Resources.resources.vbs 1.6MB
-
Xwrom/RES/XWorm.RunPE.resources103KB
-
Xwrom/RES/XWorm.ServiceManager.resources221KB
-
Xwrom/RES/XWorm.Shell.resources130KB
-
Xwrom/RES/XWorm.Sound.resources189KB
-
Xwrom/RES/XWorm.StartupManager.resources167KB
-
Xwrom/RES/XWorm.TBotNotify.resources100KB
-
Xwrom/RES/XWorm.TXT.resources101KB
-
Xwrom/RES/XWorm.TcpConnectionForm.resources169KB
-
Xwrom/RES/XWorm.ToolsBox.resources241KB
-
Xwrom/RES/XWorm.VBCode.resources174KB
-
Xwrom/RES/XWorm.VoiceChat.resources121KB
-
Xwrom/RES/XWorm.WebCam.resources100KB
-
Xwrom/RES/XWorm.ngrok.resources101KB
-
Xwrom/RES/Xworm error.exe.exe 83KB
-
Xwrom/SimpleObfuscator.dll.dll 1.4MB
-
Xwrom/Sounds/Chat.wav45KB
-
Xwrom/Sounds/Intro.wav238KB
-
Xwrom/XWorm V5.6.exe.exe 476KB
-
Xwrom/XWorm V5.6.exe.config.xml 183B
Xwrom/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- MD5 SHA1 SHA512 SSDEEP
Xwrom/ClientsFolder/BE0980072E6EBA5FF6EF/Recovery/Chromium_04-15-2024 21;13;31;638.txt
- SHA256 c835e2e90b99a7deb0dbbeba39fa95283790d55b6bad3a0d757681b864a98a8c
- MD5 9f3e55282015bbe1046e8d396b0179c7
- SHA1 98d5121979a78273e9879dd832d629f8487c8b7e
- SHA512 bca13fcbda400ae37b596585cd325b870a55803df00a47f23b3e47259a50cd506ec5a25a61e84b55b511a04d1290c9d9f539fdc1454fd7c234bd94647b427919
- SSDEEP 96:I69wGygMoqoW0qcRyE0ZFJDnTAJyg0qFJDeqx9wRWEWkDRx:I69nzW2Cps6u92WUx
- MD5 SHA1 SHA512 SSDEEP
Xwrom/ClientsFolder/D8C2D8B2335F89840F44/Recovery/Chromium_05-04-2024 14;59;17;811.txt
- SHA256 a6b8de88d6d67139b0e7b6d7382e4b2592d2c6e399998e44b3540388a6f74323
- MD5 388b37780602f750a615b1668a2bc59f
- SHA1 035b5773a8487aa41b231f28e68639e350a66be0
- SHA512 1d0e2cc322129d2969dc5b32ef418947cec5da57add2b15c90d34297ddde6cc716718d3b7e3bbc9f773149ff91fc68f9f5b2e5f151e1da8d86d6160c25719167
- MD5 SHA1 SHA512
Xwrom/ClientsFolder/D8C2D8B2335F89840F44/Recovery/DiscordToken_05-04-2024 14;59;35;623.txt
- SHA256 eb0e1274f4db33eb693baf507a92545678c829dd1cf9df87722539625e416515
- MD5 bbd715743cfe73fde1132212b1843ba0
- SHA1 5615d8cd4b7879883051e2172b529be5dcb28212
- SHA512 36bffb4a2b1eaeb4b42daeec770faa3de3b5a9364eb2b0abe0941e9bc42b421f3446f88a9bf9ead2f89c5ddbf3545042c4049eece03c2498749f36e1fdc73abd
- MD5 SHA1 SHA512
Xwrom/ClientsFolder/D8C2D8B2335F89840F44/Recovery/WifiKeys_05-04-2024 15;05;33;613.txt
- SHA256 d1e194235a25a1d55dc4a16ece2f1c1071bd1e2db15c74cdc696e1745da82600
- MD5 5cee24cf4af262e9df2999278be5d147
- SHA1 7f85bccc1f69a8317040031df655c2b5de41d7ff
- SHA512 a07c8eb6e52e2a88e4b66ee286aa04c6dac022e411200091c390878bf5e73795c0573d0e1d719ba4568c91af24258763bb03c0791b93b0119846308ff55147e1
- MD5 SHA1 SHA512
Xwrom/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Fixer.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- MD5 SHA1 SHA512
Xwrom/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Logs/ErrorLogs.txt
- SHA256 633eef2d5302c0c224cd71aeb7d29901564f30e5a9b3d31cc0a55c1c6eeb3d5c
- MD5 f77f4fb386c891a5640cf26473cebea4
- SHA1 db2fc673ed4b895561caf8670d1e40204a3d6fa6
- SHA512 47fe461ccb295c95d951c0499d943febdc7b9b41923bd03b9b0876e52abc220cde47dd4a3ff13e98f991636fc21b6ef5297b679dde8dcd38b51cd0648eea38f9
- MD5 SHA1 SHA512
Xwrom/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- MD5 SHA1 SHA512 SSDEEP
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52
- MD5 5a766a4991515011983ceddf7714b70b
- SHA1 4eb00ae7fe780fa4fe94cedbf6052983f5fd138b
- SHA512 4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8
- SSDEEP 384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492
- MD5 59f75c7ffaccf9878a9d39e224a65adf
- SHA1 46b0f61a07e85e3b54b728d9d7142ddc73c9d74b
- SHA512 80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8
- SSDEEP 384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
- MD5 edb2f0d0eb08dcd78b3ddf87a847de01
- SHA1 cc23d101f917cad3664f8c1fa0788a89e03a669c
- SHA512 8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
- SSDEEP 768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
- MD5 831eb0de839fc13de0abab64fe1e06e7
- SHA1 53aad63a8b6fc9e35c814c55be9992abc92a1b54
- SHA512 2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee
- SSDEEP 192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
- MD5 cf15259e22b58a0dfd1156ab71cbd690
- SHA1 3614f4e469d28d6e65471099e2d45c8e28a7a49e
- SHA512 7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38
- SSDEEP 192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd
- MD5 641a8b61cb468359b1346a0891d65b59
- SHA1 2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0
- SHA512 042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee
- SSDEEP 12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/FilesSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b
- MD5 6f8f1621c16ac0976600146d2217e9d2
- SHA1 b6aa233b93aae0a17ee8787576bf0fbc05cedde4
- SHA512 eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a
- SSDEEP 6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/HBrowser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c
- MD5 f0e921f2f850b7ec094036d20ff9be9b
- SHA1 3b2d76d06470580858cc572257491e32d4b021c0
- SHA512 16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3
- SSDEEP 384:tp33X3L5/QrX8nB9d13+6HcLReMWaFnp9l/1DRVTbg0Ut4xh+TfYMoKAB1R:tR3nL5/QrQ13kRR9bTbz+DYMoFBf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de
- MD5 f27b6e8cf5afa8771c679b7a79e11a08
- SHA1 6c3fcf45e35aaf6b747f29a06108093c284100da
- SHA512 0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33
- SSDEEP 24576:3rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:WHZ5pdqYH8ia6GcKuR7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96
- MD5 30eb33588670191b4e74a0a05eecf191
- SHA1 08760620ef080bb75c253ba80e97322c187a6b9f
- SHA512 820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97
- SSDEEP 768:XsKVHERYe3lgPPTxOEUyP82P6mUrYrthCO7h2ORS9SQdHfiLpmbG8p:8K1ERYe0TEE3P82P1EMS36Kp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/HVNCMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4
- MD5 065f0830d1e36f8f44702b0f567082e8
- SHA1 724c33558fcc8ecd86ee56335e8f6eb5bfeac0db
- SHA512 bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545
- SSDEEP 768:EofXMCBlQ6Kms0n6GE30IU1YKtq9oQog1zq/xPP7:EyXTa6hEZU1YKwo8Uj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/HiddenApps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea
- MD5 ba2141a7aefa1a80e2091bf7c2ca72db
- SHA1 9047b546ce9c0ea2c36d24a10eb31516a24a047d
- SHA512 91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c
- SSDEEP 768:aEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ffiCIT:SdmvWHVGMVwtYRtpl/x5qIXdEdXiCK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b
- MD5 67a884eeb9bd025a1ef69c8964b6d86f
- SHA1 97e00d3687703b1d7cc0939e45f8232016d009d9
- SHA512 52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7
- SSDEEP 384:SCUEeL4D574MvGjydqXwxDJop0n3TmyxhxJNgSg4PbOFsK:SCXeL4DSjydqXwx1FjfNfwr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a
- MD5 246f7916c4f21e98f22cb86587acb334
- SHA1 b898523ed4db6612c79aad49fbd74f71ecdbd461
- SHA512 1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d
- SSDEEP 192:rJV/HNfwK5RSpyv3RIw9RtO1Lnq4Ur1XneDN6IW1Y6Uph1KzaA0UbnnSLWqV:fFl5Rp3RntMO4U5uD8Upml0yhqV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6
- MD5 806c3802bfd7a97db07c99a5c2918198
- SHA1 088393a9d96f0491e3e1cf6589f612aa5e1df5f8
- SHA512 ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c
- SSDEEP 192:E0XOBqmqKYNg/ymxa07XW5U6chariK8GtnNK7gGteb1/C9T6IW14X/bmjIAd2vLV:mBqmqunYL6thaujK4jtepa9BX/bY1h2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/MessageBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29
- MD5 7db8b7e15194fa60ffed768b6cf948c2
- SHA1 3de1b56cc550411c58cd1ad7ba845f3269559b5c
- SHA512 e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1
- SSDEEP 384:56lIcAn3tURnUKCvUUVT/95gG3UX/NZSQW9:56lIL3tUSvbVa/NZG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c
- MD5 9c3d90ccf5d47f6eef83542bd08d5aeb
- SHA1 0c0aa80c3411f98e8db7a165e39484e8dae424c7
- SHA512 0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe
- SSDEEP 12288:+0OeMv3MrIb8CkZKobg3Wi1bRuSvazv+Uro:ROe+WIb8CkZLbg3Wa8Waz2j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Ngrok-Installer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa
- MD5 3e19341a940638536b4a7891d5b2b777
- SHA1 ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5
- SHA512 06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2
- SSDEEP 12288:Ws6T2x75lFR/RG+BUKPqnwoCMYKIUTJE:WEB+4+1C0IU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
- MD5 97193fc4c016c228ae0535772a01051d
- SHA1 f2f6d56d468329b1e9a91a3503376e4a6a4d5541
- SHA512 9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2
- SSDEEP 768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9
- MD5 SHA1 SHA512 SSDEEP
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1
- MD5 6430ab4458a703fb97be77d6bea74f5b
- SHA1 59786b619243d4e00d82b0a3b7e9deb6c71b283c
- SHA512 7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc
- SSDEEP 384:WK9Y5jI8MYODPqeivepi5zOY7//fNCsA8/h5U:WK9YNI8MVDZiWwr/TA8/hC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735
- MD5 1841c479da7efd24521579053efcf440
- SHA1 0aacfd06c7223b988584a381cb10d6c3f462fc6a
- SHA512 3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487
- SSDEEP 384:LtpW2/E3mawGD1XTgOw2QxHN7yVppy6+:JY2ImYRDKHxV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e
- MD5 3d4ec14005a25a4cb05b1aa679cf22bf
- SHA1 6f4a827d94ad020bc23fbd04b7d8ca2995267094
- SHA512 0ee72d345d5431c7a6ffc71cf5e37938b93fd346e5a4746f5967f1aa2b69c34ca4ba0d0abd867778d8ca60b56f01e2d7fc5e7cf7c5a39a92015d4df2d68e382e
- SSDEEP 384:2dqZXY/oSd1PTQLvLELadRtZa/rnRvDSQUT5S97/Y5bLOEYQfwrpn45rDhUn1kAO:2dqZXWrQPQQtZqrRrlU+cYv1kAvZc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4
- MD5 a6734a047b0b57055807a4f33a80d4dd
- SHA1 0b3a78b2362b0fd3817770fdc6dd070e3305615c
- SHA512 7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa
- SSDEEP 192:Z3eKcfO/TCOAOG+uCno9SFwN4O4FgkT8zr1P9YD6IW1GX/V3wd0yzSLWVb:8PG/TCXF1SamdnTu5lYTX/NwKyNVb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9
- MD5 ccc9ea43ead4aa754b91e2039fe0ac1c
- SHA1 f382635559045ac1aeb1368d74e6b5c6e98e6a48
- SHA512 5d05254ba5cd7b1967a84d5b0e6fd23c54766474fb8660a001bf3d21a3f5c8c20fcdb830fb8659a90da96655e6ee818ceefb6afa610cc853b7fba84bb9db4413
- SSDEEP 384:DVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7E7eEDuQZh:DVm7Q1vpebF0LC9TqH2Mj7qtqg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66dbe3b90371fe58caa957e83c1c1f0acce941a36cf140a0f07e64403dd13303
- MD5 776193701a2ed869b5f1b6e71970a0ac
- SHA1 2f973458531aaa283cdc835af4e24f5f709cbad1
- SHA512 a41f981c861e8d40487a9cd0863f9055165427e10580548e972a47ef47cf3e777aab2df70dc6f464cc3077860e86eda7462e9754f9047a1ecc0ed9721663aeb9
- SSDEEP 12288:LaoFeouLUFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1a:pFetLic805jbibGATp/j5T
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1157618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f73dc0f3074848575c0408e02079fd32b7497f8816222ae3ce8c63725a62fe6
- MD5 53a2cfe273c311b64cf5eaca62f8c2fd
- SHA1 4ec95ec4777a0c5b4acde57a3490e1c139a8f648
- SHA512 992b37d92157ae70a106a9835de46a4ac156341208cfe7fb0477dc5fc3bc9ddae71b35e2336fc5c181630bac165267b7229f97be436912dfd9526a020d012948
- SSDEEP 384:0ZMOBwQbGwAspmewuYvpYr3fgr9A8/VjceZ:0ZMOykGRzYwA8/Vl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34
- MD5 e6367d31cf5d16b1439b86ae6b7b31c3
- SHA1 f52f1e73614f2cec66dab6af862bdcb5d4d9cf35
- SHA512 8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a
- SSDEEP 384:nKr81F+CoNFZpeg7qX+mK3sxjt9l/C6I5YxBXWKeVFjyJ:KTvZY4gTPXBojG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c4efe2c8702141ffa8ff8f55d248dc4220231ae8d12ecea1f22906a9285b32b
- MD5 a22d11379e413cf832b3943ce46f2463
- SHA1 99b9552e8a25bff29678aff828901edbc23eaba5
- SHA512 cc1eccb29135acd35804b44f73447bd8dedc8ea085dee3670cf49120baa905aa7ca512c14a3f4df6aeb5a70347bd214865f9dc8b709a00abbb0c745164d87074
- SSDEEP 384:sNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9yPCn:sNuR+ZZ+mScWfEoMZQ9yPg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7adfe849345edd76aa975b0647fed2ccaa5f4a6aaf7d55f488af939c0dbef153
- MD5 224be01635cff2dca827fbdeaddb983c
- SHA1 11fa00c5e172c9cd1c81acaef52934f785f91374
- SHA512 1a4915b7b21e8166a6ddb6460c77e02c306a460c08fc7ee574832b0576c827db343eda9533959298819ee443790769328ad580fc67fe4817110b63d49248c736
- SSDEEP 192:vbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUse2po7SLOYN:vbChWqPj5jJtGUse2poHYN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c552d11db168a4f64db584283a617a6ec51ab6095c20ba4b706c3138beb68a22
- MD5 2e5f127cb0a69cdd46aa4fd9e603f982
- SHA1 994a6ab276c417301ed9208aaaf6719bf9594bc6
- SHA512 4455cb3b9d4a9c69abec7180e9a60e16e6be0ae2290f48aa09c5d926370de5512ced4d37b6e6e49515d5f51999211eff6f751c4594db936882fb7f40ee5bf97e
- SSDEEP 192:D6FAiNLB2n5QnRBiMcs/XAaICPczrOFsgXTZr106Yq6IW1yShrM7+WAMLuO1Jjm:Ziq5QRBiMn/wpDUtTZ5nYsShY3AgJjm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6c69b4d45638097e31169d94914e4acb6a8cc7f46788ffa4f241e4c1efb213bb
- MD5 04609b39e656e297db73be0d02c7e35e
- SHA1 f8abd484e7703a4d9629b033e8ec39c82eaf4654
- SHA512 11a88d55497fedeeb05b146ebd3135755aeb08c4596e9379eec83501e734aa6ba926d9bbda1c5f50e361836d65ea88d2c018f0b4b4b668c82ff2163730eaaf27
- SSDEEP 192:TDXwH3m0L3G33Kkw720sM76ODzKOFBLggT051i9Yd6IW1OU1YoWPbs5cLWT:oH3m0GqHT76OSUXT0HoYpU1XWoxT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1802e16379d96021fee05f583633c8091bb669350b7d32064179a8944d45a5a6
- MD5 3d76ef15ab712b93eabd4b68ea0111d5
- SHA1 0f309663fae17c4ccae983e1fabb16a1e5f77d9b
- SHA512 6c0d0291abb696bee33b6e42392b07028c82bcffc8fb7934ba234f178f011ab14fde38cdccb322c8dba058ae66fc023349de5db1c587d3417709bf263cfd28f3
- SSDEEP 3072:7ITmgSRcBHAt+yM1KlUKEHBAnpK37nXnF8KBOQv174Syoh2sKdm/vl7bQcX1Okta:7MmgSRcBHAt+yM1KlU18g1xNYVc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 018e06f57725563e4525700edffafb1b062bf5d4b0e9fee498507f0f8200fcdf
- MD5 ade4edd66bc695c9465816fa2538d0cb
- SHA1 e4351a2531307c848c60b20ffb50bcc04156fdbc
- SHA512 e2bf3962787366d7a975eb55d2edd1fe35935205febc00f720dc0efff0c62b5df7f0207fd569f692205e8a227c059eea596904995855458e9c02306842e88a6f
- SSDEEP 49152:eVbwgxmbsO2B7wKOfpUL6GbriHeGAb4TkyNejjWSqE08:eVbFxmbsO2B7wKOxTSf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3453418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27e17a43478448f64107df786a170753dbd116eafca7c027f6d357f11e6a4def
- MD5 9cae90969d14ab4d686c56bae19e041e
- SHA1 0359e8eeed993bbbc6f141b115bd533eeb52533d
- SHA512 04a9dc16299d866af7f56ff2ef355310d9437c909ec0dd3549d2f142e71149b09822106e254970f00801fe2f0df6b6d2670cf6a8256d85cd35b963c028f6202d
- SSDEEP 192:VsFaPxrfOKHEWS3/tQ6v/Lvyrq6gNZOtyEox0GTeA19Z/J6IW1Gz/yyY8RKIxLuM:/9GKkWuv/LyvSwyzTeej/Zz/IHUv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ebd51f1e33673cb8e55f10aa890a04027d62b1c1c0b0ae9b1d6f83f1602f53a2
- MD5 158e789d0b6cbc52fcb6653fefca38f9
- SHA1 4e913315dc3d69abe2be5e5b3a5d37b5f49f7deb
- SHA512 23243daadbad2f68b6ed6720d5792226f9c2aeb0b14cf3bf24ac54dcb7a2aa4aff9d26a5633d3add0d871e4ec65c230752c7c173cc4a4374f9263e2c46f9977a
- SSDEEP 192:kcq0WYKDFxDviOGOko8bZfmgyOYkIW1UZ/Xvjljw2ugiSL20V:kntNFxOrE8bLyOYBZ/XTugU0V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1940d563046c67dbbeaf5f2a2417aaccdae587c1eb97b79c263994896805bece
- MD5 2401bee633ea4032a758ffc6d729deac
- SHA1 3040e0e27f48eacf45860be4ece6f94db7bc1c4e
- SHA512 af016b5d2bf8c08e16b593d72a25284f31d6de7300ef98a226db8ce4f2a9dd512ec793adf0730b40dc0a37e9dc5a9d6ef0a50354a697aa5816b3cbe440655692
- SSDEEP 192:TGESp/+S2SoW+O4A083xaU12HeZOCeJyxlTer1c9gotlF6IW1oXxvZLY4cGSLOBL:w3+O4aADifeyTe5agIXxvNccZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/VoiceChat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1a2da0a66c7771962d525b8fe9491052efbd5f87b97d935c267fd96519b5a35e
- MD5 56a8b030ade4736915e5b601a4bf39f8
- SHA1 ab03e7948c4604fbd15d285f674ea879082a8e7c
- SHA512 d0f2990adb10221c88bbe04b4f2b702f99c046ae9ce5e713e2d26f73f9353dfe5fd983cd37c7b712341a58cfc4f833e590ff1e449c66fd5de98604d58a92dbd9
- SSDEEP 6144:TkcVpiCslfiJOBvKbfaIKlEZfb78+SmmCENCT/7CbRNid2/c2Co+5CJfSp7Of:4Zjp8fIlE9bg/AgBcRCcp7O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
557686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bea01b7d691d1f59ca0bb5149e5baf71cde71019da3d352141b1d4921e70bc2
- MD5 f0d8beccffd6a4831c0712a4da4a0c2d
- SHA1 238a2878f1bef8f002ba501c1f65862ed384cc75
- SHA512 1c5244736aa53d5dda52b65a26facda8334bc7f98ce2eb6356c51fcae03b183623d0c3bb7f45993b8bab0c65d261a23164f987aa5f6a47f2f307380567367904
- SSDEEP 12288:Ayw8KX3HOt3qqDQkoJBBg3bgtP1TviDH6MJyKwYalFEYU:1w7qDQkocbgttGzTa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8d413b40aef41e53557d91f3b3ac64cfc13adb0f8c3edc364e7b8501170e2657
- MD5 71a9109ccafa90550c1c879a304d27f5
- SHA1 c77ce45aaf8b2d8aaaa2a41833275f3eda78046d
- SHA512 fc92190d8a889fb088b2e8c2e4ea4751fcda59eff076b205da7c420b2f26564c1835d6ff1af470b583ec2ec92c0fcfb472e443e29d33f538572e6edd36c8c47e
- SSDEEP 3072:pA0VnWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJz:pBn+22fFcgBgakL320zYZHpMXM/I/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/RES/U40957361f7481084776e6aedU9f0U1
- SHA256 294f977ce530e3d471a9e2bb09305b6ad4516f42e3c2ce5c6c715f7dddb18991
- MD5 13f3948fa620d58ed6242262b575c784
- SHA1 8d8e32815bba106ba7452c7dd80bf6012d88def7
- SHA512 a74d3d704a075b390cb555864d531a49ce9e8ecf1e4314eb53c3f11a9486473160c02a9c03bdf6057d466f34aa87e3a53b50764bf2d493dd0dafedbc0fe22df1
- SSDEEP 1536:IuX+Mqm083ykKjsbDt1+PLCgmCZVLsDTvNIW97tXm6LSDfUW3jTzBHk1mTl0tNap:ut8Hv+P2JDhZvEcMzpl0P0bQnUBzt
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.ACT.resources
- SHA256 b7ab18c6ddc022a4018d576dcafda0352984dee3a7cd0e4d4f45cbe0f4df2b85
- MD5 7b9622f29c461e36d8a4c3e27dffb741
- SHA1 5f6204efc91e64f42978f7c8c293346e27fb533a
- SHA512 49736fa0a285f837ba12a7067b803e918b2a39c21d408cbbb39ee42efebbf64a4a19549ac2b7d7ca1e4524dc85d38c1a025ae41b947f40a36d18767fd12a4889
- SSDEEP 1536:67ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:6YLe7HkrVOiqyTaxw7jpY7s
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.About.resources
- SHA256 c403d852d1d8693c70b23199af2db9e70dd7d540e62c95bb8ee295022ccb9ba1
- MD5 dba99ce51cb7cf664617714d7c5d0664
- SHA1 79bb6210c1a5d3e37c93143d39c385445e167aac
- SHA512 1e09bf3bf45dbf4e8b7ca9b7e222f0382305d73ef1ec9626b5bc6414b6e1709265da1e4995cec56e187df251b18ecea9778e52850ff8c33385632ed395dc439d
- SSDEEP 98304:J5F/i9sHzcTiT38Ed4ihzD3w38dXdvinSh8q:l/BAe1d4ihvy85JP
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Builder.resources
- SHA256 2cd4edf6e3fcc6465e393ecc856a6f5ddff29ccd38da3c784dbb5eeab6c3d3e1
- MD5 fced32c3b698eb4204689d5ab088caba
- SHA1 fff555f9eb79f9226221d1116776e2ac4dd45d3c
- SHA512 53ad5d2b03e3f561ac55f3274d8a2d1a552490a577e4f44076be8e395981f25b6142b218fbc019a5bd19f32d6a57a196be8fa6ec9d453966f398d2feabf57aca
- SSDEEP 768:6YkB9omkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkfFakkkkkkkkkkkkkkkkkkkkkA:6r9oNnJHyh/HOL
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Chat.resources
- SHA256 9388906dced6dafbf91726771e55b4d07f870790ca6a7e5ded930d812cd13374
- MD5 8dca4f7300e5fe396ef7401b5ac9b450
- SHA1 fb91f139fcae116bf834292c47757312162bcdcf
- SHA512 f355ac08e80d1b513aa40a9b1bacbdd4d2ddea2c645156fa55521a93c759a4cf4e6a605254bac02fb9c1b7eb43ad72b75fb293720bbd2d114d77e407236a07f2
- SSDEEP 768:r/Xxu2kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkF:TkE316
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Clipboard.resources
- SHA256 18b66195ef662a04125191fc381e1181350ad081667c6437e708d29573c3822c
- MD5 98d7b91bac73c075f30116b9bd3c67f9
- SHA1 b9e705565a4ff351fe36486f12fca717915707af
- SHA512 23e542a75c1c546343c7ab236b103b47fcace224791eaeacd4fa7fe376e69b4b84773a30d7f13991f0d0b3e5b245b00252089c0c89125cef55034a06048011eb
- SSDEEP 768:mPFvvvmjF2/2KZeQ46XhNcEqnKqaglXXI:mtvvvmjILp4KNcEq8gt4
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Clipper.resources
- SHA256 fb95146658664f1a39e459d914dd6de69b3b946cc433e9927998b2e6eca2e185
- MD5 38d4e87d0095a63194c0cad81bc211f1
- SHA1 a15531063c6c341094a05d325a32808eb06d1f65
- SHA512 93589625ddf9979d348bf252bcfed5039241ca1860a8d647761220b6b6343161bff73294af80600aa525b251b7e2881985c2c939be672ded827a9071437d50c8
- SSDEEP 768:1QinR1KLCUAgc9h6RVTqSXFbnPHHWygDHS0Zvq3Sa+OGapJ:++vKLOsVZX9PH2ygbNvq3SazxD
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.CustomOpen.resources
- SHA256 598558968242dea51f96c5733c13bb430ef5444364acd72c7e47300ab760547b
- MD5 3c655ef71e0f2b716ed5a89c9b11ae2e
- SHA1 433e4a0b3a074e8df88989b31297ee38d83a98c1
- SHA512 03e457011d933cd4c4514a8c144fea2458efdedfa1ad4f3b28e963682f3c0b71f456bae40cbe15864dd527ef0dc22e0f141b7b3a5b8f02353514b26a861bc70b
- SSDEEP 768:pUUiy7kkkkkkkkkkkkkkwJ2zcrq+5kkkkkkkkknpmU0GDkdz2EapJ:LwJ3qR0oD
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.DDosAttack.resources
- SHA256 f5d6acd85a0c639a1488802afd8494c712df2925276217f71fa3540bf11e9f4e
- MD5 c84ccb00cc3e74c2aebcf95d31d72b08
- SHA1 67e30f0f0c3472ae96898e18002a8332ece8509d
- SHA512 a27090fe6877fc6df3ea0164b80d337871e2c1ac9aaa8718e2575aae1cb0533dd158a26d3c42ef73770c6fba78b41d1f1bdfa1259c7eb9c042a1253a9fe2e330
- SSDEEP 192:rkvwKwq6k94PfBMao1p1/Z+NhAaOSgG59A888Tf6Z:rkvwKwq6u4PfBO1p1faONG7A888Tfs
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.EditReg.resources
- SHA256 d1e026edbe1d06e58073bca992133a94cc495fe8958d7de0c229e9f6a4a23253
- MD5 5fec710a19fe099ac9928ea500ab63b0
- SHA1 5f539bd8383c61470b2839bce6c8e6a9eb966e55
- SHA512 f91027078a3b6384ad9db49962d7c398204d48f632a77c3f423e5cb5034d71012fbbf1d6bbdf9b56968861f34ad2e5e74bf9efb3dde1736e23b0dc29a7b880bb
- SSDEEP 3072:0TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:a8
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.FM.resources
- SHA256 697350ca911bb5af342a5485dfb5787bef0541526f053f7cb559fbf005e66333
- MD5 16f2d71e8e805a3d8678576532e45cb3
- SHA1 69116054f7a15e73b51bb0145d3cba80ec362297
- SHA512 f327d1fbfeaabed971d2255da64ab4875aaa2b8923113e62cfed68b4dc5643c07a33eadb473361a7ad30647470b744ebfffd8d806c28dd35c1681158504bc8ee
- SSDEEP 1536:Fikp4KNcEq88sXgAHWOIcK7ETH1QatyHkrVOceYM2mX:FixF8JjHVKYLe7HkrVOiVS
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.FilesSearcher.resources
- SHA256 8f6b3e617286b240c1117bf6cda40a11bd6d59d2a94ea9b9817730fec7cd3d70
- MD5 95818cf2184044335cdfb896b28843ff
- SHA1 037e53ddd857c9dcc49ba02810179d7ce8437069
- SHA512 a63e479aae870b623d1dd057b6814f10510b54e74e232a16b269acc2435fc36f7a7a19341d2b1de79bdab0603ff7b0cddc698c6b9e73fed52cd4c6e3e955e289
- SSDEEP 1536:fqZScK4323F5VLx9WXjbR2H8fsKFBT2L0RjpY6WjvhY:ffRWXjN2asKFBZxpYxvhY
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Ftp.resources
- SHA256 c497bcd280f3f33d1b49d4e7dcac03434c20bfadf435a71b0eb501cb74eba68e
- MD5 7c65f0d2d6700ea2011d8cf8698ce129
- SHA1 b1af1045a19306cd397ef3f87ecd26b7060fa778
- SHA512 d76e7470f5c2f152c699714837d8d6d046edb0953e016af3719b48f9155771e47b3a8a160f0074f96287fe2cc26f38cf9ef581b1c2dbaa4a4b579c7ac48a1e3a
- SSDEEP 3072:9BMaTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:9BMo8
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Fun.resources
- SHA256 d1e2cde8706b7574139a8d0843121fe4b469e191c64bee885b16f53c398c0634
- MD5 03ed9f7cfdc4c4022748d28866ab8392
- SHA1 14c6e19f536fe87b36ca19af03ef6808a27eca42
- SHA512 37ca143122078e3412eaf01e3120b36c43c0acc5e4a0f3b625fe8c661fa5e07a9579565a29854f80b9e510da6bc52ebd041c6ac543e32796e74b4ba338e47ea9
- SSDEEP 384:rkvwKwq6udiHHHC3P3P3P3zXqvbvQYmkvbv:m3P3P3P32vbvQVkDv
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.HApps.resources
- SHA256 d7fdbbfacc23d6cb577df5908678ea33a458f5ba0b96359efb5ca1839bfd086b
- MD5 60f80d71c8d9986035368b61a80ec39c
- SHA1 9336b5bbda4b1eb92d8b5f7cb99d482ea74964e9
- SHA512 3411e36495e958706e1bd9f37551daa76e2bacfb5bca242ff8a20921437c443f1b91aa28c25526115ad7248358d2e29d62f0de3da6aa63e7cca6aa39517d8f29
- SSDEEP 3072:OUjCDfWaFnj2tpyTaxw7jpY7kESYLe7HkrVOik9C9R:OsQW7kEubq9kwX
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.HBrowser.resources
- SHA256 3ff03acd8bda3bba40e14064dcedcf188b5c5d9b1c899920a0ba49238812ad03
- MD5 1b4955c4d297f43c89a4db73f0054346
- SHA1 d90fa8dbb8897ff4a565b8b019186fd13e0807a0
- SHA512 ada52944b61e64d28b3ca7f8eb75601a287b6d5c90b51d0707bb00ca697638589dce8469eadc738b45ac5d541908143b9c3a02b5c6d0f51b1f3df1fc2914e8c2
- SSDEEP 1536:opx1pWvE2lPpjq9bTQPmbYakBxBW/7jpYaGlVf01NiPu7ETH1QatyHkrVOceYMs:opDpW86pyTaxw7jpY7lELYLe7HkrVOih
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.HRDP.resources
- SHA256 f8d74378cb9be4608271a4d4994ef57ebbdfeab037c90c913c39ae3d89c9fb57
- MD5 fa9343a592c72c5624ee76c157265bb3
- SHA1 570197edaccd2c58f1c1d6a96a92d031933b6c71
- SHA512 a5e99e9645be0d6ce506635eebedf1307615d44c3bd85ad91f29a45f86685c1a9833df150d7bc27a19182fa73b52da2ca97c33c0337faf18052bc4f3be457640
- SSDEEP 3072:c4jEWtQbQEm/Q+NQMQSQ5QnQ+QYQQfQQuQQJQQzQCQlQbQQzQAQxZsgBTYUwmfJX:z
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.HVNC.resources
- SHA256 c1eccd021db7b1d686e10cc6aa14505a21386723fa85d2e7eea6adf361a92335
- MD5 cbd7e355e5a99120d510874ea6dc5c83
- SHA1 90e324eaced544ec96e4f773ee8f65687b2e7661
- SHA512 1e3accd3b979dec6268acd56ec9fd30f4ebdbd6fac3090e9af13f9f39dc437ad69abee431747597408ed1ae3a402bf795ba06ddd892c5897796d45b6e4aa98a8
- SSDEEP 384:rkvwKwq6uqWHMDzelakhLZS3UrjTgwE/9xxNTT0TTbo/t+H1wLzzWySGjqu9epXY:QselVg6n89zNTT0TTe9jeXWzSg
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Hash.resources
- SHA256 f5d054da5630a8fb711ec674feaf8597d1219a72cdfc6d4ca4d7e3806c84812c
- MD5 cb331a72ba58813e6b3924749bcd6390
- SHA1 18009c5eca68ae32598c3200fca3782c5b1e443d
- SHA512 98777f7558a4af46b2469d4ab4dfa4e92496e3bc1fe74401da758c902a59701ff8fd00268395e5c8a511c9d64af82af812c195b23d77d4d5b4f0a592594fa8ca
- SSDEEP 192:rkvwKwq6k9TCvWkGIlL9h1yhq9nZoWA/m7iP8Gp:rkvwKwq6uTCXpOsZob/m2
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Hosts.resources
- SHA256 3439ac9f2377613b6b499844fc39cb8c2e0958ffb22014409b5cea95c626e91d
- MD5 83793c37782eb28178b2196b51681877
- SHA1 88749fcbf6382cd36e1c94009ed7ae1404a07d00
- SHA512 c03434cf2cfe85b30a4526afee6a158b77420d2bf1350b73e3c02e9dc6febc5d9a7debb5287607dae9992467ecc49573d92ccc50a2334e0e93786936e92eb9f0
- SSDEEP 384:r0vwtokwbwq6u84ELf8Yo1TFE02rVaM3/2ptMx1bU2o07zwAWV:9j8N0Rxi2op
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.INFO.resources
- SHA256 501e089e1db08562e14f2750e406b0533d7b3aae3705e1973b29849cbbda6fb1
- MD5 5ee5eb03c4d8e504b7a996fd5410666e
- SHA1 dddcc286a7fa6cf82cbca91e1d9b67bdf9b2581c
- SHA512 e2f7acb328edf79899d8774ca9cc94574d12defcaf2ff9047b201a009d27ee7044cdfa0b761b11c1c8a12d3bf514f21bdbd35a538c52ce8b53d43a586a968027
- SSDEEP 1536:ZU4VmTTyTTRTTPTTdpgiCiCiCiiTExaFlM7ETH1QatyHkrVOceYMs:j/cFqYLe7HkrVOih
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Keylogger.resources
- SHA256 89f3a42141b619bfd652c9825bcba07b91475997bac48e001e74dcd90bef754c
- MD5 a1778b17ac5f0f62b3771e9886e0acba
- SHA1 0a0d5f1a4fec5c677ebf29e0dbbe0ab7032fef38
- SHA512 1669aa46676ab5f03ced3463a84e2a99be0789e7649f50e6d33cbe6934a058ac1088660c457caafdf42d7bc4342fcd844c9811bd2d2a02efa7cad5ecd10b7a98
- SSDEEP 3072:S6F8jWZcccccccccccccccccccccccccccccccccccccN:E
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.MBox.resources
- SHA256 a2a724d05f289fe51f6a3639937c460764ee42935c6eddbd5f7cc7ab6d26954a
- MD5 ffbc6e01f688097960937446350eb01d
- SHA1 6753b872c838f2439e91fbab20671cdcd7bc3d1e
- SHA512 2cfa07a45ed9b8547a9ca303d66a71c943f1723fcd692d9d8f5f20f6ce9671e5e5f11bbb2ba7d6e41a27806bbbb7ecfd2f7e7d37af5420aa3c68b0f64dc9c6fa
- SSDEEP 768:hFGla/np/wpRGZPdKOqoJLTapjappD+2f:jDfd3ckHjf
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.MIC.resources
- SHA256 aa4f13af48d1d3b3735a732e90163e6d302fe33a8f0041933dc76427f099aece
- MD5 d079b64991e7ae90dcb355f1036831cf
- SHA1 980f639c4e3db7cea44ab28e40ccdd2c728ee179
- SHA512 e6e5e21438d7b60eb9f7b6d8cc9e2a672e15dd5af2cecdfbc63dfce8e371982abbb951ce052e731daec9c86f356af54e81623dc7e72ff36a802907345d52f6b1
- SSDEEP 768:moZmmittmc9ik83EavHr/QS99wkwcMPliv+j4bctbK:5etYOC3lvHr/39Kcki2jAMbK
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Main.resources
- SHA256 35a6f657c6d1db902ff3fbb3149e629acbf926c7c244bbce502c0b65cd2c536d
- MD5 8d7f5438261b974eaf34287253799b87
- SHA1 086e994fa1ce12ebeba3c134ec9af69244e8c2e0
- SHA512 2e33671bf500e8a3727181e14cea8be2d4f77d4422720710056676ce4f8e6b4b2b3a9f38a0713750e7363c52af097ebb5c489c45d46c5627236d6afc81e67f67
- SSDEEP 24576:nm8179dddddNjYkDTFKlDy/Y3BZabuwVAeNgFfWN:nm815ddddde+MlDyg3BZaSI
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Maps.resources
- SHA256 f690fd15ad3c3150a48fd33962b44ec118bb3f9b210f0d0b27e3ee83420c73f4
- MD5 ed0eb94f77f681a3600539bb9a6cb6f5
- SHA1 b176e3455cd0224448e9d9b4b015789c794d8b06
- SHA512 8e097d3d8617043419154821d9721bd4f7e16f12a19f7e8873c8086872540c61e4d932e43515573eac08372a243c0ead855ebfe5488a1e6e53142c44cbb5eebb
- SSDEEP 1536:jjbwDfOmcgfteiMWWZoSp9wmLZoSp9wmT:nSfO0tkZAMZAA
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Performance.resources
- SHA256 16ea3b81c6f9ad74d27c621f0b8485929dcbe293435b151124c388aa66f09c52
- MD5 4c7233c83c2f749762fa0e000021e5e3
- SHA1 9b1a4826da8279f52aae9cf29570dd2679ada1bb
- SHA512 0f9b830fb139173f321a78b32b3166271cd5345df85b63b2a797e38cf3fa441715cc648e89768bf12bcdfcdb621273eb53b62d6fd66f5cabf6b8c40d3474174f
- SSDEEP 1536:LcP/zyxY/FVGJ+j+chraMRNPnLRhtAN4RRH9nl85gi:yyu/FVG8jbraMRDA
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Port.resources
- SHA256 bd3da4a9c29cb564c774bd8b8c0b79078f09b037cf2f3a8fa2566648f68a012c
- MD5 faf23924f3c859e9d570109d930928e1
- SHA1 6003549ef256bac573ff809a9a5d967b8106f9ab
- SHA512 227f0c0245ff48955a1ba95fcae513237c1d4f548ccba955c4b26a633e7330a312fcdea474dc87f2847b51a3694427f5227f60a77dd5168760cf28b770ee3fd3
- SSDEEP 1536:wi2AP+ew+ksEvCwVwLM+uvpIVyXJyozbGyMqmyVttdGFQeOPigp3dIHyYNSL:2A2ewhLapuvpAsZOyMqmyBeYVYi
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.ProcessV.resources
- SHA256 1e1b3bd4c4dfe056edf30fba8d6bbf94665e9bcf936ab06db79213e8b400b61f
- MD5 abfd25fb3ace375c63f8e9cd4ecff32c
- SHA1 d7b7f30bd62e17e1da6bad889b9f77d93c795039
- SHA512 d8c0546d1ee9a35a7b8a3b9304ad63794b1e71d014f8c45145b60343f8140457a8711065f7a2aa87e68e1d564a45171425adab9b83adbe9491afe065d990fe0a
- SSDEEP 1536:io7ETH1QatyHkrVOceYM4pjq9bTQPmbYakBxBW/7jpYaGs:VYLe7HkrVOilyTaxw7jpY7s
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Programs.resources
- SHA256 55c19900015145bee8c83f27ca58032550871a92047abf6166dbf547b6afa505
- MD5 9f05c761cba903361771cea155ede6fb
- SHA1 af0311816e6f1315bf29e5a42ac3d75adf71d115
- SHA512 d4e049c341deeb7376e7def96e071808c9e04e085171b46af7f7096f52cf4288df19d3c2aa2c87816a6eaf5feb3f2257bd58e93f582498ad8e4fd4bcc652859c
- SSDEEP 3072:XfH6ZxP8NJAceI82I98CBCYLe7HkrVOiqyTaxw7jpY7s:XfH6ZxP8NJAceI82I98CBebq9TW7s
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Proxy.resources
- SHA256 ee84fb0146a0a7e6bb8506159eaf12fc2888ae87b0553e1cb031e044830584dc
- MD5 d6e648329cd1473e66a01a9402e907d7
- SHA1 ebe34259546be5638bde8ae75f96d6f70e3da62b
- SHA512 0d44e33084f163b0d56798ace44294825fd76478acf303ca03bbdf6dfa286cf8cd0677c50fc1a422073ec7498d13aeeaebfb89b1a4eefd55dd010c6c23c1a7ec
- SSDEEP 768:+SEnnnXXXXHXXX/fffbyuyuyuyonnny/vXH/zLHvEppicZXvZZHf+m:+SEnnnHXXX/fff3nnny///zLHv6JZ/D
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Ransomware.resources
- SHA256 bcea581804fc0d0e1d66c76a47f9b7bd40b81578bff0241bb4155a0c67486a46
- MD5 c653b8b3f18eb2a2882c2f3905b2380a
- SHA1 62235a88bc833fe7a41c9da2e5766306a026e144
- SHA512 a01927f5a4f3b1d838919074c42125d60d6e50af3e876bf614f0dd264627234973ba4b642f30040332c328587340be82f6057a5130baa0d79851fede67069a4c
- SSDEEP 384:r0vwtokwOdwq6upS9LvgUuYkYezHbMTb7+JZf5NXJAdDzMwA6jp:Y9XuYkYez67+JZ58zf
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Registry.resources
- SHA256 ce34680ff2984c6c4766889684a358358711d2cdf3171813ff768d7f1c9c53de
- MD5 d098b950169502933b9ef1f417f25172
- SHA1 8f40b86fa8a986588788676ecdcad5bf55c586d7
- SHA512 4a38f88db6a585d6a47e6da36ac8aceb15825453e5ff4804b2943be9e4053fb85206e473115e72a86c4b0c2d13fa9a1ae18ed7d96b52edd050e7e918fed33317
- SSDEEP 1536:6s67ETH1QatyHkrVOceYMa7ETH1QatyHkrVOceYMJ:6NYLe7HkrVOipYLe7HkrVOi8
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.RemoteDesktop.resources
- SHA256 1dc136b225528fe4ee8020f46aa549e4bbdd76493d0579b6c1837d10acc3ba13
- MD5 0f5fc0694c9d76a6fd5b7e4158fd03e3
- SHA1 aa7eb852f5743e456e5737ca25e7b75ca7349b42
- SHA512 af3c1ff80a247ac8ee6440ff4410460603430f24557dce392b90961b77a2d978b6b75a9a606ca433ce16cc565d07c2b5fc41413c1229147194b24bbc1869c67a
- SSDEEP 384:rkvwKwq6uD0hAAAgAAAgAAAgAAAliIGzl8nnnJP5JJJJRetmJJJJ5gCnnnsjBy:rDnzly
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Resources.resources
- SHA256 557058bd29a5eb55ef073ea9c4dec0baea1fd3f3f4bf2cdd5ee3dfd33735e93a
- MD5 34986e38b463873af40f694874c1f6d3
- SHA1 8fa89cdb7a394cf8093d548ca9db4652c703ee72
- SHA512 c1b0278e8c21e5c28204f692a5cf5ed16c8ada0c6022d7d38e70905255f3aeb5d2c0fd4549f0ed19ead52aa0ced891a8f9372123bf5e1710be004958750874e4
- SSDEEP 49152:OsP2WTJcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHXH:zuWTGLP9Pk6gAK6n4ldyNh3
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
Xwrom/RES/XWorm.RunPE.resources
- SHA256 823554153d20aabf65c8635b7727dd6f26f14f79da929de9af8131314ec2c347
- MD5 147c16f102addfdd7b756b8ee1558b82
- SHA1 e9aa9624bb96d369aa905d14e03db625d17d00f6
- SHA512 2df2784f5284e0808224a58fec6e12f02a5e09001c77991bf643b4304d99b633a3511551ef42e2e64f1ad6e5de0a44ff2c3b358413dd6ea6a9b08c0dfc592c38
- SSDEEP 384:rkvwKwq6u29Ax59IWzT9DfLtFbm44XdZcGe5Eas1gMVuM:D9Ax5x9vtFbm44XdZNeG3
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.ServiceManager.resources
- SHA256 fc7906c147eb0066e6cee2a528ab531b6d0ad1eb0b0a4d2a32a1be422809ecb9
- MD5 776d31cf63f902ede47ccd1e09c463cd
- SHA1 a45e4761bc40019d6e5b72ece5d731c520d91303
- SHA512 f8f099d291b0ecab01d84d0c4f4480c7ea266cc79f1071d71c71ca3113f6c8594d82f192feb3b136be0e007542da1cc6a7b28b860bb3ee2e0e7747b75222bf0e
- SSDEEP 3072:VqR3kbym/bBGIgEJjHbD1yLHpkv+GhSx7BQFgfMyd9tbYLe7HkrVOih:lbJGcJj7D1cJkPhCprxbq9h
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Shell.resources
- SHA256 7f71160fb4d68eda2e6af07f2b89416cd5668ffa5260dfbeb69391dfc5508586
- MD5 a3fea8391774bbb0376e1f69eb6ee9d2
- SHA1 96032202ca3dee1983d1990ae856112f8c832173
- SHA512 10a3c77631a0d1ee80198ffe430a0a389897201ef60a8f3e9beff5125545477d8ce6ea8fa5d186ef31dc4681b62048d71fcbb3106a88f22aaa08ee75de2c842c
- SSDEEP 768:aoR1HiAxeglYAQ8BXIHDiJ9zUQI0xV3PrEiv/ewrmTIgdEM7XoSxSdL5NCc+Y:ayheg/Q8B59zUQISXnFmV+Ib81NJ+Y
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.Sound.resources
- SHA256 7d7ca0ead2e362c4b2b4e5e7799b0bd115eff66abe9f7bb184734444142bfd9a
- MD5 d867ec78d12cbf85eca15722c1ffcca3
- SHA1 90dc339c7ad81447758eadd2535298cfc2eb1bcf
- SHA512 5bcbbccad3f71207e6c28784fa27e38d8c24c4d2edcdf3b55d5937974c63c9a8fe6ce311d6946ea13b669ade3c262f0c3bba82a330fbbb08a00bf066734ea638
- SSDEEP 3072:njXXX////ePrLaPp5+SRqRN1SMLVivg1AGA8JlT6rZQnmmQo:RPp5jyNQMLAvkAl8JlmNV2
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.StartupManager.resources
- SHA256 73d138786a5f08114204491631867e44f5d1d60a683890509c7f69a78198c60e
- MD5 3e7ce35b2e085ba831d417d582b249b9
- SHA1 63926a8d61ef3eb1e9408e9c531ce35adba66886
- SHA512 27a6de57b2c88a8d1119232ef123e728b4f1bf9aedaae8caa026bdce9541ef61c4c3d5a59fb4c7613febbae5f5e19ae754c51a4ae9176f2eca5dc03d938048ac
- SSDEEP 1536:LasebR3b313F3F3goXjmtt32325JT8J8pjq9bTQPmbYakBxBW/7jpYaGS7ETH1Q0:L9eS5JyTaxw7jpY7SYLe7HkrVOih
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.TBotNotify.resources
- SHA256 6ec33992edc80f131e4a9f7f89fe9c9dba233f7c3bda8ce6e06711021e8645fb
- MD5 b219d1ee4ae25f781e5bc88165839987
- SHA1 bcb30240b697493fd238c0d611081200a0abc3a0
- SHA512 e4d013c746ca857a135484d908fd2fca6257236b8b3cba8bc10209fdbb5f7cb3b595da15618f4713eb5cdeb7033772f72c22eb9ef5022c337d1dc3ebba67c746
- SSDEEP 384:r0vwtokwswq6uTq4fffjfff+7f75ArrqWKwA+apJ:dfffjfff+7f78rqWnapJ
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.TXT.resources
- SHA256 1ec2de5a4bb61ecb3a2e57da228d3c9f278853b21ead5553643bbaf6c6706b50
- MD5 9cddc18b39b043d9542e5f0989faabf8
- SHA1 afe5c5b7d6a978ac504ec272c1e8dcaaae1d5b34
- SHA512 b9da58a39c39cfa665e63af0ea206ccbdeaf7452f801b3d2d9bd89e643c3c729de172ff6f86b8389d94f2f0ae92153275f4cb1a30fc60fa93e5fdb717cfa4a8a
- SSDEEP 384:r0vwtokwzwq6uCoAf+q7xVsFoSNDUSh+w6HvQdBeQanPw9h+w6HvQdBeQRzrh7ji:2iB7bsnWfffJFB
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.TcpConnectionForm.resources
- SHA256 5d1dcb82a528c97aa161d0ffa742032abdc3e911125d2171768ceeacf8fb9285
- MD5 84f1c4ac6a6d9b44bc830ab1129da3ee
- SHA1 55b207a19d11950267ce10e914c0b4adcad52f1c
- SHA512 4faaff764f6074216c5d9a5493e949ffa6e0cf32a74181d8141d0e3d5b5795d3afd3dbf79f9bd2890d37f420205cd75328d8e488424e139ea1aa7fc9898c0aa2
- SSDEEP 1536:ZLnTGFCnE2TeaHXvSQ7ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:ZTUEeM/hYLe7HkrVOiqyTaxw7jpY7s
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.ToolsBox.resources
- SHA256 f6a8d146ab66f03723e3ab551b1579f695947cbed073727af9fc396b2613f62c
- MD5 73bda4b934275a61f1ca27e88299a29c
- SHA1 63cb4ac6a9b0dcac53dfc35bcc817ddf46e5e399
- SHA512 9f2b82b1971a195eea9401084edf15f33694b3ff757b3c1b71d80315425c6942a3e924b9fb2681419f256128257682565ad13d78570db41fcb3e9095269cfdd0
- SSDEEP 6144:626twOOCanAtwOOCantAHzfadhIVBfVBd:62iwO7wOf0I3F
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.VBCode.resources
- SHA256 0a8d6cdc13ff8387d4216b31384339e56fbe205ebbbdf1dc3f8f4d8587007ffa
- MD5 76d53ae7107963acbfcd4597019c7f06
- SHA1 6d01fa4b76be5007a5e1b6a7068ef32e8c09b258
- SHA512 8c5a7fae83626de3f87b0b6ab382e2b2d60e002a701c87d7ede28fd976d34e7d88d664a72c22c956c2f54e0b93150634e8ed535d4b04b2d65f2516d6cbe4a270
- SSDEEP 1536:fYWQm2zLGIBhvbXetsYOIw1AVLx9WXjbR2H8fsSp4KNcEq8YnFBT2L0RjpY6Wjvb:zQ1mInYW1jXjN2asvF8YnFBZxpYxvh5
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.VoiceChat.resources
- SHA256 1e5b9f16f88c4de8c4a3ad03cb318815f92c40f89eabcfdd1ad0483a41113527
- MD5 9b4613ca9da1999c6b521410d75e417e
- SHA1 4671b2d8ce2280fefd6bd7aafbbf709ee0f554c2
- SHA512 a107f4d40581c2380b745a54640fd1ae5aa6ebde04310077074de22444b5adf3e64206c078cffc10725a77add0d023e52c2d763920e2e8941fd2f3ec58ec3e0c
- SSDEEP 768:V2bS6Pq2Ykkk+p/C+5hKf9wkwcMPliv+j4bctbK:4up2SFl5huKcki2jAMbK
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.WebCam.resources
- SHA256 0ff62be2bcacad7ddda3b3cc32fee9c0a1c3bb5d72d81318728c1805204b2433
- MD5 0a82ee1d886148e7b149c3b4745ab653
- SHA1 a6b3e0127fa58c4479d5cdc4bcaadd9b6e666424
- SHA512 6a13d2e45d710d80970dfdf0bc09ec0709fc88e62d22c4aa2cfe6c8dab18bee14e134d613b1fcf8204b70cd9950c82d040eaf718a97a8f64502d05e3ec9f6c0c
- SSDEEP 768:LVLgN8K///iee8xxpe7ee8xxpe7ee8xxpe7ee8xxpeTD28g806Pj8ql:a1xxzxxzxxzxx2n0Tql
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/XWorm.ngrok.resources
- SHA256 b7e3e334ae48421bd3cd08679d94614e3f5c2d5847aff6eb7e06532966a43013
- MD5 b776cefaa200763a77bf55211c838b3e
- SHA1 4296aecaec1f77623dafb7e34a76c8b25ef6bff3
- SHA512 19fbaa3369ff3424bcd6fdcd35c677b686bc465bb558e8933a93ce0997bf782929f4cb5c1e2022d0d3ce3f54d4fb6bff25b11444760972919d3ba0fc00aae7b0
- SSDEEP 384:r0vwtokwPwq6ub5wAlec7vxohnxNQI5EOyK/WdpcN6Y9F/2KWowAglB:JMKyqNri9B
- MD5 SHA1 SHA512 SSDEEP
Xwrom/RES/Xworm error.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3fb8431d0167c8fa9b26cbe3b5623385145436fcf11fb44732e86260266ce5cc
- MD5 c88b9d391ef2f76e8313942e8817ba5b
- SHA1 82deca0b90b6b466413dae39203bd4ece82012b3
- SHA512 630c5359b3b17f59b916b549d80ed57731d29c5759c16ccfeae53ebfd53fe10a52cf0cc6205688ab7a9478e0529fa06dd8de9740dfeb4012e0f27be567cc1422
- SSDEEP 1536:RZlBt3TU6r5J9nQzt72tbpUaq8aM04slL6CNLvZvPOr5v7Nx:RvB1znQzt72tbpQE+l5NlHO9Rx
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- MD5 SHA1 SHA512 SSDEEP
Xwrom/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- MD5 SHA1 SHA512 SSDEEP
Xwrom/XWorm V5.6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b32c1554a1a62e6d4c30bad330e5146016fe11521671536c669b429b895e5a11
- MD5 bf1ccd2d127e4ac0dc4ad6307cd1b62f
- SHA1 fc95eb4ec00d3b745fb97f7f8f140cfbe51c23ac
- SHA512 0b6fcb5596904849c5d1ef7439af2849394a56a5f64d337b85cfe2158c8aff2c2a6db5a03c5464520537ec5a203f4c784db4e47d48dc16efdfe064a0e831a3ce
- SSDEEP 12288:nB3VqDKxV3hy1gtF06T4UD/Tdv0Vsc+F:niOVyv6rPd0y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
507914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
8kK_1p>B
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
8kK_1p>B
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
150KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
X28E41X2
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xwrom/XWorm V5.6.exe.config
- SHA256 7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
- MD5 66f09a3993dcae94acfe39d45b553f58
- SHA1 9d09f8e22d464f7021d7f713269b8169aed98682
- SHA512 c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
- MD5 SHA1 SHA512