agenttesla | Xworm-V5[.]6[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

Xworm-V5.6.rar
Size

124.3MB
MD5

e9f730d0562d286333d66e2557adbfcb
SHA1

9abe1fa95363231139beaa58b29a54b80a4465a2
SHA256

685b97041f1aa3e082b9816c798c7b9adeceb630ca63634035cf4fc4cbcc4cab
SHA512

ac9bdd9ac60dae37e088cda6d26c8b5a1688c8efa4b3869858c5d8b422a83a8ef3bdd95a41ac3ad593739105e5a12fffcd38d3ac57833fa7515c62c003e54491
SSDEEP

3145728:lqbnXls0EBbp/OifpPo+Pu3qqEBdTZNSpWuR6VR/BU+/1NEZju:o71s0iZ1oqtBdmWlBB/1NE8

Score

10^/10

pyinstaller agenttesla stormkitty xworm umbral

Malware Config

Signatures

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V5.6/Guna.UI2.dll	family_agenttesla

Agenttesla family
agenttesla

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
static1/unpack001/Xworm-V5.6/Plugins/Options.dll	disable_win_def

Detect Umbral payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V5.6/Xworm 5.6.exe	family_umbral

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V5.6/RES/XWorm.Resources.resources	family_xworm

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V5.6/Plugins/Recovery.dll	family_stormkitty

Stormkitty family
stormkitty
Umbral family
umbral
Xworm family
xworm

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
static1/unpack001/Xworm-V5.6/Xworm 5.6.exe	pyinstaller

Unsigned PE 45 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/Xworm-V5.6/FastColoredTextBox.dll
unpack001/Xworm-V5.6/GMap.NET.Core.dll
unpack001/Xworm-V5.6/GMap.NET.WindowsForms.dll
unpack001/Xworm-V5.6/IconExtractor.dll
unpack001/Xworm-V5.6/Plugins/ActiveWindows.dll
unpack001/Xworm-V5.6/Plugins/Chat.dll
unpack001/Xworm-V5.6/Plugins/Chromium.dll
unpack001/Xworm-V5.6/Plugins/Clipboard.dll
unpack001/Xworm-V5.6/Plugins/Cmstp-Bypass.dll
unpack001/Xworm-V5.6/Plugins/FileManager.dll
unpack001/Xworm-V5.6/Plugins/FilesSearcher.dll
unpack001/Xworm-V5.6/Plugins/HBrowser.dll
unpack001/Xworm-V5.6/Plugins/HRDP.dll
unpack001/Xworm-V5.6/Plugins/HVNC.dll
unpack001/Xworm-V5.6/Plugins/HVNCMemory.dll
unpack001/Xworm-V5.6/Plugins/HiddenApps.dll
unpack001/Xworm-V5.6/Plugins/Informations.dll
unpack001/Xworm-V5.6/Plugins/Keylogger.dll
unpack001/Xworm-V5.6/Plugins/Maps.dll
unpack001/Xworm-V5.6/Plugins/MessageBox.dll
unpack001/Xworm-V5.6/Plugins/Microphone.dll
unpack001/Xworm-V5.6/Plugins/Ngrok-Installer.dll
unpack001/Xworm-V5.6/Plugins/Options.dll
unpack001/Xworm-V5.6/Plugins/Pastime.dll
unpack001/Xworm-V5.6/Plugins/Performance.dll
unpack001/Xworm-V5.6/Plugins/ProcessManager.dll
unpack001/Xworm-V5.6/Plugins/Programs.dll
unpack001/Xworm-V5.6/Plugins/Ransomware.dll
unpack001/Xworm-V5.6/Plugins/Recovery.dll
unpack001/Xworm-V5.6/Plugins/Regedit.dll
unpack001/Xworm-V5.6/Plugins/RemoteDesktop.dll
unpack001/Xworm-V5.6/Plugins/ReverseProxy.dll
unpack001/Xworm-V5.6/Plugins/RunPE.dll
unpack001/Xworm-V5.6/Plugins/ServiceManager.dll
unpack001/Xworm-V5.6/Plugins/Shell.dll
unpack001/Xworm-V5.6/Plugins/StartupManager.dll
unpack001/Xworm-V5.6/Plugins/Stealer.dll
unpack001/Xworm-V5.6/Plugins/TCPConnections.dll
unpack001/Xworm-V5.6/Plugins/UACBypass.dll
unpack001/Xworm-V5.6/Plugins/VB.NET Compiler.dll
unpack001/Xworm-V5.6/Plugins/VoiceChat.dll
unpack001/Xworm-V5.6/Plugins/WSound.dll
unpack001/Xworm-V5.6/Plugins/WebCam.dll
unpack001/Xworm-V5.6/SimpleObfuscator.dll
unpack001/Xworm-V5.6/Xworm 5.6.exe

Files

Xworm-V5.6.rar
.rar

Password: XWorm
Xworm-V5.6/Background.png
.png

Password: XWorm
Xworm-V5.6/ClientsFolder/29D72E7340BD5DE4669A/WebCam/06-08-2024 17;36;22;995.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/29D72E7340BD5DE4669A/WebCam/06-08-2024 17;36;27;775.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/3D22B87374BBFEF07C89/WebCam/06-13-2024 21;36;02;932.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/3D22B87374BBFEF07C89/WebCam/06-13-2024 21;36;05;111.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/3D22B87374BBFEF07C89/WebCam/06-13-2024 21;36;07;371.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/3D22B87374BBFEF07C89/WebCam/06-13-2024 21;36;09;675.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;03;578.jpg
.jpg

Password: XWorm
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;04;116.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;04;868.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;05;447.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;06;157.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;06;699.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;07;587.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;08;316.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;09;170.jpg
.jpg
Xworm-V5.6/ClientsFolder/51BE90C6FABC6310F50A/WebCam/06-15-2024 17;55;09;998.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;52;48;205.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;52;50;365.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;52;52;523.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;53;01;599.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;53;03;595.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;53;05;982.jpg
.jpg
Xworm-V5.6/ClientsFolder/61A20AB6A059CCBC1CC6/WebCam/06-19-2024 19;53;08;584.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/Recovery/Telegram_tdata_05-30-2024 20;36;08;987.zip
.zip
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;06;962.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;07;571.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;08;107.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;08;652.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;09;187.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;09;718.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;10;274.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;10;827.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;11;376.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;11;926.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;12;499.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;13;065.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;13;616.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;14;193.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;14;757.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;15;277.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;15;834.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;16;401.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;16;951.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;17;509.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;18;075.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;18;644.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;19;179.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;19;709.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;20;219.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;20;770.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;21;309.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;21;825.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;22;372.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;22;931.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;23;509.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;24;042.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;24;619.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;25;154.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;25;688.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;26;208.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;26;751.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;27;268.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;27;801.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;28;338.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;28;900.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;29;432.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;29;958.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;30;509.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;31;089.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;31;619.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;32;154.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;32;696.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;33;255.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;33;803.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;34;373.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;34;899.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;35;432.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;35;969.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;36;509.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;37;054.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;37;607.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;38;149.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;38;660.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;39;199.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;39;715.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;40;250.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;40;762.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;41;309.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;41;835.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;42;363.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;42;915.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;43;471.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;44;010.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;44;531.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;45;055.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;45;625.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;46;170.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;46;686.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;47;224.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;48;048.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;48;609.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;49;138.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;49;673.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;50;211.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;50;736.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;51;287.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;51;825.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;52;353.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;52;885.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;53;437.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;53;975.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;54;504.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;55;066.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;55;600.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;56;135.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;56;666.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;57;225.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;57;752.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;58;331.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;58;892.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;59;428.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;37;59;967.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;00;509.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;01;028.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;01;593.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;02;169.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;02;739.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;03;312.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;03;865.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;04;425.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;04;959.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;05;508.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;06;072.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;06;629.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;07;163.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;07;730.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;08;256.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;08;857.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;09;527.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;10;100.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;10;729.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;11;261.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;11;812.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;12;374.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;12;896.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;13;431.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;13;959.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;14;485.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;15;079.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;15;649.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;16;177.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;16;729.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;17;262.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;17;832.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;18;473.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;19;068.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;19;618.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;20;275.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;20;819.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;21;377.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;21;921.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;22;460.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;23;037.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;23;622.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;24;170.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;24;701.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;25;254.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;25;779.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;26;341.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;26;884.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;27;407.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;27;952.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;28;546.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;29;082.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;29;649.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;30;201.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;30;780.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;31;410.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;31;948.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;32;519.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;33;051.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;33;597.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;34;125.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;34;675.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;35;230.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;35;771.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;36;334.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;36;850.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;37;386.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;37;922.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;38;736.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;39;284.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;40;130.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;40;664.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;41;204.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;41;737.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;42;282.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;42;817.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;43;360.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;43;891.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;44;448.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;45;001.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;45;553.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;46;071.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;46;599.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;47;134.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;47;642.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;48;171.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;48;719.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;49;252.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;49;806.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;50;375.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;50;917.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;51;470.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;52;012.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;52;552.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;53;104.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;53;682.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;54;215.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;54;767.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;55;280.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;55;800.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;56;346.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;56;878.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;57;432.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;58;037.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;58;576.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;59;101.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;38;59;654.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;00;208.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;00;728.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;01;277.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;01;832.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;02;345.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;02;868.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;03;415.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;03;975.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;04;515.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;05;044.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;05;587.jpg
.jpg
Xworm-V5.6/ClientsFolder/69FCA174059956341A68/WebCam/05-30-2024 20;39;06;118.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;07;612.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;08;175.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;08;957.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;09;763.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;10;184.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;10;522.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;10;861.jpg
.jpg
Xworm-V5.6/ClientsFolder/756D7818512332543C38/WebCam/06-15-2024 17;58;11;255.jpg
.jpg
Xworm-V5.6/ClientsFolder/787178BE74A59D4C804E/Recovery/Telegram_tdata_06-19-2024 20;16;35;141.zip
.zip
Xworm-V5.6/ClientsFolder/7A36E6A7BFA23A0BDB31/Recovery/Chromium_06-11-2024 15;14;20;499.txt
Xworm-V5.6/ClientsFolder/7A36E6A7BFA23A0BDB31/Recovery/DiscordToken_06-11-2024 15;15;15;107.txt
Xworm-V5.6/ClientsFolder/80D5FEBFEA24864AB036/Recovery/Chromium_07-02-2024 13;35;44;528.txt
Xworm-V5.6/ClientsFolder/80D5FEBFEA24864AB036/Recovery/Telegram_tdata_07-02-2024 13;36;17;497.zip
.zip
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;38;333.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;38;547.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;39;489.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;39;713.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;40;583.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;40;795.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;41;014.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;41;274.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;42;275.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;43;287.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;44;583.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;44;853.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;45;078.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;45;309.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;45;566.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;46;489.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;47;388.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;47;619.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;48;776.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;49;586.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;50;249.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;50;898.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;51;179.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;52;101.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;52;391.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;53;385.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;55;652.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;56;048.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;57;145.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;57;356.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;57;686.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;58;865.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;11;59;415.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;00;468.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;00;977.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;01;296.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;01;591.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;02;117.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;02;513.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;02;851.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;03;845.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;04;844.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;05;097.jpg
.jpg
Xworm-V5.6/ClientsFolder/B986920FC5B7C29B4C1B/WebCam/06-08-2024 22;12;05;357.jpg
.jpg
Xworm-V5.6/ClientsFolder/CCB061BC85C22553339E/Recovery/DiscordToken_06-05-2024 15;40;23;526.txt
Xworm-V5.6/FastColoredTextBox.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Fixer.bat
Xworm-V5.6/GMap.NET.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/GMap.NET.WindowsForms.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/GeoIP.dat
Xworm-V5.6/Guna.UI2.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Certificate

Issuer

CN=Sobatdata Root CA

Not Before

23-10-2019 05:22

Not After

22-10-2025 17:00

Subject

CN=Sobatdata Software

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Signer

Actual PE Digest

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/IconExtractor.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Icons/1
.png
Xworm-V5.6/Icons/2.ico
Xworm-V5.6/Icons/3.ico
Xworm-V5.6/Icons/4.ico
Xworm-V5.6/Icons/5.ico
Xworm-V5.6/Icons/6.ico
Xworm-V5.6/Icons/icon (1).ico
Xworm-V5.6/Icons/icon (10).ico
Xworm-V5.6/Icons/icon (11).ico
Xworm-V5.6/Icons/icon (12).ico
Xworm-V5.6/Icons/icon (13).ico
Xworm-V5.6/Icons/icon (14).ico
Xworm-V5.6/Icons/icon (15).ico
Xworm-V5.6/Icons/icon (16).ico
Xworm-V5.6/Icons/icon (17).ico
Xworm-V5.6/Icons/icon (2).ico
Xworm-V5.6/Icons/icon (3).ico
Xworm-V5.6/Icons/icon (4).ico
Xworm-V5.6/Icons/icon (5).ico
Xworm-V5.6/Icons/icon (6).ico
Xworm-V5.6/Icons/icon (7).ico
Xworm-V5.6/Icons/icon (8).ico
Xworm-V5.6/Icons/icon (9).ico
Xworm-V5.6/Logs/ErrorLogs.txt
Xworm-V5.6/NAudio.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22-01-2019 00:00

Not After

27-02-2022 23:59

Subject

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Signer

Actual PE Digest

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 494KB - Virtual size: 493KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15-01-2021 00:00

Not After

14-01-2046 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15-07-2021 00:00

Not After

14-07-2031 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13-08-2021 00:00

Not After

29-10-2024 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/ActiveWindows.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Chat.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Chromium.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Clipboard.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Cmstp-Bypass.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/FileManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 677KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/FilesSearcher.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 476KB - Virtual size: 476KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/HBrowser.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/HRDP.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/HVNC.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/HVNCMemory.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/HiddenApps.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Informations.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Keylogger.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Maps.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/MessageBox.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Microphone.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 538KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Ngrok-Installer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Options.dll
.dll .ps1 windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Pastime.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Performance.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/ProcessManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Programs.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Ransomware.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Recovery.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Regedit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/RemoteDesktop.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/ReverseProxy.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/RunPE.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/ServiceManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Shell.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/StartupManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/Stealer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/TCPConnections.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/UACBypass.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/VB.NET Compiler.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/VoiceChat.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/WSound.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Plugins/WebCam.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/RES/U40957361f7481084776e6aedU9f0U1
Xworm-V5.6/RES/XWorm.ACT.resources
Xworm-V5.6/RES/XWorm.About.resources
Xworm-V5.6/RES/XWorm.Builder.resources
Xworm-V5.6/RES/XWorm.Chat.resources
Xworm-V5.6/RES/XWorm.Clipboard.resources
Xworm-V5.6/RES/XWorm.Clipper.resources
Xworm-V5.6/RES/XWorm.CustomOpen.resources
Xworm-V5.6/RES/XWorm.DDosAttack.resources
Xworm-V5.6/RES/XWorm.EditReg.resources
Xworm-V5.6/RES/XWorm.FM.resources
Xworm-V5.6/RES/XWorm.FilesSearcher.resources
Xworm-V5.6/RES/XWorm.Ftp.resources
Xworm-V5.6/RES/XWorm.Fun.resources
Xworm-V5.6/RES/XWorm.HApps.resources
Xworm-V5.6/RES/XWorm.HBrowser.resources
Xworm-V5.6/RES/XWorm.HRDP.resources
Xworm-V5.6/RES/XWorm.HVNC.resources
Xworm-V5.6/RES/XWorm.Hash.resources
Xworm-V5.6/RES/XWorm.Hosts.resources
Xworm-V5.6/RES/XWorm.INFO.resources
Xworm-V5.6/RES/XWorm.Keylogger.resources
Xworm-V5.6/RES/XWorm.MBox.resources
Xworm-V5.6/RES/XWorm.MIC.resources
Xworm-V5.6/RES/XWorm.Main.resources
Xworm-V5.6/RES/XWorm.Maps.resources
Xworm-V5.6/RES/XWorm.Performance.resources
Xworm-V5.6/RES/XWorm.Port.resources
Xworm-V5.6/RES/XWorm.ProcessV.resources
Xworm-V5.6/RES/XWorm.Programs.resources
Xworm-V5.6/RES/XWorm.Proxy.resources
Xworm-V5.6/RES/XWorm.Ransomware.resources
Xworm-V5.6/RES/XWorm.Registry.resources
Xworm-V5.6/RES/XWorm.RemoteDesktop.resources
Xworm-V5.6/RES/XWorm.Resources.resources
.vbs
Xworm-V5.6/RES/XWorm.RunPE.resources
Xworm-V5.6/RES/XWorm.ServiceManager.resources
Xworm-V5.6/RES/XWorm.Shell.resources
Xworm-V5.6/RES/XWorm.Sound.resources
Xworm-V5.6/RES/XWorm.StartupManager.resources
Xworm-V5.6/RES/XWorm.TBotNotify.resources
Xworm-V5.6/RES/XWorm.TXT.resources
Xworm-V5.6/RES/XWorm.TcpConnectionForm.resources
Xworm-V5.6/RES/XWorm.ToolsBox.resources
Xworm-V5.6/RES/XWorm.VBCode.resources
Xworm-V5.6/RES/XWorm.VoiceChat.resources
Xworm-V5.6/RES/XWorm.WebCam.resources
Xworm-V5.6/RES/XWorm.ngrok.resources
Xworm-V5.6/SimpleObfuscator.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V5.6/Sounds/Chat.wav
Xworm-V5.6/Sounds/Intro.wav
Xworm-V5.6/XWorm V5.6.exe.config
.xml
Xworm-V5.6/Xworm 5.6.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 770B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31.5MB - Virtual size: 31.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: XWorm

Password: XWorm

Password: XWorm

Password: XWorm

Password: XWorm

Password: XWorm

Password: XWorm

Password: XWorm

Password: XWorm

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 331KB - Virtual size: 330KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 144KB - Virtual size: 144KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:dbCertificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 8KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 940B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1Certificate

.text
Size: 331KB - Virtual size: 330KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.9MB - Virtual size: 2.9MB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 144KB - Virtual size: 144KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 940B

.reloc
Size: 512B - Virtual size: 12B

37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Signer

.text
Size: 494KB - Virtual size: 493KB

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 512B - Virtual size: 12B

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

.text
Size: 681KB - Virtual size: 680KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 856B