agenttesla | Xworm-V6[.]1 (2)[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

Xworm-V6.1 (2).rar
Size

64.4MB
MD5

2a3d4e25ed01e9585e5ab5826a6a4111
SHA1

0e51faf8e51e640f0efefa4d5deba896f88f0f49
SHA256

9b56ee6ee5bb27b038df82d0ef4f03246e0449515f3b6cfb47155ca5d80d0a5a
SHA512

d6b4e7763238210e07e80d89da930de85c070ff90a2f39b9c713aea12927426161a3f7341c8f693000455f9ef60377e1d4eae02928cc73eaf9bf82c7a4dca7a3
SSDEEP

1572864:s3Umd27Ft310rYwfqtNEs8XLyURiI1wl9Z2fEc9+gjjIWPf1L:skIylLwfqtNEZXLZ4I16mEc9+gjjff1L

Score

10^/10

agenttesla stormkitty xworm

Malware Config

Signatures

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Guna.UI2.dll	family_agenttesla

Agenttesla family
agenttesla

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
static1/unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Options.dll	disable_win_def

Detect Xworm Payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Resources.resources	family_xworm

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Recovery.dll	family_stormkitty

Stormkitty family
stormkitty
Xworm family
xworm

Unsigned PE 45 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/FastColoredTextBox.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/GMap.NET.Core.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/GMap.NET.WindowsForms.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/IconExtractor.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ActiveWindows.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Chat.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Chromium.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Clipboard.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Cmstp-Bypass.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/FileManager.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/FilesSearcher.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HBrowser.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HRDP.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HVNC.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HVNCMemory.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HiddenApps.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Informations.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Keylogger.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Maps.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/MessageBox.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Microphone.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Ngrok-Installer.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Options.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Pastime.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Performance.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ProcessManager.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Programs.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Ransomware.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Recovery.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Regedit.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/RemoteDesktop.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ReverseProxy.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/RunPE.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ServiceManager.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Shell.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/StartupManager.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Stealer.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/TCPConnections.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/UACBypass.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/VB.NET Compiler.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/VoiceChat.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/WSound.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/WebCam.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/SimpleObfuscator.dll
unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Xworm V6.1.exe

Office document contains embedded OLE objects 1 IoCs

Detected embedded OLE objects in Office documents.

Processes:

resource	yara_rule
static1/unpack001/Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/1.docx	office_ole_embedded

Files

Xworm-V6.1 (2).rar
.rar
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Background.png
.png
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/DiscordToken_06-05-2024 20;14;15;846.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/050ED1609754E9530C78/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/DiscordToken_06-05-2024 20;14;15;639.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/0ED40F7775D109858D40/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/DiscordToken_06-05-2024 18;57;00;104.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/DiscordToken_06-05-2024 20;14;13;841.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/cookies.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/2162BE28D63A11E4FE75/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/DiscordToken_08-07-2024 05;53;02;598.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/46531E75C039DA0335CA/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/Chromium_06-05-2024 17;47;18;021.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/DiscordToken_06-05-2024 17;47;24;293.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/4CC284B56F6834BDBA66/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/Chromium_06-05-2024 19;44;44;604.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/56E9597A91F0CA8475EC/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/Chromium_06-05-2024 15;09;06;022.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/DiscordToken_06-05-2024 15;09;17;012.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/607A8FFC9AE2D5D93640/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/Chromium_08-07-2024 01;17;06;151.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/815D27DCE45710930CAB/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/DiscordToken_06-05-2024 11;49;12;049.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/cookies.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/907402972A66B808A190/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/09eba037-560b-4f91-8fac-3a7a98f673ac.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/1.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/3d5f3a04-2a54-4870-a539-af8d0ed70b34.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/4fc79636-a0b0-4b69-b7d2-7b8c98edc6c0.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/50902310-7d1f-4b5d-bd2c-1f976f4f7c27.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/6309f069-0e08-4f40-8e84-f9ff928757c2.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Doc1.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Doc2.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Doc3.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Doc4.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Doc6.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/cookies.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/THIRDY NUÑEZ.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/b3668a89-11d6-47f5-a120-d640190b191a.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/bd33ee6f-0de2-498e-aa27-84d6bcb64f0c.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/building permit.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/ca5b9fd3-86e6-4bd7-a5d5-31d1faf599d2.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/ca6f0e52-53b7-4ee4-8df7-8415e0041c30.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/cf4145d3-b880-4d43-9c06-8d6ebb8d948b.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/de31b140-02a3-4c78-81ab-b59cd3f2a620.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/e286e418-8d0d-4381-8427-740bd5ffcda4.jpg
.jpg
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/ekectrical plan.docx
.docx office2007
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/~$Doc1.docx
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9223F783B94D74A70ED4/~$Doc6.docx
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/DiscordToken_06-05-2024 13;31;52;299.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/cookies.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/9C8D9A2A778F6FC54504/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/Chromium_06-05-2024 18;57;04;609.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/Chromium_06-05-2024 20;04;52;467.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/DiscordToken_06-05-2024 18;57;10;328.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/DiscordToken_06-05-2024 20;14;13;840.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/DiscordToken_06-05-2024 20;21;25;018.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/cookies.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A22BA88618B7B8EC5441/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/DiscordToken_06-05-2024 20;14;19;769.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/A9A866D60FE836F02DD2/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/AFD59616A6CE84A7876F/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/AFD59616A6CE84A7876F/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/AFD59616A6CE84A7876F/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/AFD59616A6CE84A7876F/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/AFD59616A6CE84A7876F/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/AFD59616A6CE84A7876F/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/DiscordToken_06-05-2024 12;18;14;511.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/DiscordToken_06-05-2024 17;07;04;567.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/cookies.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/CFE8D379188E499C0CC3/Recovery/WifiKeys_06-05-2024 12;18;26;753.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/F92CC07381CFFC4507F6/Recovery/RecoveryData/autofill.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/F92CC07381CFFC4507F6/Recovery/RecoveryData/bookmark.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/F92CC07381CFFC4507F6/Recovery/RecoveryData/cookies.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/F92CC07381CFFC4507F6/Recovery/RecoveryData/credit.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/F92CC07381CFFC4507F6/Recovery/RecoveryData/history.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/ClientsFolder/F92CC07381CFFC4507F6/Recovery/RecoveryData/passwords.json
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/FastColoredTextBox.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Fixer.bat
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/GMap.NET.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/GMap.NET.WindowsForms.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/GeoIP.dat
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Guna.UI2.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Certificate

Issuer

CN=Sobatdata Root CA

Not Before

23-10-2019 05:22

Not After

22-10-2025 17:00

Subject

CN=Sobatdata Software

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Signer

Actual PE Digest

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/IconExtractor.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (1).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (10).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (11).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (12).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (13).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (14).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (15).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (16).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (17).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (2).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (3).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (4).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (5).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (6).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (7).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (8).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Icons/icon (9).ico
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Logs/ErrorLogs.txt
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/NAudio.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22-01-2019 00:00

Not After

27-02-2022 23:59

Subject

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Signer

Actual PE Digest

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 494KB - Virtual size: 493KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15-01-2021 00:00

Not After

14-01-2046 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15-07-2021 00:00

Not After

14-07-2031 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13-08-2021 00:00

Not After

29-10-2024 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ActiveWindows.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Chat.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Chromium.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Clipboard.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Cmstp-Bypass.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/FileManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 677KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/FilesSearcher.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 476KB - Virtual size: 476KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HBrowser.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HRDP.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HVNC.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HVNCMemory.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/HiddenApps.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Informations.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Keylogger.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Maps.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/MessageBox.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Microphone.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 538KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Ngrok-Installer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Options.dll
.dll .ps1 windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Pastime.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Performance.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ProcessManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Programs.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Ransomware.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Recovery.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Regedit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/RemoteDesktop.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ReverseProxy.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/RunPE.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/ServiceManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Shell.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/StartupManager.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/Stealer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/TCPConnections.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/UACBypass.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/VB.NET Compiler.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/VoiceChat.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/WSound.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Plugins/WebCam.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 207KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/U40957361f7481084776e6aedU9f0U1
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.ACT.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.About.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Builder.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Chat.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Clipboard.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Clipper.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.CustomOpen.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.DDosAttack.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.EditReg.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.FM.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.FilesSearcher.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Ftp.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Fun.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.HApps.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.HBrowser.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.HRDP.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.HVNC.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Hash.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Hosts.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.INFO.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Keylogger.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.MBox.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.MIC.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Main.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Maps.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Performance.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Port.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.ProcessV.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Programs.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Proxy.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Ransomware.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Registry.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.RemoteDesktop.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Resources.resources
.vbs
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.RunPE.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.ServiceManager.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Shell.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.Sound.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.StartupManager.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.TBotNotify.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.TXT.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.TcpConnectionForm.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.ToolsBox.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.VBCode.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.VoiceChat.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.WebCam.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/RES/XWorm.ngrok.resources
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/SimpleObfuscator.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Sounds/Chat.wav
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Sounds/Intro.wav
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/XWorm V5.6.exe.config
.xml
Xworm-V6.1 (2)/Xworm-V6.1/Xworm-V6.1/Xworm V6.1.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 331KB - Virtual size: 330KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 144KB - Virtual size: 144KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:dbCertificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 8KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 940B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

.text
Size: 331KB - Virtual size: 330KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 2.9MB - Virtual size: 2.9MB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 144KB - Virtual size: 144KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 940B

.reloc
Size: 512B - Virtual size: 12B

37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Signer

.text
Size: 494KB - Virtual size: 493KB

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 512B - Virtual size: 12B

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

.text
Size: 681KB - Virtual size: 680KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 30KB - Virtual size: 29KB