xd-AntiSpy_modern.zip
- SHA256 39f5adab7ad13d1bad081cf971e0ed53c8d8ccc4b902dff4be73e4b7902eaad8
Overview
overview
10Static
static
3xd-AntiSpy_modern.zip
windows11-21h2-x64
1Localizati...ry.dll
windows11-21h2-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1PluginInterface.dll
windows11-21h2-x64
1lang.json
windows11-21h2-x64
3plugins/Cl...e.json
windows11-21h2-x64
3plugins/Fi...y.json
windows11-21h2-x64
3plugins/Pl...er.dll
windows11-21h2-x64
1plugins/Pl...er.ps1
windows11-21h2-x64
3plugins/Pl...er.dll
windows11-21h2-x64
1plugins/Pl...r.json
windows11-21h2-x64
3plugins/Re...er.ps1
windows11-21h2-x64
8plugins/Sn...t.json
windows11-21h2-x64
3plugins/Un...ve.ps1
windows11-21h2-x64
8plugins/Us...e.json
windows11-21h2-x64
3plugins/Us...l.json
windows11-21h2-x64
3xd-AntiSpy.exe
windows11-21h2-x64
xd-AntiSpy.png
windows11-21h2-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xd-AntiSpy_modern.zip
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
LocalizationLibrary.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
Newtonsoft.Json.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
PluginInterface.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
lang.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
plugins/Clear Icon Cache.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
plugins/File Extensions Visibility.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral8
Sample
plugins/PluginButler.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
plugins/PluginButler.ps1
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
plugins/PluginDebloater.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral11
Sample
plugins/PluginDebloater.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral12
Sample
plugins/Restart Explorer.ps1
Resource
win11-20240802-en
windows11-21h2-x64
16 signatures
600 seconds
Behavioral task
behavioral13
Sample
plugins/Snap Assist Flyout.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral14
Sample
plugins/Uninstall OneDrive.ps1
Resource
win11-20240802-en
windows11-21h2-x64
22 signatures
600 seconds
Behavioral task
behavioral15
Sample
plugins/Use light theme.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral16
Sample
plugins/User Account Control.json
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral17
Sample
xd-AntiSpy.exe
Resource
win11-20240802-en
windows11-21h2-x64
24 signatures
600 seconds
Behavioral task
behavioral18
Sample
xd-AntiSpy.png
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
600 seconds
General
- Target xd-AntiSpy_modern.zip
- Size 375KB
- Sample240812-h3bmtaveka
- SHA256 39f5adab7ad13d1bad081cf971e0ed53c8d8ccc4b902dff4be73e4b7902eaad8
- MD5 238159933f95443b3d1e14424f6008bf
- SHA1 8ff807098acd58f508ae8ad620c8b41a89273a08
- SHA512 8139fdb180b27a2790b794afb1cfb3013121316981ee4df7a2fd01c7d393d4891b5d236677e4b6e58a6efcbba8f7b5f698c741b333a2a27fea231b69662b7e8c
- SSDEEP 6144:TsfwVUrEJxyE5tgdKhqFjuIpuFoYmyFRozXMbgGKAkaPI5siTL6UUR1Px:TsfLrE3y4gdKcgOuAzXMpjkag5DTL6UQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/LocalizationLibrary.dll unpack001/PluginInterface.dll unpack001/plugins/PluginButler.dll unpack001/plugins/PluginDebloater.dll unpack001/xd-AntiSpy.exe
File Explorer
-
xd-AntiSpy_modern.zip.zip 375KB
-
LocalizationLibrary.dll.dll 40KB
-
Newtonsoft.Json.dll.dll 695KB
-
PluginInterface.dll.dll 4KB
-
lang.json29B
-
plugins/Clear Icon Cache.json581B
-
plugins/File Extensions Visibility.json1KB
-
plugins/PluginButler.dll.dll 18KB
-
plugins/PluginButler.json.ps1 9KB
-
plugins/PluginDebloater.dll.dll 23KB
-
plugins/PluginDebloater.json18KB
-
plugins/Restart Explorer.ps1.ps1 497B
-
plugins/Snap Assist Flyout.json640B
-
plugins/Uninstall OneDrive.ps1.ps1 2KB
-
plugins/Use light theme.json1022B
-
plugins/User Account Control.json1KB
-
xd-AntiSpy.exe.exe 133KB
-
xd-AntiSpy.png.png 31KB
LocalizationLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad2ed7a52140d72aebd27366b1966850aa2bbe1064ebd99b5141d339d9868fb6
- MD5 355ef275485c7257431b697da7b5aa92
- SHA1 4025920bfc33a9f1405245e1cc6312064ac3d8b5
- SHA512 e07c421b6134d491039cb6498e11dd0d99d54e35eb6acbf83a6f1b02e44c14a0bc1d824a0cf113a722fbe853a9e4d8d38887ff9f17e7f5665eaaaf2fabcd2da4
- SSDEEP 768:QI1iBHfJA9eGNhnapBa437FC9yLHQ8146l+UxLglce/AzzYWl56IlNA5Iw0WMdu:QIwNf4x+l7FC9yLHQK46l+U+ce/AzzYa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Belim\Desktop\xd-AntiSpy modern\LocalizationLibrary\obj\Debug\LocalizationLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PluginInterface.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 401da4bcbfc4c31613811e2071886132d876a9375efbaccf887c9305f658a9d6
- MD5 fbc4671df9ded845b971d3f042b259d6
- SHA1 043d7d1afe25f1a5efac30e03629270ea9ccbe9c
- SHA512 039e2bd2d5a63f7800133e03fa3d87e319cf6e2396baa1ec466337e39b3bc4422b49f43c7790a2071fdd721e0c0b0a1658a9686e3e16d1632ed56e0faea72a16
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9970
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Belim\Desktop\xd-AntiSpy modern\PluginInterface\obj\Debug\PluginInterface.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lang.json
- SHA256 a7428556e50caf3314b6c80e051bb61c5831ee900b0bcca749ab05e35469a0d5
- MD5 eec56a51c3361aa5a66de24d3bd23bc9
- SHA1 340c384aff6cfd8c6b4ca52f9a2cdd0b955fb140
- SHA512 6f88724220944b4cd253458f65aeab02236368ac8ca073e83e957769e9e38cdb9f29516c660c648690e4593e0793b55833444ee27ed239f02ad71c7d856a5931
- MD5 SHA1 SHA512
plugins/Clear Icon Cache.json
- SHA256 dbc5d6058f3293d34ddf8bec1279af343ebf66670e89cf8e02a512f2807e028c
- MD5 5bd80bd19f9d82495feb01faacb6681c
- SHA1 de2d7151f87f8b47c12fe7560c4732674cc3b325
- SHA512 beaea631337102c96ef3038e5f1c2e2a475c37779ba4ceb26e8b6a1d83230d26ef15fef9e2c0315ce550a097c9788a060a2528aaa65568d73c9dfffaeceb998d
- MD5 SHA1 SHA512
plugins/File Extensions Visibility.json
- SHA256 6e5dafec7faf6c5fc7b71c2b4562f554f5c28a4a6cde0660ad9734702f2fec74
- MD5 f9c31fa55ce41a828ee749798575e55a
- SHA1 9eed519bc244c964af105ee4902dbe060e605c85
- SHA512 353de1f949afbd854a752d3f3d0cd1c1f82957144942abafe0a4a25816d48cd67671e65104eac8a4cc666502d4033a4dcf9de74ff956b834abb4202236ee3444
- MD5 SHA1 SHA512
plugins/PluginButler.dll
- SHA256 9a223a0d405554bc4681ce90ee4f46adeca35f111c329090f08e699e27f6d2a0
- MD5 e74b70ff8ad8da5d065b3bcf8018d732
- SHA1 4ca18f0603a1218239a1012bed88621c7c63a777
- SHA512 f4a9e97c3d07fb7ea7b8cb08d82163028ff74856e39e07ad13ff918fe57a1868959e3bc715e8b7cc093f6a490349fc51aab191d251fdcc8f9133d17ac7d06fbd
- SSDEEP 384:W0qJI+gB9yhuUaeG53rn5WLp6qXG05P8Btq55fVg+1c+zVhu:W8+gHL3rn26qXfzlT1c4W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Belim\Desktop\xd-AntiSpy modern\PluginButler\obj\Debug\PluginButler.pdb
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
plugins/PluginButler.json
- SHA256 38d87890fd5325e79f16f4ebcdc291b7e805d2ba0fc6f2c05668fae165dbbf3a
- MD5 69ebcba399c089ffd048f060990f54f6
- SHA1 b22184acbdd762f60210116394f9d5f8ff7c485a
- SHA512 a69aebbb32a5d46f26e8c0a1877e16841e70a94437a80abb17ba599eb67a970d2e8d6fb87ce4dbc827df06fa4f3f2a0134db1f3724941dceffee4f68b078277b
- SSDEEP 192:BMN1eR742py6sb64p2mbW6Cc9WcRoCadeXrMh+xZy0:+TeRc2pydu4p2mbv9WMotdeXrMUxZy0
- MD5 SHA1 SHA512 SSDEEP
plugins/PluginDebloater.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b96eb56a71a9f0eab0185b25a92999c6dcca62071e1cecb75d0d95279e1b0b2
- MD5 f2b47bb1c2abc73dd3d442d405a3f992
- SHA1 fde43b7b439cb15ad7455abbf32e3fab3cf6dbc3
- SHA512 25fbf1509c8d17529137ac038b783c4fca91046f39bdad8dda05126d2252e728949746bce56f1e85012e6ef3a6a0d3ebb50d8eb90180098ab5210b4b3b2e31a1
- SSDEEP 384:LXfyB5XsSqEbVP0jtRmWbf5sNgcPNg+lluEaPJJgtQqa5GXfefi/VC7J:LvyJkXBs6cPy0itqnefwA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Belim\Desktop\xd-AntiSpy modern\PluginDebloater\obj\Debug\PluginDebloater.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
plugins/PluginDebloater.json
- SHA256 7a293003041a674f10288f95807f06b12cb5905cfcc4754841152dc8b099dd68
- MD5 0bb801fb7dd92875f4423fcde37581fb
- SHA1 23b75784b774ae4c42984ae267a31882d3d5eda5
- SHA512 f1443c71a5ef6893bc3ccaf2735de82cd275eef48d14d477d5ccd6bdb5526c25ff522244e23ce084898301ba607aa35b00da03a7f8ed85e83c29f0b7f6651a01
- SSDEEP 384:HHoHk8HMGpKrREKIbZjnOChhLJk6KuNW2:HHor75r/
- MD5 SHA1 SHA512 SSDEEP
plugins/Restart Explorer.ps1
- SHA256 ce31d19e4b3c0a707053dc081e109a465487f57b5180fb470be9ef75f391095d
- MD5 2ebc3b277b6b0038b48f557507372a08
- SHA1 debaa00dbfa123ddf1d1d4d004250777f067d12b
- SHA512 45f79f41f42ad1901af650bdcb8237f494c8dda759efd21fe2f5d3591cd0b7e10e8f518c62c1b8b9dea4f1b4fc8907bc83446f53a1f72b1adce53f68709e2c5c
- MD5 SHA1 SHA512
plugins/Snap Assist Flyout.json
- SHA256 07be898189534f434af1b23fbbd7d19f8197b11399b9c55780f2b11cb1ebf159
- MD5 5e417c798cdb4da02dd1757f10677a14
- SHA1 af8b4b8538087da29c51b4d7f04a69284b19f729
- SHA512 a7608abb5dec67faec30800ff097dc46266d30d62ffb12fb624f33f02af5f3ba74c2606c4d3d96c6dac31fe67cb7493c5fe328d4711a217a47deeeee7a32fe42
- MD5 SHA1 SHA512
plugins/Uninstall OneDrive.ps1
- SHA256 945f7e685db6fc568cc8eb114b4d54dd7d1d5feb0879c84fe3f82ed786ae3b8d
- MD5 d3228595fe69c9f115e84592c6a70e48
- SHA1 6795f195012476b278b1dee2766d8e62df96d0a7
- SHA512 5fae9274601b7bbfd8d3ec2ecba984e59dbfd20a8c31d5bd3bf8f32de9c004916ecea6328db2b1dfb5e2fc9737dbdf769104afe2c8f7476d695dd3b1d3827554
- MD5 SHA1 SHA512
plugins/Use light theme.json
- SHA256 102a076a0446290c6e454033c47165891f7942b7de9690517f5bf0ceb443a6eb
- MD5 636f8fbb6fc0f942ab31666dccc5d499
- SHA1 efe538b6b2ea32d0ed4b944400be86319901f47e
- SHA512 468ae61e94c106d8ddfa11da1b25b5177ec5665b20b39ed5272da72c6726e868c34426c21d11767de7b277b56863564e3ae5c997beb6be803c98e6af45f089d7
- MD5 SHA1 SHA512
plugins/User Account Control.json
- SHA256 b516eda092b3420e3e0a8ba73cf96573cf947c22b39dba8a4672948d74e7f929
- MD5 a178eda0a77068ea7770b4c7bcc8797f
- SHA1 1ece27ae47884dd7faa27ec80140dc9dc9c25be8
- SHA512 7bd0b527fdbc07fa2be37679b06c0422ea07ff2bb54ab5020dafcb09bc96a55597001f9f8b21dc71ba8994420fd8f2b008830aab276b4e259e48d1bf5b66fa05
- MD5 SHA1 SHA512
xd-AntiSpy.exe
- SHA256 648665b2b8d37614e8997c43ebe18e4026e976ef8d08a716f7c4388b567e09fe
- MD5 1ed33278dba878502386ca4e535dd305
- SHA1 5810cb649c295c89fceb953fc36bca5b236b809e
- SHA512 c3f7880d261b6be9fcc60438408005d5b843228f4282a61de9f06d246e806e5e672e2117db27a8882e33144a85a1ef18c2f3f744088172f216544aa682767595
- SSDEEP 3072:hrCNOoWvDsNE476Q5ndZDDVq2j96+c4h+AK2LUsR8s6xRVehEA4ucyH9FViOG1JL:D0+AK2LUsR8s6xRVehEDbAbZIl/i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Belim\Desktop\xd-AntiSpy modern\xd-AntiSpy\obj\Debug\xd-AntiSpy.pdb
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
xd-AntiSpy.png
- SHA256 e1009fb19bc8a891aa1989dd59bfa6c265b66cfa58d9083ff6e2b15d9af32f48
- MD5 d2a0f93e1dcf29d9ad11433a6538dcae
- SHA1 ad1f6d104a49fa490cc1a1303c19cbbfea4b7411
- SHA512 e4f62f78c2a59ce7c03e3e93b18f65e8ac081876548636c9d387733fab16a9714179efed723c2b7817c1453ddb8edd2ca8a1f6c039b23d7dc2df06718f6cc50f
- SSDEEP 768:J9L8aPIEsFGbjnwsiQufajx0yMvR14hqjsd:TLFsAnzufWqR14qm
- MD5 SHA1 SHA512 SSDEEP