Toolz (astro).zip
- SHA256 110fd83bdeee1785c51b4ae919ea9aabffe74dfd9014a42577bb5ede476ea58a
Password
@ReverseEngineeringLab
General
- Target Toolz (astro).zip
- Size 161.1MB
- Sample241001-twvynayfpr
- SHA256 110fd83bdeee1785c51b4ae919ea9aabffe74dfd9014a42577bb5ede476ea58a
- MD5 103e93f9408f4195f294dc1aea765604
- SHA1 6e25051cb67851af85c1df5d1b91a90321e0957e
- SHA512 99dc616c28b3389bf4c5b49eaa5cb2f91eaeb0c9a22147a5da5bbe9e1dc061410f90ebc8e0064a4a070faba40448b551278cc578fa8dea638f9e45a27cbcdf56
- SSDEEP 3145728:sZparHZgZR/+0kZSi9vkbRNjX8GXKXaU5OgTbt+J7y+rL58Nj6m+ctQ+xhZJZSrl:6oGZp+0kut2OgTIJ7y+rL5oxaNb
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Stealerium family
- StormKitty payload 1 IoCs
resource yara_rule static1/unpack004/Plugins/eMTYbTz0gueNs4.dll family_stormkitty - Stormkitty family
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack004/Anarchy Panel.exe net_reactor - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/888 Rat v1.2.6/888 Rat v1.2.6.exe autoit_exe - Unsigned PE 22 IoCs
Checks for missing Authenticode signature.
resource unpack002/888 Rat v1.2.6/888 Rat v1.2.6.exe unpack004/Anarchy Panel.exe unpack004/Plugins/0guo3zbo66fqoG.dll unpack004/Plugins/59Zp7paEHDF7luJ.dll unpack004/Plugins/CjETR6GpGXqM.dll unpack004/Plugins/EVa7gBMKoaHmLC.dll unpack004/Plugins/FBSyChwp.dll unpack004/Plugins/G3nl0mDcABnDuZ.dll unpack004/Plugins/KNTmoSnG.dll unpack004/Plugins/PK0TcnqTGFagQTS.dll unpack004/Plugins/RssCnLKcGRxj.dll unpack004/Plugins/WkUP83aP9CABpi.dll unpack004/Plugins/eMTYbTz0gueNs4.dll unpack004/Plugins/fzAgyDYa.dll unpack004/Plugins/mGWHaG2Jn.dll unpack004/Plugins/mML6WKMqdxjDGA.dll unpack004/Plugins/oYsKwDG.dll unpack004/Plugins/rNXXgmX25s.dll unpack004/Plugins/sJ88z8tsg5XzK.dll unpack004/Plugins/yL9x34D8X3oO2P.dll unpack004/Plugins/zVvPGvK64uLS.dll unpack004/Plugins/zVvPGvK64uLS1.dll
File Explorer
-
Toolz (astro).zip.zip 161.1MB
-
Toolz (astro)/888 Rat v1.2.6.7z.7z 74.4MB
-
888 Rat v1.2.6/888 Rat v1.2.6.exe.exe 75.0MB
-
Toolz (astro)/Anarchy Panel 4.7.7z.7z 52.3MB
-
Anarchy Panel.exe.exe 54.6MB
-
Anarchy Panel.exe.config.xml 3KB
-
Plugins/0guo3zbo66fqoG.dll.dll 78KB
-
Plugins/59Zp7paEHDF7luJ.dll.dll 4.0MB
-
Plugins/CjETR6GpGXqM.dll.dll 395KB
-
Plugins/EVa7gBMKoaHmLC.dll.dll 170KB
-
Plugins/FBSyChwp.dll.dll 170KB
-
Plugins/G3nl0mDcABnDuZ.dll.dll 177KB
-
Plugins/KNTmoSnG.dll.dll 670KB
-
Plugins/PK0TcnqTGFagQTS.dll.dll 174KB
-
Plugins/RssCnLKcGRxj.dll.dll 181KB
-
Plugins/WkUP83aP9CABpi.dll.dll 86KB
-
Plugins/eMTYbTz0gueNs4.dll.dll 1.1MB
-
Plugins/fzAgyDYa.dll.dll 79KB
-
Plugins/mGWHaG2Jn.dll.dll 81KB
-
Plugins/mML6WKMqdxjDGA.dll.dll 173KB
-
Plugins/oYsKwDG.dll.dll 4.8MB
-
Plugins/rNXXgmX25s.dll.dll 1.5MB
-
Plugins/sJ88z8tsg5XzK.dll.dll 172KB
-
Plugins/yL9x34D8X3oO2P.dll.dll 180KB
-
Plugins/zVvPGvK64uLS.dll.dll 106KB
-
Plugins/zVvPGvK64uLS1.dll.dll 234KB
-
Toolz (astro)/Borat.7z.7z 8.6MB
-
Toolz (astro)/DarkVision Rat.7z.7z 2.1MB
-
Toolz (astro)/LOIC_2.9.9.99 2.zip.zip 201KB
-
Toolz (astro)/Netflix checker.7z.7z 1.2MB
-
Toolz (astro)/XBinder V2.7z.7z 430KB
-
Toolz (astro)/Yang nitro gen.zip.zip 21.8MB
-
__MACOSX/Toolz (astro)/._888 Rat v1.2.6.7z176B
-
__MACOSX/Toolz (astro)/._Anarchy Panel 4.7.7z176B
-
__MACOSX/Toolz (astro)/._Borat.7z176B
-
__MACOSX/Toolz (astro)/._DarkVision Rat.7z176B
-
__MACOSX/Toolz (astro)/._LOIC_2.9.9.99 2.zip229B
-
__MACOSX/Toolz (astro)/._Netflix checker.7z176B
-
__MACOSX/Toolz (astro)/._XBinder V2.7z176B
-
__MACOSX/Toolz (astro)/._Yang nitro gen.zip229B
Toolz (astro)/888 Rat v1.2.6.7z
- SHA256 4804a369c53921ce8b508b285eab8d50955418fcf95e98c43e07ce8cbdb5d43a
- MD5 54824148e3fbce8e82310a370fb15383
- SHA1 4a8f6987b8d7979bd736435c8172c432144f11b3
- SHA512 c059250eae8ec86b93d886f5acea8f81ff07bd48d2bcc66eca7120a1aabe3201c8ac9f82340d39a4d9d35e1e6acc4c1598c0acc9b2f58a7ebf8d4bce1f849b42
- SSDEEP 1572864:FCG9qXvvO+Uf9owh4ExnuJFDEcAWhd2xoeLne8QFHVlnBxBd8uzvAtToA3l8Ui:QgqXvvYf9oMbxnKFDEcAkPAiHV5bBG50
- MD5 SHA1 SHA512 SSDEEP
Password
@ReverseEngineeringLab
888 Rat v1.2.6/888 Rat v1.2.6.exe
- IMPHASH c4540f421523fe2dc591e50be5ad7d0b
- SHA256 5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98
- MD5 ad33064a9ca95c5b3ed45c14b7fe2739
- SHA1 0bd1286fa5fd936a31a4514798daffa444ce8e12
- SHA512 acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647
- SSDEEP 1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv
- MD5 SHA1 SHA512 SSDEEP
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
@ReverseEngineeringLab
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsock32
gethostbyname
recv
send
socket
inet_ntoa
setsockopt
ntohs
WSACleanup
WSAStartup
sendto
htons
__WSAFDIsSet
select
accept
listen
bind
inet_addr
ioctlsocket
recvfrom
WSAGetLastError
closesocket
gethostname
connect
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
waveOutSetVolume
mciSendStringW
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Remove
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_Create
mpr
WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW
WNetAddConnection2W
wininet
HttpOpenRequestW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
InternetCrackUrlW
HttpQueryInfoW
InternetQueryOptionW
InternetConnectW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
InternetReadFile
InternetQueryDataAvailable
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
userenv
DestroyEnvironmentBlock
LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
uxtheme
IsThemeActive
kernel32
DuplicateHandle
CreateThread
WaitForSingleObject
HeapAlloc
GetProcessHeap
HeapFree
Sleep
GetCurrentThreadId
MultiByteToWideChar
MulDiv
GetVersionExW
IsWow64Process
GetSystemInfo
FreeLibrary
LoadLibraryA
GetProcAddress
SetErrorMode
GetModuleFileNameW
WideCharToMultiByte
lstrcpyW
lstrlenW
GetModuleHandleW
QueryPerformanceCounter
VirtualFreeEx
OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateFileW
SetFilePointerEx
SetEndOfFile
ReadFile
WriteFile
FlushFileBuffers
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetFileTime
GetFileAttributesW
FindFirstFileW
FindClose
GetLongPathNameW
GetShortPathNameW
DeleteFileW
IsDebuggerPresent
CopyFileExW
MoveFileW
CreateDirectoryW
RemoveDirectoryW
SetSystemPowerState
QueryPerformanceFrequency
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTempPathW
GetTempFileNameW
DeviceIoControl
LoadLibraryW
GetLocalTime
CompareStringW
GetCurrentThread
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
CreatePipe
InterlockedExchange
TerminateThread
LoadLibraryExW
FindResourceExW
CopyFileW
VirtualFree
FormatMessageW
GetExitCodeProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
CreateEventW
SetEvent
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileSize
GlobalFree
GlobalMemoryStatusEx
Beep
GetSystemDirectoryW
HeapReAlloc
HeapSize
GetComputerNameW
GetWindowsDirectoryW
GetCurrentProcessId
GetProcessIoCounters
CreateProcessW
GetProcessId
SetPriorityClass
VirtualAlloc
GetCurrentDirectoryW
lstrcmpiW
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
CloseHandle
GetFullPathNameW
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetACP
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetCurrentDirectoryW
FindNextFileW
WriteConsoleW
user32
GetKeyboardLayoutNameW
IsCharAlphaW
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
GetMenuStringW
GetSubMenu
GetCaretPos
IsZoomed
GetMonitorInfoW
SetWindowLongW
SetLayeredWindowAttributes
FlashWindow
GetClassLongW
TranslateAcceleratorW
IsDialogMessageW
GetSysColor
InflateRect
DrawFocusRect
DrawTextW
FrameRect
DrawFrameControl
FillRect
PtInRect
DestroyAcceleratorTable
CreateAcceleratorTableW
SetCursor
GetWindowDC
GetSystemMetrics
GetActiveWindow
CharNextW
wsprintfW
RedrawWindow
DrawMenuBar
DestroyMenu
SetMenu
GetWindowTextLengthW
CreateMenu
IsDlgButtonChecked
DefDlgProcW
CallWindowProcW
ReleaseCapture
SetCapture
PeekMessageW
GetInputState
UnregisterHotKey
CharLowerBuffW
MonitorFromPoint
MonitorFromRect
LoadImageW
mouse_event
ExitWindowsEx
SetActiveWindow
FindWindowExW
EnumThreadWindows
SetMenuDefaultItem
InsertMenuItemW
IsMenu
ClientToScreen
GetCursorPos
DeleteMenu
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
GetMenuItemInfoW
SetForegroundWindow
IsIconic
FindWindowW
SystemParametersInfoW
LockWindowUpdate
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
VkKeyScanW
LoadStringW
DialogBoxParamW
MessageBeep
EndDialog
SendDlgItemMessageW
GetDlgItem
SetWindowTextW
CopyRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetClientRect
GetMenu
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsWindowEnabled
IsWindowVisible
EnableWindow
InvalidateRect
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
SendMessageTimeoutW
EnumChildWindows
CharUpperBuffW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetUserObjectSecurity
CloseDesktop
CloseWindowStation
OpenDesktopW
RegisterHotKey
GetCursorInfo
SetWindowPos
CopyImage
AdjustWindowRectEx
SetRect
SetClipboardData
EmptyClipboard
CountClipboardFormats
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
BlockInput
TrackPopupMenuEx
GetMessageW
SetProcessWindowStation
GetProcessWindowStation
OpenWindowStationW
GetUserObjectSecurity
MessageBoxW
DefWindowProcW
MoveWindow
SetFocus
PostQuitMessage
KillTimer
CreatePopupMenu
RegisterWindowMessageW
SetTimer
ShowWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
GetSysColorBrush
GetForegroundWindow
MessageBoxA
DestroyIcon
DispatchMessageW
keybd_event
TranslateMessage
ScreenToClient
gdi32
EndPath
DeleteObject
GetTextExtentPoint32W
ExtCreatePen
StrokeAndFillPath
GetDeviceCaps
SetPixel
CloseFigure
LineTo
AngleArc
MoveToEx
Ellipse
CreateCompatibleBitmap
CreateCompatibleDC
PolyDraw
BeginPath
Rectangle
SetViewportOrgEx
GetObjectW
SetBkMode
RoundRect
SetBkColor
CreatePen
SelectObject
StretchBlt
CreateSolidBrush
SetTextColor
CreateFontW
GetTextFaceW
GetStockObject
CreateDCW
GetPixel
DeleteDC
GetDIBits
StrokePath
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
GetAce
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegConnectRegistryW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
CopySid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegCreateKeyExW
GetSecurityDescriptorDacl
GetAclInformation
GetUserNameW
AddAce
SetSecurityDescriptorDacl
InitiateSystemShutdownExW
shell32
DragFinish
DragQueryPoint
ShellExecuteExW
DragQueryFileW
SHEmptyRecycleBinW
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateShellItem
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
ExtractIconExW
Shell_NotifyIconW
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
OleSetMenuDescriptor
MkParseDisplayName
OleSetContainedObject
CoCreateInstance
IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
GetRunningObjectTable
CoGetInstanceFromFile
CoGetObject
CoInitializeSecurity
CoCreateInstanceEx
CoSetProxyBlanket
oleaut32
CreateStdDispatch
CreateDispTypeInfo
UnRegisterTypeLi
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegisterTypeLi
LoadTypeLibEx
VariantCopyInd
SysReAllocString
SysFreeString
VariantChangeType
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayAllocData
SafeArrayAllocDescriptorEx
SafeArrayCreateVector
SysStringLen
QueryPathOfRegTypeLi
SysAllocString
VariantInit
VariantClear
DispCallFunc
VariantTimeToSystemTime
VarR8FromDec
SafeArrayGetVartype
SafeArrayDestroyDescriptor
VariantCopy
OleLoadPicture
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
74.1MB
Virtual Size
74.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Toolz (astro)/Anarchy Panel 4.7.7z
- SHA256 bf9aa6957a814d551d3ba7f96690ff76c79ff884718b3a0f16ab17b96c2637ff
- MD5 40fa4dfb75a2ff3595435c374a5f5e68
- SHA1 2086fd6c2f38fb20e87a50cf3ee27dfb68fa3843
- SHA512 a0655a97428c2a1981015c7b819a207d119b82fe88242f8a0e703adf3eedd386de73412e428dfce1fcedacbbb04ff23775c66e21584f27b5065ed32f510da3de
- SSDEEP 1572864:AN5bnkUpaR1Ju0aVJfQF593gMr8okmaHY5q2iSBHxhj3lF:Q5bkxbJOJfnMYoriIRhX
- MD5 SHA1 SHA512 SSDEEP
Password
@ReverseEngineeringLab
Anarchy Panel.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
- MD5 94bac1a0cc0dbac256f0d3b4c90648c2
- SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
- SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
- SSDEEP 786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
@ReverseEngineeringLab
Minor OS version
0
Major OS version
4
Entry point
57260894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
54.6MB
Virtual Size
54.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Anarchy Panel.exe.config
- SHA256 49648bbe8ec16d572b125fff1f0e7faa19e1e8c315fd2a1055d6206860a960c9
- MD5 3d441f780367944d267e359e4786facd
- SHA1 d3a4ba9ffc555bbc66207dfdaf3b2d569371f7b5
- SHA512 5f17ec093cdce3dbe2cb62fec264b3285aabe7352c1d65ec069ffbc8a17a9b684850fe38c1ffd8b0932199c820881d255c8d1e6000cbbe85587c98e88c9acb90
- MD5 SHA1 SHA512
Plugins/0guo3zbo66fqoG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9661b1abc9a3e95e591c49c3838a64a066a2ff3c6de08d8aa7b541c4a75cd8e5
- MD5 e4ebcf76ff80ef398d3ab77d577f4c08
- SHA1 cb9e6b30a63d50ae87610f6855b64abfb25691d2
- SHA512 8f37cedd987dd14181fdfa861b8a95271868dac21aa9df80bd6daa831ae20f4b4965c8be3e36f32aa220bd37ded11a7568ae237c9c9641bb4fc087f6fe104b01
- SSDEEP 1536:+gqK9OLThWUkwSOykrJROOwj5vCSnVcnwwxu8NMsuS73O4VKid/:1OBX/xFwj5vCSnSwwjNH3O4xd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
@ReverseEngineeringLab
Minor OS version
0
Major OS version
4
Entry point
85774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/59Zp7paEHDF7luJ.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5db4c26057a05bb75ff7892fb60fd76620fc2228811d913d152a0aa4ec9db7a5
- MD5 15e3d44d37439f3ac8574ac1c9789ec2
- SHA1 bb3ef30e9f4496198f412738579966210ade36e0
- SHA512 ff358c9896792017ff7e91f1dedffd9d75a099c5b852da19599799aeca20b6b269267ff7c12c918a2530fe1a79a12bc8796c4eb3914c97faba3eba27388abde1
- SSDEEP 24576:L2RBtpr5ljLyeVKbed1BeaPc9oFf/V5V4IeDHRbtg58jVh6zBRkM8eJkhjpSLZFb:L2jXr5ZtVKYzX/LV4k58M8eJkhj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
@ReverseEngineeringLab
Minor OS version
0
Major OS version
4
Entry point
4206502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Desktop\Hack-List\New Folder\Anarchy-main\Binaries\Release\Plugins\oYsKwDG.pdb
mscoree
_CorDllMain
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CjETR6GpGXqM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 13db80a0211ba9bf59a1e43bdb2fffa91de5c7f38bd469c4824b5e06245a0234
- MD5 b0fc0ba80f8ec9586ff397412c512d9f
- SHA1 0f6051b71b715a47be1fa16683201413905629a3
- SHA512 222a365ae567c6c773ca2b99b82795916839cc5c9ba8eb019bf6713108720c2793303ef6612b64488f4584602cec84c0b48a02fe709db0250bf377d07e002d7d
- SSDEEP 6144:BH8ns56MGHSsdqjJiulCcVWiUpG9kxwrIfUKa:kjjSsAjAuYcVWxpG9ia
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
@ReverseEngineeringLab
Minor OS version
0
Major OS version
4
Entry point
410506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Desktop\Hack-List\DCRAT\DcRat-main\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
393KB
Virtual Size
393KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/EVa7gBMKoaHmLC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6ea1ae7ab496666c0117fc20e704bfb6104b13cfb0408073a09689f863fa64b1
- MD5 64a3d908b8a5feff2bccfc67f3a67dbd
- SHA1 a17d7e5fa57c99a067cac459cb507b625dac254e
- SHA512 66374d720230799bea6ac6cfe3faadc37fd775a49d40c04facae1caf1ec658956bbda54ba75287d7128b19b97971bd933a64469da8e0884225c5a8d8b9423ccc
- SSDEEP 3072:/bFHKx2Vpgdk6BCNs19kPVoPsb7oR4ZkvEfxMxf4t8BkVb0Uc:/TVpgdkpNs19I6Pe7oR4ZAEfx+LiVb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
@ReverseEngineeringLab
Minor OS version
0
Major OS version
4
Entry point
180110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FBSyChwp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0ea38d0d964815e2b84748a78bd5a829ae01586478e5f17b976f1ae763c8dec3
- MD5 0d41ccfaa8e7ef96248b8270d1a44d08
- SHA1 6ee22bdb91d3a18e0b45b6590eb69bc9a0b02326
- SHA512 a0f236f6dbeb1763fb1c198616de65b907a3a5edf7ed9435c2ad0b5826d84e9d2f25e96aba4e8b681ef495612cf0e04e929427a92d332164ace89e797bcb0e0e
- SSDEEP 3072:OXwOuoHBhyYr+x5IA+1gUtaEKJ8px4e1hkamm9RyxLeN/dIfMU+:awOuYr05T+KUtaEKJ8px4e1RmqRydeNd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
180174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/G3nl0mDcABnDuZ.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 060d467cbeb0a58696287c052f3dd9b3597331b1c812e3e2882d6c232f8511de
- MD5 97b8bec4c47286e333cc2bedacf7338e
- SHA1 764bbd0307924b71ca89538b42996208d10c9b91
- SHA512 a40970622a594533349e75fc2022314ba21f05fc82709d6eaba82f4a2bc343c960029ad2825cfc034ce82622722127d149993bff88982f02d6dd6b5b1fb60fbf
- SSDEEP 3072:EaEk8xLhWuo2alMFVxzPUBvRNHosrO0/1gRR0foQPssGeWSz89:EaEk8PRo2al0DzPUxvHtrN1gROffPfGl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
187198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/KNTmoSnG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 300a5551f7be89c5f03c0b70fa7dafb7f84c6394dac68bee95169e985e7786f0
- MD5 738c096a9bc38e21a9aa59ebc356c80d
- SHA1 139756ad201a537461a6bb8524a4b89a63b1b1b9
- SHA512 294c34f0716861fa67ba571bf7a8614613a1746e9f2935ba0c86eb1897dff858ea1f7fb44f1b6ec87cc709f4933a912dcd3eadd5d0b208c72985aa47e1f214f2
- SSDEEP 12288:SMmHl7LUg++x95WlkM9qgrXCEhUhWiUQpTQCyXZj3vlDV+z9BI2NHvfJa1tzh66w:AHl7LUmx902M9qgrXOUQpTQC1m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
720906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
-?~P}
;z
Size
208KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
458KB
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Plugins/PK0TcnqTGFagQTS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 991fc53fa1aa7b5cd0b6e19dab536873d68e4413fd55b533601a3a2582d38a49
- MD5 fa90a2aee0d172000257c4faca31237c
- SHA1 b317281b4acaaf1d7b7255c5e92887322abae892
- SHA512 b05c0b52e011089258ad31dd23a1f8a0cc8145b202e42e2a9d4fdf892c12d4a7b5843cc7721041295ab796e8bc98747b9e321c4e54bfd1a7c9a02dd2796fc405
- SSDEEP 3072:Z60dHpQssTFrcpvZFlOJA3YCVbbME5f8YpIVbltkksqBRbRw:xPsZcpvZFlOJA3VVbbME5f7pIVbTkkZJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RssCnLKcGRxj.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e204d15f0e7269d364157aaab265a5dfbe7e76c9f6202bf90998f0edd77ca248
- MD5 f6808c4fbbe0275db03b2cc5b4c2bc0d
- SHA1 e40b61c64c68f72fc5144f5057d54229babdecf8
- SHA512 f077c49f6943d0e40799b3b42d1e11f50dabca48305c36ef2acd3258c990e0e0f982fbb0c27b1243aa15d2ed7b398b70f07dddc9ba76ff032ba74a24c8e08fb4
- SSDEEP 3072:P1F3B6k7/u/cVnvqtXEIGyv5LBPcwk4V9KIgBH/cNw5/UzUYNv:P1F0kDu/+WX8yhLBPcwk4SIgBH/Yw58P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
191774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/WkUP83aP9CABpi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a74b74f463d567c1f0505bddcd49ed23700f9ab7dcf4b7f46435723258c5a7e2
- MD5 8dbfb67c059aa59f7c53e20ef6740363
- SHA1 3de96e7f48ee7647f5a7c2efb68cbd914bc78364
- SHA512 70aed01375416e2be63d676bbdba58c12ba5f50d406d1fe252e7a66b901d32e0705007dbf465193de51663174c1b53bdb980890d8b2e6ce641dd16a200e3440d
- SSDEEP 1536:ulBCsewAj5RhvBY/0g/+DP0yUXEVg+g6SAKJMT05eUv:6CsewGdvBsjmwj6g+g6SA+MT05eU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
> a[@&z
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Plugins/eMTYbTz0gueNs4.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 929e5f15e9ceca03c80b2d174283cb25bf47adfe4693f5c01f622416c9f6d03c
- MD5 5dfbcfbbf9e2ae7db23e252808699ffb
- SHA1 a1d429292fe73aeb5abab10304e1ae8c1262b26d
- SHA512 9ee63080781577e0d818a27d026024f96161bb7b132dc0c130fabbe2d6c3b7758868fff5a4ad68efeb4d08f964e2f69417022751880a443f7f920aa4f40f5c09
- SSDEEP 12288:s9StwoSI6P2FNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbS:tZSFPMWOe0jywNMB9ccFd7mZg4
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1166638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Downloads\dcrat_fix-master\dcrat_fix-master\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/fzAgyDYa.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f855353a618af8a53504b5188c05d3a09fb1ff85763e0cd15c53dee82d7c6119
- MD5 a5770798b7a6465f5b5a8c19d7d707ee
- SHA1 ca67e9591d2f757cbbfacb55f27aec6485b10ee6
- SHA512 64da7687e83c6ff4d1c1cdc644ffff53333f745e82f169beb529d55ec5be6f21658d27c6e01744147c00f834978260e86ea627a5f2981f27305afb69a7b467dc
- SSDEEP 768:VARgmh4b8mzujnHzq+pu57BSsdIPn7rDVNS5z4TyEWkZI9aJ+G247U33fEqtHzWT:VogClTToxxeq6ZXwvEqZaXcI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
> a[@&z
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Plugins/mGWHaG2Jn.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2bde0293c982fb6266c683ecaa2c90372d26d9a2786726874a2cfb89dcc68324
- MD5 8f98206f577160f950d456d1190c8d32
- SHA1 defced38fce00775c4616b420fa674d77f946eff
- SHA512 432c2b6759701754616273633c966332e718dbb10a9a7eab0d7c57ffdc9be95b5e1b16b6e291301ac7aa6d1de48a46d30f08729e45d6634b1849f41c78e92d91
- SSDEEP 1536:xDj7e8U5/QWCwxi4ao02nK20TSMErl4D/D:xDj7e9/xxi4ao02nK20TnErl4/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
> a[@&z
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Plugins/mML6WKMqdxjDGA.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 778877431354a9584325dadb663be077f757227eaae8bcad33e4bf26efd6b965
- MD5 e03b206eec8a7efbd1a47909071226e5
- SHA1 21163989ea524920e874bc7932adfcd5e94f854e
- SHA512 831ed74419f1b4c3250fbff20be16ed7058a851d7168a17e8a4dcf284a19412feee42a8c198af34b37571de33a80c48ac855f5d018ea9e2cfdcd846b832155ff
- SSDEEP 3072:5nkYlKsdY6RwiYNF7Bs2GEEg+9D8RZW7iKcnQy/dh1CWMEPrhBSepT/9HxW2Je:5nkrsdYUwiYNF722GEb+uRZWhcQy/71H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/oYsKwDG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54ec206c8fe8ff27b3fb02ef892b8e6bc4b6abfff2fe08f5f57175c64f1d3220
- MD5 a718955297276f2349b7644447736e08
- SHA1 377388d115b77aff357dcaf92b6aeb6286b1460d
- SHA512 a3c2ded0cdc4e62adac92a569d6cd4db0c3647e663700f019a9de27e738eb2672e5cccec19af15633a3cd25a882452ff5ce39c17f67dc3ed6653b9e0ad063641
- SSDEEP 49152:LOKHt76oI7m3G7WdJh9BUJYzGH1y+Lwo4AeXIGZl4k9uncQZGaV4p5Gi6g:6434edFu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5005206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Desktop\Hack-List\New Folder\Anarchy-main\Binaries\Release\Plugins\oYsKwDG.pdb
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/rNXXgmX25s.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b93374fdfd9af786ff20597ae0e242b81373984ba5718194f9e57feb231c52cf
- MD5 050f07b46987eaf152aab521c0112fc4
- SHA1 2d2c0943ce9c10ba09b0d5cca54c2a88a1e61e95
- SHA512 a27c370e40ec126b6b9f3ab7d603378c2b629ec752aa8fc57a10e3ef58c0b701a5d1b4903a17ba180c4e73e76b54304f0868c474eb60e671562d0deed83a18c8
- SSDEEP 24576:Ji2Q9NXw2/wPOjdGxYEfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnq:YTq24GjdGSCw+W7SCRnVQTEQ/BA8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1581454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/sJ88z8tsg5XzK.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6eaf5744b8ec91312e1c6be83d852627e5204b3b64a1932e60e47438d73fb6bf
- MD5 b3fa2c3d50057ddd2c9579dc0aef1590
- SHA1 88a1f57b9177c95a2e095866574639b09d5f310a
- SHA512 0d1b8288cbc1c206029fe2f9b7366b2f8b49158e4c9643e453111ceb90fd77af903533c64f6ede351755414c9e7daa926704cda6f1953be79e1adc7aff515508
- SSDEEP 3072:8SHb8GZKzU95JXku/dIvjVWE6jZJjnnpnSY1DFb109H:88ZKzU95JXkodIbVWE6jDjnnpnSY1DFZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
181966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/yL9x34D8X3oO2P.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e9733277eac197c4eaf40fb0eada0907388222ef21843488a8e591149768301
- MD5 38502e61cc1d39095a12c1883551ad9f
- SHA1 135c9cad9e6d54bf66a1cee5c99ba510102623b0
- SHA512 cd67a63ea954a4db8c8dfadceb2822b447d98c2c43a8f9c6901d0fce3230605a0416395b92caea6ac08348d5f6b0e1cb052b24cf90829602b0a5b0652b8a2600
- SSDEEP 3072:lq4bIABl7xQ6himcU8wzHQzvDk7r1OzArhb6lDWyITJeO9pKb3tO:4LABl7xQ6himx8w7QzvDk7r16whByITO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/zVvPGvK64uLS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e82bf869638f8118f47f3870b1382401e42912cefcc6a9890489af5bb805c7e
- MD5 a267a675b7243d9152c7b8e3e261d64c
- SHA1 9a0277095646e2a773e8a04a7913ce6a56cf05b5
- SHA512 0dae32c0c0fbf6918779a5e9699cbef27572458a5cdc7119298abddb6a597a0017fe33af06c02abe0c66f3cd490f6955bd7c65470ed3e31338d28575306c04bb
- SSDEEP 3072:KIgH2nCuMdPPgwP1euMwUiVD4WUMIoF4unE6r3Ic83C:XgH2nCoSeDzAVUMIoF4unE6rYc83
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
139274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
(8h@
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Plugins/zVvPGvK64uLS1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 98eb518c9785f988ab1dc0752e0ef6d23f171134e60187c621795d6877940f99
- MD5 4f2fb621cbea3cafb7a041c9b3c115a7
- SHA1 137502326e0126f372586d157e51a1416146c3be
- SHA512 22171b9ecf1fc99b7aaf4e73c4d164cedcb503e83021f36a9cec673ff327f83a6c7568e22a7329cc6fc7ef3d6ff79d5dc6c88a8784e58401b884920c5ba2ac9b
- SSDEEP 6144:yMc8IVeK18Kv42lIq94yFwT6J9Kfgn4670g/Pgtb:yFeK18Kgohey2T6J9KfgnX0Ag
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
232KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Toolz (astro)/Borat.7z
- SHA256 53c723a6e330a94b47baed5dc7ed4f27d5ea94848e5c08140b6f222ede30528d
- MD5 ac67b0ec25951dbb914a544e209da6a4
- SHA1 0b383708ffce7e12742ea807530a6012a847ead2
- SHA512 a4c53bf9eff859fc523155d7fa70582f8f4edede335d0ec14e368fc4643002f27b016336a0c70cf2ae44055af1126c7c21248c6b8da3d3edd804c8c3e89469e6
- SSDEEP 196608:SdT5SvN6EGcf+efsD9lUOtEbnp/ux9N1PqwLmHODu0:SSvkkfZsDEbE2SXR
- MD5 SHA1 SHA512 SSDEEP
Toolz (astro)/DarkVision Rat.7z
- SHA256 3f6692d2e43bcfa91fd2d663bc64bac34d7cbd4eaa009c94010d27822111cbd9
- MD5 3ffe675eba4cb6ae5d5ff93a600e1635
- SHA1 8ec8f85f0879d86bbe776abaff8afb3b08c27950
- SHA512 68470fbf409a92d48959631799cb3905c872e807c97ca86a6432a98affb4600aac9e81b312b4c01bf4549bf672c0258871e35a6113256a384c041175bb38f367
- SSDEEP 49152:N3ZOxbrPFm7q9tVDRcVGbpJRY/M0VHryxJyQK6n:5ZO1r9v9rRcgbpU00gjTK6n
- MD5 SHA1 SHA512 SSDEEP
Toolz (astro)/LOIC_2.9.9.99 2.zip
- SHA256 98ee120b0a3710d50afbbf4d0ce49d2399343d00139c11633ffb79ad1986919c
- MD5 b9e5cc5f3b2b87f8708ee916a3c05782
- SHA1 1a192568525b3f7faca9ac10816d44b2f70e8e15
- SHA512 cce40953814e8f598df1044847f01dbdda084064a894eda5b7d225fad9608e59b0b4042198e5b98a2ab8f05d379d02478f05940787637241839b98f01d260d8b
- SSDEEP 6144:fkm6HHT9kKywL0jcZ93/PgqVUuptMzOGvyjkW:Mm6HHTaKywL51/PDPpt2yjkW
- MD5 SHA1 SHA512 SSDEEP
Toolz (astro)/Netflix checker.7z
- SHA256 33e5da518755f42c791a3956a7e1e0ab2e9002f4036a2b29293b63a987074609
- MD5 ce951870ffe15f3d04e24f3af861c34f
- SHA1 53457332d3523e7525228b8eb20711ee0f9880bb
- SHA512 4a3e751523376a563dda3c5acf2259e167b679e2aa20a18fabbce0bc2d3e7b6da744ed78578b9277d99cc884cc0b523916a021ff2cbfa265e746109162d8ef5d
- SSDEEP 24576:BBwYNb0B5fvhDVejdS3gszYd1kmmq+OAS078FGafDmZt2u+D6dlq1yJAXO+0+NGj:BB3UfixSWd0TSFFGyDe2u+Dwq1yJIO+i
- MD5 SHA1 SHA512 SSDEEP
Toolz (astro)/XBinder V2.7z
- SHA256 16b79fb36ba40a69bf07d9df4818c33957e82e98eeefac0cd9fcde4c868b666a
- MD5 74b35810d8e59fe03f0d59fb638b366e
- SHA1 e254c557216cb5d7f5cf4ff721e8243846483571
- SHA512 b458a60af104451ac79390cc1a589c8998c9c27ad542d24a374e0f9912c4bf07414db77c6a2f60799910ecd5dc46d94f117fda9a054916ea881c68c4d322effa
- SSDEEP 12288:GshIWsM0pwXyPFkTUa9TuOlqeMRrwEvOW8tQB/:xhIWezPFiDMlwEvF8tS
- MD5 SHA1 SHA512 SSDEEP
Toolz (astro)/Yang nitro gen.zip
- SHA256 c44a2f59fd46ab4990da49bfd297d818297848d8dc0673195d98800d768989ed
- MD5 ed7517b01130979ff441073ae27038f5
- SHA1 72f5c6b41de6e607881c80fa370d450e18d3328b
- SHA512 bed71625fc4f9a35ccb55dc94a249e60696a5cb666144bf7d8f448f11d30598e4eed8657a164e6925b8b6ab235c3c884c19901381d198d3b9a3847372759ebce
- SSDEEP 393216:YzrFBbMKey4OrHRNjCuciqda/VjpkJZIc7kug5lMNZ5zqeknyzf/C8z0p+34/z69:w7bJ4OrHRNjDF/Vjpk7I92ZkeknyzfKq
- MD5 SHA1 SHA512 SSDEEP
__MACOSX/Toolz (astro)/._888 Rat v1.2.6.7z
- SHA256 10570842e9569448dcbbb6f59e930a8d4fb8586e8b41052a6e541664ef119c70
- MD5 9bcf0b27632b94dece45b4e3370bbaa4
- SHA1 7f08890caf8fa7596dc5a17f8d9812ba693caa13
- SHA512 90fa700f22f3f20e7301f721d798b2fd06dcb796b0858531fd03dcfca95617c1baa67b06c0a04733f6fdd2d70a656941ee49081711830853840917565eae8af8
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._Anarchy Panel 4.7.7z
- SHA256 2e7c5b9cd9cee73493e757d5ed98e300917ca59f5537d85bad72a3017e4307a5
- MD5 572400da02e61c5170033fc0331e4764
- SHA1 949d69ddd9f9e16277d8d5feccacdad9f791974d
- SHA512 d8d03feb53715549c246fb9b16e56d83c018979df9b9aa9953dc5f961977c4df710c4c73421b2e090bf52c755289fa54c77cd4e30a517d884990e02968fb61ea
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._Borat.7z
- SHA256 f22584998e4e43ec2ee9208a4442000e68dc394a86e098d14a6a6ca945ae9ff1
- MD5 6fe023634c9e4d7aa45d741cc27f7c38
- SHA1 632185eed0913f9a0757176b8f93ca5164ffa66d
- SHA512 bb35b53188c134f5612a70cb17575d19138c52d7c7f64a654bdf544816c1cd8e01d03ac046527512fb431e444e4461143b19f92cc896b04b74eed2b099e8cde1
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._DarkVision Rat.7z
- SHA256 cef0b1fb664b72ed672ce42b92df7fbf5aefb75c821bea7850949e92ecbddc9f
- MD5 50391083f1f503e2b48e787e70975a83
- SHA1 8bb01e01f5e9ccfbecf68afab49ccaccdb7e4759
- SHA512 fe59462d2ca2433c4ff3ee86b25d09dc32059cd1147f160ac5ec8d7abeb59fec0458718dfa9bbeac98f6fc806461d85716e821fac51324e31a7d911307f440e6
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._LOIC_2.9.9.99 2.zip
- SHA256 d55dd04522efa3765bb8ebdc826af2aa806d76674cd07a8d5c3f746c5cdb016c
- MD5 37003424c62158b951527d5ecf49b4eb
- SHA1 b219d7dbfed402294620c775d8621d5c1afdd0dd
- SHA512 b5f4c1e8439327549ff3a34aa4f02dcb54b6297c3d51fa8183992f9777146092db87a16e6511164124c2099b2641bac6b0f35f6a7a5e2c13b911a1713a5dcdc7
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._Netflix checker.7z
- SHA256 17374e638d89419c7a7240a8279a83413c3a3dde9d145c7f842f2e1429ee9b36
- MD5 3fb98ee0cc3fba7a7efbcca62b407461
- SHA1 bf31d00a1267239b5df25745fd0a09d2895ddcad
- SHA512 ceae5cba86b95934a57eb24cd3278513c51e058d1e9848125599e567ba85c56f78cbbe799fa01038e37cac153eaca70cfadfbda5eb3aea9667d4ea6ab8d79eab
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._XBinder V2.7z
- SHA256 af360a10f7890b46897bbbd372fca30f90add070df90c3608d545a76291746ae
- MD5 4307a3456a0ba3dae9ebc13b2a40cef6
- SHA1 0bdde56b283025857e1b77a4adc55fadd7f48846
- SHA512 83df553730e82306e0d46d78df603a1cea0bd8b8f280d133974cc9a8953faa13dcf65b533eabfe2722049de7f53df1ae44d8e07940fc797462e3fc869e067c19
- MD5 SHA1 SHA512
__MACOSX/Toolz (astro)/._Yang nitro gen.zip
- SHA256 eb2bd54e9072dfa7f6f161183d9bcf9efee6f157c1c63193b4edf30436a1e57b
- MD5 82a426cfe56468febb882889d4a8cf87
- SHA1 0930ddae798cac7bbf836612dc4eae6d44f9d906
- SHA512 3effc18beae296777aad5998e1691f3b834bae29dd52f36b2e6d005699e6fea9b7b0ec6ae20e43fb1dc0b3aee7b4d5f60724fa686b6580efef2f6cefa249eefe
- MD5 SHA1 SHA512