stormkitty | XWorm-v5[.]6-Lifetime-Editon-Cracked[.]zip

resource	yara_rule
sample	disable_win_def
static1/unpack001/Plugins\Options.dll	disable_win_def

resource	yara_rule
static1/unpack001/RES\XWorm.Resources.resources	family_xworm

resource	yara_rule
static1/unpack001/Plugins\Recovery.dll	family_stormkitty

resource
unpack001/FastColoredTextBox.dll
unpack001/GMap.NET.Core.dll
unpack001/GMap.NET.WindowsForms.dll
unpack001/IconExtractor.dll
unpack001/Plugins\ActiveWindows.dll
unpack001/Plugins\Chat.dll
unpack001/Plugins\Chromium.dll
unpack001/Plugins\Clipboard.dll
unpack001/Plugins\Cmstp-Bypass.dll
unpack001/Plugins\FileManager.dll
unpack001/Plugins\FilesSearcher.dll
unpack001/Plugins\HBrowser.dll
unpack001/Plugins\HRDP.dll
unpack001/Plugins\HVNC.dll
unpack001/Plugins\HVNCMemory.dll
unpack001/Plugins\HiddenApps.dll
unpack001/Plugins\Informations.dll
unpack001/Plugins\Keylogger.dll
unpack001/Plugins\Maps.dll
unpack001/Plugins\MessageBox.dll
unpack001/Plugins\Microphone.dll
unpack001/Plugins\Ngrok-Installer.dll
unpack001/Plugins\Options.dll
unpack001/Plugins\Pastime.dll
unpack001/Plugins\Performance.dll
unpack001/Plugins\ProcessManager.dll
unpack001/Plugins\Programs.dll
unpack001/Plugins\Ransomware.dll
unpack001/Plugins\Recovery.dll
unpack001/Plugins\Regedit.dll
unpack001/Plugins\RemoteDesktop.dll
unpack001/Plugins\ReverseProxy.dll
unpack001/Plugins\RunPE.dll
unpack001/Plugins\ServiceManager.dll
unpack001/Plugins\Shell.dll
unpack001/Plugins\StartupManager.dll
unpack001/Plugins\Stealer.dll
unpack001/Plugins\TCPConnections.dll
unpack001/Plugins\UACBypass.dll
unpack001/Plugins\VB.NET Compiler.dll
unpack001/Plugins\VoiceChat.dll
unpack001/Plugins\WSound.dll
unpack001/Plugins\WebCam.dll
unpack001/SimpleObfuscator.dll
unpack001/Xworm-V5.6.exe
unpack001/d3dcompiler_47.bin
unpack001/libGLESV2.lib

XWorm-v5.6-Lifetime-Editon-Cracked.zip

SHA256 a6659e559b928d89655602db75505f7b1c765a11ba7af66f1cee9c9d02149562
MD5 118e1a0e8c9ef8e03646dc1d0e3a290a
SHA1 08f34f8861a0cee81a2d5c59128f9f808a78e797
SHA512 8fff02bb6b7b6e65e9a378148cdeaa9c2f9ad7d78dbfc4be3dbfc05dc85ca2e337d01f34168bc3095400eb81b586d334ebb01bf38ca9d47cb1e68eaf673bee50
SSDEEP 786432:UoTLtAU/fX+w9RmxXRDT+M9wkIIW+gqH21aDwh:pLtAU/fOw9IXRDTXH21aDQ
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Background.png

SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
MD5 c93ee3abeff4ac24936471f80b36ec7a
SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

CefSharp.cfg

SHA256 5cae75e6d6a6b249b2d977158998aaa514b8c917c313b5a0609c7b90b075ae50
MD5 acff16b9fae109888d772998b91ccca4
SHA1 b580c68d4d2bf3cc26393728337278f190d405f1
SHA512 557aadc06ca2a961ca44b6e4f46cbe412d605dab2092bee16118baaa8a4a02eecbd746ba615d0af9eddd38ed67d81ef44dd1313956a32a4798a4018d24377962
SSDEEP 196608:4gavfJVzbFUbwD5PVO47xgO2JC85cikjYA/cmiV7ZNt/ikyM:hIhBbFUcBVO47xg/C3P/eJVyM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

PE Signature issue

Digest

ed:84:8a:63:a2:fd:f3:10:fe:ee:8c:20:62:52:c3:1f:82:db:56:32:8d:fc:2c:d0:30:4e:7c:34:43:16:cd:2b:b2:20:11:19:1a:a5:8a:7b:ea:72:ee:e3:63:4e:cc:52:f5:55:bc:24:3b:71:8b:46:fe:8c:81:fd:56:ae:8c:f4

Digest Algorithm

sha512

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=evilcoder.mysellix.io

Chains

Mar 14, 2024

Minor OS version

0

Major OS version

4

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

628B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.enigma1

Size

10.0MB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

692KB

Virtual Size

692KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

FastColoredTextBox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
MD5 b746707265772b362c0ba18d8d630061
SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

346910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

Fixer.bat

SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
MD5 2dabc46ce85aaff29f22cd74ec074f86
SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
MD5 SHA1 SHA512

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

GMap.NET.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
MD5 819352ea9e832d24fc4cebb2757a462b
SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3002430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GMap.NET.WindowsForms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
MD5 32a8742009ffdfd68b46fe8fd4794386
SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

155790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GeoIP.dat

SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
MD5 8ef41798df108ce9bd41382c9721b1c9
SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Guna.UI2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
MD5 bcc0fe2b28edd2da651388f84599059b
SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

PE Signature issue

Digest

eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 21, 2023

Minor OS version

0

Major OS version

4

Entry point

2031518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

IconExtractor.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
MD5 640d8ffa779c6dd5252a262e440c66c0
SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb

Logs\ErrorLogs.txt

SHA256 633eef2d5302c0c224cd71aeb7d29901564f30e5a9b3d31cc0a55c1c6eeb3d5c
MD5 f77f4fb386c891a5640cf26473cebea4
SHA1 db2fc673ed4b895561caf8670d1e40204a3d6fa6
SHA512 47fe461ccb295c95d951c0499d943febdc7b9b41923bd03b9b0876e52abc220cde47dd4a3ff13e98f991636fc21b6ef5297b679dde8dcd38b51cd0648eea38f9
MD5 SHA1 SHA512

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

NAudio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
MD5 3b87d1363a45ce9368e9baec32c69466
SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Digest

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

Chains

Jun 3, 2020

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

0

Major OS version

4

Entry point

510758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb

Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

PE Signature issue

Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2023

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Plugins\ActiveWindows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52
MD5 5a766a4991515011983ceddf7714b70b
SHA1 4eb00ae7fe780fa4fe94cedbf6052983f5fd138b
SHA512 4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8
SSDEEP 384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Chat.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492
MD5 59f75c7ffaccf9878a9d39e224a65adf
SHA1 46b0f61a07e85e3b54b728d9d7142ddc73c9d74b
SHA512 80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8
SSDEEP 384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Chromium.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
MD5 edb2f0d0eb08dcd78b3ddf87a847de01
SHA1 cc23d101f917cad3664f8c1fa0788a89e03a669c
SHA512 8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
SSDEEP 768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

38630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Clipboard.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
MD5 831eb0de839fc13de0abab64fe1e06e7
SHA1 53aad63a8b6fc9e35c814c55be9992abc92a1b54
SHA512 2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee
SSDEEP 192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Cmstp-Bypass.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
MD5 cf15259e22b58a0dfd1156ab71cbd690
SHA1 3614f4e469d28d6e65471099e2d45c8e28a7a49e
SHA512 7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38
SSDEEP 192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\FileManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd
MD5 641a8b61cb468359b1346a0891d65b59
SHA1 2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0
SHA512 042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee
SSDEEP 12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

700934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\FilesSearcher.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b
MD5 6f8f1621c16ac0976600146d2217e9d2
SHA1 b6aa233b93aae0a17ee8787576bf0fbc05cedde4
SHA512 eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a
SSDEEP 6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

495966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\HBrowser.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c
MD5 f0e921f2f850b7ec094036d20ff9be9b
SHA1 3b2d76d06470580858cc572257491e32d4b021c0
SHA512 16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3
SSDEEP 384:tp33X3L5/QrX8nB9d13+6HcLReMWaFnp9l/1DRVTbg0Ut4xh+TfYMoKAB1R:tR3nL5/QrQ13kRR9bTbz+DYMoFBf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\HRDP.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de
MD5 f27b6e8cf5afa8771c679b7a79e11a08
SHA1 6c3fcf45e35aaf6b747f29a06108093c284100da
SHA512 0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33
SSDEEP 24576:3rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:WHZ5pdqYH8ia6GcKuR7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1790470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\HVNC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96
MD5 30eb33588670191b4e74a0a05eecf191
SHA1 08760620ef080bb75c253ba80e97322c187a6b9f
SHA512 820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97
SSDEEP 768:XsKVHERYe3lgPPTxOEUyP82P6mUrYrthCO7h2ORS9SQdHfiLpmbG8p:8K1ERYe0TEE3P82P1EMS36Kp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\HVNCMemory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4
MD5 065f0830d1e36f8f44702b0f567082e8
SHA1 724c33558fcc8ecd86ee56335e8f6eb5bfeac0db
SHA512 bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545
SSDEEP 768:EofXMCBlQ6Kms0n6GE30IU1YKtq9oQog1zq/xPP7:EyXTa6hEZU1YKwo8Uj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\HiddenApps.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea
MD5 ba2141a7aefa1a80e2091bf7c2ca72db
SHA1 9047b546ce9c0ea2c36d24a10eb31516a24a047d
SHA512 91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c
SSDEEP 768:aEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ffiCIT:SdmvWHVGMVwtYRtpl/x5qIXdEdXiCK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Informations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b
MD5 67a884eeb9bd025a1ef69c8964b6d86f
SHA1 97e00d3687703b1d7cc0939e45f8232016d009d9
SHA512 52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7
SSDEEP 384:SCUEeL4D574MvGjydqXwxDJop0n3TmyxhxJNgSg4PbOFsK:SCXeL4DSjydqXwx1FjfNfwr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Keylogger.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a
MD5 246f7916c4f21e98f22cb86587acb334
SHA1 b898523ed4db6612c79aad49fbd74f71ecdbd461
SHA512 1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d
SSDEEP 192:rJV/HNfwK5RSpyv3RIw9RtO1Lnq4Ur1XneDN6IW1Y6Uph1KzaA0UbnnSLWqV:fFl5Rp3RntMO4U5uD8Upml0yhqV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Maps.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6
MD5 806c3802bfd7a97db07c99a5c2918198
SHA1 088393a9d96f0491e3e1cf6589f612aa5e1df5f8
SHA512 ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c
SSDEEP 192:E0XOBqmqKYNg/ymxa07XW5U6chariK8GtnNK7gGteb1/C9T6IW14X/bmjIAd2vLV:mBqmqunYL6thaujK4jtepa9BX/bY1h2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\MessageBox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29
MD5 7db8b7e15194fa60ffed768b6cf948c2
SHA1 3de1b56cc550411c58cd1ad7ba845f3269559b5c
SHA512 e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1
SSDEEP 384:56lIcAn3tURnUKCvUUVT/95gG3UX/NZSQW9:56lIL3tUSvbVa/NZG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Microphone.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c
MD5 9c3d90ccf5d47f6eef83542bd08d5aeb
SHA1 0c0aa80c3411f98e8db7a165e39484e8dae424c7
SHA512 0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe
SSDEEP 12288:+0OeMv3MrIb8CkZKobg3Wi1bRuSvazv+Uro:ROe+WIb8CkZLbg3Wa8Waz2j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

558638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\Ngrok-Installer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa
MD5 3e19341a940638536b4a7891d5b2b777
SHA1 ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5
SHA512 06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2
SSDEEP 12288:Ws6T2x75lFR/RG+BUKPqnwoCMYKIUTJE:WEB+4+1C0IU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

415342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\Options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
MD5 97193fc4c016c228ae0535772a01051d
SHA1 f2f6d56d468329b1e9a91a3503376e4a6a4d5541
SHA512 9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2
SSDEEP 768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86 polyglot

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36546

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Pastime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1
MD5 6430ab4458a703fb97be77d6bea74f5b
SHA1 59786b619243d4e00d82b0a3b7e9deb6c71b283c
SHA512 7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc
SSDEEP 384:WK9Y5jI8MYODPqeivepi5zOY7//fNCsA8/h5U:WK9YNI8MVDZiWwr/TA8/hC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Performance.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735
MD5 1841c479da7efd24521579053efcf440
SHA1 0aacfd06c7223b988584a381cb10d6c3f462fc6a
SHA512 3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487
SSDEEP 384:LtpW2/E3mawGD1XTgOw2QxHN7yVppy6+:JY2ImYRDKHxV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\ProcessManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e
MD5 3d4ec14005a25a4cb05b1aa679cf22bf
SHA1 6f4a827d94ad020bc23fbd04b7d8ca2995267094
SHA512 0ee72d345d5431c7a6ffc71cf5e37938b93fd346e5a4746f5967f1aa2b69c34ca4ba0d0abd867778d8ca60b56f01e2d7fc5e7cf7c5a39a92015d4df2d68e382e
SSDEEP 384:2dqZXY/oSd1PTQLvLELadRtZa/rnRvDSQUT5S97/Y5bLOEYQfwrpn45rDhUn1kAO:2dqZXWrQPQQtZqrRrlU+cYv1kAvZc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

25286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Programs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4
MD5 a6734a047b0b57055807a4f33a80d4dd
SHA1 0b3a78b2362b0fd3817770fdc6dd070e3305615c
SHA512 7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa
SSDEEP 192:Z3eKcfO/TCOAOG+uCno9SFwN4O4FgkT8zr1P9YD6IW1GX/V3wd0yzSLWVb:8PG/TCXF1SamdnTu5lYTX/NwKyNVb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Ransomware.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9
MD5 ccc9ea43ead4aa754b91e2039fe0ac1c
SHA1 f382635559045ac1aeb1368d74e6b5c6e98e6a48
SHA512 5d05254ba5cd7b1967a84d5b0e6fd23c54766474fb8660a001bf3d21a3f5c8c20fcdb830fb8659a90da96655e6ee818ceefb6afa610cc853b7fba84bb9db4413
SSDEEP 384:DVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7E7eEDuQZh:DVm7Q1vpebF0LC9TqH2Mj7qtqg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Recovery.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 66dbe3b90371fe58caa957e83c1c1f0acce941a36cf140a0f07e64403dd13303
MD5 776193701a2ed869b5f1b6e71970a0ac
SHA1 2f973458531aaa283cdc835af4e24f5f709cbad1
SHA512 a41f981c861e8d40487a9cd0863f9055165427e10580548e972a47ef47cf3e777aab2df70dc6f464cc3077860e86eda7462e9754f9047a1ecc0ed9721663aeb9
SSDEEP 12288:LaoFeouLUFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1a:pFetLic805jbibGATp/j5T
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
StormKitty payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1157618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\Regedit.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2f73dc0f3074848575c0408e02079fd32b7497f8816222ae3ce8c63725a62fe6
MD5 53a2cfe273c311b64cf5eaca62f8c2fd
SHA1 4ec95ec4777a0c5b4acde57a3490e1c139a8f648
SHA512 992b37d92157ae70a106a9835de46a4ac156341208cfe7fb0477dc5fc3bc9ddae71b35e2336fc5c181630bac165267b7229f97be436912dfd9526a020d012948
SSDEEP 384:0ZMOBwQbGwAspmewuYvpYr3fgr9A8/VjceZ:0ZMOykGRzYwA8/Vl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\RemoteDesktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34
MD5 e6367d31cf5d16b1439b86ae6b7b31c3
SHA1 f52f1e73614f2cec66dab6af862bdcb5d4d9cf35
SHA512 8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a
SSDEEP 384:nKr81F+CoNFZpeg7qX+mK3sxjt9l/C6I5YxBXWKeVFjyJ:KTvZY4gTPXBojG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\ReverseProxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8c4efe2c8702141ffa8ff8f55d248dc4220231ae8d12ecea1f22906a9285b32b
MD5 a22d11379e413cf832b3943ce46f2463
SHA1 99b9552e8a25bff29678aff828901edbc23eaba5
SHA512 cc1eccb29135acd35804b44f73447bd8dedc8ea085dee3670cf49120baa905aa7ca512c14a3f4df6aeb5a70347bd214865f9dc8b709a00abbb0c745164d87074
SSDEEP 384:sNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9yPCn:sNuR+ZZ+mScWfEoMZQ9yPg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\RunPE.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7adfe849345edd76aa975b0647fed2ccaa5f4a6aaf7d55f488af939c0dbef153
MD5 224be01635cff2dca827fbdeaddb983c
SHA1 11fa00c5e172c9cd1c81acaef52934f785f91374
SHA512 1a4915b7b21e8166a6ddb6460c77e02c306a460c08fc7ee574832b0576c827db343eda9533959298819ee443790769328ad580fc67fe4817110b63d49248c736
SSDEEP 192:vbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUse2po7SLOYN:vbChWqPj5jJtGUse2poHYN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\ServiceManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c552d11db168a4f64db584283a617a6ec51ab6095c20ba4b706c3138beb68a22
MD5 2e5f127cb0a69cdd46aa4fd9e603f982
SHA1 994a6ab276c417301ed9208aaaf6719bf9594bc6
SHA512 4455cb3b9d4a9c69abec7180e9a60e16e6be0ae2290f48aa09c5d926370de5512ced4d37b6e6e49515d5f51999211eff6f751c4594db936882fb7f40ee5bf97e
SSDEEP 192:D6FAiNLB2n5QnRBiMcs/XAaICPczrOFsgXTZr106Yq6IW1yShrM7+WAMLuO1Jjm:Ziq5QRBiMn/wpDUtTZ5nYsShY3AgJjm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\Shell.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6c69b4d45638097e31169d94914e4acb6a8cc7f46788ffa4f241e4c1efb213bb
MD5 04609b39e656e297db73be0d02c7e35e
SHA1 f8abd484e7703a4d9629b033e8ec39c82eaf4654
SHA512 11a88d55497fedeeb05b146ebd3135755aeb08c4596e9379eec83501e734aa6ba926d9bbda1c5f50e361836d65ea88d2c018f0b4b4b668c82ff2163730eaaf27
SSDEEP 192:TDXwH3m0L3G33Kkw720sM76ODzKOFBLggT051i9Yd6IW1OU1YoWPbs5cLWT:oH3m0GqHT76OSUXT0HoYpU1XWoxT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\StartupManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1802e16379d96021fee05f583633c8091bb669350b7d32064179a8944d45a5a6
MD5 3d76ef15ab712b93eabd4b68ea0111d5
SHA1 0f309663fae17c4ccae983e1fabb16a1e5f77d9b
SHA512 6c0d0291abb696bee33b6e42392b07028c82bcffc8fb7934ba234f178f011ab14fde38cdccb322c8dba058ae66fc023349de5db1c587d3417709bf263cfd28f3
SSDEEP 3072:7ITmgSRcBHAt+yM1KlUKEHBAnpK37nXnF8KBOQv174Syoh2sKdm/vl7bQcX1Okta:7MmgSRcBHAt+yM1KlU18g1xNYVc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

199114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\Stealer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 018e06f57725563e4525700edffafb1b062bf5d4b0e9fee498507f0f8200fcdf
MD5 ade4edd66bc695c9465816fa2538d0cb
SHA1 e4351a2531307c848c60b20ffb50bcc04156fdbc
SHA512 e2bf3962787366d7a975eb55d2edd1fe35935205febc00f720dc0efff0c62b5df7f0207fd569f692205e8a227c059eea596904995855458e9c02306842e88a6f
SSDEEP 49152:eVbwgxmbsO2B7wKOfpUL6GbriHeGAb4TkyNejjWSqE08:eVbFxmbsO2B7wKOxTSf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3453418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\TCPConnections.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27e17a43478448f64107df786a170753dbd116eafca7c027f6d357f11e6a4def
MD5 9cae90969d14ab4d686c56bae19e041e
SHA1 0359e8eeed993bbbc6f141b115bd533eeb52533d
SHA512 04a9dc16299d866af7f56ff2ef355310d9437c909ec0dd3549d2f142e71149b09822106e254970f00801fe2f0df6b6d2670cf6a8256d85cd35b963c028f6202d
SSDEEP 192:VsFaPxrfOKHEWS3/tQ6v/Lvyrq6gNZOtyEox0GTeA19Z/J6IW1Gz/yyY8RKIxLuM:/9GKkWuv/LyvSwyzTeej/Zz/IHUv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\UACBypass.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ebd51f1e33673cb8e55f10aa890a04027d62b1c1c0b0ae9b1d6f83f1602f53a2
MD5 158e789d0b6cbc52fcb6653fefca38f9
SHA1 4e913315dc3d69abe2be5e5b3a5d37b5f49f7deb
SHA512 23243daadbad2f68b6ed6720d5792226f9c2aeb0b14cf3bf24ac54dcb7a2aa4aff9d26a5633d3add0d871e4ec65c230752c7c173cc4a4374f9263e2c46f9977a
SSDEEP 192:kcq0WYKDFxDviOGOko8bZfmgyOYkIW1UZ/Xvjljw2ugiSL20V:kntNFxOrE8bLyOYBZ/XTugU0V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\VB.NET Compiler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1940d563046c67dbbeaf5f2a2417aaccdae587c1eb97b79c263994896805bece
MD5 2401bee633ea4032a758ffc6d729deac
SHA1 3040e0e27f48eacf45860be4ece6f94db7bc1c4e
SHA512 af016b5d2bf8c08e16b593d72a25284f31d6de7300ef98a226db8ce4f2a9dd512ec793adf0730b40dc0a37e9dc5a9d6ef0a50354a697aa5816b3cbe440655692
SSDEEP 192:TGESp/+S2SoW+O4A083xaU12HeZOCeJyxlTer1c9gotlF6IW1oXxvZLY4cGSLOBL:w3+O4aADifeyTe5agIXxvNccZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Plugins\VoiceChat.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1a2da0a66c7771962d525b8fe9491052efbd5f87b97d935c267fd96519b5a35e
MD5 56a8b030ade4736915e5b601a4bf39f8
SHA1 ab03e7948c4604fbd15d285f674ea879082a8e7c
SHA512 d0f2990adb10221c88bbe04b4f2b702f99c046ae9ce5e713e2d26f73f9353dfe5fd983cd37c7b712341a58cfc4f833e590ff1e449c66fd5de98604d58a92dbd9
SSDEEP 6144:TkcVpiCslfiJOBvKbfaIKlEZfb78+SmmCENCT/7CbRNid2/c2Co+5CJfSp7Of:4Zjp8fIlE9bg/AgBcRCcp7O
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

557686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\WSound.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4bea01b7d691d1f59ca0bb5149e5baf71cde71019da3d352141b1d4921e70bc2
MD5 f0d8beccffd6a4831c0712a4da4a0c2d
SHA1 238a2878f1bef8f002ba501c1f65862ed384cc75
SHA512 1c5244736aa53d5dda52b65a26facda8334bc7f98ce2eb6356c51fcae03b183623d0c3bb7f45993b8bab0c65d261a23164f987aa5f6a47f2f307380567367904
SSDEEP 12288:Ayw8KX3HOt3qqDQkoJBBg3bgtP1TviDH6MJyKwYalFEYU:1w7qDQkocbgttGzTa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

558162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Plugins\WebCam.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d413b40aef41e53557d91f3b3ac64cfc13adb0f8c3edc364e7b8501170e2657
MD5 71a9109ccafa90550c1c879a304d27f5
SHA1 c77ce45aaf8b2d8aaaa2a41833275f3eda78046d
SHA512 fc92190d8a889fb088b2e8c2e4ea4751fcda59eff076b205da7c420b2f26564c1835d6ff1af470b583ec2ec92c0fcfb472e443e29d33f538572e6edd36c8c47e
SSDEEP 3072:pA0VnWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJz:pBn+22fFcgBgakL320zYZHpMXM/I/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

220286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

RES\U40957361f7481084776e6aedU9f0U1

SHA256 294f977ce530e3d471a9e2bb09305b6ad4516f42e3c2ce5c6c715f7dddb18991
MD5 13f3948fa620d58ed6242262b575c784
SHA1 8d8e32815bba106ba7452c7dd80bf6012d88def7
SHA512 a74d3d704a075b390cb555864d531a49ce9e8ecf1e4314eb53c3f11a9486473160c02a9c03bdf6057d466f34aa87e3a53b50764bf2d493dd0dafedbc0fe22df1
SSDEEP 1536:IuX+Mqm083ykKjsbDt1+PLCgmCZVLsDTvNIW97tXm6LSDfUW3jTzBHk1mTl0tNap:ut8Hv+P2JDhZvEcMzpl0P0bQnUBzt
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.ACT.resources

SHA256 b7ab18c6ddc022a4018d576dcafda0352984dee3a7cd0e4d4f45cbe0f4df2b85
MD5 7b9622f29c461e36d8a4c3e27dffb741
SHA1 5f6204efc91e64f42978f7c8c293346e27fb533a
SHA512 49736fa0a285f837ba12a7067b803e918b2a39c21d408cbbb39ee42efebbf64a4a19549ac2b7d7ca1e4524dc85d38c1a025ae41b947f40a36d18767fd12a4889
SSDEEP 1536:67ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:6YLe7HkrVOiqyTaxw7jpY7s
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.About.resources

SHA256 c403d852d1d8693c70b23199af2db9e70dd7d540e62c95bb8ee295022ccb9ba1
MD5 dba99ce51cb7cf664617714d7c5d0664
SHA1 79bb6210c1a5d3e37c93143d39c385445e167aac
SHA512 1e09bf3bf45dbf4e8b7ca9b7e222f0382305d73ef1ec9626b5bc6414b6e1709265da1e4995cec56e187df251b18ecea9778e52850ff8c33385632ed395dc439d
SSDEEP 98304:J5F/i9sHzcTiT38Ed4ihzD3w38dXdvinSh8q:l/BAe1d4ihvy85JP
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Builder.resources

SHA256 2cd4edf6e3fcc6465e393ecc856a6f5ddff29ccd38da3c784dbb5eeab6c3d3e1
MD5 fced32c3b698eb4204689d5ab088caba
SHA1 fff555f9eb79f9226221d1116776e2ac4dd45d3c
SHA512 53ad5d2b03e3f561ac55f3274d8a2d1a552490a577e4f44076be8e395981f25b6142b218fbc019a5bd19f32d6a57a196be8fa6ec9d453966f398d2feabf57aca
SSDEEP 768:6YkB9omkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkfFakkkkkkkkkkkkkkkkkkkkkA:6r9oNnJHyh/HOL
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Chat.resources

SHA256 9388906dced6dafbf91726771e55b4d07f870790ca6a7e5ded930d812cd13374
MD5 8dca4f7300e5fe396ef7401b5ac9b450
SHA1 fb91f139fcae116bf834292c47757312162bcdcf
SHA512 f355ac08e80d1b513aa40a9b1bacbdd4d2ddea2c645156fa55521a93c759a4cf4e6a605254bac02fb9c1b7eb43ad72b75fb293720bbd2d114d77e407236a07f2
SSDEEP 768:r/Xxu2kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkF:TkE316
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Clipboard.resources

SHA256 18b66195ef662a04125191fc381e1181350ad081667c6437e708d29573c3822c
MD5 98d7b91bac73c075f30116b9bd3c67f9
SHA1 b9e705565a4ff351fe36486f12fca717915707af
SHA512 23e542a75c1c546343c7ab236b103b47fcace224791eaeacd4fa7fe376e69b4b84773a30d7f13991f0d0b3e5b245b00252089c0c89125cef55034a06048011eb
SSDEEP 768:mPFvvvmjF2/2KZeQ46XhNcEqnKqaglXXI:mtvvvmjILp4KNcEq8gt4
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Clipper.resources

SHA256 fb95146658664f1a39e459d914dd6de69b3b946cc433e9927998b2e6eca2e185
MD5 38d4e87d0095a63194c0cad81bc211f1
SHA1 a15531063c6c341094a05d325a32808eb06d1f65
SHA512 93589625ddf9979d348bf252bcfed5039241ca1860a8d647761220b6b6343161bff73294af80600aa525b251b7e2881985c2c939be672ded827a9071437d50c8
SSDEEP 768:1QinR1KLCUAgc9h6RVTqSXFbnPHHWygDHS0Zvq3Sa+OGapJ:++vKLOsVZX9PH2ygbNvq3SazxD
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.CustomOpen.resources

SHA256 598558968242dea51f96c5733c13bb430ef5444364acd72c7e47300ab760547b
MD5 3c655ef71e0f2b716ed5a89c9b11ae2e
SHA1 433e4a0b3a074e8df88989b31297ee38d83a98c1
SHA512 03e457011d933cd4c4514a8c144fea2458efdedfa1ad4f3b28e963682f3c0b71f456bae40cbe15864dd527ef0dc22e0f141b7b3a5b8f02353514b26a861bc70b
SSDEEP 768:pUUiy7kkkkkkkkkkkkkkwJ2zcrq+5kkkkkkkkknpmU0GDkdz2EapJ:LwJ3qR0oD
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.DDosAttack.resources

SHA256 f5d6acd85a0c639a1488802afd8494c712df2925276217f71fa3540bf11e9f4e
MD5 c84ccb00cc3e74c2aebcf95d31d72b08
SHA1 67e30f0f0c3472ae96898e18002a8332ece8509d
SHA512 a27090fe6877fc6df3ea0164b80d337871e2c1ac9aaa8718e2575aae1cb0533dd158a26d3c42ef73770c6fba78b41d1f1bdfa1259c7eb9c042a1253a9fe2e330
SSDEEP 192:rkvwKwq6k94PfBMao1p1/Z+NhAaOSgG59A888Tf6Z:rkvwKwq6u4PfBO1p1faONG7A888Tfs
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.EditReg.resources

SHA256 d1e026edbe1d06e58073bca992133a94cc495fe8958d7de0c229e9f6a4a23253
MD5 5fec710a19fe099ac9928ea500ab63b0
SHA1 5f539bd8383c61470b2839bce6c8e6a9eb966e55
SHA512 f91027078a3b6384ad9db49962d7c398204d48f632a77c3f423e5cb5034d71012fbbf1d6bbdf9b56968861f34ad2e5e74bf9efb3dde1736e23b0dc29a7b880bb
SSDEEP 3072:0TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:a8
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.FM.resources

SHA256 697350ca911bb5af342a5485dfb5787bef0541526f053f7cb559fbf005e66333
MD5 16f2d71e8e805a3d8678576532e45cb3
SHA1 69116054f7a15e73b51bb0145d3cba80ec362297
SHA512 f327d1fbfeaabed971d2255da64ab4875aaa2b8923113e62cfed68b4dc5643c07a33eadb473361a7ad30647470b744ebfffd8d806c28dd35c1681158504bc8ee
SSDEEP 1536:Fikp4KNcEq88sXgAHWOIcK7ETH1QatyHkrVOceYM2mX:FixF8JjHVKYLe7HkrVOiVS
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.FilesSearcher.resources

SHA256 8f6b3e617286b240c1117bf6cda40a11bd6d59d2a94ea9b9817730fec7cd3d70
MD5 95818cf2184044335cdfb896b28843ff
SHA1 037e53ddd857c9dcc49ba02810179d7ce8437069
SHA512 a63e479aae870b623d1dd057b6814f10510b54e74e232a16b269acc2435fc36f7a7a19341d2b1de79bdab0603ff7b0cddc698c6b9e73fed52cd4c6e3e955e289
SSDEEP 1536:fqZScK4323F5VLx9WXjbR2H8fsKFBT2L0RjpY6WjvhY:ffRWXjN2asKFBZxpYxvhY
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Ftp.resources

SHA256 c497bcd280f3f33d1b49d4e7dcac03434c20bfadf435a71b0eb501cb74eba68e
MD5 7c65f0d2d6700ea2011d8cf8698ce129
SHA1 b1af1045a19306cd397ef3f87ecd26b7060fa778
SHA512 d76e7470f5c2f152c699714837d8d6d046edb0953e016af3719b48f9155771e47b3a8a160f0074f96287fe2cc26f38cf9ef581b1c2dbaa4a4b579c7ac48a1e3a
SSDEEP 3072:9BMaTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:9BMo8
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Fun.resources

SHA256 d1e2cde8706b7574139a8d0843121fe4b469e191c64bee885b16f53c398c0634
MD5 03ed9f7cfdc4c4022748d28866ab8392
SHA1 14c6e19f536fe87b36ca19af03ef6808a27eca42
SHA512 37ca143122078e3412eaf01e3120b36c43c0acc5e4a0f3b625fe8c661fa5e07a9579565a29854f80b9e510da6bc52ebd041c6ac543e32796e74b4ba338e47ea9
SSDEEP 384:rkvwKwq6udiHHHC3P3P3P3zXqvbvQYmkvbv:m3P3P3P32vbvQVkDv
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.HApps.resources

SHA256 d7fdbbfacc23d6cb577df5908678ea33a458f5ba0b96359efb5ca1839bfd086b
MD5 60f80d71c8d9986035368b61a80ec39c
SHA1 9336b5bbda4b1eb92d8b5f7cb99d482ea74964e9
SHA512 3411e36495e958706e1bd9f37551daa76e2bacfb5bca242ff8a20921437c443f1b91aa28c25526115ad7248358d2e29d62f0de3da6aa63e7cca6aa39517d8f29
SSDEEP 3072:OUjCDfWaFnj2tpyTaxw7jpY7kESYLe7HkrVOik9C9R:OsQW7kEubq9kwX
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.HBrowser.resources

SHA256 3ff03acd8bda3bba40e14064dcedcf188b5c5d9b1c899920a0ba49238812ad03
MD5 1b4955c4d297f43c89a4db73f0054346
SHA1 d90fa8dbb8897ff4a565b8b019186fd13e0807a0
SHA512 ada52944b61e64d28b3ca7f8eb75601a287b6d5c90b51d0707bb00ca697638589dce8469eadc738b45ac5d541908143b9c3a02b5c6d0f51b1f3df1fc2914e8c2
SSDEEP 1536:opx1pWvE2lPpjq9bTQPmbYakBxBW/7jpYaGlVf01NiPu7ETH1QatyHkrVOceYMs:opDpW86pyTaxw7jpY7lELYLe7HkrVOih
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.HRDP.resources

SHA256 f8d74378cb9be4608271a4d4994ef57ebbdfeab037c90c913c39ae3d89c9fb57
MD5 fa9343a592c72c5624ee76c157265bb3
SHA1 570197edaccd2c58f1c1d6a96a92d031933b6c71
SHA512 a5e99e9645be0d6ce506635eebedf1307615d44c3bd85ad91f29a45f86685c1a9833df150d7bc27a19182fa73b52da2ca97c33c0337faf18052bc4f3be457640
SSDEEP 3072:c4jEWtQbQEm/Q+NQMQSQ5QnQ+QYQQfQQuQQJQQzQCQlQbQQzQAQxZsgBTYUwmfJX:z
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.HVNC.resources

SHA256 c1eccd021db7b1d686e10cc6aa14505a21386723fa85d2e7eea6adf361a92335
MD5 cbd7e355e5a99120d510874ea6dc5c83
SHA1 90e324eaced544ec96e4f773ee8f65687b2e7661
SHA512 1e3accd3b979dec6268acd56ec9fd30f4ebdbd6fac3090e9af13f9f39dc437ad69abee431747597408ed1ae3a402bf795ba06ddd892c5897796d45b6e4aa98a8
SSDEEP 384:rkvwKwq6uqWHMDzelakhLZS3UrjTgwE/9xxNTT0TTbo/t+H1wLzzWySGjqu9epXY:QselVg6n89zNTT0TTe9jeXWzSg
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Hash.resources

SHA256 f5d054da5630a8fb711ec674feaf8597d1219a72cdfc6d4ca4d7e3806c84812c
MD5 cb331a72ba58813e6b3924749bcd6390
SHA1 18009c5eca68ae32598c3200fca3782c5b1e443d
SHA512 98777f7558a4af46b2469d4ab4dfa4e92496e3bc1fe74401da758c902a59701ff8fd00268395e5c8a511c9d64af82af812c195b23d77d4d5b4f0a592594fa8ca
SSDEEP 192:rkvwKwq6k9TCvWkGIlL9h1yhq9nZoWA/m7iP8Gp:rkvwKwq6uTCXpOsZob/m2
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Hosts.resources

SHA256 3439ac9f2377613b6b499844fc39cb8c2e0958ffb22014409b5cea95c626e91d
MD5 83793c37782eb28178b2196b51681877
SHA1 88749fcbf6382cd36e1c94009ed7ae1404a07d00
SHA512 c03434cf2cfe85b30a4526afee6a158b77420d2bf1350b73e3c02e9dc6febc5d9a7debb5287607dae9992467ecc49573d92ccc50a2334e0e93786936e92eb9f0
SSDEEP 384:r0vwtokwbwq6u84ELf8Yo1TFE02rVaM3/2ptMx1bU2o07zwAWV:9j8N0Rxi2op
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.INFO.resources

SHA256 501e089e1db08562e14f2750e406b0533d7b3aae3705e1973b29849cbbda6fb1
MD5 5ee5eb03c4d8e504b7a996fd5410666e
SHA1 dddcc286a7fa6cf82cbca91e1d9b67bdf9b2581c
SHA512 e2f7acb328edf79899d8774ca9cc94574d12defcaf2ff9047b201a009d27ee7044cdfa0b761b11c1c8a12d3bf514f21bdbd35a538c52ce8b53d43a586a968027
SSDEEP 1536:ZU4VmTTyTTRTTPTTdpgiCiCiCiiTExaFlM7ETH1QatyHkrVOceYMs:j/cFqYLe7HkrVOih
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Keylogger.resources

SHA256 89f3a42141b619bfd652c9825bcba07b91475997bac48e001e74dcd90bef754c
MD5 a1778b17ac5f0f62b3771e9886e0acba
SHA1 0a0d5f1a4fec5c677ebf29e0dbbe0ab7032fef38
SHA512 1669aa46676ab5f03ced3463a84e2a99be0789e7649f50e6d33cbe6934a058ac1088660c457caafdf42d7bc4342fcd844c9811bd2d2a02efa7cad5ecd10b7a98
SSDEEP 3072:S6F8jWZcccccccccccccccccccccccccccccccccccccN:E
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.MBox.resources

SHA256 a2a724d05f289fe51f6a3639937c460764ee42935c6eddbd5f7cc7ab6d26954a
MD5 ffbc6e01f688097960937446350eb01d
SHA1 6753b872c838f2439e91fbab20671cdcd7bc3d1e
SHA512 2cfa07a45ed9b8547a9ca303d66a71c943f1723fcd692d9d8f5f20f6ce9671e5e5f11bbb2ba7d6e41a27806bbbb7ecfd2f7e7d37af5420aa3c68b0f64dc9c6fa
SSDEEP 768:hFGla/np/wpRGZPdKOqoJLTapjappD+2f:jDfd3ckHjf
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.MIC.resources

SHA256 aa4f13af48d1d3b3735a732e90163e6d302fe33a8f0041933dc76427f099aece
MD5 d079b64991e7ae90dcb355f1036831cf
SHA1 980f639c4e3db7cea44ab28e40ccdd2c728ee179
SHA512 e6e5e21438d7b60eb9f7b6d8cc9e2a672e15dd5af2cecdfbc63dfce8e371982abbb951ce052e731daec9c86f356af54e81623dc7e72ff36a802907345d52f6b1
SSDEEP 768:moZmmittmc9ik83EavHr/QS99wkwcMPliv+j4bctbK:5etYOC3lvHr/39Kcki2jAMbK
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Main.resources

SHA256 35a6f657c6d1db902ff3fbb3149e629acbf926c7c244bbce502c0b65cd2c536d
MD5 8d7f5438261b974eaf34287253799b87
SHA1 086e994fa1ce12ebeba3c134ec9af69244e8c2e0
SHA512 2e33671bf500e8a3727181e14cea8be2d4f77d4422720710056676ce4f8e6b4b2b3a9f38a0713750e7363c52af097ebb5c489c45d46c5627236d6afc81e67f67
SSDEEP 24576:nm8179dddddNjYkDTFKlDy/Y3BZabuwVAeNgFfWN:nm815ddddde+MlDyg3BZaSI
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Maps.resources

SHA256 f690fd15ad3c3150a48fd33962b44ec118bb3f9b210f0d0b27e3ee83420c73f4
MD5 ed0eb94f77f681a3600539bb9a6cb6f5
SHA1 b176e3455cd0224448e9d9b4b015789c794d8b06
SHA512 8e097d3d8617043419154821d9721bd4f7e16f12a19f7e8873c8086872540c61e4d932e43515573eac08372a243c0ead855ebfe5488a1e6e53142c44cbb5eebb
SSDEEP 1536:jjbwDfOmcgfteiMWWZoSp9wmLZoSp9wmT:nSfO0tkZAMZAA
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Performance.resources

SHA256 16ea3b81c6f9ad74d27c621f0b8485929dcbe293435b151124c388aa66f09c52
MD5 4c7233c83c2f749762fa0e000021e5e3
SHA1 9b1a4826da8279f52aae9cf29570dd2679ada1bb
SHA512 0f9b830fb139173f321a78b32b3166271cd5345df85b63b2a797e38cf3fa441715cc648e89768bf12bcdfcdb621273eb53b62d6fd66f5cabf6b8c40d3474174f
SSDEEP 1536:LcP/zyxY/FVGJ+j+chraMRNPnLRhtAN4RRH9nl85gi:yyu/FVG8jbraMRDA
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Port.resources

SHA256 bd3da4a9c29cb564c774bd8b8c0b79078f09b037cf2f3a8fa2566648f68a012c
MD5 faf23924f3c859e9d570109d930928e1
SHA1 6003549ef256bac573ff809a9a5d967b8106f9ab
SHA512 227f0c0245ff48955a1ba95fcae513237c1d4f548ccba955c4b26a633e7330a312fcdea474dc87f2847b51a3694427f5227f60a77dd5168760cf28b770ee3fd3
SSDEEP 1536:wi2AP+ew+ksEvCwVwLM+uvpIVyXJyozbGyMqmyVttdGFQeOPigp3dIHyYNSL:2A2ewhLapuvpAsZOyMqmyBeYVYi
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.ProcessV.resources

SHA256 1e1b3bd4c4dfe056edf30fba8d6bbf94665e9bcf936ab06db79213e8b400b61f
MD5 abfd25fb3ace375c63f8e9cd4ecff32c
SHA1 d7b7f30bd62e17e1da6bad889b9f77d93c795039
SHA512 d8c0546d1ee9a35a7b8a3b9304ad63794b1e71d014f8c45145b60343f8140457a8711065f7a2aa87e68e1d564a45171425adab9b83adbe9491afe065d990fe0a
SSDEEP 1536:io7ETH1QatyHkrVOceYM4pjq9bTQPmbYakBxBW/7jpYaGs:VYLe7HkrVOilyTaxw7jpY7s
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Programs.resources

SHA256 55c19900015145bee8c83f27ca58032550871a92047abf6166dbf547b6afa505
MD5 9f05c761cba903361771cea155ede6fb
SHA1 af0311816e6f1315bf29e5a42ac3d75adf71d115
SHA512 d4e049c341deeb7376e7def96e071808c9e04e085171b46af7f7096f52cf4288df19d3c2aa2c87816a6eaf5feb3f2257bd58e93f582498ad8e4fd4bcc652859c
SSDEEP 3072:XfH6ZxP8NJAceI82I98CBCYLe7HkrVOiqyTaxw7jpY7s:XfH6ZxP8NJAceI82I98CBebq9TW7s
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Proxy.resources

SHA256 ee84fb0146a0a7e6bb8506159eaf12fc2888ae87b0553e1cb031e044830584dc
MD5 d6e648329cd1473e66a01a9402e907d7
SHA1 ebe34259546be5638bde8ae75f96d6f70e3da62b
SHA512 0d44e33084f163b0d56798ace44294825fd76478acf303ca03bbdf6dfa286cf8cd0677c50fc1a422073ec7498d13aeeaebfb89b1a4eefd55dd010c6c23c1a7ec
SSDEEP 768:+SEnnnXXXXHXXX/fffbyuyuyuyonnny/vXH/zLHvEppicZXvZZHf+m:+SEnnnHXXX/fff3nnny///zLHv6JZ/D
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Ransomware.resources

SHA256 bcea581804fc0d0e1d66c76a47f9b7bd40b81578bff0241bb4155a0c67486a46
MD5 c653b8b3f18eb2a2882c2f3905b2380a
SHA1 62235a88bc833fe7a41c9da2e5766306a026e144
SHA512 a01927f5a4f3b1d838919074c42125d60d6e50af3e876bf614f0dd264627234973ba4b642f30040332c328587340be82f6057a5130baa0d79851fede67069a4c
SSDEEP 384:r0vwtokwOdwq6upS9LvgUuYkYezHbMTb7+JZf5NXJAdDzMwA6jp:Y9XuYkYez67+JZ58zf
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Registry.resources

SHA256 ce34680ff2984c6c4766889684a358358711d2cdf3171813ff768d7f1c9c53de
MD5 d098b950169502933b9ef1f417f25172
SHA1 8f40b86fa8a986588788676ecdcad5bf55c586d7
SHA512 4a38f88db6a585d6a47e6da36ac8aceb15825453e5ff4804b2943be9e4053fb85206e473115e72a86c4b0c2d13fa9a1ae18ed7d96b52edd050e7e918fed33317
SSDEEP 1536:6s67ETH1QatyHkrVOceYMa7ETH1QatyHkrVOceYMJ:6NYLe7HkrVOipYLe7HkrVOi8
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.RemoteDesktop.resources

SHA256 1dc136b225528fe4ee8020f46aa549e4bbdd76493d0579b6c1837d10acc3ba13
MD5 0f5fc0694c9d76a6fd5b7e4158fd03e3
SHA1 aa7eb852f5743e456e5737ca25e7b75ca7349b42
SHA512 af3c1ff80a247ac8ee6440ff4410460603430f24557dce392b90961b77a2d978b6b75a9a606ca433ce16cc565d07c2b5fc41413c1229147194b24bbc1869c67a
SSDEEP 384:rkvwKwq6uD0hAAAgAAAgAAAgAAAliIGzl8nnnJP5JJJJRetmJJJJ5gCnnnsjBy:rDnzly
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Resources.resources

SHA256 557058bd29a5eb55ef073ea9c4dec0baea1fd3f3f4bf2cdd5ee3dfd33735e93a
MD5 34986e38b463873af40f694874c1f6d3
SHA1 8fa89cdb7a394cf8093d548ca9db4652c703ee72
SHA512 c1b0278e8c21e5c28204f692a5cf5ed16c8ada0c6022d7d38e70905255f3aeb5d2c0fd4549f0ed19ead52aa0ced891a8f9372123bf5e1710be004958750874e4
SSDEEP 49152:OsP2WTJcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHXH:zuWTGLP9Pk6gAK6n4ldyNh3
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detect Xworm Payload

RES\XWorm.RunPE.resources

SHA256 823554153d20aabf65c8635b7727dd6f26f14f79da929de9af8131314ec2c347
MD5 147c16f102addfdd7b756b8ee1558b82
SHA1 e9aa9624bb96d369aa905d14e03db625d17d00f6
SHA512 2df2784f5284e0808224a58fec6e12f02a5e09001c77991bf643b4304d99b633a3511551ef42e2e64f1ad6e5de0a44ff2c3b358413dd6ea6a9b08c0dfc592c38
SSDEEP 384:rkvwKwq6u29Ax59IWzT9DfLtFbm44XdZcGe5Eas1gMVuM:D9Ax5x9vtFbm44XdZNeG3
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.ServiceManager.resources

SHA256 fc7906c147eb0066e6cee2a528ab531b6d0ad1eb0b0a4d2a32a1be422809ecb9
MD5 776d31cf63f902ede47ccd1e09c463cd
SHA1 a45e4761bc40019d6e5b72ece5d731c520d91303
SHA512 f8f099d291b0ecab01d84d0c4f4480c7ea266cc79f1071d71c71ca3113f6c8594d82f192feb3b136be0e007542da1cc6a7b28b860bb3ee2e0e7747b75222bf0e
SSDEEP 3072:VqR3kbym/bBGIgEJjHbD1yLHpkv+GhSx7BQFgfMyd9tbYLe7HkrVOih:lbJGcJj7D1cJkPhCprxbq9h
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Shell.resources

SHA256 7f71160fb4d68eda2e6af07f2b89416cd5668ffa5260dfbeb69391dfc5508586
MD5 a3fea8391774bbb0376e1f69eb6ee9d2
SHA1 96032202ca3dee1983d1990ae856112f8c832173
SHA512 10a3c77631a0d1ee80198ffe430a0a389897201ef60a8f3e9beff5125545477d8ce6ea8fa5d186ef31dc4681b62048d71fcbb3106a88f22aaa08ee75de2c842c
SSDEEP 768:aoR1HiAxeglYAQ8BXIHDiJ9zUQI0xV3PrEiv/ewrmTIgdEM7XoSxSdL5NCc+Y:ayheg/Q8B59zUQISXnFmV+Ib81NJ+Y
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.Sound.resources

SHA256 7d7ca0ead2e362c4b2b4e5e7799b0bd115eff66abe9f7bb184734444142bfd9a
MD5 d867ec78d12cbf85eca15722c1ffcca3
SHA1 90dc339c7ad81447758eadd2535298cfc2eb1bcf
SHA512 5bcbbccad3f71207e6c28784fa27e38d8c24c4d2edcdf3b55d5937974c63c9a8fe6ce311d6946ea13b669ade3c262f0c3bba82a330fbbb08a00bf066734ea638
SSDEEP 3072:njXXX////ePrLaPp5+SRqRN1SMLVivg1AGA8JlT6rZQnmmQo:RPp5jyNQMLAvkAl8JlmNV2
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.StartupManager.resources

SHA256 73d138786a5f08114204491631867e44f5d1d60a683890509c7f69a78198c60e
MD5 3e7ce35b2e085ba831d417d582b249b9
SHA1 63926a8d61ef3eb1e9408e9c531ce35adba66886
SHA512 27a6de57b2c88a8d1119232ef123e728b4f1bf9aedaae8caa026bdce9541ef61c4c3d5a59fb4c7613febbae5f5e19ae754c51a4ae9176f2eca5dc03d938048ac
SSDEEP 1536:LasebR3b313F3F3goXjmtt32325JT8J8pjq9bTQPmbYakBxBW/7jpYaGS7ETH1Q0:L9eS5JyTaxw7jpY7SYLe7HkrVOih
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.TBotNotify.resources

SHA256 6ec33992edc80f131e4a9f7f89fe9c9dba233f7c3bda8ce6e06711021e8645fb
MD5 b219d1ee4ae25f781e5bc88165839987
SHA1 bcb30240b697493fd238c0d611081200a0abc3a0
SHA512 e4d013c746ca857a135484d908fd2fca6257236b8b3cba8bc10209fdbb5f7cb3b595da15618f4713eb5cdeb7033772f72c22eb9ef5022c337d1dc3ebba67c746
SSDEEP 384:r0vwtokwswq6uTq4fffjfff+7f75ArrqWKwA+apJ:dfffjfff+7f78rqWnapJ
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.TXT.resources

SHA256 1ec2de5a4bb61ecb3a2e57da228d3c9f278853b21ead5553643bbaf6c6706b50
MD5 9cddc18b39b043d9542e5f0989faabf8
SHA1 afe5c5b7d6a978ac504ec272c1e8dcaaae1d5b34
SHA512 b9da58a39c39cfa665e63af0ea206ccbdeaf7452f801b3d2d9bd89e643c3c729de172ff6f86b8389d94f2f0ae92153275f4cb1a30fc60fa93e5fdb717cfa4a8a
SSDEEP 384:r0vwtokwzwq6uCoAf+q7xVsFoSNDUSh+w6HvQdBeQanPw9h+w6HvQdBeQRzrh7ji:2iB7bsnWfffJFB
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.TcpConnectionForm.resources

SHA256 5d1dcb82a528c97aa161d0ffa742032abdc3e911125d2171768ceeacf8fb9285
MD5 84f1c4ac6a6d9b44bc830ab1129da3ee
SHA1 55b207a19d11950267ce10e914c0b4adcad52f1c
SHA512 4faaff764f6074216c5d9a5493e949ffa6e0cf32a74181d8141d0e3d5b5795d3afd3dbf79f9bd2890d37f420205cd75328d8e488424e139ea1aa7fc9898c0aa2
SSDEEP 1536:ZLnTGFCnE2TeaHXvSQ7ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:ZTUEeM/hYLe7HkrVOiqyTaxw7jpY7s
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.ToolsBox.resources

SHA256 f6a8d146ab66f03723e3ab551b1579f695947cbed073727af9fc396b2613f62c
MD5 73bda4b934275a61f1ca27e88299a29c
SHA1 63cb4ac6a9b0dcac53dfc35bcc817ddf46e5e399
SHA512 9f2b82b1971a195eea9401084edf15f33694b3ff757b3c1b71d80315425c6942a3e924b9fb2681419f256128257682565ad13d78570db41fcb3e9095269cfdd0
SSDEEP 6144:626twOOCanAtwOOCantAHzfadhIVBfVBd:62iwO7wOf0I3F
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.VBCode.resources

SHA256 0a8d6cdc13ff8387d4216b31384339e56fbe205ebbbdf1dc3f8f4d8587007ffa
MD5 76d53ae7107963acbfcd4597019c7f06
SHA1 6d01fa4b76be5007a5e1b6a7068ef32e8c09b258
SHA512 8c5a7fae83626de3f87b0b6ab382e2b2d60e002a701c87d7ede28fd976d34e7d88d664a72c22c956c2f54e0b93150634e8ed535d4b04b2d65f2516d6cbe4a270
SSDEEP 1536:fYWQm2zLGIBhvbXetsYOIw1AVLx9WXjbR2H8fsSp4KNcEq8YnFBT2L0RjpY6Wjvb:zQ1mInYW1jXjN2asvF8YnFBZxpYxvh5
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.VoiceChat.resources

SHA256 1e5b9f16f88c4de8c4a3ad03cb318815f92c40f89eabcfdd1ad0483a41113527
MD5 9b4613ca9da1999c6b521410d75e417e
SHA1 4671b2d8ce2280fefd6bd7aafbbf709ee0f554c2
SHA512 a107f4d40581c2380b745a54640fd1ae5aa6ebde04310077074de22444b5adf3e64206c078cffc10725a77add0d023e52c2d763920e2e8941fd2f3ec58ec3e0c
SSDEEP 768:V2bS6Pq2Ykkk+p/C+5hKf9wkwcMPliv+j4bctbK:4up2SFl5huKcki2jAMbK
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.WebCam.resources

SHA256 0ff62be2bcacad7ddda3b3cc32fee9c0a1c3bb5d72d81318728c1805204b2433
MD5 0a82ee1d886148e7b149c3b4745ab653
SHA1 a6b3e0127fa58c4479d5cdc4bcaadd9b6e666424
SHA512 6a13d2e45d710d80970dfdf0bc09ec0709fc88e62d22c4aa2cfe6c8dab18bee14e134d613b1fcf8204b70cd9950c82d040eaf718a97a8f64502d05e3ec9f6c0c
SSDEEP 768:LVLgN8K///iee8xxpe7ee8xxpe7ee8xxpe7ee8xxpeTD28g806Pj8ql:a1xxzxxzxxzxx2n0Tql
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

RES\XWorm.ngrok.resources

SHA256 b7e3e334ae48421bd3cd08679d94614e3f5c2d5847aff6eb7e06532966a43013
MD5 b776cefaa200763a77bf55211c838b3e
SHA1 4296aecaec1f77623dafb7e34a76c8b25ef6bff3
SHA512 19fbaa3369ff3424bcd6fdcd35c677b686bc465bb558e8933a93ce0997bf782929f4cb5c1e2022d0d3ce3f54d4fb6bff25b11444760972919d3ba0fc00aae7b0
SSDEEP 384:r0vwtokwPwq6ub5wAlec7vxohnxNQI5EOyK/WdpcN6Y9F/2KWowAglB:JMKyqNri9B
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

SimpleObfuscator.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
MD5 9043d712208178c33ba8e942834ce457
SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1456282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

Sounds\Chat.wav

SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
MD5 832a3652fd780edcdb2439ec33532c0d
SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Sounds\Intro.wav

SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
MD5 ad3b4fae17bcabc254df49f5e76b87a6
SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

XWorm V5.6.exe.config

SHA256 7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
MD5 66f09a3993dcae94acfe39d45b553f58
SHA1 9d09f8e22d464f7021d7f713269b8169aed98682
SHA512 c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
MD5 SHA1 SHA512

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Xworm-V5.6.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 683ab0e13fcf793af074abcb80fcc62ec70a11a706100b7e40707c59d2bf77b0
MD5 ed10625e36f1a0309f99e7baeecb846b
SHA1 0d0602afae162b34943d89583a7967ca8e4a4825
SHA512 70817624eab8919bed9d31b014e89e8ee249d99e19f8da9beef442a0bb832cc115c4082ec11f007684def7ca868d64c10a1555dc4fcec4e3f0a4855fd9f620e4
SSDEEP 6144:f/9U3ZvwnVPvjSu908FnDa+zZBlPfDQqUuLBpD/GWGwqqm1p7o:mp4nVM8FnDf1YuLBp+Fp7o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

58021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

d3dcompiler_47.bin

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 025ed379207abb2734e78135399fd152193accbaf4739dda37dcb3189439b236
MD5 9269aa8162e145a56de29826250a3e71
SHA1 53fedafde572d6c55ee5a800b7e67438829b4f96
SHA512 0242a6b5e5f3e0514066a4341e2da82635b91f93e1081867b93218527f289de43793c772555a26835dfa2f134e08f624332f2f7fb74204da1d535c9241b7f4c6
SSDEEP 24576:Lm3rIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76M:LgUaW9xthIXWgR5vuv54Jdhx7r
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libGLESV2.lib

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 54fca0045340d0b84822ab5cf37ed84d73c41b3ab4b9f0ac7e9b98616d6124e8
MD5 04c37e7ffc1ffa36373b4abb5e71d15e
SHA1 26c156d4616baf34d85466f42444acbdcc3d0e73
SHA512 4b6bedb26ef534fb23cacd26fb341875428a66b6d9698d4d950db9aa9608973e4a6fba9ba025e89d885a707213f37a8a14ec811768f4de4a61c370c2caa702cb
SSDEEP 6144:uHvXnt3lrzWa+svebdah1SuYuxoP6uAHqe5N:uHvnt3l+a+sve8SZAB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

110844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

XWorm-v5.6-Lifetime-Editon-Cracked.zip

Background.png

CefSharp.cfg

PE Signature issue

generic

FastColoredTextBox.dll

mscoree

dotnet

Fixer.bat

GMap.NET.Core.dll

mscoree

dotnet

GMap.NET.WindowsForms.dll

mscoree

dotnet

GeoIP.dat

Guna.UI2.dll

PE Signature issue

mscoree

dotnet

IconExtractor.dll

mscoree

dotnet

Logs\ErrorLogs.txt

NAudio.dll

mscoree

dotnet

Newtonsoft.Json.dll

PE Signature issue

mscoree

dotnet

Plugins\ActiveWindows.dll

mscoree

dotnet

Plugins\Chat.dll

mscoree

dotnet

Plugins\Chromium.dll

mscoree

dotnet

Plugins\Clipboard.dll

mscoree

dotnet

Plugins\Cmstp-Bypass.dll

mscoree

dotnet

Plugins\FileManager.dll

mscoree

dotnet

Plugins\FilesSearcher.dll

mscoree

dotnet

Plugins\HBrowser.dll

mscoree

dotnet

Plugins\HRDP.dll

mscoree

dotnet

Plugins\HVNC.dll

mscoree

dotnet

Plugins\HVNCMemory.dll

mscoree

dotnet

Plugins\HiddenApps.dll

mscoree

dotnet

Plugins\Informations.dll

mscoree

dotnet

Plugins\Keylogger.dll

mscoree

dotnet

Plugins\Maps.dll

mscoree