grger.7z
- SHA256 efd21682d800d3dac89b182f18b25efbdb00291cfe4fcb3b05e7c338ec19968e
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Overview
overview
10Static
static
10grger/Anar...el.exe
windows10-2004-x64
10grger/Anar...te.zip
windows10-2004-x64
1Usrs.p12
windows10-2004-x64
7grger/Anar...oG.dll
windows10-2004-x64
1grger/Anar...uJ.dll
windows10-2004-x64
1grger/Anar...qM.dll
windows10-2004-x64
1grger/Anar...LC.dll
windows10-2004-x64
1grger/Anar...wp.dll
windows10-2004-x64
1grger/Anar...uZ.dll
windows10-2004-x64
1grger/Anar...nG.dll
windows10-2004-x64
1grger/Anar...TS.dll
windows10-2004-x64
1grger/Anar...xj.dll
windows10-2004-x64
1grger/Anar...pi.dll
windows10-2004-x64
1grger/Anar...s4.dll
windows10-2004-x64
1grger/Anar...Ya.dll
windows10-2004-x64
1grger/Anar...Jn.dll
windows10-2004-x64
1grger/Anar...GA.dll
windows10-2004-x64
1grger/Anar...DG.dll
windows10-2004-x64
1grger/Anar...5s.dll
windows10-2004-x64
1grger/Anar...zK.dll
windows10-2004-x64
1grger/Anar...2P.dll
windows10-2004-x64
1grger/Anar...LS.dll
windows10-2004-x64
1grger/Anar...S1.dll
windows10-2004-x64
1grger/Anar...rs.p12
windows10-2004-x64
1grger/Anar...b2.exe
windows10-2004-x64
7grger/Anar...xe.xml
windows10-2004-x64
1Behavioral task
behavioral1
Sample
grger/Anarchy Panel 4.7/Anarchy Panel.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
22 signatures
900 seconds
Behavioral task
behavioral2
Sample
grger/Anarchy Panel 4.7/BackupCertificate.zip
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Usrs.p12
Resource
win10v2004-20250217-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral4
Sample
grger/Anarchy Panel 4.7/Plugins/0guo3zbo66fqoG.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
grger/Anarchy Panel 4.7/Plugins/59Zp7paEHDF7luJ.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
grger/Anarchy Panel 4.7/Plugins/CjETR6GpGXqM.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
grger/Anarchy Panel 4.7/Plugins/EVa7gBMKoaHmLC.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
grger/Anarchy Panel 4.7/Plugins/FBSyChwp.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
grger/Anarchy Panel 4.7/Plugins/G3nl0mDcABnDuZ.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
grger/Anarchy Panel 4.7/Plugins/KNTmoSnG.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
grger/Anarchy Panel 4.7/Plugins/PK0TcnqTGFagQTS.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
grger/Anarchy Panel 4.7/Plugins/RssCnLKcGRxj.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
grger/Anarchy Panel 4.7/Plugins/WkUP83aP9CABpi.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
grger/Anarchy Panel 4.7/Plugins/eMTYbTz0gueNs4.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
grger/Anarchy Panel 4.7/Plugins/fzAgyDYa.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
grger/Anarchy Panel 4.7/Plugins/mGWHaG2Jn.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
grger/Anarchy Panel 4.7/Plugins/mML6WKMqdxjDGA.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
grger/Anarchy Panel 4.7/Plugins/oYsKwDG.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
grger/Anarchy Panel 4.7/Plugins/rNXXgmX25s.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
grger/Anarchy Panel 4.7/Plugins/sJ88z8tsg5XzK.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
grger/Anarchy Panel 4.7/Plugins/yL9x34D8X3oO2P.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS1.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
grger/Anarchy Panel 4.7/Usrs.p12
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
grger/Anarchy Panel 4.7/bb2.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral26
Sample
grger/Anarchy Panel 4.7/bb2.exe.xml
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
900 seconds
General
- Target grger.7z
- Size 103.0MB
- Sample250226-geqamaspx4
- SHA256 efd21682d800d3dac89b182f18b25efbdb00291cfe4fcb3b05e7c338ec19968e
- MD5 5d5a6847799817434e8cdb7598217705
- SHA1 76a7c0745d3a3321cee2c862b9ec75c8344a2e39
- SHA512 cdd2e38e1292e199a84e8be72f2776536fcdf7dffdb5d757727199abb55e094f3b4db3903bafcad02426f3e61b423def59a3a7a1d1c79bdab09f9a89ea3ddb37
- SSDEEP 786432:lIfvvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj5:KvPU4bZwm/NwEIYj5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Stealerium family
- StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/grger/Anarchy Panel 4.7/Plugins/eMTYbTz0gueNs4.dll family_stormkitty - Stormkitty family
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor static1/unpack001/grger/Anarchy Panel 4.7/bb2.exe net_reactor - Unsigned PE 22 IoCs
Checks for missing Authenticode signature.
resource unpack001/grger/Anarchy Panel 4.7/Anarchy Panel.exe unpack001/grger/Anarchy Panel 4.7/Plugins/0guo3zbo66fqoG.dll unpack001/grger/Anarchy Panel 4.7/Plugins/59Zp7paEHDF7luJ.dll unpack001/grger/Anarchy Panel 4.7/Plugins/CjETR6GpGXqM.dll unpack001/grger/Anarchy Panel 4.7/Plugins/EVa7gBMKoaHmLC.dll unpack001/grger/Anarchy Panel 4.7/Plugins/FBSyChwp.dll unpack001/grger/Anarchy Panel 4.7/Plugins/G3nl0mDcABnDuZ.dll unpack001/grger/Anarchy Panel 4.7/Plugins/KNTmoSnG.dll unpack001/grger/Anarchy Panel 4.7/Plugins/PK0TcnqTGFagQTS.dll unpack001/grger/Anarchy Panel 4.7/Plugins/RssCnLKcGRxj.dll unpack001/grger/Anarchy Panel 4.7/Plugins/WkUP83aP9CABpi.dll unpack001/grger/Anarchy Panel 4.7/Plugins/eMTYbTz0gueNs4.dll unpack001/grger/Anarchy Panel 4.7/Plugins/fzAgyDYa.dll unpack001/grger/Anarchy Panel 4.7/Plugins/mGWHaG2Jn.dll unpack001/grger/Anarchy Panel 4.7/Plugins/mML6WKMqdxjDGA.dll unpack001/grger/Anarchy Panel 4.7/Plugins/oYsKwDG.dll unpack001/grger/Anarchy Panel 4.7/Plugins/rNXXgmX25s.dll unpack001/grger/Anarchy Panel 4.7/Plugins/sJ88z8tsg5XzK.dll unpack001/grger/Anarchy Panel 4.7/Plugins/yL9x34D8X3oO2P.dll unpack001/grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS.dll unpack001/grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS1.dll unpack001/grger/Anarchy Panel 4.7/bb2.exe
File Explorer
-
grger.7z.7z 103.0MB
-
grger/Anarchy Panel 4.7/Anarchy Panel.exe.exe 34.0MB
-
grger/Anarchy Panel 4.7/BackupCertificate.zip.zip 1KB
-
Usrs.p121KB
-
grger/Anarchy Panel 4.7/Plugins/0guo3zbo66fqoG.dll.dll 78KB
-
grger/Anarchy Panel 4.7/Plugins/59Zp7paEHDF7luJ.dll.dll 4.0MB
-
grger/Anarchy Panel 4.7/Plugins/CjETR6GpGXqM.dll.dll 395KB
-
grger/Anarchy Panel 4.7/Plugins/EVa7gBMKoaHmLC.dll.dll 170KB
-
grger/Anarchy Panel 4.7/Plugins/FBSyChwp.dll.dll 170KB
-
grger/Anarchy Panel 4.7/Plugins/G3nl0mDcABnDuZ.dll.dll 177KB
-
grger/Anarchy Panel 4.7/Plugins/KNTmoSnG.dll.dll 670KB
-
grger/Anarchy Panel 4.7/Plugins/PK0TcnqTGFagQTS.dll.dll 174KB
-
grger/Anarchy Panel 4.7/Plugins/RssCnLKcGRxj.dll.dll 181KB
-
grger/Anarchy Panel 4.7/Plugins/WkUP83aP9CABpi.dll.dll 86KB
-
grger/Anarchy Panel 4.7/Plugins/eMTYbTz0gueNs4.dll.dll 1.1MB
-
grger/Anarchy Panel 4.7/Plugins/fzAgyDYa.dll.dll 79KB
-
grger/Anarchy Panel 4.7/Plugins/mGWHaG2Jn.dll.dll 81KB
-
grger/Anarchy Panel 4.7/Plugins/mML6WKMqdxjDGA.dll.dll 173KB
-
grger/Anarchy Panel 4.7/Plugins/oYsKwDG.dll.dll 4.8MB
-
grger/Anarchy Panel 4.7/Plugins/rNXXgmX25s.dll.dll 1.5MB
-
grger/Anarchy Panel 4.7/Plugins/sJ88z8tsg5XzK.dll.dll 172KB
-
grger/Anarchy Panel 4.7/Plugins/yL9x34D8X3oO2P.dll.dll 180KB
-
grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS.dll.dll 106KB
-
grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS1.dll.dll 234KB
-
grger/Anarchy Panel 4.7/Usrs.p121KB
-
grger/Anarchy Panel 4.7/bb2.exe.exe 54.6MB
-
grger/Anarchy Panel 4.7/bb2.exe.config.xml 3KB
grger/Anarchy Panel 4.7/Anarchy Panel.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e3f65457656e1c83c76cf2838bdf6aae294157a4cd7141fdea868b5724a75a2
- MD5 309d8906e1e32e2a0c1db6310da96d73
- SHA1 e6141cbe0a7095260b41553281fc547191398cf4
- SHA512 f207dc50cf5aa452b7fd802087b0569b82bef7ac3110e71186b2c4de2a7bd213e0269dc4b4ca1c0aecddd488d7508515716f731a471e79b31b80ef16b3c81e67
- SSDEEP 12288:hQXqRba8sXrA1gqWVOmw0dKcaJzkVCp4Lkuc+tSV1pH16oG8HCdIfe+:hQXqsi1OOYdKcoA5kp+S/1JGvdIfl
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
749182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Administrator\source\repos\Config\Config\obj\Debug\Config.pdb
mscoree
_CorExeMain
Name
.text
Size
724KB
Virtual Size
723KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/BackupCertificate.zip
- SHA256 ccd0799092fe1e044079faa06fd4a671da251891f8db9690bd129ff9ed136a7c
- MD5 8da0fbaf4f6b8f458035f236ece7b7ca
- SHA1 cc143922fa39226c8b35cbdba0d8d021b188f2ae
- SHA512 25c5bb6dfcc1ca5bf18196e8a79038353c262d6fa562b0b7e559e0937adb29591f377737c4a8cd0516f2508f044f1e8cacff155e158c923cdddd89ed7438fc2a
- MD5 SHA1 SHA512
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Usrs.p12
- SHA256 d6bb01668b946fbf19ab99771d942a96cebcbb98d521722091e17d98925fa2cd
- MD5 2a180e4131ced95c6586902e5c0a471a
- SHA1 dde87d3d927ebc294854fc0f7eaee7a1735fb729
- SHA512 d936e546114af9f1ce6de1163eea8a40f0f8c15c5bd8f91488e72bb2ac541a0920061fef252db6c8b3c12598b5c75e3522b08b6f47d57e1ad3f0f7c060a7c979
- MD5 SHA1 SHA512
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
grger/Anarchy Panel 4.7/Plugins/0guo3zbo66fqoG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9661b1abc9a3e95e591c49c3838a64a066a2ff3c6de08d8aa7b541c4a75cd8e5
- MD5 e4ebcf76ff80ef398d3ab77d577f4c08
- SHA1 cb9e6b30a63d50ae87610f6855b64abfb25691d2
- SHA512 8f37cedd987dd14181fdfa861b8a95271868dac21aa9df80bd6daa831ae20f4b4965c8be3e36f32aa220bd37ded11a7568ae237c9c9641bb4fc087f6fe104b01
- SSDEEP 1536:+gqK9OLThWUkwSOykrJROOwj5vCSnVcnwwxu8NMsuS73O4VKid/:1OBX/xFwj5vCSnSwwjNH3O4xd
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/59Zp7paEHDF7luJ.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5db4c26057a05bb75ff7892fb60fd76620fc2228811d913d152a0aa4ec9db7a5
- MD5 15e3d44d37439f3ac8574ac1c9789ec2
- SHA1 bb3ef30e9f4496198f412738579966210ade36e0
- SHA512 ff358c9896792017ff7e91f1dedffd9d75a099c5b852da19599799aeca20b6b269267ff7c12c918a2530fe1a79a12bc8796c4eb3914c97faba3eba27388abde1
- SSDEEP 24576:L2RBtpr5ljLyeVKbed1BeaPc9oFf/V5V4IeDHRbtg58jVh6zBRkM8eJkhjpSLZFb:L2jXr5ZtVKYzX/LV4k58M8eJkhj
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4206502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Desktop\Hack-List\New Folder\Anarchy-main\Binaries\Release\Plugins\oYsKwDG.pdb
mscoree
_CorDllMain
Name
.text
Size
4.0MB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/CjETR6GpGXqM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 13db80a0211ba9bf59a1e43bdb2fffa91de5c7f38bd469c4824b5e06245a0234
- MD5 b0fc0ba80f8ec9586ff397412c512d9f
- SHA1 0f6051b71b715a47be1fa16683201413905629a3
- SHA512 222a365ae567c6c773ca2b99b82795916839cc5c9ba8eb019bf6713108720c2793303ef6612b64488f4584602cec84c0b48a02fe709db0250bf377d07e002d7d
- SSDEEP 6144:BH8ns56MGHSsdqjJiulCcVWiUpG9kxwrIfUKa:kjjSsAjAuYcVWxpG9ia
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
410506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Desktop\Hack-List\DCRAT\DcRat-main\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
393KB
Virtual Size
393KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/EVa7gBMKoaHmLC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6ea1ae7ab496666c0117fc20e704bfb6104b13cfb0408073a09689f863fa64b1
- MD5 64a3d908b8a5feff2bccfc67f3a67dbd
- SHA1 a17d7e5fa57c99a067cac459cb507b625dac254e
- SHA512 66374d720230799bea6ac6cfe3faadc37fd775a49d40c04facae1caf1ec658956bbda54ba75287d7128b19b97971bd933a64469da8e0884225c5a8d8b9423ccc
- SSDEEP 3072:/bFHKx2Vpgdk6BCNs19kPVoPsb7oR4ZkvEfxMxf4t8BkVb0Uc:/TVpgdkpNs19I6Pe7oR4ZAEfx+LiVb
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
180110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/FBSyChwp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0ea38d0d964815e2b84748a78bd5a829ae01586478e5f17b976f1ae763c8dec3
- MD5 0d41ccfaa8e7ef96248b8270d1a44d08
- SHA1 6ee22bdb91d3a18e0b45b6590eb69bc9a0b02326
- SHA512 a0f236f6dbeb1763fb1c198616de65b907a3a5edf7ed9435c2ad0b5826d84e9d2f25e96aba4e8b681ef495612cf0e04e929427a92d332164ace89e797bcb0e0e
- SSDEEP 3072:OXwOuoHBhyYr+x5IA+1gUtaEKJ8px4e1hkamm9RyxLeN/dIfMU+:awOuYr05T+KUtaEKJ8px4e1RmqRydeNd
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
180174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/G3nl0mDcABnDuZ.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 060d467cbeb0a58696287c052f3dd9b3597331b1c812e3e2882d6c232f8511de
- MD5 97b8bec4c47286e333cc2bedacf7338e
- SHA1 764bbd0307924b71ca89538b42996208d10c9b91
- SHA512 a40970622a594533349e75fc2022314ba21f05fc82709d6eaba82f4a2bc343c960029ad2825cfc034ce82622722127d149993bff88982f02d6dd6b5b1fb60fbf
- SSDEEP 3072:EaEk8xLhWuo2alMFVxzPUBvRNHosrO0/1gRR0foQPssGeWSz89:EaEk8PRo2al0DzPUxvHtrN1gROffPfGl
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
187198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/KNTmoSnG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 300a5551f7be89c5f03c0b70fa7dafb7f84c6394dac68bee95169e985e7786f0
- MD5 738c096a9bc38e21a9aa59ebc356c80d
- SHA1 139756ad201a537461a6bb8524a4b89a63b1b1b9
- SHA512 294c34f0716861fa67ba571bf7a8614613a1746e9f2935ba0c86eb1897dff858ea1f7fb44f1b6ec87cc709f4933a912dcd3eadd5d0b208c72985aa47e1f214f2
- SSDEEP 12288:SMmHl7LUg++x95WlkM9qgrXCEhUhWiUQpTQCyXZj3vlDV+z9BI2NHvfJa1tzh66w:AHl7LUmx902M9qgrXOUQpTQC1m
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
720906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
-?~P}
;z
Size
208KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
458KB
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/PK0TcnqTGFagQTS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 991fc53fa1aa7b5cd0b6e19dab536873d68e4413fd55b533601a3a2582d38a49
- MD5 fa90a2aee0d172000257c4faca31237c
- SHA1 b317281b4acaaf1d7b7255c5e92887322abae892
- SHA512 b05c0b52e011089258ad31dd23a1f8a0cc8145b202e42e2a9d4fdf892c12d4a7b5843cc7721041295ab796e8bc98747b9e321c4e54bfd1a7c9a02dd2796fc405
- SSDEEP 3072:Z60dHpQssTFrcpvZFlOJA3YCVbbME5f8YpIVbltkksqBRbRw:xPsZcpvZFlOJA3VVbbME5f7pIVbTkkZJ
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/RssCnLKcGRxj.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e204d15f0e7269d364157aaab265a5dfbe7e76c9f6202bf90998f0edd77ca248
- MD5 f6808c4fbbe0275db03b2cc5b4c2bc0d
- SHA1 e40b61c64c68f72fc5144f5057d54229babdecf8
- SHA512 f077c49f6943d0e40799b3b42d1e11f50dabca48305c36ef2acd3258c990e0e0f982fbb0c27b1243aa15d2ed7b398b70f07dddc9ba76ff032ba74a24c8e08fb4
- SSDEEP 3072:P1F3B6k7/u/cVnvqtXEIGyv5LBPcwk4V9KIgBH/cNw5/UzUYNv:P1F0kDu/+WX8yhLBPcwk4SIgBH/Yw58P
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
191774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/WkUP83aP9CABpi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a74b74f463d567c1f0505bddcd49ed23700f9ab7dcf4b7f46435723258c5a7e2
- MD5 8dbfb67c059aa59f7c53e20ef6740363
- SHA1 3de96e7f48ee7647f5a7c2efb68cbd914bc78364
- SHA512 70aed01375416e2be63d676bbdba58c12ba5f50d406d1fe252e7a66b901d32e0705007dbf465193de51663174c1b53bdb980890d8b2e6ce641dd16a200e3440d
- SSDEEP 1536:ulBCsewAj5RhvBY/0g/+DP0yUXEVg+g6SAKJMT05eUv:6CsewGdvBsjmwj6g+g6SA+MT05eU
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
> a[@&z
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/eMTYbTz0gueNs4.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 929e5f15e9ceca03c80b2d174283cb25bf47adfe4693f5c01f622416c9f6d03c
- MD5 5dfbcfbbf9e2ae7db23e252808699ffb
- SHA1 a1d429292fe73aeb5abab10304e1ae8c1262b26d
- SHA512 9ee63080781577e0d818a27d026024f96161bb7b132dc0c130fabbe2d6c3b7758868fff5a4ad68efeb4d08f964e2f69417022751880a443f7f920aa4f40f5c09
- SSDEEP 12288:s9StwoSI6P2FNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbS:tZSFPMWOe0jywNMB9ccFd7mZg4
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1166638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Downloads\dcrat_fix-master\dcrat_fix-master\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/fzAgyDYa.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f855353a618af8a53504b5188c05d3a09fb1ff85763e0cd15c53dee82d7c6119
- MD5 a5770798b7a6465f5b5a8c19d7d707ee
- SHA1 ca67e9591d2f757cbbfacb55f27aec6485b10ee6
- SHA512 64da7687e83c6ff4d1c1cdc644ffff53333f745e82f169beb529d55ec5be6f21658d27c6e01744147c00f834978260e86ea627a5f2981f27305afb69a7b467dc
- SSDEEP 768:VARgmh4b8mzujnHzq+pu57BSsdIPn7rDVNS5z4TyEWkZI9aJ+G247U33fEqtHzWT:VogClTToxxeq6ZXwvEqZaXcI
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
> a[@&z
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/mGWHaG2Jn.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2bde0293c982fb6266c683ecaa2c90372d26d9a2786726874a2cfb89dcc68324
- MD5 8f98206f577160f950d456d1190c8d32
- SHA1 defced38fce00775c4616b420fa674d77f946eff
- SHA512 432c2b6759701754616273633c966332e718dbb10a9a7eab0d7c57ffdc9be95b5e1b16b6e291301ac7aa6d1de48a46d30f08729e45d6634b1849f41c78e92d91
- SSDEEP 1536:xDj7e8U5/QWCwxi4ao02nK20TSMErl4D/D:xDj7e9/xxi4ao02nK20TnErl4/
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
> a[@&z
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/mML6WKMqdxjDGA.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 778877431354a9584325dadb663be077f757227eaae8bcad33e4bf26efd6b965
- MD5 e03b206eec8a7efbd1a47909071226e5
- SHA1 21163989ea524920e874bc7932adfcd5e94f854e
- SHA512 831ed74419f1b4c3250fbff20be16ed7058a851d7168a17e8a4dcf284a19412feee42a8c198af34b37571de33a80c48ac855f5d018ea9e2cfdcd846b832155ff
- SSDEEP 3072:5nkYlKsdY6RwiYNF7Bs2GEEg+9D8RZW7iKcnQy/dh1CWMEPrhBSepT/9HxW2Je:5nkrsdYUwiYNF722GEb+uRZWhcQy/71H
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/oYsKwDG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54ec206c8fe8ff27b3fb02ef892b8e6bc4b6abfff2fe08f5f57175c64f1d3220
- MD5 a718955297276f2349b7644447736e08
- SHA1 377388d115b77aff357dcaf92b6aeb6286b1460d
- SHA512 a3c2ded0cdc4e62adac92a569d6cd4db0c3647e663700f019a9de27e738eb2672e5cccec19af15633a3cd25a882452ff5ce39c17f67dc3ed6653b9e0ad063641
- SSDEEP 49152:LOKHt76oI7m3G7WdJh9BUJYzGH1y+Lwo4AeXIGZl4k9uncQZGaV4p5Gi6g:6434edFu
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5005206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ninja\Desktop\Hack-List\New Folder\Anarchy-main\Binaries\Release\Plugins\oYsKwDG.pdb
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/rNXXgmX25s.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b93374fdfd9af786ff20597ae0e242b81373984ba5718194f9e57feb231c52cf
- MD5 050f07b46987eaf152aab521c0112fc4
- SHA1 2d2c0943ce9c10ba09b0d5cca54c2a88a1e61e95
- SHA512 a27c370e40ec126b6b9f3ab7d603378c2b629ec752aa8fc57a10e3ef58c0b701a5d1b4903a17ba180c4e73e76b54304f0868c474eb60e671562d0deed83a18c8
- SSDEEP 24576:Ji2Q9NXw2/wPOjdGxYEfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnq:YTq24GjdGSCw+W7SCRnVQTEQ/BA8
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1581454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/sJ88z8tsg5XzK.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6eaf5744b8ec91312e1c6be83d852627e5204b3b64a1932e60e47438d73fb6bf
- MD5 b3fa2c3d50057ddd2c9579dc0aef1590
- SHA1 88a1f57b9177c95a2e095866574639b09d5f310a
- SHA512 0d1b8288cbc1c206029fe2f9b7366b2f8b49158e4c9643e453111ceb90fd77af903533c64f6ede351755414c9e7daa926704cda6f1953be79e1adc7aff515508
- SSDEEP 3072:8SHb8GZKzU95JXku/dIvjVWE6jZJjnnpnSY1DFb109H:88ZKzU95JXkodIbVWE6jDjnnpnSY1DFZ
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
181966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/yL9x34D8X3oO2P.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e9733277eac197c4eaf40fb0eada0907388222ef21843488a8e591149768301
- MD5 38502e61cc1d39095a12c1883551ad9f
- SHA1 135c9cad9e6d54bf66a1cee5c99ba510102623b0
- SHA512 cd67a63ea954a4db8c8dfadceb2822b447d98c2c43a8f9c6901d0fce3230605a0416395b92caea6ac08348d5f6b0e1cb052b24cf90829602b0a5b0652b8a2600
- SSDEEP 3072:lq4bIABl7xQ6himcU8wzHQzvDk7r1OzArhb6lDWyITJeO9pKb3tO:4LABl7xQ6himx8w7QzvDk7r16whByITO
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e82bf869638f8118f47f3870b1382401e42912cefcc6a9890489af5bb805c7e
- MD5 a267a675b7243d9152c7b8e3e261d64c
- SHA1 9a0277095646e2a773e8a04a7913ce6a56cf05b5
- SHA512 0dae32c0c0fbf6918779a5e9699cbef27572458a5cdc7119298abddb6a597a0017fe33af06c02abe0c66f3cd490f6955bd7c65470ed3e31338d28575306c04bb
- SSDEEP 3072:KIgH2nCuMdPPgwP1euMwUiVD4WUMIoF4unE6r3Ic83C:XgH2nCoSeDzAVUMIoF4unE6rYc83
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
139274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
(8h@
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Plugins/zVvPGvK64uLS1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 98eb518c9785f988ab1dc0752e0ef6d23f171134e60187c621795d6877940f99
- MD5 4f2fb621cbea3cafb7a041c9b3c115a7
- SHA1 137502326e0126f372586d157e51a1416146c3be
- SHA512 22171b9ecf1fc99b7aaf4e73c4d164cedcb503e83021f36a9cec673ff327f83a6c7568e22a7329cc6fc7ef3d6ff79d5dc6c88a8784e58401b884920c5ba2ac9b
- SSDEEP 6144:yMc8IVeK18Kv42lIq94yFwT6J9Kfgn4670g/Pgtb:yFeK18Kgohey2T6J9KfgnX0Ag
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
232KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/Usrs.p12
- SHA256 d6bb01668b946fbf19ab99771d942a96cebcbb98d521722091e17d98925fa2cd
- MD5 2a180e4131ced95c6586902e5c0a471a
- SHA1 dde87d3d927ebc294854fc0f7eaee7a1735fb729
- SHA512 d936e546114af9f1ce6de1163eea8a40f0f8c15c5bd8f91488e72bb2ac541a0920061fef252db6c8b3c12598b5c75e3522b08b6f47d57e1ad3f0f7c060a7c979
- MD5 SHA1 SHA512
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
grger/Anarchy Panel 4.7/bb2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 50c2dba1d961e09cb8df397b71bd3b6a32d0ee6dbe886e7309305dc4ba968f94
- MD5 94bac1a0cc0dbac256f0d3b4c90648c2
- SHA1 4abcb8a31881e88322f6a37cbb24a14a80c6eef2
- SHA512 30ecee38d5d641abaf73e09a23c614cb3b8b84aa1f8ff1818e92c1f2b51bf6841d3e51564aecb5efd01a3d98db88f0938e7dd4ee9c74ca5477785c33c969ffd9
- SSDEEP 786432:RvcKHU1yll1EcgYwm/7hPo9b9DMs2PTUpRYj:lPU4bZwm/NwEIYj
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57260894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
54.6MB
Virtual Size
54.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
grger/Anarchy Panel 4.7/bb2.exe.config
- SHA256 49648bbe8ec16d572b125fff1f0e7faa19e1e8c315fd2a1055d6206860a960c9
- MD5 3d441f780367944d267e359e4786facd
- SHA1 d3a4ba9ffc555bbc66207dfdaf3b2d569371f7b5
- SHA512 5f17ec093cdce3dbe2cb62fec264b3285aabe7352c1d65ec069ffbc8a17a9b684850fe38c1ffd8b0932199c820881d255c8d1e6000cbbe85587c98e88c9acb90
- MD5 SHA1 SHA512
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.