Liberium Screen Rat 1.8 RCE.rar
- SHA256 3b50e918c45225877473a3592bef1d80962072e4bf4c369d2ab41d543b41c2e7
Password
owlsq
Overview
overview
10Static
static
10Liberium S...CE.rar
windows11-21h2-x64
7Liberium S...MM.dll
windows11-21h2-x64
1Liberium S...on.dll
windows11-21h2-x64
1Liberium S...on.dll
windows11-21h2-x64
1Liberium S...ss.dll
windows11-21h2-x64
1Liberium S...un.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...ra.dll
windows11-21h2-x64
1Liberium S...at.dll
windows11-21h2-x64
1Liberium S...rd.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...os.dll
windows11-21h2-x64
1Liberium S...op.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...un.dll
windows11-21h2-x64
1Liberium S...io.dll
windows11-21h2-x64
1Liberium S...NC.dll
windows11-21h2-x64
1Liberium S...le.dll
windows11-21h2-x64
1Liberium S...or.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...el.dll
windows11-21h2-x64
1Liberium S...er.dll
windows11-21h2-x64
1Liberium S...ap.dll
windows11-21h2-x64
1Liberium S...ne.dll
windows11-21h2-x64
1Liberium S...tc.dll
windows11-21h2-x64
1Liberium S...el.dll
windows11-21h2-x64
1Liberium S...MR.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Liberium Screen Rat 1.8 RCE.rar
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
Liberium Screen Rat 1.8 RCE/NAudio.WinMM.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Liberium Screen Rat 1.8 RCE/Newtonsoft.Json.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Action.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
Liberium Screen Rat 1.8 RCE/Plugin/AntiProcess.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
Liberium Screen Rat 1.8 RCE/Plugin/AutoRun.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
Liberium Screen Rat 1.8 RCE/Plugin/BotKiller.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
Liberium Screen Rat 1.8 RCE/Plugin/BotSpeaker.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Camera.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Chat.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Clipboard.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Clipper.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
Liberium Screen Rat 1.8 RCE/Plugin/DDos.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Desktop.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
Liberium Screen Rat 1.8 RCE/Plugin/DeviceManager.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Explorer.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
Liberium Screen Rat 1.8 RCE/Plugin/FileSearcher.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Fun.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
Liberium Screen Rat 1.8 RCE/Plugin/FunAudio.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
Liberium Screen Rat 1.8 RCE/Plugin/HVNC.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
Liberium Screen Rat 1.8 RCE/Plugin/HostsFile.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Injector.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
Liberium Screen Rat 1.8 RCE/Plugin/KeyLogger.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerPanel.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerRemover.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Map.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
Liberium Screen Rat 1.8 RCE/Plugin/Microphone.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
Liberium Screen Rat 1.8 RCE/Plugin/MinerEtc.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
Liberium Screen Rat 1.8 RCE/Plugin/MinerRigel.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
Liberium Screen Rat 1.8 RCE/Plugin/MinerXMR.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
General
- Target Liberium Screen Rat 1.8 RCE.rar
- Size 75.0MB
- Sample260522-rb3rnafw4x
- SHA256 3b50e918c45225877473a3592bef1d80962072e4bf4c369d2ab41d543b41c2e7
- MD5 2988e1853262772057c27a7e9b562ccc
- SHA1 7a7dea599890b698b27dbcd6d23b219cf5794a6d
- SHA512 b20d0aa3ebf0b5f9c6c3496970c21021adc614f5c15b2c28ccfe8de87edece78f33be4dc8767b11bc15b97f497e47131627063a9f55c3a5ead8279e3cb59cb4c
- SSDEEP 1572864:kUGaP//xXp/8aMF6J7syV35i/aJcJUWPsZfxxfdC+XS+f:tXZlAA35i/sFRfdLJf
- TLSH T14508333D1F059FFBCCF09819514EEDD271EBD58C45867B992AF98640185820CAB3E3BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
- Family: XoriumStealer
XoriumStealer is an information stealer written in C#.
- Detects Dracula aka Samurai Stealer payload 1 IoCs
resource yara_rule static1/unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Stealer1.dll family_dracula_stealer - Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/Liberium Screen Rat 1.8 RCE/Stub/Client — копия.exe family_sheetrat_v1 static1/unpack001/Liberium Screen Rat 1.8 RCE/Stub/Client.exe family_sheetrat_v1 - Detects XoriumStealer payload 1 IoCs
resource yara_rule static1/unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Stealer2.dll family_xorium_stealer - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Liberium Screen Rat 1.8 RCE/Scripts/sigthief.exe pyinstaller - Insecure Codesign Algorithm 3 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Liberium Screen Rat 1.8 RCE/System.Data.SQLite.dll unpack001/Liberium Screen Rat 1.8 RCE/x64/SQLite.Interop.dll unpack001/Liberium Screen Rat 1.8 RCE/x86/SQLite.Interop.dll - Unsigned PE 74 IoCs
Checks for missing Authenticode signature.
resource unpack001/Liberium Screen Rat 1.8 RCE/GMap.NET.Core.dll unpack001/Liberium Screen Rat 1.8 RCE/GMap.NET.WindowsForms.dll unpack001/Liberium Screen Rat 1.8 RCE/IconExtractor.dll unpack001/Liberium Screen Rat 1.8 RCE/Leb128.dll unpack001/Liberium Screen Rat 1.8 RCE/MaterialSkin.dll unpack001/Liberium Screen Rat 1.8 RCE/NAudio.Core.dll unpack001/Liberium Screen Rat 1.8 RCE/NAudio.WinForms.dll unpack001/Liberium Screen Rat 1.8 RCE/NAudio.WinMM.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Action.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/AntiProcess.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/AutoRun.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/BotKiller.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/BotSpeaker.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Camera.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Chat.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Clipboard.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Clipper.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/DDos.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Desktop.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/DeviceManager.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Explorer.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/FileSearcher.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Fun.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/FunAudio.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/HVNC.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/HostsFile.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Injector.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/KeyLogger.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerPanel.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerRemover.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Map.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Microphone.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/MinerEtc.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/MinerRigel.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/MinerXMR.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Netstat.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Notepad.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Performance.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Process.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Programs.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Regedit.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/ReportWindow.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/ReverseProxy.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/ReverseProxyR.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/SendFile.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Service.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Shell.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Stealer1.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Stealer2.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/StealthSaver.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/SysPlug.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/SystemSound.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/UAC.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Volume.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Window.dll unpack001/Liberium Screen Rat 1.8 RCE/Plugin/Worm.dll unpack001/Liberium Screen Rat 1.8 RCE/RjControls.dll unpack001/Liberium Screen Rat 1.8 RCE/Scripts/sigthief.exe unpack001/Liberium Screen Rat 1.8 RCE/Server.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/Client — копия.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/Client.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/Dropper.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/Joiner.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/KeyLogger.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/LockerStub.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/LockerStubBuild.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/UserMode.obf.dll unpack001/Liberium Screen Rat 1.8 RCE/Stub/Winlocker.exe unpack001/Liberium Screen Rat 1.8 RCE/Stub/WinlockerBulid.exe unpack001/Liberium Screen Rat 1.8 RCE/Tools/SorterNewLogs/SorterNewLogs.exe unpack001/Liberium Screen Rat 1.8 RCE/Vestris.ResourceLib.dll unpack001/Liberium Screen Rat 1.8 RCE/WinFormAnimation.dll unpack001/Liberium Screen Rat 1.8 RCE/cGeoIp.dll unpack001/Liberium Screen Rat 1.8 RCE/dnlib.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Liberium Screen Rat 1.8 RCE/Newtonsoft.Json.dll
File Explorer
-
Liberium Screen Rat 1.8 RCE.rar.rar 75.0MB
-
Liberium Screen Rat 1.8 RCE/BouncyCastle.Cryptography.dll.dll 4.4MB
-
Liberium Screen Rat 1.8 RCE/FunAudio/PikaBybyChi.wav1.4MB
-
Liberium Screen Rat 1.8 RCE/FunAudio/allahy_akbar.wav684KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/bass.wav594KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/connect.wav449KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/death.wav169KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/disconnect.wav417KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/discord_call.wav967KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/discord_disconnect.wav200KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/discord_message.wav82KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/door_1.wav265KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/door_2.wav209KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/error.wav171KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/girl bass_bust.wav245KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/girl.wav171KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/go go go.wav2.9MB
-
Liberium Screen Rat 1.8 RCE/FunAudio/hello.wav128KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/notification.wav568KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/omlet.wav959KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/orgazm.wav544KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/pocman.wav896KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/scp.wav1.7MB
-
Liberium Screen Rat 1.8 RCE/FunAudio/skype_call.wav1.2MB
-
Liberium Screen Rat 1.8 RCE/FunAudio/skype_disconnect.wav517KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/skype_message.wav156KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/telegram_message.wav344KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/terrorist_win.wav400KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/traxnyt.wav54.5MB
-
Liberium Screen Rat 1.8 RCE/FunAudio/viber_message.wav265KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/vk_message.wav400KB
-
Liberium Screen Rat 1.8 RCE/FunAudio/women.wav1.3MB
-
Liberium Screen Rat 1.8 RCE/GMap.NET.Core.dll.dll 304KB
-
Liberium Screen Rat 1.8 RCE/GMap.NET.WindowsForms.dll.dll 154KB
-
Liberium Screen Rat 1.8 RCE/IconExtractor.dll.dll 10KB
-
Liberium Screen Rat 1.8 RCE/Leb128.dll.dll 7KB
-
Liberium Screen Rat 1.8 RCE/MaterialSkin.dll.dll 6.4MB
-
Liberium Screen Rat 1.8 RCE/Microsoft.Bcl.AsyncInterfaces.dll.dll 25KB
-
Liberium Screen Rat 1.8 RCE/Microsoft.Win32.Registry.dll.dll 22KB
-
Liberium Screen Rat 1.8 RCE/NAudio.Core.dll.dll 183KB
-
Liberium Screen Rat 1.8 RCE/NAudio.WinForms.dll.dll 40KB
-
Liberium Screen Rat 1.8 RCE/NAudio.WinMM.dll.dll 56KB
-
Liberium Screen Rat 1.8 RCE/Newtonsoft.Json.dll.dll 695KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Action.dll.dll .ps1 34KB
-
Liberium Screen Rat 1.8 RCE/Plugin/AntiProcess.dll.dll 14KB
-
Liberium Screen Rat 1.8 RCE/Plugin/AutoRun.dll.dll 357KB
-
Liberium Screen Rat 1.8 RCE/Plugin/BotKiller.dll.dll 30KB
-
Liberium Screen Rat 1.8 RCE/Plugin/BotSpeaker.dll.dll 14KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Camera.dll.dll 98KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Chat.dll.dll 47KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Clipboard.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Clipper.dll.dll 15KB
-
Liberium Screen Rat 1.8 RCE/Plugin/DDos.dll.dll 113KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Desktop.dll.dll 778KB
-
Liberium Screen Rat 1.8 RCE/Plugin/DeviceManager.dll.dll 14KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Explorer.dll.dll 499KB
-
Liberium Screen Rat 1.8 RCE/Plugin/FileSearcher.dll.dll 15KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Fun.dll.dll 48KB
-
Liberium Screen Rat 1.8 RCE/Plugin/FunAudio.dll.dll 17KB
-
Liberium Screen Rat 1.8 RCE/Plugin/HVNC.dll.dll 38KB
-
Liberium Screen Rat 1.8 RCE/Plugin/HostsFile.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Injector.dll.dll 50KB
-
Liberium Screen Rat 1.8 RCE/Plugin/KeyLogger.dll.dll 17KB
-
Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerPanel.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerRemover.dll.dll 6KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Map.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Microphone.dll.dll 509KB
-
Liberium Screen Rat 1.8 RCE/Plugin/MinerEtc.dll.dll 24KB
-
Liberium Screen Rat 1.8 RCE/Plugin/MinerRigel.dll.dll 21KB
-
Liberium Screen Rat 1.8 RCE/Plugin/MinerXMR.dll.dll 26KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Netstat.dll.dll 18KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Notepad.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Performance.dll.dll 15KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Process.dll.dll 16KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Programs.dll.dll 17KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Regedit.dll.dll 39KB
-
Liberium Screen Rat 1.8 RCE/Plugin/ReportWindow.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/ReverseProxy.dll.dll 15KB
-
Liberium Screen Rat 1.8 RCE/Plugin/ReverseProxyR.dll.dll 15KB
-
Liberium Screen Rat 1.8 RCE/Plugin/SendFile.dll.dll 24KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Service.dll.dll 14KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Shell.dll.dll 16KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Stealer1.dll.dll 145KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Stealer2.dll.dll 258KB
-
Liberium Screen Rat 1.8 RCE/Plugin/StealthSaver.dll.dll 15KB
-
Liberium Screen Rat 1.8 RCE/Plugin/SysPlug.dll.dll 13KB
-
Liberium Screen Rat 1.8 RCE/Plugin/SystemSound.dll.dll 507KB
-
Liberium Screen Rat 1.8 RCE/Plugin/UAC.dll.dll 28KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Volume.dll.dll 502KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Window.dll.dll 16KB
-
Liberium Screen Rat 1.8 RCE/Plugin/Worm.dll.dll 3.0MB
-
Liberium Screen Rat 1.8 RCE/RjControls.dll.dll 31KB
-
Liberium Screen Rat 1.8 RCE/Scripts/sigthief.exe.exe 6.4MB
-
Liberium Screen Rat 1.8 RCE/Server.exe.exe 10.3MB
-
Liberium Screen Rat 1.8 RCE/Server.exe.config.xml 2KB
-
Liberium Screen Rat 1.8 RCE/Server.pdb326KB
-
Liberium Screen Rat 1.8 RCE/ServerCertificate.p124KB
-
Liberium Screen Rat 1.8 RCE/Signatures/Exodus.exe_sig4KB
-
Liberium Screen Rat 1.8 RCE/Signatures/FL64.exe_sig7KB
-
Liberium Screen Rat 1.8 RCE/Signatures/MarketApp.exe_sig25KB
-
Liberium Screen Rat 1.8 RCE/Signatures/NVIDIA GeForce Experience.exe_sig9KB
-
Liberium Screen Rat 1.8 RCE/Signatures/NordVPN.exe_sig14KB
-
Liberium Screen Rat 1.8 RCE/Signatures/RGBFusion.exe_sig8KB
-
Liberium Screen Rat 1.8 RCE/Signatures/TLauncher.exe_sig17KB
-
Liberium Screen Rat 1.8 RCE/Signatures/TOTALCMD64.EXE_sig10KB
-
Liberium Screen Rat 1.8 RCE/Signatures/Update.exe_sig19KB
-
Liberium Screen Rat 1.8 RCE/Signatures/Wireshark.exe_sig8KB
-
Liberium Screen Rat 1.8 RCE/Signatures/brave.exe_sig10KB
-
Liberium Screen Rat 1.8 RCE/Signatures/chrome.exe_sig10KB
-
Liberium Screen Rat 1.8 RCE/Signatures/clion64.exe_sig11KB
-
Liberium Screen Rat 1.8 RCE/Signatures/firefox.exe_sig10KB
-
Liberium Screen Rat 1.8 RCE/Signatures/iVMS-4200.Framework.C.exe_sig21KB
-
Liberium Screen Rat 1.8 RCE/Signatures/idea64.exe_sig11KB
-
Liberium Screen Rat 1.8 RCE/Signatures/logi_crashpad_handler.exe_sig10KB
-
Liberium Screen Rat 1.8 RCE/Signatures/obs64.exe_sig9KB
-
Liberium Screen Rat 1.8 RCE/Signatures/phpstorm64.exe_sig11KB
-
Liberium Screen Rat 1.8 RCE/Signatures/rufus-3.21p.exe_sig9KB
-
Liberium Screen Rat 1.8 RCE/Signatures/steam.exe_sig11KB
-
Liberium Screen Rat 1.8 RCE/Stub/Client — копия.exe.exe 47KB
-
Liberium Screen Rat 1.8 RCE/Stub/Client.exe.exe 47KB
-
Liberium Screen Rat 1.8 RCE/Stub/Dropper.exe.exe 9KB
-
Liberium Screen Rat 1.8 RCE/Stub/Joiner.exe.exe 9KB
-
Liberium Screen Rat 1.8 RCE/Stub/KeyLogger.exe.exe 11KB
-
Liberium Screen Rat 1.8 RCE/Stub/LockerStub.exe.exe 216KB
-
Liberium Screen Rat 1.8 RCE/Stub/LockerStubBuild.exe.exe 214KB
-
Liberium Screen Rat 1.8 RCE/Stub/UserMode.obf.dll.dll 136KB
-
Liberium Screen Rat 1.8 RCE/Stub/Winlocker.exe.exe 30KB
-
Liberium Screen Rat 1.8 RCE/Stub/WinlockerBulid.exe.exe 30KB
-
Liberium Screen Rat 1.8 RCE/System.Buffers.dll.dll 23KB
-
Liberium Screen Rat 1.8 RCE/System.Data.SQLite.dll.dll 384KB
-
Liberium Screen Rat 1.8 RCE/System.IO.Pipelines.dll.dll 82KB
-
Liberium Screen Rat 1.8 RCE/System.Memory.dll.dll 141KB
-
Liberium Screen Rat 1.8 RCE/System.Numerics.Vectors.dll.dll 107KB
-
Liberium Screen Rat 1.8 RCE/System.Runtime.CompilerServices.Unsafe.dll.dll 18KB
-
Liberium Screen Rat 1.8 RCE/System.Text.Encodings.Web.dll.dll 77KB
-
Liberium Screen Rat 1.8 RCE/System.Text.Json.dll.dll 709KB
-
Liberium Screen Rat 1.8 RCE/System.Threading.Tasks.Extensions.dll.dll 25KB
-
Liberium Screen Rat 1.8 RCE/System.ValueTuple.dll.dll 24KB
-
Liberium Screen Rat 1.8 RCE/Tools/SorterNewLogs/SorterNewLogs.exe.exe 9KB
-
Liberium Screen Rat 1.8 RCE/Tools/SorterNewLogs/SorterNewLogs.exe.config.xml 186B
-
Liberium Screen Rat 1.8 RCE/Vestris.ResourceLib.dll.dll 78KB
-
Liberium Screen Rat 1.8 RCE/WinFormAnimation.dll.dll 37KB
-
Liberium Screen Rat 1.8 RCE/cGeoIp.dll.dll 2.3MB
-
Liberium Screen Rat 1.8 RCE/dnlib.dll.dll 1.1MB
-
Liberium Screen Rat 1.8 RCE/local/Bulider.json1KB
-
Liberium Screen Rat 1.8 RCE/local/Settings.json169B
-
Liberium Screen Rat 1.8 RCE/local/Tasks.json2B
-
Liberium Screen Rat 1.8 RCE/local/temp.ico170KB
-
Liberium Screen Rat 1.8 RCE/x64/SQLite.Interop.dll.dll 1.7MB
-
Liberium Screen Rat 1.8 RCE/x86/SQLite.Interop.dll.dll 1.3MB
Liberium Screen Rat 1.8 RCE/BouncyCastle.Cryptography.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3d7ced058d7264036323f8cfd87d3203761b5fe45dfddf1ebce069c1e36b81b8
- MD5 a61bc1b4b86e564eadadd005fc7a8516
- SHA1 b272809b5b4d63e4be937ebca81400cd1d357599
- SHA512 75a7d97f904724144b90be9fb041afc480d531f018470505190ba71412853a04b418582e6aef227c206237e251f2e98b86ad141d2c2ecd1538f1894f0b1fb5d0
- SSDEEP 98304:dMckWvzAsUohBJPQdtBuEoSqVCb4rABp+:NL8dHEC+AP+
- TLSH T133269F0577F81E32E26FC3B395B19022A7F1E4AB7363EB1B6580A6A65C53B505C413B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
owlsq
Digest
0d:17:a4:f8:43:12:ec:51:f1:ce:c8:bc:0c:dd:6d:d1:4c:b3:a0:12:38:61:fe:7f:61:41:e1:16:ff:6e:a2:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU
Chains
Feb 7, 2025
CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Legion of the Bouncy Castle Inc.,O=Legion of the Bouncy Castle Inc.,ST=Victoria,C=AU
Serial Number
26:bf:b3:8b:b9:c8:9b:6c:b9:2e:af:50:64:9e:e2:68
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 14, 2022 - Nov 13, 2025
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
3312534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/crypto/src/obj/Publish/net461/BouncyCastle.Cryptography.pdb
mscoree
_CorDllMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/FunAudio/PikaBybyChi.wav
- SHA256 c76351644301a742a54f58033d809a47410bd1f3d6ca48036fddec917a451d0c
- MD5 d1bb10f64f7610795067ee6791e47fb0
- SHA1 101cde1da64edcf32531cad6613253163945c58e
- SHA512 9b70e3cee7e128f6f65018fe0cc5746285c7d1a6cae277e7d5b6404301590aedd4e1d8fcd67daead2a7074937414fcce8ad4c04a44f17bc4fff95ae5ed036ef3
- SSDEEP 24576:aznUlEy31I1ELSpyaY3/zuSBwuo5qbSrQmbAJX28tcMycjx9zWUs:wUlEyl1LSp6zh2EbmAkUcMykxls
- TLSH T14D652396B172F304F83E9635E5C0DE5801A5B98618178EDF701DDAC2D623742BE386AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/allahy_akbar.wav
- SHA256 0d67c723865e7c8e9971ac77f970a7e78467db6db8ed83323a223a75790585f5
- MD5 a8b3191f0b625bcd14a90c9a3de835d9
- SHA1 e25a26a5396181edee36b4f25cfa9a566b571a7a
- SHA512 fed458d8d4d5466e10f33d8bc6e600c5f60e797fb981d3d513f5f170b54df2423d49e8517b4b70add06e86af46fa83d6cecb5c843f65bbf2ef26635ecc2b770d
- SSDEEP 12288:kiojldD1C0K4YVpcYDk3LWjgX+8ojNDYDoPh9V0KKXY/3EEKwWZZCQG0Bagj:kiojTIcqMX+VDuoV4X4/0G09
- TLSH T1D2E4D0E3F0474C20CC861A7ED9B36E7112713C39BD69592E604C7D566AB3382A3B5BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/bass.wav
- SHA256 caff4795bd187298d8a5616fa67a635fb826c206d3d30491fdf45800ed9cfb6f
- MD5 0ef09403eebda524c728211de6de0c3e
- SHA1 175f7d059fe4a3585dcd3fb6e1e3b6fd40987dc4
- SHA512 7d2b951d1f038b73f55153aa1d70ad9287f34e4771ec96123a1d4fe417311552328f2d06204fb38316547fad03d32711afe2bafdff53ca2668ea97e13ced879a
- SSDEEP 12288:1gCGqncUXTn6MXKUF6NB3wBTbXgOrlHtJ/Z4Z7/WWXf:1gCGZM+kBTUQ7aTXf
- TLSH T1E5D42342E241DA5FF928BD715CE12CFC83AA5D631E42C3A71B56741F19F6EE6A01880C
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/connect.wav
- SHA256 b3197e8d529a623b6066268a0a598285acd59dc6ec80f4cbb121a6dd893ebc51
- MD5 5183ebe30a762761f99b960c80a94ae5
- SHA1 04482f073d49c47a47fe3e3b35f1e3661c541a72
- SHA512 9058ce0aa51cacc37c698ac36a41119538aaff23d86ebf8dbe73256cd7c5293e0aa2ac352bf3dab8a34a62bbb37c58d9793fb250e4a28789f863b2ddc7418a0c
- SSDEEP 3072:Oo0tNWiH4DQ18c+pmTheuYUIutTzqj5Du8YPas5Xd9duZWus0IGoEY9R/8ECPES:v0yK4DQ18HgTwvwTzQDlCjbAoFeZS8
- TLSH T148A48481F240DE81C4162E794566DBF953377E59FF4BA7223040FB2B3DB25C26A692C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/death.wav
- SHA256 26df48d270651081d17b35989e073a53a3e8ec99ac232af31128425b7db678be
- MD5 e6682c0e9272bd631c70f101cef7258e
- SHA1 217501b17aae8b12bcb67a32f09c8f6a6339c4a0
- SHA512 9a6e847bce3fa73c0a6db13246356205cbc174fb7ab93387dc203189c9b56cfea9810da6b93e5638127092a2c45c48a75f95899d68fd648878fa7c143f2b9ff8
- SSDEEP 3072:aXmc1sxs/hIT9d1bMWtlxwzKT3vFQwORZl8ActHf:aWFQITNbMcl53HORZNc9
- TLSH T1DF04C053B152D114ED2B8E73CE92F1442724762BBF66250F3140BF0ED9B3582DA8B9AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/disconnect.wav
- SHA256 6a9d42ae705956b0d9a6ef2aaf5a61c92452bd160a8d8bf4878898d8f42edde5
- MD5 7e236195fbde209f01d36890052ade99
- SHA1 a5686486fa114a9c505d814a38c7703bbf17c15a
- SHA512 1da792711016baa5c026b680fbe42eaa0a4269cc0bf32a003d828a84158b7c62f2585fb665455e37fa997f1df57629cd556bdb97495e541b6a88ebec312bc80b
- SSDEEP 3072:3r5A/bQa1eX3TzReEgxiwpkXgI58kXIyG9Ql/FQHjDvlJdb1aHl0m01Feh0gwp:VA/bQ4Q3TgECNI58Xvpb8Sm6n
- TLSH T1F0945A82B701DA51C495593AD956DBE65322FC9AEF03932330E8FF2F3CE24835E55289
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/discord_call.wav
- SHA256 567f5181c55f049718696c7036c461d63a5c2371bcdd2fdfd20e624a71c60de7
- MD5 899429f058818e3b711272f952140c27
- SHA1 a1fcdd78844c318468527eeca653cb3bda6493a4
- SHA512 90780801be2a29b963a0c6f6cc8f9decb63450923234cbaa1265b561d919bc8329824771a0c2bb74d2c1976ee579169ebc0e7bc22eea200374777a75aeef2506
- SSDEEP 24576:7L31D6+Oa6ji7TL2IJI35FwE0mQzDLR+LyJNx:7L3d6+Oa+BR5FwE0mQz/R+LyJ
- TLSH T17525016EF273B340D9ED8531E980CF6C2310B55659138C7AB07DDB96B1227833DA5A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/discord_disconnect.wav
- SHA256 28438681cd1e852ac9b8c60fc4ac0821c692756d1a109ca75433d4c4a49888bf
- MD5 f461065cb4323a344213f081dc729692
- SHA1 79c5fe036f9e355c60805777bc26ba149239b270
- SHA512 0b578b69f2fb7b236b9c6b2e745f5c157a43f6e1a674de507773bfe94076adfc2db909abc1a39a74812b14252dab64e0e65d8bde4f9882244f2ea9ab684f4e0c
- SSDEEP 3072:3DzU7nKcsKCf8e/3+YQ8ShuDpPPXdwvp76UO0Jh:Tz+KcRc8u3GbQFdwvpeUO0J
- TLSH T126146B81F300DA80C4466A3A9156DBF903367D5AAF46A76730B4FF1B3DB24836E691C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/discord_message.wav
- SHA256 b46b568f25d545c75185a1d6f4f9a47a940f8eabb7d8baf741f4e45f0424e02d
- MD5 c6a6a4645b72b5846d70103085de473d
- SHA1 670b559d782454af903a6bac82dfedd2d0f05a4a
- SHA512 6930208bbed89cce0ab4b27142afb1ca8d29116af03f317345cdbc9656565ca1bb0f452de9843d86093f4c01db6137445fcfbedb6980faef2d69e5217cca0f9d
- SSDEEP 1536:RyBdrCi06NKqlEVCyFJja+ODM95coEh3P:6dGP6LlEVzFJjp96oQP
- TLSH T1DE832682F701D641C496A5369D42CBE84325FCAAEE42171730EAFF1F7DBA1836E13285
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/door_1.wav
- SHA256 2832279657376379e3f746869c1716e6b033d61873de22ee86783e8232caf262
- MD5 5b6f957cbd618138f25f54ae97475c10
- SHA1 cfddeedeb1e5e2c7249800880aca0ecfed82774e
- SHA512 2cba058322f0857c0baa12be35d574589b4cec3b972d2930563b741b1b5d0727a006c8f653a839a059e9c3bca3095f37d60ac2dcd79e7f5334451129cfe96beb
- SSDEEP 6144:lmYijMwustTR6wIIkrZ/LHWyv8q1+OObO:lm0jcTR6rDHWLqsV
- TLSH T1AA44C016F293E384C0DD943BC946C6D54322768B9F039B7B3078E767B8A1043BE5AA5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/door_2.wav
- SHA256 27eb22cee79d67f026be0598feee043e2861f7b77a04e56815323eea94aeef0b
- MD5 1384aee4ddb73226e3a11578102a3776
- SHA1 712876c3aa0bb3db555038fb1820d061d8076a61
- SHA512 6f21f88211f14c83dcf45bb58b4946213532c0cca63121532dc77f88f97f25949c4732e26fdc7d904e0aa1213cc64d08da4d61f9d2b1ac3e52b14e0322687f02
- SSDEEP 6144:AQUaNJ0JPO2fOHxzuBf1vbIoEVfB5CijQt3v2fm:fNJSfwaBf1UowB5C4v+
- TLSH T153246A90F222EA04C8466E359666DFF853366D52EF07AB633100FB1B7D326C23E655C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/error.wav
- SHA256 8e1348be4275c1bca08bae5b4378800b5d742c83a29415c06bbfd55361236479
- MD5 e3c60cda4a08373f4db5c66ddcc8f681
- SHA1 8f164b8bc9b5735bbab8fc02dc45f07af669f121
- SHA512 08c1783b1f630de8236b96eb327eb5e32ad2a0b5fc32139cb6a3abab4dee40ca2022a6b37db03df2f30856282970487dd35d09494cdc5b37103ffbbe8271611c
- SSDEEP 3072:DpCRIny2Zv7lJGjgj/6LUUDbDDjffAqPaLE/ME54KPhAbXEN:1CRInVtRUj0/6LUUrQqCLEZDPy4
- TLSH T1F404BF63F8838402DA8B4E7ADDA2FF6005B27D25FF16871B3044BB095EB73C13962596
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/girl bass_bust.wav
- SHA256 399bd31f4def80781e6932e6f137dc9c56ec06269ccc499e64bd89dea8af79d5
- MD5 4a7edb77bb0f1d59352ae35e7ccfa290
- SHA1 97958b09dae3a07da380dab364a8dbb2b0d615c5
- SHA512 86dfc1c66a08eb6582ff16444153f49efe68b447eaf24c697db31164d7f95b861cf918126479a5057bd72d07f6da11d9d9d0463decc801016814466ca00cc603
- SSDEEP 1536:IkrAwgWEflzb3VN7B/EMYMTPpN3P07snmR0vXMoZXrAjWPHiEP/r/LzLff:DAf97B/VW+ZXEjk
- TLSH T1CB34CDD3F5418911CC1A0E3A8933AF7642376D36BF5F971630887A1A6FB32C25B256D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/girl.wav
- SHA256 d88e527b489758ad7d8f9d1ecebe0916a4989d079d5a2de373fdd4e2c4fe6bab
- MD5 aebec63d8673ed8dd9785ebdefae87c4
- SHA1 7db34810a5f614d6f12f458a709fdb192a7d17ff
- SHA512 aea3a0894ff6d77cf68d6dc892e39aeff91969216e4d283abf7b7c9efcd32f50fdffcc01b7a17afe131c6703a8436d24aafce28b1ce6bb800e7eedb2cc936d17
- SSDEEP 3072:arZRXJERzEf2wLGZRq4TEWkEHEJVnEgADTgUk0MVp33AabsT33N5/b8K4M:8jJAYLDBHES0EXHA7JqdM
- TLSH T108043B93F04449125C5F8A26CD73EA204761362FFF7D251D2088FE18A6D7346DBAED2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/go go go.wav
- SHA256 9f571b141bd271a37a2557999efe0bf5c5d22fd92fb7e7c1c31fc3cb93467dd4
- MD5 acd774a2f85387bfc4cab3065de5804b
- SHA1 783fa222f859d1f54d9d146c1bb5ad2a715e2ac1
- SHA512 531497bdca055af731e99f4b373bb063373c4e2e911a3f4983e3330bb34e23c1b450da302fe8ebfa4bade7bf49981fad2274d9ffcde4a8ad009564144e20bd8f
- SSDEEP 49152:xmx1211JiLBXk3RqYKygjiuq6U62vNbSu7bqnQFR/hDDADyhbttxg6TlojJ6XENF:xmC1TiLB03RqYKyUqNaufNFRhDD+yhbl
- TLSH T145E5AD81B241E540C8996D3ACE55DDF803237E86FE0AF6273864BB5F36730C36D6568A
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/hello.wav
- SHA256 cf7eaa4320a3ce1d40ec9f651c0a6e4f56cbbbb60882c33f20b4f68ad16cabc8
- MD5 41c0bba5e64279ed884fa9e870621b0d
- SHA1 0973388f5e4849e40f2f4389be4a81936b72c488
- SHA512 218b1f5fb2288860f503bc236c8f635f9dafd24956788e38a7eca2d86d9a095a1387f7bbfbce5e69c7f68fb230f18a11684b26320f1ac347db731c0acdbbf337
- SSDEEP 3072:e/r1VNxPPBWCX9X0zmUe/mN+1CttXD+ymC+xCVPEF/:2NxPPZX9EZe/r1c6ymC+xGe/
- TLSH T192D3F173C9934250E986E6769FD568847E80B60DFE282A2F314C9D06DB73341F6637B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/notification.wav
- SHA256 1c73cc515fd536eea4f2f70f22f26ea17f15bf68e095920a5f6f3944759f972e
- MD5 94286c49eef706a579e18de18ed7da7a
- SHA1 9e4c844e0bc3e2952a26d7d053ad5bfce45636b7
- SHA512 c97f56f9fa872b0fcfe3bd982bf3b7c343cb58a909589b403e8a42686306a968e87e0ad40272dacd57bc043343f2534c815b3d9e074c1fa12928a6bd30db310e
- SSDEEP 12288:j/sqixr0pU69GNMqzXnWNFhDZg2RGa4TD5n:yxrWU6l+Mv
- TLSH T131C4CF86E166CB86C8DC64369452EEA607166E8BDE034B70307CFB5374F20637E856ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/omlet.wav
- SHA256 7d7781bcc7fb62b9534ad4dea634113736c3f4ed647036ef44b1f0a1fc1a5d33
- MD5 6224f5587a7491debc15dd5574d0429b
- SHA1 7447b9d0e3472d8d2dbba9ef941637f8c4548255
- SHA512 355f7a18661f0c9e9375b2cb478407da98e7af13b136eb9fb07fc4e1a3ad2fbe79d6f34e9bb226c2bb014df15b70d076923d73d45f21975c0e49f2ae7462ca4a
- SSDEEP 12288:6satEC22HE6Bk94oF/loAA970Kkv1hAi9xoK3MnQdp2Hgvup6+3YYrbevb:6ECnk6EmFi1hH/dp2HOuZ3Yacb
- TLSH T16725F141E2337B98C6FA8132AE46DC254B51B46FDE121D7B607AEA1071833437E7276B
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/orgazm.wav
- SHA256 e547a6b7fa272ed15601252f3a4bc1309bd6bd40d6dfbb77a8d5841a360003de
- MD5 3225d4996741c9dd5fda72f7b2ba1ea6
- SHA1 62339277ef934cb44ca1135682e654e5c59b9abf
- SHA512 5eda6d0bedc8f5b522a979abd69241437b71fd0bd9e2bc76c2f3ec2405bd73bf7b00c683e3f317b5939747d30b0b621886f9ecb33ad8366c30616cc674eb83ce
- SSDEEP 12288:+0x33M4scc9q+mNTvcSNnakfAYyQzZMQy8TZCm0fOh/:b38q+S1NnaoV5y8kmEc
- TLSH T1F1C40253F2B35798D53681338DA60C804F86F69E9D115E6F7A09CE56B1C3200EA9B3BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/pocman.wav
- SHA256 e32d65bafca02ce4e2f58912aa13903a3d1f4a9187a7d712907c6c3a4782183b
- MD5 3d9d01b5ac26b8212ecf3140d54ba0cb
- SHA1 b8734ea8d35cd4a8f39a4de0052f1bf06742df6f
- SHA512 7129a278fd832e6a2ba7ecd2cf4eb437f40d887fccfa9b4cd5e73c44c19958ec2bbd58b5367535af902d4c630f4cf1431a361cc48a61ac33377a57a45ed568df
- SSDEEP 12288:Bvjj2v4bbOwgjmwaB8V1vvPdbtM/lN0AnCMYYERnS9UXWPvl0NY:BvjaoOQ1B8V13PUH0gCVgHPv
- TLSH T13115CFE1E883C943EBCBDE79DBE25E1018F26D14ECA8A51E30C87B1452F7744352969B
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/scp.wav
- SHA256 a5c907a6dd28f3feac3d8504306fcd79cfd79ebb983bd5c9c34237a23fb2c1c0
- MD5 7dd5a16b651d009c7513e56ae82f42fe
- SHA1 b1104a46a367ecafcecf4a53dae1ee71290aa917
- SHA512 f2934fd3f9b450ac1044630cdd3b7bc125a8028854efc4c64c20d495ea800ed298706c81995349ce9e31c6711a634081821b1dd95d71ca26b5a0ca0db421b86b
- SSDEEP 24576:VjKsc0R8fulgwOnACc+JjL0nKu60rW5hHHT9Q/ZiQvh80uHxyjl7dpWlMSLi:VxRGE44nqT5Fzi/Rvh80uHMl7df
- TLSH T12F8523AAE562BDC505FC821397C2DC281762F97ADC230C6F7A09CE45B1053527A3AB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/skype_call.wav
- SHA256 6ab61f5f33313d264474caa2cc9ebeca0da9bf51ffea65bb78def16dea24d2ee
- MD5 2b1be30d3a0dde71e6f9e56400c56cdc
- SHA1 97beb7fc3a3875c549b41ad0c63605bd50405304
- SHA512 1eb2869a64d0bdaab92b0dc05c0f71f4be0250e05a6a63ca8ab4c4e65a0f632f3dc232e2ad158f0633953db4358cef11ce4967120ec8717321dbb937a791386e
- SSDEEP 24576:7nurHe/gF4LhDP57iYcMAK98dJKbSTAQPrngCLdrJsnFzS67JN2wx79fsgANS:7ujFF4NDPHA88dJZXnDrJyFzS6Nrx71x
- TLSH T1FE55F1B2D4838A5AE7C7C77BABD26D1408F0E50CD6B4961F34888E5AD2D3B04365E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/skype_disconnect.wav
- SHA256 a1ca9f2001de36f617de00a353943c803abf0309cfd482cf9d23836aaa855874
- MD5 0821866d11318fb24a92eddfeefde5c0
- SHA1 6eed10a68eb26d83289765d68b99ab8faf3b5fc3
- SHA512 152d59f48bdf5f2d128ae9afacd4e793559e1fd8d738a3d09ffd1029c10a9b0e61eaea79b68306f65d8334ca646a4270b973b35a254959cb771f1b3c60f00e47
- SSDEEP 6144:dRt7k4O1xdsmq+mscrHnLwYYxwMRTcAZf6BksTHxIrqHyGNOLgHA2fza9:bm440FscaPZCFCqHkAB8
- TLSH T1A9B47293F0428901CC5A4E3A8D63EB6507327D25FF5A571B30887B0E5EB33C26B65AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/skype_message.wav
- SHA256 688288dfcb199a31d409044aaf98eab0c394ddf5276da6dd3adf2aca2ff180af
- MD5 13323f4d24cee949cb46bc9a2beb132b
- SHA1 1780a152aa9a8e10f80075f9b676a284dc0dcc0d
- SHA512 31e62e256fe8f2c4055aff78b9cddf1e526bc3a12fc64e5f5cde8cc2c536de29f43841d17d7d09fd865ac64e3fbb633eebfa5e0676248581f6b3bb63d5d8dcce
- SSDEEP 3072:1L0IeL9skIJJnAmP0kGBytxRX6L9Xt4Jst+OcmGJdndjxz0:1LdkfmP4Bbt4rOcmk70
- TLSH T1A0F37B12F281E551C026DA33CF9AC6D693277646FF06171F3088E74E7EE34468E97A68
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/telegram_message.wav
- SHA256 df52b0e7117f3ba1cbc05520e2692d0ba886bd5fdb09f2ca46145725d66b828e
- MD5 5e433ffe2d813fbedd8a9903d31e83e8
- SHA1 0a64f9b93d7824e07f76f848d07fc0434b3e1932
- SHA512 fbdbccb625365c91551f2f5b4d35b6257ff765978fc0930107b9cc3423696a4d5c7668240ab7e64e68463a726231b1c68653cb406467a40b198030a85036c226
- SSDEEP 6144:D2jgc+hEw3iTsEbCVdWmacHvlP6VL3LTWAgFcVwZZ4mS6D2t5Ffzz89ESjULaW9d:AT+IsE+VdZFxi3TWAgfZZ476eLL49ESg
- TLSH T10474AFE3E48749520C5B8A26CA73DD214772292FFE26590E3088FE0676D3346B776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/terrorist_win.wav
- SHA256 5fb879ff5cc3c451b300a9b9c877f7f6604da57059ec9464b5bc7f087ec8a53f
- MD5 be84f2540690e8347850147f38d06fb6
- SHA1 2b3a4d8b0b7ab41bfafa1d88d39ac44690f823a1
- SHA512 83483d1ad74c3077f1b2b7631b384ecdfdaa0c67321b865042ca7fe6c24edd008eaac09d193b910d48a2e6819db97b80c88de26b3edbd6914d54c67ffc60de78
- SSDEEP 6144:XbIGFQGsdXvCjfOPtoBlcazsI3wi5ARS2b9WNnAio:XbIpGsqOPil9zsA5L2p6A
- TLSH T1DE94E053E552CA10F9991E778E92AC852B10F40DFF79262F328CAD4AD2F73826641B74
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/traxnyt.wav
- SHA256 dafe3cd5fe133fe17a956a0b6e30f8b08f892fb9af4c491e0b794a0018616df9
- MD5 9c3917b6acfa06a8c3f46080abb5293e
- SHA1 f0c20565766b5e31eb46f0f101fef1bafef8cb15
- SHA512 8c3fd7f490202d739766af232a1edc2cee515ae47cd85cd1e1d9c2725e4b5fe39e742f82ae1eb5bac4cd2f6a26641de6633f7a246e6d6cc0515b19d1f10750ad
- SSDEEP 1572864:SaMyvf5elplJmdrNlakOPHmxcVN624hm1/A+YUAbE1pFjqA8evW:SaMCelnJmdRUkOPHmxcf6fmRA+YUlpYv
- TLSH T14DC7E15BF332A354EBF986269DC18C082A44FD1E1D118D7BE13BC682B1222277D577AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/viber_message.wav
- SHA256 0e5a5416501d4b3a263d70f5699fa93a5f324f819304836616097ecf1c627cb3
- MD5 da764114716dc0ed5eaa80a8b7f435ba
- SHA1 e67f31cb138dad62920bc04ff3b538b8c05bbb11
- SHA512 bfbcb65aa7713349b860326b4896df8f6a98764649ee6542a1ee6512b5d983f280a51428addb1c178701db08a5296b0b23babebe6dd2d62d007dd8cb816929ad
- SSDEEP 3072:i8bm2p61myaCF7qVWuKAiIEtTFYKNgpMSsAmU9YkjEEj2rwCQfBCxy10:VbmO6bTE9niIEtJ5gmVcWwdoF
- TLSH T1D6441C81F201ED40C4896A7A451ADAE943373F99EF06A7213064F77B3DB25C35EAD2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/vk_message.wav
- SHA256 c96c904f78d9a7fe7edda8b4d7c1e5b14a694c781768674f636bd57ba89c8078
- MD5 4c473dcc925608008bd05fd599829478
- SHA1 c8e2b09ed4c5d29e5116c39b898b8808768390dc
- SHA512 ccc49dda8d892feee52acfebbd611dab075fd9816fa58e7dcea5721ccf37546999bd498749f621dd44fd3df5bb536253b7cc436172ce5c5d2671b806422f7806
- SSDEEP 1536:h0dLK2XR/PYZzkHc3vzfiKeBKrjH72c/dWwHvNOLG4+6jZh5ov0JssYa73Z2PDfH:B2tYdk8LaKZ2kWwPN1
- TLSH T19794E5957782FC01C416B5BE4A4AD6E95733BF844F05A22330A2B7BF2F69A414CCD6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/FunAudio/women.wav
- SHA256 b7f088269ae99501587bc6c97c890fabc0d0258012de2db691a0cdc43b17268e
- MD5 ae95dcfc00a9876ee13a6a1d89674541
- SHA1 a0a9ca54e357a9af702c14b3b226d6a1542d0919
- SHA512 96178a66674d81487b3335fd90f2b1559290fde36cf02357546e00f58c120fec1d64739a9dca143d3fe96cbbb40c021facb076be2ca55c1196a55f20ad024fe7
- SSDEEP 24576:cuXadF7mVyE8N0PV/96rfnc5lFpOA0PhtdmSqVN0zMF2DFOmjSQp38e0cBt62+z:cSaCY0PV16rfIozrmSqAQwBNms8Jcy
- TLSH T1BB55F12DD133B748E5ED8632A580CD2C1750B68659278C7E613DDAC3B1323637DA4AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- TLSH T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
owlsq
Minor OS version
0
Major OS version
4
Entry point
316730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\juder\source\repos\judero01col\GMap.NET\GMap.NET\GMap.NET.Core\obj\Release\net472\GMap.NET.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
301KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f09c31a7f0cde63b914826fcd8b47e7267394175d3fab30cb9615519e5817e5f
- MD5 2110dc2c787880b9ed2ef58f17cf8da9
- SHA1 24edeb5fdd96af28425e28f2682f9874c3f9733c
- SHA512 095a26c3c7389fcabc9f5ff24d4877879d84513e628a20248bae693f1a2241a583e398f8662131dd21c07d919c06bf3d9af54f68f10a6e361e1c0f09e1dc8d31
- SSDEEP 3072:oPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJawdS5DBRS9LXf+6qbugi7vRq:KccbGucgK9vd/0rS9jf+6qq
- TLSH T163F39DA273948D7FC66F47BDA0A140C1273AFA02F692D35D5D9070BC4D93B146B227AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
owlsq
Minor OS version
0
Major OS version
4
Entry point
162494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\juder\source\repos\judero01col\GMap.NET\GMap.NET\GMap.NET.WindowsForms\obj\Release\net472\GMap.NET.WindowsForms.pdb
mscoree
_CorDllMain
Name
.text
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
owlsq
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Leb128.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e9f5e8cdcaa564d6354c15e2fb4d33dbdead917a2e1388050a68bfb1876ff01
- MD5 e6650e116617c59d46b6f2d3498ee138
- SHA1 f499cf553215a2f4190f0c1e9d35b43dc9e1b092
- SHA512 09f9b493a5accc6ba3e724627b74189e08c34a6f30557a5e07f849957db48b22d496fa38a40640b591c67ed3d9cd797f350136fcc6c5f8fdab6c3d645429cc34
- SSDEEP 192:lxAvycMDDDDDDDDDDaZF6URpVJVXKy83:/+F6URpVJVXz83
- TLSH T13FF14304A3D44E24DFA642BEA96A470993B4B71D9C43D71F789456E17D0137E2E121FC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
owlsq
Minor OS version
0
Major OS version
4
Entry point
13534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Libs\Leb128\obj\Release\Leb128.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/MaterialSkin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f075552e29e58736ff96e00c828a9a4cb28c16337744b69c5114196ad78d59e
- MD5 301d762a76b269e1fdf391d662acc86d
- SHA1 9ddf5bfa4ddd4bb23e02d49f9966338472d21667
- SHA512 25d7a6dac054744e72d97ab388898b708c4d653da474d937a8a88c92f2f6736df735e378b09acda0f33f9ed0e41de88a617262c1970a7f187eadec9a0274df05
- SSDEEP 98304:21vd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uN4E:2gKv8XcXD4K
- TLSH T12A662902D642A62ACAC6F6387D3D933E0D70D429FC5DB62674C59F3184CA944EC69BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
owlsq
Minor OS version
0
Major OS version
4
Entry point
6747714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Mes Documents\VS Projects\MaterialSkin\_release\MaterialSkin-2.3.1\MaterialSkin\obj\Release\net461\win\MaterialSkin.pdb
mscoree
_CorDllMain
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Microsoft.Bcl.AsyncInterfaces.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e26563040661b0999a34b26cbdf2c68928801aeecd17aa365ccb3623258f483
- MD5 5dfd4715571b7ae0ae06ba4cb486ab26
- SHA1 74c61e7ea7cfc7b18393d3731cf8583dfd810260
- SHA512 28b91572b9542e40f15f7d8f0728877e5c8f5487a478a683a63d0d4fb83c37963ea256ebf6bf807d807a34ac703607ab8bc9d0cc5f5f1718cc5d6f6873fc774d
- SSDEEP 768:fulwKBhTVv2wK5LdcorCdjQtanzb9zM8p:mwOTtKZdcor+Qcnzxz9p
- TLSH T148C27D1AD35C5327CFAA2EB5E5A4C6422E36D38A2C12EB3F1188F5A51D5B344A730638
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
owlsq
Digest
6d:ef:42:bf:14:98:1b:a5:d4:31:54:41:f8:27:b8:70:f0:e7:d4:7c:51:64:41:65:7d:65:e0:72:7d:f3:1f:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
21322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Microsoft.Win32.Registry.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- TLSH T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
owlsq
Digest
5e:d3:f9:23:6b:09:bd:27:29:6e:be:e0:b7:d2:f4:95:7f:a3:7e:ad:a3:49:ee:89:bf:31:0e:bd:89:19:30:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:ea:4e:2b:78:b6:2a:27:93:00:00:00:00:01:03
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
19162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- TLSH T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Action.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbea9d69dba26b89f76d8463a580aaf1759cd8ae4ad0f9b795438e67e5efb1ff
- MD5 42e596ccf83ec4e2eeca327ee39a8bd5
- SHA1 58e3aac4592b54b86492c777f6777cc1ee608ae7
- SHA512 ac2870982a5a939e0c05a656ba3f43d2ac594d7ab8d7509bebdb88f6e1884c4fa3dd4bca2e668435a69fa9aee314c3c8842c1b49d21b5aada3785482c3693fdc
- SSDEEP 768:DD9j7bLcWbEfB90FwY+jdFY/dEMKix0thSCBsFY/dEMKix0Gw:H9Pbhb8B90FDx
- TLSH T1BCF2F800B3E85934D1BA4B7A8DB21A15DB36A546E873C60E3B8C408C1BB3A58CE75F75
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41058
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\Action Plugins\Action\obj\Debug\Action.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/AntiProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8066c7bee32598396fc2ee27b2acccd1ced4f3b8d514d2c948f8b1c9bc0ba8ae
- MD5 b12ef46f5e9aa23f605d44057e9f786f
- SHA1 9a58d49f6d6e832751cea64c1101d9677ff40d74
- SHA512 33132ea044d37ac67a4ba1ebbadcd0ac2e64a989215aca1e41aae6566776f15f26e4cb2948ebda4072c254be0e581b9e9e21349d8a8fbe7d603420c8b3bfdabe
- SSDEEP 384:KJBAqb/bok08LI/jzUhufBq2DYvqS9yXm0jV9aTt:Kh888/jwQfRUqE0jI
- TLSH T18B62294843A49B3ACEE956BAE8235744D734E2015D63DB0F3ED170D2BE43BE789122E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\11111\AntiProcess\obj\Debug\AntiProcess.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f7884811c963a0b8006f282c121278f39e113e2a1fa8aa2d093e4acdc95c7b15
- MD5 c422f2256dad3fa20dfc3701ce4aae96
- SHA1 134490ce82f68a49dd9f45e27b825c463f03abf0
- SHA512 d7e69874f1a6b168de15205f2c9083c2287e0df4257ad990860abcfba1b0a2c90bbad144cda2d4cc493cd0874a598bfbb44ff867d3bb956c8615cfe12a108fa4
- SSDEEP 6144:2tsANPVlFHG7QU9V1X7E0AEfRdq6sLtMwNEamxkUu1t:9AOn1L1AKOMIWxkUu1t
- TLSH T127744B11AFE48237E9BF17B5E4B303100BB5E589E56AEB4F599414E80C63309AD173AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
371542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\AutoRun.pdb
mscoree
_CorDllMain
Name
.text
Size
355KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/BotKiller.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0dde28bbbb46d8c01df4b87f4b61464ef0f5cd3bfdecea94827dbb705e83dad1
- MD5 eccc551411ade52f5a6a3ecd58cf941f
- SHA1 84978d2345f0adff632d4b62f67d7225dd531a24
- SHA512 6dc88b5378a6a86575b4ee87c5ca2e932ab6705bd8765fa9c758cf95f4a0fd2aab5b0b71a0b9c3d6e040df43f26214700f6f1f0ccbaeee88e5044678946b9821
- SSDEEP 384:C86kQx3XemLsg/UP3EJABSt3+QbdiDc3DMqcZamJbSPzDCFyQa9aOWs6t6pQbrm0:C8TOXz2P3Ek2+yiD6Mqclb8AYahbaIv
- TLSH T1B6E2C618A7E49A28E3FF4FBA647252048730F1524D53DB4E1BC590DE18327A6DA35FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\botkiller plugins\BotKiller\obj\Debug\BotKiller.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/BotSpeaker.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3df26ae2d03f6cc7732fdc9d1498d8c26f84504327dd57178b778d43f7a1c20d
- MD5 4fb49f039d8c3bd89aeda2c63e233ccb
- SHA1 f70cecb45e08f82d8d9b71f39e1d0a708a0733ef
- SHA512 e3a2121f9dd0bd0efee4f999ede4fe87280206bfb9b896abb7d9b41a9f0748d89757228d702f2a71a720d805db7e78a0c4c97caee09268836bc375d321b6f429
- SSDEEP 192:2RlXXmgxQ8wbwlpaFuC+yYYJUT8kUD/4pHc2gPi57lL+ry0gOeMlvOv8RL:QXfQ7sp2Z+yYYJrkK/282giF6gbv8RL
- TLSH T18352C609EFC59B32DAA957BB45B28355CA34E5085C03DB1F7CCC21E5FC06BA92B601E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\BotSpeaker.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Camera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8856c385a682e8ee00209b6c9814d977efa7c9ec8577d4d87c1c097ba510c7ec
- MD5 15fe64c0625fad772e585b6329da4c86
- SHA1 6ef0b30954cf9f8b9d6e5e461f61ba0ed905a552
- SHA512 83f25fe8a2a943ca4afc133e2b0727865d593494991957b5d4a0f990434353c621c04bc192ba94fd2a2ae08925b532399c17069adce7b3644b7f334fda8c71ee
- SSDEEP 3072:VCCQQCCc23F99bb99fLgUsOOMMOOQOfVkBmQEQIpZL+S+Y37ikFJo:VCCQQCCcw99bb99fkpOOMMOOQONcpIpH
- TLSH T1CEA34B9167B8C563D5AF57F5A0B74B164B70C203A603F7EB19B424F82CA37411E222EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Camera.pdb
mscoree
_CorDllMain
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 adc1426293f7d18f179b564cfa228cd7b7246580b24e6f6fc0eb18628dba9ebd
- MD5 5659d95536342389a8265d29b11fa0ea
- SHA1 e85d8f444564e2fa9d0b8fa29ad33c72eab59c09
- SHA512 ceeac539e9cb09a6b249f84b5ff139e43db6c8ea8dbceb24fd84bd5e1fd8d08c5f65821988fbee279631862226ab37740b406e3676f4d88f7179aaaddd4ff799
- SSDEEP 768:oqVJNCa72NLlpjnGFsT+5asw+rBdNZTgM/Bc6909D+ETzYwLgec1:hV2aWTiFw+LTc69UD9ztu1
- TLSH T162230910B318CE3BD6BE0BFEB465126103B5D316BA43DBDA5DD5109CACDB3868A141EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a5c5c1014b569ff92eac1f3a809559145095c8e83b22e53b9277676837499f0
- MD5 cb96674be57d0c8d38ac31d3550e73d1
- SHA1 e6f9429e1bd47bdd684ae06e24d83e451bb52f0f
- SHA512 2fd6c7c5864fb06dd3a717a1ec7f6a966bdd9675118e87d188d8f63fcc2780edb2815f7d19bb44d0ce6897a59bd1413df116f8a823b3a6e2b65606d82a7f0838
- SSDEEP 192:2pR8sh0G3FrPpaHHS+r+g9kA8nH/4KNl6mMBqAZ2YFVvYCDdEbCr:FsJPp+y+rVkA8H/LGfLvYyEOr
- TLSH T1F552D905DBA05F31DADF95B794639349C734B1116843EB0F2CCC44E0BD5BBA826326D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Clipboard.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7e20a585733f71f441872c02ffd160e3484f1b9a60b2a07a886630dd7599b1c5
- MD5 b33db4b62a906fd1ad36c8238c19721e
- SHA1 c4cc18121c768d0249c8b6182d3568c35272cc8f
- SHA512 38a3b0240f2c3e47ac90badf9d8968b9dea4582d707b9d85e8ea1fb0b1f3e3ebb582693a26729814629744d0b45dae09549aa51d140f8289bcc78bc013bcf9b9
- SSDEEP 384:jN7IcTrT3d/c+I+c6kJ8ep/RItSOglOpg:jdIcTXNk+I/6ep/CJg
- TLSH T10B62FB449FD0DA32D5F903FAD8B3A3898634E5045C03DF1F2DDC08E86C5B7996AA25E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21434
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Clipper.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d02b2d970960070ebd41f931767d50eb8e6fccbefcd35ede140b8c2ecff02522
- MD5 14c3eea78012239274b57df062d9afe4
- SHA1 01d17f22e71234a85f84558e177ac1766db4bb12
- SHA512 1ba35e03b543536b4b3a44d79309a010a6d8add5c6679baab9ef1f1587bdb460aaec9f726674529faceaf8e00981a993f6004f9329ab3ba7bfaaf734471969f1
- SSDEEP 3072:gshGcFjKyO+bwqlWj/RxfZwqWHDgAwlq:7pfHXwl
- TLSH T1B8B3A314B3F04319F2B7177DF8F55116AA79F645FC32EB8E2469031E08A2B009986B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\DDos.pdb
mscoree
_CorDllMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 44608a47639bab323d4011ca80eba806ecec75ad42f1122bd7969b520f94750e
- MD5 0691e527028bac9f5c145d73a708bfaf
- SHA1 39e420b3e9a3e71fc1123a190eec5549df3820f3
- SHA512 9e019fcab4116a9e03b88c16c5b1354328fe5fc1efa882e9bebd8c0ae46b56b889f5f8375fa03824a7860d75fad3bec10edd00c5cd8ba50bf312209f671b46a9
- SSDEEP 12288:eJqOo1aiGeJ0MRKI0xRt0HgmtI8pHuE4po8U5BAst:eJqOo1aizXRgxRtA5BA
- TLSH T1FC0529C6CE642F26DC0F6A7F74A2651382A1D0900345734B5BD117AE6ACB3A5CB1A7CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
803174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Desktop.pdb
mscoree
_CorDllMain
Name
.text
Size
776KB
Virtual Size
776KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/DeviceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9b2d7839829e7181f7e99eb9f1aa88428f70840d57666be16974b32d525fcd27
- MD5 6aee6af63df9181248c6306a968bc41f
- SHA1 d361fc63141cf1ad88c7dd56cbb3527ec38c47bd
- SHA512 3643bffeb2a6b4dc6f63328fea885b3713d6fbbaf25448748ada8eedc6cb3db24df73d5b130828f37290de65cbade3871f34f9f72015d72764cbf202a26ee02d
- SSDEEP 384:s5yzPdtmpq1+C/OkP/1ksPnmOq/wWeaDD:s5qt6y+2P/zvgDD
- TLSH T1A262C545EBD49B71C6EC42BB98B243598635FA456803EF0F3CCC54E1FC12B9C6A216E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\DeviceManager.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Explorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 36fcc6ae1ef727bdd87fc9eda49459231c7d6e9fe8167adb01f9a5d63ff00483
- MD5 6b710265853aa59e53b57d1ee6865354
- SHA1 e728953fb7e3cb184277f6337f24b58452f9477a
- SHA512 9ee218cd38cc1153b936f2431c7d4ae2ef75ed2c4da9a7b6d688fc26e0e04d238fc0b17cfa747adabaae5f288baa280cbec289cdd91b7d73374576c2cb76ace6
- SSDEEP 6144:n4nSNHQs2dP5yGtSV41QJDsTDDtUMle6ZjxLV/m9HVJksDjJ5RIUGZ79:j8P5pS4YsVUCe65fm9EWTJGZ
- TLSH T128B48E006BD8CA5BF1EF67B6D0E39260CB71B423A97EEB4F5D8014EE1D1234099157AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
517294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Explorer.pdb
mscoree
_CorDllMain
Name
.text
Size
497KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a053ba1b74531161f49813c047c504741e7b64639e748958a98e71106a715757
- MD5 832afc9b5e77b9e58c138e0b3f606038
- SHA1 78a2676fd59ad00f854176a021e7e49c903fe65a
- SHA512 2eb3d1362fdc03fe2baa86b923c235eb8bb901826058fc1aa0c8c05344f6bce2f5b74fd86c4ad8ec9966205836e6a0f03b2b5aa4cdea0453d417773865143149
- SSDEEP 384:aoZuGc6BX1PIphh+5P9U9rkdg/22nGxfpGHzdqX:aoZuDiXVQz+52adg/+xcHzdqX
- TLSH T11E62E708BB81D730CA6E56BB9DA343454634E2099843DF0F6ED844E87C42BED5EB15EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 60375212374e77e54296e3d01432d75c2ca8c954a7a32c5b13ff510f4eb18f1b
- MD5 6b0e2e9ddb88342908ee1b6865a8f7db
- SHA1 14c8614576df69d3e84781614d3529bf91b45017
- SHA512 c4f0f37ed24536379d2c350c5e688436c2fbcd0957b69a601c3f651251ca26e28d8fb4dc7c3202e2dc4fb68c942b28d904b645fdc861f53dec9601040478a564
- SSDEEP 768:uzhlKS4g2amhVK/6cCGI0TYX/dj+fnIpX0/isVuhaY8XjCg6:elAh/c52X/x+fnogu58XJ6
- TLSH T114233A4273F78622C2BC12F6D4731315D63AF286B843FB6A1CCC25A648727C49A257DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/FunAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ce88f4d5db58ec97e9a416164f913cceb0ce2ecfdc753716e4c66963e8a10a42
- MD5 7a8e11c390bb9fe768de44926daa443b
- SHA1 8a3e1b0b92d4e06bdad812a34c8bf8ca44a85a61
- SHA512 110d32e5ab39e2ee352d63f7f72b6ad7a8c6c1d0045e89dbd8508bf571638dbc5295cdf918933b18163e6af84a88eb07149479525ea6b48b609d42223ce97136
- SSDEEP 384:E+U/G2IcUjDHx7cGNHWDHyB6nnWodIZlbQqu2Jh/hS:vU/G2IcWHx7cGNH8HyqYZlbQIvM
- TLSH T1C072194863F8CE35D9AD06FED833070993B4E5026803EB0F2AC970EA3D56B9559617A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\prida\OneDrive\Desktop\Condif\Private (ayugramexploit)\Ebloniasrc\Liberium V5 (LATEST VERSION)\funauidosrc\obj\Debug\net472\FunAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97a6a60716f0a11f24d11fc57f0dcb158a52224d5c0ccd4ef7cfca185bbfcd02
- MD5 ce3d505b0d36e9afc194f0965cd00001
- SHA1 350173b55442a81f04fd254d7bd8166268f32066
- SHA512 fb9717a7a068a6a260f11ed7c95b26e145fce032e6edc8238da4d5ea27a37b4178f4993fe614d52f4e567a655b174502d399e10a4c0ebd7b27dd405788ecea53
- SSDEEP 768:KaSbanA5GcWJ3NgIp+K11F/nahnCxcNJQ:FSYDJdgw+KtuLQ
- TLSH T123033B41BBE79220E6EF16B2E8734334873AF1432902E70F1DD911D15A97AC56A287DF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\HVNC.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/HostsFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b348e72116846fdcc842568e8be2dbffc66909f2d8e60ab8fc1a86f5db105c3b
- MD5 aaa462cc35531b473b86459d324ba5dd
- SHA1 2c86a3710a8512712a8f0bdc103493b13f525758
- SHA512 bba13b1a900da923471b03fdd99a89ea79b1a864d7434232a82f06e83615c6868bbc1de8ee1d82352d0dd210064c45316bddd260872e20f1657b5f4f39a1ed94
- SSDEEP 192:zxy4Ny7DBrrbFv+4paDwC+v17Pk5D8JLA/4o/Lw0g74RAPlCO1l9:g4g7DBHLpql+v17PkF8Js/1TNg8RQL
- TLSH T115520A08DB954B32CAE94BBB6463934A8638F505AC43DF0F7DC440E1BD4776D5E222DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\HostsFile.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Injector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b3c14f744a14f865f340ecf2d084a97935ac2a04a7c157864cf8bf650115546
- MD5 e274ec36b4366a95d6b47f88f589e1e4
- SHA1 e9f9e33f47dfcd9593d04bd54386893b0c84b5ef
- SHA512 d5360ed74e7652a30d29265ab09f4798b448dcd168d2f1e4f2e90de4a7343aa75bd939742427f28ed19141751097788eb4a00ffc0d12f58ca321c1819fa1588f
- SSDEEP 768:f++WUCSr/j67GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeKP:m+WfSry4nsycq2yWvYAHAdDlyytP
- TLSH T1A1333A64B398DA33CFE94B7A40B70F08537462565D42DF3B2DC0B0966E22A96CB53F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\11111\Injector\obj\Debug\Injector.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/KeyLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 26f94934c6cfc681a21141733321731c36bf1c817b04b37abb1d489feabc08f2
- MD5 dc880151115ef17a179d85e76523a27f
- SHA1 be96e34a9d7d0cc65831d5fd9c3900ec12aeb7ba
- SHA512 e0f29506b1259eee2d52bdcb3ba270d38e576a1a9ee6ac37275ebc0e7fdd0e8ce2a9cc37a33a713921f487c44129c68fce60a1bf4757923415aa992bf1a4619a
- SSDEEP 384:RPdRa6BDsKBFwXcrI+B+TnOAeR/LQXmmlxp9hn00HcUUv:zRHBwKocc+B/5/DmRo08Uk
- TLSH T10D822948A7D4273BEA9D53B7A4734346A734A2017C03CB0E3CE904E46C467F56A627DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\KeyLogger.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerPanel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7f9a87bcb82d196fb9c140fd85c82caf1fb496ee69a79fa2f8995a5c43801ec
- MD5 23b70511b288c5a4b3b3fdbcda2a970b
- SHA1 b0621dc37a2e59430cd998baaad720446d4d4437
- SHA512 dcb03256b01785d4f8d32376e7c0423fbaeb4eefcedda4444e9c8535e1f929127f723af7d1e36b9dc80e8996d618ec7270fd1fea2e64cec9453a54356fc7d6f5
- SSDEEP 192:Vpm0OZNpbyJunOqaltJpaDBE+mFTk5sopp/4obTOLSU3lf5fKKvR:rc/byUO3Jpqa+mFTke0p/1HO33lfj
- TLSH T19A520704EBD04B71D9AD56BB95A3838AC634E1066C03EB5F2CD441E4FC4A7E86E727D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\KeyLoggerPanel.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/KeyLoggerRemover.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8296a9b44d486858b9afac1bc2c64153c5f768d293217d11f93365abc23a0718
- MD5 c0e89c2c385a81a97a5b04b1a4f40254
- SHA1 1615c4c7050ac0c7f455bd3a0a8f3716f14187d3
- SHA512 472f294df8d88c5802361f7d324ad89614f4bef088be96847e8065dfb071c0c1155df4af4cc92947db04cd09117ac0c130e1f845b6379b261b539e8eba1f26b6
- SSDEEP 96:YK3+wVn3Nf+725gMy/4Fk5mxnKEHM4ZpM3DrKwh:7+S3Ng22My/4+5F6nTEig
- TLSH T1E9C1B812B7D85732EC628B32CCB353514674F7A8AC53CB6F28D4010BFC2665586B2FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\KeyLoggerRemover.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4e8247a474ece468fd0ce7b066f499a79e51bba66c27f7e8c361cda70b772b00
- MD5 5e7e9b9a046b82deb631b194116170a0
- SHA1 70a92128529152d64db750367699a3c973c68fab
- SHA512 6c9b84bbc0156acb965a440752da8de92d92b262f1cef10ce07b8c4e70c447d53465e141d73261312e954854a7d280af7e30e98472a8d4b8664614a7a830718b
- SSDEEP 384:9ZM/XGl0RpqT+edk9mX/1lolCj5uUco/Ha:TM+l0HQ+rI/olsaQHa
- TLSH T15152C508E7944B32D6ED56FB99A3E34A8735E504AC43DF1F2D9400D4FD037AD2A222E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Map.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b0ac1ba56879bb502fd7708c48fb552e34d6f5859622b805665ab9b86ee7ec
- MD5 efff8793d48bd3cbf56719b474eb126c
- SHA1 302d1cb529635c670b929fba734d0b3940b65779
- SHA512 842e730851dec5a6139f33c3acd332fd07e8c2907f0a5b6197b6edb8c0b66a94d7e3502c0151b4e46a79133dad4783ccde2c8244b261d4f4a5278e12579a1dd3
- SSDEEP 6144:OJrr8vmnEA5XvPZW/7wPS9rUVXcTksUo9FvQGNAZpXqcdjhjoF2phUJMiSF1:OJP8v0XjP4UVX2k5QDegihjRUJlSF
- TLSH T1ADB46C217BE09D27C16F33B3F4E20E2747B5E589B657EB8B448016A92DC37529E107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
527282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Microphone.pdb
mscoree
_CorDllMain
Name
.text
Size
507KB
Virtual Size
507KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/MinerEtc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 33f95895c63a64a82598a0c41a9a5288d9a1d44cd30e49a1b03844728a910a90
- MD5 b69990043e275d9c84a78c88dd29176d
- SHA1 ecee7948c0381348a8164e507860af5ebd391f4b
- SHA512 e8fe7247f7954737f3a9dd6e765dcd248fdfee679f5bda7b4732f62582babcbfda22cf352a0c6796763f83be1a4b86809c34cf396a3241745474ea93706380f2
- SSDEEP 384:iCXdbUGngLXIY6xmWQDVE9hnd6k0ZLvDB6MFzDs/Klykm6civII4A4d03lLFlK:bIZYtm1Gz+r6/hjkvIIKmpC
- TLSH T186B228007FA9E3B1E2EC47F3947387094B75F0065802EB5E1CD860F92DA77D896626E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30466
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\MinerEtc.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/MinerRigel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9220f75122b9de44ddf33bdfbe389d3067ec8d00a16b9b139718e5614b06add3
- MD5 a79b3eb83af787c67331428423f2b4f2
- SHA1 718b391be5066c65749b64201339bb07e153eecb
- SHA512 9a005e3e17c82a0958358812a3e15cd15ab266f2bdb9f81c71d445d7e64723ec4027d14b3f977a18b9c355d1074e6ed1cb735532561a969789962b417914026a
- SSDEEP 384:EhudgZf7rfP0W7f916dJkgC7azDHL6ncHDB5B/8lTNFhMG3H+am8jDQe0wlXlRB:ER7LMi97gvHZJ/EJeaDMxy5
- TLSH T185A24A04BFC55332D2EE57B6447353068AB5F1069C03DB0F2CD930E96D6AB9C96127EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\MinerRigel.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/MinerXMR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c833f6d927a64fa52e8ab033ddd488e366908589d8532cb8cfa0027388a9f3bf
- MD5 885acf2d6bf3d089274dd273eac4fb0a
- SHA1 f599b729e578fea96677283df1fffe8e8b049493
- SHA512 ec63056740abe16c4df3e80912c724ebb172c23b46eb650e303ff9f6de62d763da7c81ee2426214e62cd622481fda8701512d81b3f00ee953cda8b54e055a113
- SSDEEP 384:gZ2dJIu+8Wzy+YlxmffwDvehwd6k0zLvDBiMtDy/flykmXSlekYlypAm/miGwKE0:FROyznmwjdmr8/AjJplAAbi5KE0
- TLSH T140C25A047FE9A222D2FE47FAA4B357194735F0932903DB0F1CC420E92E577D899616EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32530
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\MinerXMR.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bc00fb3191b486d0e30f94595aefbbd7799a4c3c4324c11006951a3d97809fc4
- MD5 27ec2fe21280b68d31f9f443a40ca508
- SHA1 a91d75dec25755baeaaef8a0fae44b31970af66d
- SHA512 4c014fccf73b4c843a4153e5a34b490b1adff623c092173196febfc51bbac6c0ad17acf8e2201572bf3ad7a8ba3ea687272b35b09fc61ded5d1d3e0a13d0cba1
- SSDEEP 384:okDhKPyc9LHkpidA9p9+k+Qbh5kE/1TGF8qlyynm:RnUHkMduB+/E/caqPnm
- TLSH T1A88229085BC5CB75E5BE46BB74A353198B38E2265C03EF1F28D814E2BD177EC1A142DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Notepad.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f535425aff69560eebe2da5026a2ecac1af76bbe46ed59e726dacb2e796926a0
- MD5 006c3daef88fceb2ebd72663ee924a8e
- SHA1 e9eda2a8e1152e7275fca5b5891bc0e0a8ee6d95
- SHA512 6f2ade713839010a02d6aeccdfac610d3bb6d51fd0aa3332b14b289c62e9ecc8cb7fe8e5fa814ae0fc1a358baab248c629f702ce2563fd183a0be9ae64bab5c7
- SSDEEP 192:2ylNyZM/5XlTY7cpaDPS+fvk5D8cN/4ofrw0t0vGaGk6:VlgZ+953pq6+fvkF8q/1TNGG9
- TLSH T16A52F804DB954B32DA9E86FBA462434A8738F6056C83CF0F6DC404D4BD07BB96B212E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Notepad.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c461ccc56650e756fb6b9ca54b3d8372fcd6ed9f5d6a727c784cab0f6102c3fb
- MD5 139cd66ea2db7dea8dea1203cf609190
- SHA1 429390249e22c39e7ca09a0b63176c1d14eeb868
- SHA512 2da752420be3753f1539b05873250d38bcb5f8778ed465f74adf83e63faef44b23f2fb5186c69ceb37402b8e7b6a3ffd6dbf462062fe43772785bf4eb1186ae4
- SSDEEP 384:DM3ysBpHQ+GmkylVpt7j/1fGVUx/wqvtpbY3:FYw+8Y/AVUx/rbO
- TLSH T13762C508AFA98A31C9B91AF798B387094634B5055803DF0F6CDC18F0BC57BA97B506DD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Performance.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f3b81c66558d3c47569e663b61babb9880661864c35d7f01c113dce7f2910c0a
- MD5 6ecbca11e713eece48cefc5db1700fd4
- SHA1 43187aa0e7c9ec31a0f930cead6074a8b0b8e1a0
- SHA512 67b46a1b64a3719afc23db65959e5c74fc7119e99e381d5c6c2f2d0f8a97c45daaa9f630b0ac22d5d55dbaac567def6512a7db37f6f5986ff9893620ad6f60f2
- SSDEEP 384:V3d1Vy9EAyg0tGC6pJV+Kh/hdNbk/W0X3/gfGI6UFmo/n:VTw9EAy3tOP+ky9/nPG/
- TLSH T199721905AF84C331C5ED06BA686353564AB1F20A4C03E71F2ED890F17E427EDBE621DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Process.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 df6cf4983c413e1827b2676559e06e3341e6b05a9221778e0983fffd653d008c
- MD5 670469ac1f6d3dfc66654c44a8b8def9
- SHA1 7c62f2f9367bd23f93b107b0a21003b2ef99d93c
- SHA512 db5cf99dcd2ba7d1a506cee7f22c4c620dbe4a27362f742f72eaa96ccb702e995cd4a96b9f7cbad32a5054bfd10df3a65a3544c9c08c0b1113bb2d21ef6d016d
- SSDEEP 384:o+6nLsYHNcpmGQ+zL7u7kLPL96/7s2NNMz6R8hHn:o+jzQ+/LM/XNKpF
- TLSH T1D072170CAB94C231CAEA56BB9463478C83B4D5458C42CB0F2DC194E57D127E9AA636FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Programs.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f1ecfc71aeffa3efcf35c9d134e22721daec3d27d2f5540122c1bea0ebae377
- MD5 2d31d9e8104e2df168c2d236d84d5d75
- SHA1 612df60c0aeede56d19d005a801b3a7237f0f380
- SHA512 fdea9fd7e01c587c6d661e8ea607eed1e989d6d12cad696ccfc773fc4e12845bd5ff6a068450229d41e573ab8ea3235c982dc409063a22e9f42b46e45d008599
- SSDEEP 768:CXuEPJ0PgS66KWD858L/ejR0s5pSSEiucGHrsnnjj:USj66Ov1ItYGHrsnn
- TLSH T132030808A7F1473AF0FE2BBE88716A084774F812F962E70F6ED9506879223D495147F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\prida\OneDrive\Desktop\regeditsrcs\obj\Debug\net40\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/ReportWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c9a012317e4d46a8ad41857a94770553d561437be9b980b70517f69d58e4e1ad
- MD5 24eab378d2fd4512261476de44bbff77
- SHA1 fd47def79f75c8de67b730df7996db1581c67a8b
- SHA512 5a0001456536be5282b9fc654b159c31e467ebae1f8f60761cac8f4ee23f045efc72f9ebd601db7e0ee1f0261e10725df7c1317771078f9f34cc843fb3b89919
- SSDEEP 192:nfSuE+qmAVQyjpRRpas5eZ+QQLkxzw/4oJS7MP7JBCxNA:nf1E+t8QyDRpHc+QQLklw/1JgMjjCbA
- TLSH T17E52F700EB965F32CADC13BB44A387568B34A5056803EF1F5DD840F5FC577A956222E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\ReportWindow.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d322dda9cdf4374a4e1abf3fc8d6418b88b52231c24d82231569b8d6aa17c940
- MD5 c7f8caae090cb8e98ca0199945263c58
- SHA1 ca022209a765a1dc574bdd70a074604a80c5bdbd
- SHA512 24a75bd0f2acbfec289dcf87b093d4d0da6570bd4409f9ede4157b322ba0bf865a1ac8cf2e3c9c071a1777ad9580fd86340df5e7cf23f89de4b6c9ea3bbc37a1
- SSDEEP 384:obnaSmAO5sTscXwbbEE3auvPKV3vPmW+Ar4Bag0t/+Iw+2HWK/eaXZC:obnaSLO5sGxQGW+BEbt/65/eaXZC
- TLSH T1C362C708FFD4D633C5BC07FBA86182098734A15D9843DB9F5DED88E46D037A46AD278A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/ReverseProxyR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ecc8e3d0f89b792ced877b5bcf2d9a740748a16954c487a47a54485d40214cea
- MD5 e05f20394f556bd4ad887f2e8cec7611
- SHA1 f7a9f37a06c4a9687779c7c5644760b6f21ffab0
- SHA512 3c751b16604305858425d127b6b5a39b2f7ffc33e46cce024e7bf3da013fe18a3046cf362d4785f2fa9f2212d5b771b21bb13875db392dbaa7861e63dea20a85
- SSDEEP 384:AgdJYiO39HYZ4dgAPYLlmjzYWBty4/KODQZQqfstfOe3c:AgdJqt4Z4dQMjHX/jDQZ9stme3c
- TLSH T140622C01BF988632C7FA4BB2986783048334D1496C42DF0F6DED60D1AD13BE99A953DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21298
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\ReverseProxyR.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 68b1164568aecd695b733966f52d895d435e9a9cf4a1ddcac2ded094a44bc97b
- MD5 bd239c78b4cd72b62e9101fd9b20de9d
- SHA1 44e2b2201bf0ef5e4a6fde2545116da6a770a4ca
- SHA512 a2abe01ed816a29865b9b7df0641daa67dc4f456695ffa514760d3b618329b64e6f5aa997a37f1a2002671aef25197b434a3bbe5d4bb691964b2b2bc5cc7e576
- SSDEEP 384:HAgXCmS3TMCVD2eXx77W03SkLVFfUho5MZX/gCQz9l16CaRllVZkiKRGfQIQJ93s:HAXmS3vaeXDnMh7/wz9l16CasV93s
- TLSH T15DB21805FBE56A72C4BE83B6A8B356419E30F1136803CB0F7D9850A87D5B79C9A313D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd830590e5d6ebbcb1dbb59f0570bf178af28332d11a6962283b34ec2d86feeb
- MD5 893a05721ea35c6874245b5c74358733
- SHA1 b2f4911ebdfd6ff4fc1c81b136c53806365ddbd9
- SHA512 9606e1ea1a0dd3322d4a52178af7d369c02dcf36bece5f1671f1c1176d568b0b6f472a9204017a85513aa7adc644efcc2c78a9622edbcc4f3bb7956cffe1a8ec
- SSDEEP 192:nVGJqZuB9O8MA0paseE++4dkjNz2/4pvsTydhPau2C+0/1:nEAunqpfN++4dkjZ2/2EyhQCr
- TLSH T16D62D609EBD16A33D5E943FB946397889634A1016843EF0F2DC854F0FC46BDD6A222E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Service.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6de2b830ba5f937dc861e53c7b87a6d2f03debb37fedd726de80eb0ed0f4802
- MD5 952543638f714b26a905fd34bdf3e0d4
- SHA1 745b39e44ea7ef28ebe7f8f3cc911e00cacb789e
- SHA512 f933657a5bf1b47dca56c63010d058b32fd62dce02146db865ade3c5e177675b655b25f6d2dfdfd1c663dc773754315861953cefd66fa0999cd6f381be43fc79
- SSDEEP 384:egnL2Z5rpq/v+vL7vpkFJPEtZY/gqS2gTOXl:bnLIVav+6DP/9gYl
- TLSH T1DB72F60CAFC95B36C6EA12BF587287058274E2419843DF0F6CD521E8AC47BAD5E122DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Shell.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Stealer1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aaf157008ddd9aff531683c853001a63e2731b9d417e18fbbdd90e3b53bbd7f9
- MD5 e720e6f50dd86f1517b9173f7290df18
- SHA1 c8c1e1b9475fb32cd16aa1b9ee02d1146ebf747b
- SHA512 7db428ffb6fec886c0b83cc692ecf4a02c344af68c18dbff5e464febe3ffa3b57a2650d0adc3a8ef25c6ef071b3fbc8cf15c215293eafdffa7d949635061d3dc
- SSDEEP 3072:ZHRpVLXgXGS90bLPUEKNM9ApepJuHGns0zI/kN:BTBXg6L8EKgwq0
- TLSH T1F0E33A543BFA490AF2FF6BB6ABF192DC4674F0366542D75E5DC024F81A10B90A9007BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Dracula aka Samurai Stealer payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
154306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Stealer1.pdb
mscoree
_CorDllMain
Name
.text
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Stealer2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 530efd1e48d92ded2ea35a69393c58b407cfd02005f450ceeb274913899b9888
- MD5 513df38def92eeaa4f1834f391c6451d
- SHA1 f03f9a69ece3b2dc16dcb7a9ed9820a81a762913
- SHA512 f512be340de5e232cd75932d9e510901b9d5a1d16b6d9cbf1cb963390f6ee5a82ca1a5f70130ecb79469c96623b7faa4948b3d0e4fa5cadbfa77694e0e476add
- SSDEEP 3072:GGFMnljzzfYWA7f+4w2ig4J+l2ulCJCUuyr925D0o34oirKHpR5QG4RbNp1:zenlfrY/Vt3CzDuuXrKHJCn
- TLSH T14D442A2837F89A24F2FF4B7A98745280577AF9239912E30D1D9160DC2E32B45DD68F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects XoriumStealer payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
264802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Intelis Stealer\Stealerv37\obj\Debug\Stealerv37.pdb
mscoree
_CorDllMain
Name
.text
Size
256KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/StealthSaver.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f4a99b3ffb6133631a972dffc74b8e848023255d17a4d080ac6ccad8cb48c443
- MD5 882aabbc0ad5353a352dd4d4a7bd4a3b
- SHA1 655a141a67242ef059e23ff543be3d968dc85c7d
- SHA512 0341b2ebcc186111fcc9e78d344d6f6843aed1dfc62728990224db5e8a4c9c5dbde264a53becfcdf10ec38a4400c7efb856de57a47c1bceaa042c347aa8e577f
- SSDEEP 384:KrPEzsCR4EHj5aOrpOkl5mZzzbD/DFQy3EvC2gIL:KrPBEHj5aOtfmdbHeFgIL
- TLSH T1596209089BE18B36E6FE0FBA5CB347058334E6115D13D70F3DCC60A96913BAF4911AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\StealthSaver plugins\StealthSaver\obj\Debug\StealthSaver.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/SysPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a35068cc4a74c4aa776db90ef9cd84323c1b34be8435e39cb1b235a16a8c4c08
- MD5 7fb4210f1ef5b4319697219d73a7da61
- SHA1 6236dac55680b94ace28bfbf96b08549636abdaf
- SHA512 4d39624abdc40c6750ebd6593b56ddb81143b92adf0196dfb1b7edde1f943a01a75256b0c391167386c018f805b7213835b188bcc40f31c9c6a47f9fac9e7f9c
- SSDEEP 384:Nl4bFgJiyh1BpqOu+7lpA8m4/17NwPZyOglpQW:Nl47y73nu+PLm4/jeYOgyW
- TLSH T189520A05EB946F32C99D47FBA4A3974A4A38E1092C43DF2F2CC504D4FC477A966227D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/SystemSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b1b7cc3566992389c81778585e886f1f9336806c4199a0379d47ee6dac39f5f9
- MD5 795576470b03a85790631c5329f1acdc
- SHA1 b44d823689117283b7ab61488f53c25a605ebe7b
- SHA512 803bbfad661b7c254a7356358ad6a1065af5996c5363d6f62f9881f1b33ed69dc74e1df7e4b1c0ff8b3a715a12298ad6470fe29302c62b2d0e329ae0da091ec9
- SSDEEP 12288:+cqWBkcFRKUUm7Tvk0eQsRXlUQ3ezrGWOK:lBk6RKUUmk0eFR1UuTWO
- TLSH T1BBB45C517FE49D2BD06F33F2E4F20A1757B5E589B696FB8B14800AA81C937864D10BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
525114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\SystemSound.pdb
mscoree
_CorDllMain
Name
.text
Size
505KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/UAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 714d23f8f199b8c2e077e2d547a001efde891317ec69b675abc89b7245ffe89f
- MD5 cd0fa1ab39934d01815f7fea03fa99ec
- SHA1 14ccff1e9fe2f61b07cfe0548d87e05a0731a846
- SHA512 c87aef6a77e47ff14d8334ef97bdc6003d584f15be9e738d770efcd80c0e9113403b2053232ccfb1afc8b320988600c77c9ad72c8a417ee74f7f2bf4409ad475
- SSDEEP 768:ka6+W/YMgwJYyuBb/+e8u1aungAqqdjl:765HxyPb5N7ngAqI
- TLSH T188D2094567E48A34D9FF8EBE587306048331B2424D23E70F1FD640952D63BEACA65FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\Uac\UAC\obj\Debug\UAC.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Volume.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1f942f059aab4f9a7baa2f451ca548b8b5a07f4daf5c9ee6d2ca05d2e282347
- MD5 2c117aa58a774065c49fc74522e88b71
- SHA1 20fcc84d882ff820c6beff40362d3a22bf330097
- SHA512 2ba99582cba61426a1f4d5c7b1b95991d32b33c839a7b0b86b6b25f49a6402551f7668019fe89aa8db8d6ffd3ef5bbf8270989b5f69fc9291e80e8955aa8c556
- SSDEEP 12288:mrjKsSrv7c0it6zJOdFIWk8+Ph1Pc7DpfVfo:mWsSrv7c0it6zJOdFIW/+Ph1E7Dpfd
- TLSH T1E4B46C11BBE09E1BC06F23B6E4F20F274BB1E2867656EB8F448456E82D837925C117D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
520178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Volume.pdb
mscoree
_CorDllMain
Name
.text
Size
500KB
Virtual Size
500KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Window.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bc5d2f9268fef8741255cb9b2ad4c298529420286e2b4991340a430c063c182
- MD5 af5bea1f45087056132ebd4b8f78e2df
- SHA1 01e1aed052f199857407a0a3ad8f8b736b491006
- SHA512 1f5a99046f65ac9b349c469ceeb485fc440fa9948b352e6471d6711b1868be8506b6d02efd9cdfc07ef098f9b0ce9b10307ca3c34213ef8078c8ebed90db01cc
- SSDEEP 384:unZkgo94os7VczpqFQ+3arWssiko/1v21WvM8D2KNKs8888888888Oqm/hIi:unZkgYZsY9+fo/Y1AM8D2K4DqOj
- TLSH T1F2722A4E5BD99676C6AD837BD0238709C770D2014853DB0FAEE464F46D123EAB9132DD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Window.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Plugin/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57c64fefc78be99b606a8d413ae5f1d894777ea1e2fa7222b1c51d79508e8554
- MD5 92edcfe846a05b281b38cbab02354bc5
- SHA1 bc3cc8e68c27db2fd9c5fe7bdc0255efee4ae84d
- SHA512 d437fcde1499e7e4a522410041426ba8fce70a6e091823a2172257935f837fe4788317eb3b540f08ee965d63ba8485282615bd79f68f992d8b9cbd87e0b53b5c
- SSDEEP 24576:/rDXK8VRSzaywtGN0UE6r7SVtuVQchsZrq5nHsd0:DDi4tGcRrs
- TLSH T16CE5D5026EB89D3FD37A52FF90E1033416ACAC0792DAA706757CFE691C72A402BD1756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3165974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Worm.pdb
mscoree
_CorDllMain
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/RjControls.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ee6c31ab5c76286cc58c94fb11b00c8163bde35918ebb39cc6d4c3bfc62e36f
- MD5 889492bfc195bf189ef7649233da68af
- SHA1 0c1c83d6965340593e7607d86a2ae06f6cea4e51
- SHA512 52d5fae0544501a9359e0b420e31c3191d93a8ffd5aebbbe05c2a4191e417c0afe28be58b21957bf2265ebc186878c3f9be63a92043caf747ab4f071fb109b5e
- SSDEEP 768:YZrDUywW4PaIDWB15WYRnsb6IBhdaoej3Fc:kDUNxaIDsubf0jS
- TLSH T19EE20828A62C922FDBAF0FBDF44419A113F5C2703383D7E8AE85D17E6C93B454611267
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Libs\RjControls\obj\Release\RjControls.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Scripts/sigthief.exe
- IMPHASH ba5546933531fafa869b1f86a4e2a959
- SHA256 c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
- MD5 3e261becbfe12d7a5ffdbba91c76011b
- SHA1 2e5849aa0be921849f42121544895ce405fd9af1
- SHA512 02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
- SSDEEP 196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg
- TLSH T10A66335423410CFDED6A403BC8A1991EE6D4BC53A750C56B83D48BAF2F6B6E06DBB710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
42656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31937,
count=1, id=258, version=31937,
Liberium Screen Rat 1.8 RCE/Server.exe
- SHA256 a10416f186888ff5d057241f8cf77c7d12e9213f7d6574b5179aba69b57bf995
- MD5 6497d17fdb7970462c15bfbeaaca4acd
- SHA1 18a48f8be64d5b8fa598a6c4a9d8d53f2f82bbda
- SHA512 cecdf7aab7e2b5f32f519a40f281cef92f4735353dbad1dd4ea5e2c910c975c944fcd69debb2bc5bde599393aa90dfee3b97b4a32b5c023de81bf4ab033ea04e
- SSDEEP 196608:K4cFnOlTKdJKVrzRsmpcIHI8AGPeIPfpGrp0jYQ6dyuElPfCrPRIV4HGSGJCzr2f:JGOYdJKBh/IYeIPBwQFZueXKPR24HTGP
- TLSH T1CBB6E0426B76AB40D4B9077A21A00E801AE45D058FEBF783E38C2D6357E17A07F57A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\prida\OneDrive\Desktop\Condif\Private\Ebloniasrc\EBLONIA\Liberium (Для SoulRat)\obj\Debug\net472\Server.pdb
Name
.text
Size
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.NQh
Size
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.mD$
Size
10.1MB
Virtual Size
10.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Liberium Screen Rat 1.8 RCE/Server.exe.config
- SHA256 a5006a6c0c35a50dbece551a152a4b3f32e9dc1aa2a9357c9258c1afe4d1ad23
- MD5 4a2d6c897400b63f7897edd769a92830
- SHA1 56225b4fd7d54401cdc6ac5c3dbe3a92fcd2526e
- SHA512 d15f1e3c5fbde580481c2c84a204fce81087927765fee614c5a1353228cefd3bec9192e7ee2035c2ea49ab8ddbce506c3778619a643536c8d87662fd78c810d0
- TLSH T11D51AC7485CC9FA94A31199279768454CBAD03B3A489089DB4DE2A5BCFA7DC52307273
- MD5 SHA1 SHA512 TLSH
Liberium Screen Rat 1.8 RCE/Server.pdb
- SHA256 925ddc4a89a5289882b091c555a538d16b25efe47787b45eac3ebc98a63bce61
- MD5 18385badff3db7d121e9e9778aa75570
- SHA1 c4ca25459056e6daeef6591da8b1b0df05daee89
- SHA512 ecc31a40b817d42445567160777476bc63c5362cdc2cd0a9fd45550b012973254a0c50265d9a163fd0e21ec8b5ea2199820933d86ad5ddbfcd61a8be93a31b03
- SSDEEP 3072:VkVEcxilj43/+Yi43UKwzIBmiYgva1q576oppSdWDqDKTsOyxBf98ZaG2DJ:kzx5nBmsp16ozSwSHzVTJ
- TLSH T1CE647008D6C4CB09D31A763E91B68329B2F585F56B4943CA2378A33CF8D73257F56688
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/ServerCertificate.p12
- SHA256 d0bac9d5ea4c5b72fcbeca2d8edc414d02dd8099f72b0a1992d05487b82d311c
- MD5 cd15cbc053bf9047e53d4c7d55a9a6ef
- SHA1 b1bf514cd564c0f2edcc7cf4455937a4b69242ce
- SHA512 fcad569250e875152aadee49d8c9328594cda831488dddc4b87d25edc876cf40d74541ee323a3146836dd852358ffc5a6a168b86ac571ee9aac4596b7e214dfa
- SSDEEP 96:SwqwVMBbL9roW2fxI5m+dTaP+YZIPStIXbS7GPKUm8:SwqwVIb1oPK7TaPBZ/IXbLC8
- TLSH T120917D5765EE50A07853CF20EE8F9974D99165C33C30226BC83129404CD2F2B2ECD01E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/Exodus.exe_sig
- SHA256 e9ffd546881ee3fc40721d466696fa1e01cb448ca157e2b452b8d1a9106b8b9e
- MD5 2d612df3cd9fac26761e61491af1df1c
- SHA1 31e10b0b22df297a59a96eb15dbd135653f8ff29
- SHA512 15544d52d39312194a28f1593fe656b8a51bdc57c87ffc3862ec0a5abe928a9428746484ff1cc8728e9930f96cb3cc66461b9cb547e523b7bff0b9379233aadf
- SSDEEP 96:BkfTd0PmfrrQG28cYG28CEjlH7xXmUbxJ/2F69lxQKclIC:B2IYiYF8LTX72SlxTcl/
- TLSH T1409118E78D601C04DD9F8D51BAD0D63AEE39798AA1C0C2D6711FD52893C87423B9D1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/FL64.exe_sig
- SHA256 190e518041da81a833b25c870cfc7108a9ffbd2c4e0668b8175dd0c3a4b341db
- MD5 51d35a4b24664bbc137e7dcc0be2b482
- SHA1 99ba986fdd04915fce6fecd16dc8655bab7d3f8c
- SHA512 a763cbc7acfc423818513a3a71ca03d9f4290505e6d621fa0b389c568c07281bd9d7bb474bcf60960535bc1a3df0223addceb749d163356877d11cef3c6a778a
- SSDEEP 96:qnTb6NDlkBlpHpi1IddvFFSNSRvrm+8GHrgDYb3JUfhdyEi7ZHeE5gfWVDUtl:YyDWpHEKdddFSNgvr78mrOYFBZHlqWWl
- TLSH T167E1B4AACA101C926D278D2131D4D92AAE30B7826795C5F7E52DD060DFC2BC336FC1AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/MarketApp.exe_sig
- SHA256 b37e2980ef13016e896ef69019deb85b24de37acc9685e267d8f7873ef0bbe0a
- MD5 aab8503526c3cbeb44a4a293bfe788f7
- SHA1 bbc5d1aaff6a3773953ca3155e059828f23c715a
- SHA512 2a5049168725b3ca6a9c93c605094ce2a0d2af62bad10449e451484b9581baa276046d5ff732c878f9e01a01ece98e6f419f709a562d61641e6fddef219dbdcd
- SSDEEP 768:Ir2uGTi3lKFKcMkOr2uGTisNKFKcMkKdpq:I2TuIri2ThIrEg
- TLSH T13FC24DD71A3E5143AF46CE8EE1C5A8177CB8E7C38CDE548AA02B475D29493C13B9C52D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/NVIDIA GeForce Experience.exe_sig
- SHA256 5fd46f771abd9e1761c086f18cedf14e468647c812aee29a5d998f303dec68be
- MD5 e47acaa12c4f0cfa30b3f1e03bce45f5
- SHA1 552742c374b7e033fd514b780d5b5cefa0abd8d6
- SHA512 ced27bd154391d28b91c4637ec5823e99f88a56e5d2cbc1d3f6c648c34ce432d1d7fca0bd2d8522b910ad6099a8bd738a1c207e56c093c68e74c8fe7024cb509
- SSDEEP 192:DIYiYF8ahU7DNDlQZYSsDO4NKzYJzkLRCji2j4WIzla33ob16l8g:DIYishuNcY7D9NEwi2jHF8g
- TLSH T189123BAB0AA41610EDCD5E4234D5D737BE75A7F17A8388E7602AC5B2DB013613B4837E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/NordVPN.exe_sig
- SHA256 b5a5c8a5178506d45c872bdc5eda0693acbba417e6ad20d7c8cb4c3ec2620f24
- MD5 1beabb526d63b32cb8ad63c9f97d5195
- SHA1 b5dd257cb0d3c2dc7d81f93b7ff7e052c503472e
- SHA512 fdd68f51269eb630cb65be3eea32131f82862ed4dc0328d25ad054170fe90650f501d86af11b04662a116132f83d00e3c344385f5aa2ecb1821eed14d635b018
- SSDEEP 384:JMQiY9/uo6ki2Qufi1zcoKiCUV1VF0hXHMGBk7/UMQ3hnZ:ur2Qua1z5CUV1VaXLkjmZ
- TLSH T14E62398B0E3E5943AF81CEDDA0C9D8577DB8A3C39CDD144BD01B862529083E27B8852D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/RGBFusion.exe_sig
- SHA256 013d3ada70bd382333e4189c05253adaf237b865330d9490a5bd799b7fb490ef
- MD5 6859d41071774651c4101ad98bf5b930
- SHA1 b6f75a67e4ecd4425d4bb4fe440886b0cb517afe
- SHA512 fc8c827b77148d6ece71600a9e93b4eb23e1ac53c234e2f2f2e39359890c60023b351ec521d70fe5f034b187cd8989fbb822304f9d1e55537e58e1c465d51369
- SSDEEP 192:6WWSVZPzmCeJ2UzZ0y2sE9jBFKWJfsHRq3XT:FVRmCu2Ut08E9VFK4ii
- TLSH T1B00239E74A543C03DD56DD8570DCA91A9E76B3C26DE084E3921EC2504B857433BED1AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/TLauncher.exe_sig
- SHA256 a49c24d12c4c6595cbd280b96e5c891debff50d99589da03e58b25e51ac01d2b
- MD5 f390420ad7e8846b6669e583264f179a
- SHA1 ead420d6fb1d0374d5272e8e174c743a8716e567
- SHA512 092983d02b7c54385909100493792f004d6f9c6e5b15aa8a89761523e1f93c4dbcbb96f5f938c61fcc4660e3f713ba57ae7537d5da02b4cb7453b2f73fb6b77a
- SSDEEP 384:v5pq6jAAUxzUHE99IblNOr5pq6jAAz/UHE99IbF8:v5pq/ZUHEPu2r5pq/YUHEPui
- TLSH T1628239E70E286363AED28E00A0DD5A395DF0AFD57A8750CFA528F72069D93F0384C59D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/TOTALCMD64.EXE_sig
- SHA256 b5272a567533beac74a4dde52a86232ddfda8648d6f9111f9472b955fc99ac68
- MD5 490889bec03862a33250a4d39f2d1f71
- SHA1 98fd6f74023d86a6b82ef91002ecd3b814045d34
- SHA512 ad05b11727db479e0f3f5fb55bf3d7449445299bb6a5669d736092591e69100c66b8bd87105dbc5bbb07e436fcd1bc7d2112a24d5eefb09344b451d4832f61a8
- SSDEEP 192:XWkspPIKfhig1/C5q8jgfi1jsgO7fpGmGoj6gs2oEhZnpHmzafqru9:GtpwKNsqj8jpmpGmGovy8ZpHmzafb
- TLSH T12F224BA73F2471829EC28E54B0CD9E339D70A2B67FD004956071D5596E977E63B2801F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/Update.exe_sig
- SHA256 5c0fc232811bd4ece9ea39953a735cf0ba1fabf662bb3934a95e357e5b90aa00
- MD5 acf2b1fc6cc32c0f68fdd82d34057219
- SHA1 874732cb50a254f6df921857fc34a9ab67ba3780
- SHA512 d79d907ecf12a88db98738050ed70308852afff4b91888e8ff40afc6cf541438fd4608679fedc0998859514c30845022416721538e9ffca8ad8134ef548afad8
- SSDEEP 384:1kEZsHLs6BPxh8E9VF0Ny8NhqakEZsHLwWPxh8E9VF0NyBCZk:81PxWEGbChPxWEvik
- TLSH T1D2922B66CB946C02ED669E4130E8D926AF30B681AEA0C5D3521DC0614BD5783BFFD2FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/Wireshark.exe_sig
- SHA256 cda36a63055529165b43848f924a24dca7acd3b7e15959d779523958515572ec
- MD5 fc1ee7bbf43e5993f1c09173fb16b84b
- SHA1 ae40f7eafed9b68f7d22bc4767adefc7932022ca
- SHA512 75f05440a76bb2fdaf4c71cfec24f341dd45fe775a04b732809d623cff48e5f8dfded9437230427a9efbee8a9a5b6a12165339e5259deb7d7ba591f42c625e89
- SSDEEP 192:8wpPIKfhig1/C5yFgfJm91hMeufH0JOqsmVgz28WhBqO47C:7pwKNs3JMhMeu8JN77hh/GC
- TLSH T1D71239972A2864839E878E9AB0C8D6765C7097F57BE508CA143894519FC6FE62F1802F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/brave.exe_sig
- SHA256 4dcfb5c7b9da7f878a7956f5ab9b960ba5a1bcc2017332126f9f06d721c52c2c
- MD5 8ac197d05cf6003662eb1e4971251f26
- SHA1 49a49a2b224f12e1ef97e122fbba0cf6d0d2c8d4
- SHA512 f51c238a15236d76051d8f6b8cb4e5cbc431205cdaeb31f05036457a0eaf71d96700644eb7bb5cd9a5ba66fa25b0f89dc49e7752174bc4327ab68a1680aa1e04
- SSDEEP 192:TNyby2sE9jBF6IYiYF84+noPOJB3SbruA7NPKChv2d5k7f:TNyb8E9VF6IYiTPxsaPpd5if
- TLSH T194222A678924AC15DE5B5F4035C89439AE31B78659D081E3332DC1528BC9B827BE92FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/chrome.exe_sig
- SHA256 a6489457e4400183689669f10bd99422fbe33c8edb5634d95dc29fbddbb96bc6
- MD5 0967f02ea1a40889029b7a97a8209039
- SHA1 b518777dff9c98d70fc3bed3b1b45dbcca534d1c
- SHA512 f36535bcdc6ceaa739e1f49f145b409112835034efad676d587698523c44208ef85028cf82c36621813e299616b992ffc102bb4e81c0463de4daaf186e7a73ac
- SSDEEP 192:XWBIYiYF8m/Ex72f63YLa0Dx+noPOJB3hy2sE9jBF0NyfVl9Wl:GBIYi6y33SIPxh8E9VF0NyfT9Wl
- TLSH T195225D6349645C06DD5BCE4070C89939BF70BAD299D0C2D3721EC1A18B957827BED2FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/clion64.exe_sig
- SHA256 c62780a92372a3588e1d34a99ad170f9624e38e464862a72152d089d41fd8c6c
- MD5 232c1582745dd72f27732fd5de9aa927
- SHA1 76ce659ee207f604d39cf33e5c8d215d8888387a
- SHA512 fcd3e579ad3e2ca8309508d59cd558c1ba991dc397030e71946bc5f83a1a89ccfea0db94cbd81f12a4b9443280e7eef01ff1ca997a39da33fa8857fedcfa1327
- SSDEEP 192:fcuIuJfjJFer3PNwsVwlfBCXPWHboVqsn8OYoTisEPKLKI//i64m/XB:fyunFWlwwwlJCe7oVqsZniPKOIim/XB
- TLSH T105322AE35E2CE4A2AE83CE14F5E45427ED33F9C5299874DAA109C4619CCA7F06E5B03D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/firefox.exe_sig
- SHA256 2cb7b1c22d6761b550869da0f425089d8f8edbdbd1bba45496731972be06b037
- MD5 9523458b4a3e35185893abb7e53044cb
- SHA1 c0fa39c14f0d18f61f06a18a6e3e6e418dffe955
- SHA512 ee080e789f256ce9f449d678788f83be0127e0844768d2365a5a3e6fb5a9241cd912c6a9c2c85f89e8ae5b7deb501c85fa21fa649c0dc536b5369896971876a4
- SSDEEP 192:M7x0KDWpH4AAANa3Gy2sE9jBF0NyQ+noPOJB36b2jTml0x:2vDG/t8E9VF0NyVPx6b2fml0x
- TLSH T1CD22096ACA506C52ED678E5171E8D8367FB1BB425BD5C0E3A22EC1508B817C277FC1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/iVMS-4200.Framework.C.exe_sig
- SHA256 342a394bde1e61ed388250fb0caa8fb48d4d4dcacafc213e7920326a346cc223
- MD5 61f6fa235b921c9e750b53814ae12e95
- SHA1 89c5011661e6c433b4b1a3fedf0b4e5f6a545fba
- SHA512 44f868020f9554bb31c68c43ffa86f5d4e48b84a81c2bf6cabcacad282f3e6fe36efe3419fe6d2b0985bb18f541825c402cae68201e7ccab16d95b08324f5e6e
- SSDEEP 384:vMQqC/uDTrvVqGBkNl6bCIJWuFRTm4XWMQv/uDTrvVNWuFR9Y8JN77hhso:GPDVtkNlTOTk4rPDVNTL73heo
- TLSH T124A22ADB0F3E5403AFCADDCDE0C8D517ACB8A7C25CEE548B911B81592A483D23B9851E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/idea64.exe_sig
- SHA256 ce6b2b57a700ad033194cd396b09c6dd43e022e01337e344cbcb2e18952eccd4
- MD5 f3fbe6c8de3d3759487a2fb588d17b5e
- SHA1 5bb4655f0884a32b7f062fd22de4d74ba10f100e
- SHA512 924fb0735daedd62728a9a7ea715bdc09be93868657133b74a507b252c4c7f998c161fdcfaf1bdd8249c5c049e301d998d59f7d80354097144892e3a5be429b4
- SSDEEP 192:ChuIuJfjJFer3PNwsVwlfBCXPWPZfcCU7TJWOYoTisEPKLKI//i64m/bv:ClunFWlwwwlJCeRf+7d/niPKOIim/bv
- TLSH T150323BE35E2CE0A26E83CE14F5E4542BFD33F9C52998748A6219C46198CA7F06E5B13D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/logi_crashpad_handler.exe_sig
- SHA256 f27da615a73ad1c35ae6ba0ae8190808920be2d0cff18345dce290002a7a63bc
- MD5 ca872e1deb83319d7a5ab55eb95281d5
- SHA1 025f87e746775f14462dbd523dece35e69046b49
- SHA512 ef20e16741c1529e55aa0ba7566daf9eceace09c7525607f0a8a81523fa793604be6790708a96205eb7bc8004fbf54154124206b218133b87f50b0c64bfff785
- SSDEEP 192:n2T3+4RyncO67CU5rR8IIYiYF8nHPTSofousUwNhMvU7lU6QJKXPgxw8Uu1:au4scj5rR8IIYiRSofousHMx6QJKX4xJ
- TLSH T129224CA64E141C65AD079F00B4CC8A3FAE71A2C66EC0958B700D44ED6F823A57F7C2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/obs64.exe_sig
- SHA256 47b6d2260b6ff378ac89890facb2f78e839858f5719fae832b5210182e7f8654
- MD5 b59b755ae675838c151632498739891c
- SHA1 f6c7bf8f63c218b6b5d5018f5b7ce2e7655ce116
- SHA512 8aecb12381858003a844b5884ebad00ccf6f538d34538676ec56e16bb23bb27f0062eb973d786da280dcb906221a02122ab99444d174785226dc0f3d446e85e0
- SSDEEP 192:kcmNyby2sE9jBF6IYiYF84+noPOJB3n07Fj2AAXBzFvnUJR/yu:kcmNyb8E9VF6IYiTPxnk6nBzhU/yu
- TLSH T139224B6289646C06EE5B8E4035D89539BE7573926ED081D3721EC1618B943833FED2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/phpstorm64.exe_sig
- SHA256 4b2bb63abb71fcd79c579f4c4a1676f3236328bbef07a7cb3faee03dc19d2960
- MD5 a54ff09b1e539b2904998c6cd7922f7c
- SHA1 fef87ff35d8e9d9b52564bd58ccd18a6b7870221
- SHA512 de9e5c27acc3eb98bb1ec2a989625143d91f773494e98021538f03aede658bb5b30c2f01c0fb9d19d2b8187c0623e84a22ba19a7e7a89d43dcad5983d413bb24
- SSDEEP 192:LKuIuJfjJFer3PNwsVwlfBCXPWPv5QiUNPOYoTisEPKLKI//i64m/GS:LwunFWlwwwlJCeHqDMniPKOIim/GS
- TLSH T186324BE35F2CD4A26E83CF18F5D55527ED33B9C52A88649AA209C42198CA7F16F1F03D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/rufus-3.21p.exe_sig
- SHA256 c2181866cf1c114a4c8910ab3f7d7a7e027dc0246ce58d6555ce0154a5a0d1a1
- MD5 bbdf221aeb679c6665dbedc1fcae51e1
- SHA1 6ce5bfe94b33e32d40e4ad32846caa6566c6a39b
- SHA512 ac51b78d7628a08c9fa9cfa1837f6597e1931a703438489d71a798a0570b960f352884db94132279fd79f6abd8274f426804e6263a9552fdc4c7738efa6d1a22
- SSDEEP 192:2qpPIKfhig1R7JNfVZCg2txKBysIsHfH0JOqsmVgz28WhBq7T:2qpwK3PVZAUksIsH8JN77hh+T
- TLSH T164123C9B1D3464435F878CAAB0C5EA774D70A3F0BE91488710799285CF8ABD72B5902F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Signatures/steam.exe_sig
- SHA256 ee560220bc2252c7975a34d3729c71fb796107ba2b3eac935249ff70491c23be
- MD5 7863eb6ec9f67fba79fa05c5086bf626
- SHA1 3bdb11530312e9a2bf522cfb576f31a9adf59d27
- SHA512 73090fdfb8385ca7dc02f506fffbd386ce7003c0732894763c2d247d320bc5f596b9b34a01df06ce59c30865f38d71ee9d42800462028b52084e62189f56039b
- SSDEEP 192:XNyQDbnPvy2sE9jBF6IYiYF84+noPOJB3z7W76ub0R52p:XNyQH38E9VF6IYiTPxzIb0R4p
- TLSH T1A9324BA789642C06DE4B9D4171C8883ABF75BA425DD0C6E3621EC1618BD57C33BE82FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/Stub/Client — копия.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 42ffd201a7b7b33cf86e13acea3e576ad7e01cb49a5b4692390ca488b5e3ec75
- MD5 3e29822c28dcd360f6569374a2ba720e
- SHA1 054d738b72400c71a63aa1f95b418444af478806
- SHA512 60622be59e9df506f6e6e90e711f1e114916e3b8bf6422b585d5b31866d8ebd3d8df92bb47ace4c88e4314d39aea2e8f50c8226454ce2af3826fb9faa3f145da
- SSDEEP 768:ntyUebg255gqysbUc9YcYL11eDnhXHObd1Zw1fP6SBy:tyUo5gqP6L11erNObriNjy
- TLSH T12423E90873D45B21D1FF46BC987247488B30E6135913E70DAEC7A49A3A12BE9D916FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\prida\OneDrive\Desktop\Condif\Private\Ebloniasrc\EBLONIA\Liberium (Для SoulRat)\stubersoul\stub\obj\Debug\net472\Client.pdb
mscoree
_CorExeMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 42ffd201a7b7b33cf86e13acea3e576ad7e01cb49a5b4692390ca488b5e3ec75
- MD5 3e29822c28dcd360f6569374a2ba720e
- SHA1 054d738b72400c71a63aa1f95b418444af478806
- SHA512 60622be59e9df506f6e6e90e711f1e114916e3b8bf6422b585d5b31866d8ebd3d8df92bb47ace4c88e4314d39aea2e8f50c8226454ce2af3826fb9faa3f145da
- SSDEEP 768:ntyUebg255gqysbUc9YcYL11eDnhXHObd1Zw1fP6SBy:tyUo5gqP6L11erNObriNjy
- TLSH T12423E90873D45B21D1FF46BC987247488B30E6135913E70DAEC7A49A3A12BE9D916FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\prida\OneDrive\Desktop\Condif\Private\Ebloniasrc\EBLONIA\Liberium (Для SoulRat)\stubersoul\stub\obj\Debug\net472\Client.pdb
mscoree
_CorExeMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/Dropper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d911dbf9f7d1d28767982bd41f008be7599eb7957103d160f2c167ed4a326076
- MD5 a1ea2f07f2dc8ad979b8079c51415da8
- SHA1 a0d5322c26584760d9d909a38e28947e6b0985ae
- SHA512 c496e73b76c77699f58841966268027f87213b04b574bf1594e646f9b44fa685f37a3a88ffcf6bac7cc693af4636130f0d217460a0027ddcfc5e4dbfbb9693de
- SSDEEP 192:pe9suPhKz/riCfgy4m4ZUlEw4NIUFVeDxQc:pe9LPhK6sgyr4zq0Ve9Q
- TLSH T12512E808B3E88723F6FF8A766C7393108676B6524875DA0F1CCD604A5D236844A93FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Dropper\obj\Release\Dropper.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/Joiner.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a248aedd9cdb926a314b6009699acd72f8da9b1466e40166ddd46578fee5fb12
- MD5 4c7cdf0b583d91860b0d52289d27413f
- SHA1 c8316c1839d840f1f7eb965446f21dc49e748062
- SHA512 bf8fa3b1a5fa4c818c0d49ca0d2394c1e570b1ea3b7ca6c5dd794b2498f1e8f29ebbaaab2fce5bf8fca4e452cc5701ee388238bc6431bd2576fa7ffa09897297
- SSDEEP 96:Tyaokhdy6HgUmifHAsqZQDorXJ4u7Gp5mzllYBtfwZV3jFCqGFItz7q0bVUxYvzj:dphYgU+MD2u7aylytIZtjF+ItxVUK5
- TLSH T15C12F740F7E48671E5BF4FB56C3B03204AB2B7534A61E61D1CCA314FB8336A64A53EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Stubs\Joiner\obj\Release\Joiner.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/KeyLogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5f6541620ae96d7b63f75ab1075e8ed966332410e592afe4770cb52f06859dea
- MD5 62502d6b0ff9c498cefe89e7922ad87d
- SHA1 d6130ce51de902132f4e093c77d265c8a4c25717
- SHA512 b04a67a3ae891690a342c6318cb9570948700babfa66c47a0668a58611d9e49263ec868cfaa866043546da53639caaf6362e4652f1d9fdeee9ee16cfdffd46c2
- SSDEEP 192:7duMewJ5Gr9RDaOvNs5AkxHblRYWG1v0dz6HVNbCbKy:leM5GWOFUXhbLY7szYV5CbK
- TLSH T1CF32F604BFE44525CABF5A3485B317001BB2E31A5C37D78F28DE020F5E6BB454662BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Stubs\KeyLogger\obj\Release\KeyLogger.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/LockerStub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 40b719650fea48bc4a70f5f8aa5c82962d2b391d352dae2d32925746f2804f9f
- MD5 a30208355dd4098f4353b2baf0b18bd6
- SHA1 b1aa125267021c281d7d2983ca40d403c7fe9ca3
- SHA512 e2c57c916e985b8c6b15d141320d981a1d76c70f3f633d84c96f502a021c4a8be9b1b79c2e187d33569bf41b0c92deaa5111e9450e7401e96ff46691bd09257d
- SSDEEP 6144:MUPAAFBv7+SvpMW90KImQisnBbxVnRtjU:MYYBj
- TLSH T1BC244A9027AA8936C57D87B9B463614787F7A817EA03EB4DAC8814FC6E13780E711377
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
226542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\prida\OneDrive\Desktop\bluelocksrc123123\stubsrc\obj\Release\net40\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
214KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/LockerStubBuild.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b5badaee21d45442c05f22785a45b35649a2c9877f10ef7cceabe44a339c271
- MD5 ec41f3068e42acd024930e78fb0cfd44
- SHA1 639e84827af343ac04cbb3aacf05525055a6ae56
- SHA512 5ba6a5653b9a43631f26d0a8c9d87e64b4e0c9d2d0f17b48b023d997887ac07f7d692897e5e388fced722c1749be729d3141dfb492a9f90d3879e7b7f6f1eb1d
- SSDEEP 6144:n8gwv2AVAjUnRtjU1MUeQBSvpMW90KImQisnBb/V:n8gwvhujAjG2E
- TLSH T11B246C5423AB897ED6BF83BDE4A6124B07F1E517CA53E70D185A90BD1923B00F722793
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
212KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/UserMode.obf.dll
- IMPHASH 6dbf95d81ab0cb2039f47259ddec333f
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameA
GetModuleHandleA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.0Dev
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=133, id=261, version=27412,
count=15, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=3, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=7, id=265, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Liberium Screen Rat 1.8 RCE/Stub/Winlocker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a0aee361aa97edd4efbaeeb07a2d995626101eead6a86377d463cf2efe736a82
- MD5 4ddb582636318a6e85eaab09ca75c9b0
- SHA1 4c148a5d01e2419ad6c80346b863fa6068d9bb01
- SHA512 08ad3566bd34dc3402210d2c31c52f55a3107c451d7babe3075e11a682ff528f65622e21e17d5022a097d15c0e8c6dabeccb77465493131cc40037ee2b9b4de2
- SSDEEP 384:8WOAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDSfolob0K4ZEOwykj6eRD6ap/:vOQEc+cDTlShob0lUD6aZ
- TLSH T138E2224033FD1D2BDB39D6F50276192D43F795561411E7E92CCAA9CB08EAF400A94EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Winlocker-main\Winlocker\obj\Release\Winlocker.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Stub/WinlockerBulid.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d6496ba25229251c710efb3e6480961087f1e19dcb1fc00e9747db5d0b90ae9
- MD5 58e75ce421a3522e95c73da8a5d2a077
- SHA1 72744b32aab206bf1f8d98f062584aa6a14848fc
- SHA512 606c70bfaab7556d5b5285efcd95c0b94d1600cb8df05cd2b85962ef54c6c12a501b6de152c472c9964729eac8e2ded540a983fb27d2d12cc3276d51b2f92f25
- SSDEEP 384:hWupqAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDjoopehMff3F15hg7CZEOwY:orQEc+cDTlSPoopeiNhY6UFAT
- TLSH T19DE2328133FD1C2BDB39D6F502361A2913F7955A1811E7E91CCAE9CB14EEF400694EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Buffers.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
- MD5 902760412abffbd10be14842e83f0c09
- SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
- SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
- SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
- TLSH T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:68:48:ae:8e:63:d0:cc:97:89:10:b1:45:84:7f:68:66:d0:47:4a:08:eb:2a:b6:89:66:c1:09:09:16:a3:9e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:04:d8:e0:0e:07:97:32:58:98:00:01:00:00:02:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
18706
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Data.SQLite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d
- MD5 55c797383dbbbfe93c0fe3215b99b8ec
- SHA1 1b089157f3d8ae64c62ea15cdad3d82eafa1df4b
- SHA512 648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757
- SSDEEP 12288:5vXCrbE724yjK3r/fFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchs:h8dDm3r/7
- TLSH T122845BA423EC2A19E1FF5774E8F068408B70F452ABAAD31D78C054A92D27B41BD537B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
05:b0:4c:75:7e:c1:9a:ea:48:df:6d:68:e0:4d:83:26:82:55:53:44:03:4c:b5:c4:a4:4b:e3:30:86:b0:60:d1:96:8a:ea:ad:83:0d:9a:a0:c3:3c:22:b7:20:3b:53:c0:84:d9:51:b4:e2:25:84:29:24:67:99:5b:0c:9e:f9:8e
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
12:d6:a7:c7:d7:cf:38:0e:4e:bf:20:38:8e:19:b5:11:95:ce:5d:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
381862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.IO.Pipelines.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 30193587b48d4dad35313139a2b1d79e17b6dcf144042c642db60e6683b3c27a
- MD5 f056eb2b8aba1ec773cd5a6b64e8b49b
- SHA1 f2afa9b45bc96ad7860f115b743bf855ad7d9749
- SHA512 4b1aa793ca541843d69e902648e147ca06d0568003bfde9e4fb6437954d757727eed9a7b3bba823252e810214be0783d6d64eaa83d4b8c1f4a0e19a8c4899218
- SSDEEP 1536:ROBEtNwWq02pH6ZafBzoGrriJNNjrgFXjfYbsAoYo4bgN0xeR5evOjvj9T4booXS:wBSNTAl6ZcBzoGQ8XSKYo4bgN0xeR5eY
- TLSH T137836B6857BC472BEFDF1ABDA56095020FB7D7166913F74AAC4CB9DD188338046242B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:ae:46:dd:a8:5c:8f:a4:b4:19:cc:ad:df:e3:f7:70:89:79:2b:c0:a3:31:d9:d0:9d:9a:77:0f:02:d4:98:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0b:11:9d:56:29:92:f9:bf:85:00:01:00:00:02:0b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
79462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.IO.Pipelines/Release/net462/System.IO.Pipelines.pdb
mscoree
_CorDllMain
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
- MD5 bd7f42207f4fdb9c7eafb0013abd7334
- SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
- SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
- SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
- TLSH T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ae:a3:86:d1:9b:06:39:d7:1c:ad:68:32:06:75:f7:af:5a:40:e4:f5:66:01:12:56:75:99:3b:c7:18:c3:38:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:01:d1:45:59:98:10:cc:42:4f:00:01:00:00:02:01
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
138594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
129KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
- MD5 a57f205ce75d4e4a19020e8b627469c4
- SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
- SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
- SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
- TLSH T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:80:90:1b:17:38:ec:61:65:dd:0a:c6:a3:dc:d4:0b:33:38:e1:79:30:66:08:69:e4:67:38:b9:b5:4b:38:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
105250
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Runtime.CompilerServices.Unsafe.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
- MD5 cb5b861883d2bddd9833c9fe956406f7
- SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
- SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
- SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
- TLSH T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 3, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
14046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Text.Encodings.Web.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 412782a930be8ee751933270800c283aacac3ac5295d74230f611d8073607f96
- MD5 1dd554aad2774db4ff42d7a249cff508
- SHA1 ca051371e5c400119c34014a7eb1e7b3ca279353
- SHA512 a3d798e0385f2598b4a193cf9b1f96dc0508bf255e408c7bb83a187bb9c8fabaa96da162f79b2a5d80e981cf096affd1468be3ff29438be32c3c601dea20176d
- SSDEEP 1536:UOOUnOOOc++v9mBkdQ3IWIxLBHFkzoA4Vnrpwrz7ojOjyCf7xPQcjzG:a+FmCQ3IOz7oCjyC9PQgC
- TLSH T1FD736C26A7888B2EC73E16348560857197B0BF5F2362F7825854B40F1B777C9A31D2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7f:5c:c8:fa:f1:e2:97:f3:9d:51:24:1f:15:e0:66:e2:cc:4c:30:7a:da:1d:5f:04:25:82:8e:e1:a0:0e:ab:bb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fa:fb:3b:44:d3:77:33:c6:d3:00:01:00:00:01:fa
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
65462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Text.Encodings.Web/Release/net462/System.Text.Encodings.Web.pdb
mscoree
_CorDllMain
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Text.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1b1c54922dcccabd27d100df87aa9c1aef9c43d85edaae89a6c0ad522c2a1c04
- MD5 737eb058766ebfa28ebc216101c4233b
- SHA1 5b6e913b091e7277b92a8002ec242b3c27cf030d
- SHA512 c576588b7a1a34408391de507f4a38d99ee69a4f8c76f4ec71acca74f9228274c3837addd820e8f1dd2a4b35c7a63d17130f2e176146e13fd30e7bbedfcdf1be
- SSDEEP 6144:6BKdLt5cj2/gSYvY6M7XyTSAMREMJ03Yt7HO+xMSXCIVAL0jO0ypCfDhGI8UgE9+:Zt5cvSYLM2jMl7eI3gKuLwOZmQZRi1
- TLSH T13FF44A117FDC5B2BDAEF6378B07451148BB5EA12A3AED70F264485E93C42790AD803B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:12:28:c5:9d:93:e5:39:f7:eb:fa:29:a2:6c:df:32:b5:42:9d:80:79:d6:10:64:34:05:59:34:64:85:36:c4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 16, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
719334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
696KB
Virtual Size
695KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.Threading.Tasks.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:8A82-E34F-9DDA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:19:8c:bb:54:08:0a:5d:fe:65:00:00:00:00:01:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 13, 2019 - Feb 11, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
22234
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/System.ValueTuple.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
- MD5 23ee4302e85013a1eb4324c414d561d5
- SHA1 d1664731719e85aad7a2273685d77feb0204ec98
- SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
- SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
- TLSH T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d4:37:69:30:cf:c4:bf:17:93:07:4e:1a:10:f5:a8:79:e8:8f:5f:58:7c:25:a7:a1:5a:95:50:d7:24:03:73:42
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
78:b3:c4:5e:5b:a3:f6:32:6e:9b:44:3e:33:4f:0e:39:8c:1c:4a:00
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a9:54:70:d9:79:c0:84:65:e2:00:00:00:00:00:a9
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
12898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Tools/SorterNewLogs/SorterNewLogs.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b2d731aa1263fac8051be16f8b5230ba71719dee53b5cdb15302030f9255cefe
- MD5 916d0ddc7968b9432b3df28b3eac5fff
- SHA1 2123ec71d4206acfc72421accba37c80d4cf987d
- SHA512 294d9d3469d99c2aafe931249ee9056043c18b985ba5d6b8fdc539a71e060e92b4b895e8344124ef4a67f6f7a5656b84183f8736e440a8051e5e93a5bdc71942
- SSDEEP 192:2taob54M/y4pqmeYS+00mHeWDMBLfmrwUaYqVzq9m:Uaod4i+cmrwUoV+9
- TLSH T13C12A501BFFA4325F8FF4A75A97213004771FA1B4D26D76F29C921195C223489A91FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Tools\SorterNewLogs\obj\Release\SorterNewLogs.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/Tools/SorterNewLogs/SorterNewLogs.exe.config
- SHA256 cbaf2ae95b1133026c58ab6362af2f7fb2a1871d7ad58b87bd73137598228d9b
- MD5 9070d769fd43fb9def7e9954fba4c033
- SHA1 de4699cdf9ad03aef060470c856f44d3faa7ea7f
- SHA512 170028b66c5d2db2b8c90105b77b0b691bf9528dc9f07d4b3983d93e9e37ea1154095aaf264fb8b5e67c167239697337cc9e585e87ef35faa65a969cac1aa518
- TLSH T156C0124940A8BE26AD338B2392608922FFB022A2A424150CF42FAA670B3115D46473AA
- MD5 SHA1 SHA512 TLSH
Liberium Screen Rat 1.8 RCE/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a8c2ccede8eb154e20cf60bba517ea8e81485da2665362e724a279b597cedce
- MD5 306365ad424bec21e2f0c229a4ac6b08
- SHA1 432be30aa28bcd551d09cb0ed7d14e376638c5c6
- SHA512 db31b42f716e6ba546a176509d5c16fdbb39cc0bced9256203ec4264c3ef85a18981f6cd868f6fc018cb79a03c2fa448a318d310a17bac5a271b74e5066b0516
- SSDEEP 1536:qul14DC9Uf0a2T3Lip1q0GB7xxn0JL+1MtMKot25JYg:quvQ0a26p87Ln0x+1dKot2LT
- TLSH T1F8734B25A3BC4F3BC6FE467EF01704565BB0C907F227E34E8ED8B8DA65A67800915693
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Thomas\source\repos\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/WinFormAnimation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9052729b560d819c8d75149b6ca92c48b9e1b1b0ccaa50080a74166db8eaa12
- MD5 16b35ccfcf3e6e97e182d033cb7bb748
- SHA1 dadae07416824b194557ad182546e4faf5775d0f
- SHA512 b652c2eea4ca9da97db7660b8ea3dd43d045f1d0a7302b0d7ec6b09720ff242e8e03401cedb854fe1198f5ebf5d043502ef91ca8cfe03e27d8cb223b34ba5eb7
- SSDEEP 768:LkKguW2jU37VjIOsCF6sxx2trIOvwZw094wM8roBknl+8m3uPezhW:8FljVswHgV4oanlbm+24
- TLSH T1B503082907BCD67AC6AD457DA0C6451087F0D94E3C43C79A6E4CD0F9FD1A7A906823EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Personal\Open-Source Projects\WinFormAnimation\WinFormAnimation[master]\WinFormAnimation\obj\Release\net4\WinFormAnimation.pdb
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium Screen Rat 1.8 RCE/local/Bulider.json
- SHA256 f37a6479c1119f379c7bc9281a5d5d5e1d6966a1a4e0df3669e623131024b014
- MD5 f82539a31e24521edc3ac1b84074e0a7
- SHA1 cd8f8877ae5d79cc8cced53b20b8e0fcfdf974ca
- SHA512 90678d4cbbc76dc1512aed0b09178290c6a70354df469048515b3dddf0691b723402cecf39831bed4992523c2fc0a83c9800ca6d8996d0861cfd6063e5e29ab4
- TLSH T161115E36A44810BF58B403598917DA86FB6A1F4F21310C1FF6FF580AE62223B3A45BD5
- MD5 SHA1 SHA512 TLSH
Liberium Screen Rat 1.8 RCE/local/Settings.json
- SHA256 d609b544a79298d9ba1bd8b1696976ab3d7282a0dd26fa9e01c54bf0bde54932
- MD5 fd7fac9df6b34ddaa956529b7e22141f
- SHA1 4cd5da0082a192a84478d1b20f3f663718b1f745
- SHA512 c935f2230fd3d95eb8e8f84a8533d0d666111c8ac64594849be200130c43d196827fcf270589a977a1f29a6d9bfbe25e70cee8aa041b0ac7066703adc768c18a
- TLSH T121C08C3A1200C4BDE323EE13C2482F8A397805103B0A2C20C1C95E78A1F23E10278CE3
- MD5 SHA1 SHA512 TLSH
Liberium Screen Rat 1.8 RCE/local/Tasks.json
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
Liberium Screen Rat 1.8 RCE/local/temp.ico
- SHA256 2ed593965b4bba176095cafbe68a8e8159896607d0f538e8cc4e553a5e84475e
- MD5 a15e4c34453f18deadd0f89be4669ab3
- SHA1 0692a5b62aecbaec6d7ce5ab5c73c54f2a4494d9
- SHA512 c1a1f5371dc2fb19f1d3d0c66380986af8d884f6f25304a64b8e00846b47d5e1f83da39332f32219d0f7dff4212acfc51a489894d083673a6d700963410681b9
- SSDEEP 1536:10skghjZqFsbheNVNOBkMPCS5ul7wV3xudoBKnysMhNlYLHMfm:isvjhheNMPoB+ffm
- TLSH T11E040E9278CA366FDC2F5678035FEAB22A795CE07392486D4F80720D4C3694A90EDDD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium Screen Rat 1.8 RCE/x64/SQLite.Interop.dll
- IMPHASH a42f73521c784fa06f1d886fcbcefcba
- SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
- MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
- SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
- SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
- SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
- TLSH T154858D4AB3B8019DD567C17DC6675B07EBB174022310ABDB17A08AAA2F13FE5177E324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
6140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WriteConsoleW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
AreFileApisANSI
SetEnvironmentVariableA
RaiseException
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI013768ea228eaf06
SI03ee1370ff2172fd
SI050169b0f137dcac
SI061f9351f6b79d40
SI066df4a47deb7b95
SI075258fe7332f5c9
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0b65268e19d3b81d
SI0e7c9abcb195c68c
SI0f556a49067bf550
SI0fe7fecb92f1b44b
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI15d5f41c81892f13
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI24f5c83eaddd65e8
SI252aeb4a9d3dc2ff
SI2b074e8cf29cb472
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI349980d776ee39ac
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3974af1f94b94613
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI57335d3e329eea8d
SI5887bf867911838d
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI64119fb980b7e962
SI6479b9cf07b87f67
SI674c3bc07fc17979
SI6901b186cfd089f2
SI690ffdcfd9cda629
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI6e6c544c028b2de9
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI72b05b1ad5f34d61
SI75fe921d50a95fe0
SI768767362ea03a94
SI77ffe3fede90bfbb
SI783104ea11038afc
SI79f6c64948ab63d2
SI7a4943591207dd14
SI7b97ee05aa1e64c7
SI7c373366af3ee2f7
SI7cd7250399b1ea60
SI7da3b9691a73b4a2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8dd2c969f2a6a31e
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9bf461db9bf83c22
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SI9ea49276dcf9849f
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa1d7e21a548b910c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIa8e1a742a358dc07
SIa9b758d3ae2e9aea
SIab3ed5feb3c43f0c
SIada7f27769d7f95b
SIae9562605f0b7c06
SIb391996b7b633820
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIb84ee16d149e7562
SIb94a6bc97d77e69f
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc0bb4eab77f5a999
SIc21d402df09e0c69
SIc26100c97b176329
SIc28b5d2d1f102994
SIc2d8715ee8c9e908
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIc5d5610a73781fac
SIc8c63d94dd03040b
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd2334250b08e199
SIcd6b4ac0aeff7202
SId00f524badf4f5cf
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdbbe1b52f304f379
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIdca7c218fe9393fb
SIde347320a2d725fa
SIdeb28053ce71d5b4
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe2cb515ade8c0235
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIeea5cda6d9846aa5
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8090240c1414098
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfcfad09d1b0a60ec
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
263KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=128, id=243, version=40116,
count=37, id=242, version=40116,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=16, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=153, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Liberium Screen Rat 1.8 RCE/x86/SQLite.Interop.dll
- IMPHASH 39ace63b362beb47a2a7a8202a5c4f2d
- SHA256 83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae
- MD5 8be215abf1f36aa3d23555a671e7e3be
- SHA1 547d59580b7843f90aaca238012a8a0c886330e6
- SHA512 38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b
- SSDEEP 24576:eiDAYMz2epP8AEXn8z7qsyb8c+gntHKuvKtBLtTvD0nsrFSK96fYlYyv:1AYMza36enEuyjpTV96A2yv
- TLSH T1D5558C26FA8390A1EDD610B592FE6FB76C3D120A431808E7E3A41CB55A601D3767E74F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
5844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
WriteConsoleW
lstrcmpiW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableA
AreFileApisANSI
DecodePointer
SetStdHandle
RaiseException
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI03ee1370ff2172fd
SI066df4a47deb7b95
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0e7c9abcb195c68c
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI252aeb4a9d3dc2ff
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI674c3bc07fc17979
SI6901b186cfd089f2
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI75fe921d50a95fe0
SI768767362ea03a94
SI783104ea11038afc
SI79f6c64948ab63d2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIae9562605f0b7c06
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc26100c97b176329
SIc28b5d2d1f102994
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd6b4ac0aeff7202
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIde347320a2d725fa
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
_SI013768ea228eaf06@8
_SI050169b0f137dcac@12
_SI061f9351f6b79d40@8
_SI075258fe7332f5c9@0
_SI0b65268e19d3b81d@12
_SI0f556a49067bf550@8
_SI0fe7fecb92f1b44b@12
_SI15d5f41c81892f13@8
_SI24f5c83eaddd65e8@4
_SI2b074e8cf29cb472@16
_SI349980d776ee39ac@12
_SI3974af1f94b94613@12
_SI57335d3e329eea8d@12
_SI5887bf867911838d@12
_SI64119fb980b7e962@12
_SI6479b9cf07b87f67@8
_SI690ffdcfd9cda629@8
_SI6e6c544c028b2de9@4
_SI72b05b1ad5f34d61@12
_SI77ffe3fede90bfbb@32
_SI7a4943591207dd14@4
_SI7b97ee05aa1e64c7@12
_SI7c373366af3ee2f7@4
_SI7cd7250399b1ea60@4
_SI7da3b9691a73b4a2@12
_SI8dd2c969f2a6a31e@12
_SI9bf461db9bf83c22@8
_SI9ea49276dcf9849f@12
_SIa1d7e21a548b910c@4
_SIa8e1a742a358dc07@8
_SIa9b758d3ae2e9aea@12
_SIab3ed5feb3c43f0c@0
_SIada7f27769d7f95b@4
_SIb391996b7b633820@36
_SIb84ee16d149e7562@12
_SIb94a6bc97d77e69f@8
_SIc0bb4eab77f5a999@20
_SIc21d402df09e0c69@8
_SIc2d8715ee8c9e908@4
_SIc5d5610a73781fac@12
_SIc8c63d94dd03040b@44
_SIcd2334250b08e199@112
_SId00f524badf4f5cf@20
_SIdbbe1b52f304f379@4
_SIdca7c218fe9393fb@24
_SIdeb28053ce71d5b4@12
_SIe2cb515ade8c0235@12
_SIeea5cda6d9846aa5@12
_SIf8090240c1414098@4
_SIfcfad09d1b0a60ec@20
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=241, version=40116,
count=128, id=243, version=40116,
count=39, id=242, version=40116,
count=23, id=259, version=24123,
count=22, id=261, version=24123,
count=15, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=152, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,