XWorm V6.4 By XHubTools.zip
- SHA256 1f091c73050f0d294abb1029fdb17f1a06dc8d35f43ad35ea8d318ea6a42b1f6
Password
xworm
Overview
overview
10Static
static
10XWorm V6.4...ta.dll
windows10-ltsc_2021-x64
1XWorm V6.4...io.dll
windows10-ltsc_2021-x64
1XWorm V6.4...on.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ws.dll
windows10-ltsc_2021-x64
1XWorm V6.4...at.dll
windows10-ltsc_2021-x64
1XWorm V6.4...um.dll
windows10-ltsc_2021-x64
1XWorm V6.4...rd.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ss.dll
windows10-ltsc_2021-x64
1XWorm V6.4...er.dll
windows10-ltsc_2021-x64
1XWorm V6.4...er.dll
windows10-ltsc_2021-x64
1XWorm V6.4...er.dll
windows10-ltsc_2021-x64
1XWorm V6.4...DP.dll
windows10-ltsc_2021-x64
1XWorm V6.4...NC.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ry.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ps.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ns.dll
windows10-ltsc_2021-x64
1XWorm V6.4...er.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ps.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ox.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ne.dll
windows10-ltsc_2021-x64
1XWorm V6.4...er.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ns.dll
windows10-ltsc_2021-x64
1XWorm V6.4...me.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ce.dll
windows10-ltsc_2021-x64
1XWorm V6.4...er.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ms.dll
windows10-ltsc_2021-x64
1XWorm V6.4...re.dll
windows10-ltsc_2021-x64
1XWorm V6.4...ry.dll
windows10-ltsc_2021-x64
1XWorm V6.4...it.dll
windows10-ltsc_2021-x64
1XWorm V6.4...op.dll
windows10-ltsc_2021-x64
1XWorm V6.4...al.dll
windows10-ltsc_2021-x64
1XWorm V6.4...xy.dll
windows10-ltsc_2021-x64
1Behavioral task
behavioral1
Sample
XWorm V6.4 By XHubTools/MySql.Data.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
XWorm V6.4 By XHubTools/NAudio.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
XWorm V6.4 By XHubTools/Newtonsoft.Json.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
XWorm V6.4 By XHubTools/Plugins/ActiveWindows.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
XWorm V6.4 By XHubTools/Plugins/Chat.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
XWorm V6.4 By XHubTools/Plugins/Chromium.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
XWorm V6.4 By XHubTools/Plugins/Clipboard.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
XWorm V6.4 By XHubTools/Plugins/Cmstp-Bypass.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
XWorm V6.4 By XHubTools/Plugins/FileManager.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
XWorm V6.4 By XHubTools/Plugins/FilesSearcher.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
XWorm V6.4 By XHubTools/Plugins/HBrowser.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
XWorm V6.4 By XHubTools/Plugins/HRDP.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
XWorm V6.4 By XHubTools/Plugins/HVNC.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
XWorm V6.4 By XHubTools/Plugins/HVNCMemory.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
XWorm V6.4 By XHubTools/Plugins/HiddenApps.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
XWorm V6.4 By XHubTools/Plugins/Informations.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
XWorm V6.4 By XHubTools/Plugins/Keylogger.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
XWorm V6.4 By XHubTools/Plugins/Maps.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
XWorm V6.4 By XHubTools/Plugins/MessageBox.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
XWorm V6.4 By XHubTools/Plugins/Microphone.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
XWorm V6.4 By XHubTools/Plugins/Ngrok-Installer.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
XWorm V6.4 By XHubTools/Plugins/Options.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
XWorm V6.4 By XHubTools/Plugins/Pastime.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
XWorm V6.4 By XHubTools/Plugins/Performance.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
XWorm V6.4 By XHubTools/Plugins/ProcessManager.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
XWorm V6.4 By XHubTools/Plugins/Programs.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
XWorm V6.4 By XHubTools/Plugins/Ransomware.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
XWorm V6.4 By XHubTools/Plugins/Recovery.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
XWorm V6.4 By XHubTools/Plugins/Regedit.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
XWorm V6.4 By XHubTools/Plugins/RemoteDesktop.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
XWorm V6.4 By XHubTools/Plugins/ResetSurvival.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
XWorm V6.4 By XHubTools/Plugins/ReverseProxy.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
General
- Target XWorm V6.4 By XHubTools.zip
- Size 17.6MB
- Sample260623-nllpcacs8p
- SHA256 1f091c73050f0d294abb1029fdb17f1a06dc8d35f43ad35ea8d318ea6a42b1f6
- MD5 5770172fe522faabff9585ad74248c24
- SHA1 f3a6afcba5990ad970d4055314b7f6d6b3e4e528
- SHA512 3ae99d43635d99f9675ba3347488e4a8de31f2439a78e97cefa12d05fd14cd97bdf574e1a688c9310b00ad6d729263fabc93e6cc4524172a72d8618849c594e2
- SSDEEP 393216:wCgjugXqrOQ+T030wgTnFkrRRgcFzP/DDbn4zgyQ6j2Uyj2MAMpLRT2swQxb:wCNgXqrCT0kw0FkrRHP/PbM9QY2b23Mj
- TLSH T14407330F99BE2C63DA8ACD3823FD3E65F74EE4F8D574414A82284B456C6E58858C39C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/XWorm V6.4 By XHubTools/Plugins/Options.dll disable_win_def - Detects DonutLoader 1 IoCs
resource yara_rule static1/unpack001/XWorm V6.4 By XHubTools/Plugins/Rootkit.dll family_donutloader - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/XWorm V6.4 By XHubTools/Plugins/Recovery.dll family_stormkitty - Unsigned PE 51 IoCs
Checks for missing Authenticode signature.
resource unpack001/XWorm V6.4 By XHubTools/FastColoredTextBox.dll unpack001/XWorm V6.4 By XHubTools/GMap.NET.Core.dll unpack001/XWorm V6.4 By XHubTools/GMap.NET.WindowsForms.dll unpack001/XWorm V6.4 By XHubTools/IconExtractor.dll unpack001/XWorm V6.4 By XHubTools/MySql.Data.dll unpack001/XWorm V6.4 By XHubTools/Plugins/ActiveWindows.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Chat.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Chromium.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Clipboard.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Cmstp-Bypass.dll unpack001/XWorm V6.4 By XHubTools/Plugins/FileManager.dll unpack001/XWorm V6.4 By XHubTools/Plugins/FilesSearcher.dll unpack001/XWorm V6.4 By XHubTools/Plugins/HBrowser.dll unpack001/XWorm V6.4 By XHubTools/Plugins/HRDP.dll unpack001/XWorm V6.4 By XHubTools/Plugins/HVNC.dll unpack001/XWorm V6.4 By XHubTools/Plugins/HVNCMemory.dll unpack001/XWorm V6.4 By XHubTools/Plugins/HiddenApps.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Informations.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Keylogger.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Maps.dll unpack001/XWorm V6.4 By XHubTools/Plugins/MessageBox.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Microphone.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Ngrok-Installer.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Options.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Pastime.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Performance.dll unpack001/XWorm V6.4 By XHubTools/Plugins/ProcessManager.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Programs.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Ransomware.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Recovery.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Regedit.dll unpack001/XWorm V6.4 By XHubTools/Plugins/RemoteDesktop.dll unpack001/XWorm V6.4 By XHubTools/Plugins/ResetSurvival.dll unpack001/XWorm V6.4 By XHubTools/Plugins/ReverseProxy.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Rootkit.dll unpack001/XWorm V6.4 By XHubTools/Plugins/RunPE.dll unpack001/XWorm V6.4 By XHubTools/Plugins/ServiceManager.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Shell.dll unpack001/XWorm V6.4 By XHubTools/Plugins/StartupManager.dll unpack001/XWorm V6.4 By XHubTools/Plugins/Stealer.dll unpack001/XWorm V6.4 By XHubTools/Plugins/SteamTokenRecovery.dll unpack001/XWorm V6.4 By XHubTools/Plugins/System.Management.Automation.dll unpack001/XWorm V6.4 By XHubTools/Plugins/TCPConnections.dll unpack001/XWorm V6.4 By XHubTools/Plugins/UACBypass.dll unpack001/XWorm V6.4 By XHubTools/Plugins/V20Recovery.dll unpack001/XWorm V6.4 By XHubTools/Plugins/VB.NET Compiler.dll unpack001/XWorm V6.4 By XHubTools/Plugins/VoiceChat.dll unpack001/XWorm V6.4 By XHubTools/Plugins/WSound.dll unpack001/XWorm V6.4 By XHubTools/Plugins/WebCam.dll unpack001/XWorm V6.4 By XHubTools/Plugins/WindowsUpdate.dll unpack001/XWorm V6.4 By XHubTools/SimpleObfuscator.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/XWorm V6.4 By XHubTools/Guna.UI2.dll
File Explorer
-
XWorm V6.4 By XHubTools.zip.zip 17.6MB
-
XWorm V6.4 By XHubTools/Background.png.png 924KB
-
XWorm V6.4 By XHubTools/FastColoredTextBox.dll.dll 333KB
-
XWorm V6.4 By XHubTools/Fixer V6.bat122B
-
XWorm V6.4 By XHubTools/GMap.NET.Core.dll.dll 2.9MB
-
XWorm V6.4 By XHubTools/GMap.NET.WindowsForms.dll.dll 147KB
-
XWorm V6.4 By XHubTools/GeoIP.dat1.2MB
-
XWorm V6.4 By XHubTools/Guna.UI2.dll.dll 1.9MB
-
XWorm V6.4 By XHubTools/IconExtractor.dll.dll 10KB
-
XWorm V6.4 By XHubTools/Icons/icon (1).ico97KB
-
XWorm V6.4 By XHubTools/Icons/icon (10).ico115KB
-
XWorm V6.4 By XHubTools/Icons/icon (11).ico9KB
-
XWorm V6.4 By XHubTools/Icons/icon (12).ico9KB
-
XWorm V6.4 By XHubTools/Icons/icon (13).ico361KB
-
XWorm V6.4 By XHubTools/Icons/icon (14).ico361KB
-
XWorm V6.4 By XHubTools/Icons/icon (15).ico361KB
-
XWorm V6.4 By XHubTools/Icons/icon (16).ico97KB
-
XWorm V6.4 By XHubTools/Icons/icon (17).ico66KB
-
XWorm V6.4 By XHubTools/Icons/icon (2).ico112KB
-
XWorm V6.4 By XHubTools/Icons/icon (3).ico131KB
-
XWorm V6.4 By XHubTools/Icons/icon (4).ico125KB
-
XWorm V6.4 By XHubTools/Icons/icon (5).ico100KB
-
XWorm V6.4 By XHubTools/Icons/icon (6).ico106KB
-
XWorm V6.4 By XHubTools/Icons/icon (7).ico164KB
-
XWorm V6.4 By XHubTools/Icons/icon (8).ico108KB
-
XWorm V6.4 By XHubTools/Icons/icon (9).ico264KB
-
XWorm V6.4 By XHubTools/MySql.Data.dll.dll 1.1MB
-
XWorm V6.4 By XHubTools/NAudio.dll.dll 502KB
-
XWorm V6.4 By XHubTools/Newtonsoft.Json.dll.dll 695KB
-
XWorm V6.4 By XHubTools/Newtonsoft.Json.xml.xml 696KB
-
XWorm V6.4 By XHubTools/Plugins/ActiveWindows.dll.dll 14KB
-
XWorm V6.4 By XHubTools/Plugins/Chat.dll.dll 18KB
-
XWorm V6.4 By XHubTools/Plugins/Chromium.dll.dll 32KB
-
XWorm V6.4 By XHubTools/Plugins/Clipboard.dll.dll 14KB
-
XWorm V6.4 By XHubTools/Plugins/Cmstp-Bypass.dll.dll 11KB
-
XWorm V6.4 By XHubTools/Plugins/FileManager.dll.dll 679KB
-
XWorm V6.4 By XHubTools/Plugins/FilesSearcher.dll.dll 478KB
-
XWorm V6.4 By XHubTools/Plugins/HBrowser.dll.dll 25KB
-
XWorm V6.4 By XHubTools/Plugins/HRDP.dll.dll 1.7MB
-
XWorm V6.4 By XHubTools/Plugins/HVNC.dll.dll 85KB
-
XWorm V6.4 By XHubTools/Plugins/HVNCMemory.dll.dll 39KB
-
XWorm V6.4 By XHubTools/Plugins/HiddenApps.dll.dll 45KB
-
XWorm V6.4 By XHubTools/Plugins/Informations.dll.dll 22KB
-
XWorm V6.4 By XHubTools/Plugins/Keylogger.dll.dll 17KB
-
XWorm V6.4 By XHubTools/Plugins/Maps.dll.dll 15KB
-
XWorm V6.4 By XHubTools/Plugins/MessageBox.dll.dll 14KB
-
XWorm V6.4 By XHubTools/Plugins/Microphone.dll.dll 540KB
-
XWorm V6.4 By XHubTools/Plugins/Ngrok-Installer.dll.dll 400KB
-
XWorm V6.4 By XHubTools/Plugins/Options.dll.dll .ps1 30KB
-
XWorm V6.4 By XHubTools/Plugins/Pastime.dll.dll 17KB
-
XWorm V6.4 By XHubTools/Plugins/Performance.dll.dll 16KB
-
XWorm V6.4 By XHubTools/Plugins/ProcessManager.dll.dll 19KB
-
XWorm V6.4 By XHubTools/Plugins/Programs.dll.dll 13KB
-
XWorm V6.4 By XHubTools/Plugins/Ransomware.dll.dll 20KB
-
XWorm V6.4 By XHubTools/Plugins/Recovery.dll.dll 1.1MB
-
XWorm V6.4 By XHubTools/Plugins/Regedit.dll.dll 15KB
-
XWorm V6.4 By XHubTools/Plugins/RemoteDesktop.dll.dll 18KB
-
XWorm V6.4 By XHubTools/Plugins/ResetSurvival.dll.dll 1.6MB
-
XWorm V6.4 By XHubTools/Plugins/ReverseProxy.dll.dll 16KB
-
XWorm V6.4 By XHubTools/Plugins/Rootkit.dll.dll 1.7MB
-
XWorm V6.4 By XHubTools/Plugins/RunPE.dll.dll 11KB
-
XWorm V6.4 By XHubTools/Plugins/ServiceManager.dll.dll 14KB
-
XWorm V6.4 By XHubTools/Plugins/Shell.dll.dll 14KB
-
XWorm V6.4 By XHubTools/Plugins/StartupManager.dll.dll 188KB
-
XWorm V6.4 By XHubTools/Plugins/Stealer.dll.dll 3.3MB
-
XWorm V6.4 By XHubTools/Plugins/SteamTokenRecovery.dll.dll 1.6MB
-
XWorm V6.4 By XHubTools/Plugins/System.Management.Automation.dll.dll 2.9MB
-
XWorm V6.4 By XHubTools/Plugins/TCPConnections.dll.dll 16KB
-
XWorm V6.4 By XHubTools/Plugins/UACBypass.dll.dll 10KB
-
XWorm V6.4 By XHubTools/Plugins/V20Recovery.dll.dll 3.9MB
-
XWorm V6.4 By XHubTools/Plugins/VB.NET Compiler.dll.dll 14KB
-
XWorm V6.4 By XHubTools/Plugins/VoiceChat.dll.dll 539KB
-
XWorm V6.4 By XHubTools/Plugins/WSound.dll.dll 539KB
-
XWorm V6.4 By XHubTools/Plugins/WebCam.dll.dll 209KB
-
XWorm V6.4 By XHubTools/Plugins/WindowsUpdate.dll.dll 1.6MB
-
XWorm V6.4 By XHubTools/SimpleObfuscator.dll.dll 1.4MB
-
XWorm V6.4 By XHubTools/Sounds/Chat.wav45KB
-
XWorm V6.4 By XHubTools/Sounds/Intro.wav238KB
-
XWorm V6.4 By XHubTools/System.Memory.dll.dll 138KB
-
XWorm V6.4 By XHubTools/System.Numerics.Vectors.dll.dll 113KB
XWorm V6.4 By XHubTools/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
xworm
XWorm V6.4 By XHubTools/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xworm
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Fixer V6.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
XWorm V6.4 By XHubTools/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xworm
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xworm
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
xworm
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xworm
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/MySql.Data.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
xworm
Minor OS version
0
Major OS version
4
Entry point
1179402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\build\sb_1-14799416-1710747233.08\connector-net\MySQL.Data\src\obj\Release\net48\MySql.Data.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
xworm
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Newtonsoft.Json.xml
- SHA256 79ee87d4ede8783461de05b93379d576f6e8575d4ab49359f15897a854b643c4
- MD5 d398ffe9fdac6a53a8d8bb26f29bbb3c
- SHA1 bffceebb85ca40809e8bcf5941571858e0e0cb31
- SHA512 7db8aac5ff9b7a202a00d8acebce85df14a7af76b72480921c96b6e01707416596721afa1fa1a9a0563bf528df3436155abc15687b1fee282f30ddcc0ddb9db7
- SSDEEP 6144:XqqU+k/Rik5aG0rH3jGHdl0/IdHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DU1
- TLSH T155E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22ec63cb694cb33ed5e47d687f45af519cbb935eefe9e105f8a065c34a0bea5d
- MD5 1825a9ece42b3a38bce2bf17f40e05c2
- SHA1 81e3d8abdc3352b7899188c61b4d113f86bf746f
- SHA512 1985d529ffbf283d92b2c1da98b037d066283a13e04c493ff17a866f5d6033d2ec7c3d9f9eedd0c81280b224079747f8177097c24f70781f71bb49774bf7c86c
- SSDEEP 384:MRttr7olU5QrGPbONr3odT8ptsY7XZOEDue:MRtuRrGPbHt0ZOED9
- TLSH T112624A69E3E44335C6FE1FB25C73A3001370C6088C47FB5E1ACCA2969D5BA9D8B91766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e4ec58c52fb76e93d64fb030b01b220b0cd9d94923c7a7998fa3ca7a8dbf972
- MD5 228f7c41282d0a69587458d9418644c6
- SHA1 84ea8e998e2b983be895e114c8fadcf8e17868c4
- SHA512 c2f206cf583e9adf35a4ad80de4535afd5f148fa4b30668d969e8816665f4da5995b74fe26cf93f22f628db9f09c31171cb201c1d1cdf327feba97d07c221eee
- SSDEEP 384:BMOna4ifKQtuUvl0BY0iYUsBQcrwTKvh6GIKoIufWmWGfN:+KQtuq2Y0lUUvr0pIufWZ+
- TLSH T1E1821929539583B3C6FE2BF65D72E1A043B1D211CA07EF6FADDCB0AA48933528741791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e130b25e25828eb70036d88b2aa5868a47fc6ef7df83ace8ed9b1ca050fc0500
- MD5 5730cf046b935543bc7b871d411edb52
- SHA1 00b9d0621091d89ce7dc8cfed61b25bc8491ff1b
- SHA512 926818bfd0104b8c75e1537ec6f24673bbdd4d2efea33e669805e5b058e9d2b2352288b4ea60aee2034ed1500dc102e4daa3217140509da5f95813dcf14983f8
- SSDEEP 768:7SyQlmUmBlEuPuXfjq2sgDrNjfcVJ5sxVeEWqPkmV1sRduobKhJLGEY3ZsWmZ:uyQltmBlxuXfjq2sgDrNjfcVJ5sxVebO
- TLSH T1E3E2180873E8C654EEFF4E759C3565600372A0839D57F79D0AD1A0AA0BB3B908E51F93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3a56127a1a31996ed51c202a77a4814108407e3d78135557a22f90850ab2288
- MD5 a919838fc8f94e318e8cd5d31fdb911e
- SHA1 46512b79dda369deca849349c44e748a981ff336
- SHA512 9f83a9804c350f1befb913703c0c39c2a30d2b636649fc94fddc27511fdf014adbf0733a8f0d342df769e39a81ad5cf06f8de865819dbd325fa24f5efd04255d
- SSDEEP 192:pph23MhInehHXpqRxry1/X7eOFXgNTer149iY6IW1mX/YvXa77WLusU:+BeJGxy/X7eUSTe5Wi2X/T/sU
- TLSH T13F522B9863E4837DC6FD0AB35C73B2401774C705EC02FF2E1DE860A15EA7A99871276A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20058
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b5f4dd71e4fcd7703670e888bf1d2eaf1a5c7834ddff50b869044b39a2e07da
- MD5 82bfe3551669209ba9ea264d41a17cd8
- SHA1 c3b9dd7cbec22d07f47605d4f3d740a8adea4020
- SHA512 05c6694bb725a0d02a5b5d2ffcc868e86b935778a048392bbe51c90f7a6b60d4cee9dcac3bcfceec026c5afd4c2fce11a4e19445f591b50cda2d0e5abbdd974a
- SSDEEP 192:KXpS1QWlPgiqdEquP+GGO9mWbpGkjgyaYcIW1vr/8T4U7aL7+WLEO0AhdW5:K5cjP20mWbEkUyaYir/o4JL7W8
- TLSH T1BF32082DA7E18275CD7E0E7248A7E3010771DA44DD23FB2F56E4A10A5D7B38883B2676
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f31e59350ab8d78919d064e17bb9c4b4e86cf9942c0060188bda7e9bff578e9c
- MD5 ebefb5995e4588574cd92e7048070308
- SHA1 c81e64f8614cefd02cf0e5345e17bf23cc1cabd4
- SHA512 ad48ee5d65f8840e501e74665a77a59cfade1cb78c027f60bd3cc888b858282e42c23716115488fe3f61c7ec211fbed18fd8ef8586ed3ff1a46413acd5a4bb2d
- SSDEEP 12288:Elr7BUE5n+/zlbI9gJvjEWKgpKhGOXoDDDp0b:ElB5n+/z1I9SblKhGO6DDp0b
- TLSH T1B8E409203FE8F01FE29A73B6D4D187214BB4A6427296FF8F258446E81C937895C594BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/FilesSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0485f40ff9646e4fe5f79a842d680e2ba5ab96a7dc74a2e3d557e91f6e3a35bb
- MD5 5453702f3bc9b3d8971d48ea0a9d6114
- SHA1 52f8c00cdd687972d651278f3397a596c4c4b0f5
- SHA512 0dd473936210fe7669d3adccd663b50ea20c905d4dee60a857726859406c0cfcafed8c53e7214fd019b0c956018ebf0e0242de770f7ab6d95f73ef97268133f8
- SSDEEP 6144:WAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/0uhg0B6yORUlKL5i+:3VUpnkZ7slS4Ys50ie6Cf3g0PT6s+
- TLSH T118A49D412BE8C647F1BF27B2C0E252A1C7B0E455A62EEBCF5D8424EE1D17350E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/HBrowser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a8ec5c5e44b81766bfa93eded535484d3f85fa026bda7a5492ab0665557b9e42
- MD5 02630e18ca44a1b38558156d0a6de6f1
- SHA1 d4813541cfcc106f190934d5392b5179d44073a2
- SHA512 dffa9a4c84d195349fb1e88fb097b77829cf557ee229bb59ca42cb28c588b6976b1016b382597d1fac31a624b009662db41765f7eceedb26a415074daacc16d7
- SSDEEP 384:Kp33X3L5/QrX8nB9d13+6HGLReMWaFnp9l/1DRVTbg0Ut4xh+7fYMoKABnR:KR3nL5/QrQ13ORR9bTbz+7YMoFBR
- TLSH T10FB25B4967F49630E1FD0A7598B367148370FA935812EF8F0BC9641A2E3B7E446247EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 053f0276f94591724487dc51bb04d15a598a8e608ed80a2b6c1b7c8845095531
- MD5 4ec65b69a58d03fd95a25c1678e9367b
- SHA1 954d85f6c328d4a4b48ac090f17b640fa6f54e97
- SHA512 14388f53efe1d41093b45b108c44db8f32fd2b35907950476ee603c797d4175b67d067f7d0e656b6a0bca538b1d392bb47867d1a47cefb1b997dd6b18bfefd77
- SSDEEP 24576:UrKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:RHZ5pdqYH8ia6GcKuR7
- TLSH T166851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db44feac5462370d1b3b7050806509684acf3e2fd804c1b2817867c44441de25
- MD5 e608fb6e14a699106e9cf1d1f5e4ae91
- SHA1 835630b7128e29052db9b3784cf9d6ca5a8b1206
- SHA512 053b744c88aa0450460aaac24107ccdc724bfa1636cffd308993331a849ffc2b0a5f0abab1377f1a39dce8835641ed9de73d417851e15605d2172c7996e1ba47
- SSDEEP 1536:vqhezETwSM9jwX0o71Us5XttkzU3mfICaRUlh:yhezxpjwRp5XttkzUMIC2Mh
- TLSH T1DE832889A3FC4610F1FF5B7598725A204BB1F5532932DB1F22E5906E2F777818920BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/HVNCMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f1f362067d0e613b844e961c9b5c380f95cfa1333436e3431ee3accee1807804
- MD5 b4e4c31850ab3d32f71fabb658c77c26
- SHA1 2071c1d767d4fa868a1e48438d862a98b42b7251
- SHA512 4a9c506b24b6e3d0aa03a1d15244507318e1303c0f7790db735be4ed056488da39ccd07c27ec8b3617bd951335e670d1dd9d5131016b7c9d32236a05cf418533
- SSDEEP 768:xEyXMCBlQ6Kms0noGYMyKgDWj81Y6Mnx9oQog1zqGnf:xLXTa6bX81Y62o87
- TLSH T1A0034B4A77FA0221F1FE0AB5CC73A7289331F5934516D70E2AC960696B73682C510FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/HiddenApps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f24e2ed2972d3987bb189fe69830ab8a4ab56588db0ef0763145a78558abebd
- MD5 ed681170501c5728202e0eaef0c156e5
- SHA1 119eb6e56c58f0e5d7faa06a993be01db378804e
- SHA512 c32d3d21e3d1082c2b2063ce7d5703817376d8318c8720908ec38c64c3bfee1dac54a531c0537a66e0f5e65ce63c12a340ccc416f76b3ae76391dca2baa841f4
- SSDEEP 768:kEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ff+I1:kdmvWHVGMVwtYRtpl/x5qIXdEdX+w
- TLSH T1F2233848B7F88620E1FE1B3AA87363149374F4A71A16E74F0BC6A0592F723C45758BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4095ed7530b08663ed77d4adc03877a6676aa9f3b815b0ab2e0111d4e74f95ac
- MD5 c282a450afd60bda7c81370a8d031445
- SHA1 1a16d6e6584ab286ca6dc9f6f199b3d348397a00
- SHA512 d2479a6642c55a6a3cfb61696a3845ebef8a67b0db8d58e5ca36f89d440e4276f98cfc91b64dc31cc494a1a4ba67df3b5f453cb4727c51161376dbe7f2eded38
- SSDEEP 384:qCUEeL4D574MvGjydqXwxDJlw0n3TmyxhxJNgSg4eOF6K:qCXeL4DSjydqXwx1lZjfNnl
- TLSH T102A22B5837F986A5D2FE1EB14C32924543B6F60B8C12EA1F2DC8909E1D63B84CB55B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f4053d5294926f252bd07de415583ae89fb33365e9b50b69d3984cf18aefd640
- MD5 06e7bde6ffc48a633538c759bcec809d
- SHA1 a78107d2d7613c51cff3ce96c888652f879ff5f2
- SHA512 4627cb9ac9d33fde141b6042cb725dc3956bd428e2a2d7e27f6b06e6992d842581c6a10b42edea0ab39214fffc2c658d58253f48402bcde190c7057d38fc8b60
- SSDEEP 192:fJV/HNfwK5RSpyv3RFRtO1Lnq4Ur1XneDN6IW1Y6Uph1KCaA0UbnFWL2qV:DFl5Rp3RHtMO4U5uD8Upma0y3qV
- TLSH T108823A5C77D08379DEFE1EB2583363011770F2069907FB2928EC61664EE3A898751AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 462ce8f5b736dee1c87cffe2194f3327c69a654908c8675955aeb9dd39f1a37a
- MD5 0e243d4e6a5cbcf05d1c0c57d4ecaf62
- SHA1 a1fc91f268f4e80822fb38b0a636fe311865bee1
- SHA512 e84112ec0432439c52fc476c91a77ca6fd7a824700dbaa2b9b3761d807a110e5f53c405805507f63d30c0a2e23ce1c87ca33e0ca44fd750691d953fe8846582b
- SSDEEP 384:XBqmqunML6thaujkS4jtepa9BX/bD3F2:XBqmqunML6JkX5x/XV
- TLSH T12A622A16E3944276C6FE0FF65C3262001776E609CC07FF1E2DCC10AA6D6769B8E657A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/MessageBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c4bb8556013e6eca190a442e70d0a44077ded2e51719864884b36ebc63655a8
- MD5 7f080f724ad59ae4737bab66bed2e3e5
- SHA1 8080755a4bca35bb42d40f80ac687e34189ad782
- SHA512 4b247dd0699f37cdfdb8602c12142312bda6df0938553631cb9e79f450f42975713d0e1f2e84451056507e9494e592bb61118ca551629530727592aad85568fe
- SSDEEP 384:D6lIccn3tURnUuRUUVT/95gG3UX/2ZKUW9:D6lIn3tUVbVa/2Z6
- TLSH T1E66208A977E08339C6FE0FB25CB262405771EA099D02FF2E5DD850525EA7984C760F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20962
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4a238bf470277f1947e9e5383740d925148326f3cb85b6e41cb3587fcd665aa5
- MD5 3f62385887eb9a8b2645b553891dc278
- SHA1 4aa5083190cc732694638cc443073824ffdb2739
- SHA512 13066350eceadf607f697f6f99790c8e0c7db030762ec16db0a80bdf149e0808f8a8459a8fe24fab9fde34d8383396acdc7c9d317c00972a2bc136731857ff08
- SSDEEP 12288:f0OeMv3MrIb8CkZK2bg3WiPLnzrq4bDwsXP:8Oe+WIb8CkZxbg3Wgnrtwsf
- TLSH T10DC46E11BFD4856BC06F33B1E0E20B2B57B5E48A7726EB8F14808AEA5DC37525C417A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Ngrok-Installer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 806c6b8eb3e1e2538123215a874f9ac8a4af3af7ea6b2b6ccba2c3fa0c9e8937
- MD5 c7445657888041b2321243cd8dc1c230
- SHA1 8e7beb106e6c2ad8a7572aae29501452520cf47a
- SHA512 74397b6a12053144d5b37a319cbf9ca40d1b3f72b5a3adc8cc5f329cc6d6a8097874b498a644fe963f3bf05f5276e9e068d8a5568bc5828b01b5173d4525933e
- SSDEEP 12288:As6T2x75lFR/RG+BUKPqnwoCuYKITu8/M:AEB+4+1CuITL
- TLSH T1D8947C107FE0C63BF1AF97F1C162419687F4E05AB79AEBCE6C8554ED28423509A163E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b10217db23a2ea160e66c154bfab12877b31cad84dc5e69a5aae22a3e1c41a7
- MD5 7684262a187122432035acf0665f8171
- SHA1 2a66ab7f5fd37940f59ef42bb42d7b95acc6f063
- SHA512 5b4528fac3f4fb1b67cec5657b6191c0aa25174657ca66fe809dda4d58acacb950b653827e46b9ad1a965e55ae73b77c9e1c399da61338e92aeeb47eb845404b
- SSDEEP 768:gLxkuz7dDCH839Aybgkf/sGRNW9Z9dPjc8:gLNHGUZbgQsGRNW9ZL
- TLSH T111D21A017BE84629F6FF6F31EDF622158E36BC4BAD22EA1D0890101D6C73694CA51F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2379d51a088fe576b782ec0fa24794b11618be60f25a7c59410d9663830d9020
- MD5 e0350c0783ddf1993b91948badf43d23
- SHA1 38673da547676acca63367f7436f259704f7264e
- SHA512 729b1f4d02bd946891c0cda0b520baf0e06078a94058909fde058d172a92784799ac2d971d0dcb8fccf8df37c2620b5b3bad83a44a5a20ee21bf523e8c2c0c9a
- SSDEEP 384:PK9Y5jI8MYODPqePW1vepi5zOY7//fNSsA8/h3U:PK9YNI8MVDZKWwr/3A8/hk
- TLSH T1938229255BE48371C6FE1EB248B3B31003B5E242DD12FF1E49D86156AD73A85C760BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 00a018de14d33724892424ed1d97ae3447badf08e27a45fbc96d53642d65ae0e
- MD5 f8eb3462b280a9ef61314f7ec6e015d1
- SHA1 5e9c2e0742a213584fe707e0cb4db586c1f093a1
- SHA512 5c33ffda423abe2648c2a4be319ad800199b2d8f4f01de60b6a6ceb716f1ecee002d92ec39e97cd0e0b8301cfd5082dce802a86f8d179b266ef099361f08aa8e
- SSDEEP 384:5tpW2/E3moTWD1XTgOw2QxHN7yVp7yQ+:DY2ImPRDKH/L
- TLSH T1D9723A19F7E54376C7ED0EB24972A20117B1DB029D13FB2E4CCC70A64AA3A988B51B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f36790459ffdd010c4fffcc23d72f8d7d8ce150422e5c9fa569d4bc17e731cbf
- MD5 6e64859849f337cddcc621b0956dfffa
- SHA1 404111ce0a235ea75caed894c6291d41680c1e33
- SHA512 93b0fe6e4b03968b9315868c9c59a264d7928da6fd0c0b56c3399498922625cc7a19924e15b146fa16ee7cef026da3d9bd02a1bbb700f61ccb82101e6ecb1f95
- SSDEEP 384:IRdqZXY/oSd1PTQLvLwLadRtZa/rDvDSQUT5S97/Y5bLOEYQfwrpn45rDhvn1kAY:IRdqZXWrQPkQtZqrDrlU+cYY1kAvZ2
- TLSH T14D921859E3E4C3B1C2AD0E72547356510770DB018E23FB1E5CE8B0676EB36E98B22766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25290
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c7e44eba568d34de6b7ae7c588446787e84f16157e1e6ac5f872047d031b7573
- MD5 15b97f062f294a29a201d21470a64154
- SHA1 94362831bc518ce8f50cb9c5e8822119aa04ff7d
- SHA512 1890148352232a6409f8695c052f353d15bb5088b6d520c3608b1295f1aeea1a5b54d81370246294a61d1a3310708a396aa935b082e1ab4fddb25cb6549c761e
- SSDEEP 192:a3eKcfO/TCOAOG+uCno9SFpoFmGv4O4FgkT8zr1P9YD6IW1GX/V3Qd0y5WL2Vb:xPG/TCXF1STSAdnTu5lYTX/NQKy7Vb
- TLSH T191521A59B7E48379CAFE0AB25C33A2411B36DA04CD03FF2E29E851465C775948B51BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d0c55436dcd3751bc51d05e10a73d7a2a80f03ae3ee5c22ba0eaac61693b403
- MD5 2522f0289cafdb0f1490a25548e2d4e6
- SHA1 5cb5f765ae68cb383ed8f42155971f6bcd31775d
- SHA512 c2e953557151a4158ca475074ff80754f2cc64b482b88eddd25f5c1ef3914fc1b10ed724b47ff0293f882192fd0111fbb1832d256278711aa3a0d58676c7e34c
- SSDEEP 384:QVSO27QJHvpebFn0LC9Tk7fxxOi+ZMuqI+sHY4k7EqeEZuQZh:QVm7Q1vpebF0LC9TqZlj7Htkg
- TLSH T13F92F62D63E0E175DCBF19F360B3D25103B1DC35A821F62C7ACEB0AA1FB21494295E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28ab8b6aaba021460360910909c0fcdbc6a593da96a9820a439550ae240c18fd
- MD5 c28989d92cdedc1ef5f0d27a58190633
- SHA1 ace46cf680ce816851a6cab8866b6eb1977b9f64
- SHA512 321f4855618379862667f7890be2c813c4f26c0477c31328e2f85830e3604de54100cd14054c22e9cefd7fe4a29bb1838a3ae4b62cb023dbcc824e0d3f42572e
- SSDEEP 12288:alwS2DXI0GVFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbB:iwSmHGlc805jbmbXM7g8+M9JC+
- TLSH T126354B507BE8DA17E0BF23B1E4B20A451BB4F851B3A2E74F544861ED1C62384AE553FB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1157622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9e0d4c4038031b454f179637228c7f6911a1f3668c6c6da9e24f89245785776
- MD5 d87ebb619cfaed423ebf1103aebc5e75
- SHA1 40b855c33a80aa8181f4ca3224cc821e7a5125fe
- SHA512 395b2cc0f4cc6fa9340ab32685bae26ca1714a270f2bcfa3308752015496bc52e1dbb0b0084df42fd705df315073886eee8899aee6decd28518fe5d8d24ae877
- SSDEEP 384:wZAOzwQW4pmewuYvpYr3fer9A8/VlQeZ:wZAOMrzYCA8/VX
- TLSH T104622A9AA7D08332C6FE1BB20C73624157B1E605CD07EF5F9EDC10A65E132ED8741669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e1d9460e74aa120b160941f284c09563ba5e75bcedc2006cb750793ce5bc3bb
- MD5 ac409e8856618c3597647440d5d2ddc7
- SHA1 f5df61f6e0e88bd63ffb29866dc86b4e980a0191
- SHA512 979f77957995f775ed268a24b427cfddf87c5a647e68435a1fdf2ae2e3887dd24e51311690e941d7679037ac91562f737f69e762baedbf9d63a11ce3d90752d2
- SSDEEP 384:DKr81F+CoNFZpeg7qX+mKBERFjt9l/C6I5YxBXWSeVFjwJ:WTvZY4gDRbXBIjY
- TLSH T107824C1D7BE48379D6AE0E7948B3B3011738C2099D43FB1E4CD8A1A55EA37C98B717A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/ResetSurvival.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8d04215c281bd7be86f96fd1b24a418ba1c497f5dee3ae1978e4b454b32307a1
- MD5 4b6bfd7589b54468c38a9800ac70d781
- SHA1 940d574b867862491320b924e93b243755816282
- SHA512 fa076a680fde936005ecace99d93b1c06b84411507a787046f044f3576aa26452388a369a0f2bb45cd08f782c7d90b9d61af9c6c91c8b6109c5ae0988519c606
- SSDEEP 24576:PCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:67uRfbQswUZcSByYGv5u
- TLSH T13E759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1632318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8166f7b1a098f4150bcae4daa54c2e4721ead52037012617baf11d076f68b91b
- MD5 be9cb8766769017d2e90bce46c4643e5
- SHA1 304a675ebb8834e499db45781bfa49bbd0438245
- SHA512 81bc61522e75ba1213c35c1bbcb352cb6d7cb03929692300872dfb2a696f89909dc248e4d091739e6eb150515099114dbfa10fd657e31ad67aa398a25d47c723
- SSDEEP 384:MNsDP9fBkZ3pBkHEk8GZT8x35UzTNnrYFXoMZlS96P4T:MNuF+ZZ+mwTI3KfEoMZQ96PC
- TLSH T1EF7218AC67F08375C6FD0BB34872A2026B71D605D853EB2E5DCC70960D63689CB84B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Rootkit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a0c1f70af17bd9258886f997bb43266aa816ff24315050bbf5f0e473d059485
- MD5 25e304f15acb97cab8a6b685d8c8ef05
- SHA1 a96135197963d5022ab03b538adf587539e108fb
- SHA512 73c1cb68bd138e8283afb21c1e073af0aa3eefd017e796f14de4d0fbad8c87c5e816a00435259d67839e463c64dc451c033a7cd2465787af6ec017ac1b3386c2
- SSDEEP 24576:ICs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfsHG28jZ:T7uRfbQswUZcSByYGv5uaNS
- TLSH T19D85A062B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1815790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 98473df6863c6392bf332d115a632ed7b6898bddcc7b6479cf8ce76ccf0eaa07
- MD5 4872b8d860a680c28769a79ad0248fea
- SHA1 bff9a4524537a31354009e76e6e6748099d362e2
- SHA512 acc3b357f68e6cd2350eb86a20430a962ffda5408fd3fa14c2023436ce492d1716965e82663197020e5cbfa8781ac71726867832a9251da2a91bf9df641dd257
- SSDEEP 192:kbfqh94qfL9XFw3l+LI+GGOueq1JtSnIW1fUseFpoRWLuU:kbChWqfLjNnjJtGUseFpoxU
- TLSH T19E32091D43D4D679C9EE0EB24CB222811BB6DA458A57FB3F55E4A0261CE33864AA1731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bb164afa7335b299dfff1fd8b6e547c9fd660834e71e84e9e5b57ce21ea42d9d
- MD5 4c6c646c1bbf7f941f92c03a16a5ae20
- SHA1 bcfbd3018705e5f927db33f9a95e8349de8f0534
- SHA512 6b9254dc7a5e03b2f959fc0d0288c364c9202bd11b13b98da7b96332bf6c7eed38389f6d9331f5103b98d23f302f398d05a684af6b063cd80c0eeacdf3e8df16
- SSDEEP 192:wFAiNLB2n5QbRBiMcs/XAaICeMzrOFsgXTZr106Yq6IW1yShrMX+W2WLu61Jjm:viq5QdBiMn/wpyUtTZ5nYsShYLs0Jjm
- TLSH T171621A6E63D8873AC6FD0EF24C7393011B70DA08DD12FF2F2DD860565D63A994B61A62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ca3982323879e0c719c37a52c8463d1a32053374f6b4095cc2398c53a36685c
- MD5 605794f9edbb0f012a151687f65ae150
- SHA1 a0e06b7d29dfc56031ab96b67022942577b235be
- SHA512 0ab63e249cfc68c5343c0d47ed9b64e72e29cc93667af42d52a2f8dbcfa4a1eeaaabc141c88969aa5b3001217a926aa7a93ee89cb16121e9f2fedcb71605ec8d
- SSDEEP 192:jDXwH3m0L3G33Kkw720sM7f0q0dV2KOFBLggT051i9Yd6IW1OU1YogPbszgL2T:4H3m0GqHT7sq0dVtUXT0HoYpU1XgoDT
- TLSH T16B623915A7D18336C7FD0AB61C73A20147B2D704DE07FFAE6ECCB0960EA72858A52261
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3aa8b50622fd034f6fc2864af22145f6ba7f9647781a24987ede1b77f64e6f90
- MD5 8c6634d62abcb67de46225f0d03bd9ff
- SHA1 a2e0bb103b47cd18a7ee8375dfc9cd76fb73c86d
- SHA512 5c7d2eb0e1b63c219eeabf913a4f9127b9a7ce0360fc9f3a0c3f6415abc7ca355ae92e3ba7c396e997bd38ef777c875e50db77b399668dbe618f230c9cd64ee5
- SSDEEP 3072:cITmgSRcBHAt+yM1KlUKEHBAnpK37nX38KBOQv174SyohwsKdmikTSme9DpR0cx2:cMmgSRcBHAt+yM1KlUn8g/T3e50c
- TLSH T158144B4067E4CA2BEB7F13B5E4B216107774F04BA622EB8A788C15F95B2334059167BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d8991bf961f1ad22aaa2f122c76c040dd57aaab7a5b8d5b2668ca43de07e71f4
- MD5 61dbc3318bbccd995a2031535a113e57
- SHA1 c4a47b7dedec99c83ea9eecfb4d8a7952736b499
- SHA512 8db6b281045d868e81591d0a827c050d7a922be9dc3b36b2da6ca2f227d733f756f5d464c9bdb3352ba5bd7e6a05e4a6015d7b8125a86ef1384bd0f2ef255014
- SSDEEP 49152:USsvTbt3wiQB6nenuS2L6GbriqeGAb4TkyNej1DxRdo:USsbbt3wiQB6nenuSjxw
- TLSH T114F549087BF88B77E06FA7F295B1051657F4E45AF3A3E74B2A8066A80C13B006D5537B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3453386
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/SteamTokenRecovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6db46ab30d7a465094dbf3f464bdee975ecfbd6f77f9b0e2517cf1031dfbe762
- MD5 d24f704c1748a5821915c520b00bbc63
- SHA1 01ec915e89be32f67a8c8e4a2742cb5d60f41294
- SHA512 8292355abf73b73edaff768bc48d738725f6a5adf5e50648b385133bcf33e124f7c9905379f8265d0c3d7bf2e27dbd1593ad328b5ae0233891a3fe318a2f28f7
- SSDEEP 24576:aCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfH:x7uRfbQswUZcSByYGv5uF
- TLSH T158759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1635758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e2ad8c720cabc10d5de0b5de8065eaa682a670b8dda95812c2be26b429485d7d
- MD5 3b1feea26fd2915ac343165c9725230e
- SHA1 0b4e79d0df6ec7dafdb84db3fc7c16162f0f4fd1
- SHA512 e727289d8e185be6045f2e41da84086297bd7145c02b0a794ea192a329ec0663581208829a67d799a6c50c27d703d7202b942522c308746d652d4a327ad38396
- SSDEEP 192:+FaPxrfOAHEWG3/xvoQCd0UOmlUbOayEox0GTeA19Z/J6IW1Gz/yIY8XKuVL2n4v:n9GAkWIAHO3FyzTeej/Zz/CT4v
- TLSH T10F72170CA7E59239CBED1EB218B3A1010378D609AD07FF6D19CCA12A5D777984B517A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1cd9041d2dc4a01c26d6de5362a81d59caf01b8700c388a862d09a8c8c889cda
- MD5 a1945391150e465f7d6060ae07328b56
- SHA1 d658fce23ac32829d7ae3d8dcf77dd34f1ecc9b0
- SHA512 afadb2d4662d8b6bf9ce8c062b60f9338bfcd299af88d3b46980cca987d33b3f3df18952b113079785cc7771d1d14f2a5a15aa9a051ae622e920227d99b26df9
- SSDEEP 192:AcqAWYKDF75yOGOko8bZfmgyOYkIW1UZ/Xvjljw26gEWLW4V:AnRNF75yrE8bLyOYBZ/XT6gS4V
- TLSH T1B022F82A67E08335CDBE0E325C63611107F9EF05CE33FB2E58D4A0895C6365587A2B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/V20Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2b507d3ae01583c8abf4ca0486b918966643159a7c3ee7adb5f36c7bd2e4d70e
- MD5 fef068d49d6bc853d465fd5723ff3f4c
- SHA1 e1a2b12412a1468e0b572ddb48c65f5ddffefdcd
- SHA512 06798c658c351eda13539292f731dcf3a851d53e2fa6349c37582b9a4d5e41d0470f4a49f8684130b7aba2156d41d024b530bff3ae3ccc20736f2c4c03fa42d8
- SSDEEP 49152:ggkeZAyUPrHeh07ThlBUh7//4u77cIAUX4KAs7uRfbQswUZcSByYGv5uwSuV:p2Lq//RfcfKp7ul5SxV
- TLSH T17C16D016F7D985EDD1A980B985B79909D6F6F8440B25DBCB22D90B2D2F333E01D3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4124718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5720087dcc8df1380fa31e3b4afde26145bc657fd72df2b95ca637ef0d018545
- MD5 daa245f490838ee90e8c196023bf2a96
- SHA1 b30786cc7a4b2b10a0aa88eb5ab30c118f431954
- SHA512 751ba66891cf1a5b65b9150481e28ee517a190ffd169defe3d7fb522e123b2007ff3f854942923cd1a2bdf505a461a4918a24f45fe75bac9040fafbcf607fae3
- SSDEEP 192:qESp/+S2SoWSO4A083xaUWN2xSSZOCeJyxlTer1c9gotlF6IW1oXxvZaY4cQWLuN:I3SO4aApNAS2feyTe5agIXxvacWN
- TLSH T1A5621A1B63E883B6C6EE1FF21C72A2011375D6159D53FB1E1DCCA0868E63A9CCB51726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/VoiceChat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89a6c1e5492406643f569339a65172aef7567c1bed4be79930f0a049ceb4fd6a
- MD5 a5bdd8835f0c8be110795f173c4d4ee7
- SHA1 bd89582db511cff432abf88264d0fc82190072f0
- SHA512 b21d94d6fd0cdaffd350d4c65640bd4b2ab422fea46707a78f0d153d4eb7189a71b63fcd8f4cd88722f3298cc5f915ef3d1d163813ddcbbba327c3c77bc28d51
- SSDEEP 6144:rkcVpiCslfiJOBvKbfaIKlEtfb78+SmmCENCTC7CbRg9BAhqEiFlbyj85lJwyP:QZjp8fIlEZbg/AXVmbyQ5ky
- TLSH T176C45C11BBE4C527C46F33B6E0E20B2E57B1E486B61AEF4F05D09BA91D877464C41BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
557690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 253cde86bf27b61326a6b375b7664e0c5ee2d5f7256db631b939b3ef44a7bfd8
- MD5 9699b6e3f409e47750aca603b920775d
- SHA1 961f00b84b461b7fa89ca17cae7e2c8a230cee85
- SHA512 2ad8307c4717c547c3b780c1d1edb13006c5c37ba16fa239b98de54108d74a754c237dc100c9f4be9d8a0745d74fb723c3d02f0687cf8e1aff5e7360a81b2d20
- SSDEEP 12288:Zyw8KX3HOt3qqDQkoJBBi3bgtPblvxGffjL8R:Qw7qDQkoebgtTAjo
- TLSH T1D7C46C12BBD49527D06F33B2E4F20B2A57B5E48AB316EB4F059096AC5EC37815C41BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7fb8e028ca156af17874a33824122b4e0fc991534740e6f1941f63cb3847c620
- MD5 fb3d90aba62bc3ef7c1592eaef0de3d0
- SHA1 8b10f75ca0239c7c9f9224e2cb0525fb09dfb8b5
- SHA512 e80f8ae80a38536ae2688f1f164bae8c499ee588d5c6d46c04e7a444c68f2f26e0a267bdef83038da22eb0a51c2c60b73affe6ae491b409615f7a327d138cb19
- SSDEEP 3072:dA0ynWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJq:d+n+22fFcgBgakL320zYZHpMXM/O/
- TLSH T123247D06B3E5807AD5BE4A3588335A199779F8118B71DF9F1B94026E0F633C18E39F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Plugins/WindowsUpdate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f279a3fed5b96214d0e3924eedb85907f44d63c7603b074ea975d1ec2fdde0b4
- MD5 42c76f1205d21eb41ccdc0cdd4f4fecf
- SHA1 6890faa814977fca7b2d06d92c7e70956f2fe99c
- SHA512 4a7cdc8666a37879d0103ee7a01a7b7125a368e22a848e3f7c2ccccc563b862322f4a1693bf2fb6a525091f66ef36ea30bbe720e8cef89d307d988a35588c7ba
- SSDEEP 24576:6Cs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:R7uRfbQswUZcSByYGv5u
- TLSH T17E859F22B6DAC1B9D4EE40B9C97B951AE7B6784407348BDB12D4176E1F337E01E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1719470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V6.4 By XHubTools/System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 8, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
136114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V6.4 By XHubTools/System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
103866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ