XboxManager.zip
- SHA256 6f5808c255596447cd55b2d44febb42f867ebe91837634475b7997b9aaf2426b
Overview
overview
8Static
static
5XboxManage...et.dll
windows10-2004-x64
3XboxManage...et.dll
windows11-ltsc_2024-x64
3XboxManage...on.dll
windows10-2004-x64
1XboxManage...on.dll
windows11-ltsc_2024-x64
1XboxManage...te.dll
windows10-2004-x64
3XboxManage...te.dll
windows11-ltsc_2024-x64
3XboxManage...ne.dll
windows10-2004-x64
1XboxManage...ne.dll
windows11-ltsc_2024-x64
1XboxManage...er.exe
windows10-2004-x64
3XboxManage...er.exe
windows11-ltsc_2024-x64
3XboxManage...pf.dll
windows10-2004-x64
1XboxManage...pf.dll
windows11-ltsc_2024-x64
1XboxManage...nt.dll
windows10-2004-x64
1XboxManage...nt.dll
windows11-ltsc_2024-x64
1XboxManage...er.exe
windows10-2004-x64
1XboxManage...er.exe
windows11-ltsc_2024-x64
1XboxManage...og.bat
windows10-2004-x64
8XboxManage...og.bat
windows11-ltsc_2024-x64
8XboxManage...01.exe
windows10-2004-x64
3XboxManage...01.exe
windows11-ltsc_2024-x64
3XboxManage...02.exe
windows10-2004-x64
1XboxManage...02.exe
windows11-ltsc_2024-x64
1XboxManage...03.exe
windows10-2004-x64
5XboxManage...03.exe
windows11-ltsc_2024-x64
5Behavioral task
behavioral1
Sample
XboxManager/AuroraAsset.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
XboxManager/AuroraAsset.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
XboxManager/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
XboxManager/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
XboxManager/System.Data.SQLite.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
XboxManager/System.Data.SQLite.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
XboxManager/XboxEngine.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
XboxManager/XboxEngine.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
XboxManager/XboxManager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
XboxManager/XboxManager.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
XboxManager/_db/Ookii.Dialogs.Wpf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
XboxManager/_db/Ookii.Dialogs.Wpf.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
XboxManager/_db/System.Net.FtpClient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
XboxManager/_db/System.Net.FtpClient.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
XboxManager/_db/XboxUpdater.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
XboxManager/_db/XboxUpdater.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
XboxManager/_db/log.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
XboxManager/_db/log.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
XboxManager/_db/xb_01.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
XboxManager/_db/xb_01.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
XboxManager/_db/xb_02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
XboxManager/_db/xb_02.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
XboxManager/_db/xb_03.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target XboxManager.zip
- Size 16.6MB
- Sample260730-ha8f3ssdkc
- SHA256 6f5808c255596447cd55b2d44febb42f867ebe91837634475b7997b9aaf2426b
- MD5 e936d8f65a3be822bf737d248b186665
- SHA1 233d76276e142af6b88a50fd2a0b9ed318cdf6d2
- SHA512 cda15af7397ea85fe1a39f36228d55faf69cda66dd04e1e91081efd3e49b25565c6d8fb3cf7bca04e22de2c556de534218503eac1e9b4aea8e33978aafe88cbd
- SSDEEP 393216:uBH6WwjY0FVSwhQx2Br4foEzuRkS3C8WmM40n1DdLrI:uctQwBrIoEzMSkr01DdLU
- TLSH T12B0733335CA7BB21509A23416CFB00E924BB97BDD474A9DEA239252C3F4C4BC9B57748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/XboxManager/_db/xb_03.exe upx - Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/XboxManager/AuroraAsset.dll unpack001/XboxManager/System.Data.SQLite.dll unpack001/XboxManager/XboxEngine.dll unpack001/XboxManager/XboxManager.exe unpack001/XboxManager/_db/System.Net.FtpClient.dll unpack001/XboxManager/_db/XboxUpdater.exe unpack001/XboxManager/_db/xb_01.exe unpack001/XboxManager/_db/xb_02.exe unpack001/XboxManager/_db/xb_03.exe unpack002/out.upx - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/XboxManager/_db/Ookii.Dialogs.Wpf.dll
File Explorer
-
XboxManager.zip.zip 16.6MB
-
XboxManager/AuroraAsset.dll.dll 111KB
-
XboxManager/Newtonsoft.Json.dll.dll 704KB
-
XboxManager/System.Data.SQLite.dll.dll 1.0MB
-
XboxManager/XboxEngine.dll.dll 94KB
-
XboxManager/XboxManager.exe.exe 16.7MB
-
XboxManager/_db/Ookii.Dialogs.Wpf.dll.dll 105KB
-
XboxManager/_db/System.Net.FtpClient.dll.dll 79KB
-
XboxManager/_db/TitleID.Json380KB
-
XboxManager/_db/XboxUpdater.exe.exe 296KB
-
XboxManager/_db/log.bat.bat .vbs 12KB
-
XboxManager/_db/xb_01.exe.exe 135KB
-
XboxManager/_db/xb_02.exe.exe 1.1MB
-
XboxManager/_db/xb_03.exe.exe 184KB
-
out.upx.exe 438KB
XboxManager/AuroraAsset.dll
- IMPHASH 110701f6d7db02ae4d6bbbbb5c72f005
- SHA256 adfcd5fa3344e27b48c624f9b787a625ef3bab02085c02f7719f93bb89c75912
- MD5 cb7803773af0211bd759ff2806c7f924
- SHA1 903212047701dd8df87aac68d8db99fdbd148496
- SHA512 7bbdff3d957f419748419a8d48a69b43e4bf3d1bb9718151dd8e945751494d0088ff072778be8e84e1edb58740d7bb081a76a6fcffb1838cec954b2a5432c1ef
- SSDEEP 3072:gin8AR53ijiExhQ3uSqo2E/oTdcpz+Zs:t8ARUGErvTVZs
- TLSH T187B38E92F7417431D7ADF73F1612B61EB76106220922E1CF2BEC1B5E6C709A1CA527A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
84236
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Development\AssetFile\AssetDllTestApp\Release\AuroraAssetDll.pdb
kernel32
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
EncodePointer
DecodePointer
msvcr100
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
??3@YAXPAX@Z
??2@YAPAXI@Z
floor
_CIsqrt
ceil
memset
_aligned_free
_aligned_malloc
memcpy
ConvertAssetToImage
ConvertDDSToImage
ConvertImageToAsset
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=156, productName=VS2010 build 30319, version=30319,
count=7, id=158, productName=VS2010 build 30319, version=30319,
count=12, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=1, productName=Unmarked objects,
count=30, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
XboxManager/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
- MD5 24704261e701b49b51e40c1292ed149e
- SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
- SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
- SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
- TLSH T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
08:39:56:e4:21:43:4f:90:03:ee:08:ba:76:09:c5:58:d4:a5:2a:73:28:78:a1:5f:f6:46:d6:59:61:a9:2a:fb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 16, 2025
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 4, 2024 - Nov 3, 2027
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 26, 2024 - Nov 19, 2025
Minor OS version
0
Major OS version
4
Entry point
713798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
690KB
Virtual Size
689KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XboxManager/System.Data.SQLite.dll
- IMPHASH 6a46ee05e8fe580b1d3336d67c47fa50
- SHA256 b1bb322e29bf7c6d038b5d0dd19a10b70eeda9c3e4b241ab9074c750c5d69734
- MD5 63cfc416ff2b0cbaf01f725ba53eec42
- SHA1 98546d3a9fae93e906adc7d8ad4b8b311d72596d
- SHA512 b2f407351d63367575a90da0377da90479333bf70d4743770ab9f6e35b5e7ceacdb6ab294fd0b1a86ec0f7c792f3ede62c0bec77bfc5be64f99f08eddfc96dd3
- SSDEEP 24576:C6uUHJZPuEm7S+ElZ8MHQVASmjk20/yVxJOA:1u+vGglZ8MDdqKzJ
- TLSH T1B625AE55B7E2C0B1F5EE12B8D6B90EBA1D35A212931AD1C7B4D024E64EB06D17A3F343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
793830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet\bin\2010\Win32\Release\System.Data.SQLite.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MapViewOfFile
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFileAttributesW
GetFullPathNameW
IsProcessorFeaturePresent
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedExchange
DecodePointer
EncodePointer
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
msvcr100
tolower
_beginthreadex
strncpy
isalpha
toupper
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_endthreadex
_errno
strerror
_localtime64_s
qsort
calloc
free
ceil
strncmp
memcpy
memset
_CItanh
_CItan
_CIlog
_CIsqrt
_CIatan2
floor
_CIpow
_CIexp
_CIlog10
_CIcosh
_CIsinh
_CIcos
_CIsin
_CIatan
_CIasin
_CIacos
memmove
mscoree
_CorDllMain
_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_open16_interop@12
_sqlite3_open_interop@12
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_key
sqlite3_key_v2
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug
Name
.text
Size
771KB
Virtual Size
771KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
236KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=13, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=137, id=1, productName=Unmarked objects,
count=2, id=176, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
XboxManager/XboxEngine.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7dbe535d1696d49b4f5f0cf617b41696e88b2ab039f5d287d869b0e661f8541
- MD5 39adbe0efa30ae20ff33f78c51d04035
- SHA1 23e092f9633c9570d322777a7d1c765e9350f11c
- SHA512 9aa96eee0f17e50993ec3f8b631bd61dfe5d24fcaadb8f871dfb05e0920342a4a9df66c5f63686e729b9ea1cb20dd447a6161a774e81e9898f0ef4a0e2367623
- SSDEEP 1536:X9JdBd25wgEjyAYxF1C5gBjCvubMmIY6jbC1GCcxI9eh5Cq2DPN8tEaRK5T0NJtO:lCF1RQt4EbecHCFDPN8tExcJwb
- TLSH T1DB93292C23EC4E1BE6BF9778F4F1612207B1B462B576E78D9C8561E918637C04A11BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XboxManager/XboxManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 61d6f8379d459586ba0ecf6eb8f4aa2491cea9184321b10b6469d41bfe1caa71
- MD5 dcbd643a4c19df4444758fa97dedbfca
- SHA1 da58d40f1ac69d50009d72bcf733a6c0bb3ecd30
- SHA512 e6cc0c1b826d7435772dde79ed4a601a7eb1a10520c9213ad64bf64b85e92ef4c0e419d7275b14a35e3202dbea0c0815b505404147e55e16bd066abb5c17c402
- SSDEEP 196608:+/X26wxBC/ScEvYtGRWzaQFtc4kvujv//TRWpg60pS+oB4zC4j6fk2XjpdYoPfHK:wE8xSYUercUjv/gp4MHo4kej7znp8aC
- TLSH T12407126433E59507F27B9770C4B8BB244A757E72AC66C61DA850768D3CF1B81AE20F23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17268734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
16.5MB
Virtual Size
16.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
267KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XboxManager/_db/Ookii.Dialogs.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04b8cb55ff481a4f4f9a60bc3c5e06ed78c12a8677c211621edcf9d8467bd823
- MD5 5926472580c7a7b45cd611dc0fb06244
- SHA1 a3b33bc8c9963f727bc2a2714ec6de0c607bca40
- SHA512 be05b4695896b4a2ad2ca63836c9d05084b8aa1b71929e1b081fd47b851282438bdf8c7bc65466ce7f3fe30335e743c0bd12aa52670b12d6eaec8b3bfd193056
- SSDEEP 1536:5lPwQgrQnQaIM9MsmdgdSrtP7QdniuLF+mnNuu48pMBqDALYHu+an+HeaP6kOdWF:5lNJIceEMGFHnM8A8HC++aPA3O
- TLSH T19FB36B32334C0769CAEF4A7DF810A1858770DE516A36DF674988B18E29733D14AB62F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2d:ce:bf:bb:bf:fa:10:a0:ec:b2:d9:ad:12:86:f0:51:3d:7a:f5:80
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sven Groot,O=Sven Groot,POSTALCODE=3328 CS,STREET=Zwaluwenburg 81,L=Dordrecht,ST=Zuid-Holland,C=NL
Chains
Jan 28, 2009
CN=Sven Groot,O=Sven Groot,POSTALCODE=3328 CS,STREET=Zwaluwenburg 81,L=Dordrecht,ST=Zuid-Holland,C=NL
Subject
CN=Comodo Time Stamping Signer,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4f:63:d0:30:f8:15:a3:a5:b3:44:69:40:06:3d:16:89
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 17, 2005 - May 16, 2010
Subject
CN=Sven Groot,O=Sven Groot,POSTALCODE=3328 CS,STREET=Zwaluwenburg 81,L=Dordrecht,ST=Zuid-Holland,C=NL
Serial Number
a8:00:c0:d4:41:5d:1f:88:b0:ec:8a:df:1a:b9:b5:af
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 4, 2008 - Sep 4, 2009
Minor OS version
0
Major OS version
4
Entry point
110014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\Sven\Documents\Visual Studio 2008\Projects\Ookii.Dialogs\Ookii.Dialogs.Wpf\obj\Release\Ookii.Dialogs.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XboxManager/_db/System.Net.FtpClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec52a54d15635fdab9f654bd4b5f8c56e5d68907ecf4062204f7d68e4daeaa48
- MD5 8a9634580fef32b2c1708e0072586413
- SHA1 415a60205468f64e53d131a26d7160ba54918da8
- SHA512 742f49f8ed1f931460cbd10be442bc4895ea66f617b1c996e4d53ba7c6da011433c0d07e6ff6f063c34fad7dbbbed852e63d5ceedcaed6f145c42fdf974076d0
- SSDEEP 768:HjVEnb3BX4OeeepBF1yvsF8KgaFIe1UcsPIrFS3Mq77gxfppqR+yJqfayg:HhEnt/uBX1HJFIHcsArgMJrpVriyg
- TLSH T16F83E66023E85A09E6BF7B7CB5BB451047F5FD62A973D71E2D8A50EE0823B905D103A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Swizz_000\Desktop\source\obj\Release\System.Net.FtpClient.pdb
mscoree
_CorDllMain
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XboxManager/_db/TitleID.Json
- SHA256 f1ef13b06abc50685de031409fc516e0b6a23643d0f1dc0cc6c3ed8c0f98ce9a
- MD5 77e9733e516714f59638edd3e204f34d
- SHA1 8ea1915dee998714ef7790ea06ea0d23b1807567
- SHA512 632c8ad107f3f76db2137fe5381489505ea70e0acf7b4c9fffa5cf55936bb2ee325bbbd74b00db773689747f5e3308bae1e186dd2033717354d5cc77c25aa41d
- SSDEEP 1536:QfsD2Tr5qCUyqlSFPOMjjTWbB14QKch5O1H16p+coDlR1yvAMAgvA:7O5qCUq4h6zlR1s8gvA
- TLSH T14384BD18C1B00C834B4A65715EEE16983960A2DF2FE8BC143A4D955D1F8ED9EECF163E
- MD5 SHA1 SHA512 SSDEEP TLSH
XboxManager/_db/XboxUpdater.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8e688c774fdcd9f1e6aa78e1622214de193124ec191447a38dab673aa0e10fb9
- MD5 3c397b255205b1f9edd80da2c795d8b8
- SHA1 a73817d4ac56feceab1c8f6731338083a4e86974
- SHA512 861005cd55216f11f249a3ee0d1b4600d7eb1397e15bd6f45b7f4b843ac6e42dc371efa02e545e3399f32b61c717e3b17d94a26c656cbb692ea37119b9de2242
- SSDEEP 6144:o61MDZUnDzDo64hT/zcpo8Ax/hgWwvkcEfMQhAdSGU:LCZUjobzxx/qO
- TLSH T10C548C7833228B4BE395C238E5A8F7144E715AB4ADA3C6C1FDA7396D7BE4B008D55B01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
304686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\DevIshimura\Projeto\XboxUpadater\XboxUpadater\obj\Release\XboxUpdater.pdb
mscoree
_CorExeMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XboxManager/_db/log.bat
- SHA256 73b93b718a8ea9a7a0faeae6d1126d747489b750cccd006b00e86a9ee1492243
- MD5 412276a0f5e7cc17f720e5e9ea0c6c7e
- SHA1 6a01bcc4803faa64929636908c442a3e01f2de44
- SHA512 b5ea765daab93e87ca12c273f956c307bd7a88fbccf452abac70700df0e9bd7412d9c851a489c60a5c261d9373ed91ad37cb5e5bcf69451cf66238a091679632
- SSDEEP 192:5gYUxl+6v+eD6TdzEwiDp3dnrInfBk0msnsmQfJX9nLgd3C:5beY6v+ZdzuMIEd3C
- TLSH T19B422E09DACBE87BF5226A962593C7EC0C9F5146BE8523431F16BC0841CF83C71E69E2
- MD5 SHA1 SHA512 SSDEEP TLSH
XboxManager/_db/xb_01.exe
- IMPHASH f6633bfb51af70652d57984b9973ee1e
- SHA256 293c152ce3c06368e7c16e75ee43a00551570910a90befcc633f06cddb2e72dc
- MD5 83a50d2131f9ed6f1cf10c61acdd19d6
- SHA1 2c9b1a5434e8959f230ccff58056fa3b7af8ea3a
- SHA512 a41e83bf8f89fa089eb5d92a262d9638869cf65239cb98f8c31b647fc949650fcdef87dc142ca563c41eb095f01792ef71414b1742a82b0ae1c9d73291b85f87
- SSDEEP 1536:UP0+CUKHRcZKaCAfEpn0WF3felGfiexzAo4nG5INf4XqXqIvSs31Ni+BRsYnOBaL:Z5+wqEbGYtAo43D3v7BRsbSJ
- TLSH T147D37C2570C0C072D88729315675CBB29E76B476473890C3BB8D1EBA6F203E2D67A35E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
54421
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
recv
inet_addr
gethostname
getsockname
setsockopt
bind
gethostbyname
listen
accept
connect
WSAGetLastError
htons
socket
getsockopt
shutdown
select
send
WSAStartup
WSACleanup
kernel32
WriteFile
GetCurrentDirectoryA
CreateDirectoryA
SetEnvironmentVariableA
CompareStringW
CreateFileW
IsProcessorFeaturePresent
GetStringTypeW
GetProcessHeap
SetEndOfFile
GetDriveTypeW
HeapSize
ReadFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetLastError
MoveFileA
SetFilePointer
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
FindClose
HeapReAlloc
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetDriveTypeA
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
DeleteFileA
GetCommandLineA
HeapSetInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
SetStdHandle
HeapCreate
SetCurrentDirectoryA
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LoadLibraryW
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetFileAttributesA
CreatePipe
GetExitCodeProcess
WaitForSingleObject
GetTimeZoneInformation
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
Name
.text
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=152, version=20115,
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=25, id=158, productName=VS2010 build 30319, version=30319,
count=168, id=170, productName=VS2010 build 30319, version=30319,
count=124, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=174, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
XboxManager/_db/xb_02.exe
- IMPHASH 1a602bca59a9f8da589485ba1c8d71fb
- SHA256 1459fcf8ff5a89e039b02c68c06b006b7a036f3b1ca237c2d7e03d61bd211d47
- MD5 548ad5e37657749cece2a8cc9dd06bf9
- SHA1 daa985c2b4b146253a6a47e8c735609c2864a49b
- SHA512 5b1e609a37028190b8abefb6b892b15f0d7b1d4c769c7b63fc64a563e1413b2f29ad00b9988d6c5a15b32d92fa5cc63ce6133f1824e81aff9f9933400de03b4e
- SSDEEP 24576:zuQzZRq3Tfj2IbQ/A7BksK2Np7gfG4jaFX2p7q5wBm+:SQzToTfaIbQ/A9K2Np7ge4jaFXKq5wBt
- TLSH T192353A1BF76691FCC959C0748B766232BA727C0E46363E7B57D48B302E56A106F2CB18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
VirtualProtect
VirtualQuery
__C_specific_handler
AddVectoredExceptionHandler
CloseHandle
CreateDirectoryW
CreateFileMappingA
CreateFileW
CreateThread
CreateToolhelp32Snapshot
DuplicateHandle
ExitProcess
FindClose
FindFirstFileExW
FormatMessageW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentThread
GetEnvironmentVariableW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemInfo
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
MapViewOfFile
Module32FirstW
Module32NextW
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetConsoleTextAttribute
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
Sleep
SwitchToThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
WaitForSingleObject
WriteConsoleW
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
memcmp
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_fpreset
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
ntdll
NtOpenFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
Name
.text
Size
724KB
Virtual Size
724KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
300KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
XboxManager/_db/xb_03.exe
- SHA256 d93c1b814ad6ff124834f4235bf8aac9f09dba8d69c335ebecc8d6efe8d5a062
- MD5 a1924fa8082efb8df878ba9454698d85
- SHA1 231f4c77d4260074035dddd795273c355385b33c
- SHA512 39e5a91114b2fafd097ab1d6784a3b1e261ad98e2df9da9a5b687a2fe82748b85f7ecedd2f5a2167e4464c98eeee87c15cac40dec9dbabe3ad8c1f477bebed6d
- SSDEEP 3072:C9qgMC/dJVt8tKvw6+M7bp73HcrTUdSn13cjoQRoXPOgK:C9XdLqtKvw6+qbRbdSpUtwOgK
- TLSH T1160412E0E11053A5EADB6C3BBC8D1516D80E563806CD9BAC777E8D2F41F99BA0243C27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
489360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
182KB
Virtual Size
184KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=150, version=20413,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=155, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=100, id=1, productName=Unmarked objects,
count=3, productName=Unmarked objects (old),
count=38, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=48, id=137, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
out.upx
- SHA256 1dc610853d5c3ceb24193d5da80f540e6b682e040b2987e0d67e632c4ea37540
- MD5 2580777205f00de0d9ff8f93ac6f9ecd
- SHA1 4e421d6bd16106906c7c30667da15ce1f7aef674
- SHA512 a6c6f6d9521661bae960998049e9f246ffe168f1ddca460cd32fc73de424e35207019876a9bf201535a627eb9c0a18668a9c8cc2a2c4e951d68f9d96eaec149c
- SSDEEP 6144:Wg4p9LYMCM1a/gmDSaxn83E4+4PJ+bR48QRZJITiUA8bTbdam24ZZ2ATUmCG:/4p9LYMoomSapQ9ITHbrZZ2hw
- TLSH T112A49D15FAB2C0B2C15315B04D3AC7366E36A56117249BC7FBD85F2A4F223E2D93A349
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
194551
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
295KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=150, version=20413,
count=55, id=132, productName=VS2008 build 21022, version=21022,
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=155, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=100, id=1, productName=Unmarked objects,
count=3, productName=Unmarked objects (old),
count=38, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=48, id=137, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,