LibExploit (2).rar
- SHA256 4416a0161c8d129847289d72fe5f1f2cb388ff981635bc3e88b600d663350e1a
Password
https://t.me/+aKMTfS6XyoczZWY6
Overview
overview
10Static
static
10lib/Liberi...ro.exe
windows10-2004-x64
10lib/Liberi...ro.exe
windows11-ltsc_2024-x64
10lib/Panel/...to.dll
windows10-2004-x64
1lib/Panel/...to.dll
windows11-ltsc_2024-x64
1lib/Panel/Client.exe
windows10-2004-x64
10lib/Panel/Client.exe
windows11-ltsc_2024-x64
10lib/Panel/dnlib.dll
windows10-2004-x64
1lib/Panel/dnlib.dll
windows11-ltsc_2024-x64
1lib/Plugin...on.dll
windows10-2004-x64
1lib/Plugin...on.dll
windows11-ltsc_2024-x64
1lib/Plugin...ss.dll
windows10-2004-x64
1lib/Plugin...ss.dll
windows11-ltsc_2024-x64
1lib/Plugin...un.dll
windows10-2004-x64
1lib/Plugin...un.dll
windows11-ltsc_2024-x64
1lib/Plugin...er.dll
windows10-2004-x64
1lib/Plugin...er.dll
windows11-ltsc_2024-x64
1lib/Plugin...er.dll
windows10-2004-x64
1lib/Plugin...er.dll
windows11-ltsc_2024-x64
1lib/Plugin...ra.dll
windows10-2004-x64
1lib/Plugin...ra.dll
windows11-ltsc_2024-x64
1lib/Plugins/Chat.dll
windows10-2004-x64
1lib/Plugins/Chat.dll
windows11-ltsc_2024-x64
1lib/Plugin...rd.dll
windows10-2004-x64
1lib/Plugin...rd.dll
windows11-ltsc_2024-x64
1lib/Plugin...er.dll
windows10-2004-x64
1lib/Plugin...er.dll
windows11-ltsc_2024-x64
1lib/Plugins/DDos.dll
windows10-2004-x64
1lib/Plugins/DDos.dll
windows11-ltsc_2024-x64
1lib/Plugin...op.dll
windows10-2004-x64
1lib/Plugin...op.dll
windows11-ltsc_2024-x64
1lib/Plugin...er.dll
windows10-2004-x64
1lib/Plugin...er.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
lib/LiberiumUltimateExploitPro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
lib/LiberiumUltimateExploitPro.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
lib/Panel/BouncyCastle.Crypto.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
lib/Panel/BouncyCastle.Crypto.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
lib/Panel/Client.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
lib/Panel/Client.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
lib/Panel/dnlib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
lib/Panel/dnlib.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
lib/Plugins/Action.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
lib/Plugins/Action.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
lib/Plugins/AntiProcess.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
lib/Plugins/AntiProcess.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
lib/Plugins/AutoRun.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
lib/Plugins/AutoRun.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
lib/Plugins/BotKiller.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
lib/Plugins/BotKiller.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
lib/Plugins/BotSpeaker.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
lib/Plugins/BotSpeaker.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
lib/Plugins/Camera.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
lib/Plugins/Camera.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
lib/Plugins/Chat.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
lib/Plugins/Chat.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
lib/Plugins/Clipboard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
lib/Plugins/Clipboard.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
lib/Plugins/Clipper.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
lib/Plugins/Clipper.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
lib/Plugins/DDos.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
lib/Plugins/DDos.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
lib/Plugins/Desktop.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
lib/Plugins/Desktop.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
lib/Plugins/DeviceManager.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
lib/Plugins/DeviceManager.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target LibExploit (2).rar
- Size 4.6MB
- Sample260806-ea158aserd
- SHA256 4416a0161c8d129847289d72fe5f1f2cb388ff981635bc3e88b600d663350e1a
- MD5 0a1fe8946fd89d34a734c85827a1c583
- SHA1 04590656d984705e6172903661d6f8edefc0bbbb
- SHA512 b21692b52bfea59a6f3089da229106385d907574be69adbeb8561e8f2787d02939d01fe4f9f35ae8ffe9e050c66ccbb6f35bfb79e3a5baeb7e3e8043ebbbc363
- SSDEEP 98304:3DPlOHlDjZtBUmxISl1AyQl8el7mIisMTS1EuSt1UBmgcQIBUbcSbzFhf7F9:gFrmmxlleyAXivTSnSt2/bPzbfB9
- TLSH T1903633AE82BAA7F511BC76028E79FEDCAEE755C1B847C0DC6E04376811DE8B16067143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
- Detects Dracula aka Samurai Stealer payload 1 IoCs
resource yara_rule static1/unpack001/lib/Plugins/Stealer1.dll family_dracula_stealer - Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/lib/Panel/Client.exe family_sheetrat_v1 - Unsigned PE 52 IoCs
Checks for missing Authenticode signature.
resource unpack001/lib/LiberiumUltimateExploitPro.exe unpack001/lib/Panel/BouncyCastle.Crypto.dll unpack001/lib/Panel/Client.exe unpack001/lib/Panel/dnlib.dll unpack001/lib/Plugins/Action.dll unpack001/lib/Plugins/AntiProcess.dll unpack001/lib/Plugins/AutoRun.dll unpack001/lib/Plugins/BotKiller.dll unpack001/lib/Plugins/BotSpeaker.dll unpack001/lib/Plugins/Camera.dll unpack001/lib/Plugins/Chat.dll unpack001/lib/Plugins/Clipboard.dll unpack001/lib/Plugins/Clipper.dll unpack001/lib/Plugins/DDos.dll unpack001/lib/Plugins/Desktop.dll unpack001/lib/Plugins/DeviceManager.dll unpack001/lib/Plugins/Explorer.dll unpack001/lib/Plugins/FileSearcher.dll unpack001/lib/Plugins/Fun.dll unpack001/lib/Plugins/HVNC.dll unpack001/lib/Plugins/HostsFile.dll unpack001/lib/Plugins/Injector.dll unpack001/lib/Plugins/KeyLogger.dll unpack001/lib/Plugins/KeyLoggerPanel.dll unpack001/lib/Plugins/KeyLoggerRemover.dll unpack001/lib/Plugins/Map.dll unpack001/lib/Plugins/Microphone.dll unpack001/lib/Plugins/MinerEtc.dll unpack001/lib/Plugins/MinerRigel.dll unpack001/lib/Plugins/MinerXMR.dll unpack001/lib/Plugins/Netstat.dll unpack001/lib/Plugins/Notepad.dll unpack001/lib/Plugins/Performance.dll unpack001/lib/Plugins/Process.dll unpack001/lib/Plugins/Programs.dll unpack001/lib/Plugins/Regedit.dll unpack001/lib/Plugins/ReportWindow.dll unpack001/lib/Plugins/ReverseProxy.dll unpack001/lib/Plugins/ReverseProxyR.dll unpack001/lib/Plugins/SendFile.dll unpack001/lib/Plugins/Service.dll unpack001/lib/Plugins/Shell.dll unpack001/lib/Plugins/Stealer.dll unpack001/lib/Plugins/Stealer1.dll unpack001/lib/Plugins/StealthSaver.dll unpack001/lib/Plugins/SysPlug.dll unpack001/lib/Plugins/SystemSound.dll unpack001/lib/Plugins/UAC.dll unpack001/lib/Plugins/Volume.dll unpack001/lib/Plugins/Window.dll unpack001/lib/Plugins/Worm.dll unpack001/lib/dnlib.dll
File Explorer
-
LibExploit (2).rar.rar 4.6MB
-
lib/LiberiumUltimateExploitPro.exe.exe 532KB
-
lib/LiberiumUltimateExploitPro.exe.config.xml 176B
-
lib/LiberiumUltimateExploitPro_1.0.0.0.nrmap12KB
-
lib/Panel/BouncyCastle.Crypto.dll.dll 3.1MB
-
lib/Panel/Client.exe.exe 43KB
-
lib/Panel/EncryptPassword.bin82B
-
lib/Panel/MasterKey.bin32B
-
lib/Panel/dnlib.dll.dll 1.1MB
-
lib/Plugins/Action.dll.dll .ps1 27KB
-
lib/Plugins/AntiProcess.dll.dll 10KB
-
lib/Plugins/AutoRun.dll.dll 331KB
-
lib/Plugins/BotKiller.dll.dll .ps1 25KB
-
lib/Plugins/BotSpeaker.dll.dll 14KB
-
lib/Plugins/Camera.dll.dll 94KB
-
lib/Plugins/Chat.dll.dll 43KB
-
lib/Plugins/Clipboard.dll.dll 13KB
-
lib/Plugins/Clipper.dll.dll 15KB
-
lib/Plugins/DDos.dll.dll 106KB
-
lib/Plugins/Desktop.dll.dll 696KB
-
lib/Plugins/DeviceManager.dll.dll 14KB
-
lib/Plugins/Explorer.dll.dll 487KB
-
lib/Plugins/FileSearcher.dll.dll 15KB
-
lib/Plugins/Fun.dll.dll 46KB
-
lib/Plugins/HVNC.dll.dll 37KB
-
lib/Plugins/HostsFile.dll.dll 13KB
-
lib/Plugins/Injector.dll.dll 50KB
-
lib/Plugins/KeyLogger.dll.dll 17KB
-
lib/Plugins/KeyLoggerPanel.dll.dll 13KB
-
lib/Plugins/KeyLoggerRemover.dll.dll 6KB
-
lib/Plugins/Map.dll.dll 13KB
-
lib/Plugins/Microphone.dll.dll 485KB
-
lib/Plugins/MinerEtc.dll.dll 23KB
-
lib/Plugins/MinerRigel.dll.dll 20KB
-
lib/Plugins/MinerXMR.dll.dll 25KB
-
lib/Plugins/Netstat.dll.dll 18KB
-
lib/Plugins/Notepad.dll.dll 13KB
-
lib/Plugins/Performance.dll.dll 15KB
-
lib/Plugins/Process.dll.dll 16KB
-
lib/Plugins/Programs.dll.dll 16KB
-
lib/Plugins/Regedit.dll.dll 31KB
-
lib/Plugins/ReportWindow.dll.dll 13KB
-
lib/Plugins/ReverseProxy.dll.dll 15KB
-
lib/Plugins/ReverseProxyR.dll.dll 15KB
-
lib/Plugins/SendFile.dll.dll 23KB
-
lib/Plugins/Service.dll.dll 14KB
-
lib/Plugins/Shell.dll.dll 15KB
-
lib/Plugins/Stealer.dll.dll 132KB
-
lib/Plugins/Stealer1.dll.dll 140KB
-
lib/Plugins/StealthSaver.dll.dll 221KB
-
lib/Plugins/SysPlug.dll.dll 13KB
-
lib/Plugins/SystemSound.dll.dll 483KB
-
lib/Plugins/UAC.dll.dll 23KB
-
lib/Plugins/Volume.dll.dll 479KB
-
lib/Plugins/Window.dll.dll 16KB
-
lib/Plugins/Worm.dll.dll 2.9MB
-
lib/dnlib.dll.dll 1.1MB
lib/LiberiumUltimateExploitPro.exe
- IMPHASH a9c887a4f18a3fede2cc29ceea138ed3
- SHA256 e3971654d4cbc4cc46e14bbef88ea0bcb5de90cc1b61920a64788b7626cb5089
- MD5 4f66cbd4f6d35903ae06e023de8ec94c
- SHA1 62f61961d5220beef47f3a94ba1281855aa34a97
- SHA512 e511b01c0478bec1b73522163a86d698c780bbcd9dbba49ba12f8477209a14815f45311d1bd12555afb182c79a239c9b5e3b42b04607f8a3656577a933725401
- SSDEEP 12288:Y2N4UGDKdT9zhJ8AlDig6w9T+REeNeRgHJ2fk2X9qoyiq:Y2RG2Jp7JGg6w9TqEeNeeHUMgqoY
- TLSH T10AC48BCE245398FCE2C2B175D9B1851E1A14B052C3363DF886E9AB18A3328D539FA5F5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
5329
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
msvcrt
malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit
shell32
ShellExecuteA
kernel32
SetUnhandledExceptionFilter
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
527KB
Virtual Size
527KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
lib/LiberiumUltimateExploitPro.exe.config
- SHA256 ad8267122c40d37dcd9d99e1412d763187a1825732f378db8867f3ecf675cf70
- MD5 21fa0b1d75c0cc7369f1e735fe90c7a9
- SHA1 e2d01a1b6aa66e5d3ed575aca79560b014bbfefe
- SHA512 60f6704cd1b3035a1a3403ee3870c7cbc13d6e601172745336ebbffa2ee3dc21785702470ab006c69dbbde0d5525625bb25ade5c641c80c8165fbc46fdad2ad0
- TLSH T1D8C080154098BD274D334F176351C525EBB072526464040CF42F9657073104D4247326
- MD5 SHA1 SHA512 TLSH
lib/LiberiumUltimateExploitPro_1.0.0.0.nrmap
- SHA256 66fbf3c9890ac7ce8dae6f5e56eaa376b01a60ef1692ae97aa2f4f84530079a3
- MD5 360651c0d62f148dcbd222969747c873
- SHA1 9026208ee6d67a0b54bca1c3eb62aada9cc0d287
- SHA512 c4db4d7d1286d0ee4cbdc7d9d471d838c82352c462485c36f87c2b93dba51efd413b3a9c778651d4b7c3776125f3ee2f69fc9a7ecaf793dcae27a5ce6e5b7d0d
- SSDEEP 192:DWHh7NPwRb2I1FZuITkUBk8oN7Xm2GNANNW:ah7GzZ2XmCq
- TLSH T16B42A5D852BE7DF6EC1A1A252A85586AAFE8D547A125C03CF5174C1FCA2068533FB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
lib/Panel/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b474be40249aab5de303b3052c52a1349a06e27e8e54f956085465ce140d2bac
- MD5 3e02a7007f6abc85bb077a955b32b308
- SHA1 0567f20d06efab8f228d2a9f5ec706d9a38e5d24
- SHA512 cde8ed77552afac2489fc301454902b827dac98f0c2f82ad392a8559c454f868a7a65d0f5f8d80605e776bf28b8176cb5cf4e49457100a34867017ead41d555e
- SSDEEP 49152:a8X5gU7N2D0wtc8/ZiM3nxiwhra7HKaGzHIkMNKs6wc2iaoxcglc:a8X5gzDL/ZlXxiS/rxc4c
- TLSH T1F6E57C197BF81F23D16AD772D4F00042A3F2F82EB363DB5B2981A27A5C57B405D416AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
3288142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Panel/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 793480a061cb2af067bf9697649b8e5d0c9d1d58def4e0979feb39490fb47826
- MD5 d605020e1805c860e6b3c059baec938d
- SHA1 17998293f75054f9e2e12a863290e4b4283c0b61
- SHA512 d51a6cdb6caf66e139f424b6d55f1a683b440eda8c77b5e9a67ccac537cb74b16f120599eaefedb4eba12b52440c458d98d45c4470f181803695fda50a259a15
- SSDEEP 768:D7xBmd93XBHhlMywCyloyvc2vN2bdaQ1Z8rnj0Obd66wSEfgy4R:D7xBmTXBHhlMywCyll02vN2bdJ1ijwO3
- TLSH T17613D5407BC88A35E7AE4BF8A672521C4272E3636913D70D1CDB05D92532BD5EA01EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
49246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Panel/EncryptPassword.bin
- SHA256 1b35a7c3e50bcf979fa01625011836f86d6a96b121c877d4ec786928c5ea6baa
- MD5 c846ce1701c77e44a8651dda8de5e946
- SHA1 d880bda61362f91b1a252a16468c3a0c9d50f0e2
- SHA512 7485f6c5e62ca513a6ee448b33a33c955d309911c7e2980c02c5b174d4f681715266074331a4a48fa43dd380b9b6e22782e5cd48aeb6b180f7a715262d5d9ea3
- TLSH T1E0A0127686304809C110007010045116889E820409CA004492921301150C552149B4A1
- MD5 SHA1 SHA512 TLSH
lib/Panel/MasterKey.bin
- SHA256 6315e5740bf9386a2c9c752541d0c3bf9a898d6046e7db028a4c6503270914cd
- MD5 e461db55765b040c11df241188aa23da
- SHA1 52bbb7b4ce0e02c53226b052fee9e12080b34084
- SHA512 1dea46cec3f8e868744ea3eb4f75fd91cde702ac29f87715b688840c319fcb18224e18897d754c26b9527b8f3608d5f32ad9011884e621bb3f010cc0fd242d18
- MD5 SHA1 SHA512
lib/Panel/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f2c1f407811acfd1e926e61d6b71195b2f1c5aa54e59c2a43e6bb63c4e01a1d1
- MD5 fb5ecef1d457e3c5755f15988db493b2
- SHA1 eae333a1e2755155e7b7bc9e6e90706384dc5614
- SHA512 f50268facf89c751fc2f0ff766b4113672c6133d7e6dac670c69bd9df883323376b3962771b1ff041e4689b8eb16c5dd0b4c204026fc4d68f7e7908def3c4d0b
- SSDEEP 24576:kVXy+xgfrjQPiV2X03v7fww8CHvN3GygvHNfU:kVC+0r9t
- TLSH T161455A1237EC9B77C4AE477AE43116580BF0E80A676BDB4F6A58F36A6C437409D113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
1177550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Action.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e02c7d4772460b5ed8c9deb4d9c42f9307ab2e91dcad88d370c56852e2cb3cd9
- MD5 6bcf7dcdd6201723e287296fe6a137a8
- SHA1 90ae2ff990a5d7262303adddce63d966f37b2880
- SHA512 a87be64c53ad55b75dd7273207a1e8ed40c4d37b7936683409088d5d4b961eea9b016133cf79e19fa32e8de2d8819f83c1536bf4411b1580a3e4ac5762cfd185
- SSDEEP 768:GIIy4kFY/dEMKix0thSCBsFY/dEMKix0GbYB/8p3bk4TsHuHTfjOW:zIy4tBUtbpTuuHGW
- TLSH T1FBC2F804F7D82A34D2BF47758DB11A14EE7AA147EC72C90D398C40982B727998B61FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
33694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/AntiProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aa5613397f63e46ba3c6d8f23f15cfc3968715c15eb3c8bb3f7e1e6ebfe05a95
- MD5 48442e4f33ba1c798b8cd9185ca1d9aa
- SHA1 7e525947abdd2a75c2f17bbb99c25f137efd4cae
- SHA512 08c6fedf9c38c73396e7354b6fe4d58657cac480679f310bed206d1c93cbf38e0f6a66dcfa0667c1ecf33c53129213968449e1e0a83cd76a4c14bb32546079c9
- SSDEEP 192:lfNRGGKzmllcJN/jB50Hk68bTygXnFCcPKjVISBaTt:lFbcJduk68bTDXFCcPKjVBBaTt
- TLSH T1CC22E900D3E98A20DABD433EA9B3930A4A34F1049D13DB5F29D847F27C517FA56D22A8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
16046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 07b7c2db79493a5ee49b608360ad480376efb5a2decc53e17938615d0e246143
- MD5 4571541b931bd8b3e7250de365c99b1b
- SHA1 b2896b06c324d6152d38f25b7f77e2795dac917d
- SHA512 1a3e85a04c255b87fa4e9ca99ac0b8e00d70ad78dbf19cce047038ed12874f5b15db559baa162b5b8e26d6fc1ffb062e12f289ccb27748f8d05c663696462e38
- SSDEEP 3072:Kyl8eHoRnxKZILoWl7rjvMy86pJERnjwTqerO9/3n7OSUrwi920aYW9Ba+bQaKxT:/l8vn1LoWNrjvM/Pmi37NULlaba+bQS
- TLSH T115743A1523FCC627F6FF27B8F4B250104BB8E40AE96ADB4E4D84A5D86863704A55237F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
345198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/BotKiller.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 93b2051501eafa809166efd20947d3b25dfa09dd8d7e32baf41345cfdde421a0
- MD5 ec8363fdc41624cbb8125fff1ea17ee5
- SHA1 25edf29bfc2a06f8ee9e9968d9578b298334173f
- SHA512 d447a78c4dd5539413e4a116c14d96d48c023d9c03f76f972757dfb1ce936e8075a0de0c677d99a37f2f3976506cf74f548cb576c38fcdcde0bb2845b9bfa2b0
- SSDEEP 768:PxBV0x47ieFY/dEMKix0GAMgnNyw9WbJ4uDCw+VLjp:jV0x47imNubJ4uDK
- TLSH T142B2A511B3DD6230D7BF4F366832661086B5B4269C26CA8D39CC92C90B36764E631FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
https://t.me/+aKMTfS6XyoczZWY6
Minor OS version
0
Major OS version
4
Entry point
31726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/BotSpeaker.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5dd8a71a59d707ce9c6391bad79a89fb25ae00c46f366aa4732aada6190b49ad
- MD5 e15b848a004a3e3f53519bd78faaaf13
- SHA1 4d7aec7bfdb0db34fc95430c68bfb7d7fa1a46e7
- SHA512 1ff0c1e30104cf0bc7d9a18ce3e246fddfb9d05cdf1ac5c01c77c28be4eb5d74319326a2e2683ae31f3a27cfc563a17a8f2d18a4cbd08de78cafe685d29a4578
- SSDEEP 384:bp8WObHDe/6BM7GilZpE19NCmBM0bi+D9l/yvFH6qjV8HIbRL:byBWpRmHbfn0ZjSHIR
- TLSH T10952D904A3E48B31E6F946BA58A397844730E7015C03CB0F3DDC95E5AC53BBE6B517AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Camera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e686aa88a2f25a1b966fbcec46be82bf0ed96c54715426ac090b1b71c8972ee6
- MD5 45c5a5745280597756692c69d0b46565
- SHA1 8219006f2631ebd020138b3272c6e4b3c31cfb55
- SHA512 7a97ed692ae722e5c9ce091e1ae200203dc6cccefe3670eacb11546b7ea1a03ba651cab84b214c7a22263db96b0f02c87a98026966792ee1a257682b065b2a21
- SSDEEP 1536:kzKZLDqMIbKrEraXK6upJ8i6f7g27iPU4+a0u6XMRf23FzWPOa98beQSkryrzYT:kzKZqMIbKrEraXK6upJ8i6ffPw2VKPOh
- TLSH T105935C1127A8C927D5BE07F8A0734B459B319206E113E7DF1EA454EC7C63B528E632EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bab443475ee2926ef442a2283c55d81dac20d4c7dc4631f54bad03cd1a2f302
- MD5 7b5cf68bf0f453bd53d0ca28e5598923
- SHA1 b3e40dab5a8c8dd76cf07b6c46d9b17c3c346f8d
- SHA512 fa4eed927f6a54e390fe10e648bca6993e2b95eccd05fe317e2256f6e6e5c6478b5e97b5962766ecd61d5228410303a1b1a009ea832af526c619f0ed9ae4d064
- SSDEEP 768:E+vKUUMJeiAItCmtSpiXnNucgU+0IhTPbFbqacBabaGaZQSURjrJ:E+vKUUMJzP0anngU+0IVPbhqaBbadU5J
- TLSH T1A4133900B36CC92BE7DF0AFEA41056A413B1D3627883DBDA1DD468EC19D3BD556212EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 94f58501a3d911b7da346861e3f3215ef42ea5af5ff9df6283a278f9322b4d62
- MD5 20cae6df4dcf8d4b8d881037609cd62a
- SHA1 a28ab97a517185ee9c0300d6e4c178c616ef09a8
- SHA512 dc4c6c6f7c779035dfdb48aafe1273f7c3f3cfffaddb622863e792ca9c572634ebce5d89402e0391a552a6a34667f7d2682952274ba0a3f0b6cfa38115ade291
- SSDEEP 384:UOEAk3GkJmpCZhlYmBWbRaDEO1Ft6qjVJt:UUk3GkJm03lYm8bWP1Pjbt
- TLSH T13252DA0497A58632CEFE13B7696397488370E2019D03CF0F2DD8A1D5AC47BAD7A257AD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7ed33f5a2ca75094f83d98a2fb9193442cde93aeec09544eee2771ee5340b23
- MD5 e66aa80ce46ee990a4c4a9b097e5edb2
- SHA1 1d3b0f7438b41cbf234400eaa8ea091441808b29
- SHA512 7b17f7ae05d53002fd9af858227502ff0e8cffd16aa122fae59c359cbd10ae8862120364ced0cda7777d79e1882ec3731b357210a147510a88be6e95c8093387
- SSDEEP 384:QP+WeZMOo5uiSqmBrbFaDtfhCYFhaCjVJ8p:QJeeOo5xSqmBbyJhCY3j78p
- TLSH T13D620904A7D08632D7FF17B694B3A3484330E7019C43CF1F3DD8A5D56962BAEA7506AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22e6b4d12488c38461a4eaa8024c903394f6b2ba0fd079cbaf8e6e715117bfe5
- MD5 4e76455fe46ea39ef8af3b4c6b73b428
- SHA1 2c53a21da2baae658e2f2c963236a11a82a519c7
- SHA512 91cc4e2ba53f3f8c44c0f084bc8e091bd45b28e857057a344af20da800b35d005aabf93f182f4e4287c9d15387d0df19ac0650601929012d3000f191b344f57c
- SSDEEP 3072:06Yh3M2KXKZi6xb+7jd3OqlWj/RxfZwvyM:Nk3M5Cb
- TLSH T1F4B3941473F04328F2F7177DF8F95616AA76F642FD32CB9E2965021E0862B448942F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d2c817db4843f8f230dfb9fa3b66ef4aebc75856f1cec3cfb3c3397b8b83092a
- MD5 5c76bcc70a1b202cfc53fdab3fba72b7
- SHA1 0a69734dab5cb32af267b90405c6a6884b69948f
- SHA512 a84aaeb21666dd58014d2a546df4b6ebcb27128e70ad23c7c33a8452628cc6fbc16624eaa888770843e4b9c2d22b9b6adf7e6fe1e860085ef7b79ea3737403cc
- SSDEEP 6144:DzkAANJKjDlNgDib1ahIZNs4z8pjac43jB0ZnmcTyO3EyTFhbZV6i+h6CUYxPkHu:Djz3lO41ZNs4z+jzSAmOy6Tn634gxZ
- TLSH T175E41852EF6C9F22EA0F3ABDB411791311B392411701A547A886E0F91FDD389CB1A7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
718574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
694KB
Virtual Size
693KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/DeviceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 badae34033402c006e2d03e6c70be61acbdded08fcc8807d54a9f9b93e23498b
- MD5 c3cf46e883658b2b343479cd24d4895a
- SHA1 4f6b2d2ad0fdb3c47fa7aa72854f293313ccd704
- SHA512 5400862287da511a3c5d5ac0c41bd512c6f0723e6f10f24d58506401c8e454591098fa14a3ea1087014eccad9580a11012eef70fdc45b8a7a5a9124c4fcc2edf
- SSDEEP 384:8IOSKkIS/IGAIcmBj8b4+DEJ6Fi6qjVQWD:8Ik3NmZ8bFO6OjCWD
- TLSH T17D62B60467E59A31D6FD83B79CB397049231E6419C43CB0E2DDCD1F56C06BAD6B212EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Explorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f668357d772efe95cb67d4862cf8e4c704867e9ff947f9b9fe5787943872325e
- MD5 e1138018bec3e3fc193b3e6bdc13a898
- SHA1 5ed9c7f7c4dc3f2026a3a360c31f8fb5f2a5cfe5
- SHA512 943e3b30e8606b8301e9ff148d55aef3b8005239ee28917ebceb510e07a86e151933b4f026c751bc562de59d924754de104ecd1c5e44684ac366e73d9b80ad09
- SSDEEP 6144:GisNZ8n7y/YMlvgl3aGtSV41OJDsTDDVUMle6ZjxLV/Dx2ICsbCtOeZ0q:GiMZ22XghBS4msNUCe65fDx2ICu2
- TLSH T134B49D4123E8CA57F2BE57B5E4F380608770B017B93EDB8F6D8464EE291A340A5157BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
504622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 01d485ddead7eb29b1a527d22238eae750d016d1b5bee284b7bd1dffd7d00465
- MD5 8a32955f786580d1ea3ea939569db36f
- SHA1 b287e384138c5b1cfed04720a1d7b4c3bfbcf6d3
- SHA512 6680814db67a3d05aaa6b2fc6ca18e0de456adde0e1b56180cd41f688881b5dfcef3dcf12c9db16005835472751fab3a1f1f8eb52fd3a603d868bc81534e21da
- SSDEEP 384:ZzfMGgy8YUHNnVCBo2nmjmBabhHDnFIPFoxxuzmjVYntNX:Zz0zYUHvugmobpFAaNjWtNX
- TLSH T19662E90823D59631DAFE03BBA8A357048638E101DC13CF1E6EE855E4AD13BBD26117EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 44a82bef77fdf86a1c7ae60e32bad307497ec23297955088d4c63f539cc0b633
- MD5 ba9a2ec4e9766f9eacba2321cba5ce6f
- SHA1 ccc6022417b3a0663a470c59a319729644470783
- SHA512 eccf7701c73fe8b7d3eb655a6e28751eb6da41698acf1720f253cd4942e8a08083d4a555205882172741f52bcd204efdb68097df0072af19dba57039fc513585
- SSDEEP 768:EJA6alsCGi074+zEeCqo2lt5q5Lb7AZRoJjXETYsjzESw:qsyHEe62lt5qlb7Are6Ygw
- TLSH T121234B0733E58262C6BD06B5E0B34344C236E24BA412D74E3DC955EB9DB27CA9694BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d2f19c5efeeeee22fec995a617b21eebf40c38b5d0e14de4b764aa86c963239
- MD5 86db41a040959249c72e5a703eec63dd
- SHA1 1703051f1a1140e1778a5436ddeace6d1dd1d45f
- SHA512 cf086bd90cf764368c84ed8ef30c9ac8534187d4932e0f9f794d052142d8680d1f106a88bc8b783e90a9492f56797ba9cd854369adfaf591de0c0d870523e103
- SSDEEP 768:B6jOFIGAqIYj9YkJ1EBOI6JEPyi+b05y1/fUNBjK:Bmqh9Y+1/JEEbukMu
- TLSH T11F032A05BBE68220E7FE0779F4B347548634F1835842EF0E19C8A1E4A66BBD49514BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/HostsFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a901c2b7aea3bce3b048db6b66edd05880fb57ac0eb58e95a9bf261c7f7e506
- MD5 849e72579bc700922795d971048396b1
- SHA1 5b74858941df8179e64444a6382db6404e815e9b
- SHA512 2670a769fdad774445b327ff9ca1f4c3ad07f3a6c99f12dc8ec5074e0200cd552f273f27209fcfd91134adb82d1a5047fe2cc18a0f9a7ba6ce79c3312b127c02
- SSDEEP 384:gUKJZ9H9mxBxvnWqmBlmbR+DEQOXRF86qjVtp:KJP9mNn1mub6QhgjDp
- TLSH T17F52C70867E45A31C6FE4AB768A397944674E6158803CF1E3DCC81D5BC12FBE76213EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Injector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9af2bddad2a7aab91a75a5f86c11d8147ab0618a75e177b66ce0a705de210edd
- MD5 028d94e004c208adbdc0c6da95cb6650
- SHA1 3809ea7fc8b27006fc3ee9b07eb520aa0a33afe9
- SHA512 ba34c1b1c906b7313d7c503cd64a7ce6f3d270e4f6bc7195f87e588e10c172f25eec56022f1a742673813eb6fecc3b374e9ee5e4210110932493edec792f3fce
- SSDEEP 768:XMo7GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeK05U1bRgLj3D:Xj4nsycq2yWvYAHAdDlyytCKbRID
- TLSH T17F3339647384CA33CBE9477A84B71F0843B462558E52CF3F1DC8B4966E13A968763F92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/KeyLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3abe054a19d9eed6650b71e8b3b43e742671913e3369f7b37a509487328f57c5
- MD5 a25083291f5d796bc734d6b2c7952fd4
- SHA1 c51e46b0dabc36b4c0311d6e0e766c17cd474fc6
- SHA512 65dd93283d8e17a09795f87890f8cff4e9d2b1768b7e27f671a6d95c15c857d3cbf7bbd3c642602a8942a725bd13f28e84afe5d79012d7478ca245e53a6ea398
- SSDEEP 384:LWT5YO5u9HCwlSLX3G+BQbEbo//gY3bFf/6ajV0J0:5O8ALG+qbJAYrdHjqJ0
- TLSH T158821809A3E84B35D6EA067559B35B1587B0D2005C03CB2F2CD856F62A9BBF653213EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/KeyLoggerPanel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0db6e52cbb6c4a34c6127393aeff43c1d19837522e0d4a6d5f099dac30e69c7e
- MD5 32ad32137101fba2a40ef0a73553cd3b
- SHA1 ae86410363800c5cea11e98b364fb7afddc736df
- SHA512 05b26a33d5a5171463d9ee13e866f0babcdc9ab1fe1efb4a34c69bded426051d7bd78cc2938a64cb0f390772f13069a9e80e7cf3ddd2e2b97d59c02fcf8ff613
- SSDEEP 384:GciFQxMH/vVDBsomBkbi+DV2CjQFG6qjVKzO:niQxMHXVd9mObf0CjQKjUzO
- TLSH T11F52B808A3E49A31DAFE17BBA87357444374E201D803CB0F3DDC92E67C12B6D66216DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/KeyLoggerRemover.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6089816c43423f86c25765171b3ed5ef2fee9470e7771705759e758dde8428a6
- MD5 6ee4e88dcb148b9b2e1a0f03bcf3f772
- SHA1 343403678ca22676c142fce59980556f1951cf89
- SHA512 160824f3f9509d9efda0d55244efba1edae11d98dbdd6f0dc9b984a43b093f8645b0e163154160ee8319efcc3285d674950c423bcb16e1deeb7e232873091be8
- SSDEEP 96:l3kD5XGxkO5u0H7H/6BJ3DZ3oFJdHKggYO3kKjVIIrKw:l391u0bH/gRmF1gYpKjVIX
- TLSH T1BAC18511B3E99632ECA74B71ACB3534106B5FA64DD33CE6FA8D4824F6C126148A71F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a1cd7c9c76b9067e7873fa1c2d567bd41f6aae77f481b878eabda6f47ba5089
- MD5 7b65d81fbed62f1f7ea80fbb4b1ddb28
- SHA1 ecc1ed33381141e3ca773fd8d0f1d53b4b2cf44e
- SHA512 a9d7e32d53226953fe4c23da6b22383a5838e104bb03bab0332bfda2fbca13f65b4c584555451f5492d4b277c341059a1ed97f9eada2b2e190ffe8b00fa9647c
- SSDEEP 384:vL0epv8mXSYAXIh5AUdmB4b68+tzlFxs6qjVUsQQ:zgYA4h5AUdmybE1lmjfQQ
- TLSH T1FA52E809A3E59732C6FA0777D8A357454275E2029803DF1E3CE891E4BC12BBD6B113EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a5a05f525dacb211a560d85331c3e3119811a52c15917bb7d954958ce33fa4ce
- MD5 1b3cbf9085d475a5cfa7eab2767ca505
- SHA1 b59e5486ba330a46961fd42584470fdc445827a6
- SHA512 899587dad68680a78852b18c803898f11de2651d0c58c8a399306cf1491baa3d303cff9d73ea34ad8d53c76fbb31d21eb6fa2ecfa673b30cf96868cf20266eb2
- SSDEEP 12288:nZw7dtAVHW606/8HGBSelQLSJrAgK3FyDv/yMX:Zw7U26060uSz7FyDvqMX
- TLSH T1FBB45A0137E09957E0BF2776E4F1091787F3E0467263EB4B1A9496A92D83B869C01BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
502590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
483KB
Virtual Size
482KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/MinerEtc.dll
- SHA256 fa71752c440c0b763fc2eeb8d4364400767e9a3eb9c49aa2ea654c635956e3fc
- MD5 095b2fb3ac77c2ce5edd12daa62fd3cb
- SHA1 b0a090bae7040dc21078c4b93914c3fa8a76371a
- SHA512 39dbc25e289a38878b824e3a44c05be2165cd08c5d31c68bb9e40c9a72ebbc627c41f340207fecaf8642d5262ec10e9abb000ef4b6fed88c242075cf235f5515
- SSDEEP 384:zaIt55nXJIgxnhg36Fo79YKlx0lOMhr2bn0ubcMvq/SLPLStLdFVDB65FzDR4yaO:fpnrxnOcQfr0lOM12oubnqsLehj3Ejd9
- TLSH T193B2294267D88731E6FC57B658B353088770E5568C03EB1F1DD8B0E92C6AFE996007EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
lib/Plugins/MinerRigel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 857995576d06879326c198b39b55338b320d16154e89913128b27404527286fb
- MD5 b028283d5080ff26395b30e8a13ed498
- SHA1 7cc243a888943622dfcdab6a147090e079180a68
- SHA512 ec63439180f1320b62a1d5f3257ac59c156a5d0976827e5a631f0ca05438bdd359fda832820f5bc71016655198bfb6c376803665eee7b2767cfa74fa3e61a095
- SSDEEP 384:LAhQLlv4ewV8ohOqqAbydmbLqvqoSAYIKLdFNncHDB5N4UayjVbLs6XRB:LAhMvjwV8pAb1b6q/RhuWqjO6n
- TLSH T14D922A0A67E55930EAFD0BBA98B347084671F6074C03DF1F1CD871E86816FA9D6117EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/MinerXMR.dll
- SHA256 6819f0620988f4c952fa1d4371767d358f28cb0aedd56579c15631f8dc587ac3
- MD5 1157eb3177da21c6b4d3adf97b9353dc
- SHA1 cf2fe6bebdfe50b325332bb02a911134d2a6c0c2
- SHA512 c9c932f4a5230c4d5d812f59f370b91da81fb9460baf8a244e3ca81107582d7fa811b1177cf1429a6e8fc6093ad16e0e89db89f04279f8d40add5a5b72f97e0c
- SSDEEP 384:y/vCJXJ2PiEDEJgcko3VxyQVFh/nZubcMvq/SsPLhKLdFVDBi5tDt4yaujVZgaHl:yCJIPi4QXiABubnqfLwhjnEjPgUt
- TLSH T144B229457BD94735D2FD43B6A8B357098730E6078C03EB0E1DD5A0E95E29BE89900BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
lib/Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bb5ee2c61b63f26c33d7a98f83e8387412f3cb18b518e393aa05ecd075aa692
- MD5 f2647ede5797a23641406ea3e2f157b4
- SHA1 6cae531068816813f7f870295c373b1f64c7040a
- SHA512 a37c8dd752a5de666f2bb81528c108cfafa5d56cb8c2ce7bc41ad542817e21ced4cd4e1a9926e5cf5a464bbcb7605db65a2559738b2413056a3ab2da468c2952
- SSDEEP 384:cQDV9bCfDM8OFZcyt/uXC/JBvBTb9ZDwx44X5FWfaCjVry:cQvC7oZc+/K+JBvJbPU55E/jNy
- TLSH T1A982090857D99530D7BE06FAB6E3130A4374E2125C53DF0F29CCA4E97D12BE8A6117DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Notepad.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bede3169c6a9713e3287911115335f106db0d6ea27596d8a35e5c13f879318c0
- MD5 6d693ee095f5f6d9b5019e37d1f39dcf
- SHA1 e5c827a825d649eb44d296a7e964caa997e38ed6
- SHA512 9c27eda6b1c933b29cde610c71b0478f08b8beb79121ba52ff80c6fbbb79688a938f3d0afa64e66ed95218fa2f4d114d5e4e734eda6b1fa8d501b023f1f936ef
- SSDEEP 384:EijC2xrzq4QPdLC6MFzm1fJs6/6KpTYegmBnb6+DHTRFc6qjVao:przq4ydL0o6ecDmlbnzRQjAo
- TLSH T1B952E80CA3E55632D6A947B7A8A357448238F7015C07CF0E2EDC85E5BC42BBD7A217E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e031c1a988b61a5b446ca1acf56c997b9b11d4727e87c09424d9bb8b16141ff7
- MD5 88020763ccaacdab2a2f15cf53b7f7e9
- SHA1 931965a2de1366492c81b16794c982b65fb7bca4
- SHA512 afb6a555e9b5dbe137fdc3a2f71fa0be42bb1c1c1b9ea094c06508c7db9c02921f01eba93becd76b826c2d92a00c20eb31edf6e9a6668c8eb07e7af487e8db61
- SSDEEP 384:1C3Z5FO7YXW2Uk24r4p/jzBRbdUD9N8YVpYFo7juzmjVb9Hm3:1C/WUxry/jzDbIn8ZojLHA
- TLSH T18F62F70493F58930E2FE4BBB58B307044674A301DC53DB1E2DE851F4A857BBEBA12399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3560905f6f533e37ef84d5c4c431b51f930e5c31b394f1abf1b62344f65b95ce
- MD5 f0d4a366d7eea4476a0fc473c6c0399e
- SHA1 0ed962695e923653df3547388b90cc4f703ef529
- SHA512 1029d56f6efe54e743de2e676b869260b6dbe1801cf04b0ed696a93f9b6eb7c9c4ba521cb5e268d960ef0659d9192a618df7b3567885d231bdc8282bdcf62fbb
- SSDEEP 384:MFU7aAYSWvZWgPTBadbB9rDqUOpdG0X9FMaCjVR9/n:MFUOY8xTIdbftG0jzt
- TLSH T19A72E70A97D88A31D6BE06F5B52357159A72F3014E03DB0F6CC860E26D437FCA631AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec0c609caf5082209c7247f74c75b8b88cb27c42323705efb5a8db5b4442ddd6
- MD5 223e81d938f3cd59629321b6718e170a
- SHA1 eb0797697a03b1f20370b32ad7846aaf144848d0
- SHA512 3235da4b8d2ee960e6f277e98966cc8467b5b342b5e5c0e4b7673d5db1e99ecfd3637b29da976ca4abb971ed8a3b777ef5cb76043fe506dd5b9a252567e376a5
- SSDEEP 384:s453kxsrMAI+sgghmZQmb/KDEQjsG95FQa+jVUU:s4BAsV8zhmZb0drojWU
- TLSH T10A72090897E58234E6BA47B994731B4842B1A7058C03CF1F6CCD64D97D13BEE6252AFB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81c975582673cf85d0b742c5212b0ac7ca66e40c5105b68c7ee4abe22cb97db7
- MD5 8b4cc1bb143df4bc9b4ad6207683b5db
- SHA1 41edd68f084735f7350324b809c046d1c995f918
- SHA512 158f48fd193dff8abcbd9e0b4d50643c006f393d0e419164c2d9f1d74891a115a178a50987e677572e7e2cf5151fa287c55d0641a271b058074c960c01f6e57a
- SSDEEP 768:oFIC59B2dNqnoGjZML6t2AnBRbD5lUu+n6jM:kImCeoKn3bDb98B
- TLSH T135E2190567E0C336E1FE0BB998B295088770FD12A933DF5E2D8850F958137D9A9243FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/ReportWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 967b2a798915c8e6aac4e21ff1e6ce324c4522fa05e98efd2199584187ef374b
- MD5 c9f3ed497d3285c54fb00a67a13d7717
- SHA1 b13c5e601cf3d55f8d7be072f31cd13adc00c876
- SHA512 5a6ce89372acad108783b3de7a47f423085f97eb6ac11ab9462e3891c49b3660d17c8780192bd5b07599a6f2379317ae614239ffcebac562d7577b21681cb6a8
- SSDEEP 384:a8HMg7Mgnyih5U37mB4JbAS+DEdeFWUuzmjVmYfpA:a8tMgnl7UrmyJbE+eoOjgQpA
- TLSH T1DD52E70497A88972C6F547BB559397084670E3019C03EF1F3EE881E66D12BBF76127EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbae8090c84275dac7cbdb835b1bf4dab9221b3f6ccb4c652a85d6ddd50b69d3
- MD5 174b6fa8869f6d4c638a302dfea623f7
- SHA1 9b009aa9e6103eb240d4a801a8a87ca6d815c6ae
- SHA512 2b71fa01d5eadec990d374b03909e9858476874889a77441e97270c31a35b02700d8e055c12e81ca3e2fa7403165f2f1152880433cb38e3cb4eca1a1a42ddbd6
- SSDEEP 384:286A0hS7kwKPO9JRikXx/B8wnpdNNZ6BbRpDEaCF6q26ejVIebC:280hgvi+/3fZ+bv9CIxjqeC
- TLSH T1CF62070493989633CA7D87BA54A393498734E2019803DF4F6CED94F5BC42BB97B113AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/ReverseProxyR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 961c6abe2feed5226ebc409c54daac4ee6baec2694b4231875d8220bfc5a6c41
- MD5 c01119c983b175acc6f74e77ae8f4df4
- SHA1 221e3a9e59398e4231b97a9b728c4ee5875b6f0a
- SHA512 d91ea85be479fba9e2d401dc726864e2bca248f280db0c4360419e4e0f8a295a3f52b89a21154376eb9915a429df5a705f66e5979db4b0109bf0d98384e6c033
- SSDEEP 384:j8d8aF6L9xX0FggGIlKFybAGBEnzxFsIyjVuMc:j8dqL950Cgyyb2zxe1j7c
- TLSH T11E620941A3F99936E5BE0B71A0E313484774D605A843DF0FACD970E55D13FE9A2123EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a68889eba96ff60a5d5b77b296b78140e21b5960a9dd797ee3e017bc4c7a4b3e
- MD5 2790da1bd05e29b214f2df5ebfa71d2a
- SHA1 52e817fa61f411cba7b49f3b24f8ab15e04125e5
- SHA512 5e91fde3e441c58d2dd805e3da73af20f1052f2852ae8567c992662e2c1ef0f8cf8f8056caf475f423fdedb286d3d879365f16f7639ce3622dc5be7512c02c3c
- SSDEEP 384:0uoC8Hg2VQBK1B4I/eIi5BnobmF5i/RPVzx/8UhwFc5MZdaCjVnS72K:LorH5QBK1neIi5ybXvFphwvju2K
- TLSH T1A3B21944B7D49970E6FE0BF99DB317454B30E2069913DF4F2CC990E83E977A5A22039A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acadd672c83e341185636ef55280a8ab6e0a00b1db3e1f4bb0c4e303a0c47166
- MD5 13379f36b04d160279f0fedf161fa6bf
- SHA1 c29474988aa1f4771c388393d083917c54fda87b
- SHA512 ec142c5b1a5b3432d058b3ef27e3b4055d6c59eb9d68b0d166b9c8230caf4d382898c18833c440283f0a3a93cbcc28378a15f6b63c7047d6ac58527b703cebff
- SSDEEP 384:UYiJKddChLwkmB81bwIzDE93F1BuzmjV+nD+B:UodCJwkmu1bZ63xjsqB
- TLSH T15B62D80857D28A32DABD06B955A3A7098371E3019C03DF1E2DD851F5B943FBDA32139A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e0f5f77dc930a6c34e11438d7d3af55690f02ada099179ce3538fcb80c9d767d
- MD5 5c541913426566545243a36ca836b6d8
- SHA1 eacc08eab6e73190e96886d9338d2a928d7f0f3d
- SHA512 648fb1ebd7143e299ffecf8ef965a42ea1fa56c812d6a3fbfa9c0c2b9cc882090af41ef56a2b7ab2567edcfd35334be5f7b226cc7b492299d1cb53caca066ed5
- SSDEEP 384:dbuHdTnxK4wNXeMBZdmbe1S9QNXstZTFBaCjVw/:d6HdbxK4gXHB+bjgKDji/
- TLSH T1EA62290857E69B21D7FD46BF29A3670082B1E3028D53CF1E6DC991E46C12BE967413EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b81e23fcbf3d8d66ff1bd2e1d99ebb40444acbdf8843a0bdd86c91d0696597a5
- MD5 da63c7b3125232cfc58c7e0b3425f229
- SHA1 1d26180c7fff6ff20157bf8beede8c9b7a1a4765
- SHA512 097ecb1c31b92e15637f627ea462a5c13813f58f077b365b52ea19132d21eb2f34472dafc344e2c582e4c39b1cb2e7337b931ce4e71b90482841cc5c06890118
- SSDEEP 3072:vUO84N3zbtpZhT4NTUZcL/JJnblH3xP93RPvFQgn3N1VZTtnTX6e8phzQ+dbEiyh:sdXN8pC+dbG
- TLSH T110D32B143BE98D16F3FE4BB4E4B201544632F429A932D71E2DDC64BD1B23B489944BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
130KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Stealer1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f839b4130c9eab5d39effbee77ab4c378f4f200a4580222fe0189624d352a5dd
- MD5 a25e394b16985a3ccb89da01d824a6e9
- SHA1 d7c2234cc6c25d9786b7c63c5510275315653278
- SHA512 dbc1617ef0e37da55fe08819e6019c8940ae0e06e0f731a2d2ec4c4f3ca9c9a34fa80e297c8a0cf2e4935e968cbe3fbfaa053623e0748a03bcd7ff9e89679bff
- SSDEEP 3072:Q7uPudyISxDem48NB6sbD4GL0bLPUEKNM9ApepD:4xdxSxDemVB6sbx+L8EK
- TLSH T1B5E32A6837FD4949F3FF0BB6BAB1918C8A74F4366A03D74E2EC520E91A11B45A900777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Dracula aka Samurai Stealer payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
149038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/StealthSaver.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70c613bd79765a997bed33bff389427d78236fba1b8161302fb64cd5652f7b32
- MD5 41ab3dba06003e70cfa633db531814c5
- SHA1 a0065d8c58629f3258fec36e3021784ec64ef86d
- SHA512 438aeb2df18f77eb65e1e5601c85b77238dc6d06a6fa704c29793fcf9432427680e46b1849c0fd8194b0fe528dac596ea1c364c88937327b9ef41a51faea1116
- SSDEEP 6144:mIfh3POUUuZYXjxKd01xcmF+SI/F9/ybs:pfhfOUUuZYXj11xcTJ/
- TLSH T1FD246B5573E408F9E5B78239C8524645F6B2B8160760EBCF07A0477AEF236E09D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
232526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/SysPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 77d772c434e4e30f86c240082dbca1033b2539740f92b711449802dc8dc58ce1
- MD5 d6bce031a4a4493460039b92317660c1
- SHA1 7d7b3a6431e618e8abc9b2cf312ed3ef8f00762b
- SHA512 6889e899c161d13a71593bcc4564b27681820de42c82cd369689f0574b1269b007560fb21c1f3ccd273597b512849e3c1f2f5276b1f98dd677a732f372c5d008
- SSDEEP 384:Y9tJAeAcdGFJnmOmBKbR+D1XGFI6qjVJy:AbAeA5Jfmsb6FG0j3y
- TLSH T19852B54867E5CB31CBBE46766EB3A7044234F2055D03CF0E39CD42E56C56BBD66223A9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/SystemSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fff226d97dd7782f6e7951a08ab988f23ec42e998f37a90ce0661eb12ab854b9
- MD5 5575389093a0da3b24f5b753382da30c
- SHA1 31d1cd83526ae178e87355369daaa5e189933284
- SHA512 e597cf3f19f554317b667054481977cd112bc4fb7a17acd4f70d3775f7de50004f2bd5b63dac8fd4502154a694eed10eeccbdfa67d0031c5861f07e87b60225d
- SSDEEP 6144:XBU54ZigtwJoqTwag6j6gQEuOeBddE0xuWnBWyhje7JfPzGxcFUpLVbZ+abkiMVH:XBK4ZLuYf7I0cu44elaOFozSVT
- TLSH T1ACB45B5137D49A5BE0BF1376F4F1091747F2E046B2A3EB4B269496B81E83781AD00BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
500430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
481KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/UAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf03846a8d69a71001b6fc66ac6d74ad434736b878405f985926b2fafb4314eb
- MD5 051b4966c17b0d668399d4e8b16eabe7
- SHA1 016388589c50b96da2efc0a579f73a4b64375198
- SHA512 9d437d746af4bfa0b0a8e1cfca388912aa38fce2d4efeb9f643f426d5609195bc26b03b12ebcc954393d5e731b148531f78cc9a9992ac2e19279b72a987b2dc7
- SSDEEP 384:jF4T5SO/5HfGKiacSN/nKKbE69bdbaSOq+bDzri3nUAkYGbHFtslaDu5gFGxO66x:jGTdx/Iac4/nKobRdbJ+H3i3nLg4xEj1
- TLSH T163B2F981B3D88521EBBF4B756CF202114730B56B0C23DF0F5DC545A829A5BE8E771BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Volume.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21f01ce45befbb78a0ce12d7a626df0f45ed4a1cb1b0006ad44d81c8660a3ed8
- MD5 d41d3a2c37ce09560593b786765d3770
- SHA1 2c105c041f0b9ce2145aec99f48c9df9c5cb4fdc
- SHA512 806c7452eb260ad791ad2a0b8ceaac83f8be95e5f6763eab78ae85d454b857f0f0af2c6821ea65cf92b41b986ef381de04a0da11ac31eb7f32840c2d0957f974
- SSDEEP 6144:yXcm9XQsAjYxzAWIt6WKaf/FrvuRhFQ5KvqjPFUprYbY+rbsBCK8CCMTKP+o:yMm9Wj9zKa1rvuRDHMFood/t
- TLSH T1EFA48E5137E4E52BD0BF67B5F4F1091347B1E04A7222EB4F0A9896AD2D83B91AC407B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
496142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
477KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Window.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 526fda22b12b787582da3f38a3f11d7474b74ad7b2a2423ca563c66e72edf3dd
- MD5 38e772ae9ae643ca1a6283884762daee
- SHA1 baaf3e4379c521c80f0d18b9c1f62352c08086c4
- SHA512 499a0d957eabd75bc86846942fcc9f0f8c02083c2b1c7e8aa02fff28e040d4de2ac15705b00466d04e9b000ce543fbe32e44ff6d68cd6536433eff99035b97d5
- SSDEEP 384:sINbIuZPx19uC7etI3a/AENKEOUgjoB6bGArDI9QmJyK/F/uzmjVbBM0M:TPPs4ogbGoav9j1W0M
- TLSH T1AE72F80A53E58A61C2FC06F9A5235B058671E3529843EF1F2CDC92F16D52BBD62027ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/Plugins/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee58ab97c1648c5af3647950297cef9be21745d6a7f3afe82e5594aabc810928
- MD5 da063a8ef1a5cb01dbd2c9ba906037e5
- SHA1 98bb1f3d522ab5312c19f131d389bc20862496fe
- SHA512 8a4c93dfa0d678c6d95592f9161bce5bcedff7f69f57edbab9721cad9a20521b588c34a7015482d3ce870dba99436a745853f19bea8fade43cc9075deb2d565b
- SSDEEP 24576:AOhZOvj5N/pxou6EGrwIaoivP5DkvjK47LJb1LPE4KTv7frWyHN:ABMV1a3P+vjNLPfKL
- TLSH T111E5D3026EB49D3FD33A1AFF90E1433456ACAC0B92DE964A757CFD691C72A401BC4762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3059646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
lib/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39845b81c509ff9c30c1830f6c03a969268657131e54683381ca6490eced25e0
- MD5 18d231cc32c13fa5aa08440983b68b98
- SHA1 2f2ce04b1ecaab9395c53477ccfc217917ceba70
- SHA512 b4f9bd28d9949e5c600d15227f6434c42985088d9b9900f1279d4507297e179d8f94eaed5987c1cc6b79cf189dffbcfbe0391de3f468a03ee7593e59608386e2
- SSDEEP 24576:2Hlj3heQjg1UU0FN4ziQX3rMgs72c2UXjwVH0zeHEFhA9Iv7f4NGPB:GrmYDXi
- TLSH T19E455B1533FC9777D0AE873AE835052503F1E90AA697EB4B6610EB697C837689C103E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1182062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ