XWorm 7.4.rar
- SHA256 6c70aa4d5db6567f56e8c4544aff4dcd10647cf9448bde4beacd08f5b437fdeb
Password
1234
Overview
overview
10Static
static
10XWorm 7.4/...ta.dll
windows11-ltsc_2024-x64
1XWorm 7.4/NAudio.dll
windows11-ltsc_2024-x64
6XWorm 7.4/...on.dll
windows11-ltsc_2024-x64
6XWorm 7.4/...ic.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...de.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...nc.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ow.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...nk.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ge.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...se.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...nt.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...sh.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...lt.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...et.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...pe.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...re.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...te.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...le.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...th.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...re.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ve.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...it.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ey.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...op.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...ft.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ll.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...ft.dll
windows11-ltsc_2024-x64
8XWorm 7.4/...ip.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ak.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ft.dll
windows11-ltsc_2024-x64
1XWorm 7.4/...ud.dll
windows11-ltsc_2024-x64
1XWorm 7.4/....4.exe
windows11-ltsc_2024-x64
8Behavioral task
behavioral1
Sample
XWorm 7.4/MySql.Data.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
XWorm 7.4/NAudio.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
XWorm 7.4/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral4
Sample
XWorm 7.4/Plugins/ApexLogic.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
XWorm 7.4/Plugins/AuraNode.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
XWorm 7.4/Plugins/BerylSync.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
XWorm 7.4/Plugins/CinderFlow.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
XWorm 7.4/Plugins/CipherLink.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
XWorm 7.4/Plugins/CosmosEdge.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral10
Sample
XWorm 7.4/Plugins/CrypticPulse.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral11
Sample
XWorm 7.4/Plugins/DaggerPoint.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral12
Sample
XWorm 7.4/Plugins/DivineMesh.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
XWorm 7.4/Plugins/EonVault.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
XWorm 7.4/Plugins/EtherNet.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral15
Sample
XWorm 7.4/Plugins/FalconScope.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
XWorm 7.4/Plugins/FeralCore.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral17
Sample
XWorm 7.4/Plugins/FissionGate.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
XWorm 7.4/Plugins/GraveMantle.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
XWorm 7.4/Plugins/HelixPath.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
XWorm 7.4/Plugins/HydraWire.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
XWorm 7.4/Plugins/ImpactWave.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
XWorm 7.4/Plugins/JadeOrbit.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
XWorm 7.4/Plugins/KryptonKey.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
XWorm 7.4/Plugins/LithiumLoop.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral25
Sample
XWorm 7.4/Plugins/MarrowShift.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
XWorm 7.4/Plugins/MetricShell.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral27
Sample
XWorm 7.4/Plugins/NeonDrift.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral28
Sample
XWorm 7.4/Plugins/NexusGrip.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
XWorm 7.4/Plugins/NordicPeak.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
XWorm 7.4/Plugins/OrbitSift.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
XWorm 7.4/Plugins/OxygenCloud.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
XWorm 7.4/XWorm V7.4.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
General
- Target XWorm 7.4.rar
- Size 60.6MB
- Sample260810-xwr4jsab29
- SHA256 6c70aa4d5db6567f56e8c4544aff4dcd10647cf9448bde4beacd08f5b437fdeb
- MD5 a886a345b0cf68b33d87de2e4a7db9c3
- SHA1 1855c1184a87c0358c4f573bcc42db1a8f1e934f
- SHA512 c46e66542a82ab6a3aa4799a57db7a862accc5d2c186bd576225be016e2b6710de27ec61db3dac091048f3518362d5c98d1a7232d9667ae5bc5b539a17b9aedf
- SSDEEP 1572864:po1vAXSdOTHHblJzR7jMy8/UlbNq8wLWNj:pgvAidODHhJF7S/+o8w+j
- TLSH T1E5D7337AABFC3586F6F2424E949DAFC508FB7044A933A1E7E64A147F3794760110A90F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
ratonrat
Version
-
Professional
C2
-
tico-32985.portmap.host:32985
Mutex
-
AG9XoBh66DbwilDMm9njguu
Attributes
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
https://pastebin.com/raw/5BzQ82Z2
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule static1/unpack001/XWorm 7.4/Plugins/RadarScope.dll family_donutloader - Detects RatonRAT payload 1 IoCs
resource yara_rule static1/unpack001/XWorm 7.4/SteamTokenLogin/steam token login.exe family_ratonrat - Unsigned PE 59 IoCs
Checks for missing Authenticode signature.
resource unpack001/XWorm 7.4/FastColoredTextBox.dll unpack001/XWorm 7.4/GMap.NET.Core.dll unpack001/XWorm 7.4/GMap.NET.WindowsForms.dll unpack001/XWorm 7.4/IconExtractor.dll unpack001/XWorm 7.4/MySql.Data.dll unpack001/XWorm 7.4/Plugins/ApexLogic.dll unpack001/XWorm 7.4/Plugins/AuraNode.dll unpack001/XWorm 7.4/Plugins/BerylSync.dll unpack001/XWorm 7.4/Plugins/CinderFlow.dll unpack001/XWorm 7.4/Plugins/CipherLink.dll unpack001/XWorm 7.4/Plugins/CosmosEdge.dll unpack001/XWorm 7.4/Plugins/CrypticPulse.dll unpack001/XWorm 7.4/Plugins/DaggerPoint.dll unpack001/XWorm 7.4/Plugins/DivineMesh.dll unpack001/XWorm 7.4/Plugins/EonVault.dll unpack001/XWorm 7.4/Plugins/EtherNet.dll unpack001/XWorm 7.4/Plugins/FalconScope.dll unpack001/XWorm 7.4/Plugins/FeralCore.dll unpack001/XWorm 7.4/Plugins/FissionGate.dll unpack001/XWorm 7.4/Plugins/GraveMantle.dll unpack001/XWorm 7.4/Plugins/HelixPath.dll unpack001/XWorm 7.4/Plugins/HydraWire.dll unpack001/XWorm 7.4/Plugins/ImpactWave.dll unpack001/XWorm 7.4/Plugins/JadeOrbit.dll unpack001/XWorm 7.4/Plugins/KryptonKey.dll unpack001/XWorm 7.4/Plugins/LithiumLoop.dll unpack001/XWorm 7.4/Plugins/MarrowShift.dll unpack001/XWorm 7.4/Plugins/MetricShell.dll unpack001/XWorm 7.4/Plugins/NeonDrift.dll unpack001/XWorm 7.4/Plugins/NexusGrip.dll unpack001/XWorm 7.4/Plugins/NordicPeak.dll unpack001/XWorm 7.4/Plugins/OrbitSift.dll unpack001/XWorm 7.4/Plugins/OxygenCloud.dll unpack001/XWorm 7.4/Plugins/PentaCode.dll unpack001/XWorm 7.4/Plugins/PhantomArch.dll unpack001/XWorm 7.4/Plugins/PlasmaJet.dll unpack001/XWorm 7.4/Plugins/PrimalVail.dll unpack001/XWorm 7.4/Plugins/PyreTrace.dll unpack001/XWorm 7.4/Plugins/RadarScope.dll unpack001/XWorm 7.4/Plugins/RuneMark.dll unpack001/XWorm 7.4/Plugins/SaberPoint.dll unpack001/XWorm 7.4/Plugins/SectorNine.dll unpack001/XWorm 7.4/Plugins/SilverGlow.dll unpack001/XWorm 7.4/Plugins/SolarSpire.dll unpack001/XWorm 7.4/Plugins/StaticVoid.dll unpack001/XWorm 7.4/Plugins/StellarLift.dll unpack001/XWorm 7.4/Plugins/System.Management.Automation.dll unpack001/XWorm 7.4/Plugins/TalonVista.dll unpack001/XWorm 7.4/Plugins/TitanFind.dll unpack001/XWorm 7.4/Plugins/UnityAxis.dll unpack001/XWorm 7.4/Plugins/Vanguard.dll unpack001/XWorm 7.4/Plugins/VectorFlow.dll unpack001/XWorm 7.4/Plugins/VividSnap.dll unpack001/XWorm 7.4/Plugins/VortexLoop.dll unpack001/XWorm 7.4/Plugins/XenonTrack.dll unpack001/XWorm 7.4/Plugins/ZenithPixel.dll unpack001/XWorm 7.4/SimpleObfuscator.dll unpack001/XWorm 7.4/SteamTokenLogin/steam token login.exe unpack001/XWorm 7.4/XWorm V7.4.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/XWorm 7.4/Guna.UI2.dll
File Explorer
-
XWorm 7.4.rar.rar 60.6MB
-
XWorm 7.4/Background.png.png 924KB
-
XWorm 7.4/FastColoredTextBox.dll.dll 333KB
-
XWorm 7.4/Fixer V7.bat122B
-
XWorm 7.4/GMap.NET.Core.dll.dll 2.9MB
-
XWorm 7.4/GMap.NET.WindowsForms.dll.dll 147KB
-
XWorm 7.4/GeoIP.dat1.2MB
-
XWorm 7.4/Guna.UI2.dll.dll 1.9MB
-
XWorm 7.4/IconExtractor.dll.dll 10KB
-
XWorm 7.4/Icons/A.ico97KB
-
XWorm 7.4/Icons/B.ico112KB
-
XWorm 7.4/Icons/C.ico131KB
-
XWorm 7.4/Icons/D.ico125KB
-
XWorm 7.4/Icons/E.ico100KB
-
XWorm 7.4/Icons/F.ico106KB
-
XWorm 7.4/Icons/G.ico164KB
-
XWorm 7.4/Icons/H.ico108KB
-
XWorm 7.4/Icons/I.ico264KB
-
XWorm 7.4/Icons/J.ico115KB
-
XWorm 7.4/Icons/K.ico9KB
-
XWorm 7.4/Icons/L.ico9KB
-
XWorm 7.4/Icons/M.ico361KB
-
XWorm 7.4/Icons/N.ico361KB
-
XWorm 7.4/Icons/O.ico361KB
-
XWorm 7.4/Icons/P.ico97KB
-
XWorm 7.4/Icons/Q.ico66KB
-
XWorm 7.4/Icons/R.ico20KB
-
XWorm 7.4/Icons/S.ico20KB
-
XWorm 7.4/Icons/T.ico27KB
-
XWorm 7.4/Icons/U.ico27KB
-
XWorm 7.4/Icons/V.ico20KB
-
XWorm 7.4/Icons/W.ico19KB
-
XWorm 7.4/Icons/X.ico42KB
-
XWorm 7.4/Icons/Y.ico22KB
-
XWorm 7.4/Icons/Z.ico22KB
-
XWorm 7.4/MySql.Data.dll.dll 1.1MB
-
XWorm 7.4/NAudio.dll.dll 502KB
-
XWorm 7.4/Newtonsoft.Json.dll.dll 695KB
-
XWorm 7.4/Newtonsoft.Json.xml.xml 696KB
-
XWorm 7.4/Plugins/ApexLogic.dll.dll 1.4MB
-
XWorm 7.4/Plugins/AuraNode.dll.dll 220KB
-
XWorm 7.4/Plugins/BerylSync.dll.dll 263KB
-
XWorm 7.4/Plugins/CinderFlow.dll.dll 440KB
-
XWorm 7.4/Plugins/CipherLink.dll.dll 2.3MB
-
XWorm 7.4/Plugins/CosmosEdge.dll.dll 228KB
-
XWorm 7.4/Plugins/CrypticPulse.dll.dll 1.8MB
-
XWorm 7.4/Plugins/DaggerPoint.dll.dll 367KB
-
XWorm 7.4/Plugins/DivineMesh.dll.dll 83KB
-
XWorm 7.4/Plugins/EonVault.dll.dll 1.6MB
-
XWorm 7.4/Plugins/EtherNet.dll.dll 14.3MB
-
XWorm 7.4/Plugins/FalconScope.dll.dll 2.5MB
-
XWorm 7.4/Plugins/FeralCore.dll.dll 252KB
-
XWorm 7.4/Plugins/FissionGate.dll.dll 16KB
-
XWorm 7.4/Plugins/GraveMantle.dll.dll 241KB
-
XWorm 7.4/Plugins/HelixPath.dll.dll 188KB
-
XWorm 7.4/Plugins/HydraWire.dll.dll 412KB
-
XWorm 7.4/Plugins/ImpactWave.dll.dll 249KB
-
XWorm 7.4/Plugins/JadeOrbit.dll.dll 39KB
-
XWorm 7.4/Plugins/KryptonKey.dll.dll 207KB
-
XWorm 7.4/Plugins/LithiumLoop.dll.dll 411KB
-
XWorm 7.4/Plugins/MarrowShift.dll.dll 679KB
-
XWorm 7.4/Plugins/MetricShell.dll.dll 209KB
-
XWorm 7.4/Plugins/NeonDrift.dll.dll 196KB
-
XWorm 7.4/Plugins/NexusGrip.dll.dll 213KB
-
XWorm 7.4/Plugins/NordicPeak.dll.dll 1.4MB
-
XWorm 7.4/Plugins/OrbitSift.dll.dll 208KB
-
XWorm 7.4/Plugins/OxygenCloud.dll.dll 88KB
-
XWorm 7.4/Plugins/PentaCode.dll.dll 62KB
-
XWorm 7.4/Plugins/PhantomArch.dll.dll 176KB
-
XWorm 7.4/Plugins/PlasmaJet.dll.dll 1.6MB
-
XWorm 7.4/Plugins/PrimalVail.dll.dll 200KB
-
XWorm 7.4/Plugins/PyreTrace.dll.dll 100KB
-
XWorm 7.4/Plugins/RadarScope.dll.dll 261KB
-
XWorm 7.4/Plugins/RuneMark.dll.dll 4.4MB
-
XWorm 7.4/Plugins/SaberPoint.dll.dll 4.4MB
-
XWorm 7.4/Plugins/SectorNine.dll.dll 257KB
-
XWorm 7.4/Plugins/SilverGlow.dll.dll 118KB
-
XWorm 7.4/Plugins/SolarSpire.dll.dll 4.2MB
-
XWorm 7.4/Plugins/StaticVoid.dll.dll 2.5MB
-
XWorm 7.4/Plugins/StellarLift.dll.dll 83KB
-
XWorm 7.4/Plugins/System.Management.Automation.dll.dll 2.9MB
-
XWorm 7.4/Plugins/TalonVista.dll.dll 219KB
-
XWorm 7.4/Plugins/TitanFind.dll.dll 232KB
-
XWorm 7.4/Plugins/UnityAxis.dll.dll 725KB
-
XWorm 7.4/Plugins/Vanguard.dll.dll 198KB
-
XWorm 7.4/Plugins/VectorFlow.dll.dll 75KB
-
XWorm 7.4/Plugins/VividSnap.dll.dll 264KB
-
XWorm 7.4/Plugins/VortexLoop.dll.dll 418KB
-
XWorm 7.4/Plugins/XenonTrack.dll.dll 2.5MB
-
XWorm 7.4/Plugins/ZenithPixel.dll.dll 540KB
-
XWorm 7.4/SimpleObfuscator.dll.dll 1.4MB
-
XWorm 7.4/Sounds/Chat.wav45KB
-
XWorm 7.4/Sounds/Intro.wav238KB
-
XWorm 7.4/SteamTokenLogin/steam token login.exe.exe 2.4MB
-
XWorm 7.4/XWorm V7.4.exe.exe 22.1MB
XWorm 7.4/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1234
XWorm 7.4/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Fixer V7.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
XWorm 7.4/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
1234
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Icons/A.ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/B.ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/C.ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/D.ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/E.ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/F.ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/G.ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/H.ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/I.ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/J.ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/K.ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/L.ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/M.ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/N.ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/O.ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/P.ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/Q.ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/R.ico
- SHA256 29c5baccc5eecccfa611da3ce166f99be4ff739121f720e224062aad05c62703
- MD5 0520c7197d7e9de06336011d5769af24
- SHA1 51afd1fe6b32b89dcab1d9b2c2a559daea523d24
- SHA512 58332542c02c0c5a115ce9fb57148f6e5ca8866e7ea214f1fb1252810f3e2a1e39676386c2197ad4b826956c5635c460c3c5367fb920faa4b7a1a80ea0a7505c
- SSDEEP 96:nhbbjflRlJl1qCwHk7B26JAzJaXOy1jmWbezRhH+BuNBnpj8AIwgBGf:nh3jfbLeCMkt4JaX/bqRhHGeh8AIwgBe
- TLSH T1559246C180C9199CE1AE4D7B0CC1256F8D67D9CCFCEDA5CA51E63D3EB9B3101AA1161E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/S.ico
- SHA256 9e6025ae86d1cc0c1138a32bb113529fade9c05f1324c22c0f8b7ea457794971
- MD5 d9c2c5d3f14ed150b0cb81db7d8b5ca0
- SHA1 b0b59af9aa9788493f086e9fac28b76a92a1f60e
- SHA512 d756790003328b205e8af4b1fdf6209fef66230ba21eb18eb6ec8ba966534394ab15f80717e0283d45ad41b0e4442be98bf28d0f5d31dd1a1f427bcb77df3622
- SSDEEP 192:/WmPT4w/FsN0fPTM4GJKknPx9fFHOJhJJJJJ2hJJJJ4eiK6uzsQticbygb6FUush:/l/WN0EKkn5Mm63LY
- TLSH T1DA927FCEAF989D15D92483F2045107D6027DFD8AE863974B2368B1E19E3AC931B77DC2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/T.ico
- SHA256 0a92cfd516fffc6f16a9ec6a45a4742ac1857241a1f2de352e07a8d5d990c553
- MD5 2347a0f68a678ee1f85dd94ea39949e4
- SHA1 161965b6bdd977e77cfdd2622e7cd6e92b540843
- SHA512 52f21a6e18a16906ead0e8e36846a5cede4644b7cc4e7a624b1e2859b784e4460520f852430f6718eda5f5d7f5a0a34ef0f93bff05b4feb32bc3327a54a092fe
- SSDEEP 768:wOk3O/bS8lMoFJnSUjtP6i2EHBrmFjHFispOczWCcHYFHN5HuuOxuzft:hk3O/bS8lMoFJnSUjtP6i2EHBrmFjHFj
- TLSH T1EED25AD839712B44E8F157F62802C677E4AF9EA6C8F2D7A9C4C1CC573056A0C9CCAD29
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/U.ico
- SHA256 0ce01216e9e095a10241600a839c2b405ccdc9a9738f678aeb9e554a6846e194
- MD5 bb2ae39e13e12249e0ada9bf469df049
- SHA1 2adad5c70cc014cd14a8b185022956be74d72917
- SHA512 5b550896a2cb28698d37559fc80ffa3d74334328a89c335687aa7a161f4188a62aaffc78170615cdb1f63226a2954cd27c660c8fe0ce1bfade9a8ba615df55a9
- SSDEEP 384:NS4H5vL2HtGEj+P4GdLAkTRoKQU0PAPEqtYdorehJ9rlai:NfH5sf6dnTRoG0POZtxro3Ui
- TLSH T1FAC2AF8DAE798A1DEC943971C9793619274BCC7B4035E26B0CA178129B3337C6DD28C7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/V.ico
- SHA256 57472023161c31b07b19dd3553d81d706fc961b465fdf0ea8132ef7b9d8a299f
- MD5 dcb332db52e5e94b433e96d7340f2466
- SHA1 9f5a6ce03b3306bbf87d302b9a7a7b0b31628b55
- SHA512 80e2fb216c46360c0b135f261cf8dd417d0e33aad2e6843d42a4565f64c02962326d3f7343a9c6060e4fb962c987262208331bd4096dafe758844aa148032d45
- SSDEEP 384:xcZ9l999999999999hyWQ+zuuuu102zt9T:xcZ9TyDWuuuuSKtp
- TLSH T10DA268D9BF490A55E11881F9E53FCBB24233CAF850754CE1DC07AE86785D674CE2C286
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/W.ico
- SHA256 7a1ed5a0c3a42f3f82ba2f09c72960678e7906932eba5ad3c2ce7ca8c1451d66
- MD5 9c550ae1868855bdcac606978bf699e6
- SHA1 2d437b4c271e91b2091b61dc19752a4622c39802
- SHA512 21e606979c3ba5d9b25a350e6c46af6e67c88108e4eb00ab134495280a46535dd7771cdafcf13907c9d25bb73162f7c6b84857d1b6bd9fd5b9e1fb59e89cab99
- SSDEEP 192:XQUzZZIweB28vjQvKinwHxAJjBA2Oa/Uxl+1:AL27yK6aOa/Uxlq
- TLSH T11E9245C68456D7F9D1CF097AC64786F721B01CB91B663BF4BA463140F088395FA6B688
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/X.ico
- SHA256 a115102fcf0fb1c5e4bd9721f10126e8b27655e8f1c6ea0f3c7d2a66dda0ad5a
- MD5 8d1b76a36f8e234c51d9952dd8828425
- SHA1 e97899e10a0ab77ee5de7f527c543999bb94da3b
- SHA512 e8ed42e2ee9e40ab3d80df1777604d00a7f586d59e8986567bfe8487554739d7471a37fdd18882e37c004f926f68b8a9eeeed28312ad1fd01f172ab1393fe9a4
- SSDEEP 768:7PraExoqGouoSqWSLMwl9P/VWg0chOgcS:7raExxxuwWdyZNWguXS
- TLSH T15D13BFB81989B6E0DF4790F7E07889BD83598B594D093752328237FBC522B9E3583DC6
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/Y.ico
- SHA256 6c9a51e34754c0f32ee6fa3974b23bd2c8181a9e236b4aba02ba20b586742092
- MD5 f637523c8e8df0173e952078677007bb
- SHA1 47a6c19013ee18cbce426615178481d233a6fe40
- SHA512 531868c388fd72ab8971eb88ef2a4c5b5191e03e11b60d6df30b7407cac68d38f1d2a4f4e514e2cfd06ace89278ce7dc03bec6cf26814487394e41f26fe21b2d
- SSDEEP 192:EdPuZgFNTvanN0eD1HttA49J3HFZLWz4ymrxVwooqk8zc0aqkAZdUBxJwnKbs:EdPFFW6c1jFpVZy4/M8TaqXLEDwnOs
- TLSH T181B2AF727618A6F0DFF991B37718AC926289E34DFC7D009C9D419790DA5EF430B242E6
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Icons/Z.ico
- SHA256 c8b639f5285b51dbe372d24bdcd5ae18109237261277a8a00e57f790f62f5486
- MD5 694adf44280274d07ec2be70dc24db84
- SHA1 3bdbef334d34f763474b8c3eb46c68653837e47c
- SHA512 287c6b46646d5f1758e9202c9b5f309608da77bfbb86314e2f10547f5739e376e5af47958aee5bbafde8c6d6293873d61b4012ea270acf0e7c48d0767a067b45
- SSDEEP 192:K7O93kHCWdGvun/gXTI1Wgqt28OgF7o+CYJYbzKk8OuAf7ly6wTb5fCMbrU:Ka93kHCoGqghgqtLwX82Bp816arU
- TLSH T1DEA21A49D791D4FBDAFB4AB2D5A5758AB4CB6C6C3366F6498B84B0C113BF60E08170C2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/MySql.Data.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
1179402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\build\sb_1-14799416-1710747233.08\connector-net\MySQL.Data\src\obj\Release\net48\MySql.Data.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1234
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Newtonsoft.Json.xml
- SHA256 79ee87d4ede8783461de05b93379d576f6e8575d4ab49359f15897a854b643c4
- MD5 d398ffe9fdac6a53a8d8bb26f29bbb3c
- SHA1 bffceebb85ca40809e8bcf5941571858e0e0cb31
- SHA512 7db8aac5ff9b7a202a00d8acebce85df14a7af76b72480921c96b6e01707416596721afa1fa1a9a0563bf528df3436155abc15687b1fee282f30ddcc0ddb9db7
- SSDEEP 6144:XqqU+k/Rik5aG0rH3jGHdl0/IdHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DU1
- TLSH T155E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Plugins/ApexLogic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b2630e3433dd2d50df05f6743f8c5bf4be0aaaefd0b7e1cd2cae92cbf024830
- MD5 86d9a66323a7ecae53bd8a41dd76c174
- SHA1 13027c2fe9ae978bbc3b0911e4db1695a648ddbf
- SHA512 fbb7ff523b470629ebcd02f6d389f621999030fad28fbabb8e5b503d4f7b43b256d92028986e5cdedbce8027446435eb9a51a14101e98b16f2032f262692c876
- SSDEEP 24576:QLIrdj6cRIwi3etcihIXvcQizAaUkEVGEEofvStLue+Zi:7Jj6eOGcb0QgAa1EVGEh3gAi
- TLSH T1226512B9381BAA2BC764C73FC1D65829F13E94B391C26B6F249387104F026E9D7C6719
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1449986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
0F)kgF
Size
613KB
Virtual Size
612KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
I `nY-
Size
580KB
Virtual Size
580KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
طئةو
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ةيةس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/AuraNode.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7bafd173a30e599d670b91427b7d24795143f0d77c09dd6c9fca13af150a4c6f
- MD5 d84f14824405bbb10da2bb126965cb8a
- SHA1 7daf80b867b8c132ff6fd8893444548dad070cc9
- SHA512 97c63fcbe72f9f07953604b0905146d4c19678b1fdd50827d2c6469e27e0c66defafe2cad6b035c11d80f740f383121b95b255c5be6125e13c58f6c739365318
- SSDEEP 6144:uAVH9ZtyXefRYiXMhAOw0zBii/0dSw6l:uAJQXe6ic6Ow0zBii0dSw6l
- TLSH T137249EA43A566632EB2E8B3FC093780DD13EF7731383979F295706454E166F2978AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
262146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
9c`=$\
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
;IL`0A
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
وءضة
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
جؤؤو
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/BerylSync.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a01b2d43c5cba2b14fec1e59f1651aa30febc558e5b23e2c9d99df2e9f53e7f
- MD5 555682b2e3844000d46db1939ed17422
- SHA1 2516555f1028474a0cafc569fa3ab91c29acbfe0
- SHA512 5986b4c093f3f70b78878b59b46ad49b972e37c33de9ffe7257fc2f68d40e994a47ca04a4c3b21e5bed8e2ee12440726a816359ceda3828023129971b8b9fe4b
- SSDEEP 3072:Bs/ztWljPmg6tpgx4yDKNLEaX9Sg3LZ3j2kMZZbJVBVrLBctDUP0TPFBEZRt:G/R2PmaxMdX9NxjnMZZ7Pow0TF
- TLSH T1AE44AEAB3456566AC76DD73EC2EB9829E13ECA771F43675F289317108D026F0D78AE00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
303106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
=zaFt{&
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
p% hH
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
كئذر
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
عرغس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/CinderFlow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f370cc92d6e2ccbc519ff560030d3f14183f3a3d6904d2200bfc592d52b8149b
- MD5 54102735721a2b52fa0495c265bd4f7a
- SHA1 8b5a4fc3ee86d236e602b595be42dae56018ccc3
- SHA512 44c4f5a894c49db391533571eecd525e033fcc19ce8d3674c2e761a48fc6bffa4cce4ecec12fce075b9406ab59b5d32e7e440084e6124f789256d8a9b132abb0
- SSDEEP 12288:O/jpw3TuuSvxojZ81WaQZvT7lRBkd9+zvWE:O/Gjulqjq1WfZ7A
- TLSH T1C1A4D0F635625A23C72ECBBEA2C35C19E03EDF7326821A5F189366008C427F5D787A15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
483330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
os
Size
202KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
R*$
^q
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
يجظه
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
وعوغ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/CipherLink.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a71ea7367b53600b8579599d762766849e1e6750a2f05c8ab2030d6cdf78b30
- MD5 8370d4046a02221979a8ec114814df25
- SHA1 37dfc83d0b49bd7a196f97e8fd0bfae8eb8285cd
- SHA512 991e8511cdbc7bee6d4493f7f21bbcd882b3b5a5e579a266d304aedfeca82378b0fbd886729bf15a8c3c7ec8ec0e0da02510b132d9ae1fbb8198fa1e609aa96d
- SSDEEP 49152:OxU+gkeZAyUPrHeh07ThlBUh7//4u77cIAUH4c+OSupJL:OxM2Lq//Rfcnc9x
- TLSH T157B50105A7E885EBF1BB93B8C8A28441C7B1BC059775DBCF2B4019EA2E177908D35763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2407454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/CosmosEdge.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 88b08e71e67f0f4610e96e667d4b7f331ea5aa5372f13fbcabbbbbb41ffde73a
- MD5 efbac3eecc4a904fe0fa77074a4ac441
- SHA1 2793230d9bab508888736ff8a89d0256805c04ea
- SHA512 1e628b12d6005698b2c3a06bc9421e91847b1a2a039e7e02afa89a963f6a27edee15959b26c69257c8c7a897fb487615f47fab53afc4ff9efb0f4a314140fcb8
- SSDEEP 6144:xLEMzYxiN+0bMOAyiVKT3Q+85WMuQw3pl9Z:xLjXMKiVKT3QFjuQw3pln
- TLSH T10D34AEF739651923C72EAF3F81A34925F13D8A7B4B039AAF18D706144D566F0EB86E00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
262146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
hd% !\9
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
@\44
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
آؤكو
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
زخجج
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/CrypticPulse.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 000cfccf2026b977748dc32e9c4ae8e5cb6e726ecf2554598ad44464e91cb6be
- MD5 0c95aa98ee51260d0c419ba134f6ee20
- SHA1 cf850d7b6f44a21586484fda52deef2c8f42deda
- SHA512 b823c8fa228f9fd073fdd1a9c12ab01821e28eab12737823c72293884970b5472c01bf4e5e1cd7154d7b1b5cbbb691cad554a5c73464f05f95b88bf87c12f594
- SSDEEP 24576:8cCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfDp6XssJxSPH:8H7uRfbQswUZcSByYGv5uZEdSv
- TLSH T1D0959D12B7D6D1BED1AE40B98A774919E2B1B8405B25CBC79AEC133D1F233E05D3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1941006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/DaggerPoint.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ec512b958e6884d4586e331d13eaec6fc64bca53886f89340b8edfe8b37e26d
- MD5 30b444e0ebc7f3a5764b12af74a9a2c2
- SHA1 9a1f87e8fefb56def66c7faab58c118412243607
- SHA512 5417f1400252f565fd76b54b27abfbfff173b6824b1e8fb92da68b8c9bedd33632a9b713f0df527af283cbc31b127a53e821817c3171f7b68b9e5420d3a58943
- SSDEEP 6144:v3KIHG5oKl37LtfSyUemqexCwpvZeyajh2dZ21PSwqDS8hl7rCZFo2xX:yJnft1tTuCTyat2dZoqDS8hlvCZFo2
- TLSH T1E184DFA8393955B7D62EE73FC0C39465D13E92F32243AAAF246362304D125F4CB97E16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
409602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
)@]M7h
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
A^0U .
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
كفلت
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
إهءش
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/DivineMesh.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/EonVault.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 068008c26dd532a06e14394ec3a31917906c797582ca9d7c7bedf41a12740b09
- MD5 0815539e99c6af573e16cbc0ff402342
- SHA1 7917994c52fb898e865e1f93b64c67e350fe47e8
- SHA512 1823330ca717b797f6a266d5b92937d0baba2ffca5ba40a0b2715557b64f48b0063d6cca54a8d1a7e8bee12aca90f624ae26383b7a50d856baf05ed283266f76
- SSDEEP 24576:TCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:+7uRfbQswUZcSByYGv5u
- TLSH T10A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1639246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/EtherNet.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 351d24433567b9ea704c2e4a884807752aee0eb513bf45dc7e0bc678a57c9f54
- MD5 8e1ff68af99336ba3faedc518dfc0d52
- SHA1 e434dd76b40b721a6e1dc690e7fdd8a90b5d20aa
- SHA512 1ea22a94e86f6013eb947f3e0af88caf783c2a493dfd68b24fc4d3acf2cbd91f217a3d21ccd192b82170b472cd2bada2393f7a7cd166783afc16ea1c3940856e
- SSDEEP 393216:i2HsIHU9aAPwDbbpNGKSWpyCH/5/bxY4H:i2TyobtwYp3FH
- TLSH T114E6237C74D4E8B3DBE601B68D6022F2A63EBC17F7C1B4B9984E871049273E9ED21456
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15073282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
QV s/K|
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
j J0
-0
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
11.6MB
Virtual Size
11.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
こす��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
りき��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/FalconScope.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2672478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/FeralCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b95c28895caa93432b74252cdeddb35f687a19f85b52613fb617ada2e847717
- MD5 f083da4d26fa99cd36c81a2b7775597e
- SHA1 5cefdb89edde28e52c644756534a3217f21c5fc2
- SHA512 c9c5684d10baa47fcbb7a279e1c9e192abce54f1fd1934d04644d2f5a35657db7b92fac0bcfbab567acdb877c7f5373b8ecc3fb7f643711bb75ef85bb5928d5e
- SSDEEP 6144:2F/sQ08FH0Q9kaHEODGVxcdF61lpLm4XtH15w:RGH0Q2aHXCxe6h
- TLSH T13A449E7935295922D7EEC73FC28AA899D13FDAB31342676F18A326103E429F19747F04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
286722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
OUWBa
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
M<t^E}9[
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
خءحخ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ذؤغإ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/FissionGate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b811703326822407e49ea0c1151e962470e8dc5bd23fe19c61f3200a794cf998
- MD5 6e83657f22d2096b8cb4791941bb8300
- SHA1 c4e756660db09cf7bd94782216f42166651b3f51
- SHA512 22e624a09df88cf530343efce63f89e1de62adb7873c9f651194656707eaa79e247b41d1e8c71b07b5f5b1387c32fab66372322b78ee3701a038ff1ef00c050b
- SSDEEP 384:LNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9xPCn:LNuR+ZZ+mScWfEoMZQ9xPg
- TLSH T1B57229AC67F08371C6BD0BB24872A2026B71D605D853FF5E5CDC70960EA7689C784BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/GraveMantle.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ba4aa361a80c4ea88f267d3eecde64daf69ce6f202838fed6ce36f656b4541e0
- MD5 c2c3ffd06709d4f7effa2ea650edab6c
- SHA1 ba564f311006d3212c0fecb0ec109bf50b00cbd7
- SHA512 36de83a82bc2b88a8f1fd78e32ca5fa4828128edc199ff3f0fd8a93249cf9ac13faba8a3fbab52ee4d807a74dc7164043f8d6df71eec6c0de9184e44a3fe5726
- SSDEEP 6144:RiO7BivAlibhrt59aNNihJePJpeDSbVvyXVkaHmEFfhb7RQhfw73Z5zaKW:UuABBLSoG3USbVvyzpb7RofwdBah
- TLSH T1F334AEA839261426C72FCFFE81D79419E13EF6B35F42665F28A70E114E123F4E64AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
278530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
t,xF8'
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
>Hv c~^Z
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
بءبس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
قخصت
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/HelixPath.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 87003a78ca138348791d561b0d32437d3fa9c931b57e8465c01fcea5971c719e
- MD5 f978b1ff403bd512f932e462dc2bf046
- SHA1 01246056ee0c2b973d8c3eb75b54a2cf62ce9e6c
- SHA512 64161b1c2ddaf66eccce9097c0b6072e45c41bc969a77cc01bc9d476923e63d1a2b3e126060366300e55ac4f78eb26349d975228ea99f49ebc922253ec8c00be
- SSDEEP 3072:kRWo0y/6pTGIumoYEqFUAcfGg9DrZ0KJX4+Ov9LIlJ4F+b4Nk5kkJd3:QmxGIWQuDrZ0KJX4+Ov9LIl/bok5t
- TLSH T1FB146D7837122925EA2EAB3FC297B955D23EF3731342665F366F12514F021F0978AE18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
221186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
!,?Maah
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
v?4
TS}
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ةحيم
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
قزخر
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/HydraWire.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da5495a72a8e014e4776f1aa3efe1628a687bb4aeda3d1c5c6bfcfa71cba6712
- MD5 b9d200144fe8f2e2733d73bb39063b8c
- SHA1 ddf3ad5e1a43d63782b9516582e153e8bc8b2c33
- SHA512 03d2d646cc9317710ad71079a2d928e2fdeeaa79df353d5cac9f398982c69f934d2ace72bb121a827a74aef20ace7a6fb1fb8f17b667257925429485eb0b90af
- SSDEEP 12288:s+F4pzICFS+MHpyipqEGzmESgYb4kpNzH/q4:saqIC7MJqE5jxjq4
- TLSH T14894C0ED29996923E77E873FD1934418E23F8AB25242576F2CA317408E477F19349E38
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
450562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
dirh
r|
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
�Tp
Size
204KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
غآزك
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ؤئنه
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/ImpactWave.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 587abdd08cb32e5c1780ced38a799ab50add04882fde7f7e32292406c79a8cb4
- MD5 b57ebde770c74a02b4abe4e20cd4cd65
- SHA1 8c58fcabc6c57f65ecdac9ae77b19328b36dc64b
- SHA512 41db5ddd8c51a192153de8699d4a30f75a046d6e7afd8c242b81e0b78189b843e6ae83f236e7bf6ac4a4d5f70c7c0d44c6cd1a50de1bb42a71c5b6e956c814aa
- SSDEEP 6144:i9sl/zi2ZLdNYWPrBrldTwD0QKCJsOdisM22lE89NFmGs2H8pey:Cye25lOPKCJa9N8Gs2cp
- TLSH T1BE44BEB42A655A32D76DCB3FC0CAAA29D13ECBB313835B5F186346654E025F4D78AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
286722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
-1FKFIr
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
8 ^T;
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
نضوى
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
فشىغ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/JadeOrbit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f38415db4e35f47611f8266a1b753c712ecd64b2f54e1cf29f7a9a61bfcf644f
- MD5 79c9ee6b7a72a7f7f75ac62b1d318a79
- SHA1 a467c1a66be06fbf6dc8f8b268c756633862d6e9
- SHA512 4d80347758b1a79b18fdba5082740703d9d1fe5e16334a51ca597448727104a4f7a72087c457dd64e0b6fc125f2df5b76769f633f236a245133b707c674c96a5
- SSDEEP 768:PofXMCBlQ6Kms0b6GE30Qs1YKtq9oQog1zqoPPz:PyXTa6NEBs1YKwo8fL
- TLSH T147032B4937FA0621F1FE0AF5C873A7289331F5935506D70E2AC9A0696B736C29610FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/KryptonKey.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ffc87b460d490e218769c72b46724b73ab6add0bc46236e5649acfcd46159c81
- MD5 d246bd4171bb18a6ef6c12446acbc641
- SHA1 fa7c5aa91089dc3616d30223a3a154f111763796
- SHA512 58e6e5f5ce19b2260343c27422aec21953cdd3056e083abaa127913929a34807478b4012ba57811d596f235f22b6e619655b0ebcc001a662a51f8819cb6707e2
- SSDEEP 6144:piHFPaCXRv34V9qspVlDUiQK98T2Rx0FZ8rjxQ5:zmzsprDUiNWrFZ8rjS
- TLSH T147248CB635959A26D71ECBBEC1C75C58E03EEA720E825B6F29631E104D133F0DA87E14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
C 7 Yc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
o7RKf E.
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
شرته
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
رإثس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/LithiumLoop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c375193ca7074df4255f3ab43c796f69fb5938f44bddc0dbeeb6625f94c5c7d
- MD5 ef0ecc62b119c64dca88879473004743
- SHA1 da6008c1194f5c500737afb0abda2a9125896368
- SHA512 b3b188e2c0143c58f2724f55235ca494cf2a51943378c25e16d9dfec3bafd335f25af7e9313aa268f216075c8bbe7bde8540dfd7809f37b4c459b6d7d6f01d93
- SSDEEP 6144:YOGhT+dobK+lCMk/bvFVoGSqgmOG3Jg+/Mg+vwq8uRvi8UCPKaNT/2Wfkn+X:YO+f3Y/rAG5JyPquRvi8UGTVOR
- TLSH T19494CF693565AA27E7BAC63F82C75828E13FC97B5B43675F285302104F026F4D78AB1C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
450562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
D Y*
uH
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Nox&,.n~
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
رآغس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
بميإ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/MarrowShift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 16d6313caaab8d850895af6e8033aaabe65498e99a2faf3b49d2c084d7a34ce0
- MD5 e51c412c8df19249adb10b0cc8b39f88
- SHA1 f2e999d3e1d0218a6fe1215a1534049e40d97398
- SHA512 e50a511075998764512eee7133c001bb66c3a427a60084d90a6ab5acce650cbe5ee2211f580e0e684b7e8ca9d7e5d32b11c600d0adf3052023586ad61012140e
- SSDEEP 12288:JVnchrRTHcQ3nrn6xtI9qR5WKygA5KeirCDD/:JtJQ3nrnMI9MUnr5Kei+DD/
- TLSH T168E418203FE8E01FE4AE73B5D4E1972156B4E6427296FF8F258056E80E833886C555BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/MetricShell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 42e299741caf374e3d5353dd4a6d199910c1ba5dbe5d65bf9225c80a4fa7dc0c
- MD5 565a00f87b9fc1373886735c47dea37e
- SHA1 808addc907e5c49cab6ecff23b993921d6b6539c
- SHA512 6af861e85762d5c9b3b977a2a2b10f9cca02f4c2fb8d0f9fca156dec5eb28c32fc44438cebc1b5abe5e31b2f0de4ec56c14c80638a82c5d855ba2c33845696c8
- SSDEEP 3072:kVGnG3dWfvCBiLiHcBcSkslSXOJ0E1i8qedf/UFAEQFDrgP0+gcZQN3GgY:GGnqA3mcBcSpUXINq2Dzhc2Nv
- TLSH T128247CE93B915522F66ECF3E81879849D13DCBB31783A67F24670A118E12AF0DA47F14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
%pw0T {T
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
]LAdS$
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
يبظئ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
شهون
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/NeonDrift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee0cbe0c92d40ad0c66ea044b2a38a186b61d0750562f6d9e48c5931e80b50d6
- MD5 c0598b044c569e821f8e0df40f3a25a0
- SHA1 c9eca47eab3f7be74b742e66ff3a3e30896ee075
- SHA512 5e321f165d9a8fb67b85b381056c2cd6bce7d65f718d2acdabb0c9403038c3e44d813098f27245e5c31321e50df051bb7557554b56191b57e981aa6b624ab842
- SSDEEP 3072:vH7BI8u/CnKYNul2b+5st7Eb42jJutmvNEQH9thWglbPqiKFfZhMPgVPfdS:vbBI8uMlZt7EzuwFxHhlYf
- TLSH T11414BE68B76819EDCE8E2DBE809443C78B7895A2DB1363EE199245B10CD53E40B61F1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
,
%j{
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
M% )>(H
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
广原��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
肥南��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/NexusGrip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 205ccc49d98dfdc9f730bbcf80b2860c5d9381c5eca24b5dcb4a58f04b8fa4d7
- MD5 4f7528097772b02d77ac6db9ffaf8fe0
- SHA1 c88036efe1fdd9bc0a3d7035461e6fe695210262
- SHA512 324beb52e725c7fd6d95c80c817a5d7156d3d79eb8ae15215e8d702d35c7f478a36b08878ebac7dda2b9a34d1d9b7ff1ed3a4ad695aac52e6bf2ecae270ab361
- SSDEEP 6144:2s2SyFBsUEpUJ9tRhs+kr4GTYKmqfvRR2yGmhC:h29Fn9tRh8r47Kmqfv2yGmh
- TLSH T1CC248EFA399A5623CB3F9B3FC1879859D13DCBB31283665F25A706004D226F1DB4AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
L+Ce QW%
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
JDe5spy-
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ىرءك
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ىفاك
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/NordicPeak.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9cda1851bae66258401866077c9bd6d8bce9abd9154372b59fed599ab8e5897b
- MD5 edc57af0dfef2bbb80d44e6199fdfc44
- SHA1 c5f7d26ca11da5c54a6ba01ac6d0a9891601eb97
- SHA512 3d7b64cd19de4a9b3e86385f5ee6cd14855bb9b15cf785d2ad2e91700210e9747587ffd2c8140bdff643a136a43f22556cd0fde84a596cb7b9f09df04f1f95f3
- SSDEEP 12288:evUk4Cz+x/KEth2wZtK1xLaFBFYguwEdIIFbV4sAKa+wEp8Ta1i/w/ME20:eP4rxKCYfKFOw3IFJ4cTp8TaM4/
- TLSH T1CC65838565429639FB8C1E732A05D70E492240AAA751BF090DD78D50B8E7FBE18CDCBF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1472750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/OrbitSift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afe528a38eac589f13f26d1f350f7c87595e1baf02c4d6b2e2a5e908bc0ef174
- MD5 855db96880943ed44a6ac6ec58aaa514
- SHA1 449b1eaf597a0ad06c7dc6ac48382ded8bbe6829
- SHA512 ae133fde0785faa56a7c2e250943b9c17507369e3651cca5198bf2e9f329e648e5737806d4f80d30fc6584a86e4054b5e12752aac808f6ef58d497fbaeabe991
- SSDEEP 6144:2XVKIJ5A5aDsqZP2Tx3prFetG13Zv+yY:2nJ50agpZeo1pvlY
- TLSH T1FE249DE835155622DBBEC73EC2878887D23ECE77234256AF14E316505E06BF4E78AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
F(dd$t\
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
qh<Z`]y
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ببقق
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ةآصخ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/OxygenCloud.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66e18f8c94cc0938f99ad2a46494a331d3d0d5051f076dd75b81a429f8acde38
- MD5 2e196ca7f33a35d83b1d96775d306bd4
- SHA1 8320471565bd8a3ab1669669744e384833f5a51f
- SHA512 46a56fc89cff38b9021797730aa686cb91b5b29a3b0e899658fd06377c84e84202121c773f114432c535b41ea1012377234ff69e0d59441e84117595011b9442
- SSDEEP 1536:jIGHIpBFX4jm1RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRROA4T/CE2rvhndgVah:kGGFX4DA4GXhndgcsV7sqBSZ
- TLSH T113931988A5F3CC67DA9C8DF70D63154E2D788C932112EE295BC7C2A5A7827D10B1E673
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/PentaCode.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c8216a20197cc365e90089ae9dcbb8f8448ca8887409ca1b89dd7d221479fa1
- MD5 320f182444a4aeb430c74dfd0b2bbfa7
- SHA1 9e4aa3e18117958eb45a810f4a71836387fa965b
- SHA512 a2ace9c46acee02da9dd042f1629295ef1b85777fddc28b7645362a54df49c70485416e7b72dbd442f37500a7abeb9e7051b5518dd73b1cb25ce6011a7597327
- SSDEEP 1536:tE3P82P1EMS36K+B+iV/zmWykkkxxlbvtU9:QAH9+RzPykkkxxlbvt+
- TLSH T179535C8977E58A34E2FE0A35887397189372E19B1513DF0E16C6A06A7F733C18551BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/PhantomArch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 47eb4560884156bdbe539c4b2852e31149dec39a425920eee899c361ef1c246c
- MD5 a4da2d2aee3ccc3ffeb8ea2216c6003d
- SHA1 bb765ef1ff756bcb215e62bb140c27531f31e969
- SHA512 d8f5c3af0476697ab8d1bf05ae6b596c6be5060e2d192e8ced237a6529f03fd3d25ca5f981bf72363646de3f11c61e5dc27721469d6f615a40f1fe3f0fcc9f47
- SSDEEP 3072:yG7DGnEXZN9TQprimeNRRC9A4M6z97jBa89SKgoji1QU87Hh+CucRd:j7DGnEXxsUmWA/9YzoW1QU8V+CucR
- TLSH T1BC0483C4A57392A4CA8DBFF3256F139E127A2CE62505FA594FC7E1D9AC412C20B1C877
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
186206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/PlasmaJet.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a59b0165a57709d24cf481d15984006929f8601b7ac774a2b5ac140f5e5ace73
- MD5 9837b64af52b4b59e6849b8a40ffe8bd
- SHA1 902daaf4f1be83b4ced58019da50a41be87b3d1a
- SHA512 ada148fa10a3195df4113fbfecb23e7288abba64aaba105ad8400d70ad674144efe1a8f767b01fdeac02ff225a2e4945709820dfdba5e1bbfe8c073610a7da92
- SSDEEP 24576:GCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfCJ:97uRfbQswUZcSByYGv5u
- TLSH T137759F62B6DAC1B9D4EE40B9897B961EE7B678440B348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1670958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/PrimalVail.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ccb3195374a9be9636584c6805fa532cf9a9765a2b8e9539b0eb7a0b4ab4f553
- MD5 c5f5f14aed404293e2de48b68cb9c186
- SHA1 6ad9d7b023844d68454c94c0e3bfb1c9d96ffb96
- SHA512 bfbedd10ea7c265d8380011ff08a7209436e0f0357970304ce3aee3f507133936c444f2b3a10f227ad6985d1aa66134720848f523a30be8c154c1e209da74b2f
- SSDEEP 3072:9P/0Y+NbLbHUeK+/oD8xKb0sbUTTAe7FLQ6gWSFPhFAK6Ms77:9X9+lLUeK6xi437VNgBPhg7
- TLSH T1C9148C6939655526DA1FCF3FC193B819E13FEBB22282279F24671E204E067F49B47E04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
237570
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.U|-^s
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
8kfg-)
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
إخأح
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
عيؤي
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/PyreTrace.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7629163ae38fb4392b1081a290030ceb67febdcaa8f7a5712b82d97a991c79d8
- MD5 41c2697ad6c82bd4cbc8f8187ebb8f3f
- SHA1 7419a8115aca60a565b0b3b06b2d0057bba02bde
- SHA512 4bc6a6e349fed04b2e72e7bd6571e6219b24a612a0ec143b2cac9ed70138742e71ecb32d1be5190c9529a67c0a730409c46bc6078f5ff6deb84ded23dd4b600b
- SSDEEP 1536:BYOj1HP8ca6qKiMRXLgmj29xy8XVx0F4FX9+Q7RnVfJbhxSTN1:e4kv9M5gD91P7+aRnVfphxS3
- TLSH T106A34CFD36A1D937E65F8B78C4449263427D5EB3CB5372FD2DAD88600D216E2EA02D21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
139266
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
Fu}D -'o
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
V$?E4S
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
にも��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
そに��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/RadarScope.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 85beb16b7fcc71efa6377b6494508ab4f52dd04135d07a5392c69a11479c2ccb
- MD5 9b12fb86c68d6cfae2fa67b2c0a3204b
- SHA1 8e9bdeb355ab4d564be5655e606ccae5e8c043a0
- SHA512 1ca93dc0e22851c0ccf2769978a586d365151b1c5d1a73f5ab4414a3a02c19228d5ca9f07e1a96afba69a734d4a80657af17e2c61b7c5c2be295f1c0c9995484
- SSDEEP 6144:wdCTlkH9+H5rsGB0XEYMSqm6ysBfvgEEvqWBX:gel29+HUIm6JB+SKX
- TLSH T17044E045B2B38EA3F27C81B3C9C0C92A6771A046A611F71B0BC6C540FBAFAE05B54775
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
259KB
Virtual Size
259KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/RuneMark.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da1061c91058558d1817876e49986e3681ba48e3ebb7146b4de48e11a088fc50
- MD5 eebf5939d7b788193d13ff247b5b7a67
- SHA1 6714bac2a43b77d1b0f3a7cdd774e1128388e1a1
- SHA512 cf4f8a49774e5d04b87a5c4a2f88c73281bd39b09fb951674e82bd6846930dc25a3d7ead914275ea2f7f2e10f3f0ba6e9afb6d6d91c45bc8aff75431b2619f18
- SSDEEP 49152:2lEcbwRmE63g7FFHxUZ2MZsibvK8UzbP/c+32FV3aBsxBZVeCtb4TkQNcj:2lpwRmE6wJ89siIb
- TLSH T180269D4567F89E23E1AEA37295F000216BF0F86AB323D74B6591A6F91C13B816D4137F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4655294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/SaberPoint.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da1061c91058558d1817876e49986e3681ba48e3ebb7146b4de48e11a088fc50
- MD5 eebf5939d7b788193d13ff247b5b7a67
- SHA1 6714bac2a43b77d1b0f3a7cdd774e1128388e1a1
- SHA512 cf4f8a49774e5d04b87a5c4a2f88c73281bd39b09fb951674e82bd6846930dc25a3d7ead914275ea2f7f2e10f3f0ba6e9afb6d6d91c45bc8aff75431b2619f18
- SSDEEP 49152:2lEcbwRmE63g7FFHxUZ2MZsibvK8UzbP/c+32FV3aBsxBZVeCtb4TkQNcj:2lpwRmE6wJ89siIb
- TLSH T180269D4567F89E23E1AEA37295F000216BF0F86AB323D74B6591A6F91C13B816D4137F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4655294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/SectorNine.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37a38d220bd483b47014a21cf409a620471ad34bf287d31c465b28e42ab9cfcf
- MD5 7cba78a92f0aca9642546c13000244d8
- SHA1 d956a147f491a30e542e1747d23458f1919e8cc7
- SHA512 64f5509bfd0c168577d158d70eb07f5aee4c911f1e65b5dabad9a44b6fa0bd5ca3b39450d566bc5b6a4262f3ba281663ffd5ed01a7933a645f7bf23c77c81683
- SSDEEP 6144:fwz3I8z3dzpmtYsl65Vwy6L8tpXc1O4PSs2uGVVVl:fwzYmNlmK46TwzIjXiO4r2uGVVj
- TLSH T16A44AEA934655A36D77EF73AC1F78868D03EDABF02425B1F148366145E02AF4F78AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
90cBy
z
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
1E AB
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
حأهإ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
إذإظ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/SilverGlow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 16a2798e1531f10acc2518a498e25f1110b0a30688522d8e948f5298b3ad5d9e
- MD5 80c111859ebbbd5b101532832b26761c
- SHA1 99ef500a580dd47e0f3a90230b4615af89ce12de
- SHA512 bc75b0e65dc3d63bd32c67d9bf3e3e3230a8080e044be4a2437cb8de3fb5a3eb578080f3c9f081836760af3bc313aaf396b03fec01d8e053ae6347715dce48f4
- SSDEEP 1536:o79H1DCH6hC4ZQ3BddS1PjCxIngXpRz/5h/V0fOiqwki/ur7IlKSZvdZny4c:aFCENZ+dSCxIMxh/V2Oipc7Il1vu4c
- TLSH T1B5C3D888B5B3CC65CA99DEFFA5E34B4E22BE40D32501EB111FC7DB989C526C50A08977
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
127294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/SolarSpire.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 18573362a15bd14ba7194ffae8dbf7a2db5755fdf7c5da43f6eae3f9321c9f6b
- MD5 4dc846e677dc66a9c6633ce90b8c1b93
- SHA1 a911e7e7afedd2f0ed798f6eb7be4243dceeefad
- SHA512 aefeeab7e453fa73a1457777d3418feac3201c3fb807beb18a45cd8f864cccc7bbbbe293e0e3f09ed1b9c4a2df05627035ec56c3e1fba95e978dab6db26c09ab
- SSDEEP 98304:jmwfnyEdYorbv9bYIlUqpGdOq+xYbt9xUu0RUnG7:qwPFye9bYIl9pSO5xY7xUuJn8
- TLSH T1C116F11437EACE6BC2A55633D6F453652333E865F3B2C70B52A6AE3E09437005EC9369
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4431874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
oo"igo
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
4-W=Ep
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
AF24B1B
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
FE360FCD
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/StaticVoid.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5cb62954bee72039d191a39715bf887d0fddba1ced6058fd84c96873e7404f68
- MD5 21960d97a472ad7fe847a05f1231b458
- SHA1 16556bde7a7b2e6967bf5bf7a2b92ea0b40a6193
- SHA512 6409e3910f8a951ad1dc84a6c5b32fcf24f373e3ea8bce325ff0cda17d67b9a2bf5a3bc896a4892a99b2341406e5ad3f6f14d7155ece14a840a6d8562d4d95a2
- SSDEEP 49152:jY+F5n7uRfbQswUZcSByYGv5uslbXOuc:s+F17ul5ylbXS
- TLSH T155C58D41A7C599AFEA9916BDA6A34A1983B0F4804FA7D7CB47CE123C2F273D42D74311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2673406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/StellarLift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/TalonVista.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a690c4aaca7a9d18e3c3fbe6064aeb53938a7fb2f9f6f34eeafbcbcdd7826bc4
- MD5 5a65c188bbd5b1670a7c144a8047b204
- SHA1 79412e1b5db75cc21421a70bd17b9c6156723cd8
- SHA512 d8baa1c35ce9230afd9bedf30c0c0c7a224ef7752832991688a3249271ec3f7eae068ec113baf3a14b15f1bc7949d04cbefe587564e6c191c0ce0aa84403cf4b
- SSDEEP 3072:ebylIZ0HcdrTz1z2fjmXVTniw3lTVFwJnTlLT0syHBji4ABBnRrnv5zEanmwKlRd:o0HAnzijgAKtUT9T0si+fvBnVtnPaG
- TLSH T191249DA536012626FB2E8F7FC1A7B919E33EF7731342565F295302508F416F4A78AE18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
V~zqH
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
!+y O
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ضإدر
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ىحنه
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/TitanFind.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 830da300a32cda26f6e930876ee45815818a08fde80eb0915f923f8941b81505
- MD5 24fc58f9c2b648f9629c8d3df617b140
- SHA1 caa1e60b43152cbb307cacb4867e83b0e520f4cc
- SHA512 a7fbeebfe683bd7ef32348567d85ff5e7e399e89d89729dab20bb384d197d082fb8db7a405dc7729da4e629a79fb6bef5fff63a647dd65f98a8548d31c4039e1
- SSDEEP 6144:37zUSWUQf5wYowg/XPd38i4URU0LzvWKn8vCRs:PTQqJ/1yURP8vCR
- TLSH T1BF34AEB93C562A22DA2D973FC0D3D81CE23E86B31242665FD8A747501E266F1E75BF04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
270338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
?j>m\Ug
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
'_ g>cnl
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
قفثت
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
اتاا
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/UnityAxis.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 356593e85350876c5e661dab2bcbf05836d316902cf4a866effb06539eea04e7
- MD5 c3ef7d1336d02bcbc25bc313080d7d59
- SHA1 8635a807fae7a00711022d5cc7d4258e1df7e82b
- SHA512 50cb00b1272fea1e86b3d54995f3f46a32b9febdd19c127200abc9d9be87ff15a9a3d690a692e50df19f760581b3acb8859deab9d17c8320e77356a1ef82df85
- SSDEEP 12288:EiCNXWez+LWPx8Z8UUZV5qTmcTJfAbFZzPlauYynCjxKjlFkJ9TlKnkdoNNH+9EX:EXXHz+qPx8Z8U/TJfAbrjgJ7xSEBKnvf
- TLSH T191F4D0B538A59A67C769D73FC0D74828E13ECAB262429B5F34D307049D4B6F8D38A718
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
778242
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
f/%i
Size
205KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
yWS>9 8
Size
328KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
آضنأ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ئذجش
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/Vanguard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b59e1be553220c92d51ba2bc6f995faa10232daef5dfa60df52e41afeafaa922
- MD5 6edc9641752f760e4f9d0fe7a8c3a25e
- SHA1 769bd739350fd434fb727057f6ee9b0767f09001
- SHA512 10c97ba20d075527b7ef1b528e18da4edff1a40fc2c2a447a71bf324be66578fbedf20fda7978eac160854c1f5fc2b51679245a66fdbc99a16ff15473672f90c
- SSDEEP 6144:MZE66Ln1p5eZqVHCaYYLAwe8RuHqys6KUbeeCvE2:M26c1pQZqVH4YUw5RMTsWe62
- TLSH T1ED149D787BED6619DE8E4DBD10AD861F433C8263570A22FD157642A10EB37E60793E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
FSA $n
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
#'Y)0(G
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
广阳��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
和贵��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/VectorFlow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3935ae2d95dcb3882ed3dea9608cb6d911e583fbba631b505fefb3ef2653400a
- MD5 ec31bd12e7387a37caa3fc64b58c8b3b
- SHA1 ce670e9405aacca794c72b4a95e4df365a0bf2a2
- SHA512 5515565a4b3d377b7d45d0ed3bb666f8ba9ffea0cadcc0fa2df67dd0a3c763b1ba59a0ecaeb3c8d4b9ffc2f34f93f4fd00b0e1986cba1101c5f3ceb49c587647
- SSDEEP 1536:gUHh5VtnielcOuilKUzBzN0bUq6z3JN0/:LBTtiqcOZAUdzN0bUq612
- TLSH T1E173298969E7F469D6DFB7F705B399DE227840627B03FB260BD2CA945D136C8CA10036
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/VividSnap.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 09032b654b6c0b3c2a1102239a895e6ea8ceb89a221ab15a3f117ac78d0e170c
- MD5 a54386753daa3852bf9a6a6608b6a40b
- SHA1 22b3280d16eccdc61b2a75c0c245a4705d205e64
- SHA512 59807d96c6073cc2fcc1022d795fa136c8a08377a51bcd6e3538681176fc51ac93c65fbc90d7b13f19b613630171362ba1bee21f557e5423c016b861ab368a02
- SSDEEP 6144:OiSop0TbSdlSNb2URskebZeUQmHNjB2i0nlQuvG2lS:kUmbSdlSNb2TbwUQmHNjBYnlQuvGr
- TLSH T16344AFBD355A6537C72E8B3BC3C35818E17D8AB3D2825F5F185346604F026F5EACAA18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
303106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
'xe~Yw
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
"4D
)f
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
تشدز
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
حظكأ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/VortexLoop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f0bdcd1b977b8e1ff1a76b9e2730e055bde8a42dca805ee4ca394b3f644d867
- MD5 780282da4a2062c6822a2dfa87506d4d
- SHA1 ff025e6383d02af1ca681bd7201ccb72d41e0130
- SHA512 9e75054e0c7205dfa94bdcbea4c9c049657a2e9a78f004c5d32d89cb448d3d91f3f0b8a6f7f95331418893026dae33c2033b712b507c544ba96f5c094ce3666b
- SSDEEP 12288:hEaYXLEApbzzGHsnNk/Pz6sPRrZFBsNTjxWuJ53H:wTpb/HNYzFR/Wn53
- TLSH T14694CFAB34265522D72D933EC1E79C28F07ECEB65B826B5F299307114D066F4EB4BE04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
466946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
s~+}`H
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
VsTau^
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
جفيح
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
يآاص
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/XenonTrack.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2672478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Plugins/ZenithPixel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 483b849150e3e62b70fff928608ee870501d5db6add115e0f941983187710296
- MD5 5327d62f3664e1f49ac9b1d245d997a9
- SHA1 c8826eb3a8fa4a72b744e2d7b3b49d22ff2da375
- SHA512 c4b2bb994a3d4aff32b8413047c2e3cb33c89a6ff580bfe0201bd24b14dc1c08919c0cca5f71b403f713fb428337b9ab6c140bb43018b13bcd598fedd18bb111
- SSDEEP 12288:P0OeMv3MrIb8CkZKobg3Wi1kRuSvazv+Uro:MOe+WIb8CkZLbg3Wa3Waz2j
- TLSH T16EC46E21BBE0851BD16F33B2E0E60B2A57F1E4467726EB8F548096EA5ED37534C40B93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 7.4/SteamTokenLogin/steam token login.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1a3d6fb4ff125ffc558d07222dbd7ffd1098936cc4f15ab8cb2de22af46630a9
- MD5 4854520fdd296bbb189abf2135cdbdec
- SHA1 1c98825fc265fcc6c8f37ad965d61cc11cecd774
- SHA512 f469fcf03c78532fc919676efc3387c15a9ed850e623df5c76f91ba0fe9593a5669b7b11f5721216f0a06075ef68ee725d00d75e08e98c963bfde7df33bcee0c
- SSDEEP 49152:McgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4WK8:VgVUuHjkDGjYQDGuRxzew
- TLSH T1B7C5016833F9860CF1BF0BF4A4B149664B71FC079C96D76D18A579EE04B6F44AA10B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects RatonRAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2559550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 7.4/XWorm V7.4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 98f0a3fe8cedb340ace6bd1dcb57360d75e52b63074fb39cad09811da8ff4378
- MD5 69798950c9f217f0f1ac75264a7fea40
- SHA1 864b00372a97975c8c56bfe56d8837b52bc038a2
- SHA512 dcf3117d985086868e88ec9f972fd80edc9185c5334498bc32a88b09d389029190cde6053b0cbbfd8c509f1804c01ff5badc64bc84f75bf7aa5e84569cf64a15
- SSDEEP 393216:bdoTzMjoCm1w7UzfRVM1EOJOy0VM4Mas+M0HKefOd1p:bdyCmG7UM1ky0VM4MvbM+1p
- TLSH T15D379F64B4B4587C91627A3B05B2170A6B38BD1AD65E75F50E8FD00E20F23F4ED2D9B8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23108414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
22.0MB
Virtual Size
22.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ