XWorm 6.5.rar
- SHA256 1a0ec5c80430edda2736c5e4dad4083bdcd78a097778a0b85c241bef87e6bdfd
Password
123
Overview
overview
10Static
static
10XWorm 6.5/...26.vbs
windows10-2004-x64
5XWorm 6.5/...26.vbs
windows11-ltsc_2024-x64
5XWorm 6.5/...27.vbs
windows10-2004-x64
5XWorm 6.5/...27.vbs
windows11-ltsc_2024-x64
5XWorm 6.5/...28.vbs
windows10-2004-x64
5XWorm 6.5/...28.vbs
windows11-ltsc_2024-x64
5XWorm 6.5/...ox.dll
windows10-2004-x64
1XWorm 6.5/...ox.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...V6.bat
windows10-2004-x64
3XWorm 6.5/...V6.bat
windows11-ltsc_2024-x64
3XWorm 6.5/...re.dll
windows10-2004-x64
1XWorm 6.5/...re.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...ms.dll
windows10-2004-x64
1XWorm 6.5/...ms.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...ta.dll
windows10-2004-x64
1XWorm 6.5/...ta.dll
windows11-ltsc_2024-x64
1XWorm 6.5/NAudio.dll
windows10-2004-x64
1XWorm 6.5/NAudio.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...on.dll
windows10-2004-x64
1XWorm 6.5/...on.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...ws.dll
windows10-2004-x64
1XWorm 6.5/...ws.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...at.dll
windows10-2004-x64
1XWorm 6.5/...at.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...um.dll
windows10-2004-x64
1XWorm 6.5/...um.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...rd.dll
windows10-2004-x64
1XWorm 6.5/...rd.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...ss.dll
windows10-2004-x64
1XWorm 6.5/...ss.dll
windows11-ltsc_2024-x64
1XWorm 6.5/...AC.dll
windows10-2004-x64
1XWorm 6.5/...AC.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260426.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260426.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260427.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260427.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260428.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260428.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
XWorm 6.5/FastColoredTextBox.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
XWorm 6.5/FastColoredTextBox.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
XWorm 6.5/Fixer V6.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
XWorm 6.5/Fixer V6.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
XWorm 6.5/GMap.NET.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
XWorm 6.5/GMap.NET.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
XWorm 6.5/GMap.NET.WindowsForms.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
XWorm 6.5/GMap.NET.WindowsForms.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
XWorm 6.5/MySql.Data.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
XWorm 6.5/MySql.Data.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
XWorm 6.5/NAudio.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
XWorm 6.5/NAudio.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
XWorm 6.5/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
XWorm 6.5/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
XWorm 6.5/Plugins/ActiveWindows.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
XWorm 6.5/Plugins/ActiveWindows.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
XWorm 6.5/Plugins/Chat.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
XWorm 6.5/Plugins/Chat.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
XWorm 6.5/Plugins/Chromium.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
XWorm 6.5/Plugins/Chromium.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
XWorm 6.5/Plugins/Clipboard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
XWorm 6.5/Plugins/Clipboard.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
XWorm 6.5/Plugins/Cmstp-Bypass.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
XWorm 6.5/Plugins/Cmstp-Bypass.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
XWorm 6.5/Plugins/DisableUAC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
XWorm 6.5/Plugins/DisableUAC.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target XWorm 6.5.rar
- Size 28.2MB
- Sample260819-bmfs9scd45
- SHA256 1a0ec5c80430edda2736c5e4dad4083bdcd78a097778a0b85c241bef87e6bdfd
- MD5 71d3e0e7722094f78fc2ec58d957f77b
- SHA1 932563bf2c934b0c997e17247878dbe9a3a4bb09
- SHA512 eca70bef2f6a2fb973ab4312e74064ed1adcead7422465448df9e6c1839320dbf0ae17c664bd5d96ca48743cb558ec76d3340083b478338547c923df894bebda
- SSDEEP 786432:Gb7Wn+89MqA3ikFMojXg4iFfxEacSaO3i5U:Gb8+ixAfFJXgFfeacpo5
- TLSH T1D657330BDA86187E18E774930AD8B0EDA0E17144687E40B1E59178BC7DDB09BA5CF2FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V6.5 by c3lestial.fun
C2
-
portbuddy.dev:40528
Mutex
-
oISLLcnhxNkZUBVl
Attributes
-
Install_directory
%LocalAppData%
-
install_file
WindowsUpdate.exe
aes.plain
Signatures
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/XWorm 6.5/Plugins/Options.dll disable_win_def - Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/XWorm 6.5/stubs/WindowsUpdate.exe family_xworm - StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/XWorm 6.5/Plugins/Recovery.dll family_stormkitty - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack001/XWorm 6.5/Plugins/DisableUAC.dll autoit_exe - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/XWorm 6.5/XWorm 6.5.exe - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/XWorm 6.5/SteamTokenLogin/XWormSteamTokenLogin.exe pyinstaller - Unsigned PE 54 IoCs
Checks for missing Authenticode signature.
resource unpack001/XWorm 6.5/FastColoredTextBox.dll unpack001/XWorm 6.5/GMap.NET.Core.dll unpack001/XWorm 6.5/GMap.NET.WindowsForms.dll unpack001/XWorm 6.5/IconExtractor.dll unpack001/XWorm 6.5/MySql.Data.dll unpack001/XWorm 6.5/Plugins/ActiveWindows.dll unpack001/XWorm 6.5/Plugins/Chat.dll unpack001/XWorm 6.5/Plugins/Chromium.dll unpack001/XWorm 6.5/Plugins/Clipboard.dll unpack001/XWorm 6.5/Plugins/Cmstp-Bypass.dll unpack001/XWorm 6.5/Plugins/DisableUAC.dll unpack001/XWorm 6.5/Plugins/FileManager.dll unpack001/XWorm 6.5/Plugins/FilesSearcher.dll unpack001/XWorm 6.5/Plugins/HBrowser.dll unpack001/XWorm 6.5/Plugins/HRDP.dll unpack001/XWorm 6.5/Plugins/HVNC.dll unpack001/XWorm 6.5/Plugins/HVNCMemory.dll unpack001/XWorm 6.5/Plugins/HiddenApps.dll unpack001/XWorm 6.5/Plugins/Informations.dll unpack001/XWorm 6.5/Plugins/Keylogger.dll unpack001/XWorm 6.5/Plugins/Maps.dll unpack001/XWorm 6.5/Plugins/MessageBox.dll unpack001/XWorm 6.5/Plugins/Microphone.dll unpack001/XWorm 6.5/Plugins/Ngrok-Installer.dll unpack001/XWorm 6.5/Plugins/Options.dll unpack001/XWorm 6.5/Plugins/Pastime.dll unpack001/XWorm 6.5/Plugins/Performance.dll unpack001/XWorm 6.5/Plugins/ProcessManager.dll unpack001/XWorm 6.5/Plugins/Programs.dll unpack001/XWorm 6.5/Plugins/Ransomware.dll unpack001/XWorm 6.5/Plugins/Recovery.dll unpack001/XWorm 6.5/Plugins/Regedit.dll unpack001/XWorm 6.5/Plugins/RemoteDesktop.dll unpack001/XWorm 6.5/Plugins/ResetSurvival.dll unpack001/XWorm 6.5/Plugins/ReverseProxy.dll unpack001/XWorm 6.5/Plugins/Rootkit.dll unpack001/XWorm 6.5/Plugins/RunPE.dll unpack001/XWorm 6.5/Plugins/ServiceManager.dll unpack001/XWorm 6.5/Plugins/Shell.dll unpack001/XWorm 6.5/Plugins/StartupManager.dll unpack001/XWorm 6.5/Plugins/Stealer.dll unpack001/XWorm 6.5/Plugins/SteamTokenRecovery.dll unpack001/XWorm 6.5/Plugins/System.Management.Automation.dll unpack001/XWorm 6.5/Plugins/TCPConnections.dll unpack001/XWorm 6.5/Plugins/UACBypass.dll unpack001/XWorm 6.5/Plugins/V20Recovery.dll unpack001/XWorm 6.5/Plugins/VB.NET Compiler.dll unpack001/XWorm 6.5/Plugins/VoiceChat.dll unpack001/XWorm 6.5/Plugins/WSound.dll unpack001/XWorm 6.5/Plugins/WebCam.dll unpack001/XWorm 6.5/Plugins/WindowsUpdate.dll unpack001/XWorm 6.5/SimpleObfuscator.dll unpack001/XWorm 6.5/SteamTokenLogin/XWormSteamTokenLogin.exe unpack001/XWorm 6.5/stubs/WindowsUpdate.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/XWorm 6.5/Guna.UI2.dll
File Explorer
-
XWorm 6.5.rar.rar 28.2MB
-
XWorm 6.5/Background.png.png 924KB
-
XWorm 6.5/ClientsFolder/5D815A7FE397E5695D4A/Recovery/DiscordToken_05-10-2026 01-56-48-916.txt72B
-
XWorm 6.5/ClientsFolder/5D815A7FE397E5695D4A/SPOTIFY COOKIES.txt3KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/BraveSoftware_Default.txt23KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/05-05-2026_21-08-17.zip.zip 1.2MB
-
Users/Setup Game/Desktop/A7Dz/2 - ??????? ????????/! - ??? .txt3KB
-
Users/Setup Game/Desktop/A7Dz/2 - ??????? ????????/13 ???? ???? ??? ?????.txt1KB
-
Users/Setup Game/Desktop/A7Dz/2 - ??????? ????????/9 ???? ???? ??? ?????.txt1KB
-
Users/Setup Game/Desktop/A7Dz/3 - ??? ?????????/???.txt1KB
-
Users/Setup Game/Desktop/A7Dz/3 - ??? ?????????/Direct X/???.txt54B
-
Users/Setup Game/Desktop/A7Dz/FPS Boost Tools/Commands.txt44B
-
Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/HPET.txt246B
-
Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/cmd commands.txt80B
-
Users/Setup Game/Desktop/ModEngine-2.1.0.0-win64/README.txt2KB
-
Users/Setup Game/Desktop/co-op/anti_cheat_toggler_log.txt1013B
-
Users/Setup Game/Desktop/co-op/anti_cheat_toggler_mod_list.txt196B
-
Users/Setup Game/Desktop/co-op/steam_appid.txt7B
-
Users/Setup Game/Desktop/license.txt17KB
-
Users/Setup Game/Documents/Medal/GEP_20260417.txt1KB
-
Users/Setup Game/Documents/Medal/MedalLog20260426.txt.vbs 814KB
-
Users/Setup Game/Documents/Medal/MedalLog20260427.txt.vbs 522KB
-
Users/Setup Game/Documents/Medal/MedalLog20260428.txt.vbs 169KB
-
Users/Setup Game/Documents/Medal/MedalLog20260429.txt942KB
-
Users/Setup Game/Documents/Medal/MedalLog20260430.txt125KB
-
Users/Setup Game/Documents/Medal/MedalLog20260501.txt889KB
-
Users/Setup Game/Documents/Medal/MedalLog20260502.txt845KB
-
Users/Setup Game/Documents/Medal/MedalLog20260503.txt743KB
-
Users/Setup Game/Documents/Medal/MedalLog20260504.txt1.9MB
-
Users/Setup Game/Documents/Medal/MedalLog20260505.txt1.2MB
-
Users/Setup Game/Downloads/ModEngine-2.1.0.0-win64/ModEngine-2.1.0.0-win64/README.txt2KB
-
Users/Setup Game/Downloads/Readme.txt5KB
-
Users/Setup Game/license.txt17KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/2 - _______ ________/! - ___ .txt3KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/2 - _______ ________/13 ____ ____ ___ _____.txt1KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/2 - _______ ________/9 ____ ____ ___ _____.txt1KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/3 - ___ _________/Direct X/___.txt54B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/3 - ___ _________/___.txt1KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/FPS Boost Tools/Commands.txt44B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/HPET.txt246B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/cmd commands.txt80B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/ModEngine-2.1.0.0-win64/README.txt2KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/co-op/anti_cheat_toggler_log.txt1013B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/co-op/anti_cheat_toggler_mod_list.txt196B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/co-op/steam_appid.txt7B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/license.txt17KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/GEP_20260417.txt1KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260426.txt.vbs 814KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260427.txt.vbs 522KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260428.txt.vbs 169KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260429.txt942KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260430.txt125KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260501.txt889KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260502.txt845KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260503.txt743KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260504.txt1.9MB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260505.txt1.2MB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Downloads/ModEngine-2.1.0.0-win64/ModEngine-2.1.0.0-win64/README.txt2KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Downloads/Readme.txt5KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/license.txt17KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Brave/Default/cookies.json31KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Brave/Default/passwords.json110B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Brave/Default/payments.json8B
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Edge/Default/cookies.json16KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Passwords_05-05-2026 22-42-14-701.zip.zip 19KB
-
Browsers/Brave/Default/cookies.json31KB
-
Browsers/Brave/Default/passwords.json110B
-
Browsers/Brave/Default/payments.json8B
-
Browsers/Edge/Default/cookies.json16KB
-
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/image.png.png 293KB
-
XWorm 6.5/ClientsFolder/AC9A8D17BB80D2398B8C/Recovery/DiscordToken_03-11-2026 20-08-24-050.txt72B
-
XWorm 6.5/FastColoredTextBox.dll.dll 333KB
-
XWorm 6.5/Fixer V6.bat122B
-
XWorm 6.5/GMap.NET.Core.dll.dll 2.9MB
-
XWorm 6.5/GMap.NET.WindowsForms.dll.dll 147KB
-
XWorm 6.5/GeoIP.dat1.2MB
-
XWorm 6.5/Guna.UI2.dll.dll 1.9MB
-
XWorm 6.5/IconExtractor.dll.dll 10KB
-
XWorm 6.5/Icons/icon (1).ico97KB
-
XWorm 6.5/Icons/icon (10).ico115KB
-
XWorm 6.5/Icons/icon (11).ico9KB
-
XWorm 6.5/Icons/icon (12).ico9KB
-
XWorm 6.5/Icons/icon (13).ico361KB
-
XWorm 6.5/Icons/icon (14).ico361KB
-
XWorm 6.5/Icons/icon (15).ico361KB
-
XWorm 6.5/Icons/icon (16).ico97KB
-
XWorm 6.5/Icons/icon (17).ico66KB
-
XWorm 6.5/Icons/icon (2).ico112KB
-
XWorm 6.5/Icons/icon (3).ico131KB
-
XWorm 6.5/Icons/icon (4).ico125KB
-
XWorm 6.5/Icons/icon (5).ico100KB
-
XWorm 6.5/Icons/icon (6).ico106KB
-
XWorm 6.5/Icons/icon (7).ico164KB
-
XWorm 6.5/Icons/icon (8).ico108KB
-
XWorm 6.5/Icons/icon (9).ico264KB
-
XWorm 6.5/MySql.Data.dll.dll 1.1MB
-
XWorm 6.5/NAudio.dll.dll 502KB
-
XWorm 6.5/Newtonsoft.Json.dll.dll 695KB
-
XWorm 6.5/Newtonsoft.Json.xml.xml 696KB
-
XWorm 6.5/Plugins/ActiveWindows.dll.dll 14KB
-
XWorm 6.5/Plugins/Chat.dll.dll 18KB
-
XWorm 6.5/Plugins/Chromium.dll.dll 32KB
-
XWorm 6.5/Plugins/Clipboard.dll.dll 14KB
-
XWorm 6.5/Plugins/Cmstp-Bypass.dll.dll 11KB
-
XWorm 6.5/Plugins/DisableUAC.dll.dll 1.3MB
-
XWorm 6.5/Plugins/FileManager.dll.dll 679KB
-
XWorm 6.5/Plugins/FilesSearcher.dll.dll 478KB
-
XWorm 6.5/Plugins/HBrowser.dll.dll 25KB
-
XWorm 6.5/Plugins/HRDP.dll.dll 1.7MB
-
XWorm 6.5/Plugins/HVNC.dll.dll 85KB
-
XWorm 6.5/Plugins/HVNCMemory.dll.dll 39KB
-
XWorm 6.5/Plugins/HiddenApps.dll.dll 45KB
-
XWorm 6.5/Plugins/Informations.dll.dll 22KB
-
XWorm 6.5/Plugins/Keylogger.dll.dll 17KB
-
XWorm 6.5/Plugins/Maps.dll.dll 15KB
-
XWorm 6.5/Plugins/MessageBox.dll.dll 14KB
-
XWorm 6.5/Plugins/Microphone.dll.dll 540KB
-
XWorm 6.5/Plugins/Ngrok-Installer.dll.dll 400KB
-
XWorm 6.5/Plugins/Options.dll.dll .ps1 30KB
-
XWorm 6.5/Plugins/Pastime.dll.dll 17KB
-
XWorm 6.5/Plugins/Performance.dll.dll 16KB
-
XWorm 6.5/Plugins/ProcessManager.dll.dll 19KB
-
XWorm 6.5/Plugins/Programs.dll.dll 13KB
-
XWorm 6.5/Plugins/Ransomware.dll.dll 20KB
-
XWorm 6.5/Plugins/Recovery.dll.dll 1.1MB
-
XWorm 6.5/Plugins/Regedit.dll.dll 15KB
-
XWorm 6.5/Plugins/RemoteDesktop.dll.dll 18KB
-
XWorm 6.5/Plugins/ResetSurvival.dll.dll 12KB
-
XWorm 6.5/Plugins/ReverseProxy.dll.dll 16KB
-
XWorm 6.5/Plugins/Rootkit.dll.dll 19KB
-
XWorm 6.5/Plugins/RunPE.dll.dll 11KB
-
XWorm 6.5/Plugins/ServiceManager.dll.dll 14KB
-
XWorm 6.5/Plugins/Shell.dll.dll 14KB
-
XWorm 6.5/Plugins/StartupManager.dll.dll 188KB
-
XWorm 6.5/Plugins/Stealer.dll.dll 3.3MB
-
XWorm 6.5/Plugins/SteamTokenRecovery.dll.dll 14KB
-
XWorm 6.5/Plugins/System.Management.Automation.dll.dll 2.9MB
-
XWorm 6.5/Plugins/TCPConnections.dll.dll 16KB
-
XWorm 6.5/Plugins/UACBypass.dll.dll 10KB
-
XWorm 6.5/Plugins/V20Recovery.dll.dll 3.9MB
-
XWorm 6.5/Plugins/VB.NET Compiler.dll.dll 14KB
-
XWorm 6.5/Plugins/VoiceChat.dll.dll 539KB
-
XWorm 6.5/Plugins/WSound.dll.dll 539KB
-
XWorm 6.5/Plugins/WebCam.dll.dll 209KB
-
XWorm 6.5/Plugins/WindowsUpdate.dll.dll 1.6MB
-
XWorm 6.5/SimpleObfuscator.dll.dll 1.4MB
-
XWorm 6.5/Sounds/Chat.wav45KB
-
XWorm 6.5/Sounds/Intro.wav238KB
-
XWorm 6.5/SteamTokenLogin/XWormSteamTokenLogin.exe.exe 11.7MB
-
XWorm 6.5/XWorm 6.5.exe.exe 309KB
-
XWorm 6.5/stubs/WindowsUpdate.exe.exe 36KB
XWorm 6.5/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
XWorm 6.5/ClientsFolder/5D815A7FE397E5695D4A/Recovery/DiscordToken_05-10-2026 01-56-48-916.txt
- SHA256 ef493eb62a01e5768699f66c456d29b12e54841a75a49a2b6a2010b46a50302a
- MD5 b456cc63cf3c977ed3665557446fb599
- SHA1 f175b50553556afb6c98776f1f4b5e1262144a9a
- SHA512 56468640e06089c7510d631b0d5627c3e6b1f0f5055efa2af2ec4e377f02f2ca08861145bed692a607f2f175039d2539e5da99a50552566c8ee244563c629c66
- TLSH T146A0223023C3200828302B802F0320AFCA30A3080AE0BB3E038C0038F2008000F02FE0
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/5D815A7FE397E5695D4A/SPOTIFY COOKIES.txt
- SHA256 84fa8dd778573413eff6f37c7a7f7fdde22c13adff7dc8a186d79e142693ee0f
- MD5 a8b9415bcbf6d5553b93b6a645e6f3f9
- SHA1 db75bbf1ac4d0bfa2c517144fcd45a147ef58934
- SHA512 2220ecd73f6476c82a40ce3d0d5239b24f2fbaca5d31a3777412bb0cc2d7c26e3390933ed8b87293c0164f266275bf6edc3ae0d1cda0e4f4df30dd9d65412dec
- TLSH T1546156F92376EDF06A954045F8783B2B6DA56C27F1AC71BCA7092400334BDD40E92997
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/BraveSoftware_Default.txt
- SHA256 b01f62e6bbdd7a18e764b80a2e225f0cd23331c9b709dde199c7fea373f0458b
- MD5 262ebe5a1938200e06b439f750fa31c5
- SHA1 20f0fa5dcf2860e27e1f1a44431de12750f39f47
- SHA512 71d2a2077f08c5e173d63e24f90ad1fc6e04a950ca4d6a09bb1ae80f7771c910aa5eb666612cc41a5325e5d352142cf51c2b360ef92365e5ca465d2eba77cffa
- SSDEEP 384:3bx4zI8YY4bK9BYkCdC/GAxBGkPex4MQswmxKdknvhVonSd8SjbN:3bxgItu9BSNAxUWexNfIdE5VISLjbN
- TLSH T1FAB2079B7FE3A746770B4041607CBAAF4F208E35B869F6FC63206115924DEA18D845DF
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/05-05-2026_21-08-17.zip
- SHA256 11536d63e9bb73733ee039b9eb49c32862cf0ed183375ec2cf935e87fbdb5a89
- MD5 dcaf4e0995bdcae60c06641c252582a3
- SHA1 ba26d545c141f9207a8e0df24997ef4609c98f70
- SHA512 d77d5d862e9a5fe099ad59d509f3520f5c99f8fa7cbc264ab2216a83596493bf445031c96ef539efbad2c74db6959da0f39211e7c28d2a2d321b4d71f5eb21b3
- SSDEEP 24576:ka8ZfaO9UWppl/qKocfa7wyeLWYNuvOpPyJL6SuTWqs8NOwbJDXqm/SG5:ka8h/+WpLSKvfa3eCYNuvOcJpuTdTtj9
- TLSH T175553350B5AB0451E8B5E930CA667FCFAE2761308CE084E85E6F0DD8ECC57ED6356C68
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Users/Setup Game/Desktop/A7Dz/2 - ??????? ????????/! - ??? .txt
- SHA256 66109314e67823a9e7ed90bcc6138cecc369a94d058b328d6dcc71d6f7b27e5a
- MD5 18a2a1fd63557faf5c6b1a0bbf14864a
- SHA1 63965a97250ca4230d0e08bb922cf7fee0926e33
- SHA512 6baa43f79a1555722baeed8e95ac6020c41a39a37be731c828bfe737b72f277daf1ba613973715b090b690666f7d5ceffc6153f7c9dd441fe0c998dcc9992045
- TLSH T11E71A0C22D1190B05E195B4AC1ABB598EC737D73A36BF8217047123459B7A67E38F33A
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/A7Dz/2 - ??????? ????????/13 ???? ???? ??? ?????.txt
- SHA256 70f1542274d188869e9724254939044ddc33a462d4e6cc921511f9637646d0f4
- MD5 e1b40cec8f71bb1d4bb2beb01734b3b6
- SHA1 cc1ed5487ede45b2ba2d4d59ba64fab01f818e9a
- SHA512 3b0ad81c59cac560475ffd5beb7c64e04784d29089212a771c29bbe875e575a25bcf9b18fcf72ef2f59fce847a575bb89246c54d01157e9ed2aec88c15027a5d
- TLSH T1173148D2792680A10B4ACB0BD0E671EDD9366D93A6DEFD21714344200473EABE39E339
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/A7Dz/2 - ??????? ????????/9 ???? ???? ??? ?????.txt
- SHA256 1051ffbb76410ad8783556f9c1be81f299d553233435e7bb83583c473ebf4791
- MD5 111ea70cfe1b7911807e215abd635169
- SHA1 b4f543112d683c3b9958e93ed32aa01c7c2d563c
- SHA512 d428141ec0160047f3975f66f05024b52dea0cd3eeee3004ae136c140eb9b6d476a31813b9f5c5edb20de54a666269eb8f4d688dbd4c36a87435790ac315fb8c
- TLSH T1D94148F2191680601B01CD09C2D7B9ECFABB6D63E7AEF83160579025D543E53F24E23A
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/A7Dz/3 - ??? ?????????/???.txt
- SHA256 fdd50ebd7525674d1a7a5b84b1e5031db419fa09d7ca32b27e502e2c048fe22d
- MD5 fa0db248ded8eb82efa993c12ed2f071
- SHA1 98d53dfbe48f71423b0a66984efeb0be977544cf
- SHA512 ada106781ff296ef6d1c4efdd3ec757d3c83b7bf69ef63e6552de4cfe081464b8c74788eeffaf8df207dea3fca0f70aeea0a43fcc1b1f79ab24a0c0b3298b603
- TLSH T1DC2128D30A7A84A04B499E0ED292719CE8777C63A34EFC1130535529C5E3D77E29E639
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/A7Dz/3 - ??? ?????????/Direct X/???.txt
- SHA256 e27d00ca3241f1a541be7c285e91b7b685cf0eacf2abd95b4761484b87485399
- MD5 47d577e1d558bc0cbdb1c43517d379db
- SHA1 d39259c4073dd7fea5bd77ab441093529ea9786b
- SHA512 75aeef5a85dcc15043da1053d1dcbf37356f2b29376cc6eb12b690b240e26d386d9b45bcd59bbc7dba773f760e31899fa66f4e13f8ed740c0ff8a20bd05cd55b
- TLSH T1A5900290547A10A113555E16C21A2100B9609E479946EC40909089019CCB9C1544D770
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/A7Dz/FPS Boost Tools/Commands.txt
- SHA256 7f8d576d383fb53afacebb9434fab8f8cb1376d112377c315a01a635fde4db34
- MD5 5fce88ffeb00fe550e00d68802ef1497
- SHA1 5c9d04e13f0db7f687382d34fc4d6852c42e19bb
- SHA512 806dbf0045dcf4f75ee964086cfd770a662de4105faa4790543577d39a8f15cbe87f28edcc716241e31d89ec8556bde5ecee75a27f68eebb6e1a5ad628930306
- MD5 SHA1 SHA512
Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/HPET.txt
- SHA256 397f56a841585b38604daf72d493afe210762a1a658747c7357b91a91bde20e4
- MD5 081d7f05da206e5dee2f566a2f63ab97
- SHA1 86297570868ecc413ffc1db6ff635c14cdc2f209
- SHA512 f558451931b3f1137d5bbc9fc349b34138ca16f0a77c569ca85ab3f3574e8143de2538ca11fef52f570b35aaa1b7b1a5da0c980f3f5f2eee7193767458e972ac
- TLSH T1AFD05E5616737EF41562DC07585CB201FB38D863BDB2A15D704865A9626E400CC606BC
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/cmd commands.txt
- SHA256 431632403d885c3065ffb8fccb7276926b3c520ea775d7a512f859e0d0f6a8f5
- MD5 9fe033a7fd8b621657212989d931869d
- SHA1 3d2ba0504ce0c6ccb93d86f4f499e02f5e57ff6f
- SHA512 da040b6b957b35d549c49333a7fafa50518595aac5362ba3c40f5cd133d9334ef020b8db1d03cebba07a3702c7c3098559b8b5acaa6b65f80405df62a98ae61b
- TLSH T157A012536167891144E4CC00034DB8189864659451136600B2215145603485334A0ACC
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/ModEngine-2.1.0.0-win64/README.txt
- SHA256 fb08185ef7098ae41eac7dd9b26b0da7c0eccaa18d2e8f86626b18473f11231b
- MD5 7c881c7f253f3a5089e588c7dcb4b81b
- SHA1 b7968d2acf48324a71361046040d37737e80c2fe
- SHA512 a7f0793b89d7ef18567dd2dd6939823cbc092a9b00c7b1c762462b98edac84b97743d93bc3ad6bd81952660443da4b03877d62026a4aee6fb80e229e434fb79b
- TLSH T1925164AF5F5563F71A6B0351420E34E2EA25C89F23B98968703C52AD231415AF3774D9
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/co-op/anti_cheat_toggler_log.txt
- SHA256 5af7b41f940a997dd06b4cb0c5094750cbc62dc6e57b9802ec5d24e28f3a749e
- MD5 1c14b6abe700d87c69493b2a40a59559
- SHA1 0ff86aa46af78c015697dda8785b71887876ad36
- SHA512 e4e5413d2de06eb19b597f676bc0fd519fe5167decf94085120a35c869c93cd1e26f418e2f03bb48b67329b50d978371e93bb3814357cfd9123b21d8ff1d10a3
- TLSH T17311583BBCFBB9FB0A6485BB60D78C58741A901C2664D2221DE4C2861F2301A47F16FC
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/co-op/anti_cheat_toggler_mod_list.txt
- SHA256 f27f4ceaac275cc8f9dfb4da45691ec128ab9dfeaed6c6543c218c71d1150fbc
- MD5 6e691daf677f58315b9261b05dee3b60
- SHA1 9fad4806108358ef192a63016c9651137dc29bf3
- SHA512 2f1c7a4b2db730fc7b2e5808fcc5e708ac58dbade4e8c687fb30a6a8efffeaed46b6b7f9e1f82ca2c813a202eefad3de3faf401c2effcfad647fafad3fc8969d
- TLSH T175D0122CE4A11C82650E23540C929E8D782C20883B7D23250438A1CB2E3342F0B6A9B2
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Desktop/co-op/steam_appid.txt
- SHA256 fe16bb1876de8709bc47cad716c50c8b4b4e62a1a4c159c72fee466986678047
- MD5 b772634164c70967ad2cc01e3a5f62f0
- SHA1 8fe85b37eb70145871e8b0cb4ef283d14c5e9ea5
- SHA512 df346685a47213072d875fcb5096cf58e35ed7da8f3393710727a0509ab39337fb4fc38df799d522c4d0988357427be5bcd88663622afdc668535082416caf83
- MD5 SHA1 SHA512
Users/Setup Game/Desktop/license.txt
- SHA256 b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
- MD5 e3f2ad7733f3166fe770e4dc00af6c45
- SHA1 3d436ffdd69f7187b85e0cf8f075bd6154123623
- SHA512 ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
- SSDEEP 384:gq2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPyBrsS/S9B:gzuh1iYWrTXoPAs9B
- TLSH T18182A32E7B0503F20AD242916A4B68CEE31EC079763A1155345DC1AD237FE39C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/GEP_20260417.txt
- SHA256 176e7f8404ff1a4482120e10d90043eead17f8e67aebbea723e19e23ad7ba4a5
- MD5 eb3d6a4eb9c67a13bd7af115bc1035a4
- SHA1 5b84eb00a1e35a7602294e1d9271541101e4db1c
- SHA512 efd35bc84041509c52d7f93321e5c6db819ee21d2b999934310eb72f66a26245b923ad1c21437f57737e34c7c8c1586ba8850319542722817ec0a14dd3de707f
- TLSH T1CF1136A38B94049F8A2C624263DE2AD7CDDA40B6737C023DB479DF45768900DDA4DDCD
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Documents/Medal/MedalLog20260426.txt
- SHA256 ba3f372e635f8a4fffca86a752bbefdb4b523623a7247a49632becbf78a558c9
- MD5 18ee05b847561fc07576ab5fca68f3c6
- SHA1 38f69221181f219d78ee7135ebd1a8a48e35acae
- SHA512 1bbfcf5aad42083d45cf4aafff688976332ce03c80ab85b36683a421a3a66820396eafdb1156fc2bb62dce6c51f678a9607bae91385569caf31ff3ef8ac7889e
- SSDEEP 12288:NV+/i01a/SStHI/i01a/SShE/i01a/SSc/i01a/SSI1Y01a/SSmWi01a/SS0/i0I:NV3Hcyr+
- TLSH T1F805E91B951638115B35A251B27116C376BD331B72848AE6BFFC6D8E1FA3302D2E4B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260427.txt
- SHA256 dfe3fc8a37d599f4af323de1e24db1fce3043859238307b8f6240b83472e2a0c
- MD5 1b2e2a015e7cce934c53bdef1caa624c
- SHA1 10dd0d39bfd3922f321e0bf89bc69d97634143b9
- SHA512 580fb5e98c0fd2c71fcfe47dac333ee37f39634f727c8ab6f58ba4fbc4628502bb40dfae146b137ab73dcd0eac53510e27c668f3ab1910b33a9b183747b1754e
- SSDEEP 12288:sLKA0Wi01a/SSvWi01a/SSGWi01a/SSPWi01a/SSD/i01a/SSCm1X9HWi0iF/SSt:sLKAot96+F
- TLSH T167B4E726941A3451A675A242F27126C7AAAD335B73800FF3BFFD5D8D1FA3202D1E1A35
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260428.txt
- SHA256 d1460ee40d7d79a1b94e5233857c2c998bb8b6eee320ef0fd60dbb47ca80f812
- MD5 0d14b8859af4c0233b3453438e8bdf37
- SHA1 13198c69e38992fa35e3ae181ff83aaa60568adb
- SHA512 2048d5fa2c110b5b0e7cadfa291c485797f04d5c642defefb6519a03ced7702042285e524f6c916a783aff7bd41d3ab2ea432f6be78b9f472b2fb529dc997dc3
- SSDEEP 3072:eGili+id2xWqf/ili+90rWO8lili+1utWilr+Kl2:eU+id2cqfz+90rF8V+1utl+Kl2
- TLSH T1D204961F185F2C998336C192E3228BC76B2D50F5758814F9F59DCCCD2A8B29A93D5E32
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260429.txt
- SHA256 5175a76de969fb1e53e41af1f6f95068f32db897ac104585de0f0b97eb929c39
- MD5 adbc4b5c88fcd0dfa25c02188281c140
- SHA1 1ff8e4f0ddf97f37865b21f9d63f996e255eaaf6
- SHA512 942959fac0604252d2b1d326960fc5c7448eb7505a32982fccd86b34278426d3fb8f0173139183b9d3af1eacf9956fb8e77e29ba72053f1ecf98f4a4a58c304b
- SSDEEP 12288:BdCZ/i01a/SS91Y01a/SS/Wi01a/SSm/i01a/SSv1Y01a/SSIWi01a/SSZ1Y01aH:BdCrbUcKmCT
- TLSH T1E725F71A952A385557369381E33116C3AFAC732772844EE0BFFD9D8D1F5724282E4E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260430.txt
- SHA256 3ea025c69546598d25ef5a8a02b58b11fa20887a683ff2bad2c7afcab2df3a04
- MD5 9c371a0fbba57548918892cc09888692
- SHA1 f2bc5f51e75f6a1a82fc1b7a87b80c84c92c4fed
- SHA512 6b50d8bf76b90fdea040ba2a7a91ca2d7edee806291d8be259caab50b1f6ec9f2278ebd8169ce4afdb18d0ba4d3a5965b2512011731d7d089e2ace9d9480bb72
- SSDEEP 1536:p/pXilL/+RsYhDVtPYZmEYCt3hKE0Q3ezOuHf+D76bIUCIEZHBZvKPkvB+OcxfcZ:l5ilr+1j69VOq
- TLSH T177C3861E151B3CC2523A8691F31137E72F1DA2A6359449FAFAFC4C8D2B8624652E4F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260501.txt
- SHA256 f9e261503aa4bd4c8d663a18b7503ac85ad9242b8f9eb373a46f8f9a86c467be
- MD5 6f6bdb7fa5315392400d1b23d77c0f26
- SHA1 c9249e8088ecf343f587c34ea5ea0eb50bb91afb
- SHA512 ff32a660a612b4b788e9c6e80e1c69dde36a11c5eb62884e213ef6d0517cb991a5b6ecbb08a3cb43a3dda4b5edc0890be7379d7ecf06579ec31d0bfc2999e6cf
- SSDEEP 12288:PjFP/i01a/SSf/i01a/SS0/i01a/SSr1Y01a/SSpGAWi0iF/SS7Wi0iF/SS44WiV:PjFSGngsaiJGi7Fc
- TLSH T12815D60E092E3C5957358291E33257C32B6C22B7728448F5BFAD9C8D275B29693E4F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260502.txt
- SHA256 d6550b3987944b791426439df7ea6773f29743cff60b3d7e98d65784b3f4d226
- MD5 b9837a20e5d1c2b4325d7e90c575bed1
- SHA1 00c78c7d5d3e063c62bdd3b83548fe38f359617d
- SHA512 0b7451281cfb71ff69e116e20efdd4f8eae26fa891dde7bf6efa4afc1d7a7986dc43e83d7e7489615496518958da8f1ba57b128778445e747c72503769d4b60f
- SSDEEP 12288:SVTX65Oa/i01a/SSU/i01a/SSk/i01a/SSn/i01a/SSh/i01a/SSI1Y01a/SSRWe:SVTX6AP
- TLSH T12305DA1A653268651B36E240E37206C39BFD232B71885D60BAFDCE892FB534751F1E36
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260503.txt
- SHA256 142664e2a2c0695db481d3aea050e34bacca6947d7f09218a23565aa07121f82
- MD5 007612ed718b6cc1833fc398ead0da64
- SHA1 546d61bfd94328af728fd2c659f2207f98e13cfe
- SHA512 614a351e51683a225517d11d02824fa76657e824ab992c4b8b56b1449b4912387246b143b1c132627fe248ebd85be5b8febd7624385542daff1812bb4106b16d
- SSDEEP 12288:7VEX/i01a/SSD17/i01a/SS01Y01a/SSkWi01a/SSY/i01a/SSR/i01a/SSx/i0Q:7VEa1f
- TLSH T17DF4D85F9A252C241B35D341F33222C3ABFE625761C948A17AFC5DCA2FA224791F4E35
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260504.txt
- SHA256 e79899e78085daac8392ca686b39f61a34232590a54c9d751a091c5c4da6da30
- MD5 c681db10d6c2c2d59e4cc425f5348559
- SHA1 477592c66abc478ac98a31ba4c1fbc32bf1d09df
- SHA512 9625f566b89bb5a2af64985a9cb0eaf8c344ec55b7da5fd199a761a067758fedaa8602191bd4f87f9e0f5233f605d4c6636881dac767560f9a38c97ca908f5a3
- SSDEEP 12288:GUi/i01a/SSXnk/i01a/SScSE/i01a/SSa1Y01a/SShWi01a/SSj/i01a/SSd1Ye:GU5nVqiIX5Svy
- TLSH T17D959616991F3415AB359382B37235C76EFC736B728448E1BFBCAD8D1B5220292F4A35
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Documents/Medal/MedalLog20260505.txt
- SHA256 2daaee6271dece4025c6133ca408d7250fb3e3e359ad9128b74d1ea67b9fd42a
- MD5 507e0869cbee3bc096ccb949b2a01614
- SHA1 1d78934119cb51272989092f35b9740a838ed254
- SHA512 53dbb6569a8c128f230a174d75825612ce6cdd451afadd2564f6ab567d07d300246ef3f3e1eaef7a140df6495747685cbdc0aa6fa347ad65749af05849a0be78
- SSDEEP 12288:hYT/i01a/SSm/i01a/SSh/i01a/SS01Y01a/SS7Wi01a/SSf/i01a/SSRB1zH/id:hYKB1z5GKKmHjU
- TLSH T16F45D81A582A389547359291E37126C36BAC332772C489E1BFFC8D8D1FA734292F5E35
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/Downloads/ModEngine-2.1.0.0-win64/ModEngine-2.1.0.0-win64/README.txt
- SHA256 fb08185ef7098ae41eac7dd9b26b0da7c0eccaa18d2e8f86626b18473f11231b
- MD5 7c881c7f253f3a5089e588c7dcb4b81b
- SHA1 b7968d2acf48324a71361046040d37737e80c2fe
- SHA512 a7f0793b89d7ef18567dd2dd6939823cbc092a9b00c7b1c762462b98edac84b97743d93bc3ad6bd81952660443da4b03877d62026a4aee6fb80e229e434fb79b
- TLSH T1925164AF5F5563F71A6B0351420E34E2EA25C89F23B98968703C52AD231415AF3774D9
- MD5 SHA1 SHA512 TLSH
Users/Setup Game/Downloads/Readme.txt
- SHA256 e10801595753d559aa268193596f208ca21aed3f3649f7957489cf5604f0b934
- MD5 17da84b9fd4fe8b2827d0e9db7e81dc1
- SHA1 06e1199bc2cfef1132231036f9404c2f72f546ec
- SHA512 cbcdfb44d477d3b6001d78f0debfbd438eb7261c0d8f24956a39ea0bcd8b644d667c9006acbe4600562c23e5a7cd46d42dfe2dbd1065ae45231abcd49b413552
- SSDEEP 96:su+eTT3kcSPDIW0zoHBjCzBu6Ag9nApO+EGNcWm3OtVEL0Y4L2OiGu6832LiUEhS:3tf90INKGkg9nApObGN/m38VEx4HuUWS
- TLSH T19EB1759B3BD923A3167782927B4E22D5E726C07E63719F15A4EF106C3345819133FAE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Users/Setup Game/license.txt
- SHA256 b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
- MD5 e3f2ad7733f3166fe770e4dc00af6c45
- SHA1 3d436ffdd69f7187b85e0cf8f075bd6154123623
- SHA512 ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
- SSDEEP 384:gq2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPyBrsS/S9B:gzuh1iYWrTXoPAs9B
- TLSH T18182A32E7B0503F20AD242916A4B68CEE31EC079763A1155345DC1AD237FE39C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/2 - _______ ________/! - ___ .txt
- SHA256 66109314e67823a9e7ed90bcc6138cecc369a94d058b328d6dcc71d6f7b27e5a
- MD5 18a2a1fd63557faf5c6b1a0bbf14864a
- SHA1 63965a97250ca4230d0e08bb922cf7fee0926e33
- SHA512 6baa43f79a1555722baeed8e95ac6020c41a39a37be731c828bfe737b72f277daf1ba613973715b090b690666f7d5ceffc6153f7c9dd441fe0c998dcc9992045
- TLSH T11E71A0C22D1190B05E195B4AC1ABB598EC737D73A36BF8217047123459B7A67E38F33A
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/2 - _______ ________/13 ____ ____ ___ _____.txt
- SHA256 70f1542274d188869e9724254939044ddc33a462d4e6cc921511f9637646d0f4
- MD5 e1b40cec8f71bb1d4bb2beb01734b3b6
- SHA1 cc1ed5487ede45b2ba2d4d59ba64fab01f818e9a
- SHA512 3b0ad81c59cac560475ffd5beb7c64e04784d29089212a771c29bbe875e575a25bcf9b18fcf72ef2f59fce847a575bb89246c54d01157e9ed2aec88c15027a5d
- TLSH T1173148D2792680A10B4ACB0BD0E671EDD9366D93A6DEFD21714344200473EABE39E339
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/2 - _______ ________/9 ____ ____ ___ _____.txt
- SHA256 1051ffbb76410ad8783556f9c1be81f299d553233435e7bb83583c473ebf4791
- MD5 111ea70cfe1b7911807e215abd635169
- SHA1 b4f543112d683c3b9958e93ed32aa01c7c2d563c
- SHA512 d428141ec0160047f3975f66f05024b52dea0cd3eeee3004ae136c140eb9b6d476a31813b9f5c5edb20de54a666269eb8f4d688dbd4c36a87435790ac315fb8c
- TLSH T1D94148F2191680601B01CD09C2D7B9ECFABB6D63E7AEF83160579025D543E53F24E23A
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/3 - ___ _________/Direct X/___.txt
- SHA256 e27d00ca3241f1a541be7c285e91b7b685cf0eacf2abd95b4761484b87485399
- MD5 47d577e1d558bc0cbdb1c43517d379db
- SHA1 d39259c4073dd7fea5bd77ab441093529ea9786b
- SHA512 75aeef5a85dcc15043da1053d1dcbf37356f2b29376cc6eb12b690b240e26d386d9b45bcd59bbc7dba773f760e31899fa66f4e13f8ed740c0ff8a20bd05cd55b
- TLSH T1A5900290547A10A113555E16C21A2100B9609E479946EC40909089019CCB9C1544D770
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/3 - ___ _________/___.txt
- SHA256 fdd50ebd7525674d1a7a5b84b1e5031db419fa09d7ca32b27e502e2c048fe22d
- MD5 fa0db248ded8eb82efa993c12ed2f071
- SHA1 98d53dfbe48f71423b0a66984efeb0be977544cf
- SHA512 ada106781ff296ef6d1c4efdd3ec757d3c83b7bf69ef63e6552de4cfe081464b8c74788eeffaf8df207dea3fca0f70aeea0a43fcc1b1f79ab24a0c0b3298b603
- TLSH T1DC2128D30A7A84A04B499E0ED292719CE8777C63A34EFC1130535529C5E3D77E29E639
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/FPS Boost Tools/Commands.txt
- SHA256 7f8d576d383fb53afacebb9434fab8f8cb1376d112377c315a01a635fde4db34
- MD5 5fce88ffeb00fe550e00d68802ef1497
- SHA1 5c9d04e13f0db7f687382d34fc4d6852c42e19bb
- SHA512 806dbf0045dcf4f75ee964086cfd770a662de4105faa4790543577d39a8f15cbe87f28edcc716241e31d89ec8556bde5ecee75a27f68eebb6e1a5ad628930306
- MD5 SHA1 SHA512
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/HPET.txt
- SHA256 397f56a841585b38604daf72d493afe210762a1a658747c7357b91a91bde20e4
- MD5 081d7f05da206e5dee2f566a2f63ab97
- SHA1 86297570868ecc413ffc1db6ff635c14cdc2f209
- SHA512 f558451931b3f1137d5bbc9fc349b34138ca16f0a77c569ca85ab3f3574e8143de2538ca11fef52f570b35aaa1b7b1a5da0c980f3f5f2eee7193767458e972ac
- TLSH T1AFD05E5616737EF41562DC07585CB201FB38D863BDB2A15D704865A9626E400CC606BC
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/A7Dz/Laptop FPS Optimization Pack by Veloxal/cmd commands.txt
- SHA256 431632403d885c3065ffb8fccb7276926b3c520ea775d7a512f859e0d0f6a8f5
- MD5 9fe033a7fd8b621657212989d931869d
- SHA1 3d2ba0504ce0c6ccb93d86f4f499e02f5e57ff6f
- SHA512 da040b6b957b35d549c49333a7fafa50518595aac5362ba3c40f5cd133d9334ef020b8db1d03cebba07a3702c7c3098559b8b5acaa6b65f80405df62a98ae61b
- TLSH T157A012536167891144E4CC00034DB8189864659451136600B2215145603485334A0ACC
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/ModEngine-2.1.0.0-win64/README.txt
- SHA256 fb08185ef7098ae41eac7dd9b26b0da7c0eccaa18d2e8f86626b18473f11231b
- MD5 7c881c7f253f3a5089e588c7dcb4b81b
- SHA1 b7968d2acf48324a71361046040d37737e80c2fe
- SHA512 a7f0793b89d7ef18567dd2dd6939823cbc092a9b00c7b1c762462b98edac84b97743d93bc3ad6bd81952660443da4b03877d62026a4aee6fb80e229e434fb79b
- TLSH T1925164AF5F5563F71A6B0351420E34E2EA25C89F23B98968703C52AD231415AF3774D9
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/co-op/anti_cheat_toggler_log.txt
- SHA256 5af7b41f940a997dd06b4cb0c5094750cbc62dc6e57b9802ec5d24e28f3a749e
- MD5 1c14b6abe700d87c69493b2a40a59559
- SHA1 0ff86aa46af78c015697dda8785b71887876ad36
- SHA512 e4e5413d2de06eb19b597f676bc0fd519fe5167decf94085120a35c869c93cd1e26f418e2f03bb48b67329b50d978371e93bb3814357cfd9123b21d8ff1d10a3
- TLSH T17311583BBCFBB9FB0A6485BB60D78C58741A901C2664D2221DE4C2861F2301A47F16FC
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/co-op/anti_cheat_toggler_mod_list.txt
- SHA256 f27f4ceaac275cc8f9dfb4da45691ec128ab9dfeaed6c6543c218c71d1150fbc
- MD5 6e691daf677f58315b9261b05dee3b60
- SHA1 9fad4806108358ef192a63016c9651137dc29bf3
- SHA512 2f1c7a4b2db730fc7b2e5808fcc5e708ac58dbade4e8c687fb30a6a8efffeaed46b6b7f9e1f82ca2c813a202eefad3de3faf401c2effcfad647fafad3fc8969d
- TLSH T175D0122CE4A11C82650E23540C929E8D782C20883B7D23250438A1CB2E3342F0B6A9B2
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/co-op/steam_appid.txt
- SHA256 fe16bb1876de8709bc47cad716c50c8b4b4e62a1a4c159c72fee466986678047
- MD5 b772634164c70967ad2cc01e3a5f62f0
- SHA1 8fe85b37eb70145871e8b0cb4ef283d14c5e9ea5
- SHA512 df346685a47213072d875fcb5096cf58e35ed7da8f3393710727a0509ab39337fb4fc38df799d522c4d0988357427be5bcd88663622afdc668535082416caf83
- MD5 SHA1 SHA512
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Desktop/license.txt
- SHA256 b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
- MD5 e3f2ad7733f3166fe770e4dc00af6c45
- SHA1 3d436ffdd69f7187b85e0cf8f075bd6154123623
- SHA512 ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
- SSDEEP 384:gq2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPyBrsS/S9B:gzuh1iYWrTXoPAs9B
- TLSH T18182A32E7B0503F20AD242916A4B68CEE31EC079763A1155345DC1AD237FE39C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/GEP_20260417.txt
- SHA256 176e7f8404ff1a4482120e10d90043eead17f8e67aebbea723e19e23ad7ba4a5
- MD5 eb3d6a4eb9c67a13bd7af115bc1035a4
- SHA1 5b84eb00a1e35a7602294e1d9271541101e4db1c
- SHA512 efd35bc84041509c52d7f93321e5c6db819ee21d2b999934310eb72f66a26245b923ad1c21437f57737e34c7c8c1586ba8850319542722817ec0a14dd3de707f
- TLSH T1CF1136A38B94049F8A2C624263DE2AD7CDDA40B6737C023DB479DF45768900DDA4DDCD
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260426.txt
- SHA256 ba3f372e635f8a4fffca86a752bbefdb4b523623a7247a49632becbf78a558c9
- MD5 18ee05b847561fc07576ab5fca68f3c6
- SHA1 38f69221181f219d78ee7135ebd1a8a48e35acae
- SHA512 1bbfcf5aad42083d45cf4aafff688976332ce03c80ab85b36683a421a3a66820396eafdb1156fc2bb62dce6c51f678a9607bae91385569caf31ff3ef8ac7889e
- SSDEEP 12288:NV+/i01a/SStHI/i01a/SShE/i01a/SSc/i01a/SSI1Y01a/SSmWi01a/SS0/i0I:NV3Hcyr+
- TLSH T1F805E91B951638115B35A251B27116C376BD331B72848AE6BFFC6D8E1FA3302D2E4B39
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260427.txt
- SHA256 dfe3fc8a37d599f4af323de1e24db1fce3043859238307b8f6240b83472e2a0c
- MD5 1b2e2a015e7cce934c53bdef1caa624c
- SHA1 10dd0d39bfd3922f321e0bf89bc69d97634143b9
- SHA512 580fb5e98c0fd2c71fcfe47dac333ee37f39634f727c8ab6f58ba4fbc4628502bb40dfae146b137ab73dcd0eac53510e27c668f3ab1910b33a9b183747b1754e
- SSDEEP 12288:sLKA0Wi01a/SSvWi01a/SSGWi01a/SSPWi01a/SSD/i01a/SSCm1X9HWi0iF/SSt:sLKAot96+F
- TLSH T167B4E726941A3451A675A242F27126C7AAAD335B73800FF3BFFD5D8D1FA3202D1E1A35
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260428.txt
- SHA256 d1460ee40d7d79a1b94e5233857c2c998bb8b6eee320ef0fd60dbb47ca80f812
- MD5 0d14b8859af4c0233b3453438e8bdf37
- SHA1 13198c69e38992fa35e3ae181ff83aaa60568adb
- SHA512 2048d5fa2c110b5b0e7cadfa291c485797f04d5c642defefb6519a03ced7702042285e524f6c916a783aff7bd41d3ab2ea432f6be78b9f472b2fb529dc997dc3
- SSDEEP 3072:eGili+id2xWqf/ili+90rWO8lili+1utWilr+Kl2:eU+id2cqfz+90rF8V+1utl+Kl2
- TLSH T1D204961F185F2C998336C192E3228BC76B2D50F5758814F9F59DCCCD2A8B29A93D5E32
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260429.txt
- SHA256 5175a76de969fb1e53e41af1f6f95068f32db897ac104585de0f0b97eb929c39
- MD5 adbc4b5c88fcd0dfa25c02188281c140
- SHA1 1ff8e4f0ddf97f37865b21f9d63f996e255eaaf6
- SHA512 942959fac0604252d2b1d326960fc5c7448eb7505a32982fccd86b34278426d3fb8f0173139183b9d3af1eacf9956fb8e77e29ba72053f1ecf98f4a4a58c304b
- SSDEEP 12288:BdCZ/i01a/SS91Y01a/SS/Wi01a/SSm/i01a/SSv1Y01a/SSIWi01a/SSZ1Y01aH:BdCrbUcKmCT
- TLSH T1E725F71A952A385557369381E33116C3AFAC732772844EE0BFFD9D8D1F5724282E4E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260430.txt
- SHA256 3ea025c69546598d25ef5a8a02b58b11fa20887a683ff2bad2c7afcab2df3a04
- MD5 9c371a0fbba57548918892cc09888692
- SHA1 f2bc5f51e75f6a1a82fc1b7a87b80c84c92c4fed
- SHA512 6b50d8bf76b90fdea040ba2a7a91ca2d7edee806291d8be259caab50b1f6ec9f2278ebd8169ce4afdb18d0ba4d3a5965b2512011731d7d089e2ace9d9480bb72
- SSDEEP 1536:p/pXilL/+RsYhDVtPYZmEYCt3hKE0Q3ezOuHf+D76bIUCIEZHBZvKPkvB+OcxfcZ:l5ilr+1j69VOq
- TLSH T177C3861E151B3CC2523A8691F31137E72F1DA2A6359449FAFAFC4C8D2B8624652E4F37
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260501.txt
- SHA256 f9e261503aa4bd4c8d663a18b7503ac85ad9242b8f9eb373a46f8f9a86c467be
- MD5 6f6bdb7fa5315392400d1b23d77c0f26
- SHA1 c9249e8088ecf343f587c34ea5ea0eb50bb91afb
- SHA512 ff32a660a612b4b788e9c6e80e1c69dde36a11c5eb62884e213ef6d0517cb991a5b6ecbb08a3cb43a3dda4b5edc0890be7379d7ecf06579ec31d0bfc2999e6cf
- SSDEEP 12288:PjFP/i01a/SSf/i01a/SS0/i01a/SSr1Y01a/SSpGAWi0iF/SS7Wi0iF/SS44WiV:PjFSGngsaiJGi7Fc
- TLSH T12815D60E092E3C5957358291E33257C32B6C22B7728448F5BFAD9C8D275B29693E4F36
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260502.txt
- SHA256 d6550b3987944b791426439df7ea6773f29743cff60b3d7e98d65784b3f4d226
- MD5 b9837a20e5d1c2b4325d7e90c575bed1
- SHA1 00c78c7d5d3e063c62bdd3b83548fe38f359617d
- SHA512 0b7451281cfb71ff69e116e20efdd4f8eae26fa891dde7bf6efa4afc1d7a7986dc43e83d7e7489615496518958da8f1ba57b128778445e747c72503769d4b60f
- SSDEEP 12288:SVTX65Oa/i01a/SSU/i01a/SSk/i01a/SSn/i01a/SSh/i01a/SSI1Y01a/SSRWe:SVTX6AP
- TLSH T12305DA1A653268651B36E240E37206C39BFD232B71885D60BAFDCE892FB534751F1E36
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260503.txt
- SHA256 142664e2a2c0695db481d3aea050e34bacca6947d7f09218a23565aa07121f82
- MD5 007612ed718b6cc1833fc398ead0da64
- SHA1 546d61bfd94328af728fd2c659f2207f98e13cfe
- SHA512 614a351e51683a225517d11d02824fa76657e824ab992c4b8b56b1449b4912387246b143b1c132627fe248ebd85be5b8febd7624385542daff1812bb4106b16d
- SSDEEP 12288:7VEX/i01a/SSD17/i01a/SS01Y01a/SSkWi01a/SSY/i01a/SSR/i01a/SSx/i0Q:7VEa1f
- TLSH T17DF4D85F9A252C241B35D341F33222C3ABFE625761C948A17AFC5DCA2FA224791F4E35
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260504.txt
- SHA256 e79899e78085daac8392ca686b39f61a34232590a54c9d751a091c5c4da6da30
- MD5 c681db10d6c2c2d59e4cc425f5348559
- SHA1 477592c66abc478ac98a31ba4c1fbc32bf1d09df
- SHA512 9625f566b89bb5a2af64985a9cb0eaf8c344ec55b7da5fd199a761a067758fedaa8602191bd4f87f9e0f5233f605d4c6636881dac767560f9a38c97ca908f5a3
- SSDEEP 12288:GUi/i01a/SSXnk/i01a/SScSE/i01a/SSa1Y01a/SShWi01a/SSj/i01a/SSd1Ye:GU5nVqiIX5Svy
- TLSH T17D959616991F3415AB359382B37235C76EFC736B728448E1BFBCAD8D1B5220292F4A35
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Documents/Medal/MedalLog20260505.txt
- SHA256 2daaee6271dece4025c6133ca408d7250fb3e3e359ad9128b74d1ea67b9fd42a
- MD5 507e0869cbee3bc096ccb949b2a01614
- SHA1 1d78934119cb51272989092f35b9740a838ed254
- SHA512 53dbb6569a8c128f230a174d75825612ce6cdd451afadd2564f6ab567d07d300246ef3f3e1eaef7a140df6495747685cbdc0aa6fa347ad65749af05849a0be78
- SSDEEP 12288:hYT/i01a/SSm/i01a/SSh/i01a/SS01Y01a/SS7Wi01a/SSf/i01a/SSRB1zH/id:hYKB1z5GKKmHjU
- TLSH T16F45D81A582A389547359291E37126C36BAC332772C489E1BFFC8D8D1FA734292F5E35
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Downloads/ModEngine-2.1.0.0-win64/ModEngine-2.1.0.0-win64/README.txt
- SHA256 fb08185ef7098ae41eac7dd9b26b0da7c0eccaa18d2e8f86626b18473f11231b
- MD5 7c881c7f253f3a5089e588c7dcb4b81b
- SHA1 b7968d2acf48324a71361046040d37737e80c2fe
- SHA512 a7f0793b89d7ef18567dd2dd6939823cbc092a9b00c7b1c762462b98edac84b97743d93bc3ad6bd81952660443da4b03877d62026a4aee6fb80e229e434fb79b
- TLSH T1925164AF5F5563F71A6B0351420E34E2EA25C89F23B98968703C52AD231415AF3774D9
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/Downloads/Readme.txt
- SHA256 e10801595753d559aa268193596f208ca21aed3f3649f7957489cf5604f0b934
- MD5 17da84b9fd4fe8b2827d0e9db7e81dc1
- SHA1 06e1199bc2cfef1132231036f9404c2f72f546ec
- SHA512 cbcdfb44d477d3b6001d78f0debfbd438eb7261c0d8f24956a39ea0bcd8b644d667c9006acbe4600562c23e5a7cd46d42dfe2dbd1065ae45231abcd49b413552
- SSDEEP 96:su+eTT3kcSPDIW0zoHBjCzBu6Ag9nApO+EGNcWm3OtVEL0Y4L2OiGu6832LiUEhS:3tf90INKGkg9nApObGN/m38VEx4HuUWS
- TLSH T19EB1759B3BD923A3167782927B4E22D5E726C07E63719F15A4EF106C3345819133FAE8
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/FilesSearcher/Users/Setup Game/license.txt
- SHA256 b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
- MD5 e3f2ad7733f3166fe770e4dc00af6c45
- SHA1 3d436ffdd69f7187b85e0cf8f075bd6154123623
- SHA512 ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
- SSDEEP 384:gq2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPyBrsS/S9B:gzuh1iYWrTXoPAs9B
- TLSH T18182A32E7B0503F20AD242916A4B68CEE31EC079763A1155345DC1AD237FE39C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Brave/Default/cookies.json
- SHA256 1005b104aceba7398fb873ad0efeac8d90a38bc673ed2199bb47643df3e84f4a
- MD5 27cbea535161878104b077713fc92069
- SHA1 8c4b0332363bf02f0b3f8b2101a7893936436257
- SHA512 3d38f1ce87503419bd834af4757958775bd6fbf9b18950740b92334b234a9888e315b252e66c2ac95185cbedac1fb6c389de7c9bcb2e07e3f3e006c9ac09f7a4
- SSDEEP 768:DBxUYb/OYQdJ2r4UQ9T1FeL/h/tCZIcfn:jpLDQdJ2ST1FeL/h1Cqcfn
- TLSH T11BE2B7AF55C30C36CE234616FE503FCD77B80B6650DCADBAE9B5C65AD884D5222018CB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Brave/Default/passwords.json
- SHA256 9fcdbcea2b5dfcc5a3ef0102860877eebadb00fd2ab098cf4e1dcf3979bcde40
- MD5 522c8e464557768bec1c42f31b7575a5
- SHA1 55f4e2613e64d813590c422ed96ad9e71bae7640
- SHA512 02ed6d2ee349e202366307f8707a42a10c2812329cdc2aadd87dd6ec340287d05f3b46a0373f0cd7872ae3d6357f742dae11d2f41ab3fff72ccc0408439b120d
- TLSH T1FDB092AE86860A10CBB2828C8A1876A924C0451A999EDC9041329E8CB925CFB4C4DA16
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Brave/Default/payments.json
- SHA256 285386bcbda5b2338822b19266a2b90c6d87e9da18401f9148c69e469c11bcb7
- MD5 cdc6bc1cb4ec05d3e1952695ca640971
- SHA1 e1c92176fac5ddd9ea6c2cb2e01d03514bc3c84f
- SHA512 b8025aa7007a269a132403b2917710e023753980d078a72ae83cd01e40a71239344244c949662b26ff04f761b5859b49b1105b53506b9ff1ad65d9fb18e7c6bf
- MD5 SHA1 SHA512
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Browsers/Edge/Default/cookies.json
- SHA256 b0d72e376790804eb48bd2a678f16c702a968312d5428061b2e42acc7704380e
- MD5 95520450411552ecd05fcc4c198b07d4
- SHA1 597f9f369df722ca135545678edafcc17ec86c41
- SHA512 9287a4d48e1a9c1300323c8b64f503c9f190d60e1c81d49cb2590344d2e73a4aad39c9900e9c9b8e03f352a22fcd7c1e2355999a9da970e0d33d37dc29872ada
- SSDEEP 384:ii2IccmCscXsvjzS6Dnr2bNWfhGzGbAIh0:5rccmCscXsfSQnrkNiAF
- TLSH T15F7234BF64E30C3BCD670616FE117F8971A82F6350C8EDB7ADA4C946EDC555122128CA
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/Recovery/Passwords_05-05-2026 22-42-14-701.zip
- SHA256 13a237c04ca3a695501e9546e8583000f58a248b9ecc574f65c17bf84de5ecf5
- MD5 f1f2ef3a8ddd8a16cf3c9513c78a6aa2
- SHA1 05a36a13fc87cf5f7ac612170d8132d6db36cf80
- SHA512 a911f0506b526921a03d1beef911b4df8b97a4d687d29d7c2bb43c510fa838775ad9754dd1f64000a8a3f87e80385cfda42e914c052f26ba62ca0ff49469416b
- SSDEEP 384:QvOrD4o00YYuOsG1lhse8KyE++eHWaxJN5GGU8dGQqYL8uL3bJW:MyUo9fzFwxJQEr5c8dqw8GM
- TLSH T11992A02877AEAC70C1596EFC4C91298D23936D6F8D6EF543961E75190DBFC9008D8E0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Browsers/Brave/Default/cookies.json
- SHA256 1005b104aceba7398fb873ad0efeac8d90a38bc673ed2199bb47643df3e84f4a
- MD5 27cbea535161878104b077713fc92069
- SHA1 8c4b0332363bf02f0b3f8b2101a7893936436257
- SHA512 3d38f1ce87503419bd834af4757958775bd6fbf9b18950740b92334b234a9888e315b252e66c2ac95185cbedac1fb6c389de7c9bcb2e07e3f3e006c9ac09f7a4
- SSDEEP 768:DBxUYb/OYQdJ2r4UQ9T1FeL/h/tCZIcfn:jpLDQdJ2ST1FeL/h1Cqcfn
- TLSH T11BE2B7AF55C30C36CE234616FE503FCD77B80B6650DCADBAE9B5C65AD884D5222018CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Browsers/Brave/Default/passwords.json
- SHA256 9fcdbcea2b5dfcc5a3ef0102860877eebadb00fd2ab098cf4e1dcf3979bcde40
- MD5 522c8e464557768bec1c42f31b7575a5
- SHA1 55f4e2613e64d813590c422ed96ad9e71bae7640
- SHA512 02ed6d2ee349e202366307f8707a42a10c2812329cdc2aadd87dd6ec340287d05f3b46a0373f0cd7872ae3d6357f742dae11d2f41ab3fff72ccc0408439b120d
- TLSH T1FDB092AE86860A10CBB2828C8A1876A924C0451A999EDC9041329E8CB925CFB4C4DA16
- MD5 SHA1 SHA512 TLSH
Browsers/Brave/Default/payments.json
- SHA256 285386bcbda5b2338822b19266a2b90c6d87e9da18401f9148c69e469c11bcb7
- MD5 cdc6bc1cb4ec05d3e1952695ca640971
- SHA1 e1c92176fac5ddd9ea6c2cb2e01d03514bc3c84f
- SHA512 b8025aa7007a269a132403b2917710e023753980d078a72ae83cd01e40a71239344244c949662b26ff04f761b5859b49b1105b53506b9ff1ad65d9fb18e7c6bf
- MD5 SHA1 SHA512
Browsers/Edge/Default/cookies.json
- SHA256 b0d72e376790804eb48bd2a678f16c702a968312d5428061b2e42acc7704380e
- MD5 95520450411552ecd05fcc4c198b07d4
- SHA1 597f9f369df722ca135545678edafcc17ec86c41
- SHA512 9287a4d48e1a9c1300323c8b64f503c9f190d60e1c81d49cb2590344d2e73a4aad39c9900e9c9b8e03f352a22fcd7c1e2355999a9da970e0d33d37dc29872ada
- SSDEEP 384:ii2IccmCscXsvjzS6Dnr2bNWfhGzGbAIh0:5rccmCscXsfSQnrkNiAF
- TLSH T15F7234BF64E30C3BCD670616FE117F8971A82F6350C8EDB7ADA4C946EDC555122128CA
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/ClientsFolder/70B4B7918B7A58E08427/image.png
- SHA256 9fda47baf40a3bdb1ab3dcad62c247f08221601688f7ad88a101cb95a6e42369
- MD5 8a2bbb10829216d95806fe8267b09057
- SHA1 f4978ea9a2e007175172d9048b09aabcf358c491
- SHA512 53c006816983c4768f9c2a67cd52813cbccc795a6817d59790368219353a75fbaf290f706c078b8aa07cb53ac435cc24b2cf9ed6ca05f97d114f4a9128324238
- SSDEEP 6144:kpwFiwPZXnJNciJMwfX0C9sqqXtvdpR1Cuj9hvSEMZfqggrfn:LiwPZXYKMkE0q9vdHYuj98EM1qprfn
- TLSH T1575423C1D0E679DD4BB170288B51D472176FE4DBB6270BDAD9D21640C127B408AAF9E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
XWorm 6.5/ClientsFolder/AC9A8D17BB80D2398B8C/Recovery/DiscordToken_03-11-2026 20-08-24-050.txt
- SHA256 f3e5d01a4f8d2cfeb631057792b612791df4bb1a4e1b967c7209c0bc959c9223
- MD5 f47374cb4e9640131241b3c1f01b47a8
- SHA1 347419483bac041fae053b45aa757a7fc14d27af
- SHA512 91bf01bf9235c824f46349610ba6dcd76ac268b9acdb99b66c7ce05f1bd976c221de7d689909ed0d4d15eac3367e983e78586a3a3760d137582d33a07def2368
- TLSH T11AA0220F338820CCC80302ECCC800000C0ECA8E000028A8EA2388EA03C20380E22300F
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Fixer V6.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
XWorm 6.5/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
123
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/MySql.Data.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1179402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\build\sb_1-14799416-1710747233.08\connector-net\MySQL.Data\src\obj\Release\net48\MySql.Data.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Newtonsoft.Json.xml
- SHA256 79ee87d4ede8783461de05b93379d576f6e8575d4ab49359f15897a854b643c4
- MD5 d398ffe9fdac6a53a8d8bb26f29bbb3c
- SHA1 bffceebb85ca40809e8bcf5941571858e0e0cb31
- SHA512 7db8aac5ff9b7a202a00d8acebce85df14a7af76b72480921c96b6e01707416596721afa1fa1a9a0563bf528df3436155abc15687b1fee282f30ddcc0ddb9db7
- SSDEEP 6144:XqqU+k/Rik5aG0rH3jGHdl0/IdHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DU1
- TLSH T155E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a8a40ff39f4921f62b7baf2b849a2239d339ae149a7dd36c05c73d617cec314
- MD5 791204e98ba176aaccccc2324e660e80
- SHA1 67d69444d169b869eb33e8c6b5fffe61f7d6e1ab
- SHA512 bf49708e5f342bb4f6f3f090ed0408669f241822fdc318e0c58cca733f165fe553460af44734366d725cad21f229e8da9db3a7a469a3622c65abbdf2c22f20fe
- SSDEEP 384:fRttr7olU5QrGPbONr3odT8ptsY7XZREDue:fRtuRrGPbHt0ZRED9
- TLSH T12C624A69E3E44335C6FE1FB25C7363001370C6088C47FB5E1ACCA2969D5BA9D8B91766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dbdfebd9a3a5c71629d13876a7392b11b8d45f148e8d6ab8b1509518be4cb7dc
- MD5 e0976c8b7a4282536a86a930afd80f0d
- SHA1 2682265d798a3ea7f6006ec1740d1c37a9ab4ea0
- SHA512 9dc6860d1a107ed9bdbb2e0006aaa49a9114306c334fc14f3584f1ae8c2d1a1b6a9c5d7c5b7192807f33f83bc7e1a521dc9649098b77a946d48b0b2c496bd898
- SSDEEP 384:+MOna4ifKQtuUvl0BY0iYUsBQcrwTKvh6GIKoImfWmWGfN:JKQtuq2Y0lUUvr0pImfWZ+
- TLSH T115821829539583B3C6FE2BF64D72E1A043B1D211CA07EF6FADDCB0AA49933528741791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7119232252ef75159f950639e781a0e4060c41a033b365fb87cc0f414daae0f
- MD5 3db4d508119e7a0251db0f4355d43010
- SHA1 fe6ae51ab370169018d2ec4f95d10dfaeca73507
- SHA512 1f42e5b4d544fa5865055f21c8934e96fd7f3286eb8da3255396bd4738752018c99b67839d2501f734f5c6532e6df77b778c04993a080903264b509efb6cc7d2
- SSDEEP 768:lSyQlmUmBlEuPuXfjq2sgDrNjfcVJ5sTVeEWqPkOV1sRduwbKhJLGEY3ZsmmR:0yQltmBlxuXfjq2sgDrNjfcVJ5sTVebu
- TLSH T1A7E2184873E8C654EEFF4E759C3965600372A0839D57F79D0AD1A0AA0BB3B908E51F93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b12f58cd1ce87933dd1115e1a0e3a8162ed91c619b5558ac444ca610debba96f
- MD5 9a8516a3245de4359c946608103e2f76
- SHA1 5f5b4ca4e6639e6bd51db1f7a09c2b30122752e4
- SHA512 96ab8ce7d62bc6f972d82af4ffafbec1354fbe112d3b11fb20f15557ef11566f9ae15afbc081be555d6943ff7805d2e3a75ba7fb8cbfc9bd72518210dbf7ec5b
- SSDEEP 192:fh23MhInehHXpqRxry1/X7eOFXgNTer149iY6IW1mX/YHXa77WLusU:eBeJGxy/X7eUSTe5Wi2X/f/sU
- TLSH T1B6522B9863E4837DC6FD0AB35C73B2401774C705EC02FF2E1DE860A15EA7A99871276A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20058
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b5f4dd71e4fcd7703670e888bf1d2eaf1a5c7834ddff50b869044b39a2e07da
- MD5 82bfe3551669209ba9ea264d41a17cd8
- SHA1 c3b9dd7cbec22d07f47605d4f3d740a8adea4020
- SHA512 05c6694bb725a0d02a5b5d2ffcc868e86b935778a048392bbe51c90f7a6b60d4cee9dcac3bcfceec026c5afd4c2fce11a4e19445f591b50cda2d0e5abbdd974a
- SSDEEP 192:KXpS1QWlPgiqdEquP+GGO9mWbpGkjgyaYcIW1vr/8T4U7aL7+WLEO0AhdW5:K5cjP20mWbEkUyaYir/o4JL7W8
- TLSH T1BF32082DA7E18275CD7E0E7248A7E3010771DA44DD23FB2F56E4A10A5D7B38883B2676
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/DisableUAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6ae9de3990a79183c00057db035934ee0c6ded3a14e158262b7b7e69c9a098a2
- MD5 de3a0b88c7940650a74bb5e38b348b02
- SHA1 811368c07e379a3840393a0de6e5097b99ebdfdc
- SHA512 9833edf4ea1ca83234f203c8404e162c02924471570165d0d31fabe3684bc850e17d365d61e16805822104ba89904af4bcbd956e62482d97897144af2157ad2a
- SSDEEP 24576:hrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvai4M/ZtKP6cBDjvi/CZ:h2EYTb8atv1orq+pEiSDTj1VyvBatM/N
- TLSH T1C5559E0973A4419DFEABE177CA12C607D7B1784A0277862F01A4AB767F337715A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1359310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 23d1928f053a511749ca73559b72c9b12eda4d9d4b742344a9703fb3ad7f585e
- MD5 00e28bd983b64578c9d23c2981d8b73c
- SHA1 25acd6550d09c1b1a15e3458120a13031dbda0a5
- SHA512 314fb89e2d4925ecd55b6fb50ec49d604d829bf1cc12bbce649976270441cb9d34934dcddf102d47262e32e29ff2ead4d8ea3b5170f89b312d6226443628b282
- SSDEEP 12288:xlr7BUE5n+/zlbI9gJvjDWKgpKhGOXoDDDp0b:xlB5n+/z1I9Sb8KhGO6DDp0b
- TLSH T1BCE409203FE8F01FE29A73B6D4D187214BB4A6427296FF8F258446E81C937895C594BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/FilesSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f6f9954f949d7708cbfae9ed6cc638446448498cdd5fc0d1eda479c39baa0c02
- MD5 90cb500d0b2f8ad17ebb81da5680ae2c
- SHA1 61fa0ffccaacfd23c92b9f27d09c402d11b30311
- SHA512 dc8986961cb54a2c69b29202bed550f4014e4e0b57d3dc36f6f21493a71be983e4530e83ce97f810b60119424375b2af50c18bbf0b2c377d242e15577f0239bc
- SSDEEP 6144:qAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/0uhg0BkyORUlKL5i+:rVUpnkZ7slS4Ys50ie6Cf3g0FT6s+
- TLSH T1A7A49D412BE8C647F1BF27B2C0E252A1C7B0E455A62EEBCF5D8424EE1D17350E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/HBrowser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a8ec5c5e44b81766bfa93eded535484d3f85fa026bda7a5492ab0665557b9e42
- MD5 02630e18ca44a1b38558156d0a6de6f1
- SHA1 d4813541cfcc106f190934d5392b5179d44073a2
- SHA512 dffa9a4c84d195349fb1e88fb097b77829cf557ee229bb59ca42cb28c588b6976b1016b382597d1fac31a624b009662db41765f7eceedb26a415074daacc16d7
- SSDEEP 384:Kp33X3L5/QrX8nB9d13+6HGLReMWaFnp9l/1DRVTbg0Ut4xh+7fYMoKABnR:KR3nL5/QrQ13ORR9bTbz+7YMoFBR
- TLSH T10FB25B4967F49630E1FD0A7598B367148370FA935812EF8F0BC9641A2E3B7E446247EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 35be9a19f1a0140133a1ca63a09e899a6a7f5f8616369ec89445c330ad287f6a
- MD5 4e75f5442c33f7651b38c38a8fabfe5b
- SHA1 4262124bdc079412b5cdf25d02ea6559b7afc3af
- SHA512 af4cfe48d7f5b571c8e5f80fe4e2797b0ad376d21f26acf16aa85668d5c86242803a1b60d3a290823c1bf3cba5a9108b17d4d1e84a9c4b882ed8e4efe15c37e4
- SSDEEP 24576:srKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:ZHZ5pdqYH8ia6GcKuR7
- TLSH T18D851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a1a8d50eadd1f75200ca22d4cabfa6084c77db092973c9125412c1acfd08e531
- MD5 dc0edfb24acd1b371e68ccce1afcb6e6
- SHA1 1887adf4e1496c1c2f8cfd80206cc2856a63cab6
- SHA512 652d28b636d95cdc94c2512df42dfaab6d5a23c86164191914e044ebee67af38019914f025b8a9cd7a805d39b92fe1d4d93f01d71fea163e91e71308c7b55cf0
- SSDEEP 1536:4qhezATwSM9jwX0o71Us5XttkzU3mfICaRUlh:/hezVpjwRp5XttkzUMIC2Mh
- TLSH T179832889A3FC4610F1FF5B7598725A204BB1F5532932DB1F22E5906E2F777818920BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/HVNCMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f1f362067d0e613b844e961c9b5c380f95cfa1333436e3431ee3accee1807804
- MD5 b4e4c31850ab3d32f71fabb658c77c26
- SHA1 2071c1d767d4fa868a1e48438d862a98b42b7251
- SHA512 4a9c506b24b6e3d0aa03a1d15244507318e1303c0f7790db735be4ed056488da39ccd07c27ec8b3617bd951335e670d1dd9d5131016b7c9d32236a05cf418533
- SSDEEP 768:xEyXMCBlQ6Kms0noGYMyKgDWj81Y6Mnx9oQog1zqGnf:xLXTa6bX81Y62o87
- TLSH T1A0034B4A77FA0221F1FE0AB5CC73A7289331F5934516D70E2AC960696B73682C510FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/HiddenApps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f24e2ed2972d3987bb189fe69830ab8a4ab56588db0ef0763145a78558abebd
- MD5 ed681170501c5728202e0eaef0c156e5
- SHA1 119eb6e56c58f0e5d7faa06a993be01db378804e
- SHA512 c32d3d21e3d1082c2b2063ce7d5703817376d8318c8720908ec38c64c3bfee1dac54a531c0537a66e0f5e65ce63c12a340ccc416f76b3ae76391dca2baa841f4
- SSDEEP 768:kEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ff+I1:kdmvWHVGMVwtYRtpl/x5qIXdEdX+w
- TLSH T1F2233848B7F88620E1FE1B3AA87363149374F4A71A16E74F0BC6A0592F723C45758BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4a7b655b8e8cb2490b694f2cc090e36d87e53eeb432e1aebe3f3d0c73fa8ea12
- MD5 634faab5759194a8d4b774c0d18d312f
- SHA1 54d4d1986d672191eb13968027ae15e25a8fd907
- SHA512 183ea23b2c73bd8bef2befe2cf01fe74b21358412ea8fa929230560427dec80f1083103ce1dac6f3ad22581247bf65b599faded47346636130a8f7be7cd0d86e
- SSDEEP 384:hCUEeL4D574MvGjydqXwxDJlw0n3TmyxhxJNgSg4ZOF6K:hCXeL4DSjydqXwx1lZjfNWl
- TLSH T12EA22B5837F986A5D2FE1EB14C32924543B6F60B8C12EA1F2DC8909E1D63B84CB55B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 60a48be5365fbda858b6a59db2ff28ce5ee753fb8fa29d09288a9e3a97591b08
- MD5 e5ddb8afb6ed9733450af8eb09d73c2d
- SHA1 52cf60e00ddf8cdfa879c42b70b0e29cfe567a00
- SHA512 4fddea760271540b072e54c52a53fe8581023de9c0bd9126345c1aa72effc0648d17d22e31ae062c0d7e1d1487b282df24179a2fa8b103e5ae3d1d09af5becbf
- SSDEEP 192:2JV/HNfwK5RSpyv3RFRtO1Lnq4Ur1XneDN6IW1Y6Uph1KfaA0UbnFWL2qV:8Fl5Rp3RHtMO4U5uD8UpmZ0y3qV
- TLSH T1F282395C77D08379DEFE1EF2583363011770F2069903FB2928EC61665EE3A898350AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e38fe17fc34b6d61ed7744ce01aee5ac24b50e89eb22e617534a873e0c34ba26
- MD5 0da61a3bfef30fea979f81b6e1fbe973
- SHA1 2fdf58edb525dfdea4a2fb90fa7aa49c02c0fc80
- SHA512 8b637aaa35a8e87036a36239f46e049b43e048b01f2f5fbe12108493e4acc226ff1df7c6fe3c0009d4ef278039bc6f03afb9d68d80a200d452c3b1d5435a165e
- SSDEEP 384:wBqmqunML6thaujkS4jtepa9BX/bt3F2:wBqmqunML6JkX5x/pV
- TLSH T19F621916E3984276CAFE0FF65C3262001776E609CC07FF1E2DCC10A66D5769A8E65762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/MessageBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 02ed6168c76a7a0da54cbfd0196e56972abcc84934f742ad27401bc19cbfc0c1
- MD5 8d6f2371819c772aae45153c7432875e
- SHA1 695c1548dce4ce9e11f22b3bc68a208e3fbe4270
- SHA512 8121a9f9d4ba6e422f0237dc03d214e7190172fe5bd86b8eccd9896fa53521c2c34ec43f061136bc1f72a749f866418a3b8a7041e93cf8f24ecaeb7130878830
- SSDEEP 384:J6lIccn3tURnUuRUUVT/95gG3UX/kZKUW9:J6lIn3tUVbVa/kZ6
- TLSH T1536219A977E08339C6FE0FB66CB262405771EA099D02FF2E5DD850525EA7980C760F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20962
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c95a9fc69cd48558ecc6c248050b6cfd12a10a2ef1862ab8169172b5e8ccc605
- MD5 5a755cc5eb6cc70ef5ef0de13c9a3cd4
- SHA1 be2c925974a2057f3c7279afbdf4861e3f92a4f5
- SHA512 b281cbc2c8bd3da51a9da1a984d1d0a98436cd328cfdc9a38e236b55b56829ec393b25d34caaf54f23cf49e88b4c609de0bccb2ef3a9a0726ca08ae1078c29fb
- SSDEEP 12288:h0OeMv3MrIb8CkZK2bg3WiPpnzrq4bDwsXP:OOe+WIb8CkZxbg3Wghrtwsf
- TLSH T114C46E11BFD4856BC06F33B1E0E20B2B57B5E48A7726EB8F14808AEA5DC37525C417A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Ngrok-Installer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 19dd3a21f6208613ae4edbfe88af63a1279c013426a678d40f1c051e33140b23
- MD5 6c42e6d173c375de5dbb6aa7c26d18f6
- SHA1 93f74229f73c952a6c99a6e8630b2adfbf181b04
- SHA512 895898fd0bbbb1412b7008483d83757cdc6796d1fdc9c392d6aa707afb0b9712018460ed4f3515aff5f7ebc09ba3038e0b6391a0390984d6fcab767453c8b543
- SSDEEP 12288:Qs6T2x75lFR/RG+BUKPqnwoCuYKIT58/M:QEB+4+1CuITS
- TLSH T16D947C107FE0C63BF1AF97F1C162419687F4E05AB79AEBCE6C8554ED28423509A163E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad200fa6548cab2882d371c1e2794b344352a9b76ad2e4caa936b2290454fd43
- MD5 1de9d444e80c844134bb13997ef39dfd
- SHA1 3c51df31eb8c99757a39632d73a288a3a02f3474
- SHA512 912fc6d6796ee74306de8ddfcec96ef29e32e5956aa1dba5b48de31444b7a13680bc00c8391117c041753574b08ea6db67953a0c9cd85cff10532bc4f9325473
- SSDEEP 768:xLxkuz7dDCH839Aybgkf/sGRNW9p9dPjc8:xLNHGUZbgQsGRNW9pL
- TLSH T181D21A017BE84629F6FF6F31EDF622158A37BC4BAD22EA1D0890101D6C73694CA51F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ccf5f8b88ac6f443073df485dd51cbfa3fe750473fb01fb61019d92a62288f66
- MD5 ebda2d8d9e0058c8fee1771442a5238c
- SHA1 6fb928498ffa697a43f7b8eeb9176c75355c9053
- SHA512 2699699e82eb0a46ef02643490cfbbd79dc71a8ac524ba2ffc17f34783a157c6b59c8853156423315c3d86e94cd34fa810228b6376f3c7ae521e7cb6090ca767
- SSDEEP 384:QK9Y5jI8MYODPqePW1vepi5zOY7//fNXsA8/h3U:QK9YNI8MVDZKWwr/KA8/hk
- TLSH T1A48229255BE48371C6FE1EB248B3B31003B5E242DD12FF1E49D86156AD73A85C760BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 053525c14915cb1667a5360178c5518448aed5513cdb9cb16e106b20094776e4
- MD5 b8ef85d25c73f9004316d27e1912db9a
- SHA1 bcda6b397933e9197ac5f5cdb2298f3a02a4dc5a
- SHA512 bb96c9bb532223746aa3a573c0ff3ac9d9b071f77bcc9f84775274bd42a57797206536a81d2c117c97075d0b4751b50ee7543189aa3a2b4900dcefab28770384
- SSDEEP 384:ftpW2/E3moTWD1XTgOw2QxHN7yVpHyQ+:FY2ImPRDKHPL
- TLSH T138722A19F3E54376C7ED0EB24972A20117B1DB029D13FB2E4CC870A65AA3A988B51B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad5ea588effe4b4c484fb7343881b1820c88924a40948431e0884b9ec523b281
- MD5 1392f96745ac358178591f5187bd97ff
- SHA1 6e394c362ee287822cf62e33da73b10fa0ec8f61
- SHA512 0005f801bdfe98f47b8466debb17984f31568f975f2fc0d34a485cb26de8adef1b3052cd7139f4b722e889c0cb08070742f323816cca2b003cd29b4e4f6c8308
- SSDEEP 384:fRdqZXY/oSd1PTQLvLwLadRtZa/rDvDSQUT5S97/Y5bLOEYQfwrpn45rDhxn1kAY:fRdqZXWrQPkQtZqrDrlU+cYi1kAvZ2
- TLSH T17792185DE3E4C3B1C2AD0D72587356510770DB018E23FB1E5CE8A0676EB36E98B22766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25290
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b430c95b3ec7aed1f861a815e34b6cf863b7ec988047f3d12a2069d9072d209e
- MD5 cdc63b0a5d5ac1f234c41c68bfef9ad2
- SHA1 b7f48745dcfea2e60f75ce6030f9187d2aa3dc80
- SHA512 52a350e46bc2fad4c6f096526af2814681adfd6f766e01d87b161d8d25e1805ce95d9546b2d7d53abcd873392b87a7609ab11042910f7a7b7550f60ebdb33a52
- SSDEEP 192:b3eKcfO/TCOAOG+uCno9SFpoFmGv4O4FgkT8zr1P9YD6IW1GX/V3yd0y5WL2Vb:CPG/TCXF1STSAdnTu5lYTX/NyKy7Vb
- TLSH T166521A59B7E48379CAFE0AB21C33A2411B36DA04CD03FF2E29E851465C776948B51BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c26a184836b0c3828a9054270ec5cc70af927ff140e12133687ec886fd60f4c6
- MD5 c63f44de68077ce8ed9fe94dc603d295
- SHA1 66f1df7f96e9cb503c8dd08033a8d0aa9cc01215
- SHA512 d4237fc37d59322a7624bbe6bb90a2db980b3a25dd06a4de19b610e00e00d022844cf36110eb7886ad24b8d00fa42cf0c9a3ad38fead05344a3e458fb948507e
- SSDEEP 384:xVSO27QJHvpebFn0LC9Tk7fxxOi+ZMuqI+sHY4k7E/eEZuQZh:xVm7Q1vpebF0LC9TqZlj76tkg
- TLSH T13D92F62D63E0E175DCBF19F364B3D25103B1DC35A821F62C7ACEB0AA1FB21494295E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28ab8b6aaba021460360910909c0fcdbc6a593da96a9820a439550ae240c18fd
- MD5 c28989d92cdedc1ef5f0d27a58190633
- SHA1 ace46cf680ce816851a6cab8866b6eb1977b9f64
- SHA512 321f4855618379862667f7890be2c813c4f26c0477c31328e2f85830e3604de54100cd14054c22e9cefd7fe4a29bb1838a3ae4b62cb023dbcc824e0d3f42572e
- SSDEEP 12288:alwS2DXI0GVFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbB:iwSmHGlc805jbmbXM7g8+M9JC+
- TLSH T126354B507BE8DA17E0BF23B1E4B20A451BB4F851B3A2E74F544861ED1C62384AE553FB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1157622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e13989fe43bcc3a87fe167406309e7b47f7fa3d9628b43c319249c4fd4fff6df
- MD5 530c5688a2df457600598b01caff2d94
- SHA1 5eb84b730a87ef3b9cc9629a3873e9576f8f57cf
- SHA512 73e97792b26ca53e612e9f8f03ca69988eee943896f9d048464fa7fb8336a73883169c1656f50fa2f47043819c3534a16b38b03750eb7f3dbc1f446f072f21fa
- SSDEEP 384:/ZAOzwQW4pmewuYvpYr3fSr9A8/VlQeZ:/ZAOMrzYOA8/VX
- TLSH T182622A9AB7D08332C6EE1BB20C73A24157B1E605CD07EF5F9EDC10AA5E132ED8741669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cea86d652a6f8a3efb651ce6e4796b94497918b904a82e27a8f3f9842e603eca
- MD5 4967b13b95885b1d32a58bdb0535bf4a
- SHA1 4bba955348f786938632acd62d037f466ec362ef
- SHA512 466b24ee228f3bc822f33c944dd36d36d4905c1224371e8a4dc0a53b3848ef60b1bea14bd847dac00f640252a75e84849c98331effbd1e05b53480945984e737
- SSDEEP 384:+Kr81F+CoNFZpeg7qX+mKBERFjt9l/C6I5YxBXWHeVFjwJ:NTvZY4gDRbXBLjY
- TLSH T18A824C1D7BE48379D6AE0E7948B3B3011738C2099C43FB1E4CD8A1A55EA37C98B71765
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/ResetSurvival.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a9d9289bcbfd92c61478161862031894ecb7b0dea94f25846d13388e665d6f19
- MD5 6414251b179a478ca15b5cea955d0075
- SHA1 48ecce6204efd6fca67734f5374da3714dc50449
- SHA512 c3348f05e5b91cdf0571a7573bae9dd2ffc8ba587154134ef5569d4f6d604d0cfa4a95f925057c5090ead80beb2fd4319140968a8f41bc4e1cccd82c24b0ec26
- SSDEEP 192:ybErIEqk7WeMSJ9MJQ7JNPAGOOKji4+YhIW1PnvN8BukDgTqQVmA3mmNPCFLWvM7:ybQ7/TGQ7J72+YrnvuAkDpmNNU
- TLSH T13F42081B93E44271E9BE1A3A4DB192030772FE848837D72F15D9750E6DF3640CAA07B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\ResetSurvival\obj\Debug\ResetSurvival.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c131d44c17637a5b9a90a31c71239b66d96da522b4c834239e299973264c75bc
- MD5 d6a8df84bad8ad91f8add49b53205474
- SHA1 a9eead0ea0840259fc79286d483d6e55b1f7c656
- SHA512 3c83e300f63ca53e3c12315740936d6e215875e215f7b9cb6a3db1b427af38025ff10d4f359876c7cef197bcfc23f63cc4e1c3298d8664813e6c65f25675ae55
- SSDEEP 384:0NsDP9fBkZ3pBkHEk8GZT8x35UzTNnrYFXoMZlS9PP4T:0NuF+ZZ+mwTI3KfEoMZQ9PPC
- TLSH T1B27218AC67F08375C6FD0BB34872A2016B71D605D853EB2E5DDC70960E63689CB84B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Rootkit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bfca57f0a87a0be4b40bbf70bde1c108cc3b4ca020c5aba79b8c559fcf9ecf8d
- MD5 69ef356b7b31980e890ef4dcd917b395
- SHA1 5d098dbfdeab7c7c11227fd09e62f8ad1ac0c34e
- SHA512 39ddd924f64bbb74e57313b4eeff86cf7020b9074248af090a6f923e52a62f77e08f5ae76f10668c4961397e83a3763958deb0de240b827041bb9d8dd59a0a2e
- SSDEEP 384:0CzCDUoUvfyilwjYCe/CihVnfX6K3HtKREcAbfiQuR9tEohzgptObQycanCDpL:0CzCooUvfHB/CihVf6K3AREh03uoLK
- TLSH T19B92BFB543E8863BC8DB07FA1D725140033AF6109633EB6E44DDB1A56CF3A8547AA735
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\Rootkit\obj\Debug\Rootkit.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d2dc0580eab5bd5dbb07dc094f1a5ef436875ac8a6839e3a6d69013d39820e7
- MD5 344b4e3e37412c0e1ad535ef28ff3c00
- SHA1 d06f7b72803edc5490872e4697c2524ab3bb28db
- SHA512 f826fc3bfdf0479d3eeb7eb72900cede1c210252ea2c9e24067a3ef08966243628d389f8249ea331ba4e2736bd90ecfc68676f21f96c69b0b618cc047ea2cf27
- SSDEEP 192:dbfqh94qfL9XFw3l+LI+GGOueq1JtSnIW1fUse+bpoRWLuU:dbChWqfLjNnjJtGUse+bpoxU
- TLSH T1BF32091D43D8D679C9EE0EB24CB222811BB6DA458E57FF3F55E4A0261CE33864AA1731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b8b07c2decff982adf5682c471aeb53f43020d3ac2c7ebe877b8698447a2e02c
- MD5 31254160ae98bbc5a4f1d872fa02923e
- SHA1 dbf8ae1a4075ebed563f29e5e5f066619f8ea36b
- SHA512 d179156329d7a19b17bc211a454d60a0ccb0443b0409acf4dc0fb655258fa48072673ce1b62d329b00141a829df9999db3206442f0a5a2def06c0c2361d99a07
- SSDEEP 192:aFAiNLB2n5QbRBiMcs/XAaICeMzrOFsgXTZr106Yq6IW1yShrM9+W2WLu61Jjm:Fiq5QdBiMn/wpyUtTZ5nYsShYps0Jjm
- TLSH T1AF622B6E63D4833AC6FD0EF24C7393011B70DA09DD12FF2F2DD860565D63A994B21A62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 087572f92a6f37c96478f990e2737099cc88081ea017bd91f113b78078eee441
- MD5 98ebc34e0a06413c424ff126b64a0070
- SHA1 b80e062b869a1d8178c1b1de1cdb778dff20a0eb
- SHA512 a5cd6d8ccfe7324a32ac53bf3030c298d07ddc5cefc48d508ac25d8a2d85e2b2ca9c4fee46ed3541f555004fc0d2b7d748c00c2a98be826ab53bd24b8c5f639c
- SSDEEP 192:GDXwH3m0L3G33Kkw720sM7f0q0dV2KOFBLggT051i9Yd6IW1OU1Yo7PbszgL2T:3H3m0GqHT7sq0dVtUXT0HoYpU1X7oDT
- TLSH T137623915A7D18336C7FD0AB61C63A20147B2D704DE07FFAE6ECCB0960EA72858A52261
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 eab18f25e087d1c25e804a6096c9cec8c3de790dc7b4072c9d0f9ce0f3d8d19f
- MD5 c69ad581be6d93a3d1a55bc84972f6b3
- SHA1 e22ec3ec4d622b1877a21e2d4d4c70ab1e0371e9
- SHA512 705330297bce9e4b3fca9091be1575e67fd402aecb2f41784adf2692b851a88050dad26a8f62005916ce03356d1fbd6fb895f79c04b55dbedca76aa97be5a956
- SSDEEP 3072:+ITmgSRcBHAt+yM1KlUKEHBAnpK37nX38KBOQv174SyohwsKdmWkTSme9DpR0cx2:+MmgSRcBHAt+yM1KlUn8gjT3e50c
- TLSH T1A6144B4067E4CA2BEB7F13B5E4B216107774F04BA622EB8A788C15F95B2334059167BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 30853501fa2bbe3fcdbad0e2526fd0a8af678e8c54036fec314950363d1c5197
- MD5 ab55e004a7dcee1b5ec8280a696c218b
- SHA1 8ef0a10affc66daea8563cd302868f98f1ee3914
- SHA512 25d479ce82553f1b9c76804a633af701c3a3f6d6d1d1aaf96055619cb5f3ebed4868dc230f0f3fa1c6d017a55ed09eeaea314839dc9efdef5580cb9d084125cb
- SSDEEP 49152:3SsvTbt3wiQB6nenuS2L6GbriqeGAb4TkyNej1LxRdo:3Ssbbt3wiQB6nenuSrxw
- TLSH T112F549087BF88B77E06FA7F295B1051657F4E45AF3A3E74B2A8066A80C13B006D5537B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3453386
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/SteamTokenRecovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 65fd26028db0b27ecc697e9c805a9b72e3536496289c0ca97bf13adc9e56c302
- MD5 15564c43cb1a2038f58df55c5e2808bf
- SHA1 3e8382e8a0f3a4bc4e7d1abb2655849a66397384
- SHA512 8761dd4408b6dd7c7670aa38dbbfc3925a545bf2b56b69cca38fa3ad81ea382c610a3488fa053963adaea27d691dc7adb59301225ef62c930382c8153150d826
- SSDEEP 192:0RAcJmpLVZaDBjjPfbaQ3ehjXZnDFDFGOHvHilfm1DfIhYvIW10M1IXwH0LFL2Is:0RAWoZ4jTVtAvCNs0hYaM170EIs
- TLSH T1DF62072963E8C268D4FF5F36487299010B71FA25CE73EF5E68D5704A0D73B944AA1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\byt3d4sh\Desktop\Projects\XWorm SRC\SteamTokenRecovery\obj\Debug\SteamTokenRecovery.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 115e4ebbd72e56b7c817a10c8a8b9f2daa48cf94dd158de3a20aa8b274d38733
- MD5 afc7fe6728ad80a214e3271bd88637b5
- SHA1 e6cf2bcd9bb4a25c43f62077008f8b45cc554f8b
- SHA512 667d5bce7d10b970e20d2fbdd9528be59beea6b79a6c8c733a4e761152dac12f31ac91cc264dcde529fb33dfad22f12ef9622508ea8daf1e1b8cab0b9df94fb1
- SSDEEP 192:HFaPxrfOAHEWG3/xvoQCd0UOmlUbOayEox0GTeA19Z/J6IW1Gz/y4Y8XKuVL2n4v:g9GAkWIAHO3FyzTeej/Zz/eT4v
- TLSH T12872170CA7E59339CBED1EB218B3A1010378D609AD07FF6D19CCA12A5D777984B517A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 edf251f631231dd448c8343f1206f9796fd7947c9f6a654ad6d23d69d89d3578
- MD5 759ed6c2cf43018eac0c3273c5f8723a
- SHA1 11b2e48ec2c69a6db32877e24878360727612b5f
- SHA512 ba5b0a220e66cd3ebabeb50c1ccd174270bd00d36f06caba0ee03bd91f226d0c67ec0a35b5a9db6edb84e01d959d822eed74af3dfc68f70cb8b3380791eba969
- SSDEEP 192:3cqAWYKDF75yOGOko8bZfmgyOYkIW1UZ/Xvjljw2ugEWLW4V:3nRNF75yrE8bLyOYBZ/XTugS4V
- TLSH T1D922092A67E08335CDBE0E325C63611007F9EB05CE33FB2E5CD4A0895C6365487A2B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/V20Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2b507d3ae01583c8abf4ca0486b918966643159a7c3ee7adb5f36c7bd2e4d70e
- MD5 fef068d49d6bc853d465fd5723ff3f4c
- SHA1 e1a2b12412a1468e0b572ddb48c65f5ddffefdcd
- SHA512 06798c658c351eda13539292f731dcf3a851d53e2fa6349c37582b9a4d5e41d0470f4a49f8684130b7aba2156d41d024b530bff3ae3ccc20736f2c4c03fa42d8
- SSDEEP 49152:ggkeZAyUPrHeh07ThlBUh7//4u77cIAUX4KAs7uRfbQswUZcSByYGv5uwSuV:p2Lq//RfcfKp7ul5SxV
- TLSH T17C16D016F7D985EDD1A980B985B79909D6F6F8440B25DBCB22D90B2D2F333E01D3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4124718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f9a1696fca5cb4edb6ebac4187a2f77ca7407cc55c4a36fef430d6ce515a272
- MD5 dca84e91b287a08d23466a7810fe1dd3
- SHA1 70786ea3dee7bd5ac39147da0632c3b90ee45068
- SHA512 9d11c5fefaa8c8600d5a33cda943487298734c80aa2283fb6ed6587124d906ac856eab6a2b4a9a5f5fbe95f68036e876e8d0c2e01bb1f1d990a7ee64b798fb09
- SSDEEP 192:7ESp/+S2SoWSO4A083xaUWN2xSSZOCeJyxlTer1c9gotlF6IW1oXxvZVY4cQWLuN:j3SO4aApNAS2feyTe5agIXxvLcWN
- TLSH T11D622A1B63E883B2C6EE1FF21C72A2011375D6159D53FB1E1DCCA0868E63A9CCB51726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/VoiceChat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 612a84751aed50ae2e86e5b24f03a0acfbce92e46f29ca4f6d973463b04b825d
- MD5 4395b66b4ddefa25ca81a2b2e938b327
- SHA1 1e2af38ffc942ca7ed818f6e6e17b8de3722d442
- SHA512 4050f87384d5cb2e0345055b5c3515f9d34f5237ab6321bed60295b7b1df046b9d71bd1b41da295623009640e9c7c750a3706e63ee3d9aba4b943e3ce0c0db44
- SSDEEP 6144:FkcVpiCslfiJOBvKbfaIKlEtfb78+SmmCENCTC7CbRb9BAhqEiFlbyj85lJwyP:6Zjp8fIlEZbg/AXEmbyQ5ky
- TLSH T11DC45C11BBE4C527C46F33B6E0E20B2E57B1E486B61AEF4F05D09BA91D877464C41BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
557690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 05897e7742e0dbfac54d2f097d111f3af71d679f3a158b1a5a09e5126039e0d6
- MD5 1d9d62f8b7b9d043e074ce29a97b2486
- SHA1 1bfc151ac10bb60a627b640b7980239499f6050e
- SHA512 266f0e372453b4aab6708263fccfdd85160733c0f9256177d33b02dee59faa776f197e6ead73b8fbbee6798dd4f24b654153caa0abeb70dc28cfc89cdecaef66
- SSDEEP 12288:nyw8KX3HOt3qqDQkoJBBi3bgtPbKvxGffjL8R:yw7qDQkoebgtTvjo
- TLSH T140C46C12BBD49527D06F33B2E4F20B2A57B5E48AB316EB4F059096AC5EC37815C41BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 49ef4716ee261031d1c6977efe6afc47ebcf012bc87219a78f21786b46aa0de2
- MD5 d6d407ea21cf46170aeaa44daaf045d2
- SHA1 a92a841f328c10b67c7f686b048b03c0aa78e722
- SHA512 72a0b5fa694c6f529b061e27feccdbc7f6a681a887731b44fadb5b3efcc00461ef2c44e943ab3aa5cf16fa664741342215a186db8645096d94af040b8c57d836
- SSDEEP 3072:HA0ynWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJZ:H+n+22fFcgBgakL320zYZHpMXM/O/
- TLSH T114247D06B3E5807AD5BE4A3588335A199779F8118B71DF9F1B94026E0F633C18E39F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Plugins/WindowsUpdate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f279a3fed5b96214d0e3924eedb85907f44d63c7603b074ea975d1ec2fdde0b4
- MD5 42c76f1205d21eb41ccdc0cdd4f4fecf
- SHA1 6890faa814977fca7b2d06d92c7e70956f2fe99c
- SHA512 4a7cdc8666a37879d0103ee7a01a7b7125a368e22a848e3f7c2ccccc563b862322f4a1693bf2fb6a525091f66ef36ea30bbe720e8cef89d307d988a35588c7ba
- SSDEEP 24576:6Cs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:R7uRfbQswUZcSByYGv5u
- TLSH T17E859F22B6DAC1B9D4EE40B9C97B951AE7B6784407348BDB12D4176E1F337E01E3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1719470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm 6.5/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm 6.5/SteamTokenLogin/XWormSteamTokenLogin.exe
- IMPHASH 351592d5ead6df0859b0cc0056827c95
- SHA256 c53e944d97dc63801bc2d7d520975fcb4ceb71911fdf04bf1c86e1489814febf
- MD5 d4007a83505ba64e22a620f08ef8cb8a
- SHA1 554b2677c0c5e66d5dfffec18f0916d6ee62ae99
- SHA512 c01538eaf3901d2a9e8a90638341701c857dc48b3b6cd946f75e20f75c02cf01585656b48d9f7a3a81ba9131faaccc6c984f87ccd984cbcbc7ac9dfbcaa33f6e
- SSDEEP 196608:pqYMFkI1AUCv3YNIGmk0xuc1NwO8urHQZD9BKG+5fc2S/ErXKEtw+B/onXmMsqgr:poKcCvHbxx9rr8u0ZDvV+53SM8+BoXZ
- TLSH T15EC63314BBD109EAF9E3E23A87508CB9D3707C032792CEDB839486212D776E51E36756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
HeapSize
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindFirstFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33140,
count=141, id=1, productName=Unmarked objects,
count=27, id=260, version=35213,
count=1, id=258, version=35213,
XWorm 6.5/XWorm 6.5.exe
- SHA256 e0403c866274bc5af466d2fbf6f65d2fb05dbe309ef4e175d17f0b775be72eb9
- MD5 322049e146adb3a68cc9c1601091a59f
- SHA1 8e5481fb9be4220e69207fa4085b81132fe8f8ad
- SHA512 5e9637231a82a23cb0e019a03ee9f2597040bda6109ddf140ab02ca659f96a82d421f03c57c9f4bccc67eccb8be26e5aad6751bc4fbc26d910bbdc7bb7a55110
- SSDEEP 6144:AdTltSSNeaAhJuiFM7MMAr67BzRULjTqUDAIFEbmmCKwlD:sHNdAhJa7MMAO7g/TqUZzm+lD
- TLSH T1D1648D0A7F91D741D8852D3F82DF6800877675D20A3293067B09DAE25E457ABBC293FE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
77:5b:1f:88:33:93:2e:bb:81:15:50:22:76:b0:f1:e5:3b:54:b9:df:d9:37:69:de:c8:e5:d3:1b:ec:29:18:b2
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH
Chains
Oct 26, 2022
CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Ghisler Software GmbH,O=Ghisler Software GmbH,ST=Bern,C=CH
Serial Number
d1:d9:b4:e7:4c:7f:5f:41:d5:d9:60:fd:a6:f9:22:ad
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 13, 2022 - Oct 12, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
297KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
XWorm 6.5/stubs/WindowsUpdate.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 df82509b367791f33774fcc2b2de6da70f91b75883ea6885a8b9e400abfe18a4
- MD5 40541101db52c62b5eceef6d0b97bd92
- SHA1 6ce290ec035279ac36ea2e43db7dc6fe369d4876
- SHA512 96210983ba27af6884a6eec0bda30c107028c5bab1b630df7b7b538f75fb8a99fa270085c8a7b21db12ff0c17d4199f1227b92e3ee975f3c38d8bc970c185dba
- SSDEEP 768:URa+jfTHvqnFBLdxND+qlxTFyp9W16KO/hmy0NO:1cTHvqzLdxEqPFC9W16KO/MbO
- TLSH T1EDF24C08B7D40216C9FEAFB469B3A1464634E307DA17EB5E0CE485DF6B27BC08D517A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ