Netflix-Checkers-Generators-and-Accounts-Tools-Pack[.]zip

resource	yara_rule
sample	agile_net
static1/unpack001/Easy Checker Netflix/Bunifu.Core.dll	agile_net
static1/unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuButton.dll	agile_net
static1/unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuPages.dll	agile_net
static1/unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuRadioButton.dll	agile_net
static1/unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuToolTip.dll	agile_net
static1/unpack001/Easy Checker Netflix/Bunifu_UI_v1.5.3.dll	agile_net
static1/unpack001/Netflix Account Checker Coded By U0k/Bunifu.Core.dll	agile_net

resource	yara_rule
static1/unpack001/NETFLIX Checker V2 By MrPrinceX/core32.dll	SmartAssembly

resource
unpack001/Easy Checker Netflix/Bunifu.Core.dll
unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuButton.dll
unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuPages.dll
unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuRadioButton.dll
unpack001/Easy Checker Netflix/Bunifu.UI.WinForms.BunifuToolTip.dll
unpack001/Easy Checker Netflix/Bunifu_UI_v1.5.3.dll
unpack001/Netflix Account Checker Coded By U0k/Bunifu.Core.dll

resource
unpack001/Dark Star Netflix Checker By Scorpio/Bunifu_UI_v15232.dll
unpack001/Dark Star Netflix Checker By Scorpio/Bunifu_UI_v15264.dll
unpack001/Dark Star Netflix Checker By Scorpio/Netflix Checker By Scorpio.exe
unpack001/Dark Star Netflix Checker By Scorpio/api32.lib
unpack001/Dark Star Netflix Checker By Scorpio/libcef.lib
unpack001/Dark Star Netflix Checker By Scorpio/nssdbm3.lib
unpack001/Dark Star Netflix Checker By Scorpio/xNet.dll
unpack001/Easy Checker Netflix/Easy Checker - Netflix.exe
unpack001/Easy Checker Netflix/Leaf.xNet.dll
unpack001/Easy Checker Netflix/Protect32.dll
unpack001/Easy Checker Netflix/Protect64.dll
unpack001/Easy Checker Netflix/Qt5Core.bin
unpack001/Easy Checker Netflix/lib32.dll
unpack001/Easy Checker Netflix/libcef.lib
unpack001/NETFLIX Checker V2 By MrPrinceX/NETFLIX Checker V2 By MrPrinceX.exe
unpack001/NETFLIX Checker V2 By MrPrinceX/core32.dll
unpack001/NETFLIX Checker V2 By MrPrinceX/data.dll
unpack001/NETFLIX Checker V2 By MrPrinceX/libcef.lib
unpack001/NetFlix Accounts Checker [v1.1]/Leaf.Net.dll
unpack001/NetFlix Accounts Checker [v1.1]/Leaf.xNet.dll
unpack001/NetFlix Accounts Checker [v1.1]/MetroFramework.Design.dll
unpack001/NetFlix Accounts Checker [v1.1]/MetroFramework.Fonts.dll
unpack001/NetFlix Accounts Checker [v1.1]/MetroFramework.dll
unpack001/NetFlix Accounts Checker [v1.1]/NetFlix Accounts Checker [v1.1].exe
unpack001/NetFlix Accounts Checker [v1.1]/NetFlix Accounts Checker [v10]32.dll
unpack001/NetFlix Accounts Checker [v1.1]/NetFlix Accounts Checker [v10]64.dll
unpack001/NetFlix Accounts Checker [v1.1]/SkinSoft.VisualStyler.dll
unpack001/NetFlix Accounts Checker [v1.1]/build.bin
unpack001/NetFlix Accounts Checker [v1.1]/database32.cfg
unpack001/NetFlix Accounts Checker [v1.1]/libcef.lib
unpack001/NetFlix Accounts Checker [v1.1]/xNet.dll
unpack001/Netflix Account Checker Coded By U0k/Bunifu_UI_v1.5.3.dll
unpack001/Netflix Account Checker Coded By U0k/Netflix Account Checker Coded By U0k.exe
unpack001/Netflix Account Checker Coded By U0k/database32.dll
unpack001/Netflix Account Checker Coded By U0k/lib.dll
unpack001/Netflix Account Checker Coded By U0k/libcef.lib
unpack001/Netflix Account Checker Coded By U0k/xNet.dll
unpack001/Netflix Account Checker by Bornwood/CefSharp.bin
unpack001/Netflix Account Checker by Bornwood/Netflix Account Checker by Bornwood.exe
unpack001/Netflix Account Checker by Bornwood/api32.dll
unpack001/Netflix Account Checker by Bornwood/libcef.lib
unpack001/Netflix Account Checker by Bornwood/xNet-Ameliorated.dll
unpack001/Netflix Account Checker v1.0.0.3/Netflix Account Checker v1.0.0.3.exe
unpack001/Netflix Account Checker v1.0.0.3/core.lib
unpack001/Netflix Account Checker v1.0.0.3/data.dll
unpack001/Netflix Account Checker v1.0.0.3/libcef.lib
unpack001/Netflix Accounts Checker v1.0 By X-LINE/MetroSuite 2.0.dll
unpack001/Netflix Accounts Checker v1.0 By X-LINE/Netflix Accounts Checker v10 By X-LINE32.dll
unpack001/Netflix Accounts Checker v1.0 By X-LINE/Netflix Accounts Checker v10 By X-LINE64.dll
unpack001/Netflix Accounts Checker v1.0 By X-LINE/Netflix Accounts Checker v1.0 By X-LINE.exe
unpack001/Netflix Accounts Checker v1.0 By X-LINE/Qt5Core.bin
unpack001/Netflix Accounts Checker v1.0 By X-LINE/core.cfg
unpack001/Netflix Accounts Checker v1.0 By X-LINE/libcef.lib
unpack001/Netflix Accounts Checker v1.0 By X-LINE/xNet.dll
unpack001/Netflix Brute And Checker By ShaOnKrisTof/AlphaFS.cfg
unpack001/Netflix Brute And Checker By ShaOnKrisTof/NBrute_ShaOnKrisTof.exe
unpack001/Netflix Brute And Checker By ShaOnKrisTof/libcef.lib
unpack001/Netflix Brute And Checker By ShaOnKrisTof/libexec.lib
unpack001/Netflix Checker By Dark-Time Raisen/Netflix Checker VIP.exe
unpack001/Netflix Checker By Dark-Time Raisen/alocal.cfg
unpack001/Netflix Checker By Dark-Time Raisen/libEGL32.dll
unpack001/Netflix Checker By Dark-Time Raisen/libcef.lib
unpack001/Netflix Checker By Dark-Time Raisen/xNet.dll
unpack001/Netflix Checker New Api/AlphaFS.dll
unpack001/Netflix Checker New Api/Data/SkinSoft.VisualStyler.dll
unpack001/Netflix Checker New Api/Data/api.pif
unpack001/Netflix Checker New Api/Data/xNet.dll
unpack001/Netflix Checker New Api/Netflix Checker v2.exe
unpack001/Netflix Checker New Api/Newtonsoft.Json.dll
unpack001/Netflix Checker New Api/Updateapp.dll
unpack001/Netflix Checker New Api/data32.bin
unpack001/Netflix Checker New Api/libcef.lib
unpack001/Netflix Checker New Api/msvcr71.dll
unpack001/Netflix Checker v0.2.1/Netflix Checker v0.2.1.exe
unpack001/Netflix Checker v0.2.1/SkinSoft.VisualStyler.dll
unpack001/Netflix Checker v0.2.1/core32.lib
unpack001/Netflix Checker v0.2.1/database32.cfg
unpack001/Netflix Checker v0.2.1/libcef.lib
unpack001/Netflix Checker v0.2.1/xNet.dll
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/Leaf.xNet.dll
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/Netflix Checker v1 by Sh4lltear.exe
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/Netflix Checker v1 by Sh4lltear32.dll
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/Netflix Checker v1 by Sh4lltear64.dll
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/core32.dll
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/libcef.lib
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/strip.dll
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/xNet.dll
unpack001/Netflix Checker/Bunifu_UI_v1.5.3.dll
unpack001/Netflix Checker/CefSharp.cfg
unpack001/Netflix Checker/MetroFramework.Design.dll
unpack001/Netflix Checker/MetroFramework.Fonts.dll
unpack001/Netflix Checker/MetroFramework.dll
unpack001/Netflix Checker/Netflix Checker.exe
unpack001/Netflix Checker/Tulpep.NotificationWindow.dll
unpack001/Netflix Checker/bin32.lib
unpack001/Netflix Checker/libcef.lib
unpack001/Netflix Checker/xNet.dll
unpack001/Netflix Gen/Netflix Gen.exe
unpack001/Netflix Gen/api32.dll
unpack001/Netflix Gen/core.lib
unpack001/Netflix Gen/libcef.lib
unpack001/Netflix Proxy Checker/HtmlAgilityPack.dll
unpack001/Netflix Proxy Checker/Netflix Proxy Checker.exe
unpack001/Netflix Proxy Checker/api32.bin
unpack001/Netflix Proxy Checker/core.lib
unpack001/Netflix Proxy Checker/libcef.lib
unpack001/Netflix Proxy Checker/xNet.dll
unpack001/Netflix password changer + capture by RubiconT/ChilkatDotNet4.dll
unpack001/Netflix password changer + capture by RubiconT/HtmlAgilityPack.dll
unpack001/Netflix password changer + capture by RubiconT/Netflix by RubiconT.exe
unpack001/Netflix password changer + capture by RubiconT/Newtonsoft.Json.dll
unpack001/Netflix password changer + capture by RubiconT/core32.cfg
unpack001/Netflix password changer + capture by RubiconT/lib.lib
unpack001/Netflix password changer + capture by RubiconT/libcef.lib
unpack001/Netflix password changer + capture by RubiconT/xNet.dll
unpack001/STARS_NETFLIX_CHECKER/EasySecure.Core.dll
unpack001/STARS_NETFLIX_CHECKER/Leaf.xNet.dll
unpack001/STARS_NETFLIX_CHECKER/MetroSuite 2.0.dll
unpack001/STARS_NETFLIX_CHECKER/Protect32.dll
unpack001/STARS_NETFLIX_CHECKER/Protect64.dll
unpack001/STARS_NETFLIX_CHECKER/STARS_NETFLIX_CHECKER.exe
unpack001/STARS_NETFLIX_CHECKER/alocal.bin
unpack001/STARS_NETFLIX_CHECKER/core.cfg
unpack001/STARS_NETFLIX_CHECKER/libcef.lib

resource
unpack001/Netflix Checker v1 Removed Phone Number by Sh4lltear/Guna.UI.dll

Netflix-Checkers-Generators-and-Accounts-Tools-Pack.zip

SHA256 e2161676231539da3c2af5f0393ee1efb1efcfd7bc3053bc141cd53aefca20fe
MD5 dbbfd2d6dbe733ba1fcfb73274f9cd2f
SHA1 235cea61f6fcb17c2d343a30057b343cb9c786f6
SHA512 641ec37fcbe725da32b31f37dbb447c14bc49efcadbd34e2ec0bfe6fe1d8aca0cc53c447639081765ce0cca0e09b6406961be7ba9e459d2c82021c1872ce9df1
SSDEEP 393216:F9JOI4TpuqiiCIyA/teBdo2zImDIjbzBCI/aplE1gulk3fI8NI/uuIVmInXdzAIE:IuoPtaE1gNTMLAd9GqMFFuTOq8
TLSH
T19408AF10B394D032E25A11B17667D2728278BC311716A7CBB7943BAE1D327DAEE3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

10K NETFLIX ACCOUNTS - MAILACCESS.txt

SHA256 026e5ac477c63f10a2c2523f52cc048026c4873e57d485d97ee4c21fa4024f59
MD5 39c5438c930374d09d74127961668d85
SHA1 4f4e420953b1cb1adc87411a93951937e8bcf674
SHA512 708a127fe5615dd334ce5ae9fb066957acaa3000b7ed8645f71b01fa1b47065da809c7db4685cd119409787ed498731aff49fc32e4e096ff00d84de75ac24edc
SSDEEP 6144:f0WcwX5jy7f3bwHYav/uHA4BcXnD7Qhw/e38hFONgujiF7WKSOv:f0eArgT/q0D7+W3SOv
TLSH
T181643B36D71A4FDDF408498E65D6D601BB1A0AC2887EE1E5F7BE18CB3602DE871D4236
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Dark Star Netflix Checker By Scorpio/Bunifu_UI_v15232.dll

IMPHASH 55f7dfaa5fbadfb4911ad11b60c65135
SHA256 b695ac865a5df23e45ff991bf26b71e4f879c89a1a6fde0ba92f31904beaca5c
MD5 7d723a8eb4d7e494ea488c13510b97b6
SHA1 07f07c10e0661fa5f272a61ce69ed95c1cb251b8
SHA512 5ff49cc06df33b65c2bfbf37d89fa6ae2b71e26046bd7cf96a374ceb840ec7d3e11761f94b0f67b9ae38e4fcb1fe836c09a0b227e4a478f775a7511eda9d133c
SSDEEP 12288:q0MpAgk/SL8w92kboM7E2PheNUd6/8O+OeO+OeNhBBhhBB1xzyqtqKm9RZwWMN46:q0MpAgkdw/eC6/IxTtqB9RZw34HWOU
TLSH
T1CDE49D62F6D3D2B6E9DE00F5883C7E1E652DA9051B289AF7A3DC6F6E0D305D11A30247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

382933

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\svn\ILProtector\trunk\ILProtector\Output2010\Win32\Release\Protect32.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep QueueUserWorkItem DeleteCriticalSection LoadLibraryW GetProcAddress InterlockedCompareExchange InterlockedDecrement GetModuleFileNameW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection GetModuleHandleW InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW InterlockedIncrement EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind WideCharToMultiByte LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy VariantClear SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Dark Star Netflix Checker By Scorpio/Bunifu_UI_v15264.dll

IMPHASH 43c22e6f8eae03d27951cac470151b24
SHA256 b3710de17d2c2f84def83c8f3093df0dbe1664f34ab4a3adb72f1085e71c773c
MD5 08dfad3a22e42e17a3bf8f4ee43a67f5
SHA1 add9635ce5de6886b0010c83295df59d3c40a2b1
SHA512 820163bcac0c44dddf55d423c06895d419b71beb8a2099501c3e334689dac9d034f543c72733b3bc56505d662bf821df807ef84c7d16a46a0217aebc7192ab60
SSDEEP 12288:UF4dPwdZ2MWYgeWYg955/155/26Bm5h56GbU+rwo4o:Rwb6BK56GbVrwf
TLSH
T1F7F47E2BB69582A6D072D03D8A97825AF7F138444B659BDB1290436E2F37FF45E3D320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

401168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\svn\ILProtector\trunk\ILProtector\Output2010\x64\Release\Protect64.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep DeleteCriticalSection GetModuleHandleW LoadLibraryW GetProcAddress GetModuleFileNameW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection QueueUserWorkItem InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx WideCharToMultiByte LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage FlsGetValue FlsFree FlsAlloc GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy VariantClear SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Name

.text

Size

482KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Dark Star Netflix Checker By Scorpio/Netflix Checker By Scorpio.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 23ed26c2c6c4fa65ec649007dcaf46d90b8b5a8a3171ff871f5b330a22cf5d5e
MD5 1bedebc6525864260a59bc12298630b9
SHA1 8e891823bd78fe1a3d9e3d1315a8c4523956fb63
SHA512 4b2dbf04393bf6398ad9d98e626d492bcae7af2ea69d45c65dad87e140cf5ea3303b8b8efd53d9dcf382467fddaaf4f9514c9fac48fb0675fa227592f123ca70
SSDEEP 24576:NgwAwE8sVsqzvWsHQNq5YvmY1T3KJI9YL7zbwu:NgwAwXsVsqBQNq5YvmYx3KJI9YLDwu
TLSH
T11F152AC137788073D25513321D5BEA6741ADB82E076C3BCB6F86EB6F5A282F07A25147
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Dark Star Netflix Checker By Scorpio/api32.lib

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Dark Star Netflix Checker By Scorpio/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Dark Star Netflix Checker By Scorpio/nssdbm3.lib

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9b996eb290c94f1c3a7b00bd8e9b2ef33f1cfc3e16b00d427d9267e8d24ec567
MD5 25783918816d674edbaa87fd9a9990b4
SHA1 e62c64d036edff03764ece224df18b5da73bd12a
SHA512 dfb978cdb68cd253f4fb38d026a7339faed6403afcd986a27954acfcbfa7aa9201770ba13784e3e06d4ef4c10f82ccee0ce4f6ba4257edc653e993e716f5753c
SSDEEP 6144:QRS38PbDbl+/HKJbH+C0PjfDtZjfDtrtnLxCZhN2jq8NWclJPpv80dUwtn1Qsi9B:QQMPbP3gxCd2vNWcLUinusi9opw/
TLSH
T14B1586CB8BBE9D92C2CC17752D43B9074065F80F90AFBB4E4E4BE66A651D33974DA042
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

756062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Dark Star Netflix Checker By Scorpio/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
TLSH
T154B328286BF85D15E2AE87B9D4744610437BBA5A7A03D72F1D6034AF18B3B50CA10F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Easy Checker Netflix/Bunifu.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f72650f6d3a4a9b77bcdd74159282fcf724bd34afb989df6b6e075ea1dd6bc3
MD5 d9f830dffedbb2bc371fa60784c01221
SHA1 d6a778249e05ee04c2e5e386c31f88598338ab84
SHA512 e8e7c712638e0aace109e0587cc4421697e1c6cacb64ff5d56efbe570615d72e72b5dd3afadd468e59116b1ed1326b25c459d5f2110b9d643bfca750825efd61
SSDEEP 49152:9mTi+XhlhlFZ5vG+2PkuAc1B/xWCcieUuebO0Syigfihlh5:9azHb9LcFW5ifLq9yigKhlL
TLSH
T1A2C5F362E6BEB931C30FC5FE57032344C6D4AEB67A56D71AE14940E80052FB91FA81B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

66:e5:91:04:8f:ef:28:ab:ad:c3:32:d3:66:a4:3d:af:b4:df:5f:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Aug 27, 2019

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Mar 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

2658906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Willy\source\repos\bunifu\backup_branch\Obfuscation\1.5.4 _secured\Bunifu.Core.pdb

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuButton.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 34077030d0414c4bfa63cbdf9af3e6dd4258c3b949335d9290bc93db0b9d24cc
MD5 c3356290e7e68bac31309c9d80ba34b1
SHA1 75a23f1d262da114728447b14f4ce216dd58d706
SHA512 ccc9c9adc8326275f68bbde62ae133b0ab538b0934cd6bb8579e343173323dfb2d46e83f4c6024e0eb3d931dc0707ec84c8ae0147b6b218f34b7c88e0c07c736
SSDEEP 3072:wD8b3CjH6CGSinYSGOk7m4kP2tFkxgjsLb:s8b3AaCGSiYSGOfPYFkjv
TLSH
T165C3F73EA5DAFF31C34676712C40EB80623CAE577EB5D31EA4A94184D6C2E990C4D2B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

65:1b:8b:cf:1f:4a:ac:2e:12:a5:d2:44:14:32:f5:21:7e:7f:f1:a6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Aug 27, 2019

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Mar 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

117610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Willy\source\repos\bunifu\backup_branch\Obfuscation\1.5.4 _secured\Bunifu.UI.WinForms.BunifuButton.pdb

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuPages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4cabfe559ab8ce3a7ed7fc38d70333adb26a3096845b81d92b38df374aeb9929
MD5 493dc0ceb2a3cbe5a3e68e745339a181
SHA1 016a1487ebf534f53187e63fa60227732415ed0c
SHA512 f0e6c6d68455aa12160a922fbefebcb7665170b6d6692ba2b6f69cbbfeca7e897ecc3dd9076803ca58134a8d968fbc907486ccc32b7fff088378a7c6291d5c2a
SSDEEP 1536:CIr8l4M5dNC+n6xNrPGXXJIoDEoNji7IiOka5cHk5m/NDKnC2VI:joiIN9KrOKgNNjoIzcHk5Y4K
TLSH
T181B36D3E73AEBE70DF067A3A617160005E34AD9C7D7DD3AAC78488985846BD60C163B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

8c:ab:61:a6:3c:9f:84:69:70:6b:cd:27:b9:2c:f2:79:f2:16:ea:ba

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Aug 27, 2019

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Mar 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

112066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Willy\source\repos\bunifu\backup_branch\Obfuscation\1.5.4 _secured\Bunifu.UI.WinForms.BunifuPages.pdb

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuRadioButton.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7f98567b2dcfae2a87cc4518cb161a21d63a86c83984fffa7ff8060607ab6580
MD5 bd372f827daf1239c6ae91dbfc836f9d
SHA1 8cfb4d4789f8b7c924426f38023e1cba9c281d18
SHA512 1588c649ad6f06de18dcda65e282a130a5fb54f473cc9ee3829aafd41564d28414406e43ec0eb9458504ea8cdd9008313b78be0a812b852a69d88efe5fb5d466
SSDEEP 768:3G7kcuu6vBYdzrO8biWhKXPMNdoO3PKgA:3216ZArOlW80LD/i
TLSH
T19FE21659B7C2AF23CB660B3529B091014F3DFF56E961C75FAA9C11484BE27C204D87EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

c2:4a:c7:e3:df:4e:f7:d0:c5:87:d6:79:19:bf:c0:58:b4:1d:18:f7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Aug 27, 2019

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Mar 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

28946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Willy\source\repos\bunifu\backup_branch\Obfuscation\1.5.4 _secured\Bunifu.UI.WinForms.BunifuRadioButton.pdb

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuToolTip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 511790fed2ca5b914c89c224551ca692e1b9b5d2e41d6683efa1a5afda473a69
MD5 439c6cb33261d1ba1745ca3cfcfa2867
SHA1 0c6e2524dc9df96c7ccc04bebeebfe9f257c8a24
SHA512 3105820d9955a23215d71e472a5d81c1c4fe02b41af301c0478b253373b1cd5849b33f2fe33e1fa905d82bf837c062ed3502e5fcc6dfa81d9a4f2cbc334804b0
SSDEEP 12288:/Jt1RFR6/kikunQZ/gpbwasgHCThdEk+nfMtdTI:h5Z/gYbwMtdTI
TLSH
T197F46F0152ADBD70E3BA0731A801D1008AB7EEB178A9DB7FF68741D93152F9A43D4D6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

3d:7f:14:20:c8:91:ab:44:90:42:55:86:05:f2:11:e8:7f:c9:e4:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Aug 27, 2019

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Mar 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

742522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Willy\source\repos\bunifu\backup_branch\Obfuscation\1.5.4 _secured\Bunifu.UI.WinForms.BunifuToolTip.pdb

Easy Checker Netflix/Bunifu_UI_v1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1108c011910dde1a0cb6528a515ec91611113b83d0202bb305ec172e26f02d57
MD5 d203ce2a89db4c8e91be65a586699b6f
SHA1 6a6f2f4481b9ff145c9b39d1f111ff137d823ec7
SHA512 3d3aa3defd80765d5973f4afca9110eafbdff0744146d8a7120fdf59c55b26d4e4bc17b4ef719bcc2c24263ca7b776b5a04b272d8ff09032fe9890d351bdca2c
SSDEEP 6144:ajgVgVaGslPVCkyM9oNXebSTgzcH/Wi+RllW84y6EDp:K65X9opebfcHoGu6W
TLSH
T17984B52152AEB9F6C3DB4737964C11209A689DE076EEF37FC44B11D81053FAAD84225F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned PE

Checks for missing Authenticode signature.

Digest

02:ec:33:5b:71:29:f6:d0:31:1b:d3:4b:4d:90:a0:73:a1:e8:f6:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Aug 27, 2019

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=CPR2014141232,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Kajiado County,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

0a:e9:5f:ae:cd:be:04:c8:8a:3a:d1:15:e6:f7:dd:a2

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Mar 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

396326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\coding\UI\bunifu-framework-winforms-repo\Obfuscation\1.5.4 - secured\Bunifu_UI_v1.5.3.pdb

Easy Checker Netflix/Easy Checker - Netflix.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 bf40add3169b6ee824cca12702c7ed93bf37d4c3309412af417d8e12a7adaade
MD5 fea0b8af8cf1a5c57a88701dd3e6f1c6
SHA1 b107009dbeddb3b796a7e0ce80886043c35ac292
SHA512 032d5ad4df9c6123eab447380899e2468ae716373e27b7e7c956dbbafbc13427d6c4417686a4ebfdb3a7def16b250214ccaacf6e37a8d5391354c77e35477006
SSDEEP 24576:1pwAwR4sVsOzvWsjQtq5Yvm41T3KJI9YL7zbwR:1pwAw6sVsONQtq5Yvm4x3KJI9YLDwR
TLSH
T119F45C1077808037E26211320D9BE2B795ADB8390B993BC77F88177E9B695F17B3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Easy Checker Netflix/Leaf.xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 939c8980bcb9bd9a2279714f6086714229e7af194ec4e32677c5a4ed96db5edd
MD5 42cf916df4ea1d300201ec9559b7bef3
SHA1 f58abe0ad5f3e033a9dbebcebd02692c5d35936d
SHA512 2d03d21b369b9784329573e8219553f4c6b3cae66515ebe7409154c7457e3cfb95f8dfac5bae57820ade2a5219dd7d10ce34d72ec8971b2fbb7024a5a23cc1ed
SSDEEP 3072:68eadOu2iOCIckQucNPlkZnVVkeLm/RV1oal:68BEu3OCIINWZnVV
TLSH
T122C3293577F84A1AE7EF8778E870521047BAFA496902DB6E5C0460DF1892B908D12FF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

123430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net452\Leaf.xNet.pdb

Easy Checker Netflix/Protect32.dll

IMPHASH 8420c9e80d53d716c9d682dfad563ea8
SHA256 73b04c3db43dbdf62da5a740a3945fb5cc7ce89deca440c05cecff2c201f2ba1
MD5 97b6f7b91e343dae3b3d822df2b8e39a
SHA1 a77b4ea621aa7896a48c7e558f25b54c0956bad2
SHA512 1798e968b16206185e990d2afbaea9b410f4a9c40a4cd3e279665f3900b0680d7fcb0dda71fe5bb3b2cc0a0949c0bd62af4efb16753b59aa93761924a8cf054b
SSDEEP 12288:EbpDOABtX8l5Ht7v7im3fgKimJk+OeO+OeNhBBhhBBy/kJdO/kdhFP1RpZEmvnRO:EbpDOAB+HdUQ8/kcklPdZEknRv
TLSH
T1A0F49E62F2D7D2BEEDCE01F2983C6A1E652D9945173847E7A3EC2B2D5D301C12A38356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

436949

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep QueueUserWorkItem DeleteCriticalSection IsBadReadPtr GetProcAddress LoadLibraryW InterlockedCompareExchange InterlockedDecrement GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection GetModuleHandleW InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW InterlockedIncrement EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo IsProcessorFeaturePresent HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate HeapDestroy TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Easy Checker Netflix/Protect64.dll

IMPHASH c7bb123507ad86be53b59f78d6765e94
SHA256 0b014f89b2e8b090b7a61e16214bdb1920a1e6ba9333d73082599b871a50e703
MD5 f0485cecae220a2d9b58d1122a7c152d
SHA1 8f8344425f1a7369a3dc1e79ef733d95d82ae051
SHA512 73404cd149771f853c2fe9f2401fcbef36585aad1ed205830dcdb33467ae47e8b5b7e4683b49cda85c35f959dc5d71bd53fcf8f0a77feb67e221bae67c82e2e1
SSDEEP 12288:pkgueeMVxzUP9WYgeWYg955/155/6byem5rMAiVpfdc5so4o:pt3emz8b1m5rEjdcCf
TLSH
T121055C2ABA6981A6D072D03D89E78656FBF274440B758BDB1190036E2F37BF45E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

453728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep DeleteCriticalSection GetModuleHandleW LoadLibraryW GetProcAddress GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection QueueUserWorkItem InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId FlsSetValue GetCommandLineA RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate HeapDestroy FlsGetValue FlsFree FlsAlloc GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Easy Checker Netflix/Qt5Core.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8a7cb03b923461f27e716a97a182a5408d75dcfe71f9195614a7d2f77eecde43
MD5 3886f0d873897d5dabada004512da448
SHA1 b2c93357dc84bf2dc47c5a0034ff8730b2e11ff3
SHA512 0ba1617ea889f8e089e9bd76540968462cbd48a51c43f4f20588b266a90703bffbf347f9441056b47293d59c0ebc3f55ed6ca85bc84dc8cf64abd0f0c4d06a5e
SSDEEP 6144:FzAWUgV/I8ZdiyP9XoQy9T73KopOe2prEdaCZ0Tp:tTrVpZEsX2/K4OZY8
TLSH
T1284416D503CFA466DB8D14B81E83B503813EFE4F968DBF966C08A31C961E93536DE606
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

232046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Easy Checker Netflix/lib32.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Easy Checker Netflix/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

NETFLIX Checker V2 By MrPrinceX/NETFLIX Checker V2 By MrPrinceX.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 81992938e9e320397642d5729b74e6319449e4abf74688d49a23d70dfae02281
MD5 30ba7e3d62cda1d00211c9e3b0e8302b
SHA1 5de73fadd29bc75bf2452cbfe23c8d2c658ab53d
SHA512 6d1c7dfa037b2b989f28a6b30a75f905479da2fc82b6417a5529b210fd715d852dfd8d8f15647316a4f33eb1d0b7b8d9a6fbef2f5ac9d446d74c02f710fd2c20
SSDEEP 12288:VNwAwIv2h+7sVsSzvWsPQStOzzq5YvmwUlyRT35cJI9YGTk7xN2uavoNYSHwhEeS:VNwAwJksVsSzvWsPQNq5Yvmw1T3KJI9l
TLSH
T196F48D107580C037E66211331AADE3B896ADB9304B991ACB73D81BBFAF756C15F3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

NETFLIX Checker V2 By MrPrinceX/core32.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fbe7054b01efccbd9058f7f97d67f713ba353c676819218ac07fba9edae51b00
MD5 7af61be5d6662464a9e6029a3cad4769
SHA1 0d41529a4b100b7c4e0661c99e3338ec8ede0ce8
SHA512 359ce3b10f75ba7ed582752271f25c81fa2016b50cd105fc8bc8e992ad0993dde4ca365505a04a11cf5418a861db92773829671434be9eb489a543609fa3ae97
SSDEEP 49152:qKqVvJxXBPYgGW8qJDArG8d4Sm+t2MSldyeHVD7mnw6l3LJQAZnV:qXJxXBhdArHd4RdNh7WllQABV
TLSH
T1D4B5235C93A7AFA4E7AB077DC1506503CB58609DC291E36B34D509E9F402AE1EB83BC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
SmartAssembly .NET packer

Detects SmartAssembly .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2364650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

NETFLIX Checker V2 By MrPrinceX/data.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NETFLIX Checker V2 By MrPrinceX/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

NetFlix Accounts Checker [v1.1]/Leaf.Net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 77ebb46eb03ace07790b535020dbd1170c5c5eefc249f55fe27c9f19561beb8b
MD5 c98de72cd4374c4210eb5c0102e1c2af
SHA1 671649bc3df7789f3b98282ed50fbf967be9e719
SHA512 d9dbb94b7f1756cbcbb4fa8e321905a1105c40ae8e996e0f49d426d303eacbf5b65031031589198b7084cf53adc25b9b87d289db0f3e147da031c6a147b58df0
SSDEEP 3072:wy9SMUEaXYnX9pPMaetDkFyLDGaEiOtK0OrFoc1u7CqmC:wy9SMU0rkaqfDXGl
TLSH
T119D33A6977FC0A1AE3EF5B78F8B00250C3BAF945250AEB6E5C1860EF14567D08952B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

142994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Git\CSharp\Libs\Leaf.Net\obj\Release\Leaf.Net.pdb

NetFlix Accounts Checker [v1.1]/Leaf.xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70670c404f998b71fe5abfb3aa58fcb5302d3940e805ac8927f79b625afab4a8
MD5 aabe4f7e8f947171ab334b5cc0a76f7c
SHA1 83b96de7936466b027e5ba974a563c278478dea7
SHA512 e81c923c4eea8c00ac07d5a17af6377629d25bb837566f8cb74adfc545d033570a4a9dea8004799880ef05a8ba44de9a2dbdbf7c153050442432abec51d213e2
SSDEEP 1536:m8ecfUylM/rsvere3RXUmixwjKMD92NuYD9ikvyLm/RVTeyzi3v4rl:m8ecXM/a9EXBNuYxikqLm/RVTPHl
TLSH
T166C3283577F84A1AE3FF8B78E4719110427ABE492502DF6E5D4860DF28A3B908911BF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

123750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net452\Leaf.xNet.pdb

NetFlix Accounts Checker [v1.1]/MetroFramework.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845
MD5 c853e9e8c720249198ff376f42328ef9
SHA1 a56ee195148023571e26ffeaa5a736bc73a76c40
SHA512 d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739
SSDEEP 384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9
TLSH
T17E723006B2F4423AE7AFCD356AA9056F3174791DA9F2CA1C0CC90AE9D9F67404A11F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\VB\winforms-modernui-master\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb

NetFlix Accounts Checker [v1.1]/MetroFramework.Fonts.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb
MD5 b8c8a532438c4b421081efb258355469
SHA1 41aa88d5eaf398da55f712f30226b70492125be1
SHA512 511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc
SSDEEP 12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
TLSH
T134E429B5760139E6EF11C4B7C260FD80192B7863A77B802A68E3077A88575CDFE53E46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

677454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\VB\winforms-modernui-master\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb

NetFlix Accounts Checker [v1.1]/MetroFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb
MD5 b20f1b5e3d4e3df2d826e9870637cd06
SHA1 a03bb47afdf9498be409ed5b56e945f6e143fb32
SHA512 095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d
SSDEEP 6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O
TLSH
T1C6646D205788852AF1EF433BE46A048587F3EB02F97AE79D99CE90AC1F537419D11B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

326366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NetFlix Accounts Checker [v1.1]/NetFlix Accounts Checker [v1.1].exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 2ccf11cce136666e24e64f0214ff5c7034f8c499fe79e58e10cb613295caa79e
MD5 60fc78d06322d67df9a9be32e4efd735
SHA1 cd09506a7b919a609793fee632e5408dd2cc5688
SHA512 70cda4b8f4847abff72a7de65de50b508f508ba446c8e7d3b69ca7d1994741f748777c8f44a2e3203e8ea85bdf1697d983bcda4b5e32029991835efcc7b94c5f
SSDEEP 24576:w8wAwF4sVs32vWscQtq5Yvmo1T3KJI9YL7zbsLWj4:w8wAwOsVs35Qtq5Yvmox3KJI9YLDsU4
TLSH
T102058D107580C037E66211331AADE3B896ADB9304B991ACB73D81BBFAF756C15F3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

NetFlix Accounts Checker [v1.1]/NetFlix Accounts Checker [v10]32.dll

IMPHASH 8420c9e80d53d716c9d682dfad563ea8
SHA256 c4bff67c99ffd034ad0af11fcce2befe93e60313d1d306d565af9cfba0129a6c
MD5 6caae90a0558d3079becd37a0c10dc83
SHA1 3d6a51b1f4851f1f77696c9f946a37a07138ed0a
SHA512 67780dbd0a0080bd5756f12101735e8a2ad0f85af0a93d539c313968b2e4fbd592d569eec385c99f434c6082359d88920da4ae096e9b00f0a3e6e2fd3c3a5781
SSDEEP 12288:JJ70bEMo5XfgrGc6D/3TcpvMQupPd2viuu+OeO+OeNhBBhhBBNE2ch528gkJSKkx:J9ovo5oh6zTzobBE2cb5DSb7kZQzIaL
TLSH
T1F7F49E61F6D7D27EE9CE01F2453C6E2E641D9A85173C9BE3A7E87A2D1D301C12A38247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

437589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep QueueUserWorkItem DeleteCriticalSection IsBadReadPtr GetProcAddress LoadLibraryW InterlockedCompareExchange InterlockedDecrement GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection GetModuleHandleW InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW InterlockedIncrement EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo IsProcessorFeaturePresent HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate HeapDestroy TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

NetFlix Accounts Checker [v1.1]/NetFlix Accounts Checker [v10]64.dll

IMPHASH c7bb123507ad86be53b59f78d6765e94
SHA256 456a7c143c2203d63ad7af0443751344d9f8440f00da20b0388ce882943e56a1
MD5 4587741823c81e90cb59891145b0ca78
SHA1 8b710dc5ef1c1f8a1406c2b2490b4654a936fdcc
SHA512 a41c3266fad8585c7064c3afe76bfd5b0b7f65a4a28562af6c5b71b55ec89d747b8f8a35c585476eef2d81a80157b1b25bc7c633ffe0f83e993ec035b8e2bad2
SSDEEP 12288:QGpgv5t/VqUu0Nj7pWYgeWYg955/155//ryYzA5kSilNjLIUglo4o:Kv5tzuUkrdzA5kvlNjLIvf
TLSH
T104055C2A7A6981A6C076D03D8AA78656FBF274440B358BDB1191437E2F33BF45E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

453456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep DeleteCriticalSection GetModuleHandleW LoadLibraryW GetProcAddress GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection QueueUserWorkItem InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId FlsSetValue GetCommandLineA RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate HeapDestroy FlsGetValue FlsFree FlsAlloc GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

NetFlix Accounts Checker [v1.1]/Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
MD5 6815034209687816d8cf401877ec8133
SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
TLSH
T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Digest

8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Chains

Nov 9, 2019

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Serial Number

0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2018 - Oct 29, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

696798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

NetFlix Accounts Checker [v1.1]/SkinSoft.VisualStyler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f3e7ea22d052fee0e5be8cd904ac4425f3840df7452c760d5cc5357830c394e
MD5 60ac512e63a6b95eb37cfd530a01b94e
SHA1 4b5a1fa50008439ac074d732447ab9032a157114
SHA512 a6cbf2f1f6eedcb142aeca7218334dd16058b9f643e51cee4771e1a0f7124676361deac0c48d61468296e88035e4dd49b55fd139b80ece54c86c0338bdedd681
SSDEEP 12288:WsbIKGyxiGBHjhRjZSalYv4/EamVtHgaiyv:W2BxieHjhRjZjuRBbHbn
TLSH
T10535498577A5AC2BC15ECBFBC05741A497F19126DFABE79B5A4437AD2C833808D022D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1088174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NetFlix Accounts Checker [v1.1]/build.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9ce581f1a02297063c13bc72d50f519b47456fc3ef71e114ae20f08c739d635a
MD5 cda7501d38cedcd5b21ca3338635f895
SHA1 83b1549b974fd2219bdc9ceef2139f5a1099052b
SHA512 f434ac0df5ad171497364d3c795f7e21e6395f1b7cd531f9686be9ddc8f80aee52cfdadd7e2be033509bcf7dc5f5854c48296ab3e62348001f4ee52bdfaa5a5b
SSDEEP 6144:8srF4y/mOq2XYHyLiRiCmC+ONod1bwzfzAGcv3BBHiXB9qLjyS7v0TmCG:8m6kHiqL50TPG
TLSH
T137548DB9A3E51D21C6BE4278767316530EB1FC1F5509FB0AED4C216ABA3A63179C3312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

235950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NetFlix Accounts Checker [v1.1]/database32.cfg

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

NetFlix Accounts Checker [v1.1]/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

NetFlix Accounts Checker [v1.1]/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
TLSH
T154B328286BF85D15E2AE87B9D4744610437BBA5A7A03D72F1D6034AF18B3B50CA10F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Netflix Account Checker Coded By U0k/Bunifu.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3112ae92cbd6286590c3e0c985966ce02b259d0cb777fe3ed140f4024f519019
MD5 78f361e738e416a206f1956f3d51d38c
SHA1 720042330dfa01fa7e4c2f8d444f1e901da6d52c
SHA512 b6bc3a50dca02874003ecd9001d3c9b08037b8e4242bd732f4e9d6aab9a11fdb6ee894f11aa77fa2fb4808cabed488c058e96c384ad62e056d7dbead2e928948
SSDEEP 49152:EfCxBQIfE+lCEhcnlnhZj5/UOCtluBsOK0c96yA:EfCLCEhcnJh95/xCu7doTA
TLSH
T1CAC55842D6AFBB32C30FC8225F22E343F65CAE977956F71BF54A40E810A2E99044755B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

c2:2e:7e:af:6f:4c:03:bc:bf:0d:75:a2:da:34:65:85:a3:0f:7c:55

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Sep 4, 2018

SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=P051534213R,CN=Bunifu Technologies\, LTD,O=Bunifu Technologies\, LTD,L=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

08:f8:b2:43:88:63:93:78:21:d1:77:24:80:3c:cf:30

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 7, 2017 - Nov 12, 2018

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

2658034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\bunifu\Desktop\Bunifu Framework\Projects\Master\bunifu-framework-winforms-repo\Obfuscation\1.5.4 - secured\Bunifu.Core.pdb

Netflix Account Checker Coded By U0k/Bunifu_UI_v1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
TLSH
T19D345B1137A88D6BC67E4BFEA4A40240D7B2F956B1DADBCF9D9510FD24C33664B02263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

247342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netflix Account Checker Coded By U0k/Netflix Account Checker Coded By U0k.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 60553881903a3f2367aa05ea97e2252bcfdafa0260b0ff8ece32e01b2bc9ab70
MD5 8291bcf768f1d697aedb21bc23096312
SHA1 cc222303a79667e389f5991c6a8aad1b58c520e8
SHA512 6a506b5ab307203187830c81b2f1a274472bcfb5aa18e10b8934f7952a87fedeef7f91ebafc3713c2eaf506f73995cf3092986b2c6a7f3eb3957a09b91091f88
SSDEEP 24576:CcwAw8wsVsGzvWs7Qtq5YvmQ1T3KJI9YL7zbiZ:CcwAwDsVsGlQtq5YvmQx3KJI9YLDiZ
TLSH
T14B056B107580C037E66211321AA9E3B896ADBD304B991ACB73D81FBFBB756C15F3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Account Checker Coded By U0k/database32.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Account Checker Coded By U0k/lib.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d1226b74d5b51c8662ddd8743a2d802a3d942cfcee7f79937fdae465fe520c4f
MD5 8de8abb2899bfb63d2a9922bd70c9793
SHA1 20aaffa50450923ff9f0e2201577a024e56cd8b2
SHA512 1ca899493c152d2b36fc7243e3b7d75858993da662256e035f657d55af9a7e9242ee2291f5e5b3783732e4b92b84f9032b327c321bc86ee48dd7216a22857834
SSDEEP 768:tFPNdjrlVKrwiKvbG2GHUoTfIGVdlvEXVa3wyjrlVKrwiKvf/pIEt:33vKwTIUoTQGV8XVa3FvKwn/pIEt
TLSH
T1ACF3501932E74B2FC83687755467D2B44AB7EE0A0512CBDA3DC0BD9F7BB27214214693
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

109662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Account Checker Coded By U0k/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Account Checker Coded By U0k/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ac175b4d44245ee8e7aee9cc36df86925ef903d8516f20a2c51d84e35f23da4
MD5 3df8d87a482efad957d83819adb3020f
SHA1 f5b710581355ac5d0de7a36446b93533232144db
SHA512 da28c34a85a6530b1c558fa11b0e71e70710d719cd8ceaf81f954d1fe3927ec139bee6c5f3135425cc5220905240f1a31d831611c46d18f5d52600b607ea59a6
SSDEEP 3072:NWl4rhAigbJ0c1qnV+xnEd44asVyrVfwN5lTCTh3n3F:NWvigbdqnV+xnEd4zsVyJb
TLSH
T10CC319286BF95C26E6FED7B9D8701100437A799A7A03E32F496425AF24B3750CD04F6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

125278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Илья\Documents\Visual Studio 2013\Projects\BTC\UPD\LITB MITB — копия — копия — копия\WindowsFormsApplication13\bin\Debug\Работа с прокси\xNet-master\obj\Debug\xNet.pdb

Netflix Account Checker by Bornwood/CefSharp.bin

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Account Checker by Bornwood/Netflix Account Checker by Bornwood.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 4146f62ce9c5ddcfefb09a7e6b797414a730101fc8bfe257606e33e8b940c52f
MD5 82215c0f24d0fc7c9eb6e5c08ee89fa8
SHA1 b5514704e3a267cc2bbea9d1035627faee4aa91a
SHA512 b3bad53fc68ecc308f24629affda72a4a9f129b066841bbf6341fe7e6c1b99504aa1f46eb9d9e2abf80917cae956ca6438818e6ffa57a166e298b8dae00ea715
SSDEEP 12288:L0wAwMu+52XsVsGzvWs7QStWzzq5YvmQUlyRT35cJI9YGTk7xN2uavoZYLIeOR6:L0wAw8wsVsGzvWs7Qtq5YvmQ1T3KJI9g
TLSH
T116F47D107580C037E66211331AACE3B896ADB9304B991ACB73D81BBFAF756C15F3564B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Account Checker by Bornwood/api32.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a336245aea6a9f12f881f774d5b1cf5700d5af04972d3888663ee75a3eb3b115
MD5 9bb77fa8b3714456f346c9161c886bff
SHA1 0d90d34efe08757beed676bc2333e49661626ce8
SHA512 545c30c218d7a00427aa0bb31a4dbd2f4f9500a6c81fca1f6f6422d24201afcdf9d06c106efdbf47f854853cf2c10e6568360bf9e3687c936fda8dfc8b9de5a7
SSDEEP 192:qgZlZFXPnl0rCPZlxkU9n0X1DnbvxCxAN8jKI0ul:qgTZJfl0uPZH9n0X1Db5CxAN8jKzu
TLSH
T1294294067FD98D62D6B72BB058A1D2701B38EE679029CB5E18F4EC0BBD5A6041D13FE1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Blackwood\source\repos\Netflix\Netflix\obj\Debug\Netflix.pdb

Netflix Account Checker by Bornwood/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Account Checker by Bornwood/xNet-Ameliorated.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 16ea0eab1ffe6b3b05abf1b04baa7c2695885795c5bfecb6cfcfa595a0fa7b30
MD5 44d7396d8b6fbd8f1e9ff4d0278bb767
SHA1 7c8dc050381d2e19b989943f961fee45bd225b69
SHA512 320573c76b448b6f625917d26cec738c94431d274e340a9a0ac5401535a75faa9ebb65616fd23a069de39e4634baf79a67527eccf7bbd197e8f3cb823ec4d93c
SSDEEP 1536:CpGjP8+k8PDYivFAS537WYRwFH1+KZ3etqp:CpwJgYAScYRwFH1+KZ3etqp
TLSH
T1967318142BF84316E1BEBBB5A4B0021003757549B63AEB1E5D90A4EF2DB37918D21FB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\SEEZORR\Desktop\xNet-Ameliorated-master\xNet-Ameliorated\xNet-Ameliorated\obj\Debug\xNet-Ameliorated.pdb

Netflix Account Checker v1.0.0.3/Netflix Account Checker v1.0.0.3.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 83c582db7e188ef280f74af91a11e75cf5bd90684bdd042ea53a8e93e3a05be9
MD5 c1d2cf064081b988023aa21875dbbb99
SHA1 f304b43288f11a0b68abb7dbf4db7b80dbeaf77d
SHA512 88d65ccf451a28f20f962309ae9e03749b02f2878e295871e5c33f864d18fbd16dc8654de5bed40edbfbe9f78022ac4b7d7b149e607f2a48c372a1db815c07c3
SSDEEP 12288:3twAwQnHJGzsVskTvWsyx5tzFxfg4vXBlPuFT358JpAYpHEbuM2uaPoUieO06:3twAwMcsVskTvWsyxrfg4vXBwT3qJpAk
TLSH
T123F46C117580C077E17211331AADE3B896ADB9304B951ACB73D81ABFAF796C25F3124B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Account Checker v1.0.0.3/core.lib

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3755fb7bb97cb118837aea6cb21822d667754a47b52f1acd840c62fc09ff1023
MD5 057bafeb8390ca75866e2a3965ec04a0
SHA1 e98c3ea3f8def1b8a05a4beed56be5a4e015ab7e
SHA512 4c95ac299ff685d23dbbaa7bcc562cede3698d853b94ca9217aa19e39e037b18cb53fe1fa784b72b05f87f2b6be08103eef8e469096ec5239e2afe180ff47a61
SSDEEP 768:5SnF9r9u9W9f9N59LZt8skWEixUBjXPhmvCYQPdRYNW:5mF9r9u9W9f9f9LZt2iujfhmvCYQFRY8
TLSH
T1BE235F2722DE7EA2E5BD1B74373347C0C7B9ED018603D61E6ED82159997E203BA817D0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

40878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\MyPC\Documents\Visual Studio 2013\Projects\netflixChecker\netflixChecker\netflixChecker\obj\Debug\NetflixChecker.pdb

Netflix Account Checker v1.0.0.3/data.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Account Checker v1.0.0.3/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Accounts Checker v1.0 By X-LINE/MetroSuite 2.0.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8604bf2a1fe2e94dc1ea1fbd0cf54e77303493b93994df48479dc683580aa654
MD5 0d30a398cec0ff006b6ea2b52d11e744
SHA1 4ceebd9c6180a321c4d4f3cfb5cfc3952bf72b45
SHA512 8e06ff131a81e73b1ff5de78262701a11ecc2bcdaf41011f4e96f11c5372742478e70b6a0901b61953c21c95725532af8d785654405ec5066ad157e2143467cc
SSDEEP 3072:K6J2UBugOAI+yjNDWswy1MNo1EvnvkgvloSVQBjDifX0pPSRZ9KZdf8uvqtXfZBF:K6Jr8xhFzfOaa3xqQnQGTO
TLSH
T12D64A30512C8AE56E57D33F8062225A073B8AD129547E7193AFD30E91F73767ED0A38E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

305726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Martin\Documents\Visual Studio 2013\Projects\MetroSuite 2.0\MetroSuite 2.0\obj\Debug\MetroSuite 2.0.pdb

Netflix Accounts Checker v1.0 By X-LINE/Netflix Accounts Checker v10 By X-LINE32.dll

IMPHASH 8420c9e80d53d716c9d682dfad563ea8
SHA256 d3b44e0dceb22fab65f0acfa09ff136916fcd45da51dacc338a969e85a5bdad7
MD5 54fb01cc27de40b955fd59aad9afb0d2
SHA1 3030e1efa305d14ce2c9e1a703d76080f0540bd7
SHA512 08060e49152aee55b6ccbf18a28bc68293382c1260584bdd008139fc41029ad69d429b0b98da4bb4cb6e39876a5753ceff79ea946527c681e40230d5effac59a
SSDEEP 12288:E3bGcWqRNVM9v4x6k/Q889tNL4i/Wt+OeO+OeNhBBhhBBSDhr+SIvYDdvbiZ9PGT:ELGcWqQ4xFCqLDhwYpGZ9uxVI
TLSH
T19FF48D62B2D7D2BEEDCE01F2583C6A1E652D9D85173847E7A3EC2A2D1D301C12A38757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

436597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep QueueUserWorkItem DeleteCriticalSection IsBadReadPtr GetProcAddress LoadLibraryW InterlockedCompareExchange InterlockedDecrement GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection GetModuleHandleW InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW InterlockedIncrement EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo IsProcessorFeaturePresent HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate HeapDestroy TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Netflix Accounts Checker v1.0 By X-LINE/Netflix Accounts Checker v10 By X-LINE64.dll

IMPHASH c7bb123507ad86be53b59f78d6765e94
SHA256 835305f52dd417990cd13f8d1b71c77bc2f93cf5cbc1647f1a4f7ac3ecd24674
MD5 adf108af551793f9883e5ff77070b826
SHA1 fc96a9d8f5a46750d6dc577e69ae770e7f345719
SHA512 a9361e527fe58575a2429ac6fcc553940e889aa37d598933c50e09e0f23cbbaec2c41bb6c6d25f0736ffd88559ca3157e35352ce4cbdd64452b05f0fea33cc53
SSDEEP 12288:Y52yxPRRhnLVFh7GMHWYgeWYg955/155/dPtyn5G8UDI28Qo4o:S2yxPRRhLhgPYn5WDI5Qf
TLSH
T1DB054B2A76A981A6C0B2D0398AE78656FBF274441B75CBDB1190437E2F73BE45E3D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

452384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep DeleteCriticalSection GetModuleHandleW LoadLibraryW GetProcAddress GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection QueueUserWorkItem InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId FlsSetValue GetCommandLineA RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate HeapDestroy FlsGetValue FlsFree FlsAlloc GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Name

.text

Size

541KB

Virtual Size

541KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

167KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Accounts Checker v1.0 By X-LINE/Netflix Accounts Checker v1.0 By X-LINE.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 e4614ccbaa224d8f7bc1fcc22a00463608d96fb3a7be9d36a341c2093561956f
MD5 f91794272dbb335e82c5e09c5d3db552
SHA1 ae7cebb370a62ea9e564c34a5893b660bd3c1445
SHA512 fa31f8570b99b3cce19499ff01d891a944a3107307fdde6a85e09b17bde3c0d48a3b65cb5acc4238a506134c580ce4840667e9d4f91fec82a1d8cf8c47ce1c6e
SSDEEP 24576:lNwAwJksVsSzvWsPQNq5Yvmw1T3KJI9YL7zbWIIG:lNwAwOsVsSJQNq5Yvmwx3KJI9YLDrIG
TLSH
T1DE155B207580C076E3F2213216A4A6B593ADBD700B9708CF639D3A7ADB79DC51F3635A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Accounts Checker v1.0 By X-LINE/Qt5Core.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fa0fa3b2e66625d7606d2bed18bfd6d9985245710af472196ead0d23362e7a3a
MD5 f52b81e2604e1bba71f9a94d85ce9d85
SHA1 84c872677076b55888c6f3c578914dbc745a0760
SHA512 6b4a593d4cf18d9744207a5d71b1c55b3efafb12e299141e4046a9a4615f0560f38893561dba01add17c88a1f51a073856314c3e8afcd3a2d4479a48f4684fde
SSDEEP 49152:vW9yksP2h0m2FZp7lzCghob+hxGms1tznWBqcMtzy2CDO0Q0Vt1twmk/AIasI:O9k2alp7lmr+he1QBpmuB5QukXasI
TLSH
T1FCF5E1B176C2C184C3FAA87111D2666143BDFDF91C538C1E502E3A25DABED8D1F1A3A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3254046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Accounts Checker v1.0 By X-LINE/Results/14 August (09;39)/Invalid.txt

SHA256 eae70a4b7ceaf6e65cb43854ee0900850665186ad9ccfd91cbf69d792500f125
MD5 e3f74ac2f8be0d594b38ac6644ac3132
SHA1 d1c92523e04e27e572b5cb1bb3283fe6b975ec8c
SHA512 2f52fd875ee9b91400e3c92aecb91047ba018704786a0755909301a68ccb1927ac0e6b727407652b724ddb52c792e26f985385efc1b8c7cc435afdf56d5079d2
TLSH
T16BC0125000A4054043098960F810C16631447C66A9C992A04139500018B1FA038ECBF3
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Accounts Checker v1.0 By X-LINE/core.cfg

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Accounts Checker v1.0 By X-LINE/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Accounts Checker v1.0 By X-LINE/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
TLSH
T154B328286BF85D15E2AE87B9D4744610437BBA5A7A03D72F1D6034AF18B3B50CA10F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Netflix Brute And Checker By ShaOnKrisTof/AlphaFS.cfg

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Brute And Checker By ShaOnKrisTof/NBrute_ShaOnKrisTof.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 ef5fca37d8f8a4d2168576b17cbb82b740f30a381c3f113d4cb413e101e1377e
MD5 d59b1c6e0c37f0faaafa0cad8bb3d55d
SHA1 368352d518c617733f192df2b898d6bce7cc5bac
SHA512 6f351ba1bfec310b4241e1d2b9823e23583c13db7606587c81bdb96479dff0fbe33de9d37276185e47e338a17c1f0d49fab3fc95613641b0762b2a6c9a564147
SSDEEP 24576:BswAw8wsVsGzvWs7Qtq5YvmQ1T3KJI9YL7zb7Z:BswAwDsVsGlQtq5YvmQx3KJI9YLD7Z
TLSH
T1CA154A5075C08836F96222325B58E2B455BDACB28FFD96C763D81E7BBB247C14B312C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Brute And Checker By ShaOnKrisTof/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Brute And Checker By ShaOnKrisTof/libexec.lib

IMPHASH 4229206a8d709700a1caf61236b56e2b
SHA256 8f963bb89f06a3a78ef77ae1906a81e65fed62c8d1f83989250559b918ec22cd
MD5 d5e151111eefbae6c689cb73248826c9
SHA1 a32a0800fdb77a4c8c54b7f7d62b9b87ec1f16a2
SHA512 824000b3f50dc6861753c88dcaa5f0fe099968432f48ba3047acecf628d50fcbf05791a7505d4c0ee0da5cfadba63fc011a394c91e80ae562f251b52a9d88417
SSDEEP 3072:RsNstZWjhdPHUBu++1uuJ9f4XHQy5PVhAg0FuD0qmXR8q6melc9r0aEc88YwE8DH:RztZWF1/+uuuJ9qAOuk0
TLSH
T142645ED130D28C66FC5026359B54EAB0567EACF3DFFDC5A723D05E2BB9203815A628E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetProcAddress OpenMutexW LoadLibraryA CreateFileW GetLastError MultiByteToWideChar GetCurrentProcess GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetFilePointerEx SetStdHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW

user32

wsprintfW

advapi32

GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Netflix Checker By Dark-Time Raisen/Netflix Checker VIP.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 7ccbdf99a3a9907b2fc0e7617a8008b72e192b98a8ab4041708661dddc59466e
MD5 19fbf70024e012fee2c889c3006d07e2
SHA1 e6e29d969b4624a1fd1319fbee57d444caf30881
SHA512 cee67741657c57d0bb01b07ebbe29375ddbc5f238f10c23f17bffaf0d2b17a8688b38deb7c78c1d5f244f476596671a937e999fb9b20df62aa1fe2163b396b68
SSDEEP 12288:bswAwMu+52XsVsGzvWs7QStWzzq5YvmQUlyRT35cJI9YGTk7xN2uavoyY3TneOR6:bswAw8wsVsGzvWs7Qtq5YvmQ1T3KJI9Q
TLSH
T1FCF47C107580C037E66211330AADE7B896ADB9304B991ACB73D81BBFAF756C15F3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Checker By Dark-Time Raisen/alocal.cfg

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker By Dark-Time Raisen/libEGL32.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 07391d78e9a59e55b27cdb7c71319d2c785178df1d7c354d5819090b333398e8
MD5 6184fb1b7bf53be4656b378dd3ee6ff2
SHA1 e9ed4af4c6c68a01d98f6ba2fae53f90edfecf07
SHA512 48dca86da0c4dfb7080d4d92019d6be24c04fc15ca73249d7ad409406c755299fb47952cac19e75268fdb698ef14db84911083f55abb81e0bb4eb21694462af1
SSDEEP 49152:degYillnapVZ9HmBegYillgEICN2jAGGNlozXb1j33MX:JYillapVZ9eYillgnxgNluXxYX
TLSH
T1BEC523167792CE12C878B336DF5A5E4073B3B9081F03D34B2D8CD7A69D690467A0AB6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2485246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker By Dark-Time Raisen/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Checker By Dark-Time Raisen/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
TLSH
T154B328286BF85D15E2AE87B9D4744610437BBA5A7A03D72F1D6034AF18B3B50CA10F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Netflix Checker New Api/AlphaFS.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker New Api/Data/SkinSoft.VisualStyler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 365ffde7df914840eb21c96f34c39912a4b031e3814b8e902b67acee6dff65a1
MD5 2d84a619d4bd339f860cb48af0c9b6c8
SHA1 05e520126ee1100c98263bfbd5a6ff0ce6ace4f7
SHA512 bd0c5e8b018ae393a5f2b92b4a10b5b674ca466074d18b4f86b12cbe9a6a520a95323146cb8e5226b1698f14efcc63addf0df421677b7f5ba3c8d94dbcb511d0
SSDEEP 12288:XxIFyaWHyXq7VBnpJnqRAjcHFNdotFYsFjrXhmEBFa:XxIFyaWHyXq7VBnpJnqRAwHsJm
TLSH
T17B2539402BF49977C11E97FAB0B24AA057F1D924EBABB37B950470A51D9A3D0DD0E0B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

992418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netflix Checker New Api/Data/api.pif

IMPHASH 658abb15f8995417a076cf3c25a1f89f
SHA256 c87f68dea1f4b5d2ff8d497cd766691444bc71a2708b919076b6c17c65e5b794
MD5 ec8bfb5bf32658a9bcb2df7b9c463dbd
SHA1 ba6f02a47b7ebdbde61b857a8ae3186aeb9b4fdf
SHA512 1a53a19dea7df8712a2a06f5331ee60e8b4f99d30bb3f73f46e6842fb9377d5c2d029a07c3f9467fa4205eef08d78253fce1e2b51215ce1be51d705aed606475
SSDEEP 49152:r4KpyMYWpoS8Q11/oFVNUaFHI74fFN5GtTZfSH0ZKTnUJyzwRy9EjRuCMndTG:MKpQNUa+yGk0ZKIJyzqK+yxG
TLSH
T170167C13B280F43AC05A063DD527A6F4B93BAF61E6968C4756FC7C4CFE35641293A24B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

3220192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comdlg32

ChooseColorW GetOpenFileNameW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

shell32

DragFinish DragQueryFileW DragAcceptFiles Shell_NotifyIconW ShellExecuteW

user32

CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA EnumWindows ShowOwnedPopups GetClassInfoExW GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW EnumChildWindows GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC ExitWindowsEx GetClassLongW SetScrollRange DrawTextW PeekMessageA TabbedTextOutW MessageBeep SetClassLongW LockWindowUpdate RemovePropW GetSubMenu DestroyIcon IsWindowVisible PtInRect DispatchMessageA UnregisterClassW GetTopWindow SendMessageW GetComboBoxInfo LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState IsRectEmpty GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement GetMenuItemRect CreateIconIndirect CreateWindowExW ChildWindowFromPoint GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW CreateAcceleratorTableW DefMDIChildProcW GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW SetClipboardData GetClipboardData ClientToScreen SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent MonitorFromRect InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW EmptyClipboard GetDlgItem AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect GetKeyboardState ScreenToClient DrawFrameControl SetCursor CreateIcon RemoveMenu GetKeyboardLayoutNameW OpenClipboard TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor CopyIcon PostQuitMessage ShowScrollBar LoadImageW EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect GetWindowLongW InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SysFreeString VariantClear VariantInit GetErrorInfo SysReAllocStringLen SafeArrayCreate SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound VariantCopy VariantChangeType

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW AdjustTokenPrivileges RegDeleteKeyW LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

netapi32

NetWkstaGetInfo NetApiBufferFree

msvcrt

memcpy memset

kernel32

GetFileType GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect QueryPerformanceFrequency IsDebuggerPresent GetFullPathNameW VirtualFree ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile HeapSize GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery SetSystemPowerState GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetCommandLineW GetSystemInfo LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW GetModuleHandleA HeapCreate GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage GetConsoleOutputCP GetConsoleCP lstrlenW SetEndOfFile QueryPerformanceCounter lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent GetLocaleInfoW CreateFileW EnumResourceNamesW IsDBCSLeadByteEx GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode IsValidLocale TlsSetValue CreateDirectoryW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

ole32

IsEqualGUID OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader RectVisible AngleArc ResizePalette SetAbortProc SetTextColor GetTextColor StretchBlt RoundRect RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette CreateDCW PolyBezierTo CreateICW GetStockObject CreateSolidBrush GetBkMode Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect SetMapMode CreateFontIndirectW PolyBezier EndDoc GetObjectW GetCurrentObject GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo Arc SelectPalette SetGraphicsMode ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits GetViewportOrgEx SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC BitBlt SetWorldTransform FrameRgn GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap CombineRgn SetWinMetaFileBits GetStretchBltMode CreateDIBitmap SetStretchBltMode GetDIBits CreateDIBSection ExtCreateRegion LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx SetDCPenColor GetNearestPaletteIndex CreateRoundRectRgn GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

103KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

84B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

841KB

Virtual Size

841KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Netflix Checker New Api/Data/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ac175b4d44245ee8e7aee9cc36df86925ef903d8516f20a2c51d84e35f23da4
MD5 3df8d87a482efad957d83819adb3020f
SHA1 f5b710581355ac5d0de7a36446b93533232144db
SHA512 da28c34a85a6530b1c558fa11b0e71e70710d719cd8ceaf81f954d1fe3927ec139bee6c5f3135425cc5220905240f1a31d831611c46d18f5d52600b607ea59a6
SSDEEP 3072:NWl4rhAigbJ0c1qnV+xnEd44asVyrVfwN5lTCTh3n3F:NWvigbdqnV+xnEd4zsVyJb
TLSH
T10CC319286BF95C26E6FED7B9D8701100437A799A7A03E32F496425AF24B3750CD04F6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

125278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Илья\Documents\Visual Studio 2013\Projects\BTC\UPD\LITB MITB — копия — копия — копия\WindowsFormsApplication13\bin\Debug\Работа с прокси\xNet-master\obj\Debug\xNet.pdb

Netflix Checker New Api/Netflix Checker v2.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 8f5c53ef64037c88c5d3d094186158cc581624cf02f1b11a408c2db0bd5b1b52
MD5 c567f3fa8700a99c2bdf6e56ae53ed36
SHA1 8b08325f21f25d9b1156edcce5f0956a87875371
SHA512 3f594b1d4d2533e39187f33005da2f7d07206e5b0070aeaddfb78816682f2e435ccb7bdd55ce8961050bbabca18b86c9f3e8ded9846565ea8a7174ecd0441145
SSDEEP 24576:vUwAwE8sVsqzvWsHQNq5YvmY1T3KJI9YL7zb8u:vUwAwXsVsqBQNq5YvmYx3KJI9YLD8u
TLSH
T108152AC137788073D25513321D5BEA6741ADB82E076C3BCB6F86EB6F5A282F07A25147
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Checker New Api/Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 575e30f98e4ea42c9e516edc8bbb29ad8b50b173a3e6b36b5ba39e133cce9406
MD5 c53737821b861d454d5248034c3c097c
SHA1 6b0da75617a2269493dc1a685d7a0b07f2e48c75
SHA512 289543f5eea472e9027030e24011bea1e49e91059241fe6eb732e78f51822313e47d1e4769fa1c9c7d6139f6a97dcfef2946836b3383e8643988bf8908162fb9
SSDEEP 6144:ZeC37wbJmJ5bd4m15M+S50cK7q2UGu7WEYEaWdDBLH5WHxJ16Wi/h4aBTBFFu4JD:p37Ogr2VAHx7JijBZdPfP
TLSH
T118B43A502BF89726F6FE2775F434061953F9F45AE67EEB4F9A4095AA1C837804C00BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

530998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net45\Newtonsoft.Json.pdb

Netflix Checker New Api/Updateapp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 15da28aa30a6e25c0a612a18909aaed5b52d329338f3f4ff3e7c75fd7889252c
MD5 1f640dadfcadb98de27096a5c45c8c4b
SHA1 3fcb247ef167667cba8717bebff94caf30631f3a
SHA512 5408f6449ddf1af4ac514fe1ee377678efbdb43561780e76d82c82141619af422ffe61567cb54926fa84414f5f87935cc6bc59355ea4055724170b3148152880
SSDEEP 1536:VkiAmpgUL8920YM3RZ8zYHA4LFgI3dfB+ItwL/J:VkFmp3L8920YM3YMHAtI3VtwF
TLSH
T142936E39AFAC8F67C76E5B79E47242440378E1263402EBD79D41B4E92913BE12A017F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

93626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\megaapiclient\MegaApiClient-4.5\obj\Release\MegaApiClient.pdb

Netflix Checker New Api/data32.bin

IMPHASH 5877688b4859ffd051f6be3b8e0cd533
SHA256 4055d80c497aa553d4e03c81af6e9da480269d127f6614516c4b16117818651e
MD5 6cf36f75c0e8bc9fbf04cc8827681bd8
SHA1 ff8985f3f43af054394da25e10903bbe1c427e1d
SHA512 4bb8b6431852254cb6c0527153cfeb584724e51485e87e78709b66ebd87ad824287427b404bfad08b766e54f3de888df15b9ba7bbc3ed45fafb197c4b4dbe364
SSDEEP 1536:P7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfCxBl0lLCJ564GO:jq6+ouCpk2mpcWJ0r+QNTBfCbl0lLU
TLSH
T1072593CA57BE8092C28C1B782D47FE57916AF90F122C7B5A9F17FA0F502C638719D192
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset wcsncmp memmove wcsncpy wcsstr _wcsnicmp _wcsdup free _wcsicmp wcslen wcscpy wcscmp memcpy tolower wcscat malloc

kernel32

GetModuleHandleW HeapCreate GetStdHandle HeapDestroy ExitProcess WriteFile GetTempFileNameW LoadLibraryExW EnumResourceTypesW FreeLibrary RemoveDirectoryW GetExitCodeProcess EnumResourceNamesW GetCommandLineW LoadResource SizeofResource FreeResource FindResourceW GetNativeSystemInfo GetShortPathNameW GetWindowsDirectoryW GetSystemDirectoryW EnterCriticalSection CloseHandle LeaveCriticalSection InitializeCriticalSection WaitForSingleObject TerminateThread CreateThread Sleep GetProcAddress GetVersionExW WideCharToMultiByte HeapAlloc HeapFree LoadLibraryW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter HeapSize MultiByteToWideChar CreateDirectoryW SetFileAttributesW GetTempPathW DeleteFileW GetCurrentDirectoryW SetCurrentDirectoryW CreateFileW SetFilePointer TlsFree TlsGetValue TlsSetValue TlsAlloc HeapReAlloc DeleteCriticalSection InterlockedCompareExchange InterlockedExchange GetLastError SetLastError UnregisterWait GetCurrentThread DuplicateHandle RegisterWaitForSingleObject

user32

CharUpperW CharLowerW MessageBoxW DefWindowProcW DestroyWindow GetWindowLongW GetWindowTextLengthW GetWindowTextW UnregisterClassW LoadIconW LoadCursorW RegisterClassExW IsWindowEnabled EnableWindow GetSystemMetrics CreateWindowExW SetWindowLongW SendMessageW SetFocus CreateAcceleratorTableW SetForegroundWindow BringWindowToTop GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyAcceleratorTable PostMessageW GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumWindows SetWindowPos

gdi32

GetStockObject

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW SHGetFolderLocation SHGetPathFromIDListW

winmm

timeBeginPeriod

ole32

CoInitialize CoTaskMemFree

shlwapi

PathAddBackslashW PathRenameExtensionW PathQuoteSpacesW PathRemoveArgsW PathRemoveBackslashW

Netflix Checker New Api/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Checker New Api/msvcr71.dll

IMPHASH 7acc8c379c768a1ecd81ec502ff5f33e
SHA256 525b896a6de9d1c400a61d09cbd1248376f64559da5ef22380600efefdd06078
MD5 5d70d744b237a3a1f57c475600764c3e
SHA1 87bad3d29394b08459d164a6047657a3f9498f60
SHA512 730e876de54596e5ef9e7e14a5eb74efd1661659ebb06c0be8ff7055d62103d5fedd11c07ccf1a2b958c46542cff580ce3a22d4d313cb8ed8b82e6ba6db3571a
SSDEEP 6144:PcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Poz83OtIEzW+/m/AyF7bCrO/E
TLSH
T1E374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr71.pdb

kernel32

GetModuleFileNameA GetModuleFileNameW ExitProcess GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess WriteFile GetStdHandle GetCurrentThreadId GetCommandLineA GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ExitThread CloseHandle GetLastError ResumeThread CreateThread TlsAlloc SetLastError GetCurrentThread TlsFree TlsSetValue TlsGetValue FindNextFileA FindFirstFileA FindClose FindNextFileW FindFirstFileW HeapAlloc HeapFree GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA GetACP GetOEMCP GetCPInfo LoadLibraryA MultiByteToWideChar GetCommandLineW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW InitializeCriticalSection RtlUnwind UnhandledExceptionFilter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetConsoleCtrlHandler InterlockedExchange VirtualQuery QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetEnvironmentVariableA SetEnvironmentVariableW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetLocaleInfoW GetTimeFormatA GetDateFormatA GetTimeZoneInformation HeapSize VirtualProtect GetSystemInfo FlushFileBuffers SetFilePointer SetStdHandle CompareStringA CompareStringW Sleep Beep FileTimeToSystemTime FileTimeToLocalFileTime GetDiskFreeSpaceA GetLogicalDrives SetErrorMode GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetDriveTypeA CreateDirectoryA RemoveDirectoryA DeleteFileA GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW SetFileAttributesW GetFullPathNameW CreateDirectoryW DeleteFileW MoveFileW RemoveDirectoryW GetDriveTypeW MoveFileA RaiseException IsBadReadPtr SetUnhandledExceptionFilter IsBadCodePtr GetExitCodeProcess WaitForSingleObject FreeLibrary CreateProcessA CreateProcessW HeapValidate HeapCompact HeapWalk ReadConsoleA SetConsoleMode GetConsoleMode IsDBCSLeadByteEx GetConsoleCP ReadConsoleW SetEndOfFile WriteConsoleA GetConsoleOutputCP WriteConsoleW DuplicateHandle GetFileInformationByHandle PeekNamedPipe ReadConsoleInputA PeekConsoleInputA GetNumberOfConsoleInputEvents ReadConsoleInputW LockFile UnlockFile CreateFileA CreatePipe ReadFile CreateFileW SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetLocalTime SetLocalTime

$I10_OUTPUT ??0__non_rtti_object@@QAE@ABV0@@Z ??0__non_rtti_object@@QAE@PBD@Z ??0bad_cast@@AAE@PBQBD@Z ??0bad_cast@@QAE@ABQBD@Z ??0bad_cast@@QAE@ABV0@@Z ??0bad_cast@@QAE@PBD@Z ??0bad_typeid@@QAE@ABV0@@Z ??0bad_typeid@@QAE@PBD@Z ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1__non_rtti_object@@UAE@XZ ??1bad_cast@@UAE@XZ ??1bad_typeid@@UAE@XZ ??1exception@@UAE@XZ ??1type_info@@UAE@XZ ??2@YAPAXI@Z ??3@YAXPAX@Z ??4__non_rtti_object@@QAEAAV0@ABV0@@Z ??4bad_cast@@QAEAAV0@ABV0@@Z ??4bad_typeid@@QAEAAV0@ABV0@@Z ??4exception@@QAEAAV0@ABV0@@Z ??8type_info@@QBEHABV0@@Z ??9type_info@@QBEHABV0@@Z ??_7__non_rtti_object@@6B@ ??_7bad_cast@@6B@ ??_7bad_typeid@@6B@ ??_7exception@@6B@ ??_Fbad_cast@@QAEXXZ ??_Fbad_typeid@@QAEXXZ ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?_query_new_handler@@YAP6AHI@ZXZ ?_query_new_mode@@YAHXZ ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z ?_set_new_mode@@YAHH@Z ?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z ?before@type_info@@QBEHABV1@@Z ?name@type_info@@QBEPBDXZ ?raw_name@type_info@@QBEPBDXZ ?set_new_handler@@YAP6AXXZP6AXXZ@Z ?set_terminate@@YAP6AXXZP6AXXZ@Z ?set_unexpected@@YAP6AXXZP6AXXZ@Z ?swprintf@@YAHPAGIPBGZZ ?swprintf@@YAHPA_WIPB_WZZ ?terminate@@YAXXZ ?unexpected@@YAXXZ ?vswprintf@@YAHPAGIPBGPAD@Z ?vswprintf@@YAHPA_WIPB_WPAD@Z ?what@exception@@UBEPBDXZ _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CRT_RTC_INIT _CxxThrowException _EH_prolog _Getdays _Getmonths _Gettnames _HUGE _Strftime _XcptFilter __CppXcptFilter __CxxCallUnwindDtor __CxxCallUnwindVecDtor __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD ___lc_codepage_func ___lc_collate_cp_func ___lc_handle_func ___mb_cur_max_func ___setlc_active_func ___unguarded_readlc_active_add_func __argc __argv __badioinfo __buffer_overrun __crtCompareStringA __crtCompareStringW __crtGetLocaleInfoW __crtGetStringTypeW __crtLCMapStringA __crtLCMapStringW __dllonexit __doserrno __fpecode __getmainargs __initenv __iob_func __isascii __iscsym __iscsymf __lc_clike __lc_codepage __lc_collate_cp __lc_handle __lconv_init __mb_cur_max __p___argc __p___argv __p___initenv __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__amblksiz __p__commode __p__daylight __p__dstbias __p__environ __p__fileinfo __p__fmode __p__iob __p__mbcasemap __p__mbctype __p__osver __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__winmajor __p__winminor __p__winver __p__wpgmptr __pctype_func __pioinfo __pwctype_func __pxcptinfoptrs __security_error_handler __set_app_type __set_buffer_overrun_handler __setlc_active __setusermatherr __threadhandle __threadid __toascii __unDName __unDNameEx __uncaught_exception __unguarded_readlc_active __wargv __wcserror __wgetmainargs __winitenv _abnormal_termination _access _acmdln _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _adjust_fdiv _aexit_rtn _aligned_free _aligned_malloc _aligned_offset_malloc _aligned_offset_realloc _aligned_realloc _amsg_exit _assert _atodbl _atoi64 _atoldbl _beep _beginthread _beginthreadex _c_exit _cabs _callnewh _cexit _cgets _cgetws _chdir _chdrive _chgsign _chkesp _chmod _chsize _clearfp _close _commit _commode _control87 _controlfp _copysign _cprintf _cputs _cputws _creat _cscanf _ctime64 _cwait _cwprintf _cwscanf _daylight _dstbias _dup _dup2 _ecvt _endthread _endthreadex _environ _eof _errno _except_handler2 _except_handler3 _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit _expand _fcloseall _fcvt _fdopen _fgetchar _fgetwchar _filbuf _fileinfo _filelength _filelengthi64 _fileno _findclose _findfirst _findfirst64 _findfirsti64 _findnext _findnext64 _findnexti64 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fputchar _fputwchar _fsopen _fstat _fstat64 _fstati64 _ftime _ftime64 _ftol _fullpath _futime _futime64 _gcvt _get_heap_handle _get_osfhandle _get_sbh_threshold _getch _getche _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwch _getwche _getws _global_unwind2 _gmtime64 _heapadd _heapchk _heapmin _heapset _heapused _heapwalk _hypot _i64toa _i64tow _initterm _inp _inpd _inpw _iob _isatty _isctype _ismbbalnum _ismbbalpha _ismbbgraph _ismbbkalnum _ismbbkana _ismbbkprint _ismbbkpunct _ismbblead _ismbbprint _ismbbpunct _ismbbtrail _ismbcalnum _ismbcalpha _ismbcdigit _ismbcgraph _ismbchira _ismbckata _ismbcl0 _ismbcl1 _ismbcl2 _ismbclegal _ismbclower _ismbcprint _ismbcpunct _ismbcspace _ismbcsymbol _ismbcupper _ismbslead _ismbstrail _isnan _itoa _itow _j0 _j1 _jn _kbhit _lfind _loaddll _local_unwind2 _localtime64 _lock _locking _logb _longjmpex _lrotl _lrotr _lsearch _lseek _lseeki64 _ltoa _ltow _makepath _mbbtombc _mbbtype _mbcasemap _mbccpy _mbcjistojms _mbcjmstojis _mbclen _mbctohira _mbctokata _mbctolower _mbctombb _mbctoupper _mbctype _mbsbtype _mbscat _mbschr _mbscmp _mbscoll _mbscpy _mbscspn _mbsdec _mbsdup _mbsicmp _mbsicoll _mbsinc _mbslen _mbslwr _mbsnbcat _mbsnbcmp _mbsnbcnt _mbsnbcoll _mbsnbcpy _mbsnbicmp _mbsnbicoll _mbsnbset _mbsncat _mbsnccnt _mbsncmp _mbsncoll _mbsncpy _mbsnextc _mbsnicmp _mbsnicoll _mbsninc _mbsnset _mbspbrk _mbsrchr _mbsrev _mbsset _mbsspn _mbsspnp _mbsstr _mbstok _mbstrlen _mbsupr _memccpy _memicmp _mkdir _mktemp _mktime64 _msize _nextafter _onexit _open _open_osfhandle _osplatform _osver _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _purecall _putch _putenv _putw _putwch _putws _pwctype _read _resetstkoflw _rmdir _rmtmp _rotl _rotr _safe_fdiv _safe_fdivr _safe_fprem _safe_fprem1 _scalb _scprintf _scwprintf _searchenv _seh_longjmp_unwind _set_SSE2_enable _set_error_mode _set_purecall_handler _set_sbh_threshold _set_security_error_handler _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snscanf _snwprintf _snwscanf _sopen _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _stat _stat64 _stati64 _statusfp _strcmpi _strdate _strdup _strerror _stricmp _stricoll _strlwr _strncoll _strnicmp _strnicoll _strnset _strrev _strset _strtime _strtoi64 _strtoui64 _strupr _swab _sys_errlist _sys_nerr _tell _telli64 _tempnam _time64 _timezone _tolower _toupper _tzname _tzset _ui64toa _ui64tow _ultoa _ultow _umask _ungetch _ungetwch _unlink _unloaddll _unlock _utime _utime64 _vscprintf _vscwprintf _vsnprintf _vsnwprintf _waccess _wasctime _wchdir _wchmod _wcmdln _wcreat _wcsdup _wcserror _wcsicmp _wcsicoll _wcslwr _wcsncoll _wcsnicmp _wcsnicoll _wcsnset _wcsrev _wcsset _wcstoi64 _wcstoui64 _wcsupr _wctime _wctime64 _wctype _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst _wfindfirst64 _wfindfirsti64 _wfindnext _wfindnext64 _wfindnexti64 _wfopen _wfreopen _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _winmajor _winminor _winver _wmakepath _wmkdir _wmktemp _wopen _wperror _wpgmptr _wpopen _wputenv _wremove _wrename _write _wrmdir _wsearchenv _wsetlocale _wsopen _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wstat _wstat64 _wstati64 _wstrdate _wstrtime _wsystem _wtempnam _wtmpnam _wtof _wtoi _wtoi64 _wtol _wunlink _wutime _wutime64 _y0 _y1 _yn abort abs acos asctime asin atan atan2 atexit atof atoi atol bsearch calloc ceil clearerr clock cos cosh ctime difftime div exit exp fabs fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws floor fmod fopen fprintf fputc fputs fputwc fputws fread free freopen frexp fscanf fseek fsetpos ftell fwprintf fwrite fwscanf getc getchar getenv gets getwc getwchar gmtime is_wctype isalnum isalpha iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv localeconv localtime log log10 longjmp malloc mblen mbstowcs mbtowc memchr memcmp memcpy memmove memset mktime modf perror pow printf putc putchar puts putwc putwchar qsort raise rand realloc remove rename rewind scanf setbuf setlocale setvbuf signal sin sinh sprintf sqrt srand sscanf strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtod strtok strtol strtoul strxfrm swprintf swscanf system tan tanh time tmpfile tmpnam tolower toupper towlower towupper ungetc ungetwc vfprintf vfwprintf vprintf vsprintf vswprintf vwprintf wcscat wcschr wcscmp wcscoll wcscpy wcscspn wcsftime wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstod wcstok wcstol wcstombs wcstoul wcsxfrm wctomb wprintf wscanf

Netflix Checker v0.2.1/Netflix Checker v0.2.1.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 c0b58d3a0c7ba3026ff7f321b4413deaf39546399461b23ec88abf86514ff5d7
MD5 324255321da1d167b7f0d55ec17c6c8f
SHA1 7e844c3605139708b80f715c688a45b0d8c73439
SHA512 27071824f4af38045ac366e0c15540457a457ef00e72b9dc7217bd07309ff4c342b3d4ae9bad9b6257def106d1c4d401b8d3fbe682ad11005694b5d0c72e543c
SSDEEP 24576:10wAw9UsVsr2vWsgQNq5Yvmo1T3KJI9YL7zbf6:10wAwasVsr1QNq5Yvmox3KJI9YLDf6
TLSH
T18135B093744880A3F16131F207D8927752A86CF00655D58EF2B8F6EA9A37583FE21D7E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

363KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Checker v0.2.1/SkinSoft.VisualStyler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f9fa9f508b9350ed12ed3aa5b7f24aed901a6434b1b02d1f0ee301b8eea54b06
MD5 69e6563e0e7ea843e9b37d58819f4136
SHA1 4aebf9955ba0d0b5205b6b013da634aa0281a25d
SHA512 c883bcb3f6f2ac3f2fe88eed1356178ff2b43bdeed2188aa06f35cbc9dda8745a3a5c2d28d99daae5b6ea9af46abcae45b7bd4da13f318ba31062a8e8b79a942
SSDEEP 12288:OSVkAXRzNIYqsdMExMDj/iREVGx2G4dZJ25jad4NJQe5rkAf/e5rkp3gN372sx00:ZRz+YqsdMExMDj/iRHx2dJ7Wsx0
TLSH
T10B3539807BF89577C16E83B7D0A615F05BF5E225DB2BD79B5A5037AA1CE37804C0A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1088638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netflix Checker v0.2.1/core32.lib

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker v0.2.1/database32.cfg

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d85a5c4f2a3f97fa5bf84bc8068b9901cf4d522acfcdb1f1a776effd41abfa70
MD5 7a32fb550855b0c93d5e2eb7819d962e
SHA1 529ab06e84ca8369603cef50df476a4f113cf1db
SHA512 41a375d5274576bfc3c8b460c3956a9db8ac529655481e3ede52bd7f65282acf23a5e36e7c30ba1eb4748806780b49ebae5f7e59de854c545511a2aef1356b5f
SSDEEP 3072:W8Y6Y8Y8Y8+/FOSQj3ruamthO4b3vtZX8Y6Y8Y8Y8+/FO:CtOSbiCtO
TLSH
T1DEF468E7314994D7B19072F6A2C4803322646CF8A14AD2ACF479F9C9563396BFC91CBD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

401006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Julio\Documents\Visual Studio 2012\CrunchyrollGen021-TR-Stop1\CrunchyrollGen021-TR-Stop1\obj\Debug\Netflix Checker.pdb

Netflix Checker v0.2.1/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Checker v0.2.1/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ac175b4d44245ee8e7aee9cc36df86925ef903d8516f20a2c51d84e35f23da4
MD5 3df8d87a482efad957d83819adb3020f
SHA1 f5b710581355ac5d0de7a36446b93533232144db
SHA512 da28c34a85a6530b1c558fa11b0e71e70710d719cd8ceaf81f954d1fe3927ec139bee6c5f3135425cc5220905240f1a31d831611c46d18f5d52600b607ea59a6
SSDEEP 3072:NWl4rhAigbJ0c1qnV+xnEd44asVyrVfwN5lTCTh3n3F:NWvigbdqnV+xnEd4zsVyJb
TLSH
T10CC319286BF95C26E6FED7B9D8701100437A799A7A03E32F496425AF24B3750CD04F6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

125278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Илья\Documents\Visual Studio 2013\Projects\BTC\UPD\LITB MITB — копия — копия — копия\WindowsFormsApplication13\bin\Debug\Работа с прокси\xNet-master\obj\Debug\xNet.pdb

Netflix Checker v1 Removed Phone Number by Sh4lltear/Guna.UI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e
MD5 6d6a1f28978d42ad2f0a8f278eaac966
SHA1 b09168ec88109422ca29cf4f1b6462d51930873d
SHA512 76ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d
SSDEEP 12288:bXlW6JhG2lO8FbG5byJR//uXShuqO3daKScHj/mTnGS:bE6JY2sYS5GJRuHkcHqTnGS
TLSH
T145155B6577E4D99BC05987BA503346E86B74E004BFA7F34BD419B2AC0ECB3AB1C19943
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fd:c7:11:ac:06:af:3c:b3:90:a8:99:02:20:3d:6b:dc:7b:d8:16:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Jan 1, 2020

CN=Sobatdata Software

Minor OS version

0

Major OS version

4

Entry point

897734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Guna.UI\Guna.UI\bin\Release\build\.net 4.0\Guna.UI.pdb

Netflix Checker v1 Removed Phone Number by Sh4lltear/Leaf.xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70670c404f998b71fe5abfb3aa58fcb5302d3940e805ac8927f79b625afab4a8
MD5 aabe4f7e8f947171ab334b5cc0a76f7c
SHA1 83b96de7936466b027e5ba974a563c278478dea7
SHA512 e81c923c4eea8c00ac07d5a17af6377629d25bb837566f8cb74adfc545d033570a4a9dea8004799880ef05a8ba44de9a2dbdbf7c153050442432abec51d213e2
SSDEEP 1536:m8ecfUylM/rsvere3RXUmixwjKMD92NuYD9ikvyLm/RVTeyzi3v4rl:m8ecXM/a9EXBNuYxikqLm/RVTPHl
TLSH
T166C3283577F84A1AE3FF8B78E4719110427ABE492502DF6E5D4860DF28A3B908911BF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

123750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net452\Leaf.xNet.pdb

Netflix Checker v1 Removed Phone Number by Sh4lltear/Netflix Checker v1 by Sh4lltear.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 55fe472dcf928ccf95c1e09f16178c054106d3d950118275e154b3f5d8db8ce6
MD5 42fcd9c13943aed8f2d14a02862d8d14
SHA1 0eb5dddaa1a669ec90e1a4790ca4f5114784149d
SHA512 8e563b93c403577830becfe98978bca2eeb9c2b1cb9b387e1b4ad18e28599269101388a83de7cdeca56990acbc47f72079fa891e3571ee04fb1bd1e1b455140f
SSDEEP 24576:opwAwR4sVsOzvWsjQtq5Yvm41T3KJI9YL7zbOMwFuUbUBGR:opwAw6sVsONQtq5Yvm4x3KJI9YLDxwQG
TLSH
T121159D117980C037E66211731AACE2B895BDB8300BA51AC773D91BBFAF796C15F3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Checker v1 Removed Phone Number by Sh4lltear/Netflix Checker v1 by Sh4lltear32.dll

IMPHASH 55f7dfaa5fbadfb4911ad11b60c65135
SHA256 b695ac865a5df23e45ff991bf26b71e4f879c89a1a6fde0ba92f31904beaca5c
MD5 7d723a8eb4d7e494ea488c13510b97b6
SHA1 07f07c10e0661fa5f272a61ce69ed95c1cb251b8
SHA512 5ff49cc06df33b65c2bfbf37d89fa6ae2b71e26046bd7cf96a374ceb840ec7d3e11761f94b0f67b9ae38e4fcb1fe836c09a0b227e4a478f775a7511eda9d133c
SSDEEP 12288:q0MpAgk/SL8w92kboM7E2PheNUd6/8O+OeO+OeNhBBhhBB1xzyqtqKm9RZwWMN46:q0MpAgkdw/eC6/IxTtqB9RZw34HWOU
TLSH
T1CDE49D62F6D3D2B6E9DE00F5883C7E1E652DA9051B289AF7A3DC6F6E0D305D11A30247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

382933

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\svn\ILProtector\trunk\ILProtector\Output2010\Win32\Release\Protect32.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep QueueUserWorkItem DeleteCriticalSection LoadLibraryW GetProcAddress InterlockedCompareExchange InterlockedDecrement GetModuleFileNameW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection GetModuleHandleW InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW InterlockedIncrement EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind WideCharToMultiByte LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy VariantClear SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Netflix Checker v1 Removed Phone Number by Sh4lltear/Netflix Checker v1 by Sh4lltear64.dll

IMPHASH 43c22e6f8eae03d27951cac470151b24
SHA256 b3710de17d2c2f84def83c8f3093df0dbe1664f34ab4a3adb72f1085e71c773c
MD5 08dfad3a22e42e17a3bf8f4ee43a67f5
SHA1 add9635ce5de6886b0010c83295df59d3c40a2b1
SHA512 820163bcac0c44dddf55d423c06895d419b71beb8a2099501c3e334689dac9d034f543c72733b3bc56505d662bf821df807ef84c7d16a46a0217aebc7192ab60
SSDEEP 12288:UF4dPwdZ2MWYgeWYg955/155/26Bm5h56GbU+rwo4o:Rwb6BK56GbVrwf
TLSH
T1F7F47E2BB69582A6D072D03D8A97825AF7F138444B659BDB1290436E2F37FF45E3D320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

401168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\svn\ILProtector\trunk\ILProtector\Output2010\x64\Release\Protect64.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep DeleteCriticalSection GetModuleHandleW LoadLibraryW GetProcAddress GetModuleFileNameW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection QueueUserWorkItem InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx WideCharToMultiByte LCMapStringW GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage FlsGetValue FlsFree FlsAlloc GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy VariantClear SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Name

.text

Size

482KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Checker v1 Removed Phone Number by Sh4lltear/core32.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ad32d183b6173b7d11e87f80e41708299976c216f1312230a79903308ef58ab6
MD5 3c48b36295eb8ebb9e468bc273ebce75
SHA1 385a2e8c5a9ac4f15da3eb1e33bb7dd992eb819a
SHA512 cc3e93b922bfe923d05d31308ab05576819ded33467db7c4679a9c8ecb5ebb29119da9bb1c60b938e59b2d93accfafc65a677a612bbfe57d1bc978cd7631e97c
SSDEEP 24576:8MwFuUbUB2MwFuUbUB0MwFuUbUBkoiiMwFuU+UB:/wQDBJwQDBnwQDBkoilwQMB
TLSH
T19E15DFC3FBE26D08C71A68FE6AB2444101B4F4411832DB8BB78F563D7A6DA62B7D5311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
SmartAssembly .NET packer

Detects SmartAssembly .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

749390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker v1 Removed Phone Number by Sh4lltear/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Checker v1 Removed Phone Number by Sh4lltear/strip.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker v1 Removed Phone Number by Sh4lltear/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
TLSH
T154B328286BF85D15E2AE87B9D4744610437BBA5A7A03D72F1D6034AF18B3B50CA10F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Netflix Checker/Bunifu_UI_v1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9a9cb99d6e8c39818768424fd33a3f63887730a3a05cc1e2579e1617779f0e54
MD5 e311a2693ca2c262a902edf5e0d5027e
SHA1 4d6e5a09d1aa0903268cbbdc99441e6d9e152f14
SHA512 e55b9c79dded46c990cfee3b84571be4d6692e6910e9d1be8d6a639d148a5e060f2f6bf5d5335587268cecc1cf6e9d34dd30be1d654f26c99ae4d81543111230
SSDEEP 6144:uPZIqHjb8T1JEiB7jsAZwGt/W4NpOe2hNbrcH0tsEJ:NqHjb8T1JE28+wGwIkcHasEJ
TLSH
T1E6346B1137A44D67EABE86FDB8594085DB72E919729BE3CDACC510FD08C33994B423A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

250606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netflix Checker/CefSharp.cfg

IMPHASH 4229206a8d709700a1caf61236b56e2b
SHA256 21e2844d2c2e32292842e4dc8172866d3e79303723e6928e7a684a56d42fc368
MD5 7319122241b38c0fb21ef982c1ca9fc5
SHA1 1cff118ee43e49837544b959115627d345cae3d5
SHA512 928f2f008808077f62fb706a1225a069be7744873d9edacda323f007cf3b12eedbd25b3c6e4d656e815d4b76ba08d795db437c3649e6fcf2ae786b5934347c20
SSDEEP 3072:V6N4tZWjhdPHUBu++suJ9f4XHQ2xPVhAg0FuD0kmXR3PaGkMMDW0:VFtZWF1/+ZuJ9WAOY/aG10
TLSH
T188F35C1535E2C472E4B2217508A8BFF1CB7DE8204B615DEB27D41B7F8E202C16A76D7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

26810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetProcAddress OpenMutexW LoadLibraryA CreateFileW GetLastError MultiByteToWideChar GetCurrentProcess GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetFilePointerEx SetStdHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW CompareStringW LCMapStringW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW

user32

wsprintfW

advapi32

GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Netflix Checker/MetroFramework.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845
MD5 c853e9e8c720249198ff376f42328ef9
SHA1 a56ee195148023571e26ffeaa5a736bc73a76c40
SHA512 d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739
SSDEEP 384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9
TLSH
T17E723006B2F4423AE7AFCD356AA9056F3174791DA9F2CA1C0CC90AE9D9F67404A11F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\VB\winforms-modernui-master\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb

Netflix Checker/MetroFramework.Fonts.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb
MD5 b8c8a532438c4b421081efb258355469
SHA1 41aa88d5eaf398da55f712f30226b70492125be1
SHA512 511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc
SSDEEP 12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
TLSH
T134E429B5760139E6EF11C4B7C260FD80192B7863A77B802A68E3077A88575CDFE53E46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

677454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\VB\winforms-modernui-master\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb

Netflix Checker/MetroFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb
MD5 b20f1b5e3d4e3df2d826e9870637cd06
SHA1 a03bb47afdf9498be409ed5b56e945f6e143fb32
SHA512 095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d
SSDEEP 6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O
TLSH
T1C6646D205788852AF1EF433BE46A048587F3EB02F97AE79D99CE90AC1F537419D11B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

326366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netflix Checker/Netflix Checker Notificaciones.vshost.exe.config

SHA256 87451e21db5e08cdbd746570d3b2e61e9e7dddf3db87420dd751b23777f6b910
MD5 72a9c8b79a6577721302be0a9a75f53a
SHA1 b98675b937dabac285d37ed8dbf4d3755fb76777
SHA512 b3bf9709bf210c431598bad84a5f8b8a53c41374e1c27e70459e0c5805a9fe480fab2e6ad6c1c4e190e7b36df1830ae68e12f8b2756c6f54c4b0977c830b0797
TLSH
T15BC0122944A8BD268E324A235652856AEFB062A3A424000CF02FAA660B3114D4267336
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Checker/Netflix Checker Notificaciones.vshost.exe.manifest

SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
SHA512 fa583ba012a80d44e599285eb6a013baf41ffbe72ee8561fc89af0ec5543003ba4165bfe7b1ba79252a1b3b6e5626bf52dc712eacd107c0b093a5a2757284d73
TLSH
T1F1F0DCC1D188CA6AD73042A13A66E420A2AD435B19DD49EC74DC2ABB6F0BBC680C30F1
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Checker/Netflix Checker.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 3da5b4f054201dbdf2784c64a2ec446e95afe7803cde1fe6a98ad3068a62edd0
MD5 83dd29fc0e0f9691ca44a9a9663ed234
SHA1 0bb27b3e4c9c06aecdca7d13696955a57504f1be
SHA512 5dc0ec1b3a342d998147454fd4b7186ba86acdb56e1ce1418790fc770aa33259907fc310a79453b87f31e1a1fd3a664c6dfa9b1392b36d237a5fc7bfd617d27e
SSDEEP 12288:howAwMu+52XsVsGzvWs7QStWzzq5YvmQUlyRT35cJI9YGTk7xN2uavoqYeneOR6:howAw8wsVsGzvWs7Qtq5YvmQ1T3KJI9x
TLSH
T139F48D107580C037E66211331AADE3B896ADB9304B991ACB73D81BBFAF756C15F3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Checker/Netflix Checker.exe.config

SHA256 87451e21db5e08cdbd746570d3b2e61e9e7dddf3db87420dd751b23777f6b910
MD5 72a9c8b79a6577721302be0a9a75f53a
SHA1 b98675b937dabac285d37ed8dbf4d3755fb76777
SHA512 b3bf9709bf210c431598bad84a5f8b8a53c41374e1c27e70459e0c5805a9fe480fab2e6ad6c1c4e190e7b36df1830ae68e12f8b2756c6f54c4b0977c830b0797
TLSH
T15BC0122944A8BD268E324A235652856AEFB062A3A424000CF02FAA660B3114D4267336
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Checker/Netflix Checker.pdb

SHA256 f2946e9c43b2c95c7bf8b3d59afb638a3d83822f2633008b39efba23133c635c
MD5 43e886a4d2626143cec8d8de9b3961b4
SHA1 2445b0c0933f22623fc2bafb7ca09e1c84f9cdc3
SHA512 55c11b92c94ca1584b64a2d3836d80112d69544488566b1e73abcc1d0074a7b4ece3965955e9745489191c09f7f2fbb5ef22fc4616608263c70b10f8f571d2c1
SSDEEP 768:0oG7pSlg5QPAV+LYUTZ4pfidE0hX6rqUn7e1SA/2ihD:QlSgyP0+BGyHX6rNn7I22D
TLSH
T127733E1A6789C572D0269B3867A7CF3D8779EC452B9B4F2B2794B42D2DB6301BF42310
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Checker/Netflix Checker.vshost.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 280fdcaf69c8f7145446c8bc342fa4a0c7ff0abfed111c5f72b520f479fde785
MD5 dbd8bc6438e1011ca1b796c7a9c78d78
SHA1 9184d63d8335efecf3ea02845fd1f027e7edaa0a
SHA512 1536aa27db27c9ad52c4f5fcd5acd584a520afeb2bb30aaeca03682b3737fa7820fe0eb1d7a2e0951202e5383287edf8539b0939d2587a741729ab19c8f281f3
SSDEEP 384:G3LPZZWmBWM71q//0GftpBj/NH3HRN7o+lKxCnj:IrBRE8ixNHoRO
TLSH
T1AFB25B91CA6CC143EC939C7066A4EA83BD3CD7C74C61591B249EFAD91E833D4EB2162D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Digest

f2:1d:d9:a2:07:dc:41:af:bb:ba:11:e1:07:69:69:c1:32:9a:67:78:70:8b:32:95:5b:bc:c3:de:d9:c8:9f:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 5, 2013

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

11:70:04:e3:44:27:26:49:ee:b1:45:b0:17:2e:3f:bd:23:2a:8b:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 5, 2013

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:28:90:67:b9:04:b0:3c:6e:66:00:00:00:00:00:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

0

Major OS version

4

Entry point

12382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\binaries\Intermediate\vsproject\vshost32.csproj__1853760103\objr\x86\vshost32.pdb

Netflix Checker/Netflix Checker.vshost.exe.config

SHA256 87451e21db5e08cdbd746570d3b2e61e9e7dddf3db87420dd751b23777f6b910
MD5 72a9c8b79a6577721302be0a9a75f53a
SHA1 b98675b937dabac285d37ed8dbf4d3755fb76777
SHA512 b3bf9709bf210c431598bad84a5f8b8a53c41374e1c27e70459e0c5805a9fe480fab2e6ad6c1c4e190e7b36df1830ae68e12f8b2756c6f54c4b0977c830b0797
TLSH
T15BC0122944A8BD268E324A235652856AEFB062A3A424000CF02FAA660B3114D4267336
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Checker/Netflix Checker.xml

SHA256 0ead5ad0b0d8d7f79c3cdcca04d3397c3a5d381689a091e424b858998820221c
MD5 8cab2b40d816d4018e9ca5a63baf4168
SHA1 fc76a5483490362623576340bd283e2be37ac72b
SHA512 a72f890f317768eadad165bb848f3cca0cfefb45a4986daec33a69b36c9cc972660497089b2a24377fdf8c210a7f4b1f4f2dd6492c27fe7445e9138f9e67d5e9
TLSH
T1E4012B0BA398AE319D30047B3D61B895214B6D20C679311DECA958770BE538927EBC60
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Checker/Tulpep.NotificationWindow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe4e8f5bc2fb30372836426b78fdd146d91a81cffa60aeef3d95a582fa2a3f82
MD5 1f6a5b52b3d99e3bf04164f17ce22c39
SHA1 ad814c10ad6b84c281974fa40af1593a07b28369
SHA512 a80d09f6e3e5017a8383b5b69619df3ab22ad0e6eaccef24153c5c281a877c31edd792b32d97b164706556f67ad20eed67cbf74a0641e65f14f7deaa8fa750c7
SSDEEP 768:Av4UIcOP/GUUXqmoQX6sBxRMmPbyLq4JP:0RIcOP/GUIo07RMmPbyLqu
TLSH
T11CD21959335CC277CA6E4E7AC02262215BF6D2853503EFD48E80A4DF6AD7B8452136FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

34878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\notification-popup-window\Tulpep.NotificationWindow\obj\Release\Tulpep.NotificationWindow.pdb

Netflix Checker/bin32.lib

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Checker/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Checker/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
TLSH
T154B328286BF85D15E2AE87B9D4744610437BBA5A7A03D72F1D6034AF18B3B50CA10F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Netflix Gen/Netflix Gen.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 39193181e62ed855156d32cabffd900ae2d6f3cd4415cf5cbb195369061020e9
MD5 dfb1ed72eb4a1cb21cececbe1921ec01
SHA1 2773fc3893bae46402c4224da9b08ecbac436548
SHA512 a448f79b4a29aa48921101cde45b8295e8de1e9eb6611a4406fe54fd6f16caa442357a7615f13f4e9a9763844f8af550c6faa46aaa71f92f7a5821f1dde35599
SSDEEP 12288:U5wAwcjHJGXsVsATvWs+x5trFZfg4vXplPuFT358JpAYpHEbuM2uaPoJqeOv6:U5wAwMwsVsATvWs+xTfg4vXpwT3qJpAa
TLSH
T1F1F47D107780C037E562113209AEE3BA95ADB9300B9927C77BD816BFAF756D16F3124B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Gen/api32.dll

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Gen/core.lib

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 512ef9cf7cec4c70f801964ed3e78ae8a38bb19a7fa3c4fbb8d822d79851a313
MD5 edd364101099c82f23729344330ae539
SHA1 b7f5fd02d2a77082ea36286c87523e25c1b09636
SHA512 62d459d272fd1e3a780d9144e20d01a27668d2ffd6a301a831e55e5fc46a465a25607cb5828f6eeb9dc8ed3dcc2d25e427da505dd2934e97df2b89fafe74dee0
SSDEEP 768:FzaSrukOnlyQMptd8w7aQxHxoZallt8egT2D0TFE2Pw1x:Fz9FbGZAx
TLSH
T168D241C4074F09A6DD96797C1CB3B307513AF44E1C6EFBB98CA4A24EBA3A53474C0696
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Promethazine\Documents\Visual Studio 2015\Projects\Netflix Gen\Netflix Gen\obj\Debug\Netflix Gen.pdb

Netflix Gen/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Proxy Checker/HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21885df350d1de518b95bd39207fa7c4b31ebd5008905e51ce5fc04f8ed87dd0
MD5 c0b73d84ef4a8e2c8405d6ee171608b7
SHA1 1a68ba9a8cfa054f37d636bc462c8958073bf8a2
SHA512 147610924afc82ecc97d4a1468503e2dd6aa48d6b29c78c41d25a15a8ec779797be0abd4ad0e0740c8f83f71df53cc0791a52a2029d3862d0b924b5911020397
SSDEEP 3072:WQzzvsepYoCGm6b2r+jL6ScQ8PIZFPAA:6GmBKL73
TLSH
T18CD3A315F6AF66F6E6E78EBCA8A134400AFDBD1EE006DB5D0DC490EC8472B558940F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

143686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Jonathan\Desktop\Z\zzzproject\HtmlAgilityPack\HtmlAgilityPack\obj\Release\HtmlAgilityPack.pdb

Netflix Proxy Checker/Netflix Proxy Checker.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 2591c034d0052a09d447474a1a8b40d2ee80d134d84ee4b76d8cb130a5e8dc19
MD5 9c91b9003b7475062da32a2dd707c28e
SHA1 431dda2490115efc6333586d3abf42f14c15fb5d
SHA512 e6208bc97b79fe2273f6bab0be8adb246b0dbe61566fc648270231ee050ef62009407f885d39ddd9b6f4425602d9627bba1f7c74c9044584efbe8069fbd5c42c
SSDEEP 24576:55wAwMwsVsATvWs+xTfg4vXpwT3qJpAYObd7+rJHPt48BTm0X:55wAwTsVsA4xTfg4vXpQ3qJpAYOxGJHh
TLSH
T1AB258D107980C037E66211324AA8E2B896ADBD314FA517CB73D85EBFBF756C25B31247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix Proxy Checker/api32.bin

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix Proxy Checker/core.lib

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f80cc3e43e7c53cb4dba53f95b4e89e0cba816d820d396b792cbf9c0ac331e99
MD5 bb2eeaef66eb5671a0989ece3ed96358
SHA1 7249502234965474befa95f18fe8cfaef8347297
SHA512 1d8bc150a8f05bf23e90a88b831c51ef7c184c1a00afa4481baf6360a622463e9c8b7ee15f3ef39d11ac8838bf65339edd465c775a8ace4601f8fc53a8b2d97d
SSDEEP 24576:6Q8rpHPt48BTmgrpHPt48BTmmKrQHPtL+B/F:gpHl42TmopHl42TmxQHlLI/F
TLSH
T130057C61AB849666C5786671DF11D47103A76DBFFC30E347B9E0FD8B38BAA438621342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

591418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\NIR\My Project, Works\Source Codes\Proxy Sources 2019\Proxy Tool Custom\[C-Sharp] Proxy Scraper and Scanner\obj\Debug\[C#] Proxy Toolkit.pdb

Netflix Proxy Checker/dangerous_ip_ranges.txt

SHA256 400465903c84f374f2064da78c23c9544ec41552750f2e2a146184b61694e09b
MD5 be92697155b12777ed22a0b3481d7201
SHA1 d2f520cb040d2961351444c5d147652fcca28450
SHA512 99b3dd4396026fae11a82a8e7860d641bf4595deb019d42bfe1878875af9aaf41362611acfcb86a9ebe8bbd49bef27dee4e45bda0da451669ea2352f97df3e65
SSDEEP 384:Egs+kCOOhYlIU4N+CkS7eBVMzVu1QLzgLzsaidn/nRY+4mbLCEXevd:Egs+kAU4Nzk0eBdmUidn/6+4mbAd
TLSH
T17E0386F6B3B510D9224F8BAF1153F75084FE627022D6F80BAFAF5160E693D4663E1225
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Netflix Proxy Checker/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix Proxy Checker/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3b0ab75717a8bf4370e95e7c666d8c2a4e7ebb115a52eb238b6b4557c4b6250a
MD5 16e7e19da6c6a7cb7a145bd3d62bc82a
SHA1 61a872b1515a0a042cc430d7ee59f0d68331848d
SHA512 0682da640db56b2b8d9763b2c8dcf776f9d70d0abd831962e549c81676ec01c37c6d2685d683c0dfca06b2f6f9c264cc3e9062fecd05f32f43d08757f48f2ed5
SSDEEP 3072:vbHth5Ybye8hx7KM/vV4OI6vupVwP4MYvv3oYa:ZJe87KEN4Pn4
TLSH
T15EE33929B7F85A19E7FA5B3CE0B542004739B9596503E76E4918B0EF2873B91C904FB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

150526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

H:\NIR\My Project, Works\Source Codes\Proxy Sources 2019\Leaf.xNet-master\Leaf.xNet-master\Leaf.xNet\obj\Debug\net452\xNet.pdb

Netflix password changer + capture by RubiconT/ChilkatDotNet4.dll

IMPHASH 01b2471b51a2a02550625e6e6cfe64c7
SHA256 1ffb1f04224b93562e9a17b1d6919fe07989fb617ced606534a86f449c0e60bb
MD5 300498f6010a5ce415bde71f7b948696
SHA1 aa5afb1d7ae395afbcc834b7def917e36dd1def3
SHA512 f8e11d37a5712d34034c97fc479211136133acdcc43c00068c67103ec18fa6d6f70feef2222820436356a488449074c961265887b339661babd98b6bb220919f
SSDEEP 98304:LOjGGxiBSz5P460e8xvfmuLe91k65alA5egsNdCrXs3eyiQMrPt:ykkzJ4PxvuuLQ1olAggiL3OPt
TLSH
T16D666D317F9A8835F65E1272C96C539FDB0CC9B2072E15C7B244859A28E67C3AB33953
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4504398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\ck2000\components\ChilkatDotNet4\ChilkatDotNet4\release\ChilkatDotNet4.pdb

msvcr100

remove clock rename realloc malloc isdigit strtol strpbrk fgets fputc fgetc printf _setmode __iob_func __FrameUnwindFilter _cexit ??_V@YAXPAX@Z __CxxQueryExceptionSize __CxxExceptionFilter __CxxRegisterExceptionObject __CxxDetectRethrow __CxxUnregisterExceptionObject ?__ExceptionPtrCopy@@YAXPAXPBX@Z fseek _telli64 ftell strchr ferror fread fwrite _filelength _filelengthi64 _gmtime64 atoi _localtime64 _tzset _crt_debugger_hook _except_handler4_common _onexit _lock __dllonexit _unlock __clean_type_info_names_internal ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __CppXcptFilter _amsg_exit _initterm_e _initterm _encoded_null free _malloc_crt towupper towlower isalnum __timezone _mktime64 _rmdir qsort memmove _atoi64 memchr srand rand _time64 _fileno _wcsicmp fopen fprintf fclose getenv sprintf toupper tolower _strnicmp strncmp _stricmp memcpy sscanf memset strstr strrchr ??2@YAPAXI@Z ??3@YAXPAX@Z strncpy __CxxFrameHandler3 __daylight

kernel32

GetCurrentDirectoryW GetTempPathW GetTempPathA GetModuleFileNameW CopyFileW CopyFileA DeleteFileW DeleteFileA SetCurrentDirectoryW SetCurrentDirectoryA RemoveDirectoryW CreateDirectoryA SetFileAttributesA SetFileAttributesW GetFileAttributesA GetFileAttributesW CreateFileA MoveFileW MoveFileA CreateDirectoryW GetCurrentDirectoryA FindNextFileW FindFirstFileW SetFilePointer CloseHandle GetFileTime SetFileTime ReadFile WriteFile GetFileSize FileTimeToSystemTime SystemTimeToFileTime CompareFileTime GetSystemTime GetLocalTime InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapValidate HeapUnlock HeapWalk HeapLock GetProcessHeaps GetVersionExA CreateFileW GetCurrentThreadId EncodePointer DecodePointer InterlockedExchange InterlockedCompareExchange DisableThreadLibraryCalls QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetFullPathNameA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess GetFullPathNameW GetModuleFileNameA FormatMessageA GetComputerNameW GetOEMCP GetACP GetTickCount Sleep GetLastError FindClose GetCPInfo IsDBCSLeadByte MultiByteToWideChar DeviceIoControl GetModuleHandleA GetDiskFreeSpaceA GetDriveTypeA FileTimeToLocalFileTime FreeLibrary WideCharToMultiByte SetLastError GetStdHandle GetFileType SetEndOfFile FlushFileBuffers CreateFileMappingA MapViewOfFile IsBadReadPtr UnmapViewOfFile LocalFileTimeToFileTime FindNextFileA FindFirstFileA GetProcAddress LoadLibraryA LocalAlloc CreateThread LocalFree

advapi32

RegDeleteValueA OpenSCManagerA CreateServiceA CloseServiceHandle CryptGetProvParam OpenServiceA StartServiceA ControlService UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase QueryServiceConfigA QueryServiceStatus CryptAcquireContextW CryptEnumProvidersA CryptDestroyKey CryptGenKey CryptGetUserKey CryptExportKey CryptImportKey CryptDeriveKey CryptDestroyHash CryptHashData CryptCreateHash AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA SetFileSecurityW CryptGenRandom CryptReleaseContext RegQueryValueExA RegSetValueExW RegSetValueExA RegEnumValueA CryptAcquireContextA RegCreateKeyExA RegOpenKeyExA GetUserNameA RegCloseKey DeleteService

crypt32

PFXVerifyPassword PFXImportCertStore CryptEncryptMessage CryptVerifyDetachedMessageSignature CryptVerifyMessageSignature CryptEncodeObject CryptSignMessage CryptDecryptMessage CryptMsgOpenToDecode CryptMsgUpdate CryptMsgClose CryptMsgGetParam CryptMsgControl CertAddEncodedCertificateToStore CertGetSubjectCertificateFromStore CertDeleteCertificateFromStore CertSaveStore CertAddCertificateContextToStore CertFindCertificateInStore CertOpenStore CertCloseStore CertVerifyRevocation CertFreeCertificateContext CertSetCertificateContextProperty CryptDecodeObject CertGetIntendedKeyUsage CertGetCertificateContextProperty CertDuplicateCertificateContext CertCreateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertNameToStrW

ws2_32

listen connect socket accept gethostbyname bind getsockname recv send WSAGetLastError gethostname closesocket __WSAFDIsSet htons inet_addr getpeername ntohs inet_ntoa ioctlsocket setsockopt getsockopt WSAStartup shutdown select

shell32

ShellExecuteA

mscoree

_CorDllMain

Netflix password changer + capture by RubiconT/HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d3046430cc6c9950f62555b24b5cf87ae84b8a2657c6327c0249369ebe6c34b1
MD5 913351ee35410a1a4b3a58f5151491b8
SHA1 12dacaf43d665973ec5c8c820ec367f4f409e2d9
SHA512 ee56bb9c1cf7f75b11f2361bfd12221f9bec2b80ab596514dfdd5675ed3785e28612b4b7ad3b356f54079f2d4ee3116afd36be07d1340d8032db7aa6aeafbc29
SSDEEP 1536:Td4MYY8XTlVmOzq1nZ8g8iPw4qpiN7kJew2puPJewiJewrWJTLrMNylELWskmrQO:xv+PmVYie4N7PphNjz8PIZLA8
TLSH
T15CD3B60572BEA622E3A7CB7DB4B161101B3968999403FBBD9CC461DC4476B8F4D52F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

137094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\stgrell\Source\Workspaces\htmlagilitypack\Trunk\HtmlAgilityPack\obj\Release\HtmlAgilityPack.pdb

Netflix password changer + capture by RubiconT/Netflix by RubiconT.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 9a34c075041e94bf4ef39c4a713cfcb9c3328f6a98db4c8d00ac410fad3c02d3
MD5 a7f198cb9e57c6c1d5f54f061b7bbc29
SHA1 e6f0621310786bb4e0d2387cc33acd2bc8d5054e
SHA512 1eacfbf7acfd5176c64ecfd7ddfc9410619a7eda9a55b53513c4ba5c55cd982efb5de921ab2fa81c0575660bbdbefcac09860e8f22c82f2d4e7aeeb0627c3323
SSDEEP 12288:LBwAwcjHJGXsVsATvWs+x5trFZfg4vXplPuFT358JpAYpHEbuM2uaPo8gReOv6:LBwAwMwsVsATvWs+xTfg4vXpwT3qJpAv
TLSH
T17CF46C107680C03FF562113219ADF2B895ADB9305B961ACB73D816BF9B796C15F3228F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Netflix password changer + capture by RubiconT/Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 575e30f98e4ea42c9e516edc8bbb29ad8b50b173a3e6b36b5ba39e133cce9406
MD5 c53737821b861d454d5248034c3c097c
SHA1 6b0da75617a2269493dc1a685d7a0b07f2e48c75
SHA512 289543f5eea472e9027030e24011bea1e49e91059241fe6eb732e78f51822313e47d1e4769fa1c9c7d6139f6a97dcfef2946836b3383e8643988bf8908162fb9
SSDEEP 6144:ZeC37wbJmJ5bd4m15M+S50cK7q2UGu7WEYEaWdDBLH5WHxJ16Wi/h4aBTBFFu4JD:p37Ogr2VAHx7JijBZdPfP
TLSH
T118B43A502BF89726F6FE2775F434061953F9F45AE67EEB4F9A4095AA1C837804C00BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

530998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net45\Newtonsoft.Json.pdb

Netflix password changer + capture by RubiconT/core32.cfg

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2768c17af7d2f15c3848d6dc32b34b94089c2199be35d40ce29fc6aec39cc50d
MD5 593e3c4e79aac503ecc36e6f3e4039d6
SHA1 d19a1d24b61d7358d50a99b35e3a8a119e66a783
SHA512 af03476b97d739e0d49417a3654c021ee7712897eb0f618d430aa5cb86ee021f9bf4f50cd68531e8bbb282f6ffb55d65bfe5c549cc09fa46ada95def33ad047f
SSDEEP 1536:7EhQKAntehqtpQlkK0wHHHvoooo3hB2a8I5ZlHZ+NQFuJa0NHXBPLkxdmGzYHF:uQZntudBcIJA9NFLM9Yl
TLSH
T128D3C8502710C82EF1190A78C996F2F86628AEA9FA17470735D2BD2D3C3E79D99035FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

129518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix password changer + capture by RubiconT/lib.lib

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Netflix password changer + capture by RubiconT/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Netflix password changer + capture by RubiconT/nsi.dll

IMPHASH 9f19b08ba92c5e2d2fffc1b3724649db
SHA256 d70fe697431eaa77eee2d98d9ecda7a9f00ead5295593d7417ac0fe1696fae47
MD5 f1c7a0b888ae21b85749dccc18cb1b39
SHA1 e83a09f7bbc2fd4da8797e4eba9c3073d04eb6dd
SHA512 4d03f7bac4701f8871a8598b8e07534526abbe907341dc569af1bd99b3825b160bef371d1b8d6d18b77b3fe97f4444ff567be58ed7ddfba13698999414e057fa
SSDEEP 384:rJ2VdkxG1umK0Y2fjxbLgWkVWtG4RrDBRJJ4a0lxBjno:t2VqG1um7hNCYGkr1PJio
TLSH
T17A9227B297044AC2CBE22DF219CAF567693C6F95572041DF0DEAA2C64C167C2FB3065E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Digest

da:67:7a:d1:ff:55:79:28:31:a7:01:25:ca:2c:32:d5:f1:e3:67:c5:65:ff:48:42:6b:d9:0e:c0:3f:11:33:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 18, 2019

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

10

Entry point

7840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsi.pdb

Netflix password changer + capture by RubiconT/xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5d9c2b1822bcaa71ddeaa5426d4312d8e174766ae8864c7add29d7f44cea87f2
MD5 bf1f76644bddd20339548ebacf7a48eb
SHA1 38114702114105eb3df3f74bf4c68ef7db436f47
SHA512 76132c9e29a0a3054cd41c56d5184951d392a2abd1995e14b34c40f14b154914a6990c107e7fcf4139344759ae6048e9ecf0bdaf0447c1cd589dfacbf901b7c5
SSDEEP 3072:sCMhzHWHfyqxjqCgRGAQIO7ScwpY3wisz0YsXhqnV+xnEd4:sCM52n4RSVPwIhqnV+xnEd
TLSH
T161A32A1437FE595BF7EF4778E470111443BAB9A92207CB6E1C5474AF08A2B908950FB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

108010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\User\Documents\Visual Studio 2015\Projects\xNet\obj\Release\xNet.pdb

STARS_NETFLIX_CHECKER/EasySecure.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1db80a27b8c3cc27343958432f3185b6f88465229de150bda451bf860f88e964
MD5 4b8d741e796b132c121e9d9b6ec2ff7d
SHA1 60426039cb87decc90d2b60564b32cb7b7e37798
SHA512 eaacad920f59fdaba2d8a8b1ee93321bb507ed49d59b74c3369ef911993fe3c45ba3bbb58fe44686a9ba4bc6341ce09484511a0cebae850ceb95ffddc360d239
SSDEEP 192:JKT7vXDbnzPr0rSjeZM1lPCmp/bUsJspCyCcwuDVeMjb4Eb7JjLrLD:JKT7vXDbnzPr0rSjeZSlPHisKkyCcwG5
TLSH
T195329505F3F88A20E87ED9B259B192504B75B6469DA1EA2F0CC340AA2D377740F74F6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\EasySoft\Documents\Visual Studio 2017\Projects\EasySecure.Core\EasySecure.Core\obj\Debug\EasySecure.Core.pdb

STARS_NETFLIX_CHECKER/Leaf.xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 939c8980bcb9bd9a2279714f6086714229e7af194ec4e32677c5a4ed96db5edd
MD5 42cf916df4ea1d300201ec9559b7bef3
SHA1 f58abe0ad5f3e033a9dbebcebd02692c5d35936d
SHA512 2d03d21b369b9784329573e8219553f4c6b3cae66515ebe7409154c7457e3cfb95f8dfac5bae57820ade2a5219dd7d10ce34d72ec8971b2fbb7024a5a23cc1ed
SSDEEP 3072:68eadOu2iOCIckQucNPlkZnVVkeLm/RV1oal:68BEu3OCIINWZnVV
TLSH
T122C3293577F84A1AE7EF8778E870521047BAFA496902DB6E5C0460DF1892B908D12FF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

123430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net452\Leaf.xNet.pdb

STARS_NETFLIX_CHECKER/MetroSuite 2.0.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8604bf2a1fe2e94dc1ea1fbd0cf54e77303493b93994df48479dc683580aa654
MD5 0d30a398cec0ff006b6ea2b52d11e744
SHA1 4ceebd9c6180a321c4d4f3cfb5cfc3952bf72b45
SHA512 8e06ff131a81e73b1ff5de78262701a11ecc2bcdaf41011f4e96f11c5372742478e70b6a0901b61953c21c95725532af8d785654405ec5066ad157e2143467cc
SSDEEP 3072:K6J2UBugOAI+yjNDWswy1MNo1EvnvkgvloSVQBjDifX0pPSRZ9KZdf8uvqtXfZBF:K6Jr8xhFzfOaa3xqQnQGTO
TLSH
T12D64A30512C8AE56E57D33F8062225A073B8AD129547E7193AFD30E91F73767ED0A38E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

305726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Martin\Documents\Visual Studio 2013\Projects\MetroSuite 2.0\MetroSuite 2.0\obj\Debug\MetroSuite 2.0.pdb

STARS_NETFLIX_CHECKER/Protect32.dll

IMPHASH 8420c9e80d53d716c9d682dfad563ea8
SHA256 c4bff67c99ffd034ad0af11fcce2befe93e60313d1d306d565af9cfba0129a6c
MD5 6caae90a0558d3079becd37a0c10dc83
SHA1 3d6a51b1f4851f1f77696c9f946a37a07138ed0a
SHA512 67780dbd0a0080bd5756f12101735e8a2ad0f85af0a93d539c313968b2e4fbd592d569eec385c99f434c6082359d88920da4ae096e9b00f0a3e6e2fd3c3a5781
SSDEEP 12288:JJ70bEMo5XfgrGc6D/3TcpvMQupPd2viuu+OeO+OeNhBBhhBBNE2ch528gkJSKkx:J9ovo5oh6zTzobBE2cb5DSb7kZQzIaL
TLSH
T1F7F49E61F6D7D27EE9CE01F2453C6E2E641D9A85173C9BE3A7E87A2D1D301C12A38247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

437589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep QueueUserWorkItem DeleteCriticalSection IsBadReadPtr GetProcAddress LoadLibraryW InterlockedCompareExchange InterlockedDecrement GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection GetModuleHandleW InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW InterlockedIncrement EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo IsProcessorFeaturePresent HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate HeapDestroy TlsAlloc TlsGetValue TlsSetValue TlsFree GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

STARS_NETFLIX_CHECKER/Protect64.dll

IMPHASH c7bb123507ad86be53b59f78d6765e94
SHA256 456a7c143c2203d63ad7af0443751344d9f8440f00da20b0388ce882943e56a1
MD5 4587741823c81e90cb59891145b0ca78
SHA1 8b710dc5ef1c1f8a1406c2b2490b4654a936fdcc
SHA512 a41c3266fad8585c7064c3afe76bfd5b0b7f65a4a28562af6c5b71b55ec89d747b8f8a35c585476eef2d81a80157b1b25bc7c633ffe0f83e993ec035b8e2bad2
SSDEEP 12288:QGpgv5t/VqUu0Nj7pWYgeWYg955/155//ryYzA5kSilNjLIUglo4o:Kv5tzuUkrdzA5kvlNjLIvf
TLSH
T104055C2A7A6981A6C076D03D8AA78656FBF274440B358BDB1191437E2F33BF45E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

453456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb

kernel32

MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx GetLastError SetLastError CreateFileMappingW CloseHandle Sleep DeleteCriticalSection GetModuleHandleW LoadLibraryW GetProcAddress GetModuleFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection QueueUserWorkItem InitializeCriticalSection LocalFree FlushFileBuffers SetStdHandle WriteConsoleW SetFilePointer GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc MultiByteToWideChar GetSystemTimeAsFileTime GetCurrentThreadId FlsSetValue GetCommandLineA RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess LCMapStringW GetCPInfo HeapSize ExitProcess WriteFile GetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapSetInformation GetVersion HeapCreate HeapDestroy FlsGetValue FlsFree FlsAlloc GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount GetCurrentProcessId HeapReAlloc

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

oleaut32

SafeArrayDestroy SysFreeString SysAllocString SafeArrayPutElement SafeArrayGetUBound SafeArrayGetElement VariantInit VariantCopy SafeArrayGetLBound VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector

winmm

timeGetTime

mscoree

CorBindToRuntimeEx

Name

.text

Size

543KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE

Name

data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

STARS_NETFLIX_CHECKER/STARS_NETFLIX_CHECKER.exe

IMPHASH 7037febae0bd70529b47680e3eb5c00d
SHA256 ad446b782a663d67ba502b3eb6cc0053382cea2caddcc417a44ec6359d6706f6
MD5 ce5328ff29e741944152667a6adc1ce7
SHA1 cee0446ca32faf7f6a8620a0354bc2b67392ee5f
SHA512 b1475af6a100badb3a272e218ff8a2af43831688cac9cf20d69407ea07bdd77b13d59da89b9a2add2d749a63a6f0e359a438e538db11d5f51f9124ce78e8ce28
SSDEEP 24576:k1wAwJksVsSzvWsPQNq5Yvmw1T3KJI9YL7zbFG:k1wAwOsVsSJQNq5Yvmwx3KJI9YLDFG
TLSH
T12BF45C1077808037E26211320D9BE2BB95ADB8390B993BC77F88177E9B655F17B3524B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

256543

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Script\app3\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

607KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

STARS_NETFLIX_CHECKER/alocal.bin

IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
SHA256 d4394b8ed2b9ae91bef809e728453636a249ad4e25ff6185be013ac885bb6f53
MD5 0cf8d02991b9b797b5776ca9935ce901
SHA1 29cf8c07faa07a9d70bb123d34947eef3d1d1cd3
SHA512 8f0c2e50ab2ea58c23f7d1332a82567c7572196cc5b41503c157c0d4794862f630611088ca140291875a03c12579f406b916bebbec57a406e190e8d6a9e25575
SSDEEP 6144:MnpKnqt3lO3f5kXUGmo+8y6ds204eMreKqiLfLI0g5NMHMDctQ3:sKqt3l8GcPUdsqeMrtq8kNKW
TLSH
T184943B1475B2D1B5E161C133761BEBB059697430A72339DBB38427AC1C606CEBBBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

300188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

STARS_NETFLIX_CHECKER/core.cfg

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3123962badec646d074227ce5885ef3ce55b05f3662620e142114ccbcf2d26cd
MD5 f6bd464c927af988aca2744c7b7477fd
SHA1 b4f4cb824fbd2ae91677cc35a454d040841ee14f
SHA512 1af725d2c1ae5e2e4c136304191ceeaece119908051fb94a0ddef93edc2840325a6bced8bd7583f42921ecf7c144702683eb90c98ed3882f5c65e924249e9ea3
SSDEEP 1536:u7kw/bVKfPeuH6lCLznnZpr0OBtBlunQK7E4b2Vcl:u7kw/bUH9oQK7E4bMY
TLSH
T1FBD3E7DA134FA469C38E24B84E83F5178139FD5F0A4D7BA16D48F30C9A5E93436DEA12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

102094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

STARS_NETFLIX_CHECKER/libcef.lib

IMPHASH d313ecd002c12a80284c87d3cd0fce06
SHA256 00289c2fe9078c8b3ca899ef269179235a57c75777d7c65fbf408c03acfac04b
MD5 7830a4ced35b10d5c52f1cb580e5be1a
SHA1 5b671be8b002185cf91c212bb9fb57ddbeffcb36
SHA512 8365202477e151c4ae0a13d6df4026379db84c9c13d8b6704b7c4e18c97c41db7436d08b0f87b8ac31957ccdf0d7b374ad6ff21d825781a46c9a078c4fdbac74
SSDEEP 6144:50M13u/UbFV5X55WxbtOj4rG4//ng0eqqt7T/gWV:50MJu8hV5XexbtOj4rR/eb/gq
TLSH
T136644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

148149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

STARS_NETFLIX_CHECKER/readme.txt

SHA256 764c9f7719f9caaa9bc649e18382a10c552a25af458c08e3c7197333b6b372cd
MD5 e776ebd851ea322cb9554a1bcb147844
SHA1 8413a07dc69729a6534b3831f1662e3c99eda09f
SHA512 506d99539b07d563cacb493a7844f024653e0fdf44192efa8c9b1481dba944e451eb7b5b0f4ff1d369115fac9122b261b270f10a6015b14f8ead14904398efeb
TLSH
T145B01256808001719633D3B096D222051221E64A24002E03368C41150B7524C6DF0505
MD5 SHA1 SHA512 TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Sharing

General

Malware Config

Signatures

File Explorer

Netflix-Checkers-Generators-and-Accounts-Tools-Pack.zip

10K NETFLIX ACCOUNTS - MAILACCESS.txt

Dark Star Netflix Checker By Scorpio/Bunifu_UI_v15232.dll

kernel32

advapi32

oleaut32

winmm

mscoree

generic

Dark Star Netflix Checker By Scorpio/Bunifu_UI_v15264.dll

kernel32

advapi32

oleaut32

winmm

mscoree

generic

Dark Star Netflix Checker By Scorpio/Netflix Checker By Scorpio.exe

kernel32

version

generic

Dark Star Netflix Checker By Scorpio/api32.lib

kernel32

generic

Dark Star Netflix Checker By Scorpio/libcef.lib

kernel32

winhttp

generic

Dark Star Netflix Checker By Scorpio/nssdbm3.lib

mscoree

dotnet

Dark Star Netflix Checker By Scorpio/xNet.dll

mscoree

dotnet

Easy Checker Netflix/Bunifu.Core.dll

mscoree

dotnet

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuButton.dll

mscoree

dotnet

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuPages.dll

mscoree

dotnet

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuRadioButton.dll

mscoree

dotnet

Easy Checker Netflix/Bunifu.UI.WinForms.BunifuToolTip.dll

mscoree

dotnet

Easy Checker Netflix/Bunifu_UI_v1.5.3.dll

mscoree

dotnet

Easy Checker Netflix/Easy Checker - Netflix.exe

kernel32

version

generic

Easy Checker Netflix/Leaf.xNet.dll

mscoree

dotnet

Easy Checker Netflix/Protect32.dll

kernel32

advapi32

oleaut32

winmm

mscoree

generic

Easy Checker Netflix/Protect64.dll

kernel32

advapi32

oleaut32

winmm

mscoree

generic

Easy Checker Netflix/Qt5Core.bin

mscoree

dotnet