okitashub180.zip
- SHA256 f32b62a4c4fc42f1d91bd85538eeeb34045fed4c7ce19fa8dca3142239cff952
Behavioral task
behavioral1
Sample
okitas_takeover.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
900 seconds
Behavioral task
behavioral2
Sample
updater.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
x_agent.exe
Resource
win11-20260513-en
windows11-21h2-x64
14 signatures
900 seconds
General
- Target okitashub180.zip
- Size 215.6MB
- Sample260822-g5vb9swvbv
- SHA256 f32b62a4c4fc42f1d91bd85538eeeb34045fed4c7ce19fa8dca3142239cff952
- MD5 0e778c72743e4f4c210d205b861bc287
- SHA1 46073697428d7f49a1d05b2591fb7f9c061f5937
- SHA512 413fee67d166a919d7389b55e73ebec6a61b0b03150c140daddbf1c4987bdf765c9ccab37ac6f8b8613d12000b25899d71ae73d98c91bf462bb7db18b7f3f92f
- SSDEEP 6291456:xTrbKTV+RkPDUE3Z7W9vVPCeaHOvusNSpbaB2+BH:xveTMiPXyVP7a/pbalBH
- TLSH T1A8B8337081F4812305B699D34E950FA09BF79989D7189D026FEF75E305E03E687AF2AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 3 IoCs
resource yara_rule static1/unpack001/okitas_takeover.exe pyinstaller static1/unpack001/updater.exe pyinstaller static1/unpack001/x_agent.exe pyinstaller - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/okitas_takeover.exe unpack001/updater.exe unpack001/x_agent.exe
File Explorer
-
okitashub180.zip.zip 215.6MB
-
okitas_takeover.exe.exe 109.8MB
-
okitas_takeover.pyc11KB
-
updater.exe.exe 37.4MB
-
update_apply.pyc.wsf 22KB
-
x_agent.exe.exe 69.9MB
-
x_agent.pyc.ps1 256KB
okitas_takeover.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 f7cd77db9324ce90788f3bc65ad65078d92f8c637a57516447b263e359b61042
- MD5 8c0513a97319edb9f203cdd6029a6353
- SHA1 c4de0537a70b806390eae3dbb8ab515917dbcaa7
- SHA512 89eae4ca847b5bff7626f2367e8f419bc9b07978782a55928ccb8725d89ef19074e821a4ef0062593ae26ffc97e52c66a90821026161a77ab9f3f0cbe71a99fd
- SSDEEP 3145728:7mmXCYzMSEvMArWNwynXThzqMWt8wwrq9V9K3a:KmWtvMfThzqrKrqm3
- TLSH T15F483390A5B88047D4B7557085D2C97193F36CEB4B2885A35FE88EA338C31D4DBBE26D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
265KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
okitas_takeover.pyc
- SHA256 acaf4de4f18ed2b1c9c3de3057fea3d26da14cd9665db9322564baa8f1bb9431
- MD5 5f80d169d77f069d0a0a1cc2b7a7f7f9
- SHA1 b1a6db362c7f37f9c5b89b9e897122352fc9c660
- SHA512 3dba082e6cd985c31a66ecd6418c345168c207b9a2ced2b60fe7b54c549641270ea48a494e7d3e00c7a846009df9d96691be0d705c1a7e624ad9ca780a1a3dd6
- SSDEEP 192:DGtiHXdv04wNdUENWcJetOBM86qMmh+TH/RsuLlQ:DGtiN8pNJNW+i8HMY+T7i
- TLSH T1D132F64B7B56C173FC60A2B488263B1BA73089767305D76B22EFC0289C170719CA62DF
- MD5 SHA1 SHA512 SSDEEP TLSH
updater.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 b8e515b4a5d2bfea70a08aba55d88beb442038d133f63244cd6b34bf138cc0e7
- MD5 126530c3b9f2aa137d49df3983c32868
- SHA1 23aeb4ab7c17f76b6d6ea73607a00d71e18df48f
- SHA512 ee2d0af3193e7a76b6613f9cd267af395381ba81ca8a36858d3cc7fb1f2dda71d9534c74c1ba7021b0afa93ab5ef6c7e5e7a99910be557db0028d54af0df85fb
- SSDEEP 786432:A21nbhVEHCYFq5jyW8YW+e5RJ9M/qMbCYmjAwzJttNw53L0CxcDiDD5thItdKt/:N1ZjyW7W+eHY/qMbBYtt+5ADwNIzG/
- TLSH T1368733E4B3D84891E8A2467B88C3C6759BA17CB68374C6C34FE88D6339570C49EBE754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
265KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
update_apply.pyc
- SHA256 c9d6f3acdab1fbfe9f2fb4f8b10638d0942c0ecb5fee010807f0f20b0cce5949
- MD5 8728105931d3189a262cdf14f0c78c70
- SHA1 394be57077a947a134cfad69a4b96b4dd0888ac5
- SHA512 bc6d0a4b2c329958280ee2ad7c4709e19ba346128d7f0af149b4e14a12962b7f3a59b32a56058ed0ae81df6efa92c59962d564d9a434efc0abe53f114ba703d1
- SSDEEP 384:kcpoWzKrspRayZcKovHvTjh0HPhDjDc02FxqQuXV18OpgMMMflj9:kc302jZ+vTjaHhs5xqZFtguflj9
- TLSH T192B2298A6716C17BFCA8F1F4902A2367F332C1B5731193A321AB81757E07174AD681DC
- MD5 SHA1 SHA512 SSDEEP TLSH
x_agent.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 53704316f2b4289e07199e5332e6abaecd06af11b0c38fa1d371f4fea922f875
- MD5 90cc29af22a6e2783e0db12420db39b9
- SHA1 ef755098f4fe2f04790310bb22dc87a373c1e7c7
- SHA512 69a13b8f2d25030c3440d390a1d726fb30388b52fd2497e0289ac7ea308de57ffc7278e9a166c47a04de7bc43a0f485e1243603a42c9a44fedb2807853e78ef5
- SSDEEP 1572864:i1gjyWRTW+eHO+Dw/AF/NerW0c/ohPXTaUbyU0NpQC3a:Agm/sMArWNwNXThG3QC3a
- TLSH T15BF7339098E80196E8BB507086E6CAF2D3B36CFB4B54469BABF4CD4339C31D48DB615D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
265KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
x_agent.pyc
- SHA256 2c7d1276399a96b69c902ac2c97a46a1188900081d53f7008aa79e4e04e1ae70
- MD5 4a10c072f302e65c9c04af6569086403
- SHA1 de1791122a1b959a6f68bc9a1a6789471d9e9b6e
- SHA512 1320ef9317fc99cec584171469bfd269a89967944d18da6f1e43edaeddb334c0a60d7473697232c43aec7eb56d40a12b44613754e998c33da26fe10bf3fc7c48
- SSDEEP 3072:mr+dndDFONxGoV14hhs4DowBdkDzWM7xnys0f5ggj4GrSsQXyz84:mr+dndDFEXWNowBdTyxn05plrSs2yzX
- TLSH T15B4439893763E877FC50B2B4881A175FF32091B57B01CB1B39AF9168AF431658C912DE
- MD5 SHA1 SHA512 SSDEEP TLSH