NjRat-0.7D-main.zip
- SHA256 25365152ad36e5dfed6b05153f5c1477160383af2fae36a24d59af14d76f5155
Overview
overview
10Static
static
10NjRat-0.7D-main.zip
windows10-2004-x64
1NjRat-0.7D...ICENSE
windows10-2004-x64
3NjRat-0.7D...ot.png
windows10-2004-x64
1NjRat-0.7D...on.zip
windows10-2004-x64
1GeoIP.dat
windows10-2004-x64
3Plugin/pw.rar
windows10-2004-x64
1Settings.ini
windows10-2004-x64
1Stub.il
windows10-2004-x64
3Stub.xml
windows10-2004-x64
3NjRat-0.7D...on.zip
windows10-2004-x64
1GeoIP.dat
windows10-2004-x64
3README.md
windows10-2004-x64
3stubs/Bsod.egg
windows10-2004-x64
3stubs/Exe.egg
windows10-2004-x64
3stubs/Hide.egg
windows10-2004-x64
3stubs/Mpress.egg
windows10-2004-x64
3stubs/ReGKey.egg
windows10-2004-x64
3stubs/Sound/Sound.wav
windows10-2004-x64
6stubs/VN.egg
windows10-2004-x64
3stubs/copy.egg
windows10-2004-x64
3stubs/dir.egg
windows10-2004-x64
3stubs/host.egg
windows10-2004-x64
3stubs/regch.egg
windows10-2004-x64
3stubs/regname.egg
windows10-2004-x64
3stubs/startupch.egg
windows10-2004-x64
3stubs/startupname.egg
windows10-2004-x64
3stubs/task.egg
windows10-2004-x64
3user.config
windows10-2004-x64
3NjRat-0.7D...on.zip
windows10-2004-x64
1NjRat-0.7D...on.zip
windows10-2004-x64
1NjRat-0.7D...on.zip
windows10-2004-x64
1NjRat-0.7D...DME.md
windows10-2004-x64
3Behavioral task
behavioral1
Sample
NjRat-0.7D-main.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
NjRat-0.7D-main/LICENSE
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral3
Sample
NjRat-0.7D-main/NjRat-Screenshot.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral4
Sample
NjRat-0.7D-main/NjRat.0.7D.Danger.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
GeoIP.dat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral6
Sample
Plugin/pw.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
Settings.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral8
Sample
Stub.il
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral9
Sample
Stub.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral10
Sample
NjRat-0.7D-main/NjRat.0.7D.Golden.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral11
Sample
GeoIP.dat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
README.md
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
stubs/Bsod.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral14
Sample
stubs/Exe.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral15
Sample
stubs/Hide.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral16
Sample
stubs/Mpress.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral17
Sample
stubs/ReGKey.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral18
Sample
stubs/Sound/Sound.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral19
Sample
stubs/VN.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral20
Sample
stubs/copy.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral21
Sample
stubs/dir.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral22
Sample
stubs/host.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral23
Sample
stubs/regch.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral24
Sample
stubs/regname.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral25
Sample
stubs/startupch.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral26
Sample
stubs/startupname.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral27
Sample
stubs/task.egg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral28
Sample
user.config
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral29
Sample
NjRat-0.7D-main/NjRat.0.7D.Green.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral30
Sample
NjRat-0.7D-main/NjRat.0.7D.Lime.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral31
Sample
NjRat-0.7D-main/NjRat.0.7D.Single.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
NjRat-0.7D-main/README.md
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
General
- Target NjRat-0.7D-main.zip
- Size 43.3MB
- Sample260910-k9fapagd44
- SHA256 25365152ad36e5dfed6b05153f5c1477160383af2fae36a24d59af14d76f5155
- MD5 11372ec11b77529f7d4f35b49b148d8a
- SHA1 ef241aa786bef1565054bb8ba4fed2fbecf7118d
- SHA512 89f3059d924a3b0dcba4ec5f2d797a36d42e271dab4fd8e48d3e16125ead38471182e45fd85658e3acc3758039c43e66dc41290e289cdf1d3185e22f1fd526f2
- SSDEEP 786432:l2Y2Y79Ec8uOYQpw1hdDTUf/qPrPR5DT4s3Hwa6iRr9etfx16EXygj4LvOVG:lI49/8kwwTJT1PnDTL3n6iRAtfLVX1eN
- TLSH T1A1A7332DC439B08AF5A0631E14D55E70D5BC1EFAB502BE697D8CD3E4E709CED9AB8801
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
C2
-
:
Mutex
-
[RNVD]
Attributes
-
reg_key
[RNVD]
-
splitter
|Hassan|
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
hacked
C2
-
185.204.1.236:1111
Mutex
-
c15cd7ce3aae2bd6036dd10a665f69f9
Attributes
-
reg_key
c15cd7ce3aae2bd6036dd10a665f69f9
-
splitter
|'|'|
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack006/njRAT-0.8.0-LIME-EDITION-main/NjRat Lime Edition 0.8.0.exe ConfuserEx - Unsigned PE 89 IoCs
Checks for missing Authenticode signature.
resource unpack002/Extensions/Anti.exe unpack002/Extensions/Compressor/Rpx.exe unpack002/Extensions/Compressor/Rug.Packing.Reflection.dll unpack002/Extensions/dotNET_Reactor.exe unpack002/Extensions/mpress.exe unpack002/Mono.Cecil.dll unpack002/NjRat 0.7D Danger Edition.exe unpack002/Plugin/1.dll unpack002/Plugin/10.dll unpack002/Plugin/2.dll unpack002/Plugin/3.dll unpack002/Plugin/4.dll unpack002/Plugin/5.dll unpack002/Plugin/6.dll unpack002/Plugin/7.dll unpack002/Plugin/8.dll unpack002/Plugin/9.dll unpack002/Plugin/Andex.dll unpack002/Plugin/Gren.dll unpack002/Plugin/P.dll unpack002/Plugin/cam.dll unpack002/Plugin/ch.dll unpack002/Plugin/chrome.dll unpack002/Plugin/cmd.dll unpack002/Plugin/dneg.dll unpack002/Plugin/explorer.dll unpack002/Plugin/explorerr.dll unpack002/Plugin/firefox.dll unpack002/Plugin/hms.dll unpack002/Plugin/inf.dll unpack002/Plugin/mic.dll unpack002/Plugin/mpress.exe unpack002/Plugin/plg.dll unpack002/Plugin/ps.dll unpack002/Plugin/pw.dll unpack003/pw.dll unpack002/Plugin/red.dll unpack002/Plugin/rq.dll unpack002/Plugin/sc2.dll unpack002/Plugin/spark.dll unpack002/Plugin/t.dll unpack002/Plugin/vu.dll unpack002/WinMM.Net.dll unpack004/InjectIcon.dll unpack004/Mono.Cecil.dll unpack004/NjRat 0.7D Golden Edition - Rus.exe unpack004/Plugin/AntiProcess.dll unpack004/Plugin/cam.dll unpack004/Plugin/ch.dll unpack004/Plugin/mic.dll unpack004/Plugin/plg.dll unpack004/Plugin/pw.dll unpack004/Plugin/sc2.dll unpack004/WinMM.Net.dll unpack004/stubs/Anti.bin unpack004/stubs/Stub.bin unpack004/stubs/dlentrypoint.bin unpack004/stubs/dlnormal.bin unpack004/stubs/mpress.exe unpack005/NjRat 0.7D Green Edition by im523.exe unpack005/Plugin/cam.dll unpack005/Plugin/ch.dll unpack005/Plugin/mic.dll unpack005/Plugin/plg.dll unpack005/Plugin/pw.dll unpack005/Plugin/sc2.dll unpack005/Server.exe unpack005/WinMM.Net.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Mono.Cecil.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/NjRat Lime Edition 0.8.0.exe unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin Compiler.exe unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/cam.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/ch.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/mic.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/pass2.exe unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/plg.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/pw.dll unpack007/pw.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/sc2.dll unpack006/njRAT-0.8.0-LIME-EDITION-main/Plugin/seed.exe unpack006/njRAT-0.8.0-LIME-EDITION-main/WinMM.Net.dll unpack008/NjRat 0.7D.exe unpack008/Plugin/cam.dll unpack008/Plugin/ch.dll unpack008/Plugin/mic.dll unpack008/Plugin/plg.dll unpack008/Plugin/pw.dll unpack008/Plugin/sc2.dll unpack008/WinMM.Net.dll
File Explorer
-
NjRat-0.7D-main.zip.zip 43.3MB
-
NjRat-0.7D-main/LICENSE34KB
-
NjRat-0.7D-main/NjRat-Screenshot.png.png 735KB
-
NjRat-0.7D-main/NjRat.0.7D.Danger.Edition.zip.zip 15.8MB
-
ER/Abrairnotes.dll55B
-
ER/Abrier.dll79B
-
ER/Apraircam.dll83B
-
ER/Bipe.dll65B
-
ER/Delet A.dll83B
-
ER/Delettemp.dll199B
-
ER/Destentrnet.dll33B
-
ER/User.dll923B
-
ER/dcr.dll37B
-
ER/destedmous.dll.bat 160B
-
ER/dromous.dll67B
-
ER/infctcmd.dll53B
-
ER/laxer.dll58B
-
ER/logoff.dll37B
-
ER/maltExe.dll60B
-
ER/past0.dll183B
-
ER/prar.dll3B
-
ER/tela.dll76B
-
ER/trafs.dll140B
-
ER/windefnder.dll117B
-
Extensions/Anti.exe.exe 23KB
-
Extensions/Compressor/Rpx.exe.exe 147KB
-
Extensions/Compressor/Rug.Packing.Reflection.dll.dll 11KB
-
Extensions/dotNET_Reactor.exe.exe 5.9MB
-
Extensions/mpress.exe.exe 101KB
-
GeoIP.dat1.2MB
-
Mono.Cecil.dll.dll 305KB
-
NjRat 0.7D Danger Edition.exe.exe 8.2MB
-
Plugin/1.dll.exe 367KB
-
Plugin/10.dll.exe 1.1MB
-
Plugin/2.dll.exe 271KB
-
Plugin/3.dll.exe 223KB
-
Plugin/4.dll.exe 202KB
-
Plugin/5.dll.exe 292KB
-
Plugin/6.dll.exe 628KB
-
Plugin/7.dll.exe 31KB
-
Plugin/8.dll.exe 259KB
-
Plugin/9.dll.exe 469KB
-
Plugin/Andex.dll.exe 100KB
-
Plugin/Duck.dll.exe 63KB
-
Plugin/Gren.dll.exe 155KB
-
Plugin/P.dll.exe 29KB
-
Plugin/cam.dll.dll 63KB
-
Plugin/ch.dll.exe 75KB
-
Plugin/chrome.dll.exe 29KB
-
Plugin/cmd.dll.exe 29KB
-
Plugin/dneg.dll.exe 176KB
-
Plugin/explorer.dll.exe 29KB
-
Plugin/explorerr.dll.exe 29KB
-
Plugin/firefox.dll.exe 29KB
-
Plugin/hms.dll.exe 61KB
-
Plugin/inf.dll.dll 19KB
-
Plugin/mic.dll.dll 50KB
-
Plugin/mpress.exe.exe 101KB
-
Plugin/pd.dll139B
-
Plugin/plg.dll.dll 28KB
-
Plugin/ps.dll.exe 29KB
-
Plugin/pw.dll.exe 403KB
-
Plugin/pw.rar.rar 325KB
-
pw.dll.exe 403KB
-
Plugin/red.dll.exe 61KB
-
Plugin/rq.dll.dll 23KB
-
Plugin/sc2.dll.dll 12KB
-
Plugin/spark.dll.exe 29KB
-
Plugin/t.dll.exe 29KB
-
Plugin/vu.dll.exe 28KB
-
Settings.ini15B
-
Stub.il1.2MB
-
Stub.manifest.xml 487B
-
WinMM.Net.dll.dll 43KB
-
NjRat-0.7D-main/NjRat.0.7D.Golden.Edition.zip.zip 1.8MB
-
GeoIP.dat1.2MB
-
InjectIcon.dll.dll 13KB
-
Mono.Cecil.dll.dll 305KB
-
NjRat 0.7D Golden Edition - Rus.exe.exe 1.9MB
-
Plugin/AntiProcess.dll.exe 16KB
-
Plugin/cam.dll.dll 62KB
-
Plugin/ch.dll.dll 23KB
-
Plugin/mic.dll.dll 48KB
-
Plugin/plg.dll.dll 28KB
-
Plugin/pw.dll.dll 251KB
-
Plugin/sc2.dll.dll 12KB
-
README.md50B
-
WinMM.Net.dll.dll 43KB
-
stubs/Anti.bin.exe 12KB
-
stubs/Bsod.egg5B
-
stubs/Exe.egg11B
-
stubs/Hide.egg5B
-
stubs/Mpress.egg5B
-
stubs/ReGKey.egg45B
-
stubs/Sound/Sound.wav23KB
-
stubs/Stub.bin.exe 44KB
-
stubs/VN.egg6B
-
stubs/copy.egg5B
-
stubs/dir.egg6B
-
stubs/dlentrypoint.bin.exe 11KB
-
stubs/dlnormal.bin.exe 11KB
-
stubs/host.egg9B
-
stubs/mpress.exe.exe 101KB
-
stubs/regch.egg5B
-
stubs/regname.egg14B
-
stubs/startupch.egg5B
-
stubs/startupname.egg11B
-
stubs/task.egg5B
-
user.config93B
-
NjRat-0.7D-main/NjRat.0.7D.Green.Edition.zip.zip 2.2MB
-
GeoIP.dat1.2MB
-
NjRat 0.7D Green Edition by im523.exe.exe 1.6MB
-
Plugin/cam.dll.dll 63KB
-
Plugin/ch.dll.dll 24KB
-
Plugin/mic.dll.dll 50KB
-
Plugin/plg.dll.dll 28KB
-
Plugin/pw.dll.dll 251KB
-
Plugin/sc2.dll.dll 12KB
-
Server.exe.exe 37KB
-
Sound/Sound.wav643KB
-
Stub.il.ps1 399KB
-
Stub.manifest.xml 487B
-
WinMM.Net.dll.dll 43KB
-
nj_users/VM-РџРљ_vm_602F4037/Keylog.rtf.rtf 182B
-
nj_users/XTREME-HPHU46T6_Администратор_EE0C994/Keylog.rtf.rtf 397B
-
NjRat-0.7D-main/NjRat.0.7D.Lime.Edition.zip.zip 13.5MB
-
njRAT-0.8.0-LIME-EDITION-main/GeoIP.dat1.1MB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (1).ico9KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (10).ico31KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (11).ico66KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (12).ico66KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (13).ico227KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (2).ico9KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (3).ico264KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (4).ico11KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (5).ico97KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (6).ico361KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (7).ico361KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (8).ico361KB
-
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (9).ico97KB
-
njRAT-0.8.0-LIME-EDITION-main/Mono.Cecil.dll.dll 305KB
-
njRAT-0.8.0-LIME-EDITION-main/NjRat Lime Edition 0.8.0.exe.exe 5.4MB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin Compiler.exe.exe 352KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/cam.dll.dll 63KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/ch.dll.dll 12KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/mic.dll.dll 49KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/pass2.exe.exe 915KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/plg.dll.dll 28KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/pw.dll.dll 39KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/pw.zip.zip 224KB
-
pw.dll.dll 251KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/sc2.dll.dll 12KB
-
njRAT-0.8.0-LIME-EDITION-main/Plugin/seed.exe.exe 1.9MB
-
njRAT-0.8.0-LIME-EDITION-main/README.md1KB
-
njRAT-0.8.0-LIME-EDITION-main/Support/Media/Best Settings For Crypter.PNG.png 58KB
-
njRAT-0.8.0-LIME-EDITION-main/Support/Media/Setup.mp45.3MB
-
njRAT-0.8.0-LIME-EDITION-main/Support/Read-Me.html.html 3KB
-
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/ransomware.jpg.jpg 431KB
-
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/wallpaper (1).jpg.jpg 231KB
-
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/wallpaper (2).jpg.jpg 161KB
-
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/wallpaper (3).jpg.jpg 229KB
-
njRAT-0.8.0-LIME-EDITION-main/WinMM.Net.dll.dll 43KB
-
njRAT-0.8.0-LIME-EDITION-main/image.png.png 63KB
-
NjRat-0.7D-main/NjRat.0.7D.Single.Edition.zip.zip 9.2MB
-
GeoIP.dat1.1MB
-
Icons/Bokehlicia-Captiva-Atom.ico190KB
-
Icons/Bokehlicia-Captiva-Blender.ico179KB
-
Icons/Bokehlicia-Captiva-Firewall-config.ico177KB
-
Icons/Bokehlicia-Captiva-Nvidia-settings.ico177KB
-
Icons/Bokehlicia-Captiva-Utilities-system-monitor.ico176KB
-
Icons/Bokehlicia-Captiva-Web-slack.ico182KB
-
Icons/Carlosjj-Microsoft-Office-2013-Access.ico162KB
-
Icons/Carlosjj-Microsoft-Office-2013-Excel.ico161KB
-
Icons/Carlosjj-Microsoft-Office-2013-InfoPath.ico160KB
-
Icons/Carlosjj-Microsoft-Office-2013-Lync.ico161KB
-
Icons/Carlosjj-Microsoft-Office-2013-Office.ico160KB
-
Icons/Carlosjj-Microsoft-Office-2013-Outlook.ico162KB
-
Icons/Carlosjj-Microsoft-Office-2013-PowerPoint.ico161KB
-
Icons/Carlosjj-Microsoft-Office-2013-Word.ico161KB
-
Icons/Ccard3dev-Dynamic-Yosemite-Numbers.ico163KB
-
Icons/Chrisbanks2-Cold-Fusion-Hd-Radar.ico158KB
-
Icons/Cornmanthe3rd-Plex-Android-App-drawer.ico73KB
-
Icons/Cornmanthe3rd-Plex-Android-Baconreader.ico73KB
-
Icons/Cornmanthe3rd-Plex-Android-Ebay.ico73KB
-
Icons/Graphicloads-Colorful-Long-Shadow-Analytics.ico163KB
-
Icons/Graphicloads-Colorful-Long-Shadow-Cloud.ico164KB
-
Icons/Graphicloads-Colorful-Long-Shadow-Favourite.ico165KB
-
Icons/Graphicloads-Colorful-Long-Shadow-Restaurant.ico165KB
-
Icons/Graphicloads-Polygon-Cart-add.ico166KB
-
Icons/Graphicloads-Seo-Services-Pay-per-click.ico166KB
-
Icons/Harwen-Red-Christmas-Home.ico223KB
-
Icons/Harwen-V-Day-Valentines-Day-Honey.ico422KB
-
Icons/Harwen-V-Day-Valentines-Day-Present.ico422KB
-
Icons/Hopstarter-Sleek-Xp-Basic-Money.ico290KB
-
Icons/Hopstarter-Sleek-Xp-Software-Opera.ico251KB
-
Icons/Iconka-St-Patricks-Day-Hat-tophat.ico173KB
-
Icons/Icons-Land-Weather-Moon-Phase-Full.ico363KB
-
Icons/Icons-Land-Weather-Sleet.ico363KB
-
Icons/Icons8-Windows-8-Logos-Xbox.ico162KB
-
Icons/Icons8-Windows-8-Security-Security-Checked.ico161KB
-
Icons/Iconshock-Trendy-Guys-Andrew.ico139KB
-
Icons/Indeepop-Crazy-Crown.ico83KB
-
Icons/Johanchalibert-Mac-Osx-Yosemite-Safari.ico215KB
-
Icons/Kevin-Thompson-Love-And-Breakup-Love-box.ico182KB
-
Icons/Paddy-Web20rigami-Firefox.ico204KB
-
Icons/Petalart-Business-Cloud-upload.ico33KB
-
Icons/Ph03nyx-Super-Mario-Mushroom-Super.ico134KB
-
Icons/Photoshopedia-Xedia-Firefox.ico422KB
-
Icons/Tooschee-Misc-Present.ico185KB
-
Icons/Tooschee-Misc-Sync.ico187KB
-
Icons/Wallpaperfx-3d-Softwarefx-Acrobat-Reader.ico197KB
-
Icons/Wallpaperfx-3d-Softwarefx-Chrome.ico226KB
-
Icons/Wallpaperfx-3d-Softwarefx-Dreamviewer.ico215KB
-
Icons/Wallpaperfx-3d-Softwarefx-Facebook.ico198KB
-
Icons/Wallpaperfx-3d-Softwarefx-Firefox.ico239KB
-
Icons/Wallpaperfx-3d-Softwarefx-ITunes.ico227KB
-
Icons/Wallpaperfx-3d-Softwarefx-Illustrator.ico208KB
-
Icons/Wallpaperfx-3d-Softwarefx-Photoshop.ico214KB
-
Icons/Wallpaperfx-3d-Softwarefx-Quicktime.ico235KB
-
Icons/Wallpaperfx-3d-Softwarefx-Safari.ico231KB
-
Icons/Wallpaperfx-3d-Softwarefx-Skype.ico228KB
-
Icons/Wallpaperfx-3d-Softwarefx-Thunderbird.ico227KB
-
Icons/Wallpaperfx-3d-Softwarefx-Utorrent.ico223KB
-
Icons/Wallpaperfx-3d-Softwarefx-Vlc.ico204KB
-
Icons/Wallpaperfx-3d-Softwarefx-Winamp.ico206KB
-
Icons/Wallpaperfx-3d-Softwarefx-Windows-Media-Player.ico208KB
-
Icons/Wallpaperfx-3d-Softwarefx-Yahoo.ico223KB
-
Icons/Wallpaperfx-3d-Softwarefx-Youtube.ico207KB
-
NjRat 0.7D.exe.exe 8.5MB
-
Plugin/cam.dll.dll 99KB
-
Plugin/ch.dll.dll 45KB
-
Plugin/mic.dll.dll 77KB
-
Plugin/plg.dll.dll 65KB
-
Plugin/pw.dll.dll 284KB
-
Plugin/sc2.dll.dll 46KB
-
Stub/Stub.il338KB
-
Stub/Stub.manifest.xml 487B
-
WinMM.Net.dll.dll 43KB
-
NjRat-0.7D-main/README.md1KB
NjRat-0.7D-main/LICENSE
- SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
- MD5 1ebbd3e34237af26da5dc08a4e440464
- SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
- SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
- SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
- TLSH T15FF2835FB74413B2018206A26A9F68DEE319D03A73664095785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
NjRat-0.7D-main/NjRat-Screenshot.png
- SHA256 76d0cc76005f661f6d4c6fb61799f59a8a9e72e74ded97f3f376dfd9b17daf26
- MD5 620aca41c052f51a96afce52ccf26836
- SHA1 3ef77932215b3fcd7ba13b6eab912f87148c772f
- SHA512 60d6a6c674c749d9aa27ad750d2d87902a675d790c558f3b24df64dcbec05d427acf4c0e6cf81ca0b351c994dc3e82ea6a2d91e32052237d2798a7090452fd36
- SSDEEP 12288:x6L3+qJ0/TK4CtBZNF5IFWQzvyffM3Y+PetZfIVDmXPP156SuH/QK:4LuU0/TitPa0Mvy3M3Y+uhIV6XP7A/N
- TLSH T1AFF423496CF4E3650FA3907E05DDDF139923B3983AEBB84CD798D84D5A02D25E4A384A
- MD5 SHA1 SHA512 SSDEEP TLSH
NjRat-0.7D-main/NjRat.0.7D.Danger.Edition.zip
- SHA256 4b649c32035e383706673ffe6471d6c711989a206d6f96fdd905dda207a5f0cb
- MD5 18b9e23e509ff221ebb1b8a0ce4bc82b
- SHA1 bacab6a415515e94b3083c4f7ebda6a82e1d4c7f
- SHA512 26091095397f3b229439bb4838f3321de63b9084beab20391a3f85fa8038836d9d0a96a44c7de1d860b182d0b072e0c752494201eb50fd36444cfe742d310ca1
- SSDEEP 393216:miHDYl/45B6Jh6jtGFHAeFWs2AUSTPnUGeOiw6hlVoTzQaGQLMGqE5i:DYl/4r3g6C1UGGw6hlZrQLTqSi
- TLSH T17EF6332A4A16705AFE27731A50EB9CF0A7A609B6B159FC5D2AC830D0C50FDDECE5184F
- MD5 SHA1 SHA512 SSDEEP TLSH
ER/Abrairnotes.dll
- SHA256 321fcf894e5a1853ffb430624d3085f04025563e8e5d8ae1c9c28dbce93d5f93
- MD5 cad085eb4a51b05d3f2905c9a2996fec
- SHA1 f2c6be581eac7a2580666fd3c589f15cf6599996
- SHA512 f6e50801d3de71926568c9b225b2c83607269b716aa18b9f9af417dbb32e7160395c1f53c80c07bef2b50209ab1e92a5b6aaac46d36ab6f14e62b8e83e1503c4
- TLSH T14990025D5062ED6F11A5A6814087849CB16FC0D61C5784464407057D8A454415449C49
- MD5 SHA1 SHA512 TLSH
ER/Abrier.dll
- SHA256 ed0aa6ecbb2d5d6ef3b8431d13d4562d89c2e1c88636c22dbbbbea81e32f913d
- MD5 5514b7e5a95e10c6d37278bb973651b2
- SHA1 44049d7456b90ef04b9c5c414167f1594f54bbf8
- SHA512 3b98f20638cd63612f035fe331b6bdb3ba1cb737df277da762005eb90f548f72fff43977ab502daa105ec571011e277bfdca0f34cafbdac4509ad53c8f175b56
- TLSH T125A0112220820A02200A88E0A0AAA080320BA3A30383ECC8282BC0308B803EC80E8823
- MD5 SHA1 SHA512 TLSH
ER/Apraircam.dll
- SHA256 37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450
- MD5 cc795c9c4a83aa1ede067f96f1eb8d15
- SHA1 32b8e1c43787353f7d87514e279288aff5f7d4f6
- SHA512 ec0b8f6600b2b0443ea6f271fcf16804e380b6f51f3f74997dc5c53ed28ece8ece58a12686b451532ed31941a67fa075305314fba7fa8555a7fb8cf6424c6fc5
- TLSH T1E3A0121221814A01200C54B490699080304B62971343DCD0182AC13887C03CC80C8407
- MD5 SHA1 SHA512 TLSH
ER/Bipe.dll
- SHA256 c1c8afde84694f203ebb49766454ce17179e32c06a0bbdd272bf598c0d9b7c0e
- MD5 4992e2814a8597fb20b5282e568a032d
- SHA1 e0e1bb5cdcc6eae4714ed420e158717be66c45fa
- SHA512 dfe05b7db512c82b5c0d996c13086133ffd70547c69f819486d311aae3d687516bc4e412f8ef7c7755456d84e37ce33d55ff30b71208335144194fc2d67db903
- TLSH T1AFA0021261D11E05900C7AD8E99BE4C0345B82C71347A9C8283FC474CBCBBCD91AC91B
- MD5 SHA1 SHA512 TLSH
ER/Delet A.dll
- SHA256 fd8802c66f18b5d7175bd3eaf628c652525605be88b8149a37e7ec731f3ab963
- MD5 b256a2a73f8436243481712965f3fd48
- SHA1 696657223bc7be99c1cb275b2501850c03581001
- SHA512 aae2b68303ce9fe22f260f31f9fd5ee7edf4bdff7e99372df35a1e0d0a5a3714a915c23d8d68a97417cc5a3c431d0dac3a3c289aa74764308e63709b99d94dca
- TLSH T1B5A009059C4A0586A1291893208557E2A61649956F589A41028FA0E667C73466205459
- MD5 SHA1 SHA512 TLSH
ER/Delettemp.dll
- SHA256 5cbea0f270bc1d57e2231a4d2d5e5d8323710d5757e714d5559e90dc86432c93
- MD5 5fce1e96bf39cd18ede1c35b48a90b43
- SHA1 e8e323eac6292b077c0b9af93c89dd869477a4a5
- SHA512 bd5fa97a9c67c6b342569653362b6896b7eb82be561695ba46b4975a3d0dfd2d3d3ed108e7ae4dbbf1ed7a4deeca2f54fc2477a946b124a6e5819300b553b0e0
- TLSH T17FD04C233019360EB04C4D34C1B49015161DD364593A5AD1CC91D8107F175C4466F3D8
- MD5 SHA1 SHA512 TLSH
ER/Destentrnet.dll
- SHA256 0ec9ad05ab5eac77b92dcdf1b2f8f563d626b9b6a64619da9fd64aa375f97638
- MD5 0920bfe00503b41bc09350f6d60412e9
- SHA1 4ad929b21d7f51fc414619fc7c7a6eb702ac1aba
- SHA512 19f56252682e633293f08207cf88af0003c1959cfe102b66e59f8b4c76b4dea11830d77073cef35bf9f6f4e1200d0a98e78240622956a1cf614ccd6fe8cf764c
- MD5 SHA1 SHA512
ER/User.dll
- SHA256 e4125f396993ea0876f3ffa9bffc46134dd20d7c8e4d077ddadee67b6ca33abe
- MD5 456c3e1669d900ebe41355349deb28e0
- SHA1 57d3afa70c9cff74b74366fb6d34bc57cf01312a
- SHA512 7300fa661115e8606a766093698ee5c760162293d65216a26ba54fc83cf866bcc16da6e84aa304c917106eb94c0f5cce5c95b1d0fb1ee2dc1c1b2f0c631d02df
- TLSH T13611005EE00E362D2D5747F53C559485570550C913C579941475419CB55D5709155811
- MD5 SHA1 SHA512 TLSH
ER/dcr.dll
- SHA256 6a207f770478d59da0d2aa43a9719ef05b3f85c8c700400746ca3ab0463d08f0
- MD5 1cbc3a2f81d4259e3bf61249711fec81
- SHA1 7ba62560df466c6dcd794854a25aeb5b088968d8
- SHA512 74ba85a391d769686c95001af6e29f9fe2ccaa4d119247fac31e65c8becda7be1ea9fa3eb9f2a06c1d48ac4b580ad8e63c14e06d94e8dd07b26129df7f1f4bc0
- MD5 SHA1 SHA512
ER/destedmous.dll
- SHA256 b7dfc64c735cb92f98937b9bb77cbea0f8bc6bc94e3ef14155b2611a36482e25
- MD5 86db8aaa81d53ba3647175fa02aec88d
- SHA1 27277b6740e72bee1efdc2b21a6b4fb147e493e2
- SHA512 a846322ee5037dc8d9c8aa5be8badf7f295250c6374702d0e5e4972ff6db41fdd8f9765ed3313e9a083bb07a66d096c03f38a375ab5aee2b28a16c9d21527d4b
- TLSH T1EDC0803B600699049C075F65204964DD773F21D30385CCC0445754E4DA413C9D17CD2F
- MD5 SHA1 SHA512 TLSH
ER/dromous.dll
- SHA256 32c699ebb7394ddb2d56f092ef10fde4d9f4bcf808dbe11bad777e7bc73f7aae
- MD5 1cc401169ef8cf1e8977f4e92dfe72c7
- SHA1 d04c32295d4e563978fa0abb1b32ba52699cb08d
- SHA512 076eb06d9fbf8bf1d6a4c5043d803ee7b5cf0307253de6358f8ea70e0bf240f5ae2208fbe9a44778e782e29c54751936f393ade6e292064d2134ed223506866b
- TLSH T17BA011A2200C0A0080080CB0208B008A382A20EA0322EE8A800B82E0AAA0288800CA0F
- MD5 SHA1 SHA512 TLSH
ER/infctcmd.dll
- SHA256 e677fb6d2da669557df503eb45de14c3d3acf5509bb2005fcc4be39ac975f2ae
- MD5 b72c081752f133cf07327f33fa4f819f
- SHA1 19d19299a17de80c1cb97df79b8a659f09fd958a
- SHA512 876dfe36eb1d47d49916512b3634bfb19a0b43f90b7348fcde4246e93dfef1521b59b4299c09071521d2d83e92385faa93557b18764e364ae1bc78cab56443eb
- TLSH T1209002A916421A14500D8E60A059E196682EB1DD41105B80504F75D4C9D1E4C8254D71
- MD5 SHA1 SHA512 TLSH
ER/laxer.dll
- SHA256 21ab187279045e81f550c170fdc8b73117f4e4dc2e608bdb80865540264fdab6
- MD5 e67ee9fa20340544e65bc2cfba5d8192
- SHA1 7b49b96219d3ef4a2660a0deb6d70df69d73ec6f
- SHA512 b1786afb5f50dd2001862e0a26fccba91aeecb338a14ee55ef0a09f5f0efb0e7e68a52e0c1b545032930a42668a27d729d334abacb1e0c85b1583887a32480a8
- TLSH T121A0028638050F4C118C4856208ED1C075BF10C74A50D9C2512FA0E0DA8C5D9859CD5B
- MD5 SHA1 SHA512 TLSH
ER/logoff.dll
- SHA256 2036a894b2c0eaeb684a56b5da1e2bbf992ff50fba536e606fb1adadf6cdec4c
- MD5 3d79995c5af417fb5b26f78b02000f49
- SHA1 7e1f39492457eb8be9c0b1bed130f1b205b41ad5
- SHA512 21a745ee1c5b8482573d619d54daa71c6b35095ec0521c1cf97c8d1e6470f236e94e0688d013c597699ee9af1df9be129e8b0e0e39b25a725daa7e9b7b0d92e6
- MD5 SHA1 SHA512
ER/maltExe.dll
- SHA256 4f553023c9fdfea5f806c86d6bdd40d94348843d4a4efd91dc952a53229a4358
- MD5 94070806e01c1ae7fe2aae46d929387a
- SHA1 0fcd747b0fd81b01ea54fbd849388b6e49ff1698
- SHA512 1334b73fadeb074ea1f31f379bb76f4274af5ddfc48a5c28139e766202c373a8b25e0ba2105537673bdf5de9df625dcbd870ef0b8a4506f9674c88bcd2595e08
- TLSH T17DA002472442DD3558391959208FB894749B01CA43DABB90244B44E08E817C8B089DBA
- MD5 SHA1 SHA512 TLSH
ER/past0.dll
- SHA256 71385e3fb017bb452466ab1ad8764950c14a7af856d0ee8c147cf8f7f073b2ec
- MD5 ab45b6913751e20d60d6c9a44a229a66
- SHA1 fbf98231ced1c5667bb8b83114ca2f83b044698f
- SHA512 b462bd82a58ff51d3351ae5168028439fe3dbfbaeb2465c8b300419fb5d9115eb2091aa6fe4e11cf30ba9ee37e3ef175211e5053d6fc7a3398deace787180f4e
- TLSH T138C0C01780802C0F40091B9830C7FCC29EA97C432C831D00C00EB8305F735C4A0C807D
- MD5 SHA1 SHA512 TLSH
ER/prar.dll
- SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
- MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
- SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
- SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
- MD5 SHA1 SHA512
ER/tela.dll
- SHA256 3be1adc56cfae9722bfa25df2ed2b112349b7aa4d8088cbf694e560dd9e53817
- MD5 18dc60bfb068d99a80fd22499ec5f252
- SHA1 4939c87a7ff6456971aa4baf517646d3df2a7710
- SHA512 890ba3a69f516df93154b7534f2530a5004f9d6ccc01e4f59a434e4c2c49912cc2630d34afcb24a60208173a089b8934ace4acad4cc587d21988a150d9ad32e3
- TLSH T123A0021556414555514C595570CF51D7352F10C54158D64015C750A0C55556CC675EFA
- MD5 SHA1 SHA512 TLSH
ER/trafs.dll
- SHA256 fc41e3b41dfe50d5ca916ee4800a122da3744754e6bc16f7aeb8dbfcdb48862e
- MD5 08c12660d57fb1679a2a881ffea7a929
- SHA1 4dfd98579bc18639be74e31f8129331038c13159
- SHA512 ef0d3ff581b43e0a8a11707f3e01abab341da6a11d846048fabaeb038b5e02fa13dc7b8ac13a06ee7a470aa89b82b94c892390999497b9c4231aba5808c16aaa
- TLSH T144C02B1078154633E0D07A10400F980233FB23CF3002E6D00D4E101C481A441C33C2DF
- MD5 SHA1 SHA512 TLSH
ER/windefnder.dll
- SHA256 467c340bf310cec9fa62eb6d9bc86592366bcd6cbc373977e1589357b5623ae7
- MD5 e7470172eed4177d0044118746564736
- SHA1 5318f1e92a00bf453019624dcdc0eb221042bd1c
- SHA512 0e4c42d548b18f36ea6cafdf6e02efc3038b3402e17f6af6e7ccd231d75b55db361a57ad8a2b359474e3c6faf491324354b1b01176a99a1a8635ba342deed30f
- TLSH T104B09207B407280749A80CE096DE409AF95BC0DB5968ABA8809612F1E844484D98DB9E
- MD5 SHA1 SHA512 TLSH
Extensions/Anti.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c98367ffbaec6e84c07efce9d80eae1c1b97cf98583257f16229a80578d500eb
- MD5 a21d32aa5073d7ccd8a7bc87b1fd4fa9
- SHA1 d5d4abe293934cc6ad93c94baa31964132358dba
- SHA512 09f87db37ba4f406885be9c3812e3ed04fd836d04a8c6eb0a79e0fce34a435f660ab63d26badfc3c5116c4bf6243ad19e72aa9a2e674737ae49a07a1abff2ac9
- SSDEEP 192:NhVFyr1bFd2lOIkVOAbvZm7nloYk4kNIDLR7PYoRGZR0bKxJd:NhV8FgOIkcAbRT4g+LRVsREKx
- TLSH T1BEB2821322CE7EE6C5B80A713B7343D1C72DEE058423DA2E65D47629CABE1037A527D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\سورسات برامج رات\SRC - Coringa-RAT 0.3\Stub AntiProcess\obj\Debug\MemoryDiagnostic.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/Compressor/Rpx.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 151e09c4e5d45d3d7247bedf08096ce1f8adaae59476ba1637839ead8099e53b
- MD5 4571a19fd31b61c8947490fac3b54ef2
- SHA1 a4a3026b943695189ae74344e550edd21dbdf103
- SHA512 5ad2d098f5b9097f5bab92a91b6d904bf374ae0e7c762f353b1dfc5190c8faca9072dcd330b13eb2290c70a7d27987e11c26cef7a4d05c8638817881bcad6fbf
- SSDEEP 3072:7xexpcRJvrGI2e6kQFXdhHaaKGxufkByDo1RZpwobf1Xv6IPcm9ddVMQKB:7xezsN2eY/vKoufkBy0RZpwobdT9ddVM
- TLSH T155E312107AC872B2F8B30B73B84691E482C27E417D92D5DE1289B9CB9FF1902A555FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/Compressor/Rug.Packing.Reflection.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fc5c7454261c7dd016302be92362e4cf60a3c9c6c4633c65855b3258d534af73
- MD5 63b02fbfa302ee016bc83be8f18efe77
- SHA1 61ecf0bab944dc173e2c06a0b059cc620d75fb0b
- SHA512 6a9aa2b2c74b34e43549aa31d3621c47003e370c4fffc1fe9844df347eed61c8e319a6a42e158d772b81fd19eb9d7b845e736062d7e14d404a9d74da0d5990d7
- SSDEEP 192:2V6ksZ2Bnx+XEXi5U4fkR3WZs2NDqQp3BrPNBNoGN:2XA2BnUwCfkYZs6DqAl7oK
- TLSH T16232D71597E8823EEE7B0BBBBC63B22102F5FB44D552D92B4C4C414FAC677508A22776
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Code\CSharp\RugProjects\Export\Tools\Rpx\Stable 4.0\Rug.Packing.Reflection\obj\Release\Rug.Packing.Reflection.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/dotNET_Reactor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 79f190a51af8a463f13ddd5a76947cf7ba2adfb8e231b37c5e0968602217a62b
- MD5 a7d69d6ddbe2586d698ebdf7f49c1afa
- SHA1 7b87de25c982d0cc42a1dde89790cd34acbcfd2e
- SHA512 2d4fb34f83d9794c38ec39f12f78b8d7c5af331aea475eaecf589f95c9e1849196a8d5252a7f9beaa596bb34ddc0c94b76a6c9092dc0fb93ec6b0af9fb66226e
- SSDEEP 49152:VXl2PFBegFNFLua2gBxnnim//7rF31inFhyNkLObEECwc0mjZ5tzCo3Eh5pfO+pD:VW5nnim//7uvwCt5tuo32v
- TLSH T1C6567B2076A8C911E0AE9774C3F281FF0BF0FD0BD226971B69857F6639B17425C06A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6205246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NjRat 0.7D Danger Edition.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e6cff62a0e8e7c654eec97093a1295773f223cd3a6a11f65c91491cfbd6be751
- MD5 eda04645089d60f5cb602c8012a33e07
- SHA1 85ae9d1a404d0a2063bee3d8d7bb9bef233fa71a
- SHA512 fe9a1bddd90aabb6f5abb1d15666e75ab3c6136d1dbf2c79f0bbcd1dffe2089ac8a73ffe11b3d1cbbd6b393fc51f921fd5c50bf490a38e9038d2c366aaa9468d
- SSDEEP 196608:TZXg/uuzJ4eNyvXQoCV08GzIBcx8OyULg5fy2Sif8E0Wt:S/uuzJtGzzIw8OXmW80
- TLSH T14496DF117A6AE957D1BD227BC1D3B01963B4BC162BA3F346BAAF32BD11523634C094CD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8610190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8.2MB
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/1.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 afda8e5fb125e27aa1062365ab4b77c4fa3acd14a6e435ab7ddde18644266af3
- MD5 c3e8ff959a4027bc8cd67e26d3003370
- SHA1 5469f8a06813027ab3f8bcfaf4d5c87810ab347a
- SHA512 d0f461200daa100f6d05320c538d793e662f9ddfb13fa70351bb1bdf21cf7a1c256d284c3378551d288d7275cfa9cb32e84cdb13e7bc49ca4b5483d8ef999f15
- SSDEEP 6144:ELPgpcVH6h+9Ve/B2Gmzoun1YUqqlkLqa8vcvIjlk0Hrg5eplNpi:EceD9uB+ca1Yg0qakwIjKU1Nw
- TLSH T1EA84F11756DCEEE1D87843353B338AC6BB685E08E957CB8FCAD4A11E9C3A143751A2C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
369646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
353KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/10.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4d04ead199b9f3433314ac5a4c5466d0ce5e4c43e2fdd381ae0d6a1e705e6f1e
- MD5 e3bf65ce42edca6891fb7123711ace2c
- SHA1 455a838ce4c51976faa9312ae212d7fc82ff7e19
- SHA512 1bce779f1afc8a10c9dffe245ebfb9c46c69cf805cc24dfbb5edfe6e3577b0b34e7ee59763a31e05579f22a584628c10c87fcfb6e9f180d16a0648b6fe05f490
- SSDEEP 24576:2cMzcRP/NYt1FxJlZfY+4VHM9gJppE2ZiH8BnoTsHa0GMG:2HcZN4FTfYxHHoHuoTV2
- TLSH T10745235B128DCE54CC748770377307D2EB5A6F046A238BAFC6D5B269CC3A506B8B12E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1175774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/2.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7ab30a602581387fa97faf7f8100d2c98bd3407372f723f805f2346addb7d008
- MD5 07194ab187366cab46972f2f2f1ef0b5
- SHA1 14927d4482a318004a42a5cf8cc40ad08673a302
- SHA512 989720c17fca490d1fb3a6166f713b07410b0525c7ee142d192de4f5a044f904633b3eb8c3e83f8448bc7ee3da5cb448711067025cdf037d20cf1e9d18131446
- SSDEEP 6144:HLPgpcVH6h+9Ve/B2GmzountZ0MGr33cPuWG69SvplN2r:HceD9uB+caYMIcmWG69SLNU
- TLSH T10E44E01752CCFEA0D47843312B3386D2B7689E04AA57CB8FCED4A169AD3B18379257D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
270942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/3.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 666f19c5d6528c4e071b4414aa410eae3497c809107739db87e39374ceb8593c
- MD5 fc2c601bba0029124a120db3035b5652
- SHA1 a56b3b16e0814ed4da024ab2eee968c17c004698
- SHA512 0c49ad30c8bbf125fa3a47ac63d862063b8feadd87968356237a7df08b8cf4ed4b66e1a8852303b32f6d8ff168a24743fc7adeb94de4aa6f72aed3f2c279b95c
- SSDEEP 3072:hLXfgUssa+sVyMMH6h+xr0we/4E2Gd0NRW5H76QM4o+aeMMf6W9plNNAGExB:hLPgpcVH6h+9Ve/B2GmzounxW9plNWl
- TLSH T15424BE1316CCEEA1D43943312B7386C2B7A89E04EA53CB9ECED4B16D9D3E14379666C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
221822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/4.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d22944f50fdbe7b9fc55807ebca0275e59a0ede94226e2ce365bc507bc96ec68
- MD5 621ff03775382229afbc039efba07212
- SHA1 3bcf1669b70df52059d2fb5c9025ad3fd30170ad
- SHA512 3168bb66d0e2a72df58c46275916fc9cd1d92512b4221fc0259859904d174f9a4b4cec3ff43ec91e4a084ebe4cbfd7349cfba230b1e56403bf36a711d2d8b90b
- SSDEEP 3072:NLXfgUssa+sVyMMH6h+xr0we/4E2Gd0NRW5H76QM4o+aeMyzBplN1AiENh:NLPgpcVH6h+9Ve/B2Gmzoun4plNud
- TLSH T19A14CE1712CCFE91D87847312B7387D2B7A89E05EA53CB8ECAC4B1699C3A14379263D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
201198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/5.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b6914d1ca3c871a2e79d54bb19a7a66e207548214b215698ac3371595cecb5a
- MD5 54b06dbc99832ca8a54232351af21059
- SHA1 42367bca4add1792f841f9c20bf8d6a6410c0ae1
- SHA512 e49dbe7b2a58dc5be68cc79aca83a090486786454d03461ae256f5a0b098d8e00f18032bf1eddd7ed7e863580b8c463771704df404009d3ba1b375b4ec9bd87a
- SSDEEP 6144:iLPgpcVH6h+9Ve/B2GmzountmmJwBISoHVgmRuPOLaplNZW:iceD9uB+cat3JKbFDOuNE
- TLSH T16A54E00312CCFE91D47817356B7386D3B7A8EE04A963CB8EDAC4A06D9D3A14375263D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
292654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
278KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/6.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0d01cc53ba6630b8bae7674cfd4deebe6cb0c9e5d2029e3f29c0bc25b2760207
- MD5 633b07e6516aea1d677b8d64bfcb04e7
- SHA1 8f55062fbec6bea8f8cb689e5228cb0f4b759b59
- SHA512 456207a76294bfc5f8f88b3c893b1d931604f935a67770349d6ef831674a65de73ed6d01b2c51c0a3499c30543e5011490b0ebfb34598d00504f1574adae3df4
- SSDEEP 12288:RceD9uB+caZ042+6tMOfLEawCDQuPBFjXwR0F+SbNV:RcMzcRG8pBVwyNb
- TLSH T1A0D4124311DEEE50D83053747B33E1C2AB6C9D09EA56CBAEDAC8A1699C37153B4A13E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
637278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
614KB
Virtual Size
614KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/7.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 814ac620ea996b45e8c0fc55ae57e10c11add1cf4fbe9d260a5f13052051b420
- MD5 ba2d32d8118f59ae4aab0bae941542ed
- SHA1 b627f2ffb0c8d82e8b9413228a8b75e70d716f2e
- SHA512 1181d91e843f1a51248e4080fe91539d77c749125017fb3a1382da3c7b15317337510a0e18827a7ef6ad091c66ff70801f68597895e81c08e6daf96ca0ade839
- SSDEEP 384:ZokI7SgVV+17QwkSoL20gNjhlLk245nKuk4Z/jKeK:an07QnaHjh5m3K
- TLSH T1F8E2092722CEBEE6C5B90674777353C0D76DDE008553CA2E69C0751ACABE2437A923C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\09\09\obj\Debug\09.pdb
mscoree
_CorExeMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/8.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 06b3345a22309557ec7168efe1d4bb48a6180a9643faa472c9c90b004ce0a1ac
- MD5 8ca640310df5533abc19acd7dabc829e
- SHA1 38d126c7d252c5aa5963be1022060869bb3daea9
- SHA512 a7d699d09e0e78815e842eae633b44c03ad0c974985cf2faa4f8f64ab8ceec164f75390f120170847c59a4f09d9bcb3ab0c3f0377afa5cdf834b4612528a15df
- SSDEEP 6144:WLPgpcVH6h+9Ve/B2GmzounAbvkteYu6eYsvSplNH0:WceD9uB+caAbvZYA/v6NU
- TLSH T1DD44D00712DCFEA1D87803352B7386C2B7A89E04E953CB9FCAD4B0699C3A14379267D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/9.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 45aa36d007d27ca8e9659cd004a98f048b232161202553da643c4d1df3427459
- MD5 1a018036c48b4cd8e0c7d1a7ebea06a9
- SHA1 8ec946a133f07bf62754caddf3a884020f430f8d
- SHA512 a8a8cbb9a1bfbdbe610bcde92d49674ee155d11fb6992dcd74551926fb3c1d8c2eebc773655638f785079961129cc9112718f2d4764812bbca9f085d3d7bd79a
- SSDEEP 12288:BceD9uB+caeL5rWxh9FnOl5T3e2Vzdb3Cl9WNNg:BcMzcDL5yxhfnk5TnhVk9m
- TLSH T143A4010792CDEEA1D8395730AB7386C2F7589D04EA63D78ECBC47168AC361437A253E4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
474206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Andex.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19dc8c66d04d1a1d781e59107e2a1db5fd6288761c9dfd0c6909e533e79d04e7
- MD5 6032ce8ceea46af873b78c1f323547da
- SHA1 8c5bd4a70e0f21aeba41c07976ace2919b64fd80
- SHA512 3ada1663cb730f43b44e32ceade5d0b9cae20d1c20001691a1d226d99c82510e001581f67f5131d6c21e0e0cf98e5089c3d0f22a6a1e3347053ed73304ccc6fe
- SSDEEP 1536:CQvlJNxwHPmtN2dWWWQmMTuAip6XIbY6i32Kf3oKwfTjK2f20:CQNwaFET6p6XOY6i32U3BwfPK2e0
- TLSH T1CBA37A1365CEBEF6C8B816B0377387D0D72DEE152413DA2E69E1341A89BE2537A523C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\Andex\Andex\obj\Debug\Andex.pdb
mscoree
_CorExeMain
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Duck.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5d1217e2c9e820c3e7b2fc28fab4e40d85e0e9f4362e66a451e42d597b8c2650
- MD5 d7d46952778a85491b34f62991a060d4
- SHA1 ff30ef03867eb74f2454375cbe3508ee26b07163
- SHA512 7c9b4c254a1977d1a16ac3aa8ce81d897eeda4465e51c9f0cbe2c03326cc6c3bb7acb89d8d1f4ce1dec03118574b57f30a3400b2dc47b70aa87bfd2f4f99f8bc
- SSDEEP 1536:miaFJkobMa8dBXu2IbV3DKyBzYDEBUhYW:miEbMRdBXnUV3DKyBzYDEal
- TLSH T18F53E814A7F84217F6FA4B71A9F4C047983AB953AD25C75D348E438D0B223C4DA62B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:d4:6c:da:67:78:ce:d8:05:cd:90:31:b3:c0:ae:26:f0:cb:f8:24:62:b1:48:e6:cd:cf:92:57:43:33:ab:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
33:9d:72:06:36:dd:88:70:f1:17:7c:b2:5f:38:3c:c5:83:f3:3e:b7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9a:3e:ab:01:a5:36:60:a7:0b:00:00:00:00:00:9a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2016 - Jul 27, 2017
Minor OS version
0
Major OS version
4
Entry point
52746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
RegAsm.pdb
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Gren.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9a8f461b55d753e7f66f3db602a29a079efe626c514920d933a471489ccab951
- MD5 8775af76bef724f22a0b5bb7c787a1cc
- SHA1 39620f580705b8b214f94acc7d1c81bceec15ba9
- SHA512 966de3d1d6463eb15ed0b1ad6e1902d343c1b587abecf4fa27798bd576effadbe99a7f787de320cf815dacbfb5795e3dff369802e13d95c96fcb9c54e32bf61f
- SSDEEP 3072:bbQsn8VDXc8qrTvJZErpoVAOjKsYMouMpYc6UI1i03AJJmdn8txICpH3SHB8zkFQ:Zn8VDXchT0IusmViHB8YdwLm
- TLSH T1BCF3F7181BE49E57E97E03B853BB026083B4D5614587E75F6EE064F05C7B392AF0B28B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\SRC - NjRAT 0.7D\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/P.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d3cf09c638fb94b81343c94dd1a9d7ee385a5240a1f3d78fc70dc591b417999d
- MD5 a7a746707ca4e136585570eef6daf2d4
- SHA1 50705953b5184d8c0fea9c10619d765648976b78
- SHA512 dc97a3cdeb599c976bac9ef4e901c97e4bf02035b6ea60c0e8d9a288b220ca66545a4810842623574293ff09bd4c60fdfaa878fd4e7aa2dbd493d4f001fb0ce5
- SSDEEP 384:Af/GMPhe22EjYdr1M8KdkMLk24jXPlCuoM/SYNp0DDZ3:eGq0dr1M8Kdkg2XPdS3
- TLSH T109D23D2752CEBEE6C9B90670373343C1D36DDE045413DA2E99D4B52AD9BE2037A927C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ch.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 57a02c05691f47b13a6bd77258a559ff193a2e3bc19b6d4339ffd06d2f47569e
- MD5 8e39d0bb786fb308842102fb90211910
- SHA1 fcc8a86135ac63aaf51e6d80472813b5385feb4b
- SHA512 ace89e18827953ccd61af94ac49cc3b1005be3ab0ab5a44c28d690b33bbfa89c2e4e34970d3a8898e65d63f9956747708e2b64afa21c7fe5799131702fc45850
- SSDEEP 1536:bkU/zdQrxRqkFvoCC3TWuA9GyLJnFMarv:bkVlRqkBobiuA9GyLJnFMmv
- TLSH T19C73486745DE7ED6E07C2738277353C0C7BACE508603EA2E9DC4A55A8AB9603B9913C1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/chrome.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ec85087f6830b71f106871c59dc8ffa0de91cc3d8ce8c269b7264359d9b4e80b
- MD5 685c1eade930e2b40f02f98328fca44d
- SHA1 e42f950e1dbed069d7c337c9ff09f55fb90afdf6
- SHA512 aceb433536f6f8f684219c2d62b64604175d1eb8fb0c3d0aba819c81b6793f2f96b2c8b13d7311f7513234d8d9e62dbb61750156d9ee8d8fdfdb7b5ec69262fd
- SSDEEP 384:rfBLiWh61JSBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYVjDsPIWS:12vTSB1p3Q1sGHw2XPIo
- TLSH T1DCD23E1752CEBEE6C8B90670373343C1D36DEE009413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cmd.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1adfc8c1d730b305aa7b79973a2a9d7bd7437742e464de3671448b70658b860a
- MD5 189937260ddfd3b529ed1f5d80e9ac08
- SHA1 70e63e7ac92f55228a81aae93960df6551cb65a9
- SHA512 053d95d415ca3cbedae305eeb000c57978d96e6bb86319e6f600f7e3236ed95ae8b412d76494d1b4ab7f57956b4869799240b99b3f310dcda2b522eefbb6d464
- SSDEEP 384:VfBLiMh61XlBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SY4jDsuIWS:j2JNlB1p3Q1sGHw2XPvb
- TLSH T1F1D22E1752CEBEE6C8B90670373343C1D36DEE005413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/dneg.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5b9c1b0aedcd82ce25b5f7d6ced6b38943b5c0ca14f09a27b4bfb4eb4f0204d5
- MD5 0edfdfc37d6e263002e8294424783c35
- SHA1 e7bf2e195ff32d5f6d5b09164de94e83d1f0f3f2
- SHA512 14b4bd0a6e6ef26a4713cdb115f298d35530864b00a4c5a9d84c7e27086d232bca2ae18c58831a72ff687b4511735bb0669a5136b59b4813464bb25c384b123a
- SSDEEP 3072:owQoQ2z3lUnNx+DsH4ceTgXjrF5hvTjhppH1myZXGT2oelwxkzXJNVlzE9JmZcIR:ALf+/yDHlaNIR4tlYm
- TLSH T1AC043A045BE4ADA3D97F437843BB126043F5E9109207DB4E5FE0A4F55C3A39AAE0A6C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/explorer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e05264acc620b4828ec23550351bdaa7cc429fb273ecc4450ea58f2b20b7f61
- MD5 9cc05ec9d58102696092dd1ab9103fc2
- SHA1 d4019f352ea64504a357c6447c56f79e06602131
- SHA512 a74f5ebbe8f154857af1408aabc2fab30240ff5dd892d5aa9b510c63d51cb8c67605ff6c34459d620c10bb9d13085ac34072235b7bea274605014f9f8a7dbe55
- SSDEEP 384:wfBLiyh61NmBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYsjDsqIWS:s2TXmB1p3Q1sGHw2XPrv
- TLSH T16BD23E2752CEBEE6C8B90670373343C1D36DEE005413DA2E99D4792AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/explorerr.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b9347d22eab0264a0253aebcfb735ea687453fc85d9a906933673017abe4285e
- MD5 2407032a11e906cb7eb171d4e8256992
- SHA1 f6dfc9b6632435136167a16f8a5b23fa624246aa
- SHA512 55bed6d2c026c2f29a13f9d17e9c3d0594158cd8caab8a8fe9dd6fdbc5816efddf2c006489c062b7c191d5f6b40541f7d51d58da0353f5c9853162b13c8b325b
- SSDEEP 384:2fBLiyh61NmBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYwjDszIWS:O2TXmB1p3Q1sGHw2XPrE
- TLSH T1BED22E1752CEBEE6C8B90670373343C1D36DEE005413DA2E99D4792AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/firefox.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2fb77c75a773abb9f61c6c918c2ad90d2f694a3f4822e0f934d9549b386cd8ca
- MD5 1dae4ce0658e69e451d007200a69de1e
- SHA1 141f5b6c4ec400fe58ffdf384a08c138875ab904
- SHA512 786b69e5b96fd4ace34fa7226da9d4a0be7cd4f5b475116ac1a07d34a7a2891c5511fb3ff14540719a989e72d5c84c12dc7f0faeab108adb87746d6a611beb44
- SSDEEP 384:yfBLikh61PGBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYcjDsBIWS:C2x1GB1p3Q1sGHw2XPzW
- TLSH T11CD23E1752CEBEE6C8B90670373343C2D36DEE005413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/hms.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a5c1bdc7b8c0e456edac031568c8acca0524eeec7e91977d63c41c0a82c608c5
- MD5 f4407493019fe05f34b074539519ebc4
- SHA1 b3f5ff69ff4fee493440c133f033a0d05a6edd43
- SHA512 24668bd17617e038544ed5cc92385cba01ec1b70725930457a5deb6f4ef1a079e3af8d7f592dad851fb1685387daaf47cc02a6c406042dc7ec1f406d2ab3bfc4
- SSDEEP 1536:ne/lKI2YbmnzBSrw0fFGIa0H7BldTRu8j0ZwM0UCz:ned522fR1hYZuz
- TLSH T12053AE69EBD440A4CBA5AB37F19ABB131B32CDD78B8363B649D078111C93B444EBD642
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication7\WindowsApplication7\obj\Debug\GoogleCrashHandler.pdb
mscoree
_CorExeMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/inf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9648ffd2eb53744c5f78dc8442a8bcbbe9831db1e198be370a62cbf9f51cd896
- MD5 cef141d894400bc2e0096d1ed0c8f95b
- SHA1 1bcef29980686dc4cf8ff13f251f1ead7ba6e2d2
- SHA512 794e7cc5a899407414bb3bbe2f2aadbfcacdeda2eb0381249b8dd5ed342534910b85b1450f509f1d6b36109efdc82eb3ef1eba36b76ce123b1034192d871d2d7
- SSDEEP 384:XioX36zZ00sK2qbc+LROMnDdU6cpobsTP4Fj:SC3wS0/9dcpFgj
- TLSH T1A792D805F3E86028EEBD1B329EB3C7616276BE274D2EC62F09D8715D19B23404A71B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\NF\NF\obj\Debug\NF.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Plugin/pd.dll
- SHA256 8701c0d8266cefd9ffb4006a278e9d28963e90e1688f5e1f5c65db6a132be733
- MD5 7e3c8627a5f7d7b9a8e54541bf4e1eec
- SHA1 92907340746a489ba6bdc1a887bf68b160057a3a
- SHA512 cf06e93ae7d4942539d5dbac9253c696663c7164697018c5bb9d2b92bfb27eb25a861acaadd81506c124f0ecd43230343f4c2f3257ed9106907bc0270494ffb4
- TLSH T156C08C27776B26A100339AF22AE2084C238B71FACA82D0A4B23481A6FA8512C5920620
- MD5 SHA1 SHA512 TLSH
Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- TLSH T185D2C70D27A0C525C7BE87365E2143225EF786134C25FF2E4CCB4AED5EA2789DB4864B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ps.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d215b8cc095e913f2d3adbd88ae7691be657104dd52340efba670d04eff1e368
- MD5 cc65ad514684506f9f22c71d94c537ea
- SHA1 36e2bf3159d14552279fc1b80db80a8c177925f4
- SHA512 5c505b4c49df8e7e83af47719f79018358a39f1df552b2b90dda244b1e41a30559cbe66b1d415a836f403452c5493b26e28ef170376eb5f1a310733e65d8eeed
- SSDEEP 384:GfGnw6ju+g/gvW+yCnbMLk24jXPl8a3XEWss4YY6:pwag/SZHnbg2XPM6
- TLSH T16AD21B1712CEBEE6C4B81670373393C1D36DDE045453DA2E9AD4752AD9BE2037A927C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/pw.dll
- IMPHASH 720f62ecaae027b5c3ec6686644322e9
- SHA256 6d0b37a62e1d2215e2fd8936d3d1d13cd1d620d7678c773e013e70ccf55a674d
- MD5 b8cb1a1d76fe3fd71ac5b5fc175b699d
- SHA1 611589181cb1bb72a279e44116fa3ed7c1256ded
- SHA512 280d2dbb4702498e11879c1fbf62c6eac8a2c97c2cc520f310e658ee5162329e24ba23d752ba8f549c0ffc85d5c83781ea1c10788ad6546258f83ed9c3c2cc25
- SSDEEP 12288:u7eVQkTrvj4bwVmWyQSo6aQNlcjDzJsu2N:ueQkTf4sVmWyQSo65ToRW
- TLSH T13394E01160C1D9B3C47A043457F28BF5C72D7D36076A94DBB7E82BA56A382D2BA313C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
65519
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateFileA
CreateFileW
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=102, id=1, productName=Unmarked objects,
count=41, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Plugin/pw.rar
- SHA256 3b45b9a4541d8eb282efb8cf55dd5070b89b7fe7ac520c79901ca1b14df60e9d
- MD5 6d59194c555d6878bcb82ebba07ad076
- SHA1 789b4f0c15dcd1296b2718ba42f58ddf10dd2f9d
- SHA512 b30d13896de4a1455af87040690dff1fe65ad23d303fc571fa7c05b3551fad12535900f33b3e7e5622763b7d980a40292eeb8bae49330d11ca04f5914d6ef384
- SSDEEP 6144:jPp5FkU23Y7wBUAtrL8vUPRW7Aenzui5pgdC+tf28EfyaY:jPfFkUZ6UAtrgvUZ+dKiwdho8EfnY
- TLSH T16364234E17E79EE6FA4F36CAAA0C4F8339033F942CD4D95D458F91AF80A2D15E41A643
- MD5 SHA1 SHA512 SSDEEP TLSH
pw.dll
- IMPHASH 720f62ecaae027b5c3ec6686644322e9
- SHA256 6d0b37a62e1d2215e2fd8936d3d1d13cd1d620d7678c773e013e70ccf55a674d
- MD5 b8cb1a1d76fe3fd71ac5b5fc175b699d
- SHA1 611589181cb1bb72a279e44116fa3ed7c1256ded
- SHA512 280d2dbb4702498e11879c1fbf62c6eac8a2c97c2cc520f310e658ee5162329e24ba23d752ba8f549c0ffc85d5c83781ea1c10788ad6546258f83ed9c3c2cc25
- SSDEEP 12288:u7eVQkTrvj4bwVmWyQSo6aQNlcjDzJsu2N:ueQkTf4sVmWyQSo65ToRW
- TLSH T13394E01160C1D9B3C47A043457F28BF5C72D7D36076A94DBB7E82BA56A382D2BA313C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
65519
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateFileA
CreateFileW
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=102, id=1, productName=Unmarked objects,
count=41, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Plugin/red.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7ff23f4e452d1073547790f12070518b20bb4a305effebbb90212ce141d64e84
- MD5 35be497312c0fa928c92fa3e2fca1783
- SHA1 0adbaa1b4d0b9cccb45d0d50021035e254409beb
- SHA512 211643da52801dbea616e1a05d38c4ca4069d96cb50ee6c9ea6ecc43d6abc16750d4f19814061c8f48c924b6c61ae2d93e36a6a0d4493446fa7c1538f4f958a4
- SSDEEP 1536:EDi8HBf8KZyGOzx2ZC/5Mp23cs3uvzarv:oznY4G5ZLubmv
- TLSH T12653281752DEBEA1C67913747B3393C1D3A9DE008113D62E6ED434AA897E2037E827C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/rq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bc2898da9cd9e202b7795b330fa3daff81a4b02ab4ecfe47fdd712c53252f12
- MD5 2490eda5b4450138ba79f39fcc90048a
- SHA1 f8af994fdeeb8afbf7d95e816da389a7eb09806e
- SHA512 4f96028666bcb0a80730e8429082c2ab839fe8662086ad9735641fe8e55d51f909171124b1500c1da4065f26a9d3118c8b6c24d1827d12c5c887cd1e358a2d58
- SSDEEP 384:B3RxTVz/Cn1CfWok/7+I98wxOaPlXfNIsGwPEvMnNKp9p:fxTVzK10N69XfNIUUpz
- TLSH T19EB2F81963E5C762CCFD07790862621167F2CD51DB13EF6F2ED870E92AB37048B4269A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/spark.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4c19b629100abd685a936f1dfed09dab57c69733e9547ee1a9b9fd1d19d0f6e8
- MD5 c78f9243c3e40ab2f4198a61538c7efc
- SHA1 e9944ff9f066c8be968f55e319667f27bc41d5db
- SHA512 d1ca85d6767ea1ebd5ebdb2e9822f04a59404d3d61c4579f01704633c9d1fa12a783447a781808ed840523ae5884d984ef95a6f3663d3e6d1ef1c13829c2ad4b
- SSDEEP 384:ffBLi4h61LsbBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYKjDspIWS:x29xiB1p3Q1sGHw2XPd+
- TLSH T17DD22E2752CEBEE6C8B90670373343C2D36DEE005413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/t.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 712626ed1ae9b07a876300ee93619e76834b9c2e64d724bcc1daef3060d6cdaf
- MD5 771c11ce7b5e13bc7415aab054af9e4a
- SHA1 0bf166884a46b66471a4e03517d14cb1efa37e5c
- SHA512 4b7097f4e0d3e2736447ba1ec7ecbcf304cf6cfdc955841f780f35585cb0c9b71600273ee21a8b34ab337a279d857a899bc078eff3b6cdadfc6f0a8c6fb4220d
- SSDEEP 384:Lf/GoPhe22IPYdr1M8KdkMLk24jXPlCuoM/SY2DDZh:jGqgdr1M8Kdkg2XPuh
- TLSH T129D23D1752CEBEE6C9B90670373343C1D36DDE045413DA2E99D4B52AD9BE2037A927C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/vu.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 501c36ac282029ccf7950a4957d4c10ea72fe18f0ad8d6daeabfe628fa4070a7
- MD5 6c2210ba180f0e1b9d831c3c6c14c8b4
- SHA1 00bebdf704f4cabf254583c6ad87c6e72872b61a
- SHA512 26a63ad05199cf45acd7519fbc63945097b4c4a89bb2cdfa4f87ba004e1ce106220b0b99419e656de26d164265b3868a9ce541c71b05d4e4db1a9a1343130e9b
- SSDEEP 384:Z3wflY4njjVCnyGbNJXn5MLk24jXPl8uor/SYDi39j:Z81tayGx5n5g2XPVj
- TLSH T10FD20B1712CEBEE6C5B81670377343C2D36DEE045453DA2E99D4B52AD9BE2037A823D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Settings.ini
- SHA256 17f547710bf4fefb27ff4470e0f78089c4888567eec25380e136d9fde1e02276
- MD5 332f4072f2109e4d81f2701c2387b186
- SHA1 36bbaf7dfa5a6d6d52ab04f533359f3c65cfa8e4
- SHA512 53841fa1fb9f0fc1c6633e863f1195d27c8dfed1c0caa7ae519d224893eab3fb23487b130539b5c1839eb8aa99d51b3450b6d15cc63275c0a32841897c84d67a
- MD5 SHA1 SHA512
Stub.il
- SHA256 78a156fe7e6900ece45fdd25516c0f9ffeb2083ef3d62685f189fb5ef5a9a0a5
- MD5 abe394d9d5139ff9c586aa7dddc97e68
- SHA1 6b3ab81b04af61685cd480a41bc953cd6a963f90
- SHA512 30a7d44e319ef500802edc4c74c9bf39bf43ada220427c230973aeecd71f18f02466c824332cc265b96622b6588bda472f3949b1ca3d81bdaa4d6e617bf2a114
- SSDEEP 12288:frIAmhjIU7g9wYYxWzGzGhPRaquMSd0yNMyryKYtEo+vQRLtJkw9WPOSigRGIrKN:gAOU
- TLSH T1C445EC6982289589D5B2B11DBEB2CB46F37F12230F326C967C9FC659FF312884174636
- MD5 SHA1 SHA512 SSDEEP TLSH
Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NjRat-0.7D-main/NjRat.0.7D.Golden.Edition.zip
- SHA256 aac5b302910be9b2c904f039129d3c42eb1e4b1539ef6de621669793a95c7e69
- MD5 de0724e9b662c97a8131d593ae03e1e8
- SHA1 2367807d0405ef6d7cef00f0b145c29823dd5128
- SHA512 753baf929259237f987d1c8251c13a2d0c72ec34c332b1c103ea501c5ce68628d41092d404ff02b7c58709fb51c266489a96453e502533c2804a884446c18e64
- SSDEEP 49152:hoQ91Di9X+pMocKQtkWhCTNMH9xf1aawHlFhoTfNAghr5:h991DuOYKQyW4TGHeFhgNHhr5
- TLSH T1C4953327E226C409D4762BFF0655BB66EDD416C2E84E640AD4A8B074E78DFD81EF0A02
- MD5 SHA1 SHA512 SSDEEP TLSH
GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
InjectIcon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 98348ffe70a68f69d934118a2d14b86b382d698601827a4c1d322d878d36bbdc
- MD5 83921e813f885ae1669aa0efa21f8695
- SHA1 130f59f513eb64018736c0173d45a2b524c282fc
- SHA512 f123ef9c5fd3157c6f51b1ac02d6103baa1ebd2a02e3c2d95355b15ce3730f241c0d61d1ffc07713b8d3af7600730d29049683c589c7007a9a4e7bb4707f58c3
- SSDEEP 192:OLCpu5eYPefzYTZVzunlYJL/eBvnaDNIDLTHqaf0+E+sQAE8UBscU:OL+1qe09prqNnq+LTGQY
- TLSH T1EB52D70693D6C332CE6E873A5C1377A45B31DE00DA52AB3F55A0B2676DB33440E93762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Dark\Desktop\InjectIcon\InjectIcon\obj\Release\InjectIcon.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
123B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NjRat 0.7D Golden Edition - Rus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c81d701c3a4d6b7bcaa40f9c92a1bcfdf2f829954cf1ca15556712fbdc792834
- MD5 8d540934a359a0480de188a748b3d573
- SHA1 556693330454d09e461b0cc16c2c8f69f7f3cd45
- SHA512 d2214389578a2928cc51b7fb098dd8d1ed4677f97a3f6bb18ec5494a3247866c400af7fe5d1a326cd25faf6090139849d3ef0fbb43c62075e5a436c0599d47b9
- SSDEEP 24576:S69t3fGD4IC7VS2s5G8xQ63UJzyS6P/qY7/:S6T3vs5txQ63OqP/P7
- TLSH T138950F03B302EE55E9B832F450058FA052697E4E9174C6B62A743A78E9F98D3FD913CD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1966382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/AntiProcess.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
- MD5 b21947a28760750689f46e071d575d07
- SHA1 6008a9ff367e7a715422d2e2f96312f1a3231a9e
- SHA512 75fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
- SSDEEP 384:0sRt7Wow+KPUhkRf1jJXMgthizKN8dhct+1W7Lf45kNQfjO8pZ3TR:xRt7Wow+KPUhkRf1jJX4dhVI/mf
- TLSH T1F4720817A3E6873BCFED0EB48526150483F1C3069553FF2F9DC665768AA33404B9279A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\برامج\اختراق\سورسات كود برامج الاختراق\Anti\Anti\obj\x86\Release\Stub-Anti.pdb
mscoree
_CorExeMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
167B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f00cda5808e3fd126d452708308ddee6556cb83adaccd02efe83654a40fc641
- MD5 7eba4d9562bf7fc14f2c1bb142a1aa6f
- SHA1 7c0f49bd672100881e7340a480dc6674d5dfc862
- SHA512 5e7e9ee05674eb6a943b84437a46cd6c4dd7d63cd95bf308cd614026383eafc087590f6238a5282e275cf1875038aaa46ef843a5c6d322e3b7b1a63e2d454830
- SSDEEP 1536:CfGJpkk261SBIAPVQfiZba2epz5B7hzUzaQo:QGJt3MIAdZbLepz5BlzUz5
- TLSH T126534C6E6798541AC58D46BC94770F1053F0CA1EA337EB8E2B7891BCCDB23814A5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bc2898da9cd9e202b7795b330fa3daff81a4b02ab4ecfe47fdd712c53252f12
- MD5 2490eda5b4450138ba79f39fcc90048a
- SHA1 f8af994fdeeb8afbf7d95e816da389a7eb09806e
- SHA512 4f96028666bcb0a80730e8429082c2ab839fe8662086ad9735641fe8e55d51f909171124b1500c1da4065f26a9d3118c8b6c24d1827d12c5c887cd1e358a2d58
- SSDEEP 384:B3RxTVz/Cn1CfWok/7+I98wxOaPlXfNIsGwPEvMnNKp9p:fxTVzK10N69XfNIUUpz
- TLSH T19EB2F81963E5C762CCFD07790862621167F2CD51DB13EF6F2ED870E92AB37048B4269A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d327985d7e4f83adffbdf831c1e999c68cb90238790b63260af19d24bfa66b8
- MD5 1607999c56366fc2096a27a8bd237b98
- SHA1 0e0a61c55c6a7e8fecaa2053afeaf816095374a2
- SHA512 d30a642f26307f16a88782de2635b6e7b852dcbc90975c3920d61468dde06ed921074d95bd9d3b3b058ce4ce54973254370830d68f94a0d56b5072e82b890b85
- SSDEEP 768:fI3iafm1WcNQtd53fddlGemdITB8l/zkgQM8QRyHQuhwWCTxqPbojlfB:H1WcGyem7QXMryHQvWCTxqPbojl
- TLSH T19D23D6407A981CBAC52F067D7CE71621F6B18D64A327E26B1CBD60F718877DE96006F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6f8770a35ec0845226a28dd57c8ae414dc8814a6871bd0bb818bb13ca3b82106
- MD5 04cb30a874ee349721b0398594de65fe
- SHA1 8f3272e318edd73c1f4194f3a90143e18f158e10
- SHA512 a69b3bc0e30ddaae10478626ac231b214864b722c9254d932a81ea1016f4f49cf04551d17cbe93819f9e1bd88f679fdc1f5446761c7065e2b0d30a8b7edf40ae
- SSDEEP 768:l78dTGdbp1AD8CYDMxelHpWuVP1eksWwnb9s7:+5hD8C2MxeSidBeb9s
- TLSH T162D2D70D2BA4C925C5BE57359D2223224FF346134817FF6E4CCF9AEC19A23884B56A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
250558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f97aadb4d1c59f4b3155a9ec57f91a05700aed38b0090096f8f1e0e7975b6561
- MD5 9c8b5c9ec7d24ef02c7df4e589dba366
- SHA1 6f939463f40343cf62afc072978c833ee864914f
- SHA512 a4bf281274c22b41b8faf0cbe7559c5a62bd7614bcc06cdc29f8f28419010bdadcb70a850886b4be9d7b6edb370fb34283a5f0991a1320edbaa12b5a194f8196
- SSDEEP 192:dUFqUAbp57yUnWcL90wG1YL7ANg5egmdOnB61f8a54qwynam0q61pLWnVG:dUcNWcL90wG10MNg5PTM1Ea54qwOaz2G
- TLSH T1A242F80D6F88C613E7AD0ABD26A3431593B6C1664312FB5B5ECE74F569AA7C202083D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
README.md
- SHA256 94472753f8a506fcfbb28d294af7b4f9ebbd878d274444d4fd588e2035f68533
- MD5 ec91841256a3a5e0e6d45793717436ad
- SHA1 3a22752cc744296a76fa9b9ddaa388c312b4939e
- SHA512 5ba66e653d7a861edd31f0cc217ae549712418f6d9ed095c26a149bb01eacfef8c9eb5c03e760818aba27bd26fcfe12090b875972d47176e7fe05eac6babb14c
- TLSH T1059002E796063B41814391164D41511D1430400599089518A52492716E1A1659672988
- MD5 SHA1 SHA512 TLSH
WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/Anti.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 01d0bedcc943e13e341578423a2fc6848d9f63f1c5800b9a16bd64f65a1fcdde
- MD5 2170473f4f2b81e9b909996b0f459d16
- SHA1 81be2df85521167bcffd449e22db1add18e7bc5c
- SHA512 f5d879a45dfa733e264018fc4a714421e8b5fef5f8f06f2293ac327bbc4f4d09fc123a38d271bbd1dbc6e0ca206ec618027a10bf5291d7bb804862cef4aeb416
- SSDEEP 192:J1o3yrrIXd2lBBVCfA+XZm7nloYk4kNIDLR7swYoxU5R09KxK:J1o2k6BBVIA+JT4g+LRwcCRCKx
- TLSH T11742291577A58374CFFD0F325C6356101BBAD706CA636B3F98D8427A99E32108663E32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Desktop\My Src\SRC - Coringa-RAT 0.3\Stub AntiProcess\obj\Debug\MemoryDiagnostic.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
159B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/Bsod.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/Exe.egg
- SHA256 21a79c05c0f8307c51271987d8f78c2be7adc0ba1882cff03d9be82255e09dd5
- MD5 d81891c69f5b8e60db91a41be4249c8e
- SHA1 77b257e03fc069c535b42fe8c38bd5e9d8f21e86
- SHA512 55b1a8117193331375444324b81c488a738c88b8b0e53d72cfd7fd088677db0f7fb7f01af26930db816f2080bcc9bbb5847fd5cb8034f5971361c8bc71905a49
- MD5 SHA1 SHA512
stubs/Hide.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/Mpress.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/ReGKey.egg
- SHA256 b8fa5aa5af1c96f87c35e32117364155dfab8f913fcd098b71f59888e0609154
- MD5 c7e93739b6dec45a71cce1da31ccdcd8
- SHA1 7b65dd11ab20361e4c4d9dad4a1c5d0389d0af2b
- SHA512 016f6e6bfe36567430870da31d1bebc134f07e68ab7574e2bd22e17f80aad19e9036c9c97322ada577fdd6cb67056fc528b1351086d02eae69bbe62dd475d2c7
- MD5 SHA1 SHA512
stubs/Sound/Sound.wav
- SHA256 a76aa44b4924a960d020cc82c0e29e840f46fd81ec05c91ddbf4f42169ade4db
- MD5 ff8b7adc4209146b4ec595a986fd6384
- SHA1 1630cfd169baad76ba47fc725f296bd4fbd26bbd
- SHA512 f6e6ef9dd841d8265f6d6f0f26965c467c8db6d60b81eaf6bc8aa85c2b77ad5e9cb939a30ef37349f7ed666480847e0dd0d26e61fb0a5b12bac1d58045d6f510
- SSDEEP 384:2fNSnOOUe9RcnAEtrNEAl0Zcp1+XKnRPXnIbMUjwu8SKZelRGSQMQRWFV:W4nB1OnXLPlmcL+XKRPvUEu8elRosFV
- TLSH T132B26B9384E1B0425E0FC6B9FE1BC9A8F14AD8DDCDCDD75A5114E63690F6232C29F982
- MD5 SHA1 SHA512 SSDEEP TLSH
stubs/Stub.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9901a131548492470fab93c1d607be4d5cfa174f5b2efe2a592fddfa3af9fdd
- MD5 2ca8aa52af999240dddb9790a1f474bc
- SHA1 599fa5e9ce3f7a634543595f73dd92bd5e406d8e
- SHA512 5bad1d2bfdd6259456b8beba60a93341a6f3dab3d673bfdc6003891357e3bf1344059849c8941f532f46791d25ddd29040c5a4549ae676a80cd545471658a9e9
- SSDEEP 384:7F7RVdzu0ohd1vwyxEsvgvRpkhcaE1EgRqmVldNCJ9yko5lwWHWqb4Zz8ujoLT3m:BMDzBd7vAcIqAdQJ9O5GWHW6UkA
- TLSH T13F23A64DB2508574E6EF4BF1B8A162D806719057A946A10FC9F2B5E94FB3EC08710FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Stub1\Stub1\obj\x86\Release\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
111B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/VN.egg
- SHA256 417dacf7bc522f756571e33110ad80a23a17a16abea66fa1c004e91b5535140b
- MD5 8746d62c81bb0c573a0a1086f9955c7b
- SHA1 80ee75364815abf7c4ac88639279d2137bd8668c
- SHA512 a3d26b5cb548f85a567fbcae79f5769f99f1164e2d44ed3594c220f52d63d5996e3c9cbcb972f129a54937857facdb0b82763e782f68bb27cafa419ccd956e49
- MD5 SHA1 SHA512
stubs/copy.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/dir.egg
- SHA256 07f8b1a4dba9ee295d9af001e6859fd115c69f452d287fc6e6c0ec6ac49cafdd
- MD5 2fbcfac1e2d2302c87300af0d4f592a5
- SHA1 c73400d24e0b5332a354df36b33f90a0e980d619
- SHA512 000f85bdda6558866153c7c2a7fc0de0eb9e36218f3e4748af0909c7a74caff707b8f46a51949ed63454d4c1d8045382136d9338c7fff492737fe12169df75af
- MD5 SHA1 SHA512
stubs/dlentrypoint.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c8294263bb4e447f53eeb9e639dba6ec24d735d80a7d05894e8b88bd115f2970
- MD5 4a7b5a4da67c17c762cb538e6fec9ed1
- SHA1 65945d34c9484151c67f9a780c488186db4aece7
- SHA512 fcea20011c5cfc91b1f523bafe7df96a1723bab7a7bf182ba14caddd76eb658faae9a8840b9095a8f30d6ea8665e163b014649dc32dc3c0f781a435f4be11c2b
- SSDEEP 192:RFXnc1L11AvlszLq65grqZmGnloYk4KNIDLT7pnElS+Fs:RFs1LnAvlszeILy4a+LT7pElf
- TLSH T11B32082653858776CF3F0B72082375404BB6C306D296AB7E9DD466AA8FD72460BB3371
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\AppData\Local\Temporary Projects\class\obj\x86\Release\class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
131B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/dlnormal.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e36c6fbbc68953d2702c3d5f84eeb35912ce9a53aadf467f8df60faf51a7f5e
- MD5 2b53e572879a63aaa6ab032221a24d99
- SHA1 cecfb4dad0d128bc78369aba53839828af223ff1
- SHA512 327d26775f38f29f462c8a3a9d921ab0d89cf80527acb2ddd539d0842988f93c2cbf335a865cea893ab2a81915a95683cdfd8033f9a357aacbf0b8d3360e8188
- SSDEEP 192:3d3WKytoFQldQKDFdzG1nvlldKXZmGnloYk46NIDLRKQVuYvpxGBA:N3Wuy7FBGJvl7KJy4q+LRK6lx8A
- TLSH T1CB320829A7918770CFBE0BB2086775800BB6D30AC7936F3FCCD4695696E311947B2626
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Stub Downloader\ClassLibrary2\ClassLibrary2\obj\Debug\Class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
119B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/host.egg
- SHA256 12ca17b49af2289436f303e0166030a21e525d266e209267433801a8fd4071a0
- MD5 f528764d624db129b32c21fbca0cb8d6
- SHA1 4b84b15bff6ee5796152495a230e45e3d7e947d9
- SHA512 2f8748abdbb42c16f5d62251f8adea1f65443b6ed0ec063b49be332a6c8cc200892828deee3bbc44bffff040677446dfe0fe5d9dc5a2150d342dd93456b54e22
- MD5 SHA1 SHA512
stubs/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
stubs/regch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/regname.egg
- SHA256 d9bf5215fd3470cebfaa8f90e670edd92e2192d7561f0fb0563d54fcfa6efdbe
- MD5 99c7315e03761ceafc2e151ae808f267
- SHA1 799d0cb439a58d27b92cdf4a8f177aa3fa49d4af
- SHA512 5132ccf17ff8726c7bb338df203e45b639adbd5665dd57a9f5b8e4e4f80f916abb74f4c96fffd017f2b5bf9a84208a211225f3d8ef8337b4aa0442e6303b070b
- MD5 SHA1 SHA512
stubs/startupch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/startupname.egg
- SHA256 46237cbc19353167743677a80ab15a202877d968d907ecd4341ecae2cea2d3db
- MD5 7797cd8b4621ffc45f229516be6ecdbc
- SHA1 6ee10b56197f3d7732c93c35229af02373466caa
- SHA512 f993de6f1494d6fdeb3f489e6baf83a5c307c9bea1bbac2e7ab838439be445350e53a13f125d03a7208ecd84617ebcbee49022b2f8ac814d9ce73d2a2edef63d
- MD5 SHA1 SHA512
stubs/task.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
user.config
- SHA256 4b811ec98b3799a6fa3ac12796768b8ca04a3acd26f8d78a3e6e159a346fd697
- MD5 ad052788878c1d604567873934e7f010
- SHA1 b667670af3db27405aa79819182a298e947e4b1b
- SHA512 d278a23c9fe1c6235b0e4a8bfc253f18cad99fdcce6305ec25ea389d9323cf24d78ca9378004557a6ef4f54eaaf047bd90e59136a620aabff1c14743ff10aebc
- TLSH T15BB002C494508D754F9D0521DC0351214D94174CCC713570F7301723C40007003D0151
- MD5 SHA1 SHA512 TLSH
NjRat-0.7D-main/NjRat.0.7D.Green.Edition.zip
- SHA256 72029d0005d9b3130cdbdba3d6d6129a817f073b5eaedd79345729042e586a25
- MD5 5e9879dfb0eb64e734c28f514f208418
- SHA1 0b5e8d1f6c777a07b6da9de781e7525d6c0b7562
- SHA512 df9017285c26e528765e89f70d148f5654dad3797839aff610e017d2afe30b55f3df54a46633ce9dc8de8b984ab3b38db6bcabbb8adf3fb561fa36c9fd383bea
- SSDEEP 49152:z91Heasnn4LOb5a7kQdWH7xKQtkWhCTNMH9xf1aawYLngK0posG+:z91Hn80y/7KQyW4TGHfnyosG+
- TLSH T11EB53313A332E504E23803793B70A5C7DADD6EC2B953693B75DAD8689338B5E17B2143
- MD5 SHA1 SHA512 SSDEEP TLSH
GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
NjRat 0.7D Green Edition by im523.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580
- MD5 1033c448810d3b507423546432e2f502
- SHA1 2bf9d04f68ed15b957378fb95daa78c85d5b2b26
- SHA512 aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44
- SSDEEP 12288:ouicuiPszLSDeMFFFFFFFNPjiRfbljmYpNk1Yt6JwpwqVcTeec7neIjjpL:ouicui0zLSDRPjiRfzUcpcNgD
- TLSH T176850B03B343EA54E97812F46105CFA052696E4E9178C1F639AC3B79FBDA8D1BD853C1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1691166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\im523\Desktop\Sementara\NjRAT 5 fix7\obj\Debug\NjRat 0.7D Green Edition by im523.pdb
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
146B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7722206dba0cfb290f33093f9430cb770a160947001715ae11e6dbbfaef1c0ee
- MD5 73c8a5cd64fcf87186a6a9ac870df509
- SHA1 7ea0bd1f15d7c8bc8b259b3a409b2cd3b0fe3eec
- SHA512 b5faaf370d951bccd34da369e970d75c8f038bbfc99cf042c89a4ceb9cc077c1c8fc81318d79180c67373cca8024d27aaba052d4cee82a3aeda8d59ad0ac817d
- SSDEEP 384:nok/7+I98wxOatKr3xcNRPKtoMlqfpibcWY2EvHqNiaR6D3sO9:c6oh4RiHlqhi/EvDou
- TLSH T197B2181563D2CB63CEBD077A0952A24167F2CD44DB12EB6F3ED874ED19B37049B0268A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\im523\Desktop\ll\obj\x86\Debug\ch.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
99B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- TLSH T185D2C70D27A0C525C7BE87365E2143225EF786134C25FF2E4CCB4AED5EA2789DB4864B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
250558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Server.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b6074646068cfd2536df69f95c2b7d45ea1ca196098bede73a9dbdcba8e96e5
- MD5 92c80777998fb2d7cf4a89e3c0485c32
- SHA1 1af70450af73c0a589ed7c0eb07e6c5cf800f319
- SHA512 711d2485afb622c2769b7485b920651676699386458ab301eae23207973463afe8f2fc53df045d9ebb764d1ce16b45c68384e1dbd2679a1a30837bb4dc32b92c
- SSDEEP 384:9FGBkiyRnDNGRn5IyUvoIdf1hg/SuswcrAF+rMRTyN/0L+EcoinblneHQM3epzXx:DZ5M5jUvtdAaufcrM+rMRa8NuzZt
- TLSH T1D2032A4D7FE18168C5FD197B05B2D41207BAE04F6E23D90E8EF564AA37636C18F50AE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sound/Sound.wav
- SHA256 5ff592b183b2c990448f1dcd842a29cfe17a3eaa9956e0135c945c578676344a
- MD5 562fb3b4b1b1eafd2cf107f2e92e0670
- SHA1 cebf2a65c99e1b2c13d7212bf111bdf0fe5c13ce
- SHA512 807cd580a04c84fb671c1dfa0fc2b90bbf2428e4727d7fa3956011623cae5c7e093acf55d5f0ad325116b729c96e845f06f3fc3007e8048238aacdea7f21386a
- SSDEEP 12288:kqqW6lExbQPGUXw7zYmDahneArkGZKatb4TZdXEuH3S28UI:Mz65YQa44kKmLVHiXUI
- TLSH T1FCE40262D880CD19FACBCB7756D3991855E1A808E2AA570F75C59ECBE9C3344BC4D383
- MD5 SHA1 SHA512 SSDEEP TLSH
Stub.il
- SHA256 ed79411707d5a9925f1146e595983804e4eeafe35e72eb51703908eff13cc073
- MD5 3575abf7ab346ec4039138fad1fab4b7
- SHA1 c5c7b08cfcb707cab339d966e36de6c3c97bd7f5
- SHA512 2044d78e20a4d7b8acbc0ebf61c38176314ccf02a0b009b161530b78658444faed8304a628938514d98effe5ebdd81275e1328f65d98ec3f2e545f9c9de56179
- SSDEEP 12288:YbidABkcrO7qU+1gtxPXEx8V0IC0FcUYpm+0DGG+ld+HkZCpC654tDarkic:s
- TLSH T14594FE298228559ED572661DBE72C756F76F42230F326C96BCAFC254BF312C8813463B
- MD5 SHA1 SHA512 SSDEEP TLSH
Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
nj_users/VM-РџРљ_vm_602F4037/Keylog.rtf
- SHA256 9a27937010fa2be4c9f3634fee0bf20cbdeb64bc7141ab1beda02c06de27f869
- MD5 92122da996c66cbd51d8c6ea868739c5
- SHA1 685b9da98ac120cf133d55faa4e4a8438d1439cb
- SHA512 152fbf1314cfe26d3119868f8c83f6c332b9f4ea2a63034f91a4e66182575c90a2e6303c5ef2442e8a4deacb30f29277ae35870dba01505770fa0fa87ccc3838
- TLSH T1E0C022248510D09A168A254C6AA8810E1ECBC1CBBCCAE5C62042180C706271F71418C0
- MD5 SHA1 SHA512 TLSH
nj_users/XTREME-HPHU46T6_Администратор_EE0C994/Keylog.rtf
- SHA256 c1534af7f44d83c419a261e90f1b226fd26171a3a55a494bc831006f9474ad5b
- MD5 890cbd4acf6ba3b475f59bf3d583da83
- SHA1 655e0c60316c93973457ba5145de9e6a15a83567
- SHA512 2d69b16799c11a785ea891dee1574d605bc57fb2ebc98dfd0a9d631a24dba597f4b5aa042a16a0d681358f804d00ebe4b3575af426649b8ce803bb9512a1c05f
- TLSH T17BE0AB288810D18E068A0A8C0F5E42072B5ED05F3CF9D6A66852AA0B302AA0EA2074E2
- MD5 SHA1 SHA512 TLSH
NjRat-0.7D-main/NjRat.0.7D.Lime.Edition.zip
- SHA256 bd247718429e52d8e49d1f2c36e339ba7ae8451f6dd08e9e93a2abe222df2159
- MD5 13ff54ce26a0175fba427be4ceadabd5
- SHA1 81200c7da7585e558147617d8e4f22790d8091d5
- SHA512 d58a766d522116d77675ab621ac905e43126f66e50c5943e6594209405ca4815b79dd791b2a8f3d674a2ffe53c8b0914adfe3db554a32ecda3b87514161e8ff4
- SSDEEP 393216:vTtJ88g2UEKFAP9pw9MlrjPY2zInuQgfFKAFkiak4fm:vTPg2UW1S9mrjPqMfOfO
- TLSH T118E6335C04B6B25AE4F0CA7739485714F4586EAEE7906FB2FD09AE1C5F148F038BCA61
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/GeoIP.dat
- SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
- MD5 a0a228c187329ad148f33c81ddb430bb
- SHA1 d70ec83d1b15b3156df73802dd1bec024b1b9346
- SHA512 0fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
- SSDEEP 24576:WUH7rp/TXKHJBjsN0wjAu6e3akVX7k+k7bKnz+AHxOxaz+hnV647KyMLh:WUH3p/TKpBjs0b+akV4+C0axaz+ZVL7o
- TLSH T129358C22FF0696DBA9413D9EBD189EDC18148DB9FD071339625E379C60B8374CCC26A6
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (1).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (10).ico
- SHA256 c3e80ac14cbc29ca45da4be38af545988a3626f90c142f75d69552bada6b26dd
- MD5 eced1de1bf2067570510d36c6863bc53
- SHA1 4515fc85df528fc34737b2ac76228849a8f6baa8
- SHA512 5bafa187ca99ceff80a29ea496f8433afd07868d8c153cc75ced7cf35ee6f1e40d70aeebc8f15695f99f1d39cbc64ddb2fceffaf9353c4eac94b957929bc87b1
- SSDEEP 384:jMFK33393ZeoVrVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfAA+dkYL0jEV:Eot41qr
- TLSH T179E2F856204ACBC8E8155C72E2383DFD02112CFAC60F48A799D6FF54FDB85E8061A97B
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (11).ico
- SHA256 59dcb6c0ff03d989a50d94de56091787cc99ff4f35b7d92d54d3093762f4cf61
- MD5 8527b2d62c1a051a1e4a8dd8f6f3524d
- SHA1 38603fe6236a5272010e04eeaff62fac0cfa6476
- SHA512 1b91c3d4f8e235099cedac1fc03ec4f5bbc8d0fd0648fde3d7b7f349dbb9717a6d0e771e4083e62b2e597c6578f6884d245f8ec76a314a73fd9dc717910be71c
- SSDEEP 768:ypg200li5mF+Evvvvvvvvv1cZlPQNr+Rv3Dd52dH0Oz:yp00liOJcv4r+RvDd52dH0Oz
- TLSH T1816333277D01EBDAC82BD972F45BA5F94A127EBFC1645343B2C07E1578B2812D03A652
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (12).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (13).ico
- SHA256 2929c71fccdd683b953e0a59a4ef21df703d59e5d08d0bfa193ef078bfc90f25
- MD5 e8897b34f81d635aba478737dc1ea06b
- SHA1 aa820313997ba211a4e435d1c900e7a3d210185f
- SHA512 62357dae2f040d77a3a25f6a698e06dccf3cf28011a4d9d24782c56fd1880a4e22f391ccb0ed6892dfd88bd9411abcc6b274a8819818604b3dfd71931d9e61c1
- SSDEEP 3072:Q5+RAEhS6bKDGAwC8CwqgJ0zZiACGLXCEkNCCBwok8b9sg:S+A6S6BAwC8CY01iACWz6nBV
- TLSH T143344A10AC736582CC39F170C1BEC9B98379BC1AA3C69D6AD4E0B121AD73D63FA17156
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (2).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (3).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (4).ico
- SHA256 96ae6b12864258da631d896e2ab1ba247957ff0dc45aa935aad453c5447dfc42
- MD5 ca33b28f5f6ddb6c8974fd78d1e167fe
- SHA1 d2f6d185aaa9710efdcb4901892cfe3fba26641f
- SHA512 42f5551632b655ab010c5769fc30a7ba38ec1069b458c1459dae0ff9d090e6bfbae052b7b14e5acc37b9f91ad2f70adb03f64177236be99f45f465068d0f3e40
- SSDEEP 192:RFVE6Wv/K4Vn7Jh9b7n0Fu7bdDd0ssiw/r:RA/DHn0F8RDd0s+
- TLSH T17532E8EB1B8C4D1BE5066634C5A47F36102BAD91A5424F57B5D83D0AFD09FD318E09E3
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (5).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (6).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (7).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (8).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Icons/icon (9).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/NjRat Lime Edition 0.8.0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0cd735d8d6b0ed76d4c0477250a3ba8e6befcf865204de97679d93099ad12de6
- MD5 92626a4321b5589b03c3292646b86790
- SHA1 10cf3966f67976654e934c2241a3db49b15c6af4
- SHA512 0a0e27b907532bf7ba82ae4b11ffe4750e36d173163e0697e0ace32bb0f466291f9bbccf40191569f4c689674ffbc018f7f75c8880b88b5713d27a5b8ad80ee3
- SSDEEP 98304:PCVbySZc/e9WZJ051vuDhyToIveG1eLqY+rGqGObdKImSlJaPPjLvx1:x9ZJaW9yxegUqt4GlJaPPjDx1
- TLSH T13846332C01761122D4F2B2FD16DAC33A52189C0AB850D251E9F6FC97B9745E3ECB8B5E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5606766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin Compiler.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 77d5859c1973d0e9aa2d28a0d8cc46ecc6678828b35a728d8c4efebf596fe448
- MD5 e0b76ae4dc1e02ba1393b5d6f14286a3
- SHA1 9902ceb6f9af538960b54797ccbc502f016bd2bd
- SHA512 0de3dcce58dcf2b190608cc4fbcbcfab0437d5e6b8a648dbfaf5bd3c8539b1bda9456a12553aa6b58efc36ebdb22ee74875d5a769b5e5974ad8dacec69c38cf5
- SSDEEP 6144:R2aOs7VRzXl5uigI/6dSB4MCsc4RSbq8tcomGlbDoSeEos:dVR/hF/6dSB5CscQSbqMBlbDFis
- TLSH T18D74021E62434B69EAFF32FDA5E1E9F400965D669458E40B60F4FE833873643EC2149E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Hacking Tools\Sources My\Rat Crypter\lion hacker crypter enterypoint new 2014 woooorrrrkkk\WindowsApplication4\WindowsApplication4\obj\x86\Debug\NJRAT 7.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
340KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7879a422086a39f4cfc54e3474842471ad917e4c02c0f9c5a1df200bdd9330a
- MD5 e060977f25e63e43807cacfaefce7fcc
- SHA1 aeae36ca89f0887b3c8572b350dc556cd8dffc5b
- SHA512 c6528508fd4bf89f13e28a8d4ac800b12c7d8bb916587351d2c90a3f4bf82bbecc13b8619e3b7d2dcfb8f07557cb08451a4ca6ff2c140cdf6a5e64850f43e990
- SSDEEP 1536:y+V0m3PKUhL1vP9QJwnXusCEtsIbepigBULBqa:y+0mZ11WJQIEeIbepigByv
- TLSH T106532A2A2B98A41BC58E577C50B30F0003F0D65A7623EB8A6F7961BDDD723944B173A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 86fe7c55b617ad645ca0bff7d365470f0766d8487aa4037b85d44f0cc692c5b2
- MD5 a993abe13968a324e4873a6480ee1bc7
- SHA1 7852144fb66498bfa60762fa2e736c154c66cd58
- SHA512 7a5f78db69facbf18b72da5c15d71212cb44ebc3da52d9d23ec23c4595cf7f9eb4098ad6cc279529a154783b2306a8f20a39ea1dcaa306fedd875dba533b3c97
- SSDEEP 192:6uXz5lc9dzEMnaKP3oLLTJB3UCTOzri9oR6PmR3dE5BMwLXUicLLC:N5WzlaKP3oLLTJB3UCTOzBR6PmR3dE7O
- TLSH T1D042D71973949B27C96CA67C95A7831023F3D1155222DFAB7CC918ED6DE23D117843CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0dd0617d215bbdf5a1d8eda7eda4096ed17d725e27ffdf1fee400c20910f70a9
- MD5 9737618b1db06b700b8a3b97cd3b3e89
- SHA1 875790dff3c526596b86bc9f1cec06cd26657561
- SHA512 7613e9a99a78e80ea979e30068af9015ecfd16c1e18aa4a41690dc02ca416985706e534ec6013bf06da897bbaac7258224fbc5cd7ecfe1479d1078d882b5573c
- SSDEEP 768:Loqi5LbGLWNbufGemlXEFajkt22rB7BJodsx7fuhwWFTxqPbAgmB:Lo7VemlY9V7Jx7fvWFTxqPblm
- TLSH T10F33D6507EA41CBAC16B067DACE61112F6B18D68B227E76B1CFD60F758833DE86406F1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/pass2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 eff6d9f2f2609be04c69339c21b69b77c6b2f9575ff1b8ea3218426032f28a29
- MD5 2e17223a079a3957be8009ebed5548fd
- SHA1 63c6378d766db9b0a4a5cd960d9f5b6184d867e1
- SHA512 2b31424278b60708045e8ce4e3c7519fcf409aa755ccd8e942cdfee4e127112dbbf2f34e7e161cd511c21594b2679fd7c926848d7591f3283d4d9cb71f40a60f
- SSDEEP 24576:qank6BtOSlIoK4Yuyhply1J797XYiXq2698VqUj:NLLlRKRfhpl2FXYEqf8
- TLSH T172150184B54ACF60C86B1D30C521CAF0046A9EE5FD24E45B6AD4BF0F783BAE5B15291F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
942414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\HMJ\source\repos\ConsoleApp9\ConsoleApp9\obj\Debug\ConsoleApp9.pdb
mscoree
_CorExeMain
Name
.text
Size
912KB
Virtual Size
912KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 768ea673e4297c8b0761b639aa2fae174c89f6551cecdf3d7488ff3a261c85a6
- MD5 1e2a04607169f65dc5427d10cd4d9d00
- SHA1 11b62899bc8dd6a890f832c82d230b207474024a
- SHA512 4e54192a1fc6f927dc7a485ed14a33c840baf854a5333ca941c172ebf5212b15e6a1a0446a2af84d9b7b1692ca3275bc89b60f817f4dabbe26b9865f1a871fcd
- SSDEEP 384:hgLZMJMNbAlDWLJ57nPpZUIb2pst55d8unTlC3/b3DP0lpm+x6dzWxQpbiqWz5m+:h+8dg5rPpZUIae2j3rc+KUbkoa45
- TLSH T1CBD2E70D2BA5842AC37E87355D6243215AF782274915FE2E0CCFCEED1BA37C84B45A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
- MD5 db87daf76c15f3808cec149f639aa64f
- SHA1 d67f84a44ddc25432ce179aeba9cff778af746ee
- SHA512 ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
- SSDEEP 768:fqcFOkBO3jzamnEjt0Wp8em0nktiwRnKSg42+:fvg3jumny0Wp8em08NBgG
- TLSH T10F037D067BC69301EABD8FB51CB281444372D28F5D13E79E1CE988F42B76B900955BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/pw.zip
- SHA256 97c84bfe8f2c973b13cad4b2acf9428ff93f156a6f7ac8cecd91797b5a4de85c
- MD5 f56c7629de32bb65e127dbf4679f94b2
- SHA1 671c4bb7b80fe3a9d1087afd6a0c1cfd32726a13
- SHA512 00c7b78adad3fbc173e767766de2323b6e0fa3b3d21fd01ad16ffcb336b8ff891550898eb293562ff287a8e32910841d887800842d624477b6279489cbf6f89b
- SSDEEP 6144:o1w2AIaiP5m1/9lr320ZwmFe3UeoqTxtVLta2:Ow2AcPg/73nZLFXaRtt
- TLSH T178242369BC03B9490CCC8D71226F85B08FB51F7CC680923BB587ED65935E658AF9E438
- MD5 SHA1 SHA512 SSDEEP TLSH
pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
250558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 95fd52409ed4d0f49e4c6aa32dcd804feee5bd971ea3de6f6a23c007cb3ca5f9
- MD5 63fb7dd7af22405c8653745538f49406
- SHA1 c6bffb3f358a4912baf3b6927a6f55467bb61468
- SHA512 2e89007c98f387e63bba38bea6da87ee2c66c0328980a8d0f6a1bf3a7e5b597ebfc85b9a3579af3aa09395b578e213da9baaebb8b97b3636dd61638e24ae5a98
- SSDEEP 192:LWSDI04G7OzbIjxTU4b3DX8CB2/mZLkqGLj08Lt8dTGzRpy7yNVILDB61d+ZMt2y:LWSDDOPI1Dc/IQqG3082dTE3y2QXM1d1
- TLSH T1A942F60DBF1CC207E66C0B7D156356255376C06B1303FF2B9DC9A4B6A8AA7C22658399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/Plugin/seed.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 80063f3e9fee6ced4f159714bd00ba61d757fd185621d82330bed16d4c2eb495
- MD5 9462fc0f63c2f95bc2e6796189ef18b5
- SHA1 6bb4282414f3fddef31debe396a5264371ab1e3d
- SHA512 c0b542784f681aec31899235e425c482b43da038f1ca847b428e34a4677f1da30c773f43183c3d287f64bb7271fffcea873ca03136de77f54c1bf614cccec297
- SSDEEP 49152:SMHKPBHLsPMN3FYmrvaWJB4qHgOOGg+zESWYdCvLv:OHLsP013vaqra+zEJwCv7
- TLSH T1739523B98986628DD2E9157100BE1F018CF07DE75729637FB448692F8EA3FC17257A32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2017318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\HMJ\source\repos\ConsoleApp7\ConsoleApp7\obj\Debug\ConsoleApp7.pdb
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/README.md
- SHA256 fcd6d8bdaf471df5bac479eedef336ba1f889c45cef02cf3d1ed0102d57c9ead
- MD5 a147bd20283209effc833d437854f47e
- SHA1 0bb555f1fb95421b78408716e376a0808d063f62
- SHA512 854321c8f03c4ecb88c91808bc72793e66208cc1033d6fb9f950b8911cc75e7cc3453995f03ef3fbfa095db200bd866ad9c7063c33afadededaf2435ad36dfec
- TLSH T18B216323313C3F271751D159F10E2925EEAD2492FB4285202CEEA54C629DE69CB3F4B6
- MD5 SHA1 SHA512 TLSH
njRAT-0.8.0-LIME-EDITION-main/Support/Media/Best Settings For Crypter.PNG
- SHA256 2722c257ec5615a7d225a62bd431bb42daea9eed858d80b6b8e342beb4532386
- MD5 bcf793178707ffabd5f18631de4fc34a
- SHA1 c61d681c2df492d8f6b07ebc163a680e233bd651
- SHA512 704cdc07d3de17169e3f2a5c2422023c9b81ab57da8e12d2c2b343305222e3df3514278d5007866b3afe4da0539c4f7028c676b9c6217ccd5017c87602a534bf
- SSDEEP 1536:WPYZbxa2HNkX+CrvwjvuN6UrxzErxFojuxjGR1bA:PZFg+CTjNano6xjG4
- TLSH T1B743F1F50676D0A52231AC5BD87AF0E6EFE4E4DA29710A4C8B07F46D960DCD2B25C4E3
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Support/Media/Setup.mp4
- SHA256 2d6dad48684958e403a8f0ce308afb932884a2c56cbca971874c82ea4d080e0a
- MD5 d8c8771ddfac187261e0465eb493c081
- SHA1 461f07d48bfb95190e9b021d7b07a63c18564736
- SHA512 fd0a8a257dcbf51da219971756a7cb24733864b71af2b74412c3f7b9314c70fa3914b8837f4a882e99f9b5ee6fc3a120c093db5bded3a1d96c04c514bff10576
- SSDEEP 98304:W+vKXZ2hd8djsLslj41+no+90C67GkFMHcXhcYJ9Mg3I:zvKXZ2hdmj1j41wf1XkF7/6eI
- TLSH T104468F80BACF21D1D89D00382546D3542AEEB1DF07F5FEFB222776A649077CB5E22592
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Support/Read-Me.html
- SHA256 3252100d550d0de970722bad4179ab11c011a9ea7acdcd0d24a3f75c7780afe3
- MD5 13047f6e4bbc873e492fd857f8d31bb9
- SHA1 b60d1e33fe75d15d1dac455dd702d958676aad15
- SHA512 9712e0049c849fb5e2912fc33d34cbb9c680626bd57584dc79661c8134ddf864488306e3ad415943123a4426676d0a2f2df432ff7ab634228cc6c96cc7004e2c
- TLSH T19661511BE31E7572147206D9F64FD5971B1042A823913B6221BEC2FF7A6C6273A2E0CC
- MD5 SHA1 SHA512 TLSH
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/ransomware.jpg
- SHA256 59bf5322df68243b365a47935a37d08321422b1288ad94b5551dbc655a895a1a
- MD5 e2c7571f6de6b6e4dfecd99fb6e33f79
- SHA1 65f83efad61d3e6535da6b48b8dcc3b088ad8b90
- SHA512 2e62b83d85b7b1959ea8ac1db540f7180bec27bed31dd0b61571e7f727831582a5aa2ba527d1e0be1f334690bbf1201c284d04c7485938f4202ac17ddfa88142
- SSDEEP 6144:FA74OjO4QhL5INwLSwXONU+Chyhc6yS9/oL3remkk9eeobFpj06nl42ZRSCieu:FA7wBhLSLw6/RoHexpAil42yZ
- TLSH T1919401606640DFD1F8ED0B7088E39B873923DAFB21977A01B85F205AABD717E50131B9
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/wallpaper (1).jpg
- SHA256 29bffa7b5b1b3097e1bcc13f78498eebd5d6c25f72eccc5d4d4e78839f43e1cd
- MD5 43cedc4fb225139deef92f484b94f768
- SHA1 312486999a42c00403d51305080ea3f92b0e8779
- SHA512 3aaceaa2459893336101baf838354cd47666a2537f02fc8372b9750f9642ad4ef7597c00cff21c1cbd60a2548169e19dcbf398f9416558972ab0b4c2244219ce
- SSDEEP 6144:azrcODyTzbAR70FYLN44ULT5vT5Fpieve/MERb:ercjzQgChtULVvT5FPMNF
- TLSH T13434123DF1A292A449EB425C9D7FBD93A24986F10178C428F89D8CEAF3D6F03684155F
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/wallpaper (2).jpg
- SHA256 0b65566b14dfc0b892be07dbb9a3f79b3c9f7b9987d9f43fd41cbf4ed0893541
- MD5 fb7556046d50a3e69c0f09bac27546ec
- SHA1 0f081996f7acdc7890e21baf53508be26843b66c
- SHA512 ef87640cea8d88071927f433df946151ecde3dcba600cc0312195ed0fa527e3ead9735670796ee6f89637db4798529233d87ad6d216ac82fd5ceaa300e30b730
- SSDEEP 3072:NFSg/sH1WVGlAQY8RpVY3iSZwQ4SQ8Xqk/IXu8Fk+OU+m+RTbCx+9mVaLyxiRaJ:/SNHZRpVqRZwQhHqkgXu6f9kTG+9HxI
- TLSH T112F323E799901E4B8C380F42CB28EDFED4BCC415B059E1AD515D92FEC24DD63E1A456C
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/Wallpaper/wallpaper (3).jpg
- SHA256 2519e72f92e95610e56ceb253ab6593a656d726cb4c3406fc2219164302d671e
- MD5 abd1c4698f7547ec6a5d908203fd09f3
- SHA1 9058137e7540daeeb3273d66c579c9ad8d6c3d26
- SHA512 73d46c8bff3b340b84103f8c0a63bc3066b8a0c950b77c3bc27db90c9cd96c826d6fe69d12966d7a4efc24d52123d33040b448eb261fa9d0eb3b63e98ac90065
- SSDEEP 6144:PAQUP+dRe0QUSp8NpCXunkBZMbqsfOaoeC9E7aTgPgTU:LUP+mgpCXeLXCQZ2U
- TLSH T13F34122CBA4ACD63D1CAD2BA92D1E70C9167A1B4958711D2B7CD26C33374773BC8C986
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.8.0-LIME-EDITION-main/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT-0.8.0-LIME-EDITION-main/image.png
- SHA256 c32a81e6a20e637dc721c88e4511736b9f4b60e354f01175b9d27cb478a9a0db
- MD5 d36cd619da519f130645eef58d970dbe
- SHA1 9675a5f0990aa0759da43f41cf7114c8eae22d48
- SHA512 610618355b8b02997aec78ca8d34c00e3508d581d00a3a59221e6466ef24616f9a0bdd63afc1f8de9716d37c5a6c68e02722d54e993f35777c2500862cae4fe6
- SSDEEP 1536:Dou3bylH4+DH8WDaA3PQMN/DkSMfjelrSUZ6scu/eN4wXAQxEkQD5L:r3bylH4o8WeUbhkSAjSDcWq4wXAQxEkU
- TLSH T16D53F27614F3C546CCDF5531BE1199A8CB7E400A9A36173007FD897DFD9426AC298AB3
- MD5 SHA1 SHA512 SSDEEP TLSH
NjRat-0.7D-main/NjRat.0.7D.Single.Edition.zip
- SHA256 902576f7f90174513a45bc82796b82c9264a57c82c0c72b7c9bf11e7da6bba96
- MD5 6a4984809b0b295b75d8a52095a70f73
- SHA1 5b7fd2737d6f7c5541c17704534f7602f7465b8d
- SHA512 f54954b82b36c57604960c020e5674e413ca61a61111290c1712036d1f00175f1263967c5ce3674c5d28e606d3c06013d0d331faba24a3a1d77bd38429f22a1d
- SSDEEP 196608:p3uLx63wJLFj37EL6GnrrrpPFXXmwB15EiuVnaUrHBB9UB:p4x+Gj3gXrr19Gwr+aQFm
- TLSH T1F4A633BC8235B8D2F7E2417428223A55D638D0BCBD9A3EB41D9CC7D9B0D3ADB5746049
- MD5 SHA1 SHA512 SSDEEP TLSH
GeoIP.dat
- SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
- MD5 a0a228c187329ad148f33c81ddb430bb
- SHA1 d70ec83d1b15b3156df73802dd1bec024b1b9346
- SHA512 0fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
- SSDEEP 24576:WUH7rp/TXKHJBjsN0wjAu6e3akVX7k+k7bKnz+AHxOxaz+hnV647KyMLh:WUH3p/TKpBjs0b+akV4+C0axaz+ZVL7o
- TLSH T129358C22FF0696DBA9413D9EBD189EDC18148DB9FD071339625E379C60B8374CCC26A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Bokehlicia-Captiva-Atom.ico
- SHA256 91c7291eb6b9acb6913ad7f2fc7baed35b90b7ede64ca730ca2d6566b6454671
- MD5 1d79405f7e023fae9cafeeb11c24afa3
- SHA1 c6b53636636dc6e95f570d1e6ce8b39f8096875a
- SHA512 768c5c6b6e0f4ffe308bec00ee67858ad1f7795489e4f8da9e428a249dd54ea529b0c9f47ed98ee1ef0faf86991e0909cb648b536efe92df5edd16295c0356a3
- SSDEEP 3072:m1pCyC1eaGNJRj3jHHHHHHHHHHHHHHHHHHHHHHHHAgcciBjsqdrrFrrrrrrhrmEi:WMe1X3jHHHHHHHHHHHHHHHHHHHHHHHHv
- TLSH T1C5141B03B2113B0BC4650877425143A819FAEC7FAF6F366750A0772F5D7E8A0E63AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Bokehlicia-Captiva-Blender.ico
- SHA256 2c75b081b7f6560e68ccdda10a7564e56b5c11eb94314a0a67a3d1c9b5ad86c7
- MD5 c492875b64c0fffae444a3e083399c1a
- SHA1 82df84680c877bd72355f6f94e779a108b7eb734
- SHA512 b444fe46c6f644965eb73fa9c2e9016b2f0a6e4cba26c49e265096528f87056c28ae3a7c4f6c79c8c2c1c0cc7ed30167c03b7899687b535ab74009695dc2273a
- SSDEEP 1536:u/SaS8PiHN/ejL4m4gx4EC7nGwARmxeEq9HHEqdIERM3RW2:ua84/AD4ihCLGHLEq9HHD+U2
- TLSH T1CC04C72E8B89CBC3F4CC6EF15A2245B153FF6C46146E02978A6179B658627C213DF09F
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Bokehlicia-Captiva-Firewall-config.ico
- SHA256 62bf6131f689a912778973368f588e057d33522c26b4e45f2630444eac70ef29
- MD5 1b532a29e8a448fcd9741839571e2d63
- SHA1 0b2c1cf2b039a13e7b2203c77d14bef8045ea83f
- SHA512 68cca16910623b788d729cf2b2d7275c7dd2213236ea9c72f24bc288cca2c3c2731df038df8acacec8efce5d35b52331d6c2116d892b56c804c42cec3164aa22
- SSDEEP 1536:IrbbCvEqcaw4+cxQbvlJCpELLL7LLLBSLLgRwRRdD75QesUEJeRRu3tCm5ULCeZt:ubiF2cxiJC8gEJeRR2CvVsNK
- TLSH T1D70465EBFF5D9E14D0E5EEF64C22D2B22B985DD11F3846C1DD4D74F20AE999B6820022
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Bokehlicia-Captiva-Nvidia-settings.ico
- SHA256 ab234c4921a836d62fe083b34620f9d0cbbcaa386cb60a7951fde7761b1fdfd0
- MD5 6c8373254011716ec00c937bc89c3f6e
- SHA1 3afda47954cab6a35dbfb80d6a9f81d36eab27b2
- SHA512 303b864c0e21fc13dda58cc8f72bdc9662b8240c14125a3c94efd8b5968f66d7bbbc9a9b6850b373734f05fdcad7fde6bd4c531648dd9206b1bc36245b99fd0f
- SSDEEP 3072:5sIThzA8888V888888f88888888888888888888888888xFQ1QL+M//22g8k:KCzA8888V888888f888888888888888Z
- TLSH T1AF040E6BE76F5C01D2309AFEE903BB951DEC92322E2CF6D589614DB6B8CC2417947093
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Bokehlicia-Captiva-Utilities-system-monitor.ico
- SHA256 54020401fb9a922ac6d87ce98e7faff4afa8a800194d1f8c721c699405617810
- MD5 d6b403b8948f016df7a27477572fda7e
- SHA1 a72140a170e688233dadee4a79a9ffd611f25cb0
- SHA512 6c73b1b0037c2824fed07cae78913133eca03944826ebeac848a9c74075c90642835b7d30cb33f887c7bcc2df1def84c319807fcbfff1f765575d7651e2f885a
- SSDEEP 1536:fTNHrn7KXuds4kpESkDhGL79DY6SGXoGniQQQ1fZTK:RLnBUQoVYlMiQQQT2
- TLSH T1B60495142EC0FD49E66CF07411B0CA978AEF9A5D0623C561DEBAFD1535ADFCE2EA1102
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Bokehlicia-Captiva-Web-slack.ico
- SHA256 535f4ee53742c0d07f696972270332c425aa248a961be5cc5ef1211b6d31a548
- MD5 5ebe5bd94a99f8103cfa7ca18f60feff
- SHA1 698da213deb81dbd367ecb7bfdb4a7e06c263dd4
- SHA512 d139a838ee9766697ce3cc9af66918f283a9f2b8e7bd8e571a4af6f66a926b3eaedcfc84ae20e1c2215c85e41db261f32e1e30a541caf78f6c00c8fcefe0ccdd
- SSDEEP 3072:u2HxZyjPRld3mMSp9S4sBxK7sf9HQ92lxfjd7AOi/OplEu1E0YRWLHO51:u6yzRld3up9SRBU7s1HQEf7AOi/OpuuC
- TLSH T1B104AC7C66F49782C3BC25709BA3853559D06E78EEE5D30BD0F09C16A903DCE2A4668F
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-Access.ico
- SHA256 b4f6e0388a17cca2edf91035e663b416351fa89e0cd0d1ac226f058438c36f9d
- MD5 2f03b739995589a73d0a880b3a4e1c24
- SHA1 085da1ad0e017c2ce52668d18e3daa849b50ae69
- SHA512 08159f0e084023e1cf5802bd5bd5b0abac5168a25ffe3a87e6af0def839a1cc3e35ccdd72dc75df61eff7fb711d8481fee38b1ed444e38a82432f72ad5b1cdee
- SSDEEP 384:CBJJqh7rWQehcoQ7mCJnrJJJChi5JtF8884nUx88888x0sabfszx40:EJJIaeoQ7JnrJJJC2888l888886Xi
- TLSH T1ECF3DFA6DB6E4F65D1552B728C7FA979F9D29F0832B0B7A4489434C1E0FCA8210E30CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-Excel.ico
- SHA256 89e8a0214f242e7a5321dd5bb0f6c11279edc545a994c6633938d1a5ca72bae4
- MD5 6288e3bafe5576eaac15893ce3ed9359
- SHA1 1f5b46cbde606da717ed6c912a407608b6b2e384
- SHA512 3e4121b6df2f812628fc945c5635e869d71ffc12dcd801a8bd5432ba38ea6bbb34766a0db7a6f3a29a4cf3536970366077c9c057f57d2fd226740f823c3858a2
- SSDEEP 384:v0cvejVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalfalfalfalfalfalKlSlSDKg:vbvuvFZtj
- TLSH T1C8F3C823B07CD5E6F89C3DF45A0897256AB52E924238F097E91FBED6E8B3623C1041D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-InfoPath.ico
- SHA256 81eb99f8cede5ce56236c477c4e53981f4dab77a0efaa605c1d9179257cba360
- MD5 02eb592fc17f6ea0719d0d6b18588273
- SHA1 61c3de6e3055c3ce419a3b664e93919e9206b924
- SHA512 db5d9b7f51fbaaff95b6be678e4bc1dd889f8e90aaccdc009b3febd3683b7ee56064c89d8344c78cc140402aff0b6e40356ff05362545dfcd33a7e98bb48cdc6
- SSDEEP 96:aYtcJRqRuTb3HuCfXoo++yTzzLLjDbBkRRRaHHlUaaaaq444444444444444444h:aYtczqs7uom1Mc/rTP
- TLSH T1F9F371677ADF1BD4F0925FF2D891B9FC66E4AC2C1284849BB645FE3B24B1B20020552F
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-Lync.ico
- SHA256 cc3941ea46141d642f10adff18b1645126ee70db72b64fc949fee742c48a0a66
- MD5 414c3734aa12057926c20fdda89b4409
- SHA1 481adde3a79e17d1a28e0459e35a4c4a5a930d63
- SHA512 062ca8ed518473c4dccfdb0e337051b1ea6d0438625670180e86e7a9dc82e3b0950cf5d2b8790ca6fa4ee2398eb1eb9f55162fe066a7f9e5186e0eeb2e234805
- SSDEEP 192:5vdwI9nlQw877adqvwO2dPnOWBukJGrvj0nLt8nDO8:vlQwu7aymniPTonJn8
- TLSH T17FF3F009C891E8D5FC64BAFC28227750CAB65C51896D4CD363B5BBEEC2B15807F0F989
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-Office.ico
- SHA256 9b2f9abef3f184617658e45b6afca7bff4e162fee75f1d574e0ed99a78f2a60b
- MD5 da665d8230c75cf09aa0d4cb59f9e217
- SHA1 d675e57aacdfdbb58600eae85dc2d8b0ec18be41
- SHA512 a2713389414f06d1dc49852b8ac227eb7324dd5f84833e1c8867a8244cb4db5cc4cd9528ff064561d68736f19cce3baf842f3e930ca9e0b84a28029153dbc5be
- SSDEEP 192:mhJETQEj4y5ADduV03PCCiSl3joll5n0pM9p4YckGkZJHLyV4KwV5CQ:mhJuX4y5AD3ocVdwV51
- TLSH T1B3F382A4723090B6D89C5EB53B54FAAE61697C28C8834C9671D27FDF7BF0A30A700275
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-Outlook.ico
- SHA256 211db05d6fd99f4726cf6265c5fd0ebb242994b5865a02702d31309b9aa2fcaf
- MD5 92ad3018b5564fd60f49579442c5bca9
- SHA1 a6c84103de585687b474ff8c472ed456444345d4
- SHA512 4bb16893527ced3c297c6ce35a8cb7df20d0256650b13f7618fae5c35af9ab3f62e5397418e2799664bf1dba1ac2e5eafb04965891e693a7f6d53b8b93e494e9
- SSDEEP 192:CavdNWabOCByj6gORJeEwwweQII4M/ATRZCwkvXOhm94glxVkqw0WtqoO4l+j:tFBTgORJeEwwwDIrJTTCwmXOwTlXkxG
- TLSH T1DEF3C648C855E9E8FC64B2FC69017B54C6B65C40CA9D48E32BB47FFED2712913E0B949
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-PowerPoint.ico
- SHA256 c124af4531d16a23d220a335f8927002382ecb23ba6205e78508ccdbcd2a7f01
- MD5 26a6129b38f3d0b70db220b329e7d970
- SHA1 95f73a1c7ea6785567a923b7f41a84636ad53c02
- SHA512 144b3a4516610f5f983727b348fd254d9004965d715186cc1a687e8eb84cfd3329f8b1dfe197a9922ba29b265f713eba90c724112f99f405c93122b0e952fddf
- SSDEEP 192:JaaaTMSy9eFh+qp3vNLoabUE1faaa95OL52/KZ9:z9Ch+qBvSYq5w5X
- TLSH T1ACF32E8CBC58844CEEA9EA71191EF473FD2A7FCABA4C6B90C1507FD63972161064D839
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Carlosjj-Microsoft-Office-2013-Word.ico
- SHA256 607e17a53524f457be2fc5eee62791fa110ce2a57397cdcab8a12e53acc4ad0d
- MD5 213e5e6956287cf4da074ae3dbbbe4ea
- SHA1 8a6d88204c3b08a11aa25e0c6fb3700b5be96f67
- SHA512 44e1ae57973f27be2c4ddae36cd1be0b2ff642e713d50af1b939564e2f6ef0818526a596cc04828069730b322e73e5b65686cd88f3c8c8a67e591153f8501a43
- SSDEEP 384:Mmwww6BKpwWowwwl6ES0JXtZhVm13j2tSHPWcDeaYT:MR6ES0JXtZhVm13j2tSHPWcSaYT
- TLSH T125F33192EBB6EF74CE24093F8344B3399F2E1ED181F27D89314DB1642EB9D01D1446AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Ccard3dev-Dynamic-Yosemite-Numbers.ico
- SHA256 277da5044afd4d0e2ada605022d208691fa088013a605fd9cfa6caa2b842279e
- MD5 56776ef588b6e393487f4336729da61c
- SHA1 962caf71a160208de5b68619a1738fc7c2e4c385
- SHA512 48a1b718bee99fa1e113211ee853e3ef4afe77d31583a02d776c45ba2e51690ee4d839cc1dcd0e9613e15885eec5d9f3f45794dca229b7e9e9becbb9bfe3e684
- SSDEEP 384:cJntFzgFNlzEz2/HGO1eubgvs1gxFLEAOtR9CCzCCLCCjCC4eQ2LIo:c1Il4+HJ1xgvKgxFnOj6eAo
- TLSH T10FF3D544F25AA072FD385A3A15D7B650CD5CACE089698891A3BD271F3F772D18B0E8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Chrisbanks2-Cold-Fusion-Hd-Radar.ico
- SHA256 59ddd09041b697eb35979cdc52a5e15c82fbb124efc12479276c03a22216d6ba
- MD5 f1b634a8785120cce35948a341fb5514
- SHA1 0e5c699dfdb330f8a3e6709ff23c21e976729e49
- SHA512 a2860938b6a9ff294b527b9681a7877c9e7b6067bbee21428c4461fccf5f3f82065c3e62be18bf5e15815f81ead37771a1bbb0a00e1db83bf75044c90f885889
- SSDEEP 1536:T8YPUroe7pyzV74PFL1tBCxZaO5H59JBDSaubXCPGQ3B/4iiMLopa98FYm7pEBD8:T1Mr8b4bSPGEYmf34Rs7+SE
- TLSH T15EF363950D40CD1AC36843F0BADBFA6066F7ABB14DC20511E23E1F69F42568CB967B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Cornmanthe3rd-Plex-Android-App-drawer.ico
- SHA256 8915eed20d151827bd0e294a45442d774fcc337a46bd1e2f8c5c4557a4ab4d17
- MD5 43db64aa1471ac46d71832e1406f7013
- SHA1 8beccc99390cc1c03b0466a29836b6ceb0c91b97
- SHA512 39d7b4485005d9b1b1bf99e10a98da668c889e07da31d08ca824a94c5f09284869863d69cdd5f4aa6eb4ec7aeb49d1b01a00a9135ba3fbf3bc4dd48e15949e10
- SSDEEP 1536:KM8Roojoo8oooo1yoooo1goooo1Iooooo1Mooooo1aoooo1fTooo1poo11oo1ehw:9z
- TLSH T13B73EDAD16FF5396C1C39132DA8A40655CE85D1FFC5394B3FAA9337838768E00B1D86A
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Cornmanthe3rd-Plex-Android-Baconreader.ico
- SHA256 44409f5824e5b46c842e0f21a4a80f32668745cec801a166b537c31bdc2c6ed5
- MD5 5e743319959de11e2f4bdbb44c84ae82
- SHA1 60e394afb18b4680b07289cdf6d91b5f701db841
- SHA512 632875640eb882708225ac416593382abd27eb8324196eb2e49b0dfed43862fe06429696c7748044acf645ba108ff9e0316d75057e7de138da5dba3523f221c4
- SSDEEP 768:HoNnGSpeu2Xvvvvvvvvvvvvvvvvvvv+8pcz:IRGSpaGccz
- TLSH T1B073D91280FF0830F5F6B470166B95564A0A179FEA0C50A5255CBF1EB27AB0E177FECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Cornmanthe3rd-Plex-Android-Ebay.ico
- SHA256 4c0fc122396f38b85184e7b3f93e6c0147809a2577d3d7f49bb0aa4ee62d7921
- MD5 57d3350b8d9853c1e15142eca5e1b46c
- SHA1 1b1f1ae98d72a1955083998ac8725ca64f81bf50
- SHA512 1415cfa5a41ce69b920490eededa6953612d2f59657c9949f4e4493dc7c18dbe25cab840620f1e9d1461d08d817445947ec7f01d8df13e5f16fda9c93643423c
- SSDEEP 384:ZuzQKz0Ch5to7Cdx/NiV7+nCZQomscpF:szQKz0RprQofE
- TLSH T11E7362C42DAD059DFCE263F9C9856D9022333ADCD5F48A41B0832EBFF6666714285B78
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Graphicloads-Colorful-Long-Shadow-Analytics.ico
- SHA256 41fe2796815a1345a24529ee67604452541ef2b01fa14dd646ac3b3d411915d2
- MD5 16a0318b9c21fc7937e758f375f6bee2
- SHA1 d58c8d6b43387dcd4b66e28be03500b1563e4bc4
- SHA512 4930ae7fcfbba42784228837ef3f5f35b8a8a4df1559305300688daddb6cedb765247d43bddfe8d3efc27e8081d42d4ba2265d9c21b1a3797bd2b9b389b25022
- SSDEEP 768:Lwcvt1yXNN6SMJNwwON8u2NeAVXk18EjcT+MZa:Lwc11yXNN6SMJNwwOf2Ne8ygiMQ
- TLSH T188F3EF0019C712B8EE7AE87B2C55427FF6054983BA722537654D2271FBFC84BC7A6932
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Graphicloads-Colorful-Long-Shadow-Cloud.ico
- SHA256 b86da228efa3655f7013e7aa03427ce63ffc8657c9af526016b03c714f009436
- MD5 9d914665f71c78d430d3c0b3d8106897
- SHA1 169421cda38f25f27b3b89472eabaa31b84a6a64
- SHA512 3b80d268497d4cf3eddc011f9e1e6f022628f589db174ce63476ecc364ef898a5b7fbbefa4e27e776b4cfc9b87c92e6c3ba8075b3839727de58873ba4065c5da
- SSDEEP 384:yHUCguCj7/eWeFSzqg65VMdEKMmgpStgmKatnS9yTFlS0k3toxTLPaJgoRW4YcY2:yHo7feWwgiWvOagmKqFlS9dohzqgozTV
- TLSH T179F3633C19424C85CFB3D6344399D6021662AD26ED7A87DD2A7BB677C2F00C9412C9BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Graphicloads-Colorful-Long-Shadow-Favourite.ico
- SHA256 da5c118e44aaac573a9f5d901449918d452e3f96cb9d865e8af514b219985498
- MD5 fddd19e0ff0f031ceb61ce49bb6f2b48
- SHA1 3c275316b4ade307fe46d8db3ea68fbecfbe5062
- SHA512 c5096b5ea3b9ac89e51b79e7bc478a172f4ec1442ee7c90ed79776d4b828e1cfe35700141d1c0504beba95bbb5f5815945b88dd882c3cd1e8f911aee672f3a9e
- SSDEEP 768:2ltOeo5ct/xCbl/RpCqHHL0O8YXjKicoxE:SOW6l/RpCEr0O8Yl3xE
- TLSH T1EAF3C08FD242AC75F8BFF330AB407795E6448A8DEE808D2511EF2EBDA32543678544D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Graphicloads-Colorful-Long-Shadow-Restaurant.ico
- SHA256 503b2f0aae3906c8f334e8579b42c7270113d3a81db165d9a2d47eacc298de5f
- MD5 d1c582193c63639a5ab4d2c02751492e
- SHA1 71a2947d645a666c52b6ce8dc69fe0876dc5c660
- SHA512 aa68c8e07437b76b396f29e0ab2540f5e0279eb43d12a318ffa7ffb9a39d7cea0d78a711a08b6d0f9ab5dc2661ef0241900746552cb79bc125229d73b4e19136
- SSDEEP 768:+T7tXtjAqDoXCMtEbrlGjJyA55tXA7MLr5vxFj0EemZt2ll59:+T7fjAqDSCMtEbr+JyNk/Fjx32ll
- TLSH T165F3494019CB12A8ED3EE87B2C15427FFA050D83B9325537664E12B5F7FC84B87A6932
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Graphicloads-Polygon-Cart-add.ico
- SHA256 47a07df9cd21ac1645dcf1e5bc298f1dcc9140db2a36799bf105b09a04c607b1
- MD5 967114ed565578655ee12c352aab91d5
- SHA1 4cba75b8a4206934260c883e8f3443bb215a9f07
- SHA512 a3088ea141b576f4681979396256cb084f947bb0ecf412656d191a0edaa40089d3829ff47ad20c8099240f456407829afc905217cce9f03c99bd7aa47818e405
- SSDEEP 1536:jEyGuVudGQFPRRRRRRRRRRRRRRRRUKFoDqTx:IyGTGgDoDY
- TLSH T1A1F3440299DE7476C2E15ABF29286FFB4A450CCE564BBCA3B55D632EF0A31A1D344133
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Graphicloads-Seo-Services-Pay-per-click.ico
- SHA256 bf68d5da89cead6b9955e9c69e0e02400bdeac0293f429b9583bf2f049c439b0
- MD5 0fcbfa2b5b8ac56bfeb870cb59302122
- SHA1 2e6d50d71fe125a9393ee1eab43998a8749680b0
- SHA512 720fd878db37338a30df15a703e72d632760342202d98c83f66cec96df661604ef8bc8b4680ec154199cfde78a216173765e12c504d4cdaa54739a582a3e75bb
- SSDEEP 768:013e8GKz9wiKtj1Ha0eMfNJyX3ZURbqe4uCbijdO/nPDpXB7YKj6:013Pz9CRa0eGy3mYwdOFpi
- TLSH T168F359430DB3CEDFC3E4AEBEE4978651889E84E46488FA39E82418CEF055956F503D9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Harwen-Red-Christmas-Home.ico
- SHA256 0af1e8ed64f29520ff95ecb1d8d2442e583c962ed92aeea9c8333a3f2a1194e7
- MD5 6a093ed2410d5d24a12036996f735f3d
- SHA1 4ff57c4cdd6c94ed8ad28ad3843e10d01e419ea3
- SHA512 e186e594c7c1fb9f789519de0ecf9917a1e8bd61bcd52923b76919150a1b8b3f620f7a5697ec045dcdc6a9259564ff8f9c72c154150db28626055b4fc940d720
- SSDEEP 3072:VvVjK5LuspEH9kTxwxcGXR+TJiF5htD34g1A2BmzpNEGNu2b/Sbry+03rNeV1JMC:Vva6dktwxc7J434aiNEG0e/WENch4mMI
- TLSH T11824D0D1F2007161FA660F325462AE14713B2FA87D79B60A6960BE773B773C3A921C47
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Harwen-V-Day-Valentines-Day-Honey.ico
- SHA256 6f0a3c5cce460f1972d180681cbc587f2563684735c56bf6901d5e794d7e4912
- MD5 40566500c320676d4fdba8c8916a8b8a
- SHA1 c963c8a8692be159856a5681eef95222babe8eee
- SHA512 ec06c1b742aa1e44e17e655a3395541b1862c8487249c0b377aa12ab84a37f0770b962945b337222d2e2932fba8ab31c61336125dfb0b21b4bc815473a463bd8
- SSDEEP 6144:sHaZfv2SEUgZMf0rb8Z3qe5mcCH3r/mzB4rT4jOkfxm9m6kealHX2:sHcH0XKx5mcCH7/CBUsSkf0JkZpX2
- TLSH T1B594BFB4698659ADD4A127795F84F73FA0449FFD2343A61B5B118EFE7FACB288C40012
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Harwen-V-Day-Valentines-Day-Present.ico
- SHA256 237bc770de1f427e89d1d5cc7bcfd73a25482a0bddcbf7798a3c60f02bdaf4f2
- MD5 962026e3e92e86fcb2e7259edeb3e023
- SHA1 85a90d37ac275327e3d75c0f619e5316cd1c3026
- SHA512 579cd0854d45e0d451fcfb01bffedb8c00e35be1742d5018fb2e724bbf82e345397e9b4c5eb3d669bcd2dde40984366698c7fcddc2c29179161d7cbef46f75c3
- SSDEEP 6144:wX1CqVlrBb2+B9E3ivpUoOjBOdWeVxVewm/w9n:evVl1KR48OlJewUs
- TLSH T123944B8272350BA7E4790F70941B9E6017658FFE80DE13AEBF993A4ED8DED11C41B612
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Hopstarter-Sleek-Xp-Basic-Money.ico
- SHA256 dec0c43d0dc3928a6394efa79b789a63d7ffbfd5a957bff1361f2da9b5175761
- MD5 a04f76eca59f9c58d165243caa6d7129
- SHA1 6465b69b8fafcf35ffcc2230366e927744485e04
- SHA512 c89db3e960a55f741482a0f4573ba67ad125f073fc51c3e06bb603207b7507a83abc6f83e2ccca3ea1f36ae486d18963dd936f8fdf7f7efe0bbf46c6f7bc1ea8
- SSDEEP 3072:iFa//4QfpXM/yLyhuVoqsQg8fu3vhXb7uwTpzCp9M0TwZribrT1LY/eeiwymyBY:uawQfdxQuQoGdfVduTwWf9Yya
- TLSH T1E454BF52FD42E1A0CC2156349F77D8B64B16BCAD68B0A40F21E43EAF39FF643943A585
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Hopstarter-Sleek-Xp-Software-Opera.ico
- SHA256 ba6d0cbc1453120c8854c8d8d48431f81e5d8803dd2af89ee676f4bb380040aa
- MD5 964f84c7947a58a66f5e059930417693
- SHA1 bf7e37eeda5dc52034d5e23b092f44d603ed9ed8
- SHA512 a2b3a36924754b4fad3c00637e42eab5513a7643951b6a8fd0f9ff3c81e02cd81ce4e49dd7ad8884066afa158f77f1d48bfa328c3370078c6a7116535a37a4d4
- SSDEEP 6144:NV1oOIqKU73czuwpzxXIyY/l8nS6ybi6b4Z:NV1ou73czuSxXIyY/l8nS6ybi6b4Z
- TLSH T162446BA87064E128C7E922318F81EB392B203D5D9A45A519B0F07FEF3EFD1B77944259
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Iconka-St-Patricks-Day-Hat-tophat.ico
- SHA256 4bbb73885d052825733d7b798f83982312961c18b029104c5b2e20dec9153073
- MD5 7014d15c6ad0450af1b856091f53fe82
- SHA1 60ae03f2816216953b76e996401c9a2fc9ec20cc
- SHA512 4733e993155075dd543df381d471aea31bcc416d20a2976f26cad4c136369a4f43487c7a135942cc64e39b313ab3114681926ead2f9835dae7e7386a793da42e
- SSDEEP 1536:ZD6EUkCMZeMBBMWHhqC4DXCIeaP88L46WAaR3ws2hgHbdq:ZekCMLyBBDyIZ4VJl2hgHI
- TLSH T14B0435039C44D5FAC5E8DD7B2A83A0F7A49FDE689C7510FEEA85638541B1C2B23F5428
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Icons-Land-Weather-Moon-Phase-Full.ico
- SHA256 66ceab0496fb80d706488b2e0fba9dae375185ad81af434823907bb73987f240
- MD5 710295fe313012ab7f2b7a97ed29f826
- SHA1 bd3c3b3baebff34857f31f0a6bd733871bac4400
- SHA512 7e4e6d64e361a9928e5f38f10b39de14974d35c9be0356b2954f6d19b107423996f7d380fbd3660c9f5900eb7b9d78dd346c3a7efb9ba3f3d022830deea79769
- SSDEEP 6144:lgLW7wnfBISNxZ0KENaC1YnGuzSTg1WG+:l4WeImE8C2Gu+6WG+
- TLSH T19B845C266E2DF851C60CC4F3E613C4CFA8706E6813C529A3656BBA3F817C357EA1E149
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Icons-Land-Weather-Sleet.ico
- SHA256 7728f02d0bfdc03280ce3b2d9be8514607ce639b7f977a210f76d99d51664497
- MD5 4a557a2565bbdc71792dde2ba9c582a5
- SHA1 67254c5b5537fb6f75271288e90b02c6eace97fc
- SHA512 ffbf71d08dac0b520efb4fb7ff972ce1c82d6dc19d8bd7bb5599f0bb4e4ffeb0b88b55e5363539cb9a9884715dfd2d44e0e8825a26f7ee2050a99e00c6ca6e94
- SSDEEP 3072:ahMTl4PA2yvyWLrxWPvVTc6lyspb7a87Xjoii5QtYbaQG2+9Pyj3cF8HvMW1S0OK:FTlAivNxW3SeVORiGQtGTpj3QNW1S0OK
- TLSH T16B843AC3F80041E5EC6D447FB50A5A802A9E6C7BD8E97585FACA365A5AF3067403BC4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Icons8-Windows-8-Logos-Xbox.ico
- SHA256 21ea0e57efed9183c5f9efc3d2c5b27ea4e907bdc8b8d422882e5ee5e4f31e8d
- MD5 fc4a05a6fe4256718791dffda2364f32
- SHA1 01fbfa39593a629362d0bdb47f19bec4264928ee
- SHA512 4b6984b86637b558bb5a3f02f0106043a48db65de6d82da1c6c952f2edc6cdb5e28e025e03d9402a3829b508c6bab80384a5c9d1b20d0428e82ae02aa21489b3
- SSDEEP 384:Loy4NTtTULLherY4VEPCnFZ2HTLh0aNxZCC4lZUzvKq+nG1RkJTotUsz354AF:D4NYMYxPCj2pN5v7kut9zJNF
- TLSH T1CBF3DC483519F40AD7D8B6389FA1CAB117246CED6D1989B33AF87F9F36FD0176101262
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Icons8-Windows-8-Security-Security-Checked.ico
- SHA256 2c2b163ed7590acc3ebfb42af949fcc2570a49544eef5a8eb6624a008f941ccc
- MD5 a0a080bbecb44b21b5dd2d3b83705cb6
- SHA1 5ba62c6b964621dd58588dda1577402b0c7ff212
- SHA512 0e312a32ee94220036123cbcd2421c0e57e63eebe73033b65855e59758568786815eaa6ff613dbb7c01ff4e58021c9eda84b82ce477f65ab095667527ec7b50e
- SSDEEP 384:+eFNDrXXuO0SXgyny+HgSI/zvipFOeL8m:+INPXekwc4m
- TLSH T1DDF3EB187108F40AD7D8B639AF51CAB50724BCAD6D2589733AF87F8F36FC16B6110266
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Iconshock-Trendy-Guys-Andrew.ico
- SHA256 2b06bea026a928f59a9ee0cec440b9e4025ab1daca4887e56dd9230b1e6f6a46
- MD5 7934b1fce6521e9bbb9a31dceb107f1d
- SHA1 baf0c175f9606bfc3af5c4f83d3da4c6351e9161
- SHA512 b80f29c1a4e316ce7be3f32dda2fe2515c64fd7f574ca4a51332f704fbf9dad44badd1b705275ec78f1e618003d98f8f067a1b49effcae4b5cdf09f1b65fea6c
- SSDEEP 768:Yn4B8xlDapxUzAt4yHa1oCOdCXFn/jzxiX9AA+SNB9Mw/xd7bqKnjWnyhHhzvz4x:lB8PapxUzMran7iX9EQ/qMj0sz4xXT7
- TLSH T146E3C890E1048ED5CAB4B3B83B00FDBA6B522C4E5521071ED3EA7D17365EA4B374A1E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Indeepop-Crazy-Crown.ico
- SHA256 741e6d9f5fcdacae84272b1b7c77808e1df5329a8bb3a41fea105f92f3a87482
- MD5 e4352204e8a3d0ce08e96949648dc552
- SHA1 e90ad39ff010185aff1395c0417a1607ddb95d9e
- SHA512 15e7a7122487bf6f489a3626f7a9decfbd7b6ba20beb5f12fe7714661d98cf070051ce549f88810641abff187d162e4984a7a8ef772bef431096f0d5ca858463
- SSDEEP 384:72DoP4pfD8hX+SiFKijmLPwOHc8K/8dOlAS1DANlcYAAQpbYWBYA38o39vDX2w7K:SDogD8ASS6TfHc8280D4u/ATwZsAK
- TLSH T188833E5D7C57C685C7505EB88D9FE4D1222EBC02EC4CA63235B8774DDB71A0EC86AC98
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Johanchalibert-Mac-Osx-Yosemite-Safari.ico
- SHA256 3113872a60a2c0ac37912d35ffd8106ed33b33face68d09dcce7299663d7e9ef
- MD5 f172c4d75e6913157b18600b00def523
- SHA1 22096a573f319874eae2071bf83583b9a6776d23
- SHA512 b36e3f2c27263cb9270da38fc3ca7c6d30019159edaf1c2b27c501053646f690920f843e127712928606be70b3aad39b5269332919b48cdcb5c620e027bca4aa
- SSDEEP 3072:AfAkNK2SGGzx9Wk269AGRAx6RJafjs5tdbfAIM2a:TSK2SGG9Ik/NRCLs5tdbw2a
- TLSH T11524BF927908E483E87C3671C6B3CE7143393CBDA6914AD73199FB2E2573946670E70A
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Kevin-Thompson-Love-And-Breakup-Love-box.ico
- SHA256 ecaf56954dc0dc9550ba671fa341674bcf162698ceaf73406a4662f81f13e76f
- MD5 b4a66fa007347495b48aa2bacceaf786
- SHA1 0d777507732254c4315e11f918df1a32262ea5ed
- SHA512 3d46f0621952b4cd3acc465d77723f6c72de1ab2b89782ca5b57058031e9a7cf4c91df3b1aae69a12efe8dbfe475ab955d82aa351b4090459e688f33797365d1
- SSDEEP 1536:N4Pz6ZJGch4CAHZ5+G9j/nABvSZdAAkkM1hjN3olL:yz6fGRrZnHAGQBYlL
- TLSH T10C04D503ECDD80F7F8BD68320A91C3AA5D246FD89A1615E223B43ECAD475E4E3D4958D
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Paddy-Web20rigami-Firefox.ico
- SHA256 0c28c96f8be216d8d7fa75616547edc888f83e55c56d1e04b5a587e44194a74c
- MD5 38f28e2ff46ebdeb95de66c5e42e2cd1
- SHA1 4f540202aeb87af79be924220ebfb9651d82342f
- SHA512 b8a39179de0c8314c0b6678d41f149f229e8dfcc72ea18d57c9656f1c858aa84e08ffff04f999c4c4fa53fd30e0751adb27bc11172bbf6bd1af34334c5d238ca
- SSDEEP 3072:1cwsP/KWzelqrnmMkUdQuO/ih0cZztew4fjnfXIC8:1rqF4bq8Vfa
- TLSH T1281405C6AA7AB694C43B1FB3C9C1467A0B14FCFBD9C2C5AE65D5321958359C0BE3422C
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Petalart-Business-Cloud-upload.ico
- SHA256 c1211c6a71844c456cf5616538009789c866e92cc09322b6e90d41e91f21fe40
- MD5 4a4cfd942d9e745ab8ba2a9ce7679c29
- SHA1 f49ca97491f2700b825854d54cb24fa12ea97106
- SHA512 3d69d93427c2b5acef9c5a2f7035a7a5544cd77b3a5ccfdc58ab2cd5d97fa053a051221c4cb61eef43f71830d85578ad39366cc6b694607da9857c0d492c4a00
- SSDEEP 768:sDHvcLC+eBEPJBgapd7uw/VJLIc5/4tGrACD/PQ:eHk7/EyY
- TLSH T138F2B6162139E34ED2EF2A74E06E49BD0FB93D27D7026812B5C472EE9CF115426B2E13
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Ph03nyx-Super-Mario-Mushroom-Super.ico
- SHA256 526827c143363abc2a26c7218653e2b03b2c7139f28ce320678e047c6bf3a148
- MD5 b9e5edb6100f7d29d29d11993ffb6b59
- SHA1 b608b986231fc844e9ba962e2ca3a6aa27c005e9
- SHA512 3c9fc918274cbc211c574d6c1cb35bf4ed4e8cc3fd93ea652afe6d03bd2324a60b7686e8fc39edef93d97ecc729e802883ec7a173b2e17c4f21bb84b4958c54a
- SSDEEP 1536:VRAkIxI6n7RKigtKCCSq0lZ7BSfBPESx83ekH/pi3NLAFd:TFIhIgsH6/0UdLAH
- TLSH T179D3E58FF121FF28DA7920734466B60219357BE863247D7EFCA8A71A0DA463384DB5D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Photoshopedia-Xedia-Firefox.ico
- SHA256 603337b9f55e6ef644df6237f94ab2dd2076da8d1d6cf7ee49706c8213c55eef
- MD5 3eb4d157501c36e3f66c5d4372a3c15d
- SHA1 764579cd6e3ca4f45679826fc0ccac640d29e1a3
- SHA512 3b252bb695a730f315c541d9ee4d96fb9b4c7b10d3feca93ed1f3d7cb3e46670b77ae2c28ab24f45d5ca5967c21a5f1afe0ffbd1d72b1cd9fadb477407e9f8ad
- SSDEEP 6144:wO/D1sRye4tMMfNjOOOYMwvoSNC+G/8G7sw3dXCeKmI:wa1sncOOOYMWoSNCj7t3dSSI
- TLSH T180946AEE684074CEF67A413A8256D0704123ED2DF916C61222DCBF2F7B314528A65BFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Tooschee-Misc-Present.ico
- SHA256 46b3e61f81d7aedb79cf3d3bad2e27829e397a2e037ea263157e6ef160b28921
- MD5 35b95a2b86b834615e350799d7c757ea
- SHA1 cbc57de3f06bd32043c8db327ea1b327aaf82599
- SHA512 75bf478a50b6f9922d020580166edd7fcfad9e1210ca9db2027c392705c1969ac1b8f5fd072429b220e1818db66abe128a032b9ca03e64557237964b55af5af8
- SSDEEP 3072:52BkVMG85MfdGzE0rqJTgDfQkJOC1L89L0OAgG:MXG8id6qJszQkJh1L89L0OAgG
- TLSH T1A0145A5A3E1A8020E028857BD5B75B74D1180F1F598C55BA40DCAFB670F4ECEC2BA63B
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Tooschee-Misc-Sync.ico
- SHA256 e5bf9915525c2951ffc691f6c085fb08c4462e732f36d0b4b200fa99d0fd507b
- MD5 9cbd68e9a3cfcc333de1e1aa7f47aa57
- SHA1 9f1f53fb11dd24e3e3215ae9eb517f18ccd4bfd3
- SHA512 45bdd7746b7d8b21763b930e08a0e5134d6024cf3a21f56ffc8880327b3b99524d5490cea3c7af8dad633ea85698e30971e0c9a1f974821ea980ee5560634c33
- SSDEEP 1536:oziygiYWqMIJXJFavTxYVylZYQYrCh0AEhV7wlHCF+It:qiygvWqMILFavTIYY7CybvwliF+q
- TLSH T1A414BF317801D479CAECC1B24DFBC99952A03E2EBC01241779A07F5F39FE6196A07A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Acrobat-Reader.ico
- SHA256 94cd1892c164592165889abd7987f34e8cf3350603939c640749bfc3f3c8e09d
- MD5 804c0877429446f9b7dfa2010d8e902b
- SHA1 1ac1dd2e473a773b1a4104336b906901c3810ef7
- SHA512 937a1f2d43c68eed9aed86fa3bdbe2f3c6981771e2b8ba128442c094c8f3f02a473d3e29fc276ee9751c42bb3a649299aa1af18e0e654459af5d0fd6958dfe7e
- SSDEEP 1536:AiyYa4lmVQ1U3Ox7eD3Xaaaaa3aaaaaaaaaaaaaahNbd1EhDOLs/t24ax31m333p:pVJlF1U3O9eSNbdiDOnls
- TLSH T1B214B596AD019E07C7F321F2AF8095B331191E757A61587895B93F3B32F8C879B89720
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Chrome.ico
- SHA256 b8834db43313c01d641fd4873d852ea78527f3faba1150b6d79a2742de016e7a
- MD5 b93625b86050e1063b21a7ebb1289720
- SHA1 762ce78494aefe8485ccbef80aedc063d76b0445
- SHA512 e3a8678fc90b738daad929ae1b5b8bb6eebf68a4242789cfb4a6e4ecec580957aba6d139141aef35d56b37ecb9bb8b8547631f50b80ecc162e8917195569cc9a
- SSDEEP 3072:UWJJb6FJAMyhnOkAunMqGPwKKPZfO6Ha55fqRn/kjwRJ4bscwEIDlezW:cATnOoMqiw1ZjHavko0JJozW
- TLSH T1A2349D10FEC4AFC6C1212A378955B274130FDD192E48599AABE1EF573076B836F7AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Dreamviewer.ico
- SHA256 84e0fde276904d0d6ceae83cb1719275c64ed355c212a08c3270a9a4bfe7de79
- MD5 82a4764e633314df202913b879406f23
- SHA1 51764c4bc155c9b8687123b35826db3ace8bf6dd
- SHA512 71c9e8bf96ec4e38f388efc932aeec6e6877b1932b94a0b0fce95c560fec1cbd48272367470e320dd236289bb7ffee90cc26088c7bd7cd5742a95a4b76ac2c10
- SSDEEP 3072:manGCYukn+ErsZ0Qi+4ExUU1KP0h/71HAhdA0ahZc4AdcABX:PnGCpk1U1h/712ALXAdcAX
- TLSH T1DE245B321E074A2DD3D800F9D059D1B886BE8FD4694F9762F0E09F97E4B8D4F6A96078
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Facebook.ico
- SHA256 c30436c2e09c2364d3c35d1eac84acf666f392718fe08c3e28a6ebcd412174bb
- MD5 5c878a7d4550f60d71e89f97765f66a3
- SHA1 4f3e9fd5f9f9a54a53ff7f7a13a1a2bff4316744
- SHA512 f7c1c6683e647e6685b375597084a564e894b16f4fc526a9eccceaa283d07a14b59766ccc1ef66f816182a9638881de0c6da034ecce24c85c1d7d40f15e4f093
- SSDEEP 1536:LYHD7woJfNf2neNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNUnUquu40vK+:UH/bJfF8AZbwk8bYmFPOa
- TLSH T181141B732A9902F9D8198F36F336B43563732C77A6A984E174403B552EFC191EB12D3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Firefox.ico
- SHA256 9aebd0daee148c86c47a5b0b8b9410c41478ed9959f87a6cdfc408cc69890e70
- MD5 22a3cb54088c5835a0d5a6b7fda43d9f
- SHA1 9a4ea364cf60cdc48aaf6a4265faefb2c286f40f
- SHA512 386cc5f3ce31d8468afa1cb6b77b774938f5687e4f6ac9d054ed6712a554cdb74325be6249ebcaaaec5d7ec6d3e5cdc95ef2a01ed0f3630153739cd396c1abbe
- SSDEEP 6144:wd9lnMNh/iO3gL3Pa5vG3/+CjHsI6FXSM6/Sb:wd9lnMNRiL3Pcv2+AJ6FXNASb
- TLSH T16A348D94D5CEC482C9216A30B6ABE7B2773F2FF5744A4E4C65263BD034B785BA0F6406
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-ITunes.ico
- SHA256 7f214a53b12c34be44ca06139a6ec49c7f13b2605df354c5a0834345ee78f2b3
- MD5 aaa140f0f5b39882527fa2849ed38e92
- SHA1 dbf664aa8b156619c8684050086c6afbd9301105
- SHA512 15c72b84ab634a44f325c2ebba609bccfb8c9d792d128feec0e561fbcf25f4b2e406633e2d97e702399d9584362f4c7f719333ecdadad1b03df54931dda9c7d9
- SSDEEP 3072:gn7q2X9n7RMm5xeWiGbnX93s++j5BXO5kb9J89h+uCRtb6tvZQbAZr:oq2X9qcxp7xsptQc5uitb6NZAAZr
- TLSH T1FF34BFE13F02DD06D25973376252E3B94B78ED083A463652B5E1FFAF3535BA27A84201
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Illustrator.ico
- SHA256 26760978a4fb3579e20d3b12f98af585fbd4df84285d31ed8a9af25c31a966c5
- MD5 98736ae975ec6dd8b885eebc43a6fad9
- SHA1 338819a9c59671ef39156aef7b21d7ebb2080ea1
- SHA512 47cbd516212eeebe5d2e62702408f5a8341ccedf5d88fff2508c104d6f9d8000238a0ad8c996b8d1a09eece3073e98960d1f32a13fbf5f13390404d43f428d19
- SSDEEP 3072:2Nu/7L/NwFG8NGGKeer7spdDXasF+UJcupnidQ/Bsh4E7um4qFrZCFzxCgSF7RPF:L/h7umLFrZClw9Jnx
- TLSH T1D124092AF9A35C57E4812E7E8515F1F0066E627D3C3BA1B97D9C2356A1228938DF3F10
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Photoshop.ico
- SHA256 02db5c1b1dba6d0b31ba34683e2f291868e98dcec3b5f319cfc689c14749f6c8
- MD5 13d84c9f9626dc0ac1218a7fc58d79fd
- SHA1 22f1da8c2578481901c1d87c3c21f791589a047f
- SHA512 3cb8cb86d5d8c33ffd3c4371080a1636b951f6a24220b876641b856df4a7148e36278b97dde6adf8b613214b2f1acfd7165d9b944c4351ebd11e86e3ce3d883d
- SSDEEP 3072:x9Zv9N+3Ga7/VLQmDnHeu18ADLsH5u/Ldqo3ubP+oZ7:x97KGa79LLDHh8m5Dc+g
- TLSH T120244BA25DD3EECEE7D018708139EB3085F776E999328582DDDB2EDDA13C6953123026
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Quicktime.ico
- SHA256 58f475cd259b552672d7c2b55d1dc7715a34aeb3618e891d609a5a33c173fc45
- MD5 bdc81be3a6333a7d8975e0f692b2dc7e
- SHA1 ca9f9fd57c73515eca1a1d531545ed4da8960009
- SHA512 92310c9f101d7c432f031b56adf5dd3d27c68b4d0672971e5b272fb08f80188abcaaa7573d6927c758202534f90816a0fa95b71fb615ddb92f2e1c062bc4e617
- SSDEEP 3072:pwwdT3hnu47fpYNqXovsEZdKI/oyvvmW0gwAo2IfQHcGYFCSEj:3T35ubNqXoEDyvD0gJxIYHcdsD
- TLSH T19A34BF60BA9A785FE147B7FB4B62E9BC4778A6687743C32F2720574FAD25A54DF00080
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Safari.ico
- SHA256 a37d2041c211db37adb6cabb91645a4a190db3e75ebdc5fe6e81894d79df1ce8
- MD5 109ebfaf169ae434c0c0c4947393342d
- SHA1 669773bfc0721c3ec0ca11e4c9ff22557fba94ab
- SHA512 a4bc517bc532c75f0051562e22becc855c146b64e7bcadf8f476259fb7967be812ba0c3f5cfbcd18f616377074802fd80147cc15da90ab9e5030da115665ca6f
- SSDEEP 3072:jDTwyHyEgJyNSZYR6WH/MAYlKoYRcoBO3pJYY3UQ0F1DCZGua1P0mj:LUE8aSa0W0DYRc4O3EY3UNbDeGua1hj
- TLSH T153347BBDE944E801EE4234B7C491A1FA83349F041FF65580BEEE77EBA7F49A05904E25
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Skype.ico
- SHA256 c44e1733cd141fed84a0a21d13446937eddb19e583eaf2561fd971d3d6ee54eb
- MD5 9924ffffc1ec3aaa5b632cd9bdbd3198
- SHA1 88a37fc4dcc884f7d00778c77e8d6d26a322b9f5
- SHA512 d3bae583cc99dfc5e9a35322b28d8d20187c1962f0c9972b248ff0e034fbdbcd0b4b30704ddc81520204ba6479809c8fd725965bf0f5d5db749581875cc26e3f
- SSDEEP 3072:AvVkpdFyJ3/GBs8wGR35tPfgbTXMhpccrcFc2fdAvHUp+lVNpnqbb111rKZYQ8S:WVJ318PR3Yv2pccrcFc2uxzznO8ZYhS
- TLSH T1BC343BB2504006E4E9AC6A384131DDBD4F1AAE7EFDB064DEED48B56122731DC61368EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Thunderbird.ico
- SHA256 2929c71fccdd683b953e0a59a4ef21df703d59e5d08d0bfa193ef078bfc90f25
- MD5 e8897b34f81d635aba478737dc1ea06b
- SHA1 aa820313997ba211a4e435d1c900e7a3d210185f
- SHA512 62357dae2f040d77a3a25f6a698e06dccf3cf28011a4d9d24782c56fd1880a4e22f391ccb0ed6892dfd88bd9411abcc6b274a8819818604b3dfd71931d9e61c1
- SSDEEP 3072:Q5+RAEhS6bKDGAwC8CwqgJ0zZiACGLXCEkNCCBwok8b9sg:S+A6S6BAwC8CY01iACWz6nBV
- TLSH T143344A10AC736582CC39F170C1BEC9B98379BC1AA3C69D6AD4E0B121AD73D63FA17156
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Utorrent.ico
- SHA256 223da657dde7c75c34ea2e4445c5953412532b3706b0426d11bfb2d851d7bb9b
- MD5 40fdc91f864c65c3966f11c976e095bb
- SHA1 a9240da62b78a21924516708339ccda8816721db
- SHA512 6a8d965af88814d2babad5f0668f6975f9435dbd099f1ea86e132b44eadcfa996c23e64e10e721677099df96c71e3112a30bc432d077a259c9bd07f5c2b9b566
- SSDEEP 3072:XzrhgvwNZdri31w6EOOKuCQG8ebj0TSsc68/Q1qGrYkbPyiUtEXOXCbbd:D9gvwrdri31w6juC38ebirYkbz7XBnd
- TLSH T1E4244BEF516EBE8DDC20B437B06E6A47D2613CFAD6035915A6C063C62AF2342D7607C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Vlc.ico
- SHA256 8cf563caa60dd13914578862b8666ff250def03f70110b99c13e03b0911219b3
- MD5 f28acd30cc87113fd0ddff76fb4bd62b
- SHA1 e3cb20223eb5df1b923f5e48f7bc0146eca98189
- SHA512 cea294a7357f12532dd08c5a58a38442ab550df8fcd926644103611bbf1c8fd86b23fdc8dc6a6f6f4d0aa6c735533079c52e42309fef54fb3dc157907cf0c5b3
- SSDEEP 3072:NkVlVIG//km00000000000Mv00000000000PW0GvaRaLJsL3SPUdLKtIIhp:NklIpG90GSCJsLcZ
- TLSH T1B6245BA9FE94ED8ACD214572DD1FFEA0136E6E74BD05108A32A57B4EF17F4138872602
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Winamp.ico
- SHA256 225c64d24e37e5e4db7a90987ef5359e79709ca7b7a8c1f2aefaaa71a24a5711
- MD5 8c62608c708fddb202fc9ebb3ea27a08
- SHA1 eedabfcc137c3291c13e1c320c6727113195e4cb
- SHA512 b6140124270e08f13d3efadcb457a754233a5c7246ae71981e194f916f5d9cacb2bcd7f8e96706a1694a3c2e8d95721aba5eb9f9653e5a2d72676ff9ba02c628
- SSDEEP 1536:6Q92tmauZfH5Ht1zggOHB8N8gAPCKsUeDzOzay4JMd:6E2UakHLqHBteKXg4H
- TLSH T16024F9647FD9C905F39654B91BB4E9B4CE0F6D491A5680B0E8FBFD6B723CA9234E1002
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Windows-Media-Player.ico
- SHA256 86a6271258059309dc79b59c0e42fcdbe8b159db6c0c1c8a19f32dead0ff0c24
- MD5 d589227e6d039e8fc02e90b150449718
- SHA1 6a654b4a47a9483027528d5949176a062476eed7
- SHA512 8e4ccfdd964ddb6855d0f4a73d9fa8c12672bba8ffcdf2a6735879aa64250f1e1781b6c5fa91795b94b4690ce862185135c523e7362f2f58499189c7d759e80a
- SSDEEP 3072:b45Vok/TPeJqG1ttUTWDGwKMw233JCfB7WMKS:bkLmJqUU6DnKMB3ZCfQy
- TLSH T18124D6DAACF47A80C41F85F28D666F535BBF6C2BD7428490D291BB13980721A0DEB51F
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Yahoo.ico
- SHA256 ee637a571644d00ed7bf1c66b80c27b62281e08c00d9cbe385884f9c05bbd117
- MD5 88469d56079e738e91576aaa94d1f7bf
- SHA1 f8406e745a1b332a4f93301c0e32260f5ef4b88f
- SHA512 4f8af5067a060fdf50bb03d31255ecfe7f66f80f5291c17ea45826f98c6e9dfe50c2097b2fb283f941965ccab047d0344892746b0498309edc230a94ed51d3b7
- SSDEEP 3072:0EZPb8bzmoeYdn4FRVEsY4b4moEZOTmq7RVkFf:rboZ4r+LE4md+zVVMf
- TLSH T1EC246B72B20643D3E88E93B53585E16B3E68AC723C33A56D700BBF5E76760F23115869
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Wallpaperfx-3d-Softwarefx-Youtube.ico
- SHA256 8c6083a889bc781e51fa0a06ef11ebc7db03fa5c727036a9b9ebb9f85a53dae2
- MD5 27545dbb1b25dd73faf3b34e1429ffb8
- SHA1 c015a869481592c57955d6064f870854b447dccc
- SHA512 38f392fefe45851f317cefb5014b02249ba8b1becc610ebb5f585d4bfb241054eac264118e60f5254a492d6cd15f0937797d66cedcd1d93e7c7015c01fde16c4
- SSDEEP 3072:CDnCoqaE8qRMar9YGueiZO3xyYYYYYYYYYYYYYYYiqOpv3VTlye1CmQfhZsJ:CDCWQngeiZO3xcpv3VX1CmQ7sJ
- TLSH T179242A84B4C854C2E61E0732987BA62824517EFF96B690BEB61E773A43733C1442BD3D
- MD5 SHA1 SHA512 SSDEEP TLSH
NjRat 0.7D.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5
- MD5 70ea9c044c9a766330d3fe77418244a5
- SHA1 18602d0db52917b88cbdab84ba89181e6fd4686a
- SHA512 5261865e7ca21e928b956a97518366c9dc218a2312961e0ba0b72b37ae7c797176382de3c3dc1d2949aca51c3db330562f1087a71efdc7c3c3b8f8928872f917
- SSDEEP 98304:cn9aRMDoMu2EW5nnim//7uvwCt5tuo32v:cni6nnim//7uVtF
- TLSH T1CB965B12B295D914E1BD63F4C2E182F606B4BD0ED134C63B25A43F69B9F1BD1BC42B86
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8925674
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\HMJ\Desktop\njRAT v0.7d (SRC)\SRC - NjRAT 0.7D\NjRAT\obj\Debug\NjRat 0.7D.pdb
mscoree
_CorExeMain
Name
.text
Size
8.5MB
Virtual Size
8.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
- MD5 8ce3060686462fc72ece2701caa13e3b
- SHA1 19fc9892200de4db332ddd0c14b4b6fd9a35ccd4
- SHA512 ef38e00b054240a0d4747bfd79db860015ed027735c360de58af6889a69482109ccf74770608a2750542457ac38aa79367431ff6ca77fae44d7e3a7023f33a17
- SSDEEP 3072:31IL2SeOPGmBUMqtZabredepzZxgUPWeJP3:w2Sm/MqueepzZxgQW
- TLSH T12EA3091A77479B17C54C5A78C0EB2B0403F0978A6373E7CA3F6C15ACDE633425E5A68A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3c088df7119c494e3df95af42456225f4dab1c3abe003869f8c79afb0993b027
- MD5 2fe4b9dbd31f83faa7aa1c692ba4d3a2
- SHA1 1b3c03e29302a0f07acb4af306a7ad42ea4827dd
- SHA512 cd169dc1d2d5cf0f538334b8ac31817ea1a4e2c8c0faca6a715c63eb4aa464e8aaa4f6b10fe030f46a37ab18a1cd6fe099c662c727e107cb87ada1a8218bc5fb
- SSDEEP 768:FjTkCC7kDA87eqVlviNDkpI/pDwxRcNDRQt40BthZWMaGOQKgB22T:dkCC7kDA87eqVlviNo2hkxmRRQthBt3O
- TLSH T1E7238315B2874313CA2C65B540DF352413F3978A5B33DA9A7D8C02FD5ED23929F86B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27528a77e27d02aadecabfdf658b2da638bb0ca2f2c60bdd9d0fd5338c1fc346
- MD5 9b376f0d44995ca15d43f7943a602fb2
- SHA1 18a2bb7d13836256bd5f39089203f18d740669d5
- SHA512 4dfb0c49816e0d0c2f7d0d76081725bd48d3713506ec51ac6c06ae7092908d14e3683d707d6f332505163fb0ade0ee6b50a355cd69c25725e829ebb23a3e93b2
- SSDEEP 1536:ZAwSxproATOoeQHshYNR1zTTxqPbKhOCjXKem:TSxpr/KoemAYxTTxqj
- TLSH T17873F814378B1E76C42A09BA58C73100B3B25F997337E61A2CAD11EF5D433DB9B44AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 13043521ed6876edf2736fc46a7c49e6b639cfa7a866ca11de26f119796cd521
- MD5 c179e212316f26ce9325a8d80d936666
- SHA1 14d08b3cda60341d1e9187fc14bd64ebefe4a5b6
- SHA512 1b5eb687a9932c82ab2e655dbc5df8ba667a023e7568dbbd13c503a54661763193bde11937f87e2e09b88d770c8357eda07589d526e6103db058038e3ce3b750
- SSDEEP 768:rVRKgRFKn3N5U2jNGUyXWI9Yi1s0sbtAEsz8CjBMiPs2T:pR3R895Npyhn1sBbtPsz8C9P
- TLSH T10853D80A77878625C55D177054EF512007F787872B33EA5F2CCA0B8D4E923DA4FA9B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca6367d1ab873a55ced13d7024c530bbe4a6a703813225233e59041c7ce14eaa
- MD5 ac43720c43dcf90b2d57d746464ad574
- SHA1 eae39df1c717ca74f6f04d5ca8478ea55145535a
- SHA512 9082b3cd8b36031256923c8f2bed628e9331129bbf09d111d9d02268a49e493248e5638ddee5b02da66e9159a608f8f26499ca0f736d6a369a30f71950c60d40
- SSDEEP 6144:QxY714e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO:7ZxJ/JmSG9T8CEgdM
- TLSH T19454D007728BAE61D47C467123FB72D183B5AF461633D51E2EC822499B3B2D3BA41BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
284686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
270KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 010b1ec566be774a2d12146f9826aa31fd7eb6ffe7b45ce5e572b2d8c7f815c3
- MD5 2d65bc3bff4a5d31b59f5bdf6e6311d7
- SHA1 43962fbeb93fc267fb1c7036a12b8c5d6f40c28a
- SHA512 b210d447cc9b4b89402a2a1d3d5e9cfe13ae897c47094be4110ed3aac109152c8a45ec138f73b703e7d3799934234cba4ca3f2439b3dd193a4cec671b9edaa6a
- SSDEEP 768:mtAX1G0UYRxIDbYDGN5/eoK79QlRfe2AfgFTMBku2T:mtAFZUYA/uW2x9CJe2BFQB
- TLSH T14423C602738B5B12C86C097240EB252413F19BCF1733EA4E7E8D669D5E933939F68B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/Stub.il
- SHA256 8c57706fdafbf6981da459d8ef85654b1a8830381652b44cd486f6747245a2fd
- MD5 77e35880da8fa98f1ad8dc3ab322af22
- SHA1 9e69dcb4b4f1f2b3c38d3b945135536a2d011e35
- SHA512 1e2ea9ecdbd529ad55930ef58d3fac9640e041d2d5fc07a2f2c4738f749d6cf7eff47a6397ffe6be7bd7c73e3c08e733f00d57e5917a0b20bcbfd43058506651
- SSDEEP 6144:XY54wj3kCi/A9rOQCMUJIghk/UgfnktBSMsC9VFs:XY54wj3kCi/A9rOQCMUJIghk/UgfktBO
- TLSH T15474CC288228959AD5B2A51DBE71CB46F77F12270F31AC967DEFC254BF31284817063B
- MD5 SHA1 SHA512 SSDEEP TLSH
Stub/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NjRat-0.7D-main/README.md
- SHA256 223b34d4395b2af80c0dcba0dda3b176d9eaefed3526093259b3cb0f52c5f13d
- MD5 0cc6aff247b3352a2c0f4923915adf0e
- SHA1 154f3beca10b59f97aacb452f771a29f74e650a9
- SHA512 6c3408ee61763a420eed71ad301d16d993db88914ad753ec1596d98583b3ba9ca45851fc429b48b93f3927f59284e20f34143f7d0249217c66f741db1166d759
- TLSH T12D216322313C3F261751E249F10B2925EEAD2892FB4245503CEE995C52ADE5A8B3F876
- MD5 SHA1 SHA512 TLSH