Liberium premium 1.8.rar
- SHA256 a81c481d16677c5741a501905a277326bf82925aaaa678feeec392349e07e832
Overview
overview
10Static
static
10Liberium p....8.rar
windows11-21h2-x64
1Liberium p...to.dll
windows11-21h2-x64
1Liberium p...re.dll
windows11-21h2-x64
1Liberium p...ms.dll
windows11-21h2-x64
1Liberium p...or.dll
windows11-21h2-x64
1Liberium p...28.dll
windows11-21h2-x64
1Liberium p...in.dll
windows11-21h2-x64
1Liberium p...io.dll
windows11-21h2-x64
1Liberium p...re.dll
windows11-21h2-x64
1Liberium p...di.dll
windows11-21h2-x64
1Liberium p...pi.dll
windows11-21h2-x64
1Liberium p...ms.dll
windows11-21h2-x64
1Liberium p...MM.dll
windows11-21h2-x64
1Liberium p...io.dll
windows11-21h2-x64
1Liberium p...on.dll
windows11-21h2-x64
1Liberium p...on.dll
windows11-21h2-x64
1Liberium p...es.dll
windows11-21h2-x64
1Liberium p...ss.dll
windows11-21h2-x64
1Liberium p...et.dll
windows11-21h2-x64
1Liberium p...SB.dll
windows11-21h2-x64
1Liberium p...sk.dll
windows11-21h2-x64
1Liberium p...un.dll
windows11-21h2-x64
1Liberium p...er.dll
windows11-21h2-x64
1Liberium p...er.dll
windows11-21h2-x64
1Liberium p...ra.dll
windows11-21h2-x64
1Liberium p...at.dll
windows11-21h2-x64
1Liberium p...rd.dll
windows11-21h2-x64
1Liberium p...er.dll
windows11-21h2-x64
1Liberium p...os.dll
windows11-21h2-x64
1Liberium p...er.dll
windows11-21h2-x64
1Liberium p...op.dll
windows11-21h2-x64
1Liberium p...er.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Liberium premium 1.8.rar
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Liberium premium 1.8/BouncyCastle.Crypto.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Liberium premium 1.8/GMap.NET.Core.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Liberium premium 1.8/GMap.NET.WindowsForms.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Liberium premium 1.8/IconExtractor.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Liberium premium 1.8/Leb128.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Liberium premium 1.8/MaterialSkin.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Liberium premium 1.8/NAudio.Asio.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Liberium premium 1.8/NAudio.Core.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Liberium premium 1.8/NAudio.Midi.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Liberium premium 1.8/NAudio.Wasapi.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Liberium premium 1.8/NAudio.WinForms.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Liberium premium 1.8/NAudio.WinMM.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Liberium premium 1.8/NAudio.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Liberium premium 1.8/Newtonsoft.Json.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Liberium premium 1.8/Plugin/Action.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Liberium premium 1.8/Plugin/AntiMessages.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Liberium premium 1.8/Plugin/AntiProcess.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Liberium premium 1.8/Plugin/AntiReset.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Liberium premium 1.8/Plugin/AntiUSB.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Liberium premium 1.8/Plugin/AnyDesk.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Liberium premium 1.8/Plugin/AutoRun.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Liberium premium 1.8/Plugin/BotKiller.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Liberium premium 1.8/Plugin/BotSpeaker.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Liberium premium 1.8/Plugin/Camera.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Liberium premium 1.8/Plugin/Chat.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Liberium premium 1.8/Plugin/Clipboard.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Liberium premium 1.8/Plugin/Clipper.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Liberium premium 1.8/Plugin/DDos.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Liberium premium 1.8/Plugin/Defender.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Liberium premium 1.8/Plugin/Desktop.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Liberium premium 1.8/Plugin/DeviceManager.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Liberium premium 1.8.rar
- Size 74.1MB
- Sample260925-mf36rsvx6m
- SHA256 a81c481d16677c5741a501905a277326bf82925aaaa678feeec392349e07e832
- MD5 6496a460e033197c10fc0726b64998ce
- SHA1 559d5e9503da162cc1652af8c797964b366a779f
- SHA512 963600bcaa366db72c56b2eecf0e1a20664480bbf05be3f0e29c2add6a2c04f2c6f834aa66f9180ede72da6081f1e54ff449ab54c77dba46e8cdd80a70ea010d
- SSDEEP 1572864:rzF4bPkxcM1GC2nbu0LXt2BUZwmKYAKTPhnJdsHzh55pe91vBU:rzF4oDKVLscXLhTsNM91pU
- TLSH T1AB0833A53C0AA8D9E29C52EEA88CE9CD92576F1647B308B26B942745D4C33F41CF1DF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/Liberium premium 1.8/Stub/Client.exe family_sheetrat_v1 - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Liberium premium 1.8/Scripts/sigthief.exe pyinstaller - Insecure Codesign Algorithm 5 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Liberium premium 1.8/System.Data.SQLite.EF6.dll unpack001/Liberium premium 1.8/System.Data.SQLite.Linq.dll unpack001/Liberium premium 1.8/System.Data.SQLite.dll unpack001/Liberium premium 1.8/x64/SQLite.Interop.dll unpack001/Liberium premium 1.8/x86/SQLite.Interop.dll - Unsigned PE 133 IoCs
Checks for missing Authenticode signature.
resource unpack001/Liberium premium 1.8/AntdUI.dll unpack001/Liberium premium 1.8/GMap.NET.Core.dll unpack001/Liberium premium 1.8/GMap.NET.WindowsForms.dll unpack001/Liberium premium 1.8/IconExtractor.dll unpack001/Liberium premium 1.8/Leb128.dll unpack001/Liberium premium 1.8/MaterialSkin.dll unpack001/Liberium premium 1.8/NAudio.Asio.dll unpack001/Liberium premium 1.8/NAudio.Core.dll unpack001/Liberium premium 1.8/NAudio.Midi.dll unpack001/Liberium premium 1.8/NAudio.Wasapi.dll unpack001/Liberium premium 1.8/NAudio.WinForms.dll unpack001/Liberium premium 1.8/NAudio.WinMM.dll unpack001/Liberium premium 1.8/NAudio.dll unpack001/Liberium premium 1.8/Plugin/Action.dll unpack001/Liberium premium 1.8/Plugin/AntiMessages.dll unpack001/Liberium premium 1.8/Plugin/AntiProcess.dll unpack001/Liberium premium 1.8/Plugin/AntiReset.dll unpack001/Liberium premium 1.8/Plugin/AntiUSB.dll unpack001/Liberium premium 1.8/Plugin/AnyDesk.dll unpack001/Liberium premium 1.8/Plugin/AutoRun.dll unpack001/Liberium premium 1.8/Plugin/BotKiller.dll unpack001/Liberium premium 1.8/Plugin/BotSpeaker.dll unpack001/Liberium premium 1.8/Plugin/Camera.dll unpack001/Liberium premium 1.8/Plugin/Chat.dll unpack001/Liberium premium 1.8/Plugin/Clipboard.dll unpack001/Liberium premium 1.8/Plugin/Clipper.dll unpack001/Liberium premium 1.8/Plugin/DDos.dll unpack001/Liberium premium 1.8/Plugin/Defender.dll unpack001/Liberium premium 1.8/Plugin/Desktop.dll unpack001/Liberium premium 1.8/Plugin/DeviceManager.dll unpack001/Liberium premium 1.8/Plugin/DisableUAC.dll unpack001/Liberium premium 1.8/Plugin/DriverManager.dll unpack001/Liberium premium 1.8/Plugin/EventLog.dll unpack001/Liberium premium 1.8/Plugin/Explorer.dll unpack001/Liberium premium 1.8/Plugin/FileSearcher.dll unpack001/Liberium premium 1.8/Plugin/FullImageOpen.dll unpack001/Liberium premium 1.8/Plugin/Fun.dll unpack001/Liberium premium 1.8/Plugin/FunAudio.dll unpack001/Liberium premium 1.8/Plugin/Go/Go20.dll unpack001/Liberium premium 1.8/Plugin/Go/Go21.dll unpack001/Liberium premium 1.8/Plugin/Go/Go22.dll unpack001/Liberium premium 1.8/Plugin/Go/Go23.dll unpack001/Liberium premium 1.8/Plugin/Go/Go24.dll unpack001/Liberium premium 1.8/Plugin/Go/Go25.dll unpack001/Liberium premium 1.8/Plugin/HVNC.dll unpack001/Liberium premium 1.8/Plugin/HiddenRdp.dll unpack001/Liberium premium 1.8/Plugin/HostsFile.dll unpack001/Liberium premium 1.8/Plugin/HzGenerator.dll unpack001/Liberium premium 1.8/Plugin/Injector.dll unpack001/Liberium premium 1.8/Plugin/Java/Java17.dll unpack001/Liberium premium 1.8/Plugin/Java/Java21.dll unpack001/Liberium premium 1.8/Plugin/Java/Java8.dll unpack001/Liberium premium 1.8/Plugin/KeyLogger.dll unpack001/Liberium premium 1.8/Plugin/KeyLoggerPanel.dll unpack001/Liberium premium 1.8/Plugin/KeyLoggerRemover.dll unpack001/Liberium premium 1.8/Plugin/Leb128.dll unpack001/Liberium premium 1.8/Plugin/Map.dll unpack001/Liberium premium 1.8/Plugin/MemReduct.dll unpack001/Liberium premium 1.8/Plugin/Microphone.dll unpack001/Liberium premium 1.8/Plugin/MinerEtc.dll unpack001/Liberium premium 1.8/Plugin/MinerRigel.dll unpack001/Liberium premium 1.8/Plugin/MinerXMR.dll unpack001/Liberium premium 1.8/Plugin/Net/Net5.dll unpack001/Liberium premium 1.8/Plugin/Net/Net6.dll unpack001/Liberium premium 1.8/Plugin/Net/Net7.dll unpack001/Liberium premium 1.8/Plugin/Net/Net8.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore10.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore2.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore3.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore5.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore6.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore7.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore8.dll unpack001/Liberium premium 1.8/Plugin/NetCore/NetCore9.dll unpack001/Liberium premium 1.8/Plugin/Netstat.dll unpack001/Liberium premium 1.8/Plugin/Notepad.dll unpack001/Liberium premium 1.8/Plugin/Performance.dll unpack001/Liberium premium 1.8/Plugin/Piano.dll unpack001/Liberium premium 1.8/Plugin/Process.dll unpack001/Liberium premium 1.8/Plugin/Programs.dll unpack001/Liberium premium 1.8/Plugin/Python/Python10.dll unpack001/Liberium premium 1.8/Plugin/Python/Python11.dll unpack001/Liberium premium 1.8/Plugin/Python/Python12.dll unpack001/Liberium premium 1.8/Plugin/Python/Python13.dll unpack001/Liberium premium 1.8/Plugin/Python/Python13_5.dll unpack001/Liberium premium 1.8/Plugin/Python/Python13_9.dll unpack001/Liberium premium 1.8/Plugin/Python/Python14.dll unpack001/Liberium premium 1.8/Plugin/Python/Python9.dll unpack001/Liberium premium 1.8/Plugin/Regedit.dll unpack001/Liberium premium 1.8/Plugin/ReportWindow.dll unpack001/Liberium premium 1.8/Plugin/ReverseProxy.dll unpack001/Liberium premium 1.8/Plugin/ReverseProxyR.dll unpack001/Liberium premium 1.8/Plugin/Screamer.dll unpack001/Liberium premium 1.8/Plugin/SendFile.dll unpack001/Liberium premium 1.8/Plugin/Service.dll unpack001/Liberium premium 1.8/Plugin/Shell.dll unpack001/Liberium premium 1.8/Plugin/Sound.dll unpack001/Liberium premium 1.8/Plugin/Sounds.dll unpack001/Liberium premium 1.8/Plugin/Stealer.dll unpack001/Liberium premium 1.8/Plugin/Stealer2.dll unpack001/Liberium premium 1.8/Plugin/Stealer3.dll unpack001/Liberium premium 1.8/Plugin/Stealer4.dll unpack001/Liberium premium 1.8/Plugin/StealthSaver.dll unpack001/Liberium premium 1.8/Plugin/SteamGuardBypass.dll unpack001/Liberium premium 1.8/Plugin/SysPlug.dll unpack001/Liberium premium 1.8/Plugin/SystemSound.dll unpack001/Liberium premium 1.8/Plugin/UAC.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2005.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2008.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2010.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2012.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2013.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2015.dll unpack001/Liberium premium 1.8/Plugin/VC/VC2026.dll unpack001/Liberium premium 1.8/Plugin/Volume.dll unpack001/Liberium premium 1.8/Plugin/Wifi.dll unpack001/Liberium premium 1.8/Plugin/Window.dll unpack001/Liberium premium 1.8/Plugin/Worm.dll unpack001/Liberium premium 1.8/RjControls.dll unpack001/Liberium premium 1.8/Scripts/sigthief.exe unpack001/Liberium premium 1.8/Server.exe unpack001/Liberium premium 1.8/Stub/Client.exe unpack001/Liberium premium 1.8/Stub/Dropper.exe unpack001/Liberium premium 1.8/Stub/Joiner.exe unpack001/Liberium premium 1.8/Stub/KeyLogger.exe unpack001/Liberium premium 1.8/Stub/MBR.exe unpack001/Liberium premium 1.8/Stub/UserMode.obf.dll unpack001/Liberium premium 1.8/Stub/Winlocker.exe unpack001/Liberium premium 1.8/Stub/WinlockerBulid.exe unpack001/Liberium premium 1.8/Vestris.ResourceLib.dll unpack001/Liberium premium 1.8/WinFormAnimation.dll unpack001/Liberium premium 1.8/cGeoIp.dll unpack001/Liberium premium 1.8/dnlib.dll
File Explorer
-
Liberium premium 1.8.rar.rar 74.1MB
-
Liberium premium 1.8/AntdUI.dll.dll 2.1MB
-
Liberium premium 1.8/AntdUI.xml.xml 759KB
-
Liberium premium 1.8/BouncyCastle.Crypto.dll.dll 3.2MB
-
Liberium premium 1.8/EntityFramework.SqlServer.dll.dll 577KB
-
Liberium premium 1.8/EntityFramework.dll.dll 4.8MB
-
Liberium premium 1.8/FunAudio/PikaBybyChi.wav1.4MB
-
Liberium premium 1.8/FunAudio/allahy_akbar.wav684KB
-
Liberium premium 1.8/FunAudio/bass.wav594KB
-
Liberium premium 1.8/FunAudio/connect.wav449KB
-
Liberium premium 1.8/FunAudio/death.wav169KB
-
Liberium premium 1.8/FunAudio/disconnect.wav417KB
-
Liberium premium 1.8/FunAudio/discord_call.wav967KB
-
Liberium premium 1.8/FunAudio/discord_disconnect.wav200KB
-
Liberium premium 1.8/FunAudio/discord_message.wav82KB
-
Liberium premium 1.8/FunAudio/door_1.wav388KB
-
Liberium premium 1.8/FunAudio/door_2.wav190KB
-
Liberium premium 1.8/FunAudio/error.wav171KB
-
Liberium premium 1.8/FunAudio/girl bass_bust.wav245KB
-
Liberium premium 1.8/FunAudio/girl.wav171KB
-
Liberium premium 1.8/FunAudio/go go go.wav868KB
-
Liberium premium 1.8/FunAudio/hello.wav128KB
-
Liberium premium 1.8/FunAudio/notification.wav568KB
-
Liberium premium 1.8/FunAudio/omlet.wav959KB
-
Liberium premium 1.8/FunAudio/orgazm.wav544KB
-
Liberium premium 1.8/FunAudio/pocman.wav896KB
-
Liberium premium 1.8/FunAudio/scp.wav1.7MB
-
Liberium premium 1.8/FunAudio/skype_call.wav1.2MB
-
Liberium premium 1.8/FunAudio/skype_disconnect.wav517KB
-
Liberium premium 1.8/FunAudio/skype_message.wav156KB
-
Liberium premium 1.8/FunAudio/telegram_message.wav172KB
-
Liberium premium 1.8/FunAudio/terrorist_win.wav400KB
-
Liberium premium 1.8/FunAudio/traxnyt.wav54.5MB
-
Liberium premium 1.8/FunAudio/viber_message.wav265KB
-
Liberium premium 1.8/FunAudio/vk_message.wav400KB
-
Liberium premium 1.8/FunAudio/women.wav1.3MB
-
Liberium premium 1.8/GMap.NET.Core.dll.dll 304KB
-
Liberium premium 1.8/GMap.NET.WindowsForms.dll.dll 154KB
-
Liberium premium 1.8/IconExtractor.dll.dll 10KB
-
Liberium premium 1.8/Leb128.dll.dll 7KB
-
Liberium premium 1.8/MaterialSkin.dll.dll 6.4MB
-
Liberium premium 1.8/NAudio.Asio.dll.dll 33KB
-
Liberium premium 1.8/NAudio.Core.dll.dll 183KB
-
Liberium premium 1.8/NAudio.Midi.dll.dll 45KB
-
Liberium premium 1.8/NAudio.Wasapi.dll.dll 175KB
-
Liberium premium 1.8/NAudio.WinForms.dll.dll 40KB
-
Liberium premium 1.8/NAudio.WinMM.dll.dll 56KB
-
Liberium premium 1.8/NAudio.dll.dll 7KB
-
Liberium premium 1.8/Newtonsoft.Json.dll.dll 695KB
-
Liberium premium 1.8/Plugin/Action.dll.dll .ps1 27KB
-
Liberium premium 1.8/Plugin/AntiMessages.dll.dll 19KB
-
Liberium premium 1.8/Plugin/AntiProcess.dll.dll 14KB
-
Liberium premium 1.8/Plugin/AntiReset.dll.dll 14KB
-
Liberium premium 1.8/Plugin/AntiUSB.dll.dll 11KB
-
Liberium premium 1.8/Plugin/AnyDesk.dll.dll 14KB
-
Liberium premium 1.8/Plugin/AutoRun.dll.dll 357KB
-
Liberium premium 1.8/Plugin/BotKiller.dll.dll 30KB
-
Liberium premium 1.8/Plugin/BotSpeaker.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Camera.dll.dll 98KB
-
Liberium premium 1.8/Plugin/Chat.dll.dll 47KB
-
Liberium premium 1.8/Plugin/Clipboard.dll.dll 13KB
-
Liberium premium 1.8/Plugin/Clipper.dll.dll 15KB
-
Liberium premium 1.8/Plugin/DDos.dll.dll 113KB
-
Liberium premium 1.8/Plugin/Defender.dll.dll 13KB
-
Liberium premium 1.8/Plugin/Desktop.dll.dll 778KB
-
Liberium premium 1.8/Plugin/DeviceManager.dll.dll 14KB
-
Liberium premium 1.8/Plugin/DisableUAC.dll.dll 16KB
-
Liberium premium 1.8/Plugin/DriverManager.dll.dll 17KB
-
Liberium premium 1.8/Plugin/EventLog.dll.dll 12KB
-
Liberium premium 1.8/Plugin/Explorer.dll.dll 499KB
-
Liberium premium 1.8/Plugin/FileSearcher.dll.dll 15KB
-
Liberium premium 1.8/Plugin/FullImageOpen.dll.dll 17KB
-
Liberium premium 1.8/Plugin/Fun.dll.dll 48KB
-
Liberium premium 1.8/Plugin/FunAudio.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Go/Go20.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Go/Go21.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Go/Go22.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Go/Go23.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Go/Go24.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Go/Go25.dll.dll 14KB
-
Liberium premium 1.8/Plugin/HVNC.dll.dll 42KB
-
Liberium premium 1.8/Plugin/HiddenRdp.dll.dll 688KB
-
Liberium premium 1.8/Plugin/HostsFile.dll.dll 13KB
-
Liberium premium 1.8/Plugin/HzGenerator.dll.dll 513KB
-
Liberium premium 1.8/Plugin/Injector.dll.dll 50KB
-
Liberium premium 1.8/Plugin/Java/Java17.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Java/Java21.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Java/Java8.dll.dll 15KB
-
Liberium premium 1.8/Plugin/KeyLogger.dll.dll 17KB
-
Liberium premium 1.8/Plugin/KeyLoggerPanel.dll.dll 13KB
-
Liberium premium 1.8/Plugin/KeyLoggerRemover.dll.dll 6KB
-
Liberium premium 1.8/Plugin/Leb128.dll.dll 7KB
-
Liberium premium 1.8/Plugin/Map.dll.dll 14KB
-
Liberium premium 1.8/Plugin/MemReduct.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Microphone.dll.dll 509KB
-
Liberium premium 1.8/Plugin/MinerEtc.dll.dll 24KB
-
Liberium premium 1.8/Plugin/MinerRigel.dll.dll 21KB
-
Liberium premium 1.8/Plugin/MinerXMR.dll.dll 26KB
-
Liberium premium 1.8/Plugin/Net/Net5.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Net/Net6.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Net/Net7.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Net/Net8.dll.dll 14KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore10.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore2.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore3.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore5.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore6.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore7.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore8.dll.dll 15KB
-
Liberium premium 1.8/Plugin/NetCore/NetCore9.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Netstat.dll.dll 18KB
-
Liberium premium 1.8/Plugin/Notepad.dll.dll 13KB
-
Liberium premium 1.8/Plugin/Performance.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Piano.dll.dll 13KB
-
Liberium premium 1.8/Plugin/Process.dll.dll 16KB
-
Liberium premium 1.8/Plugin/Programs.dll.dll 17KB
-
Liberium premium 1.8/Plugin/Python/Python10.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python11.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python12.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python13.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python13_5.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python13_9.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python14.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Python/Python9.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Regedit.dll.dll 32KB
-
Liberium premium 1.8/Plugin/ReportWindow.dll.dll 13KB
-
Liberium premium 1.8/Plugin/ReverseProxy.dll.dll 15KB
-
Liberium premium 1.8/Plugin/ReverseProxyR.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Screamer.dll.dll 5.2MB
-
Liberium premium 1.8/Plugin/SendFile.dll.dll 24KB
-
Liberium premium 1.8/Plugin/Service.dll.dll 14KB
-
Liberium premium 1.8/Plugin/Shell.dll.dll 16KB
-
Liberium premium 1.8/Plugin/Sound.dll.dll 18KB
-
Liberium premium 1.8/Plugin/Sounds.dll.dll 18KB
-
Liberium premium 1.8/Plugin/Stealer.dll.dll 157KB
-
Liberium premium 1.8/Plugin/Stealer2.dll.dll 160KB
-
Liberium premium 1.8/Plugin/Stealer3.dll.dll 258KB
-
Liberium premium 1.8/Plugin/Stealer4.dll.dll 137KB
-
Liberium premium 1.8/Plugin/StealthSaver.dll.dll 15KB
-
Liberium premium 1.8/Plugin/SteamGuardBypass.dll.dll 114KB
-
Liberium premium 1.8/Plugin/SysPlug.dll.dll 13KB
-
Liberium premium 1.8/Plugin/SystemSound.dll.dll 507KB
-
Liberium premium 1.8/Plugin/UAC.dll.dll 28KB
-
Liberium premium 1.8/Plugin/VC/VC2005.dll.dll 15KB
-
Liberium premium 1.8/Plugin/VC/VC2008.dll.dll 15KB
-
Liberium premium 1.8/Plugin/VC/VC2010.dll.dll 15KB
-
Liberium premium 1.8/Plugin/VC/VC2012.dll.dll 15KB
-
Liberium premium 1.8/Plugin/VC/VC2013.dll.dll 14KB
-
Liberium premium 1.8/Plugin/VC/VC2015.dll.dll 14KB
-
Liberium premium 1.8/Plugin/VC/VC2026.dll.dll 15KB
-
Liberium premium 1.8/Plugin/Volume.dll.dll 502KB
-
Liberium premium 1.8/Plugin/Wifi.dll.dll 18KB
-
Liberium premium 1.8/Plugin/Window.dll.dll 16KB
-
Liberium premium 1.8/Plugin/Worm.dll.dll 3.0MB
-
Liberium premium 1.8/RjControls.dll.dll 31KB
-
Liberium premium 1.8/Scripts/sigthief.exe.exe 6.4MB
-
sigthief.pyc6KB
-
Liberium premium 1.8/Server.exe.exe 2.5MB
-
Liberium premium 1.8/Server.exe.config.xml 1KB
-
Liberium premium 1.8/Server.pdb1.6MB
-
Liberium premium 1.8/Server.vmp.exe.map181KB
-
Liberium premium 1.8/ServerCertificate.p124KB
-
Liberium premium 1.8/Signatures/Exodus.exe_sig4KB
-
Liberium premium 1.8/Signatures/FL64.exe_sig7KB
-
Liberium premium 1.8/Signatures/MarketApp.exe_sig25KB
-
Liberium premium 1.8/Signatures/NVIDIA GeForce Experience.exe_sig9KB
-
Liberium premium 1.8/Signatures/NordVPN.exe_sig14KB
-
Liberium premium 1.8/Signatures/RGBFusion.exe_sig8KB
-
Liberium premium 1.8/Signatures/TLauncher.exe_sig17KB
-
Liberium premium 1.8/Signatures/TOTALCMD64.EXE_sig10KB
-
Liberium premium 1.8/Signatures/Update.exe_sig19KB
-
Liberium premium 1.8/Signatures/Wireshark.exe_sig8KB
-
Liberium premium 1.8/Signatures/brave.exe_sig10KB
-
Liberium premium 1.8/Signatures/chrome.exe_sig10KB
-
Liberium premium 1.8/Signatures/clion64.exe_sig11KB
-
Liberium premium 1.8/Signatures/firefox.exe_sig10KB
-
Liberium premium 1.8/Signatures/iVMS-4200.Framework.C.exe_sig21KB
-
Liberium premium 1.8/Signatures/idea64.exe_sig11KB
-
Liberium premium 1.8/Signatures/logi_crashpad_handler.exe_sig10KB
-
Liberium premium 1.8/Signatures/obs64.exe_sig9KB
-
Liberium premium 1.8/Signatures/phpstorm64.exe_sig11KB
-
Liberium premium 1.8/Signatures/rufus-3.21p.exe_sig9KB
-
Liberium premium 1.8/Signatures/steam.exe_sig11KB
-
Liberium premium 1.8/Sounds/connect.wav938KB
-
Liberium premium 1.8/Sounds/start.wav531KB
-
Liberium premium 1.8/Stub/Client.exe.exe 78KB
-
Liberium premium 1.8/Stub/Dropper.exe.exe 9KB
-
Liberium premium 1.8/Stub/Joiner.exe.exe 9KB
-
Liberium premium 1.8/Stub/KeyLogger.exe.exe 11KB
-
Liberium premium 1.8/Stub/MBR.exe.exe 3KB
-
Liberium premium 1.8/Stub/UserMode.obf.dll.dll 136KB
-
Liberium premium 1.8/Stub/Winlocker.exe.exe 30KB
-
Liberium premium 1.8/Stub/WinlockerBulid.exe.exe 30KB
-
Liberium premium 1.8/System.Data.SQLite.EF6.dll.dll 196KB
-
Liberium premium 1.8/System.Data.SQLite.Linq.dll.dll 196KB
-
Liberium premium 1.8/System.Data.SQLite.dll.dll 384KB
-
Liberium premium 1.8/System.Data.SqlClient.dll.dll 217KB
-
Liberium premium 1.8/System.Security.AccessControl.dll.dll 30KB
-
Liberium premium 1.8/System.Security.Principal.Windows.dll.dll 17KB
-
Liberium premium 1.8/Vestris.ResourceLib.dll.dll 76KB
-
Liberium premium 1.8/WinFormAnimation.dll.dll 37KB
-
Liberium premium 1.8/cGeoIp.dll.dll 2.3MB
-
Liberium premium 1.8/dnlib.dll.dll 1.1MB
-
Liberium premium 1.8/local/Bulider.json7KB
-
Liberium premium 1.8/local/Miner.json125B
-
Liberium premium 1.8/local/Settings.json389B
-
Liberium premium 1.8/local/Tasks.json2B
-
Liberium premium 1.8/local/temp.ico4KB
-
Liberium premium 1.8/res/screamer1.gif.gif 646KB
-
Liberium premium 1.8/res/screamer2.gif.gif 1.1MB
-
Liberium premium 1.8/res/screamer3.gif.gif 1.8MB
-
Liberium premium 1.8/x64/SQLite.Interop.dll.dll 1.7MB
-
Liberium premium 1.8/x86/SQLite.Interop.dll.dll 1.3MB
Liberium premium 1.8/AntdUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3cff25b7c804e162c834772145ab1384f44ec1533ba2bb2800844e363c86d47
- MD5 1962b3dae04045e9ea04930479b3e000
- SHA1 a1453ae68de9c12e2c3791ea11339a5d4f76a789
- SHA512 b2e8607fd96e6e5b3b48c675bc21a035b8d142e900e6cf55bebda71629381018ab2e3e27765a22359f65947a2c12ebd4f65487e5e84eff0ad35342c3e0016114
- SSDEEP 24576:Q3xqGMSp+XAnXNzFjU+PyDcJir63/s4p/LMdIDpyhXpN/:QxZWuir63/s4p/L5s
- TLSH T1CEA54A51B2D8C7BAD82F57B5C0211032A3FAC59AB2D5AB19EB89DC70BD033D58E450DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2221554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Pro\Me\AntdUI\AntdUI\gitee\src\AntdUI\obj\Release\net46\AntdUI.pdb
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/AntdUI.xml
- SHA256 b779438976584c373ecbaf1cb87e43f21c673d7da3a51b0c654ee5a551847148
- MD5 c81412fcd296fd0f6298cd12df1b7307
- SHA1 9617512b02ca6c630c104e8ea1eaf730f0ed1455
- SHA512 716796b1c55ca959f7c0423e7a8bb116e29e4bcb562f715d6447da29ec8044bb7be31ffdd15b72683494261c080b5c1f6dda9a8338e94e97572e633b744e3462
- SSDEEP 6144:um3iAQqfWv5o8AetvbzwETad1QU9fSfSalGV1h2r:umItvbzwElSalGV1ho
- TLSH T119F49A28B6C59E200C3601576E55F8C8FF850C37214E696A708E3E675F7ACD763AFA60
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
- MD5 0cf454b6ed4d9e46bc40306421e4b800
- SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
- SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
- SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
- TLSH T15EE57B0577F81E67E56ACBB7D1B14012D3F1F82AB363DB5B5882633A1C13B805D826A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 19, 2021
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 18, 2020 - Mar 23, 2023
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
3221146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/EntityFramework.SqlServer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- TLSH T187C4F715B3E45E24C3BB4230583A701CEAB582F3627D0694F95EA3DF6FBA91115A3723
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8e:c5:11:28:68:d6:51:bd:1d:88:7b:a2:95:b6:a4:1e:10:90:40:df:99:35:39:92:62:d9:0a:b7:28:af:67:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 16, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:24:cb:cd:02:a1:17:70:5c:9a:00:00:00:00:01:24
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
587890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/EntityFramework.SqlServer/Release/net45/EntityFramework.SqlServer.pdb
mscoree
_CorDllMain
Name
.text
Size
566KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/EntityFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- TLSH T1EA362942F3E81F2AE1FF067AA435604A5AF5FC6A1352D65E381CB1AD1F227005A63737
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4b:23:17:75:a0:e1:0d:cf:78:75:af:e9:4d:d3:dd:b6:84:55:8d:90:dc:2a:e5:20:27:57:dd:97:7a:9e:24:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 16, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0a:52:c8:39:01:52:d1:70:4b:00:00:00:00:01:0a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
4947982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/EntityFramework/Release/net45/EntityFramework.pdb
mscoree
_CorDllMain
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/FunAudio/PikaBybyChi.wav
- SHA256 c76351644301a742a54f58033d809a47410bd1f3d6ca48036fddec917a451d0c
- MD5 d1bb10f64f7610795067ee6791e47fb0
- SHA1 101cde1da64edcf32531cad6613253163945c58e
- SHA512 9b70e3cee7e128f6f65018fe0cc5746285c7d1a6cae277e7d5b6404301590aedd4e1d8fcd67daead2a7074937414fcce8ad4c04a44f17bc4fff95ae5ed036ef3
- SSDEEP 24576:aznUlEy31I1ELSpyaY3/zuSBwuo5qbSrQmbAJX28tcMycjx9zWUs:wUlEyl1LSp6zh2EbmAkUcMykxls
- TLSH T14D652396B172F304F83E9635E5C0DE5801A5B98618178EDF701DDAC2D623742BE386AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/allahy_akbar.wav
- SHA256 0d67c723865e7c8e9971ac77f970a7e78467db6db8ed83323a223a75790585f5
- MD5 a8b3191f0b625bcd14a90c9a3de835d9
- SHA1 e25a26a5396181edee36b4f25cfa9a566b571a7a
- SHA512 fed458d8d4d5466e10f33d8bc6e600c5f60e797fb981d3d513f5f170b54df2423d49e8517b4b70add06e86af46fa83d6cecb5c843f65bbf2ef26635ecc2b770d
- SSDEEP 12288:kiojldD1C0K4YVpcYDk3LWjgX+8ojNDYDoPh9V0KKXY/3EEKwWZZCQG0Bagj:kiojTIcqMX+VDuoV4X4/0G09
- TLSH T1D2E4D0E3F0474C20CC861A7ED9B36E7112713C39BD69592E604C7D566AB3382A3B5BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/bass.wav
- SHA256 caff4795bd187298d8a5616fa67a635fb826c206d3d30491fdf45800ed9cfb6f
- MD5 0ef09403eebda524c728211de6de0c3e
- SHA1 175f7d059fe4a3585dcd3fb6e1e3b6fd40987dc4
- SHA512 7d2b951d1f038b73f55153aa1d70ad9287f34e4771ec96123a1d4fe417311552328f2d06204fb38316547fad03d32711afe2bafdff53ca2668ea97e13ced879a
- SSDEEP 12288:1gCGqncUXTn6MXKUF6NB3wBTbXgOrlHtJ/Z4Z7/WWXf:1gCGZM+kBTUQ7aTXf
- TLSH T1E5D42342E241DA5FF928BD715CE12CFC83AA5D631E42C3A71B56741F19F6EE6A01880C
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/connect.wav
- SHA256 b3197e8d529a623b6066268a0a598285acd59dc6ec80f4cbb121a6dd893ebc51
- MD5 5183ebe30a762761f99b960c80a94ae5
- SHA1 04482f073d49c47a47fe3e3b35f1e3661c541a72
- SHA512 9058ce0aa51cacc37c698ac36a41119538aaff23d86ebf8dbe73256cd7c5293e0aa2ac352bf3dab8a34a62bbb37c58d9793fb250e4a28789f863b2ddc7418a0c
- SSDEEP 3072:Oo0tNWiH4DQ18c+pmTheuYUIutTzqj5Du8YPas5Xd9duZWus0IGoEY9R/8ECPES:v0yK4DQ18HgTwvwTzQDlCjbAoFeZS8
- TLSH T148A48481F240DE81C4162E794566DBF953377E59FF4BA7223040FB2B3DB25C26A692C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/death.wav
- SHA256 26df48d270651081d17b35989e073a53a3e8ec99ac232af31128425b7db678be
- MD5 e6682c0e9272bd631c70f101cef7258e
- SHA1 217501b17aae8b12bcb67a32f09c8f6a6339c4a0
- SHA512 9a6e847bce3fa73c0a6db13246356205cbc174fb7ab93387dc203189c9b56cfea9810da6b93e5638127092a2c45c48a75f95899d68fd648878fa7c143f2b9ff8
- SSDEEP 3072:aXmc1sxs/hIT9d1bMWtlxwzKT3vFQwORZl8ActHf:aWFQITNbMcl53HORZNc9
- TLSH T1DF04C053B152D114ED2B8E73CE92F1442724762BBF66250F3140BF0ED9B3582DA8B9AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/disconnect.wav
- SHA256 6a9d42ae705956b0d9a6ef2aaf5a61c92452bd160a8d8bf4878898d8f42edde5
- MD5 7e236195fbde209f01d36890052ade99
- SHA1 a5686486fa114a9c505d814a38c7703bbf17c15a
- SHA512 1da792711016baa5c026b680fbe42eaa0a4269cc0bf32a003d828a84158b7c62f2585fb665455e37fa997f1df57629cd556bdb97495e541b6a88ebec312bc80b
- SSDEEP 3072:3r5A/bQa1eX3TzReEgxiwpkXgI58kXIyG9Ql/FQHjDvlJdb1aHl0m01Feh0gwp:VA/bQ4Q3TgECNI58Xvpb8Sm6n
- TLSH T1F0945A82B701DA51C495593AD956DBE65322FC9AEF03932330E8FF2F3CE24835E55289
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/discord_call.wav
- SHA256 567f5181c55f049718696c7036c461d63a5c2371bcdd2fdfd20e624a71c60de7
- MD5 899429f058818e3b711272f952140c27
- SHA1 a1fcdd78844c318468527eeca653cb3bda6493a4
- SHA512 90780801be2a29b963a0c6f6cc8f9decb63450923234cbaa1265b561d919bc8329824771a0c2bb74d2c1976ee579169ebc0e7bc22eea200374777a75aeef2506
- SSDEEP 24576:7L31D6+Oa6ji7TL2IJI35FwE0mQzDLR+LyJNx:7L3d6+Oa+BR5FwE0mQz/R+LyJ
- TLSH T17525016EF273B340D9ED8531E980CF6C2310B55659138C7AB07DDB96B1227833DA5A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/discord_disconnect.wav
- SHA256 28438681cd1e852ac9b8c60fc4ac0821c692756d1a109ca75433d4c4a49888bf
- MD5 f461065cb4323a344213f081dc729692
- SHA1 79c5fe036f9e355c60805777bc26ba149239b270
- SHA512 0b578b69f2fb7b236b9c6b2e745f5c157a43f6e1a674de507773bfe94076adfc2db909abc1a39a74812b14252dab64e0e65d8bde4f9882244f2ea9ab684f4e0c
- SSDEEP 3072:3DzU7nKcsKCf8e/3+YQ8ShuDpPPXdwvp76UO0Jh:Tz+KcRc8u3GbQFdwvpeUO0J
- TLSH T126146B81F300DA80C4466A3A9156DBF903367D5AAF46A76730B4FF1B3DB24836E691C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/discord_message.wav
- SHA256 b46b568f25d545c75185a1d6f4f9a47a940f8eabb7d8baf741f4e45f0424e02d
- MD5 c6a6a4645b72b5846d70103085de473d
- SHA1 670b559d782454af903a6bac82dfedd2d0f05a4a
- SHA512 6930208bbed89cce0ab4b27142afb1ca8d29116af03f317345cdbc9656565ca1bb0f452de9843d86093f4c01db6137445fcfbedb6980faef2d69e5217cca0f9d
- SSDEEP 1536:RyBdrCi06NKqlEVCyFJja+ODM95coEh3P:6dGP6LlEVzFJjp96oQP
- TLSH T1DE832682F701D641C496A5369D42CBE84325FCAAEE42171730EAFF1F7DBA1836E13285
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/door_1.wav
- SHA256 ce6ddfc6b6a445fd6e4384bd5dfbd979b6b207cabeedd319b03053582f69951c
- MD5 3789b32ed467c7c657f7665979df863f
- SHA1 16db1368fe9d052b5c33f3cd35a07b6b718d44e6
- SHA512 2e2c4cbcc79d53d469a7bbc10bd5f25889d24f4fdcb701f0b29bc558dae76d603221dab236fbdcbd9a9b9218de10db3ca7b5798fc8a060c7b9cbe49a17aeaeb6
- SSDEEP 6144:UgfS/E7mpRkg+pVXu00Ct4vYFzAPeQpC95b:HfSM7gQVXu0T+AFOC9
- TLSH T1CA84B6D2F4428911CC174E398573FE7103376D3AFE5A960634887B0A6AB33C66776A93
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/door_2.wav
- SHA256 434f5bd5c1765806a52a742a221b89f7b483df768eb29a487667c8536004210c
- MD5 70a40b8b73b33bb66f8f7a821f17d9ec
- SHA1 8bc0dcd3cf4150b243cbe256e7274ac81dcb0500
- SHA512 b9cc30fde1afbc4b61ad7acb4e6aace1fb3c63929f0b7bd3dc5567878f5e1a45ec5839feb186c8e8dececf6aa19862b7fe58b00ffd67a529e9477586cde9d776
- SSDEEP 3072:IiONrYdvfMl5kTrRXmNge6bX6occ4Ezud5tqUgf7jrDsQfcNwff8vt:IiOMeGTrsNge6bX6vc4EzABgf7jrDsp5
- TLSH T10114C0A7E48301126D199A27CFE3B8011E15712FBF79391F354C9E19E397312A2A3B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/error.wav
- SHA256 8e1348be4275c1bca08bae5b4378800b5d742c83a29415c06bbfd55361236479
- MD5 e3c60cda4a08373f4db5c66ddcc8f681
- SHA1 8f164b8bc9b5735bbab8fc02dc45f07af669f121
- SHA512 08c1783b1f630de8236b96eb327eb5e32ad2a0b5fc32139cb6a3abab4dee40ca2022a6b37db03df2f30856282970487dd35d09494cdc5b37103ffbbe8271611c
- SSDEEP 3072:DpCRIny2Zv7lJGjgj/6LUUDbDDjffAqPaLE/ME54KPhAbXEN:1CRInVtRUj0/6LUUrQqCLEZDPy4
- TLSH T1F404BF63F8838402DA8B4E7ADDA2FF6005B27D25FF16871B3044BB095EB73C13962596
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/girl bass_bust.wav
- SHA256 399bd31f4def80781e6932e6f137dc9c56ec06269ccc499e64bd89dea8af79d5
- MD5 4a7edb77bb0f1d59352ae35e7ccfa290
- SHA1 97958b09dae3a07da380dab364a8dbb2b0d615c5
- SHA512 86dfc1c66a08eb6582ff16444153f49efe68b447eaf24c697db31164d7f95b861cf918126479a5057bd72d07f6da11d9d9d0463decc801016814466ca00cc603
- SSDEEP 1536:IkrAwgWEflzb3VN7B/EMYMTPpN3P07snmR0vXMoZXrAjWPHiEP/r/LzLff:DAf97B/VW+ZXEjk
- TLSH T1CB34CDD3F5418911CC1A0E3A8933AF7642376D36BF5F971630887A1A6FB32C25B256D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/girl.wav
- SHA256 d88e527b489758ad7d8f9d1ecebe0916a4989d079d5a2de373fdd4e2c4fe6bab
- MD5 aebec63d8673ed8dd9785ebdefae87c4
- SHA1 7db34810a5f614d6f12f458a709fdb192a7d17ff
- SHA512 aea3a0894ff6d77cf68d6dc892e39aeff91969216e4d283abf7b7c9efcd32f50fdffcc01b7a17afe131c6703a8436d24aafce28b1ce6bb800e7eedb2cc936d17
- SSDEEP 3072:arZRXJERzEf2wLGZRq4TEWkEHEJVnEgADTgUk0MVp33AabsT33N5/b8K4M:8jJAYLDBHES0EXHA7JqdM
- TLSH T108043B93F04449125C5F8A26CD73EA204761362FFF7D251D2088FE18A6D7346DBAED2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/go go go.wav
- SHA256 b5b0179d5242d98cfc541c156050b9447f018b220ddc1304bf06cd5c27909928
- MD5 90429d9c0a56c873e3e35ccc179bdd0f
- SHA1 8538e51738d2eb50fb67526f497dfe01a87d9159
- SHA512 f87d39a7ab7c6b9be320b0c07054a05f5ec317b8657ef33c700c4d917ad04364f4d9844f1a8b8e3b7e7adbac056767431ff91f2b17314c88d4e04234994f37ba
- SSDEEP 24576:tBx7aDwfNa5N7R8NUatKf8+XVxzNvG9rOm:c0GOyaqXzzt07
- TLSH T1B015F187F612E51DC6D9C5329D81DED41B20B85AAD020B273078DF2E39B22837ED765E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/hello.wav
- SHA256 cf7eaa4320a3ce1d40ec9f651c0a6e4f56cbbbb60882c33f20b4f68ad16cabc8
- MD5 41c0bba5e64279ed884fa9e870621b0d
- SHA1 0973388f5e4849e40f2f4389be4a81936b72c488
- SHA512 218b1f5fb2288860f503bc236c8f635f9dafd24956788e38a7eca2d86d9a095a1387f7bbfbce5e69c7f68fb230f18a11684b26320f1ac347db731c0acdbbf337
- SSDEEP 3072:e/r1VNxPPBWCX9X0zmUe/mN+1CttXD+ymC+xCVPEF/:2NxPPZX9EZe/r1c6ymC+xGe/
- TLSH T192D3F173C9934250E986E6769FD568847E80B60DFE282A2F314C9D06DB73341F6637B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/notification.wav
- SHA256 1c73cc515fd536eea4f2f70f22f26ea17f15bf68e095920a5f6f3944759f972e
- MD5 94286c49eef706a579e18de18ed7da7a
- SHA1 9e4c844e0bc3e2952a26d7d053ad5bfce45636b7
- SHA512 c97f56f9fa872b0fcfe3bd982bf3b7c343cb58a909589b403e8a42686306a968e87e0ad40272dacd57bc043343f2534c815b3d9e074c1fa12928a6bd30db310e
- SSDEEP 12288:j/sqixr0pU69GNMqzXnWNFhDZg2RGa4TD5n:yxrWU6l+Mv
- TLSH T131C4CF86E166CB86C8DC64369452EEA607166E8BDE034B70307CFB5374F20637E856ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/omlet.wav
- SHA256 7d7781bcc7fb62b9534ad4dea634113736c3f4ed647036ef44b1f0a1fc1a5d33
- MD5 6224f5587a7491debc15dd5574d0429b
- SHA1 7447b9d0e3472d8d2dbba9ef941637f8c4548255
- SHA512 355f7a18661f0c9e9375b2cb478407da98e7af13b136eb9fb07fc4e1a3ad2fbe79d6f34e9bb226c2bb014df15b70d076923d73d45f21975c0e49f2ae7462ca4a
- SSDEEP 12288:6satEC22HE6Bk94oF/loAA970Kkv1hAi9xoK3MnQdp2Hgvup6+3YYrbevb:6ECnk6EmFi1hH/dp2HOuZ3Yacb
- TLSH T16725F141E2337B98C6FA8132AE46DC254B51B46FDE121D7B607AEA1071833437E7276B
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/orgazm.wav
- SHA256 e547a6b7fa272ed15601252f3a4bc1309bd6bd40d6dfbb77a8d5841a360003de
- MD5 3225d4996741c9dd5fda72f7b2ba1ea6
- SHA1 62339277ef934cb44ca1135682e654e5c59b9abf
- SHA512 5eda6d0bedc8f5b522a979abd69241437b71fd0bd9e2bc76c2f3ec2405bd73bf7b00c683e3f317b5939747d30b0b621886f9ecb33ad8366c30616cc674eb83ce
- SSDEEP 12288:+0x33M4scc9q+mNTvcSNnakfAYyQzZMQy8TZCm0fOh/:b38q+S1NnaoV5y8kmEc
- TLSH T1F1C40253F2B35798D53681338DA60C804F86F69E9D115E6F7A09CE56B1C3200EA9B3BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/pocman.wav
- SHA256 e32d65bafca02ce4e2f58912aa13903a3d1f4a9187a7d712907c6c3a4782183b
- MD5 3d9d01b5ac26b8212ecf3140d54ba0cb
- SHA1 b8734ea8d35cd4a8f39a4de0052f1bf06742df6f
- SHA512 7129a278fd832e6a2ba7ecd2cf4eb437f40d887fccfa9b4cd5e73c44c19958ec2bbd58b5367535af902d4c630f4cf1431a361cc48a61ac33377a57a45ed568df
- SSDEEP 12288:Bvjj2v4bbOwgjmwaB8V1vvPdbtM/lN0AnCMYYERnS9UXWPvl0NY:BvjaoOQ1B8V13PUH0gCVgHPv
- TLSH T13115CFE1E883C943EBCBDE79DBE25E1018F26D14ECA8A51E30C87B1452F7744352969B
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/scp.wav
- SHA256 a5c907a6dd28f3feac3d8504306fcd79cfd79ebb983bd5c9c34237a23fb2c1c0
- MD5 7dd5a16b651d009c7513e56ae82f42fe
- SHA1 b1104a46a367ecafcecf4a53dae1ee71290aa917
- SHA512 f2934fd3f9b450ac1044630cdd3b7bc125a8028854efc4c64c20d495ea800ed298706c81995349ce9e31c6711a634081821b1dd95d71ca26b5a0ca0db421b86b
- SSDEEP 24576:VjKsc0R8fulgwOnACc+JjL0nKu60rW5hHHT9Q/ZiQvh80uHxyjl7dpWlMSLi:VxRGE44nqT5Fzi/Rvh80uHMl7df
- TLSH T12F8523AAE562BDC505FC821397C2DC281762F97ADC230C6F7A09CE45B1053527A3AB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/skype_call.wav
- SHA256 6ab61f5f33313d264474caa2cc9ebeca0da9bf51ffea65bb78def16dea24d2ee
- MD5 2b1be30d3a0dde71e6f9e56400c56cdc
- SHA1 97beb7fc3a3875c549b41ad0c63605bd50405304
- SHA512 1eb2869a64d0bdaab92b0dc05c0f71f4be0250e05a6a63ca8ab4c4e65a0f632f3dc232e2ad158f0633953db4358cef11ce4967120ec8717321dbb937a791386e
- SSDEEP 24576:7nurHe/gF4LhDP57iYcMAK98dJKbSTAQPrngCLdrJsnFzS67JN2wx79fsgANS:7ujFF4NDPHA88dJZXnDrJyFzS6Nrx71x
- TLSH T1FE55F1B2D4838A5AE7C7C77BABD26D1408F0E50CD6B4961F34888E5AD2D3B04365E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/skype_disconnect.wav
- SHA256 a1ca9f2001de36f617de00a353943c803abf0309cfd482cf9d23836aaa855874
- MD5 0821866d11318fb24a92eddfeefde5c0
- SHA1 6eed10a68eb26d83289765d68b99ab8faf3b5fc3
- SHA512 152d59f48bdf5f2d128ae9afacd4e793559e1fd8d738a3d09ffd1029c10a9b0e61eaea79b68306f65d8334ca646a4270b973b35a254959cb771f1b3c60f00e47
- SSDEEP 6144:dRt7k4O1xdsmq+mscrHnLwYYxwMRTcAZf6BksTHxIrqHyGNOLgHA2fza9:bm440FscaPZCFCqHkAB8
- TLSH T1A9B47293F0428901CC5A4E3A8D63EB6507327D25FF5A571B30887B0E5EB33C26B65AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/skype_message.wav
- SHA256 688288dfcb199a31d409044aaf98eab0c394ddf5276da6dd3adf2aca2ff180af
- MD5 13323f4d24cee949cb46bc9a2beb132b
- SHA1 1780a152aa9a8e10f80075f9b676a284dc0dcc0d
- SHA512 31e62e256fe8f2c4055aff78b9cddf1e526bc3a12fc64e5f5cde8cc2c536de29f43841d17d7d09fd865ac64e3fbb633eebfa5e0676248581f6b3bb63d5d8dcce
- SSDEEP 3072:1L0IeL9skIJJnAmP0kGBytxRX6L9Xt4Jst+OcmGJdndjxz0:1LdkfmP4Bbt4rOcmk70
- TLSH T1A0F37B12F281E551C026DA33CF9AC6D693277646FF06171F3088E74E7EE34468E97A68
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/telegram_message.wav
- SHA256 2bf69daba699813e94ff282f38e01b2ccecad9dc110161e1c38045467669182e
- MD5 f9cdedfbfe375efb7fdef5d8681dad17
- SHA1 62377004ab2ab1590ca98fd9b9bc0a8de50bb218
- SHA512 c571a5b12ba58054e4e6a8de91d64c9b0d3ab8071305db0e17a6f1c40d97f434317df18a063f21be587fc1fe7818f16c278643b7949bb141546490560f0ef15f
- SSDEEP 3072:0AQpOu+XiVryRzdb40zfOG/EWF+ejVPLpa6iD/wQ0XL4GDHfPBewCH:0Hd++ORzdbNVTpe/gX0GbfZC
- TLSH T1DD04C0B1D4834A95E7C7C73AEBC02E441CA1BA4CFCA8592F31C8AE15D7A770175193EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/terrorist_win.wav
- SHA256 5fb879ff5cc3c451b300a9b9c877f7f6604da57059ec9464b5bc7f087ec8a53f
- MD5 be84f2540690e8347850147f38d06fb6
- SHA1 2b3a4d8b0b7ab41bfafa1d88d39ac44690f823a1
- SHA512 83483d1ad74c3077f1b2b7631b384ecdfdaa0c67321b865042ca7fe6c24edd008eaac09d193b910d48a2e6819db97b80c88de26b3edbd6914d54c67ffc60de78
- SSDEEP 6144:XbIGFQGsdXvCjfOPtoBlcazsI3wi5ARS2b9WNnAio:XbIpGsqOPil9zsA5L2p6A
- TLSH T1DE94E053E552CA10F9991E778E92AC852B10F40DFF79262F328CAD4AD2F73826641B74
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/traxnyt.wav
- SHA256 dafe3cd5fe133fe17a956a0b6e30f8b08f892fb9af4c491e0b794a0018616df9
- MD5 9c3917b6acfa06a8c3f46080abb5293e
- SHA1 f0c20565766b5e31eb46f0f101fef1bafef8cb15
- SHA512 8c3fd7f490202d739766af232a1edc2cee515ae47cd85cd1e1d9c2725e4b5fe39e742f82ae1eb5bac4cd2f6a26641de6633f7a246e6d6cc0515b19d1f10750ad
- SSDEEP 1572864:SaMyvf5elplJmdrNlakOPHmxcVN624hm1/A+YUAbE1pFjqA8evW:SaMCelnJmdRUkOPHmxcf6fmRA+YUlpYv
- TLSH T14DC7E15BF332A354EBF986269DC18C082A44FD1E1D118D7BE13BC682B1222277D577AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/viber_message.wav
- SHA256 0e5a5416501d4b3a263d70f5699fa93a5f324f819304836616097ecf1c627cb3
- MD5 da764114716dc0ed5eaa80a8b7f435ba
- SHA1 e67f31cb138dad62920bc04ff3b538b8c05bbb11
- SHA512 bfbcb65aa7713349b860326b4896df8f6a98764649ee6542a1ee6512b5d983f280a51428addb1c178701db08a5296b0b23babebe6dd2d62d007dd8cb816929ad
- SSDEEP 3072:i8bm2p61myaCF7qVWuKAiIEtTFYKNgpMSsAmU9YkjEEj2rwCQfBCxy10:VbmO6bTE9niIEtJ5gmVcWwdoF
- TLSH T1D6441C81F201ED40C4896A7A451ADAE943373F99EF06A7213064F77B3DB25C35EAD2C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/vk_message.wav
- SHA256 c96c904f78d9a7fe7edda8b4d7c1e5b14a694c781768674f636bd57ba89c8078
- MD5 4c473dcc925608008bd05fd599829478
- SHA1 c8e2b09ed4c5d29e5116c39b898b8808768390dc
- SHA512 ccc49dda8d892feee52acfebbd611dab075fd9816fa58e7dcea5721ccf37546999bd498749f621dd44fd3df5bb536253b7cc436172ce5c5d2671b806422f7806
- SSDEEP 1536:h0dLK2XR/PYZzkHc3vzfiKeBKrjH72c/dWwHvNOLG4+6jZh5ov0JssYa73Z2PDfH:B2tYdk8LaKZ2kWwPN1
- TLSH T19794E5957782FC01C416B5BE4A4AD6E95733BF844F05A22330A2B7BF2F69A414CCD6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/FunAudio/women.wav
- SHA256 b7f088269ae99501587bc6c97c890fabc0d0258012de2db691a0cdc43b17268e
- MD5 ae95dcfc00a9876ee13a6a1d89674541
- SHA1 a0a9ca54e357a9af702c14b3b226d6a1542d0919
- SHA512 96178a66674d81487b3335fd90f2b1559290fde36cf02357546e00f58c120fec1d64739a9dca143d3fe96cbbb40c021facb076be2ca55c1196a55f20ad024fe7
- SSDEEP 24576:cuXadF7mVyE8N0PV/96rfnc5lFpOA0PhtdmSqVN0zMF2DFOmjSQp38e0cBt62+z:cSaCY0PV16rfIozrmSqAQwBNms8Jcy
- TLSH T1BB55F12DD133B748E5ED8632A580CD2C1750B68659278C7E613DDAC3B1323637DA4AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- TLSH T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
316730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\juder\source\repos\judero01col\GMap.NET\GMap.NET\GMap.NET.Core\obj\Release\net472\GMap.NET.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
301KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f09c31a7f0cde63b914826fcd8b47e7267394175d3fab30cb9615519e5817e5f
- MD5 2110dc2c787880b9ed2ef58f17cf8da9
- SHA1 24edeb5fdd96af28425e28f2682f9874c3f9733c
- SHA512 095a26c3c7389fcabc9f5ff24d4877879d84513e628a20248bae693f1a2241a583e398f8662131dd21c07d919c06bf3d9af54f68f10a6e361e1c0f09e1dc8d31
- SSDEEP 3072:oPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJawdS5DBRS9LXf+6qbugi7vRq:KccbGucgK9vd/0rS9jf+6qq
- TLSH T163F39DA273948D7FC66F47BDA0A140C1273AFA02F692D35D5D9070BC4D93B146B227AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
162494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\juder\source\repos\judero01col\GMap.NET\GMap.NET\GMap.NET.WindowsForms\obj\Release\net472\GMap.NET.WindowsForms.pdb
mscoree
_CorDllMain
Name
.text
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Leb128.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e9f5e8cdcaa564d6354c15e2fb4d33dbdead917a2e1388050a68bfb1876ff01
- MD5 e6650e116617c59d46b6f2d3498ee138
- SHA1 f499cf553215a2f4190f0c1e9d35b43dc9e1b092
- SHA512 09f9b493a5accc6ba3e724627b74189e08c34a6f30557a5e07f849957db48b22d496fa38a40640b591c67ed3d9cd797f350136fcc6c5f8fdab6c3d645429cc34
- SSDEEP 192:lxAvycMDDDDDDDDDDaZF6URpVJVXKy83:/+F6URpVJVXz83
- TLSH T13FF14304A3D44E24DFA642BEA96A470993B4B71D9C43D71F789456E17D0137E2E121FC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Libs\Leb128\obj\Release\Leb128.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/MaterialSkin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f075552e29e58736ff96e00c828a9a4cb28c16337744b69c5114196ad78d59e
- MD5 301d762a76b269e1fdf391d662acc86d
- SHA1 9ddf5bfa4ddd4bb23e02d49f9966338472d21667
- SHA512 25d7a6dac054744e72d97ab388898b708c4d653da474d937a8a88c92f2f6736df735e378b09acda0f33f9ed0e41de88a617262c1970a7f187eadec9a0274df05
- SSDEEP 98304:21vd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uN4E:2gKv8XcXD4K
- TLSH T12A662902D642A62ACAC6F6387D3D933E0D70D429FC5DB62674C59F3184CA944EC69BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6747714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Mes Documents\VS Projects\MaterialSkin\_release\MaterialSkin-2.3.1\MaterialSkin\obj\Release\net461\win\MaterialSkin.pdb
mscoree
_CorDllMain
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.Asio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.Midi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.Wasapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb
mscoree
_CorDllMain
Name
.text
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- TLSH T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
- MD5 c583aa3819b16ae53859f728f59ea9a0
- SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
- SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
- SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
- TLSH T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net472\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dab10297bd76994a5815d01d43a0c65127427b01396703bde93fb0531d8d5ef6
- MD5 e17f526ebe13f59f5672f92257fb6830
- SHA1 c802af55e0704f857fa9263600e7069d81da9c91
- SHA512 65772a8c66bc324e1249dbc21cf09aefa6b05e388f49584553171872bcaca1f22a5de7b9771f29921133dd6b76aac14fecc2dc2a8a590f411996131b9f92e28f
- SSDEEP 12288:h9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBG3BCjb0PDgM5j9FKjc3:h8m657w6ZBLmkitK/BCjb0PDgM5
- TLSH T188E44A0623F88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cc:ec:0a:66:e1:9d:89:6a:0c:b3:27:86:d8:15:22:99:d6:84:4b:1a:fd:c2:c7:04:1d:b2:ab:b4:60:e3:5a:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 10, 2022
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
cc:ec:0a:66:e1:9d:89:6a:0c:b3:27:86:d8:15:22:99:d6:84:4b:1a:fd:c2:c7:04:1d:b2:ab:b4:60:e3:5a:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Jul 24, 2021
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:43:55:b1:b9:36:33:05:e7:ce:00:00:00:00:02:43
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 12, 2021 - Sep 15, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:EACE-E316-C91D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:9a:c0:75:a2:c4:21:6d:3e:85:00:01:00:00:01:9a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 2, 2021 - Feb 28, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
698886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
675KB
Virtual Size
675KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Action.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 886425f64f01c29e3a143ce195673ebfabda010f600300d3b21e58c300f4ff0b
- MD5 3f5b598d358d5eb6709f3fbddff15296
- SHA1 a542ceb5f080512b9002f7669918b62de4af12b6
- SHA512 223388a59d7096c2e0412ae3f26b360ad74f31591d49f7aff120e3e7e50a99bef0709206a4c311c3e0234a2cbcc1d274b8acd26663567206550d8bfba2b169b0
- SSDEEP 768:LoE6MFY/dEMKix0thSCBsFY/dEMKix0GjRjrEquHp/Up5x9LM:8E6IjrEquH2pB4
- TLSH T182C20A00F7D86A30D1FF07759CB21B15EE35610BD8B2C5193A8C40E82F767558AA1BBE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Action.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/AntiMessages.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27a7677fe8a90dac9f539c6e0cf23e02534555252ece4fc129147e8ba03ee1e5
- MD5 35fbca2a76e05c1cfcf02bad7cd8d369
- SHA1 8f37e80d6827470fb94782c9c08f81f49cfe9d58
- SHA512 ce0c8394e9466a46ca32ac3564e86f3523ef7440f30a2c0157e2896785a7609869758ab168acaf7c2cea06e407f4820438222e0601baf0f7fb358c2d474d96dc
- SSDEEP 384:UW/kXCopabU9BlPDKUM+0cfeqecEHvq2+VBs9IQWgjV1:X/4p9btsSeznvWBngjT
- TLSH T12F92B40557F88A20F6FB2B76597767544636F9154D23DE0E22D0908C09A2FAACE70BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\AntiMessage plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/AntiProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8066c7bee32598396fc2ee27b2acccd1ced4f3b8d514d2c948f8b1c9bc0ba8ae
- MD5 b12ef46f5e9aa23f605d44057e9f786f
- SHA1 9a58d49f6d6e832751cea64c1101d9677ff40d74
- SHA512 33132ea044d37ac67a4ba1ebbadcd0ac2e64a989215aca1e41aae6566776f15f26e4cb2948ebda4072c254be0e581b9e9e21349d8a8fbe7d603420c8b3bfdabe
- SSDEEP 384:KJBAqb/bok08LI/jzUhufBq2DYvqS9yXm0jV9aTt:Kh888/jwQfRUqE0jI
- TLSH T18B62294843A49B3ACEE956BAE8235744D734E2015D63DB0F3ED170D2BE43BE789122E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\11111\AntiProcess\obj\Debug\AntiProcess.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/AntiReset.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 eab8cc355de8edd2fd86a5f3e2e177a6afb415e4e7ab7bf1bc717b06f665e1db
- MD5 ac87e705208e65746b52f3d4d376cc3d
- SHA1 a200c96245c408170f1a15ffad03a9345bb359d3
- SHA512 f6b0c218aa45fa138af31ed372f583fd39c588c33b6fe2074faa37cac0e75f36f497b76aacb7b193016057b2d3a28c8aaf591a501ac9bb5c6852d7021ee05551
- SSDEEP 384:SzDIQ2U9HYtkxL3mZWbqGD1wUs9YlYfCjVQ:C2q3mEbbuUfYfCjy
- TLSH T15B522C485794CB71C6F99BB99AB357449330D2424C13EB0F3AD6A0D87C13BEF4562AA4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\AntiReset plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/AntiUSB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 be5285e697c9f77699bbbfeb364ce5b9d18e01c404009f9c8593ede6babec5d0
- MD5 451168886eea620c6b78103ff1444703
- SHA1 177416c40dbe71958dee3d91db8d23dcc008db3f
- SHA512 92739d877ba2851980c2fef8b35c4a1514643c8c7e076d2d91a3b00b4f729f99927654d642cb097f1b6bff70a31ac1861b65b2b4c83289074aedb8495978e554
- SSDEEP 192:8crXBUKBJa2dCdM+Kxy4c6gtzbq1hhXjrk0j0vWz:8crXBz/o7KQ4c6Qzbq1hdjrkK0v2
- TLSH T1ED32E704D3F49A10E9BE0B786ABA47519730F502DD53CB0F278180E77DA1ABB8DA1B75
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\AntiUSB Plugins\AntiUSB\obj\Debug\AntiUSB.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/AnyDesk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bbcc19c82470220b60d73a182189c9bf9a898a8f40ebceb1da592f9d721db728
- MD5 40532d322ba7c4903c584ecc16c1f226
- SHA1 d99890713106260cb91026a51cdeecbb3535e189
- SHA512 e6ab7ba0c7cccba96a5aa8e0fa09649bbf2b668800e5a66cbb2a976e863f9e6c3ba9410432fec129daf378509b8029bd0e2117ae244d10c58e9ea9ad1935edf6
- SSDEEP 384:lBcgecsBoEf/2mM9VlSjlj6YaFbn/D7p1eu9gvlY1jVD:7DEf/bM9/SjljAFb7N1eHY1j1
- TLSH T17762E80453A48B76CABE5EFA957353949330A2019C13EB0F2BD590D67C52FFF8A31A90
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\AnyDesk Source\SysPlug\obj\Debug\AnyDesk.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4712c34d28257f8e26f1e06b40468468b645922db4fb6500305cf0976dd2f66c
- MD5 0ef595d91c5eba2cb89ae05d7cadf68d
- SHA1 fa9ec6a035ad53427e5edb4c40af49a827c12d89
- SHA512 adfe9da697befccfa3f79399c823c520462abf6b80c34116ba81d7623a996a7c3970544e1933a023a357cecd46c3bf00edc1fab6387e405a7efa1715360f7e45
- SSDEEP 6144:mtsANPVlFHG7QU9V1X7E0AEtRdq6sLtMwNEamxkUu1t:tAOn1L1AQOMIWxkUu1t
- TLSH T1F2744B11AFE48237E9BF17B5E4B303100BB5E589E56AEB4F599414E80C63309AD173AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
371542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\AutoRun.pdb
mscoree
_CorDllMain
Name
.text
Size
355KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/BotKiller.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0dde28bbbb46d8c01df4b87f4b61464ef0f5cd3bfdecea94827dbb705e83dad1
- MD5 eccc551411ade52f5a6a3ecd58cf941f
- SHA1 84978d2345f0adff632d4b62f67d7225dd531a24
- SHA512 6dc88b5378a6a86575b4ee87c5ca2e932ab6705bd8765fa9c758cf95f4a0fd2aab5b0b71a0b9c3d6e040df43f26214700f6f1f0ccbaeee88e5044678946b9821
- SSDEEP 384:C86kQx3XemLsg/UP3EJABSt3+QbdiDc3DMqcZamJbSPzDCFyQa9aOWs6t6pQbrm0:C8TOXz2P3Ek2+yiD6Mqclb8AYahbaIv
- TLSH T1B6E2C618A7E49A28E3FF4FBA647252048730F1524D53DB4E1BC590DE18327A6DA35FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\botkiller plugins\BotKiller\obj\Debug\BotKiller.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/BotSpeaker.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 99f26d9fef61b33ec76b1ade8e43b936b474a98e9a0bb07a6231d4a5b6117e1a
- MD5 e92c3d2caeee8c9e14398dbbf4b83be3
- SHA1 5ec14e150ffc5c63988028b659f570e467e5048f
- SHA512 3724d74e9e71c9ae70e265bfb1d3d00e0b65367b7f3c9bad6dead7b22ba8670a39614c568faad9d245cfc9d1da147af093f6f870c56c9c55f1bd25c1e1196f20
- SSDEEP 192:nRlXXmgxQ8wbwlpaFuC+yYYJUT8kUD/4pHc2gPy57lL+ry0gOeMlvOvNRL:TXfQ7sp2Z+yYYJrkK/282giF6gbvNRL
- TLSH T13552B709EFC59B32DAA957BB45B28355CA34E5085C03DB1F7CCC21E5BC02BE92B611E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\BotSpeaker.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Camera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e7ea582bf54b9fa13ac9a9cf8f2e229c2f2a0c7d1d424f6ac5ec3c5a86aeeaf3
- MD5 199c91a495027b961a7ced3570aaca8f
- SHA1 38295ef49252a4394311be6bfb6fe63b4bf891f2
- SHA512 a6489d06a66b9d57c3e6f66a9be84176640cb85c41d433fbefb8fcd48e1805c0e500e7e05fd4fb6805f1124b5b252cada90157c18839431c354a86277bc7c1b9
- SSDEEP 3072:sCCQQCCc23F99bb99fLgUsOOMMOOQOfVkBmQEQIpZL+S+Y37ZkFJv:sCCQQCCcw99bb99fkpOOMMOOQONcpIpH
- TLSH T15CA34B9167B8C563D5AF57F5A0B74B164B70C207A603F7EB19B424F82CA37411E222EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Camera.pdb
mscoree
_CorDllMain
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0827b00c451238a219767da717d2680eca03aec01fdcf41959abec56d533b818
- MD5 33b894426caf363803827b5d0dedd458
- SHA1 91dde1283ed49e43ade2ee132cc3983e9ce35647
- SHA512 242146ae12c3a26a56ab3ec2a0048ab57e337b1423d2813a952f86d372393bd13e1738be57012216669d1765b38d15466dc59907427035c43b8cb92bce584d1a
- SSDEEP 768:LqVJNCa72NLlpjnGFsT+5asw+rBdNZTgM/Bc69e9D+ETzYwLgecg:+V2aWTiFw+LTc69iD9ztug
- TLSH T118230910B318CE3BD6BE0BFEB465126103B5D316BA43DBDA5DD5109CACDB3868A141EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21fcdba1a3975ca23dafc895218e40df6942096f9f16aeb317823f884d24859d
- MD5 b963b133122b2b96ee1a7a1d93dfbf30
- SHA1 97d2cd2262a508f77cbc9be60ae15f2dfedd8023
- SHA512 83bb7e93ab7247f122d747456f0657384d429e3109de576788880403f0a9195c4bf223ddcb199370ce8cbb1b0bb7f2f885f4b630f27c3762e57eb60b326a6546
- SSDEEP 192:0pR8sh0G3FrPpaHHS+r+g9kA8nH/4KNl6mMB7AZ2YFVvYCDdEbwr:HsJPp+y+rVkA8H/LGaLvYyEsr
- TLSH T1E652D905DBA45F31DADF95B794639349C734B1216843EB0F2CCC44E0BD5BBA82A326E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Clipboard.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ed36bf7a6b6509aa3efc0d4693eef7382e6148500054ba3c4dcfab302b7dec51
- MD5 c9f4f3dbb6c6bf0ebc776c2c1bbccd26
- SHA1 65b280f5cfeedaa5036d24601f4a44bd52094b65
- SHA512 d4971970aecc299656bbcc003c5856ee9c0f21995433e7a7e19ee1ea99b75281988bd1205cadf6d1f35a36ae4983f71e5f0d277d23501f0b51b92d4536cecabd
- SSDEEP 384:6N7IcTrT3d/c+I+c6kJ8ep/RI8SOglOpG:6dIcTXNk+I/6ep/5JG
- TLSH T1C4620B449FD0DA32D5F903FAD8B3A3898630E5045C03DF1F2DDC08E86C5B7A96AA15E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21434
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Clipper.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f6d8a19a87a76bc8b4dde820805739ddeb2f96a973045a925d583c26de00bbf8
- MD5 a8a4eed258b38bdcca7fcbca50ade082
- SHA1 f1bc39057239fd71a6f65ba0a7b43fccfb811cc8
- SHA512 3ab07e0cc63a168b149b91ef8d213f8a66b7475eb92502972aee030895c1b8d868ac67af49da757aec6fd8b9d7746e83b214bca9e64828913f5aa9f4bd9d9b9f
- SSDEEP 3072:yshGcFjKyO+bwqlWj/RxfZwqKHDgAwlr:NpHHXwl
- TLSH T1FCB3A314B3F04319F2B7177DF8F55116AA79F545FC32EB8E2469031E08A2B049986B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\DDos.pdb
mscoree
_CorDllMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Defender.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4b9a5bf7cc80b0ff4e128662f621212b9cd60943bfe0a06da34de98bc17acafa
- MD5 4753e3995f4f3dd3d604d5da0d1f8886
- SHA1 d94daa2c5e96835010dcea7c71d8b2236a068311
- SHA512 4b9203282ba9e501afa8aae7dbdf9be3d5670823d2e0b6f405feb6d40747c3b7f6f81536ca03874c23153689591bc2bb1e09f0092fdb66e4713077795f2f588b
- SSDEEP 384:n6nTkrWYcs3PfTjqXsjyL7HlyK+j6KbRGDEvFjVY9MSmwjVYu:6nTkNDCFIjDbuAZVtwjv
- TLSH T1C852E80853948A71D9BD57F964B397049378E7019803FB0F3AC980D5BC13FFE992A6A0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\Defender Plugins\MemReduct\obj\Debug\MemReduct.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 588be035077befc4eefc116a8294c5dffaf71406aad388a1bc65edc38c31ee8a
- MD5 52b0a2fe08c98617287fe6085e1d4429
- SHA1 a757e3c504bfb74a1abaf6e9fc41cf73c7714f93
- SHA512 29a928c0f13d4c9b09ccb545b02ca944dca75e94b62de58fb1574d221766e58062f853716fd1e02734d3dd46770c0c5e073998a0a426d6a7b51a3bb4351278b4
- SSDEEP 12288:PJqOo1aiGeJ0MRKI0xRtmHgmtI8pHuE4po8U5BAst:PJqOo1aizXRgxRtq5BA
- TLSH T1730529C6CE642F26DC0F6A7F74A2651382A1D0900345734B5BD117AE6ACB3A5CB1A7CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
803174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Desktop.pdb
mscoree
_CorDllMain
Name
.text
Size
776KB
Virtual Size
776KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/DeviceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 169018d37f3914fc3f4033c417024f9a20a31b508b5ca48aaa76b8fce3a3ee3d
- MD5 54e29e3ebc666cd190f4a38e35b62c0e
- SHA1 acc5bf1691d896fbe2863675c727fbbf075377ae
- SHA512 5301db98e5aac6e89b611d6cf8dda3b2a2f2070ab92c53a864dda0442d22104d32628381aba03604156930a36181cd8bc8b95899d3918861cfd8a41784e16126
- SSDEEP 384:Q5yzPdtmpq1+C/OkP/1ksinmOq/wWeaQD:Q5qt6y+2P/zqgQD
- TLSH T1D162C545EBD49B71C6EC42BB58B343998635FA456803EF0F3CC854E1FC12B9C6A216E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\DeviceManager.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/DisableUAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 705578a7933c7453d4e430739c7c18479eaea11e1fe092525a138d375c1e2e65
- MD5 fad270bef338f53cecc9e0d844042e3b
- SHA1 535c3aed21aecf070cc45292fea2bb917a85eff5
- SHA512 fd8505357cb14f4d8575e5a2da792d7e541b723868b4d0bd4befd9fa1e99128822819e8e06206b452e8d50aec2d631cd9f67c96a5f34f78ac289c4961be1e014
- SSDEEP 384:J2rpct3XdzNITmBKbRGD1U37Y9IBlYgjVp:MUXYmsbuy37nYgjH
- TLSH T1F672D70853D44B32DAFA1BB948B257459733A6015C37DB0E3AEC60D96F13BEAC961372
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\DisableUAC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/DriverManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 126fea7b7c9ce9c30b67fbeaf6388c68a67c426c84cbe411e13dba0e02db4b8c
- MD5 ef4adf4c5be0b61eb15bb0c6cac3efae
- SHA1 ca1385d3238a49abdb59efb70ec77248349d05f9
- SHA512 0fdf52d517a99dce8a59e9be555c461035d6ab0cd07068e69b1b224e0dc1ae23d685880572810f12d39543740e2cee0402c6d7b27798d8ce7756c492f0b9c3bb
- SSDEEP 384:mR/kqeyLApv/bv0Du8TmZJETDT5u6Rb89N2NGVMR:6/TeyLANTviu8mI9B9NGE
- TLSH T10582FA1877E88B36E8FD857F4DB343044370E5065963E70F3ED1B0C66D23B9A9A14AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24050
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Drive Mananger\DriverManager\obj\Debug\DriverManager.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/EventLog.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2dfe4c8d64b5130e7597491422b0b287c32a5d9239ae76e93b0a3a790a37c277
- MD5 7947af1c9e245b115a1f49bfa11a6786
- SHA1 64266b1a0eb03eb3a9536f050e4cf3108e945e58
- SHA512 6b361fe7ee4ee17adb72dcdefd5efbfcf645927cd750b5d529e2dae80574359713151b7364cadda6dda945b5a9c1204e2964fd392e29e893a77e910251ac5d31
- SSDEEP 384:D+00Pv8zyTj6XM3DMCgIdhKW9TGVnjVo:60kTjIQRgIdhKlVnjW
- TLSH T1A242C61897A4CB75C4F94AF918A397458338F2168803D74F3ECD61E67C92BEF8A61790
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\EventLog Source\Service\obj\Debug\EventLog.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Explorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 36fcc6ae1ef727bdd87fc9eda49459231c7d6e9fe8167adb01f9a5d63ff00483
- MD5 6b710265853aa59e53b57d1ee6865354
- SHA1 e728953fb7e3cb184277f6337f24b58452f9477a
- SHA512 9ee218cd38cc1153b936f2431c7d4ae2ef75ed2c4da9a7b6d688fc26e0e04d238fc0b17cfa747adabaae5f288baa280cbec289cdd91b7d73374576c2cb76ace6
- SSDEEP 6144:n4nSNHQs2dP5yGtSV41QJDsTDDtUMle6ZjxLV/m9HVJksDjJ5RIUGZ79:j8P5pS4YsVUCe65fm9EWTJGZ
- TLSH T128B48E006BD8CA5BF1EF67B6D0E39260CB71B423A97EEB4F5D8014EE1D1234099157AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
517294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Explorer.pdb
mscoree
_CorDllMain
Name
.text
Size
497KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5a97d34609133ce2af8943d8279d6f52de247b03ac13e411c47c69946fd090de
- MD5 1c22eba57fc17b09022cbcceb76432da
- SHA1 0521671fba70f565f428abcc2a4deeb6bccb62e9
- SHA512 8a6d6c98fa235c93defa806517743086bbd5ff2ec3ed0f601d683bd9b3cb339fcad60229878a24fa59b5612995305072fdb2b7be4f1ea68005a599fe7e422aca
- SSDEEP 384:FoZuGc6BX1PIphh+5P9U9rkdg/22nGMfpGHzdkX:FoZuDiXVQz+52adg/+McHzdkX
- TLSH T17D62E7087B81D730CAAE56BB9DA343454634E2099843DB0F6ED844E87C42BED5EB15EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/FullImageOpen.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9dc7ca1095aaa4d4b34800f3c4e772a8b36903ce552034d3433efc8773137f2e
- MD5 8d3816386797b45ec86dfd83d8863c7a
- SHA1 e208109e5bf3ef5de1c3450efad48a20d660d966
- SHA512 ea29889b25f0cc4ec2607a2db56afc827a1dbbbc97aab7dfabea1041592dca56c5397e1a028795442c52559fef24b408899a387434dca9136a4489e84ad549bc
- SSDEEP 384:sAA6RWM7beQBKkVRE+5MBn7ihDDD2EA7swCmLV5HK:b9beQ3b5Mp7iRwZCMLHK
- TLSH T1C882290853F68E24D9AA1AFE647357049330F6029843E70F2EE5B0F27D57BA685117F6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\FullImageOpen\FullImageOpen\obj\Debug\FullImageOpen.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1e012b9c9257d37b6286c063a675e8ff3c08f1e593fe656ee2ae4220a572e657
- MD5 f0238ffd4fd01245ceeb6d77871b99c8
- SHA1 22c18dd2ea0fb6cd0800fd089e47d8b195525a3e
- SHA512 7b5778b0f6b5db5d7aed3275c95bd7ebf9bc9702e29c34cca1ed3512fb8c1c667e65a464e6d489978c01ceef03a95f66ffa37e61aa2f7a5774889b3ee76eedd9
- SSDEEP 768:cOuda/hjNQIM75cUQG2hz0tqqqqqqqqqq+aId5Xp5pQmlgpSJw8XJjZjB0qGs7:cOia5miz0k7d5Xp5pxlOswgqs7
- TLSH T19E232B1377D98121DBBD07B5C072AB05C630F12A2413D74E1DCA65FA9BA67C98B20BDB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\soulleb_v1\Fun\obj\Release\net472\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/FunAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4ed4bb2cff65f33398bdb78695a01d38a3047b7f499704c198f1203ea5f70726
- MD5 daaa4a3efc9f8d7b32bf407ed32d218d
- SHA1 b46f3ba5e01ffd697b2e9db4a89b2b471cdd5a22
- SHA512 02b3216425d2727fbefadec7b8ab208eea8d067d89e2f422ed756519435f619504b96a1b15d3c72930cb081c9482653a8136a63d48af202b811e0234393ad936
- SSDEEP 384:CLhGyZeIq+pPctVcvLB+LDql3/4Vt5hBWAiS:CpStVcvLUhVFb
- TLSH T1EE620B0C93F24F20D6EA06FA955393445374F212D963FB0B2ED850E2BE127FA5802BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\FunAudio Plugins\FunAudio\obj\Debug\FunAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Go/Go20.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a9772da71d86e54b9941f58535d9c41319962eab045d3a6d6d907cdfd5754d7
- MD5 71042560ea91209f74facf8c482cd584
- SHA1 f91ba2377ebf86af4a2a2f12325269758d50b732
- SHA512 e872cc39a6552431273064c8b0daaafec019a4f568ba710eb645111344100dd4e1fd95cab7d72af67e1ca54df18310e463e4fd77f8ebec46857443a6a3025d4c
- SSDEEP 384:K+qOZ3vD9Mw7mBgb4PDKIGCXyBU9LWqVjVm:aOBm2bM5irqVjU
- TLSH T1D162E7085364CBB6C9ED86BA18B303449370E2425913EB0E7ED9A0DA7C13BFB8515AB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Golang Installer\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Go/Go21.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1083401944dd5adceaf750b8cd3a07615310530b27fa937e23751cd12984c9c6
- MD5 1f5bece6e52ca4ce9ca2e78625481047
- SHA1 ef70ec95c32dfb41b030bd41bb8fe632b919e897
- SHA512 d8272aa93fa9674bbf6614e74c493cc1be4f114e1d77d9bb74947278169160d605892da201eaf06677a1574522966b65ab2c91299e4848c77febbc9dcc1e36ef
- SSDEEP 384:g+qOZ3vD9Mw7mBgb4PDKIkC5IBU9LWqVjVY:MOBm2bM5YrqVju
- TLSH T12A62E71857A48BB6C8ED86BA58B303449370E3425903EB0E7ED9A0D97C13BFB8515AB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Golang Installer\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Go/Go22.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d44493ad6841b1386537ddc4435eeea32b355ea4eb563b8b8f90fffabb86c519
- MD5 7c4522f23b738a65552c112dd4720f34
- SHA1 ed2b66fd113b87de5ad3872b78ee77e1e14abe4c
- SHA512 a8f885b1e917de97a3fea3cacd9262d35ed3ebf6e3494cd012685dd538900bcda41e32e210ce03ca94b9154504c14dcec9546b7366d725d6639527c2b7731a81
- SSDEEP 384:c+qOZ3vD9Mw7mBgb4PDKICCboBU9LWqVjVW:YOBm2bM5krqVjk
- TLSH T1DC62E70853A48BB6C9ED86BA58B303449370E2415913EB0E7FD9A0D97C13BFB8525AB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Golang Installer\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Go/Go23.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d5f9da60f871b1a1dddd867cb2fb6914ed59d81b9f656587b4b8d20b6e4ce0a6
- MD5 f55c971c49caf3cfacef47688627f7fb
- SHA1 c955abcd996bd3cd0a03d3b21de37b6ddc5749b6
- SHA512 a214cd77ba86212a7fe9b33c63b7c5249ab2806d3ecfbd0f24162486f278d9e7e949e46d98cbfd657b6e916892012b219273dd47302cfbf6b585da9f86a684a2
- SSDEEP 384:4+q6Z3vz9Mw7mBgb4PDKILJQpBU9LWqVjVI:k6Rm2bM5aXrqVja
- TLSH T19562081853548BB6C9ED86BA58B303449370E2025D03EB0E7FD9A0DA7C13BFB4525EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Golang Installer\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Go/Go24.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0075ab8786244474807e53f1dffe1a248c36f5b7278f8bb910d228bda293d259
- MD5 b8e1c3c84f2576cc8d687a8db6d05980
- SHA1 eb947dd823f6cc6f8fde21199886f82d04476cab
- SHA512 970738ba8afacd4b46da1e935e9aff000d6a5f540c0af178c94f21e10ddd65dbf0c4c1c92ef23cb32b9f5ed9d1aa959ae5c05ed895233ff07a0a4a69a5958c71
- SSDEEP 384:5+qOZ3vD9Mw7mBgb4PDKImC3qBU9LWqVjVC:3OBm2bM5arqVjQ
- TLSH T15D62E71857648BB6C8ED86BA18B303849370E3415903EB0E7ED9A0DA7C13BFB4525EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Golang Installer\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Go/Go25.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0aeb5c90cdd6ae27dc9d3d67a912c0e601ad8dc4f248a86fc886597ee02f1a47
- MD5 95fcf18b6f458c3b55f86c0583dfa694
- SHA1 da270f07b7199b5bc3ed696bb9ec0ef1f0f1f9e6
- SHA512 e9adee5f66ef07ad17ced17bbdfc3d1113553d338d36cc3d74ac4fb42180e2538152fe24e65d8691ad58b6ac2b96e45ca5df0a7b3c4072403b7fa0569ed8126f
- SSDEEP 384:C+q6Z3vz9Mw7mBgb4PDKIgeIBU9LWqVjVf:y6Rm2bM50rqVjJ
- TLSH T11762F71857648BB6C9ED86BE58B303449370E2025903EB0E7FD9A0DA7C13BFB8515EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Golang Installer\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f53a8a1aaab6b3e6857e697ea56fbc120ebddaf8f7164e479291623f516fa2a2
- MD5 ad44430fb77f6392e8cd51fea4ca8555
- SHA1 93eae8c1d22b11f4808ffe69f90b183bc2f9731a
- SHA512 3a007b9ca5c6bb88c41e9629e9b6c7ee025dfe6dbb3017cf8b127e00710c4f584730bfce6225b91d6acdbbffa4b40daa959723225c76699c3b4b48ef2b7b2855
- SSDEEP 768:N8FLqw2GASgtmcyvfLczodbwX3nPyxHZ1BmcPVVjj:NcLN2GANgvfIzodbwnn22CB
- TLSH T1CD133B44ABF95A20E5FF8A79847397649334F1431903D70F2AC521E86A77BCAC611FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\HVNC Plugins\HVNC\obj\Debug\HVNC.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/HiddenRdp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4fde9b5abd26216ed994cf317eecea76dce312a2e8e0b2defe72825d758ebf48
- MD5 d0e00af5c28697493a3ee58018f7354f
- SHA1 dcaa8e31f17cf3086a4cf0972df40f46d7bafab4
- SHA512 d9833786aa87f507fb19de588881f3bb1ca1afdf19d9a98576722016055b125f039beec48c00b0b48420f1695a18275d50faff79bf233312a9d303c807bdcc34
- SSDEEP 12288:LgbyhbNaAaZN+zmix6X5BIzGx2R/7J/HIZwjQ1wnhjz2In+:LgbMJBaZN+zmix6X5B1x2R/t/HkwjQw/
- TLSH T1D3E41886B3B118F1D256813A875BC233EA73BFF00635C3263594CA1B5B562A15E2FF52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
710874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\HiddenRdp Plugins\HiddenRdp\obj\Debug\HiddenRdp.pdb
mscoree
_CorDllMain
Name
.text
Size
686KB
Virtual Size
686KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/HostsFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 90d274e007a29ed44b7eed48103beee0ca8fdb0685e7e5d006a6da4786326643
- MD5 fd3d43bdf206a286dbe3f42b98739ddf
- SHA1 5509d427bc890802227142ae7d08ba1e5fc6c553
- SHA512 54158dfade76900e9b7dfa9cfd3bcc1245ef97beb64b5deeb9c483617354d458cfecbffffa53b78c446aa9715a94b726330283537c1d7d6389cd315d2a7143c2
- SSDEEP 192:oxy4Ny7DBrrbFv+4paDwC+v17Pk5D8JLA/4o/Lw0g44RAPlCO2l9:l4g7DBHLpql+v17PkF8Js/1TNgXRQE
- TLSH T112520A08DB954B32CAEA4BBB5463934A8638F505AC43DF0F7DC440E5BD077AD5E222DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\HostsFile.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/HzGenerator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b3e569e584698fea0f619f5df69b0f437d146e67f2ab076525524bc9a3ea7d58
- MD5 d91c1c74fdcbab427d35f6189d52e63c
- SHA1 6f72e6e80b52dee576116b9ddc4215602ac0540b
- SHA512 67154e22bc2fbcb3c33149e05491eb18411b6fe404d2c648fe66d5f1051597d1f1f4f795e87b6a3c7ac433e88b74e5ac047402d946114326bc6b3a5fcb4e3935
- SSDEEP 6144:dSY1aeUmsl0v2q+wSldMVT2dJVHuVpaEUiHYLT1biiAezOfK+pGF+cbsWfd36l:lrUBlJ/X20JiHYL5RAez4KeMtZ6l
- TLSH T184B45B243BE49913E57F53B9E8F1051197B1F446B617E30F16E0A6A92DB37A2CC40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
528778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\HzGeneraotr Plugins\HzGenerator\obj\Debug\HzGenerator.pdb
mscoree
_CorDllMain
Name
.text
Size
511KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Injector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b3c14f744a14f865f340ecf2d084a97935ac2a04a7c157864cf8bf650115546
- MD5 e274ec36b4366a95d6b47f88f589e1e4
- SHA1 e9f9e33f47dfcd9593d04bd54386893b0c84b5ef
- SHA512 d5360ed74e7652a30d29265ab09f4798b448dcd168d2f1e4f2e90de4a7343aa75bd939742427f28ed19141751097788eb4a00ffc0d12f58ca321c1819fa1588f
- SSDEEP 768:f++WUCSr/j67GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeKP:m+WfSry4nsycq2yWvYAHAdDlyytP
- TLSH T1A1333A64B398DA33CFE94B7A40B70F08537462565D42DF3B2DC0B0966E22A96CB53F91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\11111\Injector\obj\Debug\Injector.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Java/Java17.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e9be4f2fddbfbc50c0a04da826bb54eb541557c496a895db909751e4f00d710
- MD5 c85ed09e3a7599eecbfb94f48140fcd6
- SHA1 7adf2d76ef21f8dfe027a1b90cea68d06b1e31cd
- SHA512 ce3adba9bf7d6484152d60dd42d4017f5a31f8cd45f18700320f79e36be095cdd1e825b57630d7aa6470cabc4b106f5192302958552ca8046e3f3a7e795f68b3
- SSDEEP 384:thQydhJHSJsB+aFbDPDKq1dHXwxWqAjVn:/QQHHmsXFbPH1hXzqAjF
- TLSH T190621A08A7904B35C8FE27FF98B397459734E6018C03EF1A7AD6A0D87D52BF94910BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\prida\OneDrive\Desktop\plugin1231\obj\Debug\net40\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Java/Java21.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 82f7758cb62a6922e8d8d76f7488de1c91104d0effeab21cbfd993485df5c6b9
- MD5 7a805d4e28a6c6259aec66ac90ba5c37
- SHA1 300a449bc083758707faa1d52aadb9690b879a3b
- SHA512 2f8bd0c2d84e19d54baa3f745b1e9cd7f9a5b29466ef7e00a333cb74f24ef3621c2ece5bce6d9564b1e9046a85768c44b3dab6ad1956aab58162d3a3f5ac3bcc
- SSDEEP 384:jhnyEhJHSJsB+aFbDPDKqxuHwxWqAjVL:dnxHHmsXFbPHxEzqAj1
- TLSH T17D620908A7904B35C8FE17BF98A393459734E6018D03EF2A7ED6A0D97D52BF94910AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\prida\OneDrive\Desktop\plugin1231\obj\Debug\net40\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Java/Java8.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a95ff3e64c0a5144b44a7f106bebf562b8abd8cf6ada0d6a1fb7eccf1c40ae6
- MD5 970bc8dcfbb4fa4e03dbaa82f64e9f85
- SHA1 faa0a03ea868e2c7ae093001389d7b0c020d8580
- SHA512 2fca0d78aede24ab4fb66c75e94703f5b1650203c622532b95b573580bb6b2ab1bad1579e7898cc40c77d4cb2d235f4a673f295c0507f224e558e1c3f656fa78
- SSDEEP 384:TyY6GILxT96dnsmB+aFbnPDKFv9V1M9M2gjjVU:f6rRmXFbrCvb1Mgjja
- TLSH T195620B0417E08B35D8BA76BA98776788D734E2016C23DB0F2BD560977C43FEF45226A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Java Installer Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/KeyLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 77a6a9daec54344f9f5c81b05fa35e6ba499cbe8181759a3efac048ec8c9c05f
- MD5 01ae5ce56ed8e1ffc8bc61e1f67eaa11
- SHA1 9e395c1a35539d3a82568f67559795387c62e5f7
- SHA512 d7188635ef5102527feb6ef1e87d8ed5ba2f4ca861a42fe8ae4a2c7011cb393062ef859f3c4d4ffe639d9d1cccc14efdda7dd9977a9fa26dc3eaadb6db1b231a
- SSDEEP 384:hPdRa6BDsKBFwXcrI+B+TnOAeR/LQXmmwxp9hn00HcUUk:DRHBwKocc+B/5/Dm4o08UD
- TLSH T15282294867D4673BEA9D53B7A4734306A734E2017C03CB0E3CE904A46C46BF56A627DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\KeyLogger.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/KeyLoggerPanel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3cea86492713de8a34d519780a7f9dd17e9a7ce0caa4f443bd29b4a56c8a4f3c
- MD5 3a8df0d6da2dd403bca16f99cdd8024f
- SHA1 e48e0a58d2d918442b58ca604227f46ebf2e8d36
- SHA512 25972c8150b7a3c83fcc0f395f93fe1ae3d106b8daa74d39d3d838e7234e5d37a33b9e03220687840c1db722e0869828b94c46e140110d95a34f6cd3f5f5deee
- SSDEEP 192:zpm0OZNpbyJunOqaltJpaDBE+mFTk5sopp/4obTOLSs3lf5fKKvp:tc/byUO3Jpqa+mFTke0p/1HOz3lfb
- TLSH T1BE520904EBD04B71D9AD56BB95A3838AC634E1062C03EB5F2CD441E4FC4A7EC6E716D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\KeyLoggerPanel.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/KeyLoggerRemover.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d9068e16f405a4e04b996bf4661df60e2df1c5d7c7beaf1133e0e04b58b5a61
- MD5 4bc4ff7f6cbff0ae048360fa98e53b3f
- SHA1 8835e7fd3c79a37e3ec91fafdb205aa9c9254b0b
- SHA512 c56eb9472a3c73965209e79ffa91acc03b0a1e1890c98c79754c4d31e774f1aa71228b6bce5abfca0dc8478c1b0582b12d0f5647fdce921981a95ae53f86a89b
- SSDEEP 96:MPK3+wVn3Nf+725gMy/4Fk5m6nKEHM4Zpid3DrKwh:MO+S3Ng22My/4+5s6nTiRig
- TLSH T16CC19812B7D85732EC628B32CCB353514574F7A8AC53CB6F28D4420BFC255598672FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\KeyLoggerRemover.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Leb128.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0c0133676813eab3ae24b4f135383f13d95862be7ae9526b4dcd7ff11ac31cd1
- MD5 5b02eb01a43b4bf0a4d78b04e091273d
- SHA1 f71165ac901e3333df7e6e1e222300f207e695ad
- SHA512 bdae2b852fcdf52405ebc981a5420998582ef27ff4df71650ab84d7c42c5520b4bb773969c24c799605ef5d1e5a49dff56274f56c355f145420f935ac8a2f816
- SSDEEP 96:rNdKLsS4+U27l9DdMZ65/4Ek5lxNO2IVh8//5dTHtDeIFozF:0sA7HDj/4t5lx7qEvTH8IFE
- TLSH T1F0E1C502B7E84332F47A8B389CB293405B3AF68198A3CF6F1DC4415E6C367158734BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Leb128.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fbf285599bbe3a4e8b0675f66a7a2e3ad335a79510d37fc2de20520d4892654a
- MD5 4d4c8c845059cbeeed92fa29b646c90a
- SHA1 42865d1266351654d5cb7dd31c8fd63cefbacb9c
- SHA512 0c715363ac042ba9a222c8fc37da22d7d6836df4b247f15f0ce8b9a9c9ed159fc236ece71156b3e0642dabaa70b7f4adfc6d4edc797527d9794afa4d6bdfa311
- SSDEEP 384:dJtLXhKakwSxpvMJmmBi0+t6mds99GkjVT:xheTrmGU6/kj5
- TLSH T11F62E90867789B32D5F656FA58A757449339F3024903DB0F3AD860E1FC02BEF5931AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\liberiumSRC\Map Plugin\Map\obj\Debug\Map.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/MemReduct.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e20737aa8ae98811429a35bd00139125afda91de9777135edcb068946b889502
- MD5 ba4ca1405641b32d60562a6ab9164f95
- SHA1 9d4195139256ec8a447aa807de428572cbc220d2
- SHA512 af75ea40ba39d180b5fe94dae9833142da830acb10ddcbe8537095133e1226131edaec6dade128bf7f52a5ec2ccc8ed83adeebd1fa924cddcf43658d1356bb3b
- SSDEEP 192:GTKBTyrtorXqKR0OvWgdvUql7YPF5yQynUYoVmBvK3ygElJ2Bv9jcXm0jVuf:GTKAngdNl7athmBy3DElJOv9gXm0jVO
- TLSH T11F52E74C53648F31C6E557BA58A38B149378A3125D13EB0F3EE460E4BE57BEE8531AA0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\MedReduct Plugins\MemReduct\obj\Debug\MemReduct.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dd7f624a43598a2700b9e2b3b518cdbb9e6b72a396b4e4ac0035c73e1395e660
- MD5 1894d2fc9b36e80e2bf1c6a05d2c05d8
- SHA1 b6e6433c3d935561f06d80684b44b2afef533bae
- SHA512 3e1069462a236570231ebc2724d985308f2b2a854d45aa5b9f041c2c6075955701d37fda6498f698b645db4e203bb5d5ee064dac043ad44f0ec58de5c876de48
- SSDEEP 6144:bJrr8vmnEA5XvPZW/7wPS9rUVXcTksUo9FvQGNAZpXqcdjwjoF2phUJMiSF1:bJP8v0XjP4UVX2k5QDegiwjRUJlSF
- TLSH T19AB46C217BE09D27C16F33B3F4E20E2747B5E589B657EB8B448016A92DC37529E107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
527282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Microphone.pdb
mscoree
_CorDllMain
Name
.text
Size
507KB
Virtual Size
507KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/MinerEtc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6c210d18feb20339a4758213374022542676c81fd138ccb2d0c59447847344a2
- MD5 bcf1676fd9a463ec482da555fb3e0913
- SHA1 fa106b89b2f5e7867528bdc43f5c3f50dd1ad64b
- SHA512 c6d2eca65c17d81129349c223ce89b795c4d84797629eee9665cdd618d724c229db92df9d7d317012200b22e5cfdce63a9a8cc43dfc871b7bc79cb29b75823a6
- SSDEEP 384:uCXdbUGngLXIY6xmWQDVE9hnd6k0ZLvDB6MFzDs/Klykm6PivII4A4d03lLFlq:3IZYtm1Gz+r6/hjDvIIKmpi
- TLSH T174B228007FA9E3B1D6EC47F394B347094B75F0065802EB4E1CD820F92DA7BD896626E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30466
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\MinerEtc.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/MinerRigel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9220f75122b9de44ddf33bdfbe389d3067ec8d00a16b9b139718e5614b06add3
- MD5 a79b3eb83af787c67331428423f2b4f2
- SHA1 718b391be5066c65749b64201339bb07e153eecb
- SHA512 9a005e3e17c82a0958358812a3e15cd15ab266f2bdb9f81c71d445d7e64723ec4027d14b3f977a18b9c355d1074e6ed1cb735532561a969789962b417914026a
- SSDEEP 384:EhudgZf7rfP0W7f916dJkgC7azDHL6ncHDB5B/8lTNFhMG3H+am8jDQe0wlXlRB:ER7LMi97gvHZJ/EJeaDMxy5
- TLSH T185A24A04BFC55332D2EE57B6447353068AB5F1069C03DB0F2CD930E96D6AB9C96127EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\MinerRigel.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/MinerXMR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 79626818686e00d6f296f0229f5dfba401175264b119b27405ffdd46d1142156
- MD5 d68e0d69320ac333c0a25a9d32c4d4b7
- SHA1 d5a57773e6e2d191d4a57ce6ba14bbd49d275209
- SHA512 fbeca295f011615cd7ad8d7d30b91f45bfcb7e9b92b2e138673c6ecd7f4185a98b2558f90838ced1f638d850ab71881bd1e981d960b0fceda868644c47d17b04
- SSDEEP 384:rZ2dJIu+8Wzy+YlxmffwDvehwd6k0zLvDBiMtDy/flykmXSld4kYlypAm/miGwKZ:OROyznmwjdmr8/Ajc4plAAbi5KEY
- TLSH T119C25A047FE9A222D2FE47FAA4B357194735F0932903DB0F1CC420E42E577D899516EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32530
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\MinerXMR.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Net/Net5.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27dd7b6968f3daf6cdd07e71e488fb5bde344ece01921d354326f0b6a8af7d09
- MD5 4d614b020dfa968682ab97255055d3a4
- SHA1 1846ee273c6c06e6270726af5bd0ff1d82c915a5
- SHA512 077a2bba420a4f266d032ee2b8979a00d7c73276b91220428bd6392ebe17b39049de7b9854a63bff4a523a6a6570fbb7dd9841ced2774fc0261ab98c29682acf
- SSDEEP 384:VV8/NIYqkUddl1mB+aFbnPDKFwHIM9H2g8jVW:VW/KkOXmXFbrCwHIPg8jY
- TLSH T14B621A0457E08B75D8BA66BA487767899730D3016C13DB0F3BD560867893FFF89216A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetFramework plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Net/Net6.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b961baa5e86b6ed4d41ba1c41206410443c8d8fe31dbe96afb81c6f17fba4915
- MD5 f475ee5d8b1b463f56ba897b3d4be800
- SHA1 d0ccc47e0a0115632f04f8c108ac133a57903cb6
- SHA512 4daa56dda707981a71f8afe18cb8092e3587d5e457f97bbf3b12e4c739c1cba78680fe8d5c8ca712be54fa935dbd098cf352456f6c813cb290cc19e4ed2d85e4
- SSDEEP 384:WNE/NIYKkUddl1mB+aFbnPDKFwaIM9H2g8jVP:Wm/qkOXmXFbrCwaIPg8jV
- TLSH T193621A0057E08B71D8AA66BA88776749A730E3016C13DB0F3FD560967C93FEF89316A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetFramework plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Net/Net7.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d57189cf53107aac1d515f20dbd95dfcc527d1341f2849af4b15cae5dbf4a3f7
- MD5 f3d960da463bd0cd3e8ffc3c7d2733c6
- SHA1 3c9f8a42b42186fc4f1d1d77ad24ce5915fb89f6
- SHA512 e79d77020e07255c3adb48ea0c6740188d7fdedfe6ba18771563cf8c13551459be0a9799136cc216a7e633d73989083cd44e805fe8ffaf2112d373cf06adfbf8
- SSDEEP 384:jNE/NIYKkUddl1mB+aFbnPDKFwKIM9H2g8jVH:jm/qkOXmXFbrCwKIPg8jx
- TLSH T163621B0457E08B71D8AA66BA88776749A730E3016C13DB0F3FD560967C93FEF89216A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetFramework plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Net/Net8.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 01aebdec2f2934694a9c185d904285220160fab063de39b14aa125c9e506d7a7
- MD5 6fcaeaa1876e5c5711b0ac83401ba3cb
- SHA1 e9609b5b86fd12e6c4f714cbeb0efdc959787da9
- SHA512 237cfb23246912f49aef80373d3ea7916331d9bb204cdc5930c01962337ce6a3b4cae0e34e359b28b7bcbfeaf8c327a63768dd9417c0b103fc32aff817263aa3
- SSDEEP 384:dLy/NIYkkUddl1mB+aFbnPDKFwUIM9H2g8jVw:d+/EkOXmXFbrCwUIPg8ja
- TLSH T1D2621B0057E08B75D8AA66BA887767499730E3026C13DB0F3FD560967C93BFF89316A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetFramework plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore10.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 52bcbe5f823f76e5ba25ccd8fdab6f9128fcada65b0b044d2c6a9e107dbb06f4
- MD5 af5acbbc8bad2d5ce37ee2be4c81e56e
- SHA1 9f1e38b77ae8855aadf78f642d20184a5f58138c
- SHA512 2df7fa77e7e67be2651feeeb1a4b4abd4b00750f68c8200913d854f51dffe21d2c24a0219771ffaab3c804b25a1743d601ff9a1c0d61055751fb5a788204d50b
- SSDEEP 384:dyb6GILUT96d3smB+aFbnPDKFwt1M9M2gjjVK:u6kBmXFbrCwt1Mgjjs
- TLSH T13462FB0457E08B35D8AA66BA58B76789D730E201AC13DB0F3BD560977C83BEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 058fc4e87d466027fdaad9794429829b5c3a0888f8ec57dcb01bdad09370d2c5
- MD5 86bed66614b48d300b37e9602ec47c3f
- SHA1 c6ab4fd28a6f9ca2d5d6310f24817cf64d0ba963
- SHA512 399f14d37272348444daef3814a268cb043d78cfcf82bb62e5810ff32c4ea9d0d5a89311554e1d07bb6cebe7a87177783ad8e304705a6aa4df46438b87921969
- SSDEEP 384:Vy16GILeT96d3smB+aFbnPDKFwX1M9M2gjjVi:86GBmXFbrCwX1Mgjjk
- TLSH T1C562FB0457E08B35D8BA66BA98776788D730E201AC13DB0F2BD560977C93BEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6589cba12f5e3e9aa3d346d028ca57b55bee39b6a59607e642542b6a0012b7e
- MD5 c93e70c628afba25b907d0205cf93245
- SHA1 b579d4f5648fcdf93b9f1e319eb8130379665c62
- SHA512 597b8d55434266b5ca5f41a47e29628bb90bdba04427dd87336232b4bccbec82b7799fc7a254705dad5174de1770457a594bb88757022c8a2449be16c5fa3879
- SSDEEP 384:Sy16GILeT96d3smB+aFbnPDKFwc1M9M2gjjV2:j6GBmXFbrCwc1Mgjj8
- TLSH T11762FB0417E08B35D8B966BA98776789D730E201AC13DB0F2BD5609B7C93FEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore5.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5cdfd0270d2d91d8c3cf683a01ae5b044e6b3275ecdfaa50a7a316c16ade14e8
- MD5 d15136cc7bae0b505dedfc1899a188c2
- SHA1 0e821097e0e424101f439e112edf8b4b8c0c6927
- SHA512 2d3ddbf709da0816642c2ef6a7f2491f44443aebf90e56a0bbde7e9dda02d75d1ba74efb27f9bb65c118205c9502eb496fa5f2dec59ffed7eccd5bbcfd820016
- SSDEEP 384:Dy16GILeT96d3smB+aFbnPDKFwQ1M9M2gjjVQ:O6GBmXFbrCwQ1MgjjK
- TLSH T1D062FB0017E08B35D9B966BA98776789D730E201AC13DB0F2BD5609B7C83FEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore6.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a98388f09db8ba5ad70fbc712ffa50838812eebb3751feaeafaab9861f9bd2c
- MD5 d669b0e02115e1e5eb84de1260efcc8a
- SHA1 b183e82857b73dafc6eb10f54c1e4faa20ec7b70
- SHA512 67ef99c3ccb0c824ed0fca0a9be54195cce9a24cbaf27023128a93a0ae6bccf105edf027cfef51405ed716e28ec84e1982d1a2c05fced070936341a430d89a51
- SSDEEP 384:sy16GILeT96d3smB+aFbnPDKFw91M9M2gjjVC:B6GBmXFbrCw91Mgjj8
- TLSH T1E9620B0417E08B35D8B966BA98776789D730E201AC13DB0F2BD560977C93FEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore7.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d87c402140d1d1114853afae29fba03c5462ee5e78db8405dc231e2e60a1c4c
- MD5 00995d3f3fdf3bfbac04b883548c013f
- SHA1 40d2e8e553af515ccc48192d263c4297a46fdf0a
- SHA512 a7dd06facc45a5cfa2831b63725aadea29dba8e5870c6d7f29985f4456311c822d99b56f04693815da197a9de1c0e771a29bf27cdb1d044f7753d7ea4e4fbb55
- SSDEEP 384:Dy16GILeT96d3smB+aFbnPDKFwU1M9M2gjjVV:O6GBmXFbrCwU1Mgjjr
- TLSH T1F862FA0417E08B35D8B966BA98776789D730E201AC13DB0F2BD5609B7C93BEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore8.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9b1e3f27f447952f256174b88cf61178088ef02629bb223815d478107bf6068e
- MD5 73755c9de02ef37ae42f0b310083e4a6
- SHA1 9c29a7ae450c73cf585b41bc807a3963a55c81a5
- SHA512 e8ef2f2f6beca978bd8552fb3c85df527570c254cf9a1981c828ba2def53ac77eca54a42675d29c864eb181f5a3c5ee3334641260183d2211b78b4a9e382dea6
- SSDEEP 384:My16GILeT96d3smB+aFbnPDKFwV1M9M2gjjVz:h6GBmXFbrCwV1Mgjjl
- TLSH T1DE620B0457E08B35D8AD66BA98776788D730E201AC13DB0F2FD560967C93BEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/NetCore/NetCore9.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 24906cee67ce8d3b512080f3275eec1e7dcf41040e4345851ca9717ad9832743
- MD5 83f2a756339d389331a6e773109f67f1
- SHA1 357e85f42989c4aeec91b7fbb1376c41d625dc85
- SHA512 3f8e7e0ab16fccbf838087338f631758efbb894b1372e9e065cbd47a982628ce8d7a688f093d00affbb522dd3678493aa7af7a6503c1c30a1b5ccb96723a94c2
- SSDEEP 384:qy16GILeT96d3smB+aFbnPDKFwi1M9M2gjjVPD:b6GBmXFbrCwi1MgjjJ
- TLSH T1C0620C0017E08735D8BD66BA98776789D734E201AC13DB0F2BD560977C93BEF85217A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\NetCore Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a612850482a5c1ad078d515a38f3599d0a35bf2fdbd78a9f09848a3b13f77e7d
- MD5 ab8ebf841ac311b108c4f212249eed0b
- SHA1 31edf09db5049ed837340cb2ec33288d4844e882
- SHA512 d3988cde833f150e87dd2c6ae25b71711f2ab281df6f92f73c10073806225a06f8cd4ce30e78cabd1630b65d2d55a1c5154b77c304a89b201ac8ee620d1c8c81
- SSDEEP 384:GkDhKPyc9LHkpidA9p9+k+Qbh5kE/1TGFBqlyyYm:fnUHkMduB+/E/cPqPYm
- TLSH T11A8229085BC5CB75E5BE46BB74A353198B38E2265C03EF1F28D814E1BD177EC1A142DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Notepad.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac6266366686ba153bd6d0fbbe0c16425f8cec8945bf9caa5438e07ee65dd6e8
- MD5 97f8aed7d7a8d406dc07481066805c14
- SHA1 af8359f32db998dc5910770f1df38970f27f2637
- SHA512 56caba5db0d5b366120b2cc7536d7542e64632c25bb1bea6769b3d975ef3eb34adbd8fad5e1d4cb7eb581ad377aefae066428eb5a37198d7defbfe5514b9b5e3
- SSDEEP 192:1ylNyZM/5XlTY7cpaDPS+fvk5D8cN/4ofrw0M0vGaGk:4lgZ+953pq6+fvkF8q/1TNpGk
- TLSH T16A52E804DB954B32DADE86FBA462534A8738F6056C83DF0F69C404D4FD07BB95B212E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Notepad.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee578211b0ce27f739ed6e5ce1825626d8d0fc377fcd4ed8855ee89fea0d00f6
- MD5 4f2591e6511dbc31f7a113d18871ab61
- SHA1 f145762c106e3b829103437585fd4b6965b36cf7
- SHA512 cb0fa82d5f2d9f04f32370efb759263be43c7106f27d886417dd86d5723c00885f78f95a1bfa8a77e1846f70dbb4e639b2d098eceda2273d02bf0df0210fdf89
- SSDEEP 384:aM3ysBpHQ+GmkylVpt7j/1fGVNx/wqvtpbh3:qYw+8Y/AVNx/rbF
- TLSH T11A62B508AFA98A31D9B916FB98B387094634B5059803DB0F6CDC18F0BC57BE97B506D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Performance.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Piano.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a069df41f810f00030f5d6f59e1cdc8852847363dd46c5fe76f25fe7bf99c61
- MD5 ad8c46fc5b22db4c52d76e834bd0a5ef
- SHA1 42c3eb9208d80f81917f29ede865b7d2c9c77fb2
- SHA512 6e007cc6901f03c0d999756400487700abfda69c9d34b0bb61d6242e239cf776398b77cd720b408664db4dac280cbc70f8ef79e8dfa6ad43a7932573d7d0d44a
- SSDEEP 384:NtMubuWb2TS4z22222222222NXNXb4j60ODE3gZ29I1mTbT:Yc2uO22222222222N9L4j6agZeTH
- TLSH T16C52FA0C57948BB2D9F646B958A357849334D2026803FB0F3FD9A0D5BD46BFF86616E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Piano Plugin\Piano\obj\Debug\Piano.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0609db119532a3220d64151bca92fc9c616fc468aa590ed0e970d6c0c6135d01
- MD5 e7b23085a42fa10222cbb9118b4de32e
- SHA1 dc2929910f9da83d10244a87b145ad6e14119fd7
- SHA512 8faaf89d997cab59917327a963ca2b08b391155720c225fb075928b7f40a8f15ef432ba50cec0e1cef522a62ab5fd9f2ebcb9832eab6be15bdcc36c1a9529fa2
- SSDEEP 384:m3d1Vy9EAyg0tGC6pJV+Kh/hdNbk/W0X3/gfGI6uFm+/n:mTw9EAy3tOP+ky9/nP0t
- TLSH T1F2721905AFC4C331C5ED06B6686353464AB1F20A8C03E71F2ED890F17E527EDAE621DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Process.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04fa5054e1260a13dbbf1f56cf614d07fc4f8e8e0eee1f5ad533590720307c3b
- MD5 4568f832e32e65e1b81e4892a9eeb6b6
- SHA1 59c29096f6751168c9872eb4f8cdbdb3d4c3e7bc
- SHA512 a737d34204ae4df2bfe90e3a7999d929fb6851ca87a572ce13f4369dd18703ae61db48953c1d24a39c1b982c81e973200990da73e64b32de6e822213467142b5
- SSDEEP 384:p+6nLsYHNcpmGQ+zL7u7kLPL96/7s2NsMz6R8hH8:p+jzQ+/LM/XNppq
- TLSH T13172280CAF94C231CAEA56BF9463478C83B4D5458C42CB0F2DC194E57D127E9AA636FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Programs.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python10.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8af46d1f43df438490f94210c9c152194e4593856a6dad20f1879b3e3142974
- MD5 118709e8b78811e1f948c2063ca7438b
- SHA1 11e2ac895323f8794ea75bae589e43ef2e5e1b6c
- SHA512 5b336f92cb123181940e14d1d79be8c8a3ec4acad2ddd199a6e032d72711181d8102ec419d3ed6818658cf5097a66509fc95881792d40a6f37870ae91d0e1a80
- SSDEEP 192:qtzBF2k8cYHKgtECS+kESm+OwnY5KTVcNrTsKDbGjmBIbCKMygKojbnx69QjVmYF:O5+NRUxmBIbRMDKoHx69QjVOYI6
- TLSH T121521A0CA7904B35C5FA1BF958B357058334A342DD03EB1F6AD590EC7903BBF9A266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python11.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58bfe79d9a9ea0f001369936ea5532f9a5163fe3e406fe8a841057ab3bf43d7e
- MD5 d2d988b22470484284e5e12de2b20e58
- SHA1 486271cc53bf70bee5e5b47c8b620d79f86b75a8
- SHA512 55db189aec2ed9932b5cc9704303544cab0c26042b7dd10dcb5783b407c36dec0a793858aef85f56dcab7fb3e72e1e562291cb61a0bd09336adbae0f9a01b9b5
- SSDEEP 192:ZtzBF2k8cYHKgtECS+kESm+OwnY5KTVcNrTsKDbGjmBIbCKMygKoj+nx69QjVmYF:p5+NRUxmBIbRMDKoGx69QjVOYI6
- TLSH T159521A0CA7904B35C5FA1BF958B357058334A342DD03EB1F6AD590EC7903BBF9A266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python12.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b118ef1462d61ca97a66d4f892265a182b60452ab8448d1306dda0fc5c4d0394
- MD5 d3d2e464670917f63ef65a2021af4923
- SHA1 329da90edbce448692a289c743bc0297b50ac152
- SHA512 2c3347074ceb01941298d42019c8a77299057c4de61231ac68742107a576fe269dcb94f3f037c2b9318531a8997c03fec33ca4345529179465286a535e7e7400
- SSDEEP 192:btzBF2k8cYHKgtECS+kESm+OwnY5KTVcNrTsKDbGjmBIbCKMygKoj6nx69QjVmYF:L5+NRUxmBIbRMDKoyx69QjVOYI6
- TLSH T104521A0CA7904B35C5FA1BF958B357058334A342DD03EB1F6AD590EC7903BBF9A266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python13.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2563dbd4538581b7ad2b4e8c39a23888da4c6602b069241c829c0278e297d5bc
- MD5 ca80fe3cae99c21136e74210089fdb82
- SHA1 d2c4a1cf1494cda726b77234e249fba978628701
- SHA512 abc3014f3bf219ef84595a984c1a1df3928d3e5c83c6615a7d065f04c9b46dbe4ae202bd1157faed69bc6e6a649814d34279b71dcbd173f914c9860bf5ad6ec6
- SSDEEP 192:gtzBF2k8cYHKgtECS+kESm+OwnY5KTVcNrTsKDbGjmBIbCKMygKoj5nx69QjVmYF:k5+NRUxmBIbRMDKoxx69QjVOYI6
- TLSH T13D521A0CA7904B35C5FA1BF958B357058334A342DD03EB1F6AD590EC7903BBF9A266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python13_5.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97f11cb6081f1cb4bb112914773a81070cd95f429a0b1f9bcbe91e20c14369b7
- MD5 bfceb2021bf99d165d973f64cc29ddef
- SHA1 d99c8562b3ec5451d2f18d56cc44f220ec6b0e2e
- SHA512 14472b78f2d67f26a466da75a168a63ccabf3f7a4a255837df428097d9611fa32b755f58d52a216096be54f8538883a7add86cc7c90d7d76fe83b89022828a73
- SSDEEP 192:EtzBF2k8cYHKgtECS+kESm+OwnY5KTVcNrTsKDbGjmBIbCKMygKojanx69QjVmYF:Q5+NRUxmBIbRMDKoqx69QjVOYI6
- TLSH T1D0521A0CA7904B35C5FA1BF958B357058334A342DD03EB1F6AD590EC7903BBF9A266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python13_9.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ceab22771409ddde15bd4ab8ad26c81b74d9b69ccb305b7d8c5cc79703a427b2
- MD5 ad4905082413ed4b8e537b5f40ff9ce1
- SHA1 b943cb4dcaf66efc2bbce01c38ae6b06b573ba1d
- SHA512 f4645876e2950f8d24e0f1781bbd81881bd44a69cee14c9cb6d413b1b78255753de2524616ab790d174c95636109766e7ee8aea3a6386b6b8edeafb8728f22c1
- SSDEEP 192:YtzBF2k8cYHKgtECS+kESm+OwnY5KTVcNrTsKDbGjmBIbCKMygKojGnx69QjVmYF:85+NRUxmBIbRMDKoux69QjVOYI6
- TLSH T1DD52090CA7904B35C5FA1BF958B357058334A342DD03EB1F6AD590EC7903BBF9A266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python14.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 64bbd2f518dbbb528acdcd9c4d9eb016e43577d76e1a3985fe7e82795bbb51d8
- MD5 9964f089b98129f416b8005c801764fd
- SHA1 890074599b7eb6c19f1fb50722cd9ba0910afeb4
- SHA512 98e5bcb2adccf1a25a817bc343cd64c8f2b07694216cfd6c2a90251ddb1c48741a97dba47c03ac9aad03d256aac5fcb7f40e01e8bec4a0505ad83c22def02def
- SSDEEP 384:K2suRpERuwBLnjd2v1mBIbRPDKIzsi4zA9M2gjjVB:Q8QuwBLnjdQmibd5A/zAgjjj
- TLSH T18362FA486794CB32D9AA1AFE98B39705E374E2015D03DF0B2BD6A0997C03BEF59146A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Python installer plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Python/Python9.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ed0cc2f90f986215dc9fbbe5a5d93e6176ef97ae663d0987de5fb85e8692fbf
- MD5 8bd51751bf2ace9dc52dbaffe4f873be
- SHA1 eb3d5e9b5d9ddc2205315e85898dd822292a5882
- SHA512 698a168f06cad8e84ca86da9e200ff447fffd29ac845eba295306df2c9cd22c25e409aaae0442e60bf95984ffcc22e4bad2400db415309bdc25c02ac4f778778
- SSDEEP 192:VlzBf2Z8cYHKgtECS+kESm+OwnY5KTV0NrTsKDbGjmBIbCKMygKojAernx69QjVZ:Ve+NRUpmBIbRMDKo9x69QjVOYIi
- TLSH T16C52190CA7904B35C5FA1BF958B353058334A342DD03EB1F6AD590EC6903BBF9B266A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 11308871506ffb337e3f4b0a399ff9dc2a7074387c32fb053480d3969bb44c8f
- MD5 89e22cbd496f2b507ead5395cbea06fa
- SHA1 465868bd6455466479097cc172766d62b046e7e6
- SHA512 67d5d0ca2dfae216f6099d1002bda642defa59c85816828570d1de0bd2c7bde4206f5d3bf5caa6019ade5b15193be040b785ec9757580812e8173c81ab32670c
- SSDEEP 384:zmo6Xc3UszkIVZzwEQB3ApJ9p7YNsgZBmqk+VehvFM1V3OnW+Z//rffEHBMRfFnR:pJtztxQNATi+aef/KM+ZQ
- TLSH T16FE20A056BE5C336F2EE17B95CB153084B71FD8A6D22DB0F3D8810E59D227E4A5243EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/ReportWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3525d8807cd6a9b1d106629673efc77f9fabf14b5039351ae8c27795081fdf6f
- MD5 48209033f33ffb6fea8e38b79ffb3085
- SHA1 1101b82f030e726ac399d5d8cd14e13dbc7f2e86
- SHA512 6062b808fb08e1987ee927699a542d5574e90594ab13fd72a77c27ee5300e22b64a49123e343424758cffeca2e2ff2a5ed097e07e3dee9639c07d992b7deeb13
- SSDEEP 192:6fSuE+qmAVQyjpRRpas5eZ+QQLkxzw/4oJS7GP7JBCGNA:6f1E+t8QyDRpHc+QQLklw/1JgGjjC6A
- TLSH T13F52E600EB865F32CADC13BB84A387568B34A5056843EF1F6DD840F5FC677E956222E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\ReportWindow.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 663384c98a50f9f8f09f159248d2a71f5dd1863fc03abe1879d01468348329d8
- MD5 ce238ce6910f3bfcdc822776c44541d9
- SHA1 d8ba1cc136b454aa26f65382ffe775c032acd63c
- SHA512 f005af60274c193f8d000e263a3a37d6483ae2f999859692d7005e9baa94e1a6ec72ad0a337c9becf25883b92dd4ea2e358f71163260f349d9abaf0b485e1667
- SSDEEP 384:4bnaSmAO5sTscXwbbEE3auvPKV3vPmW+Ar4Bag0t/+Iw+zHWK/eaXdC:4bnaSLO5sGxQGW+BEbt/f5/eaXdC
- TLSH T14B62C708FFD4D633C5BC07FBA86183098734A15D9842DB9F5DED88E46D037A46A9278A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/ReverseProxyR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ecc8e3d0f89b792ced877b5bcf2d9a740748a16954c487a47a54485d40214cea
- MD5 e05f20394f556bd4ad887f2e8cec7611
- SHA1 f7a9f37a06c4a9687779c7c5644760b6f21ffab0
- SHA512 3c751b16604305858425d127b6b5a39b2f7ffc33e46cce024e7bf3da013fe18a3046cf362d4785f2fa9f2212d5b771b21bb13875db392dbaa7861e63dea20a85
- SSDEEP 384:AgdJYiO39HYZ4dgAPYLlmjzYWBty4/KODQZQqfstfOe3c:AgdJqt4Z4dQMjHX/jDQZ9stme3c
- TLSH T140622C01BF988632C7FA4BB2986783048334D1496C42DF0F6DED60D1AD13BE99A953DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21298
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\ReverseProxyR.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Screamer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d2a0bbce77c06a26bb62d8b6bb13b9aa47f421f58cc3364dfaa88773a793435
- MD5 e23a3e039254afa5d69581f85f85be28
- SHA1 e30a0a084f465000748f92966beb4fbb6b29546b
- SHA512 0c135db9a69376f9a2c0e2da01362cfbdd1be0dba913502839de5a03eefd3a6a6eec41a0f15aaf50ca8b9fc1fefe1c019cb365ee4e785ff20c1c852fc7c5d358
- SSDEEP 98304:D/eMWWrYPRj1zhkAI0CbNvoZlfGxQvRJpUI0+O2/VOu8XTbl5jrfwLyf/yGGlGeg:U5PlFhkJbNvoEQvRJ+I0+O2Uu8tNR6G0
- TLSH T1BA46122BC60A0B1DE439DB76AB8CE5782C21B4C08D6825551177DD6C81B6BCBDEC3B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5480322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Leb18Dec\Screamer\Screamer\Screamer\obj\Debug\Screamer.pdb
mscoree
_CorDllMain
Name
.text
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 316173212eb5bd02fe1ee0a1b24ec8371447d33b1bc487796423b19035c12980
- MD5 d76ce3cb3df05107ed04f7cb71f9374a
- SHA1 234c3df4dd476b55bed8120214e4d7d497a14ccc
- SHA512 101ad7e6f1469b0d23affe4e7f79a9b3a20731f53b8945b5fd3887d9ca6fd93266014a4343625325fb19990541244240d8bf7f360111115f19dd1122d516d958
- SSDEEP 384:3AgXCmS3TMCVD2eXx77W03SkLVFfUho5MZX/gCQzSl16CaRllVZkiKRGfQIQJ938:3AXmS3vaeXDnMh7/wzSl16CasV93S7
- TLSH T11CB21805FBE56A72C4BE83B6A8B346415E30F1136803CB0F7D9850A87D5B79C9A313D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e2a90d8d0755f80c3a323a23aca11c7a0eb4671a0a28bdb1ab6f670183d4f6c
- MD5 aaf2fe5964b4530be13bb87416fda91b
- SHA1 6759ab81f779472990fdaf97f483cabe4da64bc8
- SHA512 ab9cd0e496efcc1314dbfb04862800f4297b8ac726acdd5396cb544adcc2d0e9100e7cef795c12d26a38f1d032cf5e88b6532f54ee7b2cb300e54ae2bf2de21c
- SSDEEP 192:XVGJqZuB9O8MA0paseE++4dkjNz2/4pvsTyYhPau2C+0/V:XEAunqpfN++4dkjZ2/2EfhQCv
- TLSH T1F462D609EBD16A73D5E943F7946397889634A1016843EF0F2DC854F0FC46BDD6A222E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Service.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ba4d5a68bc41d752ac1ae34ada85b6d36f97fac9cb1f63cec21f5d8ec5b1d99
- MD5 5292e1bd355d17ce9aaa3dd9e99db3ee
- SHA1 f0d17af5fea4b39f292fbb9eadf2152a588d8eea
- SHA512 be5b7906f381212a7fd60fe40b2b0c1be33bb652236c87a32be56882682a3f514ec249280aa58f56e8c9fc9c71c2f6139e80e4b88d9486c10d94c81cd498ac02
- SSDEEP 384:OgnL2Z5rpq/v+vL7vpkFJPEtZY/gqS2gTOXD:rnLIVav+6DP/9gYD
- TLSH T1DE72F70CAFC95B36C6EE16BF587287058274E2415843DF0FACD521E8AC47BAD5E122DE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Shell.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Sound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 023a203da0a6c8912ae0137583e990de8a35019c341cbe0f6d733e988ab7ccab
- MD5 e2edcb652925a989278a63e263f863ce
- SHA1 a2430073d640d0423239a622e198ef24b25481d4
- SHA512 dd5718bf5543126d59e71042e62e7c30584535ac27c439fed8f69664071eb39b8a1d696da5c4b0681bfc680d1fe605baa778cf7f19a5558b0a58cd0affa43abc
- SSDEEP 384:Be6KqJ/d7cKTraWbm5OzRwSYBDqs8ydaOB78lWn:BVdYyTBRwPCOTBj
- TLSH T166821904A3F48E35D9BE47FF1573DB158374F2139913EB0B6AC820962E627A74D01BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\liberiumSRC\Sounds Plugin\Sound\Sound\obj\Debug\Sound.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Sounds.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 023a203da0a6c8912ae0137583e990de8a35019c341cbe0f6d733e988ab7ccab
- MD5 e2edcb652925a989278a63e263f863ce
- SHA1 a2430073d640d0423239a622e198ef24b25481d4
- SHA512 dd5718bf5543126d59e71042e62e7c30584535ac27c439fed8f69664071eb39b8a1d696da5c4b0681bfc680d1fe605baa778cf7f19a5558b0a58cd0affa43abc
- SSDEEP 384:Be6KqJ/d7cKTraWbm5OzRwSYBDqs8ydaOB78lWn:BVdYyTBRwPCOTBj
- TLSH T166821904A3F48E35D9BE47FF1573DB158374F2139913EB0B6AC820962E627A74D01BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\liberiumSRC\Sounds Plugin\Sound\Sound\obj\Debug\Sound.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e7b81e3ba2b46b37a7baf5d301c8b2f24a8d8dda29a4f56afcaa7d7dee5f3e75
- MD5 153b3bf2a327f759054c0093a1798e2f
- SHA1 a364be228f8caafdddcb2a803d1c776741d9090e
- SHA512 0781e6d5f76417bd69095e9ba030fa7f1a3db6fd6cf73eea9976236d2fd9f4476306bdd83b5854cb4205365185c8c0b3e29d6e7f64f5271191bd65d5e0015a51
- SSDEEP 3072:gP4RXLv8xck6045Wrk7OOTS4qyJDYn7N6jB/fKfpNRPxR:BSySYJu
- TLSH T176F3175C37E88E10E6FF4AB9D87151108636F863AD32D31F568960AD1F33B588958FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
163910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Stealer Plugins\liberium Stealer\Stealer\obj\Debug\Stealer.pdb
mscoree
_CorDllMain
Name
.text
Size
155KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Stealer2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81f788ae4ac2f529d0010079fe4462e459e0c2c01ae86320b6a3f526ca980215
- MD5 968527707321e694f86a2811b9976e66
- SHA1 01c624db159f7507e2a7f0b22188966ffb6e4935
- SHA512 1118a014f1d7a6942e51fe22e8b03e69c95c36eb9fc4ba6d5b2e3ab384e61f3901e027785201ce90dffe3901403d716915beda5e4b76b56230bc976b60980e19
- SSDEEP 3072:lw3jlmJOkCZOVtVTZGTpS7FHojXBmDyh6frO1pD3ejP82:SjOhZGTpSRkRmH
- TLSH T129F3E61827A88A21F7BE8EBA943E01054370F17759B2EF0B56F354E52E227B59704ED3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
167538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Salsa Stealer\Stealer1\obj\Debug\Stealer1.pdb
mscoree
_CorDllMain
Name
.text
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Stealer3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 530efd1e48d92ded2ea35a69393c58b407cfd02005f450ceeb274913899b9888
- MD5 513df38def92eeaa4f1834f391c6451d
- SHA1 f03f9a69ece3b2dc16dcb7a9ed9820a81a762913
- SHA512 f512be340de5e232cd75932d9e510901b9d5a1d16b6d9cbf1cb963390f6ee5a82ca1a5f70130ecb79469c96623b7faa4948b3d0e4fa5cadbfa77694e0e476add
- SSDEEP 3072:GGFMnljzzfYWA7f+4w2ig4J+l2ulCJCUuyr925D0o34oirKHpR5QG4RbNp1:zenlfrY/Vt3CzDuuXrKHJCn
- TLSH T14D442A2837F89A24F2FF4B7A98745280577AF9239912E30D1D9160DC2E32B45DD68F63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
264802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Intelis Stealer\Stealerv37\obj\Debug\Stealerv37.pdb
mscoree
_CorDllMain
Name
.text
Size
256KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Stealer4.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3188bafbd26473a86cb75ce0264864706a57a1ab8e1a895db69774b79d81aa73
- MD5 1cb8ea00e95bcf1a8d5e9388be22d8c4
- SHA1 99383e76cb6e105c33cd3717680714cfe3358a15
- SHA512 07a8c680f5eb8d911dfc72d2cd1d1d94daac048e1726f68700e792b2b91de724e009e7e3f405156a30e41f23a11842d9dbdae6278ddddfa3a48c1524ce7d08f5
- SSDEEP 3072:iSCKnkP+HLE6f4EWkG//Xep89dELib0In:rCKkcLw9GOb
- TLSH T199D32A583BE98A06F2FF8AF1E8B611548B35F4676973D71E59CC20EC0722F849904B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
146330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Stealer.pdb
mscoree
_CorDllMain
Name
.text
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/StealthSaver.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f4a99b3ffb6133631a972dffc74b8e848023255d17a4d080ac6ccad8cb48c443
- MD5 882aabbc0ad5353a352dd4d4a7bd4a3b
- SHA1 655a141a67242ef059e23ff543be3d968dc85c7d
- SHA512 0341b2ebcc186111fcc9e78d344d6f6843aed1dfc62728990224db5e8a4c9c5dbde264a53becfcdf10ec38a4400c7efb856de57a47c1bceaa042c347aa8e577f
- SSDEEP 384:KrPEzsCR4EHj5aOrpOkl5mZzzbD/DFQy3EvC2gIL:KrPBEHj5aOtfmdbHeFgIL
- TLSH T1596209089BE18B36E6FE0FBA5CB347058334E6115D13D70F3DCC60A96913BAF4911AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\StealthSaver plugins\StealthSaver\obj\Debug\StealthSaver.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/SteamGuardBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f46e6c5f6f2fa8eff8a1da63cefad0b05a68e808a6215943aa41557869be18b
- MD5 e9c678e8dc71f63613e1307e47c9f250
- SHA1 c1981853f79c1ad308e6f8dffdafe7f2a2da975e
- SHA512 2f2a1e96d831dc203dcfdda7815f5e5a88d9a9c61903aa63bb04e927f072eb55bbd1ac1bcf43da1ed3439d2d5964fffe0d72579adc52fc23f04995d8048e41b7
- SSDEEP 3072:+EmVJ3l93ThNSHoNOOIyEFpnLRyi3ThNSHoNOq3ThNSHoNOj:+ESvVfTiyEFpnLRymfTHfT
- TLSH T1A8B3BFA4BB340128C2B6993C55670398633C4962ACA3CB0977F7756DE8C7BB759043EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Steam Guard Plugins\SteamGuardBypass\obj\Debug\SteamGuardBypass.pdb
mscoree
_CorDllMain
Name
.text
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/SysPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3784cbb4597cbb2e3234ff6b382b4b009b24adc746373f78ed8bf0aa070f5f09
- MD5 203a42b9de3a5a4ec6090cc0867abb0c
- SHA1 5a72a7099688fe543cbc04ac710ad7a57caaf6cf
- SHA512 b78725cdc59909067fa99cc771844d60878cb07de60691537f937626bf14cf266821b21d48ad90fad9de7df99b3892355b626bb6a5edc5297002ea10b3b929cd
- SSDEEP 384:Cl4bFgJiyh1BpqOu+7lpA8m4/17NsZyOglpQe:Cl47y73nu+PLm4/jsYOgye
- TLSH T1E252F905EB906F32C99D47FB94A3974A4A38E1092C43DF2F2CC504D4FC477A966227DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/SystemSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e3ed04003cdfc313ad3dc1598a210a68beea96e9e481c500c17cddb9dfb4bcf0
- MD5 ffc9c26dfb116f55f652647ce5d6e3fe
- SHA1 90b3d174589c3ca62ac1896532d00e8b64ce2728
- SHA512 fb6f7f3996ba0ffe1bb5b811b4b330c02b4928dbd7eaf79ac69a695b4bc7820a81acb449c56386204281a05fb22bff6b30c7c1f173233a73ec63b79f432bade4
- SSDEEP 12288:tcqWBkcFRKUUm7Tvk0eQsRXlNQ3ezrGWOK:aBk6RKUUmk0eFR1NuTWO
- TLSH T126B45C517FE49D2BD06F33F2E4F20A1757B5E589B696FB8B14800AA81C937864D10BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
525114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\SystemSound.pdb
mscoree
_CorDllMain
Name
.text
Size
505KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/UAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 714d23f8f199b8c2e077e2d547a001efde891317ec69b675abc89b7245ffe89f
- MD5 cd0fa1ab39934d01815f7fea03fa99ec
- SHA1 14ccff1e9fe2f61b07cfe0548d87e05a0731a846
- SHA512 c87aef6a77e47ff14d8334ef97bdc6003d584f15be9e738d770efcd80c0e9113403b2053232ccfb1afc8b320988600c77c9ad72c8a417ee74f7f2bf4409ad475
- SSDEEP 768:ka6+W/YMgwJYyuBb/+e8u1aungAqqdjl:765HxyPb5N7ngAqI
- TLSH T188D2094567E48A34D9FF8EBE587306048331B2424D23E70F1FD640952D63BEACA65FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\Uac\UAC\obj\Debug\UAC.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2005.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a8ad14da374ec96b503d416cd380021dbc13bc4dad2a5668d9417b6f0bca121
- MD5 b31a28e63ddb3b26fac4c4d74902dd39
- SHA1 7a81436605a87fb6110c22031835ae70592d5441
- SHA512 05ef4dce17bf1de7b88a00acc58ee55780629de35c43cdb31a9830cf27990d8e8622ccde50ea12d6640dbf6dbf6ac43d90adb4d8065b43af2d771d9ef8fc1c2a
- SSDEEP 384:e6h4/NIYGkUddl1mB+aFbnPDKFwlIM9H2g8jVFw:ta/mkOXmXFbrCwlIPg8jw
- TLSH T137620A0057E08B75D4AA66BA88776789D730E301AC13DB0F3FD560966C93BEF89316A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2008.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54f41cb94ac1255562f9afba89a23c13baaeba2c05edebdcd05db86e155da024
- MD5 951ffdc80007ba6991f71734919ae192
- SHA1 85d9bd1b5d1a83336b5ac7530535c77ec9320c02
- SHA512 1f02aab49b4bc4a6bafcb573e71b1dbd8de4e1b95a47dd5ec804c818dd094f4a5c2c2175d14eff07506e8a12ce64d488833058a083ba5d4930f2d34d3e15663a
- SSDEEP 384:Y5Q/NIYXkUddl1mB+aFbnPDKFw6IM9H2g8jVV5:Ya/3kOXmXFbrCw6IPg8jp
- TLSH T135620A0057E08B75D4AA66BE48776789E730E201AC13DB0F3FD560967C53BEF89316A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2010.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 965bc51bc8479fb79d772b9d7eed715d99520b925799cc01a9bb86fccaecec6d
- MD5 54fa263f5f16b0d1f0bda84799f97b28
- SHA1 2d33d21326d2a93371443133f691ccd271d29fa7
- SHA512 90a495bb33d7686ee8a728a4ce33cc17dbd2d2c1ede9a04fc94101ead3aaa9e7d463462b5100f968d89ad34095216c5d0e8e85036207ea5f2b084a1051e9a79d
- SSDEEP 384:45Q/NIYXkUddl1mB+aFbnPDKFwBIM9H2g8jVQ:4a/3kOXmXFbrCwBIPg8jy
- TLSH T15F620A0057E08B75D8AA66BA48B76749A730E2016C13DB0F3FD560967C93BFF89316A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2012.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 278a69bfb3a0b0186d7d4a723f273264b9cace35e77cd8ee1c44d5a95f7bf372
- MD5 c279c64145ee49ebdcc47469ce7fe4cb
- SHA1 672f2984f4fa1ecc8473c7473687b0634ca83fc5
- SHA512 86b60ce9fa2d320c3995d6cb138a1f5c666110196b8d9439d65a11bfaa113761860ff88f84f88d3f184fadc11681322e5d8737c8c0471e6b98839c05db1c602a
- SSDEEP 384:YN8/NIYmkUddl1mB+aFbnPDKFwbIM9H2g8jVw:Yy/GkOXmXFbrCwbIPg8j6
- TLSH T19562FA0057E08B75D8AA66BE48776745A730A3026C13DB0F3FD560966C93BFF89317A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2013.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a0d7b1556e8576027ad6c8dacce8e17453f4dbb6c788cae02087dfd4d225a340
- MD5 90f99fd3164d8e062d33f03e04f007a0
- SHA1 27bf27da1216e94bd579ee8ba54ece99e3bb7a34
- SHA512 b63d723fe6bc6ac17e03342b155404556dd2905bb9257f0d68f30593a631daef522e286c6d7a5676f3a30771f0c34fdc0152f09fc27309571372490264880a83
- SSDEEP 384:15g/NIY6kUddl1mB+aFbnPDKFw4eIM9H2g8jVf:1G/akOXmXFbrCwPIPg8jl
- TLSH T1A5621A0457E08B75D8BA66BA887767499730E3016C13DB0F3FD460967C93BEF89326A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2015.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 55f8bb88e9228d67b32c0ab13f3eabe285ebf0e0ca694f24845e06248762fef8
- MD5 da15c2a72c0952bb7da3bf48e3431921
- SHA1 40ef09929e3430f59801d955c41e8f19d0dfb85d
- SHA512 c913fc5962a23a8251e738881a5d663762135b9a7bee0a9a209f1ed65ed1379c94dc01bfb0a00e98b772f727fbe800fbd83cb6c3cf8a72f0e1e44a6b1980b847
- SSDEEP 384:ZPG/NIYMkUddl1mB+aFbnPDKFwkIM9H2g8jV1:ZO/skOXmXFbrCwkIPg8jj
- TLSH T1B6621B1057E08B75D8BA66BA487767899730E3016C13DB0F3FD5608A7C93BEF89316A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/VC/VC2026.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b0aeeb4f84f95ebc43ff15a41416022412a63043b9b30d309f61407d150e5813
- MD5 c6a49d502951ed0ae5e83e1d24420726
- SHA1 bbffd52d31acf893ddc98e171e7c0275486229dc
- SHA512 f83e90ebb65fe67a5b84d8d6b61c9aab1f1e2ba7ab7f0876e77b3f73198147788247ed3bf51aea9a661f4afea9ec8cddc7fb8ab455e5de3acba25be7e78f26df
- SSDEEP 384:Yxo/NIYrkUddl1mB+aFbnPDKFwkIM9H2g8jVsYf:Ya/LkOXmXFbrCwkIPg8jff
- TLSH T14E620A0457E08B71D8BA66BE88B76749D730E201BC13DB0F3BD160966C93BEF8931661
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\VC Plugins\SysPlug\obj\Debug\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Volume.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf1d82759453af352c1387a089a243319f06b7bb7b2101d077327afc2635ab5c
- MD5 a6110836d624dd55c26829a95855953b
- SHA1 332a07f6eafa7cfe2e65146c479bce8547a98e54
- SHA512 dc837955156f06ca71135f5f96065038d14e38ee1ee40320f3cb39fbd48688cca24c6180344dbc29d3cf93b5c444907eb988d08a4488d42292e8fd30390eaa00
- SSDEEP 12288:rrjKsSrv7c0it6zJOdFIWk8+Ph1PcQDpfVfo:fWsSrv7c0it6zJOdFIW/+Ph1EQDpfd
- TLSH T172B46C11BBE09E1BC06F23B6E4F20F274BB1E2867656EB8F448456E82D837925C117D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
520178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Volume.pdb
mscoree
_CorDllMain
Name
.text
Size
500KB
Virtual Size
500KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Wifi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0314fef9cf7e0925f345a86fdc01dc8d859841dcf29219aa022338eade0514c2
- MD5 87758625f6c81f3023bc792c6c4afdd8
- SHA1 dc92a2ee134055cf0e73f43bb4836125fa66ff29
- SHA512 9f6bbc4d3e4df99606a381f7f7e2642ba8c6061a9ead2e7b1c7b7ed13b7989f3a1fd41c9543f93b0879366d189c2638be795d6621c34fa24a4986d85e081c7f1
- SSDEEP 384:C33fidP99Z3bVIkp2EHBY+FmaKQ/SV+z0REB97X2RjVm:5dPprl2EHuJQ/f6Rjo
- TLSH T15A822B0867586A3AC8FD4AF554A36B548330D2039D03DB0F3AC830967C5BFDE6A617E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\matve\OneDrive\Рабочий стол\LiberiumSRC Premium\Wifi Source\Service\obj\Debug\Wifi.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Window.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f757b1a0633ddd8f8ed655a58890a5256f559c15f1c39d06efb7709947c2922
- MD5 4b989876c13b552ab050d24462fb8763
- SHA1 2c7c85db5ef9cca982d358390ee6842e310792f6
- SHA512 fb22008b4b2b33e94a0a35ad3f7707d06ab8a0535293adbfb11f38b8a2b4d237a7065fb4b59551b69fdebb931fde830aba4abc3592cf89851db17660111da854
- SSDEEP 384:inZkgo94os7VczpqFQ+3arWssiko/1v2cWvM8D2KNKs8888888888Oqm/hIG:inZkgYZsY9+fo/YcAM8D2K4DqOH
- TLSH T15A722A4E5BC99A76C6AD837BD0238709C770D2014853DB0FAEE864F46D123EAB9132DD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Window.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Plugin/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4b3b2e3b8f3605382d33235e2c9542d910fa80e8e606ec818019c288e3e8a20e
- MD5 786520b5fc56b659db0a9e2fffe0feac
- SHA1 4e9519b7f7fa648809025e7136ec5cd076f8527a
- SHA512 e54e82a092e94284a682109a3598e793029ea609fd604350d385297842bda43cffca76d87d45dfc4680f33ce54f185da52b1081bcc1fdd1225d6346304a0f939
- SSDEEP 24576:rrDXK8VRSzaywtGN0UE6r7SVtuVQchsPrq5nHsd0:XDi4tGcnrs
- TLSH T16AE5D5026EB89D3FD37A52FF90E1033416ACAC0792DAA706757CFE691C72A402BD1756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3165974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Server\bin\Release\Plugin\Worm.pdb
mscoree
_CorDllMain
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/RjControls.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ee6c31ab5c76286cc58c94fb11b00c8163bde35918ebb39cc6d4c3bfc62e36f
- MD5 889492bfc195bf189ef7649233da68af
- SHA1 0c1c83d6965340593e7607d86a2ae06f6cea4e51
- SHA512 52d5fae0544501a9359e0b420e31c3191d93a8ffd5aebbbe05c2a4191e417c0afe28be58b21957bf2265ebc186878c3f9be63a92043caf747ab4f071fb109b5e
- SSDEEP 768:YZrDUywW4PaIDWB15WYRnsb6IBhdaoej3Fc:kDUNxaIDsubf0jS
- TLSH T19EE20828A62C922FDBAF0FBDF44419A113F5C2703383D7E8AE85D17E6C93B454611267
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Libs\RjControls\obj\Release\RjControls.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Scripts/sigthief.exe
- IMPHASH ba5546933531fafa869b1f86a4e2a959
- SHA256 c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
- MD5 3e261becbfe12d7a5ffdbba91c76011b
- SHA1 2e5849aa0be921849f42121544895ce405fd9af1
- SHA512 02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
- SSDEEP 196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg
- TLSH T10A66335423410CFDED6A403BC8A1991EE6D4BC53A750C56B83D48BAF2F6B6E06DBB710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
42656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31937,
count=1, id=258, version=31937,
sigthief.pyc
- SHA256 ce721f5b11024398d7cd9dee3c09a8f0808ad47e41ddd8bad353915f5c4ba929
- MD5 bd259b78802e5d16e6e9270c24696abf
- SHA1 1450f17973f7226687d6bfde7b6a5de32b88d673
- SHA512 5170b410775c1ecbe80f333f598069858eeb0acddd0411c5a40c2945a85805ea6e6797690afb19d3c069e62bd11341c5cabb9f757c1c7fe409b4077c6b2173c8
- SSDEEP 192:EHmxQlq2qYEqG2myU2jNrvH9qN91HPJzRJuZs03i:EGxQY/YEqGqUKc5+s0y
- TLSH T15EE1544F8A522A91F9D6FBB0214D6D309960C2D713C81C1F2A06F21B1EEE5D8657F8ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Server.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c32140ac4397c99627b68c8d61c470c934548fe6dcc15716e590694e81015f75
- MD5 b9feb06860d77c1004c1e0bfaad3e836
- SHA1 5f5218d6ac475b77383ef0d9e3ebe6ee1aa8367e
- SHA512 ee551ba2c2f841ef7c6d63cdac027b8b7ff98a32cdc444e69ac344e671886bd26b55055a82ad860e1e45e87cc33816ae34563ca9c0de0ed330540b8336ab5993
- SSDEEP 49152:BzGna4ueJFkE/nnnnnnnaSusuKm3dSotvveReReHe/e:l3eJBifXAueReReHe/e
- TLSH T108C5390237A4361FD6FECBF11823285C43F5658F86DBA74DAAC911B809EDB15B64132B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2505542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\matve\Desktop\LiberiumSRC Premium\Server\obj\Release\Server.pdb
mscoree
_CorExeMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Server.exe.config
- SHA256 54563d7bd07fc9c2f2a9a85ea8ee2141a7ae29f86126c54fdeb7a32509483a15
- MD5 e98958636f20d7ff8e0c4ec5d33cea9c
- SHA1 410f8229218a5d615334f24fe6b6c3c23ba912f6
- SHA512 50097c18d0d2eedc2bbda62f059f7e56caa0562aa860323568f395e49db7b124143555665c1da00bcd6ded82b971fcde0cc0382f26d48ccdd357abdcdddd38f8
- TLSH T1A8418AB885CD8E7E05310983B975C480D7AD43E3E1960889B4DE25ABCBE7CC5221B363
- MD5 SHA1 SHA512 TLSH
Liberium premium 1.8/Server.pdb
- SHA256 9219758fa88111a267c43f68894864ba694769451b4029bf6f3aa705d309b828
- MD5 846e6a81fe8b5e190996908f124874a5
- SHA1 2e70afb21b3217a399c33433a0f43bc4839b06de
- SHA512 b1e1a342b67292ca268d3c161ac56de3bd68c6c83e56f0dcd766febda210b87f695c4dc88868482307d6fcd0a10994f7204e2d9e72aee6eff5b79d21be5de349
- SSDEEP 12288:g4qKrAo50hDPt4WmuFQaDnbBc4GeKlq51:xR50ZhmCHB9f
- TLSH T14075A117FA81CA72C4A5827817EB8F2D473CE9855F87978F5385A06EBDC27812F86344
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Server.vmp.exe.map
- SHA256 35cc283702a7e97c39e53a3b5f975d017873701c4630ba050f453ca7b463a3dc
- MD5 b2a651c1e8aec7ba5845e97e6f436e05
- SHA1 0a16e0122a07119e901d0fc745bb1e0cf89a7efb
- SHA512 0a48a36e651b67376e8a2d685c8d302ea7f972f04acdd3690c481d5dc4e4a275db7ec53eb58e4d6d844af3b77528c1735b60650f360a4d1bacf87444a53d003f
- SSDEEP 3072:IfWqakKE+Bo2/H22ezztZPokTI3UFuS1seLZ7bGDzbjY+AiVXRQ:IfWqLqCzXPNI4ugseLZ7bMUiVXRQ
- TLSH T1B504E6AA70A066F7DE47630DCFC90CBA4F914410537E69109D9D584E8E6EBA4C7FE30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/ServerCertificate.p12
- SHA256 b6c57e19ab088bfab51684019cab89e2bb928eff1903b976f54789cc6c003d4e
- MD5 a278724b53a258240f497b479dc6222f
- SHA1 fbd068880a0024d1c775a32a017cfed4c94c0976
- SHA512 7cb88d13b9eda19b88133c03fc1d4d284aca40e4e789185dc9e508f06f2d4e39fa7cb288174e114389e223366557beb76a73d254e1796d6d34d66a0a086c9d57
- SSDEEP 48:KDRVWYnbuRzz7O4dDRbu9eVbNtMRGCYbb5frORx1PS/kmKHH11/y9TjsQQS7VHxb:uizTRbBrMZefyPScB8TAQQQVRr3
- TLSH T16A917D574CF44127B9F2C5765B26174A1A0EEA346F74440723B252F90D6271A734C7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/Exodus.exe_sig
- SHA256 e9ffd546881ee3fc40721d466696fa1e01cb448ca157e2b452b8d1a9106b8b9e
- MD5 2d612df3cd9fac26761e61491af1df1c
- SHA1 31e10b0b22df297a59a96eb15dbd135653f8ff29
- SHA512 15544d52d39312194a28f1593fe656b8a51bdc57c87ffc3862ec0a5abe928a9428746484ff1cc8728e9930f96cb3cc66461b9cb547e523b7bff0b9379233aadf
- SSDEEP 96:BkfTd0PmfrrQG28cYG28CEjlH7xXmUbxJ/2F69lxQKclIC:B2IYiYF8LTX72SlxTcl/
- TLSH T1409118E78D601C04DD9F8D51BAD0D63AEE39798AA1C0C2D6711FD52893C87423B9D1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/FL64.exe_sig
- SHA256 190e518041da81a833b25c870cfc7108a9ffbd2c4e0668b8175dd0c3a4b341db
- MD5 51d35a4b24664bbc137e7dcc0be2b482
- SHA1 99ba986fdd04915fce6fecd16dc8655bab7d3f8c
- SHA512 a763cbc7acfc423818513a3a71ca03d9f4290505e6d621fa0b389c568c07281bd9d7bb474bcf60960535bc1a3df0223addceb749d163356877d11cef3c6a778a
- SSDEEP 96:qnTb6NDlkBlpHpi1IddvFFSNSRvrm+8GHrgDYb3JUfhdyEi7ZHeE5gfWVDUtl:YyDWpHEKdddFSNgvr78mrOYFBZHlqWWl
- TLSH T167E1B4AACA101C926D278D2131D4D92AAE30B7826795C5F7E52DD060DFC2BC336FC1AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/MarketApp.exe_sig
- SHA256 b37e2980ef13016e896ef69019deb85b24de37acc9685e267d8f7873ef0bbe0a
- MD5 aab8503526c3cbeb44a4a293bfe788f7
- SHA1 bbc5d1aaff6a3773953ca3155e059828f23c715a
- SHA512 2a5049168725b3ca6a9c93c605094ce2a0d2af62bad10449e451484b9581baa276046d5ff732c878f9e01a01ece98e6f419f709a562d61641e6fddef219dbdcd
- SSDEEP 768:Ir2uGTi3lKFKcMkOr2uGTisNKFKcMkKdpq:I2TuIri2ThIrEg
- TLSH T13FC24DD71A3E5143AF46CE8EE1C5A8177CB8E7C38CDE548AA02B475D29493C13B9C52D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/NVIDIA GeForce Experience.exe_sig
- SHA256 5fd46f771abd9e1761c086f18cedf14e468647c812aee29a5d998f303dec68be
- MD5 e47acaa12c4f0cfa30b3f1e03bce45f5
- SHA1 552742c374b7e033fd514b780d5b5cefa0abd8d6
- SHA512 ced27bd154391d28b91c4637ec5823e99f88a56e5d2cbc1d3f6c648c34ce432d1d7fca0bd2d8522b910ad6099a8bd738a1c207e56c093c68e74c8fe7024cb509
- SSDEEP 192:DIYiYF8ahU7DNDlQZYSsDO4NKzYJzkLRCji2j4WIzla33ob16l8g:DIYishuNcY7D9NEwi2jHF8g
- TLSH T189123BAB0AA41610EDCD5E4234D5D737BE75A7F17A8388E7602AC5B2DB013613B4837E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/NordVPN.exe_sig
- SHA256 b5a5c8a5178506d45c872bdc5eda0693acbba417e6ad20d7c8cb4c3ec2620f24
- MD5 1beabb526d63b32cb8ad63c9f97d5195
- SHA1 b5dd257cb0d3c2dc7d81f93b7ff7e052c503472e
- SHA512 fdd68f51269eb630cb65be3eea32131f82862ed4dc0328d25ad054170fe90650f501d86af11b04662a116132f83d00e3c344385f5aa2ecb1821eed14d635b018
- SSDEEP 384:JMQiY9/uo6ki2Qufi1zcoKiCUV1VF0hXHMGBk7/UMQ3hnZ:ur2Qua1z5CUV1VaXLkjmZ
- TLSH T14E62398B0E3E5943AF81CEDDA0C9D8577DB8A3C39CDD144BD01B862529083E27B8852D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/RGBFusion.exe_sig
- SHA256 013d3ada70bd382333e4189c05253adaf237b865330d9490a5bd799b7fb490ef
- MD5 6859d41071774651c4101ad98bf5b930
- SHA1 b6f75a67e4ecd4425d4bb4fe440886b0cb517afe
- SHA512 fc8c827b77148d6ece71600a9e93b4eb23e1ac53c234e2f2f2e39359890c60023b351ec521d70fe5f034b187cd8989fbb822304f9d1e55537e58e1c465d51369
- SSDEEP 192:6WWSVZPzmCeJ2UzZ0y2sE9jBFKWJfsHRq3XT:FVRmCu2Ut08E9VFK4ii
- TLSH T1B00239E74A543C03DD56DD8570DCA91A9E76B3C26DE084E3921EC2504B857433BED1AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/TLauncher.exe_sig
- SHA256 a49c24d12c4c6595cbd280b96e5c891debff50d99589da03e58b25e51ac01d2b
- MD5 f390420ad7e8846b6669e583264f179a
- SHA1 ead420d6fb1d0374d5272e8e174c743a8716e567
- SHA512 092983d02b7c54385909100493792f004d6f9c6e5b15aa8a89761523e1f93c4dbcbb96f5f938c61fcc4660e3f713ba57ae7537d5da02b4cb7453b2f73fb6b77a
- SSDEEP 384:v5pq6jAAUxzUHE99IblNOr5pq6jAAz/UHE99IbF8:v5pq/ZUHEPu2r5pq/YUHEPui
- TLSH T1628239E70E286363AED28E00A0DD5A395DF0AFD57A8750CFA528F72069D93F0384C59D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/TOTALCMD64.EXE_sig
- SHA256 b5272a567533beac74a4dde52a86232ddfda8648d6f9111f9472b955fc99ac68
- MD5 490889bec03862a33250a4d39f2d1f71
- SHA1 98fd6f74023d86a6b82ef91002ecd3b814045d34
- SHA512 ad05b11727db479e0f3f5fb55bf3d7449445299bb6a5669d736092591e69100c66b8bd87105dbc5bbb07e436fcd1bc7d2112a24d5eefb09344b451d4832f61a8
- SSDEEP 192:XWkspPIKfhig1/C5q8jgfi1jsgO7fpGmGoj6gs2oEhZnpHmzafqru9:GtpwKNsqj8jpmpGmGovy8ZpHmzafb
- TLSH T12F224BA73F2471829EC28E54B0CD9E339D70A2B67FD004956071D5596E977E63B2801F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/Update.exe_sig
- SHA256 5c0fc232811bd4ece9ea39953a735cf0ba1fabf662bb3934a95e357e5b90aa00
- MD5 acf2b1fc6cc32c0f68fdd82d34057219
- SHA1 874732cb50a254f6df921857fc34a9ab67ba3780
- SHA512 d79d907ecf12a88db98738050ed70308852afff4b91888e8ff40afc6cf541438fd4608679fedc0998859514c30845022416721538e9ffca8ad8134ef548afad8
- SSDEEP 384:1kEZsHLs6BPxh8E9VF0Ny8NhqakEZsHLwWPxh8E9VF0NyBCZk:81PxWEGbChPxWEvik
- TLSH T1D2922B66CB946C02ED669E4130E8D926AF30B681AEA0C5D3521DC0614BD5783BFFD2FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/Wireshark.exe_sig
- SHA256 cda36a63055529165b43848f924a24dca7acd3b7e15959d779523958515572ec
- MD5 fc1ee7bbf43e5993f1c09173fb16b84b
- SHA1 ae40f7eafed9b68f7d22bc4767adefc7932022ca
- SHA512 75f05440a76bb2fdaf4c71cfec24f341dd45fe775a04b732809d623cff48e5f8dfded9437230427a9efbee8a9a5b6a12165339e5259deb7d7ba591f42c625e89
- SSDEEP 192:8wpPIKfhig1/C5yFgfJm91hMeufH0JOqsmVgz28WhBqO47C:7pwKNs3JMhMeu8JN77hh/GC
- TLSH T1D71239972A2864839E878E9AB0C8D6765C7097F57BE508CA143894519FC6FE62F1802F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/brave.exe_sig
- SHA256 4dcfb5c7b9da7f878a7956f5ab9b960ba5a1bcc2017332126f9f06d721c52c2c
- MD5 8ac197d05cf6003662eb1e4971251f26
- SHA1 49a49a2b224f12e1ef97e122fbba0cf6d0d2c8d4
- SHA512 f51c238a15236d76051d8f6b8cb4e5cbc431205cdaeb31f05036457a0eaf71d96700644eb7bb5cd9a5ba66fa25b0f89dc49e7752174bc4327ab68a1680aa1e04
- SSDEEP 192:TNyby2sE9jBF6IYiYF84+noPOJB3SbruA7NPKChv2d5k7f:TNyb8E9VF6IYiTPxsaPpd5if
- TLSH T194222A678924AC15DE5B5F4035C89439AE31B78659D081E3332DC1528BC9B827BE92FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/chrome.exe_sig
- SHA256 a6489457e4400183689669f10bd99422fbe33c8edb5634d95dc29fbddbb96bc6
- MD5 0967f02ea1a40889029b7a97a8209039
- SHA1 b518777dff9c98d70fc3bed3b1b45dbcca534d1c
- SHA512 f36535bcdc6ceaa739e1f49f145b409112835034efad676d587698523c44208ef85028cf82c36621813e299616b992ffc102bb4e81c0463de4daaf186e7a73ac
- SSDEEP 192:XWBIYiYF8m/Ex72f63YLa0Dx+noPOJB3hy2sE9jBF0NyfVl9Wl:GBIYi6y33SIPxh8E9VF0NyfT9Wl
- TLSH T195225D6349645C06DD5BCE4070C89939BF70BAD299D0C2D3721EC1A18B957827BED2FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/clion64.exe_sig
- SHA256 c62780a92372a3588e1d34a99ad170f9624e38e464862a72152d089d41fd8c6c
- MD5 232c1582745dd72f27732fd5de9aa927
- SHA1 76ce659ee207f604d39cf33e5c8d215d8888387a
- SHA512 fcd3e579ad3e2ca8309508d59cd558c1ba991dc397030e71946bc5f83a1a89ccfea0db94cbd81f12a4b9443280e7eef01ff1ca997a39da33fa8857fedcfa1327
- SSDEEP 192:fcuIuJfjJFer3PNwsVwlfBCXPWHboVqsn8OYoTisEPKLKI//i64m/XB:fyunFWlwwwlJCe7oVqsZniPKOIim/XB
- TLSH T105322AE35E2CE4A2AE83CE14F5E45427ED33F9C5299874DAA109C4619CCA7F06E5B03D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/firefox.exe_sig
- SHA256 2cb7b1c22d6761b550869da0f425089d8f8edbdbd1bba45496731972be06b037
- MD5 9523458b4a3e35185893abb7e53044cb
- SHA1 c0fa39c14f0d18f61f06a18a6e3e6e418dffe955
- SHA512 ee080e789f256ce9f449d678788f83be0127e0844768d2365a5a3e6fb5a9241cd912c6a9c2c85f89e8ae5b7deb501c85fa21fa649c0dc536b5369896971876a4
- SSDEEP 192:M7x0KDWpH4AAANa3Gy2sE9jBF0NyQ+noPOJB36b2jTml0x:2vDG/t8E9VF0NyVPx6b2fml0x
- TLSH T1CD22096ACA506C52ED678E5171E8D8367FB1BB425BD5C0E3A22EC1508B817C277FC1AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/iVMS-4200.Framework.C.exe_sig
- SHA256 342a394bde1e61ed388250fb0caa8fb48d4d4dcacafc213e7920326a346cc223
- MD5 61f6fa235b921c9e750b53814ae12e95
- SHA1 89c5011661e6c433b4b1a3fedf0b4e5f6a545fba
- SHA512 44f868020f9554bb31c68c43ffa86f5d4e48b84a81c2bf6cabcacad282f3e6fe36efe3419fe6d2b0985bb18f541825c402cae68201e7ccab16d95b08324f5e6e
- SSDEEP 384:vMQqC/uDTrvVqGBkNl6bCIJWuFRTm4XWMQv/uDTrvVNWuFR9Y8JN77hhso:GPDVtkNlTOTk4rPDVNTL73heo
- TLSH T124A22ADB0F3E5403AFCADDCDE0C8D517ACB8A7C25CEE548B911B81592A483D23B9851E
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/idea64.exe_sig
- SHA256 ce6b2b57a700ad033194cd396b09c6dd43e022e01337e344cbcb2e18952eccd4
- MD5 f3fbe6c8de3d3759487a2fb588d17b5e
- SHA1 5bb4655f0884a32b7f062fd22de4d74ba10f100e
- SHA512 924fb0735daedd62728a9a7ea715bdc09be93868657133b74a507b252c4c7f998c161fdcfaf1bdd8249c5c049e301d998d59f7d80354097144892e3a5be429b4
- SSDEEP 192:ChuIuJfjJFer3PNwsVwlfBCXPWPZfcCU7TJWOYoTisEPKLKI//i64m/bv:ClunFWlwwwlJCeRf+7d/niPKOIim/bv
- TLSH T150323BE35E2CE0A26E83CE14F5E4542BFD33F9C52998748A6219C46198CA7F06E5B13D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/logi_crashpad_handler.exe_sig
- SHA256 f27da615a73ad1c35ae6ba0ae8190808920be2d0cff18345dce290002a7a63bc
- MD5 ca872e1deb83319d7a5ab55eb95281d5
- SHA1 025f87e746775f14462dbd523dece35e69046b49
- SHA512 ef20e16741c1529e55aa0ba7566daf9eceace09c7525607f0a8a81523fa793604be6790708a96205eb7bc8004fbf54154124206b218133b87f50b0c64bfff785
- SSDEEP 192:n2T3+4RyncO67CU5rR8IIYiYF8nHPTSofousUwNhMvU7lU6QJKXPgxw8Uu1:au4scj5rR8IIYiRSofousHMx6QJKX4xJ
- TLSH T129224CA64E141C65AD079F00B4CC8A3FAE71A2C66EC0958B700D44ED6F823A57F7C2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/obs64.exe_sig
- SHA256 47b6d2260b6ff378ac89890facb2f78e839858f5719fae832b5210182e7f8654
- MD5 b59b755ae675838c151632498739891c
- SHA1 f6c7bf8f63c218b6b5d5018f5b7ce2e7655ce116
- SHA512 8aecb12381858003a844b5884ebad00ccf6f538d34538676ec56e16bb23bb27f0062eb973d786da280dcb906221a02122ab99444d174785226dc0f3d446e85e0
- SSDEEP 192:kcmNyby2sE9jBF6IYiYF84+noPOJB3n07Fj2AAXBzFvnUJR/yu:kcmNyb8E9VF6IYiTPxnk6nBzhU/yu
- TLSH T139224B6289646C06EE5B8E4035D89539BE7573926ED081D3721EC1618B943833FED2FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/phpstorm64.exe_sig
- SHA256 4b2bb63abb71fcd79c579f4c4a1676f3236328bbef07a7cb3faee03dc19d2960
- MD5 a54ff09b1e539b2904998c6cd7922f7c
- SHA1 fef87ff35d8e9d9b52564bd58ccd18a6b7870221
- SHA512 de9e5c27acc3eb98bb1ec2a989625143d91f773494e98021538f03aede658bb5b30c2f01c0fb9d19d2b8187c0623e84a22ba19a7e7a89d43dcad5983d413bb24
- SSDEEP 192:LKuIuJfjJFer3PNwsVwlfBCXPWPv5QiUNPOYoTisEPKLKI//i64m/GS:LwunFWlwwwlJCeHqDMniPKOIim/GS
- TLSH T186324BE35F2CD4A26E83CF18F5D55527ED33B9C52A88649AA209C42198CA7F16F1F03D
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/rufus-3.21p.exe_sig
- SHA256 c2181866cf1c114a4c8910ab3f7d7a7e027dc0246ce58d6555ce0154a5a0d1a1
- MD5 bbdf221aeb679c6665dbedc1fcae51e1
- SHA1 6ce5bfe94b33e32d40e4ad32846caa6566c6a39b
- SHA512 ac51b78d7628a08c9fa9cfa1837f6597e1931a703438489d71a798a0570b960f352884db94132279fd79f6abd8274f426804e6263a9552fdc4c7738efa6d1a22
- SSDEEP 192:2qpPIKfhig1R7JNfVZCg2txKBysIsHfH0JOqsmVgz28WhBq7T:2qpwK3PVZAUksIsH8JN77hh+T
- TLSH T164123C9B1D3464435F878CAAB0C5EA774D70A3F0BE91488710799285CF8ABD72B5902F
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Signatures/steam.exe_sig
- SHA256 ee560220bc2252c7975a34d3729c71fb796107ba2b3eac935249ff70491c23be
- MD5 7863eb6ec9f67fba79fa05c5086bf626
- SHA1 3bdb11530312e9a2bf522cfb576f31a9adf59d27
- SHA512 73090fdfb8385ca7dc02f506fffbd386ce7003c0732894763c2d247d320bc5f596b9b34a01df06ce59c30865f38d71ee9d42800462028b52084e62189f56039b
- SSDEEP 192:XNyQDbnPvy2sE9jBF6IYiYF84+noPOJB3z7W76ub0R52p:XNyQH38E9VF6IYiTPxzIb0R4p
- TLSH T1A9324BA789642C06DE4B9D4171C8883ABF75BA425DD0C6E3621EC1618BD57C33BE82FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Sounds/connect.wav
- SHA256 fe881435f7cb3d6c9b3ab37476a11f8e5ac05b44a6d3acb07e9783e741a1b827
- MD5 821ecb39fdcdda2c09ace1cf0ff19030
- SHA1 7702857ee1ff9a85b1a6f5fb8166d37374ee2937
- SHA512 6cf91aca96a3e717652a27b923dcc61b28e378bc05d2c2cadb68ec5f7ab9616829624db1c6e53d595007b421ada7d9c4993ee7de5174dc814a7b922718fc2fd2
- SSDEEP 24576:3VrIwn80umnXehPNHdRsxDmOAnRG78AI0B8N6C:FrIwn80jXehF9RsxDgRGTI6jC
- TLSH T1BF1523EAB0B13778D3DEFA7601D14602019B40F6A75694827B9F8ABC3F0666E7317684
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Sounds/start.wav
- SHA256 f9dbd5d5f1ab056ec8e0ee9b982604dfdb698b59c6b80c22f09fbdead1b3772f
- MD5 74a82aa5b2e7b98f21ea2af20314eb22
- SHA1 678d4a3a46f9ed7c811a907685b31561257da96b
- SHA512 48a9c038579f9babcfb535f3341e63d09cfe6263af0f94d2549ef6aa5f64e21c17f74f5e5bf66f1b61ae6c6fc8af186af6ec9351be44192755b168984132db84
- SSDEEP 3072:esehIyF1Cf99v4jCnNiWBJJW7aBRgMX7fiwkEgmbIhpJXOgt2X:ep2yF1QnQjDoJJeMX7axEgn17G
- TLSH T1FFC45093F641C911C81A5E3A8D63EFA54732BC2AFF1A571730847B1E6DB32C25E216D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/Stub/Client.exe
- SHA256 ee4136ff988be4e6ab60fd65feb00f0d5a8700d05270dffdc6631857fd70e3a4
- MD5 f7ab54f4bf5dc6bac5f8c830395368c4
- SHA1 3252aee445b72bae1e55663e028263c448524e17
- SHA512 7b1d0a4fb261b1ce4975b0aab32a342de547bbc2c145a44f9ec2608b2d5fc411c880ac0eb204724f89984403c29bf087f7ab9bc382762536d3e8bbfc845c0aab
- SSDEEP 1536:6ARdnFqJFsjl37HGwnvSs/hH7fbHHbDLspjB:BRdnFqwl3RJH7fbHHbDyt
- TLSH T16973294837D80F16C2ED8ABC6021475C8B30E5578553EB8FEDD7A0E919227E45A06FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Liberium premium 1.8/Stub/Dropper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d911dbf9f7d1d28767982bd41f008be7599eb7957103d160f2c167ed4a326076
- MD5 a1ea2f07f2dc8ad979b8079c51415da8
- SHA1 a0d5322c26584760d9d909a38e28947e6b0985ae
- SHA512 c496e73b76c77699f58841966268027f87213b04b574bf1594e646f9b44fa685f37a3a88ffcf6bac7cc693af4636130f0d217460a0027ddcfc5e4dbfbb9693de
- SSDEEP 192:pe9suPhKz/riCfgy4m4ZUlEw4NIUFVeDxQc:pe9LPhK6sgyr4zq0Ve9Q
- TLSH T12512E808B3E88723F6FF8A766C7393108676B6524875DA0F1CCD604A5D236844A93FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Dropper\obj\Release\Dropper.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Stub/Joiner.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a248aedd9cdb926a314b6009699acd72f8da9b1466e40166ddd46578fee5fb12
- MD5 4c7cdf0b583d91860b0d52289d27413f
- SHA1 c8316c1839d840f1f7eb965446f21dc49e748062
- SHA512 bf8fa3b1a5fa4c818c0d49ca0d2394c1e570b1ea3b7ca6c5dd794b2498f1e8f29ebbaaab2fce5bf8fca4e452cc5701ee388238bc6431bd2576fa7ffa09897297
- SSDEEP 96:Tyaokhdy6HgUmifHAsqZQDorXJ4u7Gp5mzllYBtfwZV3jFCqGFItz7q0bVUxYvzj:dphYgU+MD2u7aylytIZtjF+ItxVUK5
- TLSH T15C12F740F7E48671E5BF4FB56C3B03204AB2B7534A61E61D1CCA314FB8336A64A53EA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Stubs\Joiner\obj\Release\Joiner.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Stub/KeyLogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5f6541620ae96d7b63f75ab1075e8ed966332410e592afe4770cb52f06859dea
- MD5 62502d6b0ff9c498cefe89e7922ad87d
- SHA1 d6130ce51de902132f4e093c77d265c8a4c25717
- SHA512 b04a67a3ae891690a342c6318cb9570948700babfa66c47a0668a58611d9e49263ec868cfaa866043546da53639caaf6362e4652f1d9fdeee9ee16cfdffd46c2
- SSDEEP 192:7duMewJ5Gr9RDaOvNs5AkxHblRYWG1v0dz6HVNbCbKy:leM5GWOFUXhbLY7szYV5CbK
- TLSH T1CF32F604BFE44525CABF5A3485B317001BB2E31A5C37D78F28DE020F5E6BB454662BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\leb 1.8\Stubs\KeyLogger\obj\Release\KeyLogger.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Stub/MBR.exe
- IMPHASH dc7a43a2525620cbdd4ca7a5ec347adb
- SHA256 13db59047310847b7b26436a401b1e1827b9600b5331ef04400659b3baf59243
- MD5 abfcdebd29f937a9327dbeca400c7f02
- SHA1 b477253ea0fa8a3662a977cc22a52a7ce4de9efe
- SHA512 fb9a183b7dc8129aa8f4acdc22ab55dc64df59e20b3781e801fd1ac03e12bb344c53ab26e1400c07a3cccb09caecddb76f5ab8faca3cd58cc2195afe6cba6682
- TLSH T18151FE8FC9EA9CE2C1D88BB20BCBC629F87B053487C3F5002EE10755C430AB56525785
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
ExitWindowsEx
kernel32
WriteFile
CloseHandle
CreateFileA
ExitProcess
ntdll
RtlAdjustPrivilege
Name
.text
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
280B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=20, id=19, version=8078,
count=1, id=18, version=8444,
Liberium premium 1.8/Stub/UserMode.obf.dll
- IMPHASH 6dbf95d81ab0cb2039f47259ddec333f
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameA
GetModuleHandleA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.0Dev
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=133, id=261, version=27412,
count=15, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=3, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=7, id=265, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Liberium premium 1.8/Stub/Winlocker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a0aee361aa97edd4efbaeeb07a2d995626101eead6a86377d463cf2efe736a82
- MD5 4ddb582636318a6e85eaab09ca75c9b0
- SHA1 4c148a5d01e2419ad6c80346b863fa6068d9bb01
- SHA512 08ad3566bd34dc3402210d2c31c52f55a3107c451d7babe3075e11a682ff528f65622e21e17d5022a097d15c0e8c6dabeccb77465493131cc40037ee2b9b4de2
- SSDEEP 384:8WOAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDSfolob0K4ZEOwykj6eRD6ap/:vOQEc+cDTlShob0lUD6aZ
- TLSH T138E2224033FD1D2BDB39D6F50276192D43F795561411E7E92CCAA9CB08EAF400A94EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Winlocker-main\Winlocker\obj\Release\Winlocker.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Stub/WinlockerBulid.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d6496ba25229251c710efb3e6480961087f1e19dcb1fc00e9747db5d0b90ae9
- MD5 58e75ce421a3522e95c73da8a5d2a077
- SHA1 72744b32aab206bf1f8d98f062584aa6a14848fc
- SHA512 606c70bfaab7556d5b5285efcd95c0b94d1600cb8df05cd2b85962ef54c6c12a501b6de152c472c9964729eac8e2ded540a983fb27d2d12cc3276d51b2f92f25
- SSDEEP 384:hWupqAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDjoopehMff3F15hg7CZEOwY:orQEc+cDTlSPoopeiNhY6UFAT
- TLSH T19DE2328133FD1C2BDB39D6F502361A2913F7955A1811E7E91CCAE9CB14EEF400694EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/System.Data.SQLite.EF6.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 857a287f7f39097c2f70ff0ce681d35196daee60b43f255bc72b842a351208c4
- MD5 6f69454f7206eb6fb00b1f15d13718d9
- SHA1 c1472ad5c91da5e729bf419b8546657b2152915c
- SHA512 27c193cb2d25938bc508312c38932a25d63a8ecf49c9af6ad2819d1291f44f2b4435725dfef2dded2e0f3415aa73c8af276084899302f8b196a993dde85ae095
- SSDEEP 3072:9Nh7rnOCmxzBE91M+I1X+IZ/6KP8czmLhL:9b7Zmx1E91AuQ6KP8c
- TLSH T1A2149725B3F09D31C1AA023029B57418ADF082F3737C5198FE9E63AD9F6A91117B7B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
bb:d8:c5:bb:bd:68:c2:c0:c5:da:67:9a:6b:8a:d7:01:1e:85:69:bb:87:83:c5:eb:ac:08:54:90:1c:cc:77:c5:dd:1c:f9:a5:45:39:35:fc:bf:dc:3b:f8:4a:f7:d6:7f:6a:de:c3:1a:f6:8a:98:da:9a:45:63:66:b7:1e:a6:81
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
99:65:26:d7:c9:e8:76:61:13:07:44:be:3f:37:0f:19:ae:9f:33:c1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
190322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.EF6.2015\Release\System.Data.SQLite.EF6.pdb
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/System.Data.SQLite.Linq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4fa3cc89f5c3cfa0f794c1f849b0ea8d081e5c0e69d7fb2d834caed08d1140c0
- MD5 bbb0d3ddaaba530dc111e665a4891217
- SHA1 cea5a71ff0305083a9add3c4755a8e54ab10f869
- SHA512 ebf248bb57355de887770d91ea2b40a98e0760335a57dc6ea92ab89e65177cae95eb1c08116855c8eeeca81d4022ccdde2fca7cf34fad68b4ff0e14b74c93b89
- SSDEEP 3072:0Nh7rny2puIm199zIsd9IZ16KP8cfYLcgML3:0b7G2wbdLm6KP8cwO
- TLSH T13E14B725B3F09E31C16B023028B57458ADB082F3737D5188FE9E63AD9F6A91117B7B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
19:74:b5:53:55:33:c4:62:97:af:ea:b8:18:02:ef:ac:98:60:8a:00:c6:b1:1a:48:ec:49:45:ee:07:93:1e:87:b9:79:5d:16:76:f8:74:aa:98:f0:20:16:38:f5:a9:fd:d8:f2:d2:8c:b2:30:38:e0:4b:aa:af:f5:25:1b:6a:68
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3f:8f:87:1d:f5:4f:a3:52:19:ab:82:91:cb:f5:8d:99:1b:51:70:a9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
190166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/System.Data.SQLite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d
- MD5 55c797383dbbbfe93c0fe3215b99b8ec
- SHA1 1b089157f3d8ae64c62ea15cdad3d82eafa1df4b
- SHA512 648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757
- SSDEEP 12288:5vXCrbE724yjK3r/fFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchs:h8dDm3r/7
- TLSH T122845BA423EC2A19E1FF5774E8F068408B70F452ABAAD31D78C054A92D27B41BD537B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
05:b0:4c:75:7e:c1:9a:ea:48:df:6d:68:e0:4d:83:26:82:55:53:44:03:4c:b5:c4:a4:4b:e3:30:86:b0:60:d1:96:8a:ea:ad:83:0d:9a:a0:c3:3c:22:b7:20:3b:53:c0:84:d9:51:b4:e2:25:84:29:24:67:99:5b:0c:9e:f9:8e
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
12:d6:a7:c7:d7:cf:38:0e:4e:bf:20:38:8e:19:b5:11:95:ce:5d:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
381862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/System.Data.SqlClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d81f4a40b0cd8a28ea552d935ff8a7b86f70d746bd969ae9b3a783a5c8e6546f
- MD5 2cf3623600d7948d2d3b2ec51a75022b
- SHA1 d00c8be9945b6fbd22929dd0e666799cf0670673
- SHA512 1dbe67568aefdd9e3d85117b54ab6062efa15f2f2526f9e9c6e78c295bf4e873d2a7066c53b3c5fddbfe8446fb636c29a9bbef5d768aa7290c39ee6ae24da825
- SSDEEP 6144:XXFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFQ:HFRf60FhFoFmF8cjcsc4FEFbFgcbFmFQ
- TLSH T17324962433E4369DF9BB3272757B1412A639A2926112D8BE7C8C404F87B3D7551B3F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f9:51:1e:09:e5:65:c5:36:26:ca:16:1f:05:b9:9d:ea:a6:44:d8:1b:de:89:06:85:57:04:1e:0e:41:0e:a6:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 16, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F7A6-E251-150A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:59:9f:fc:7e:5f:2c:ea:f2:43:00:00:00:00:01:59
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
218902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Data.SqlClient/net461-Windows_NT-Release/System.Data.SqlClient.pdb
mscoree
_CorDllMain
Name
.text
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- TLSH T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
26694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- TLSH T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
15:1f:de:b6:f3:56:f1:80:ad:c0:ff:4f:a8:55:41:ad:fa:07:51:b3:2c:1f:9e:57:30:1f:5d:fa:af:6c:1b:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:60BC-E383-2635,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:26:df:ba:4b:22:b9:82:82:07:00:00:00:00:01:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
14422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/WinFormAnimation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9052729b560d819c8d75149b6ca92c48b9e1b1b0ccaa50080a74166db8eaa12
- MD5 16b35ccfcf3e6e97e182d033cb7bb748
- SHA1 dadae07416824b194557ad182546e4faf5775d0f
- SHA512 b652c2eea4ca9da97db7660b8ea3dd43d045f1d0a7302b0d7ec6b09720ff242e8e03401cedb854fe1198f5ebf5d043502ef91ca8cfe03e27d8cb223b34ba5eb7
- SSDEEP 768:LkKguW2jU37VjIOsCF6sxx2trIOvwZw094wM8roBknl+8m3uPezhW:8FljVswHgV4oanlbm+24
- TLSH T1B503082907BCD67AC6AD457DA0C6451087F0D94E3C43C79A6E4CD0F9FD1A7A906823EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Personal\Open-Source Projects\WinFormAnimation\WinFormAnimation[master]\WinFormAnimation\obj\Release\net4\WinFormAnimation.pdb
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bdb84aa16678189510def7c589851f6ea15e60ff977ea4c7c8c156504e6ac0ff
- MD5 3d913aab7b1c514502c6a232e37d470e
- SHA1 28ac2d1519ec5ea58b81fe40777645acc043b349
- SHA512 311e8f73c52dd65cbaf9f6e008b3231090ea99edf3471bac63cca4156a37a0d874ac590b19c01b15e05345bb6a5b636a11698bbd4e88c59c138dd3f358800027
- SSDEEP 24576:2gW20arTgWkk7z2B3Kqwf11Ot9Awr89Iv7f+NGGL:XC3o4swrY
- TLSH T105456C1177EC9BB7E0EE4737E8320A5807F2D5066693EB4F5610ABA96C833589D013B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1182782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium premium 1.8/local/Bulider.json
- SHA256 b8757b7b74a4b6f2b9df6744ae2f2ea15abff0f3d29ed06ce02e1e1a39117128
- MD5 c3a02d6944c0049a2a67da74582d6bbb
- SHA1 b699dc17b7556332559947e9100f268f4db821d5
- SHA512 dd2b3c184b38c1e89d45200aae17877c64bcbe5d2325055d38f4ccdc2ae704135d3efaf39f746ddf9790fbe21818aae5075a6beb799d4ed8b3746bab78de2c75
- SSDEEP 96:L5C/lETxqbHwZvhQkvKI/O7B4uXlARFNFk8qiF28+IyEBo/1NR61nvn1cBgx4aSl:L2IyWvhfK0O7ahnR28Ep/Vanf1bBWdTh
- TLSH T1F4E14D76D8414D3D76F0099CC00A5A477ED92FCB5022ACA7F5FBAD0AB22523568BDF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/local/Miner.json
- SHA256 95ffcbc49aa464484825392c1c7d5002791e5a3772046195b1318fdde049975d
- MD5 6ae6cf6aa0cc5d29d7082e3a40c6834e
- SHA1 71d7a8ad00b087a3f220ff6b16031c081f61c2ce
- SHA512 0742ee0435a494cc20c3dc1af56f616356f635e08e9b7814a93d2179cd8b6ffc53b96b2696e430035d179684e56d0d711cb9339f31c57194f360d8dc5586df51
- TLSH T182B09231E84400BFB0B42509E09AC20B63804FB124312D13F0FF50183232C243040FC8
- MD5 SHA1 SHA512 TLSH
Liberium premium 1.8/local/Settings.json
- SHA256 c32a87af95d53060e9a012857374dd2d9238310cdf4a2cf7209ca30e5a772a7c
- MD5 ea78bd58713a03057c6f8976f69f6155
- SHA1 6b1d690dcfa841752bbaf010d56a625e8a05fb6c
- SHA512 0e70b3aab3b24fd5c451888a4f4f1d6c21c6a820a6267f0687210a14dae2f87d2727dc052d7a8fe007160c55ff0c2d2568842809fb3f3de321c4c5bc883bf86b
- TLSH T143E0D83D271051FEB7628627C10E7E475B749AA1330A3811F5874E7570E37D612748D3
- MD5 SHA1 SHA512 TLSH
Liberium premium 1.8/local/Tasks.json
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
Liberium premium 1.8/local/temp.ico
- SHA256 8519778606993d46892a2d2ff7dc31e12bef435f91d6fbe8c1050f4becd891c6
- MD5 07f3abe85575d1be490eaf49c2d18585
- SHA1 b7179d8b0fa4cf4ed657202d36167f249aaf9224
- SHA512 9e0c082ff9793bb905c56d2a74e8dc9fb6db9baf350fa515475ab1b3cc714c9caee9e810ba7a637c1f9c251151e1be63e80efcb6ea89d604873fcb482798aeb7
- SSDEEP 96:rmdVM1rQmjgR/fjsfxQYXLiHA0AhBLZeb0xeH1mf+r6Kxl3TF:r/8hg5OgHYgxamK6CTF
- TLSH T122A12910A7D0D469D90E5938780B8EF70CA6AC9628007B57567DEC8F7CF06240F6E9AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/res/screamer1.gif
- SHA256 1c89432367e998e79d727aaf75a6e75038190612277a14b5eadcf84f33062fac
- MD5 f6269f614dd75e8aa8e8eb6128c538e6
- SHA1 9f7a73817eec6a7c2768716127bf5d8da15d26d8
- SHA512 f38a1c14898a03f985befd9990fec1295cddf95adf93cfbc7f31e3176824af900e5f7d36a365b6b7e649a53900c018c083a0cbd09d33a4e7e84d790b4af3ad57
- SSDEEP 12288:rBcSIXM3hWFA4a+ZVkYS0q3++Uu1UoEaRQoL+mWKzjpYGZMLp0t9ygkCJ92ehA:rH5hWFA90tSHpU4UopRQoLfLy2t9IaBA
- TLSH T105E42377ACA90415DB77FEBA47C97F501067AEA0B1612836BC6A9FB2A103AC54CCC5C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/res/screamer2.gif
- SHA256 2e3ae0be44105fd6f6c936dcd00e0c83c5f255c87dfffe6b86d070f147a4d6c3
- MD5 afc20646ce6e6dc09cba83d3166f7c7f
- SHA1 8b3c13ce12b970246de0d60f1913fd3a3ca58f54
- SHA512 fe363ced7cde686f54b63e96d8184e2fbbd2ac00a7854e9b8ea2159997774fcf538e4b5bd2d2eb7ec32f6a6a0fe29b3ce95c57a9026a0806c7e3d7e5dc9264d4
- SSDEEP 24576:r7ZAuMlrXtfVbYmBHjrZNU2jFqZwDc7SAIr0HE7L0YgpN5XeCEyGo:nOuerXtVbl5jrfpqZwc7ymhpmCEyGo
- TLSH T11945331C863492510D7E347CB1DE6EA661950CAAEDE2747311EEFE0D3B09A7F8CC15A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/res/screamer3.gif
- SHA256 33ab9db3bb28718cb5482a2d52bdfae1d8f7ea721e4d5a7ba2bd24ae6178753d
- MD5 638ba268153efb84e1d3bde0bf31491c
- SHA1 14fff5d08eeec580f7f106422cfb9ffe1a0c4a1c
- SHA512 4fc0bbf01eb0a8c758c0c0dc9acb9d45ba43df67fe320fa30982c325522adbb2be4cbae877a9bddbe87a9a9814ab287f770d462e2c321283eca3032749a936d5
- SSDEEP 49152:8lGDq3lGDq3lGDq3lGDN3lGDqxlGDQ3lGDN3lGDq3lGDq3lGDU:8lGe3lGe3lGe3lG53lGexlG03lG53lG0
- TLSH T1DF9522DAC68B4E4B8436777D710DC48960725A009B2C5BF8A7F25ACD437A6EBEDB3410
- MD5 SHA1 SHA512 SSDEEP TLSH
Liberium premium 1.8/x64/SQLite.Interop.dll
- IMPHASH a42f73521c784fa06f1d886fcbcefcba
- SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
- MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
- SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
- SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
- SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
- TLSH T154858D4AB3B8019DD567C17DC6675B07EBB174022310ABDB17A08AAA2F13FE5177E324
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
6140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WriteConsoleW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
AreFileApisANSI
SetEnvironmentVariableA
RaiseException
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI013768ea228eaf06
SI03ee1370ff2172fd
SI050169b0f137dcac
SI061f9351f6b79d40
SI066df4a47deb7b95
SI075258fe7332f5c9
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0b65268e19d3b81d
SI0e7c9abcb195c68c
SI0f556a49067bf550
SI0fe7fecb92f1b44b
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI15d5f41c81892f13
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI24f5c83eaddd65e8
SI252aeb4a9d3dc2ff
SI2b074e8cf29cb472
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI349980d776ee39ac
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3974af1f94b94613
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI57335d3e329eea8d
SI5887bf867911838d
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI64119fb980b7e962
SI6479b9cf07b87f67
SI674c3bc07fc17979
SI6901b186cfd089f2
SI690ffdcfd9cda629
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI6e6c544c028b2de9
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI72b05b1ad5f34d61
SI75fe921d50a95fe0
SI768767362ea03a94
SI77ffe3fede90bfbb
SI783104ea11038afc
SI79f6c64948ab63d2
SI7a4943591207dd14
SI7b97ee05aa1e64c7
SI7c373366af3ee2f7
SI7cd7250399b1ea60
SI7da3b9691a73b4a2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8dd2c969f2a6a31e
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9bf461db9bf83c22
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SI9ea49276dcf9849f
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa1d7e21a548b910c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIa8e1a742a358dc07
SIa9b758d3ae2e9aea
SIab3ed5feb3c43f0c
SIada7f27769d7f95b
SIae9562605f0b7c06
SIb391996b7b633820
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIb84ee16d149e7562
SIb94a6bc97d77e69f
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc0bb4eab77f5a999
SIc21d402df09e0c69
SIc26100c97b176329
SIc28b5d2d1f102994
SIc2d8715ee8c9e908
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIc5d5610a73781fac
SIc8c63d94dd03040b
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd2334250b08e199
SIcd6b4ac0aeff7202
SId00f524badf4f5cf
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdbbe1b52f304f379
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIdca7c218fe9393fb
SIde347320a2d725fa
SIdeb28053ce71d5b4
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe2cb515ade8c0235
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIeea5cda6d9846aa5
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8090240c1414098
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfcfad09d1b0a60ec
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
263KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=128, id=243, version=40116,
count=37, id=242, version=40116,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=16, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=153, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Liberium premium 1.8/x86/SQLite.Interop.dll
- IMPHASH 39ace63b362beb47a2a7a8202a5c4f2d
- SHA256 83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae
- MD5 8be215abf1f36aa3d23555a671e7e3be
- SHA1 547d59580b7843f90aaca238012a8a0c886330e6
- SHA512 38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b
- SSDEEP 24576:eiDAYMz2epP8AEXn8z7qsyb8c+gntHKuvKtBLtTvD0nsrFSK96fYlYyv:1AYMza36enEuyjpTV96A2yv
- TLSH T1D5558C26FA8390A1EDD610B592FE6FB76C3D120A431808E7E3A41CB55A601D3767E74F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
5844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
WriteConsoleW
lstrcmpiW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableA
AreFileApisANSI
DecodePointer
SetStdHandle
RaiseException
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI03ee1370ff2172fd
SI066df4a47deb7b95
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0e7c9abcb195c68c
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI252aeb4a9d3dc2ff
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI674c3bc07fc17979
SI6901b186cfd089f2
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI75fe921d50a95fe0
SI768767362ea03a94
SI783104ea11038afc
SI79f6c64948ab63d2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIae9562605f0b7c06
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc26100c97b176329
SIc28b5d2d1f102994
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd6b4ac0aeff7202
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIde347320a2d725fa
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
_SI013768ea228eaf06@8
_SI050169b0f137dcac@12
_SI061f9351f6b79d40@8
_SI075258fe7332f5c9@0
_SI0b65268e19d3b81d@12
_SI0f556a49067bf550@8
_SI0fe7fecb92f1b44b@12
_SI15d5f41c81892f13@8
_SI24f5c83eaddd65e8@4
_SI2b074e8cf29cb472@16
_SI349980d776ee39ac@12
_SI3974af1f94b94613@12
_SI57335d3e329eea8d@12
_SI5887bf867911838d@12
_SI64119fb980b7e962@12
_SI6479b9cf07b87f67@8
_SI690ffdcfd9cda629@8
_SI6e6c544c028b2de9@4
_SI72b05b1ad5f34d61@12
_SI77ffe3fede90bfbb@32
_SI7a4943591207dd14@4
_SI7b97ee05aa1e64c7@12
_SI7c373366af3ee2f7@4
_SI7cd7250399b1ea60@4
_SI7da3b9691a73b4a2@12
_SI8dd2c969f2a6a31e@12
_SI9bf461db9bf83c22@8
_SI9ea49276dcf9849f@12
_SIa1d7e21a548b910c@4
_SIa8e1a742a358dc07@8
_SIa9b758d3ae2e9aea@12
_SIab3ed5feb3c43f0c@0
_SIada7f27769d7f95b@4
_SIb391996b7b633820@36
_SIb84ee16d149e7562@12
_SIb94a6bc97d77e69f@8
_SIc0bb4eab77f5a999@20
_SIc21d402df09e0c69@8
_SIc2d8715ee8c9e908@4
_SIc5d5610a73781fac@12
_SIc8c63d94dd03040b@44
_SIcd2334250b08e199@112
_SId00f524badf4f5cf@20
_SIdbbe1b52f304f379@4
_SIdca7c218fe9393fb@24
_SIdeb28053ce71d5b4@12
_SIe2cb515ade8c0235@12
_SIeea5cda6d9846aa5@12
_SIf8090240c1414098@4
_SIfcfad09d1b0a60ec@20
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=241, version=40116,
count=128, id=243, version=40116,
count=39, id=242, version=40116,
count=23, id=259, version=24123,
count=22, id=261, version=24123,
count=15, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=152, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,